ff, r0, 0x80000)
setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8)
syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00')
fcntl$setstatus(r1, 0x4, 0x6000)
mq_open(&(0x7f0000000800)=':em1\x00', 0x40, 0x4, &(0x7f0000000840)={0x4000000000000000, 0x0, 0x9, 0x0, 0x0, 0xff, 0x7})
pwritev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000c00)}], 0x1, 0x0)
ioctl$DRM_IOCTL_AGP_ALLOC(r6, 0xc0206434, &(0x7f0000000440)={0x9dca, <r7=>0x0, 0x10002, 0x4})
ioctl$DRM_IOCTL_AGP_BIND(r5, 0x40106436, &(0x7f00000004c0)={r7, 0x676})
ioctl$sock_ifreq(r5, 0x8917, &(0x7f0000000300)={'lo\x00', @ifru_data=&(0x7f00000001c0)="16e667ea25efad95e8e866bb6ef7f6ba94b72b63a28bcb7eafa978bdbe09a4d8"})
getsockopt$inet_int(r4, 0x0, 0x0, &(0x7f0000000600), &(0x7f0000000640)=0x4)
getsockname$unix(r1, &(0x7f0000000680), &(0x7f0000000700)=0x6e)

2018/03/30 13:05:53 executing program 6:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYBLOB="22811e2630b1d0ac3463"], 0x1)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r1, r2, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = getpgid(0xffffffffffffffff)
syz_open_procfs(r3, &(0x7f00000005c0)='net/ip6_tables_targets\x00')
process_vm_writev(r3, &(0x7f0000000180)=[{&(0x7f0000000140)=""/22, 0x16}], 0x1, &(0x7f00000003c0)=[{&(0x7f0000000740)=""/173, 0xad}], 0x1, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
r4 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
r5 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
r6 = dup3(0xffffffffffffffff, r0, 0x0)
setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8)
syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00')
sendmsg$IPVS_CMD_NEW_DEST(r6, &(0x7f0000000540)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x2000400}, 0xc, &(0x7f0000000500)={&(0x7f0000000240)=ANY=[@ANYPTR], 0x1}, 0x1, 0x0, 0x0, 0x10}, 0x4)
fcntl$setstatus(r1, 0x4, 0x6000)
mq_open(&(0x7f0000000800)=':em1\x00', 0x40, 0x4, &(0x7f0000000840)={0x4000000000000000, 0x0, 0x9, 0x6, 0x0, 0x0, 0x7})
pwritev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000c00)}], 0x1, 0x0)
ioctl$DRM_IOCTL_AGP_ALLOC(r6, 0xc0206434, &(0x7f0000000440)={0x9dca, <r7=>0x0, 0x10002, 0x4})
ioctl$DRM_IOCTL_AGP_BIND(r5, 0x40106436, &(0x7f00000004c0)={r7, 0x676})
ioctl$sock_ifreq(r5, 0x8917, &(0x7f0000000300)={'lo\x00', @ifru_data=&(0x7f00000001c0)="16e667ea25efad95e8e866bb6ef7f6ba94b72b63a28bcb7eafa978bdbe09a4d8"})
getsockopt$inet_int(r4, 0x0, 0x0, &(0x7f0000000600), &(0x7f0000000640)=0x4)
getsockname$unix(r1, &(0x7f0000000680), &(0x7f0000000700)=0x6e)

2018/03/30 13:05:53 executing program 4:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
r1 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000002880)='/selinux/avc/cache_stats\x00', 0x0, 0x0)
ioctl$EVIOCSABS20(r1, 0x401845e0, &(0x7f00000028c0)={0x1000, 0x7fff, 0x1ff, 0xffffffff, 0x7, 0x40})
fchdir(r0)
r2 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(r2, &(0x7f0000000080)=ANY=[@ANYBLOB="00811e2630b1d0ac3463"], 0x1)
setsockopt$packet_add_memb(r2, 0x107, 0x1, &(0x7f0000002900)={0x0, 0x1, 0x6}, 0x10)
r3 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r2, r3, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r3, 0x0)
inotify_init1(0x800)
ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
r4 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
setns(r3, 0x8000000)
r5 = socket$nl_xfrm(0x10, 0x3, 0x6)
r6 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
dup3(r3, r0, 0x80000)
setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8)
r7 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00')
sendmsg$IPVS_CMD_NEW_DEST(0xffffffffffffffff, &(0x7f0000000540)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x2000400}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)=ANY=[@ANYBLOB=',\x00\x00\x00'], 0x1}, 0x1, 0x0, 0x0, 0x10}, 0x4)
sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10}, 0xc, &(0x7f0000000340)={&(0x7f0000000480)=ANY=[@ANYBLOB='H\x00\x00\x00'], 0x1}, 0x1}, 0x0)
sendmsg$IPVS_CMD_GET_DEST(r2, &(0x7f0000000880)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f00000005c0)={&(0x7f0000000740)={0x138, r7, 0x208, 0x70bd2b, 0x25dfdbfb, {0x8}, [@IPVS_CMD_ATTR_SERVICE={0x28, 0x1, [@IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@multicast2=0xe0000002}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x3}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x7fff}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x8c6}, @IPVS_CMD_ATTR_DAEMON={0x50, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @remote={0xac, 0x14, 0x14, 0xbb}}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x400}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x10001}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'syz_tun\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x6}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x2}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x30, 0x2, [@IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x2}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv6=@ipv4={[], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0xffffffff}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0xafa6}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x1}, @IPVS_CMD_ATTR_DEST={0x6c, 0x2, [@IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x7}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv4=@remote={0xac, 0x14, 0x14, 0xbb}}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x8}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x1}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x5}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x3}, @IPVS_DEST_ATTR_PORT={0x8, 0x2, 0x4e22}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv6=@mcast2={0xff, 0x2, [], 0x1}}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x10000}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x701a3921}]}]}, 0x138}, 0x1, 0x0, 0x0, 0x90}, 0x4)
fcntl$setstatus(r2, 0x4, 0x6000)
setsockopt$sock_linger(r4, 0x1, 0xd, &(0x7f00000008c0)={0x1, 0x2}, 0x8)
pwritev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000c00)="cfb93447d6feaef9f73c0561e075a8295d43017ab1a157786dcda36c5eec92a4306f284fa7e3ed364cc2da5c08cf7e4030d394520e123eee6d9ab275c91c174b1364fc943b49faefe12f605b5ce6c1400a91210c00477f900aff390901bf594c18557cb38a7d57ac8ded098b96b9dfc125e3bdc9305193f4cd256068baca5208160d820b9e7a043666ba4801cf6d557fc0f97f35c13ec6c0d1fe97ce1af1c17078ef47ab955200836671e402717481d14936b09828fd6f55fda2f11eb4c61b480e941133c0a4c5ec54033d0d174742191754ffe28b093596286a78ea01078337ada8585aa98dcc1143689002e31ccc5b9f5cfd2bbce5683a0f91b395391a60ba8e8f4d3c10c82c71caa74c44c8b0f3e42f1fc264497d5b9dabf309bad7bd", 0x11e}], 0x1, 0x0)
sendmmsg(r5, &(0x7f00000027c0)=[{{0x0, 0x0, &(0x7f0000000a00)=[{&(0x7f0000000900)="913da470640ae70fe168a71ad316e5525ce43547f28d8c56cb5cd246950c2d44a514698b3aebf2b60d933814378b0b9b750dec28bdbeedda6c8af5f3418ff8c43701e5dea492428ecdcf0e8c2a19f60e388b478179256834360c5ee359dbe4fabee36883a8314f0ea64dea3a732dffbe26a02e8327a0f7174a6990389e5b608d5300c271f26b3b37cc88e720a477e5f1aa2751af90d35d72606ac73f72dab39aad418a6335d44c785ba83edc9619a3221ae39ef2fed1657e426fa293a739cd779a6c645b3d29bb184041476e8e6e737e5fa1c4312360", 0xd6}], 0x1, 0x0, 0x0, 0x8000}, 0x3f}, {{&(0x7f0000002240)=@nl=@unspec, 0x80, &(0x7f0000002680)=[{&(0x7f00000022c0)="756a6b1895d55b0b292a3985cd35f28cfa8d5ab20a3448791e47ec9e971be82f993ebd55ec843a76ccd644a71222e57119e6f8866f59ba0b89c4cf71a9ce853f72bd99ac9097baf924ea3e3fbceaf0a0df15deb45ae757832bec56c67c0ad44e0ea5fcbc12f898989e1773427ad180efff1044e98613dab446587dd52a0deacb4074e01d97cd46c6e633ae1c1011fd2123c766e6fea028799cf82a562bd9d52c544241172f684398ac1b", 0xaa}, {&(0x7f0000002440)="c802b7c29c92c7ddcf8b11133e071ae83e8c0b0827764303ad44356d381633ce1fdd31e1641872e8d6b4c1a974d97d", 0x2f}, {&(0x7f0000002540)="446c9b3779f2a3dc39f3a3541d912b01ca9865e4172a83cda910f6b10dd97377212eb5279c", 0x25}], 0x3, &(0x7f0000002700)=[{0x80, 0x10f, 0x200, "4f483406ed4a2e47550522989e031e3e239b59c5dc988744d266f33171b6d4a8e54f025a1e1be02c21ad9675e29aea96625352eec0db268e5c70b8e22a2bb0e11b9e6d9613d4e8e338194d9a41821db1ef97a16b16e5263d008bb6ce86b1e26f4d59926a9a72bed62192dc96"}], 0x80, 0x800}, 0x1200000}], 0x2, 0x20040000)
sendmsg$IPVS_CMD_DEL_DAEMON(r2, &(0x7f0000000280)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000240)={&(0x7f0000000180)={0x28, 0x0, 0xb30, 0x0, 0x25dfdbfc, {0xa}, [@IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x3ff}, @IPVS_CMD_ATTR_SERVICE={0xc, 0x1, [@IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8}]}]}, 0x28}, 0x1}, 0x0)
ioctl$sock_ifreq(r6, 0x8917, &(0x7f0000000300)={'lo\x00', @ifru_data=&(0x7f00000001c0)="16e667ea25efad95e8e866bb6ef7f6ba94b72b63a28bcb7eafa978bdbe09a4d8"})
getsockopt$inet_int(r4, 0x0, 0x0, &(0x7f0000000600), &(0x7f0000000640)=0x4)
getsockname$unix(r2, &(0x7f0000000680), &(0x7f0000000700)=0x6e)

2018/03/30 13:05:53 executing program 7:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x0)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYBLOB="22811e2630b1d0ac3463"], 0x1)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r1, r2, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = getpgid(0xffffffffffffffff)
syz_open_procfs(r3, &(0x7f00000005c0)='net/ip6_tables_targets\x00')
process_vm_writev(r3, &(0x7f0000000180)=[{&(0x7f0000000140)=""/22, 0x16}], 0x1, &(0x7f00000003c0)=[{&(0x7f0000000740)=""/173, 0xad}], 0x1, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
r4 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
r5 = dup3(0xffffffffffffffff, r0, 0x80000)
setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8)
syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00')
fcntl$setstatus(r1, 0x4, 0x6000)
mq_open(&(0x7f0000000800)=':em1\x00', 0x40, 0x4, &(0x7f0000000840)={0x4000000000000000, 0x0, 0x9, 0x6, 0x0, 0xff, 0x7})
pwritev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000c00)}], 0x1, 0x0)
ioctl$DRM_IOCTL_AGP_ALLOC(r5, 0xc0206434, &(0x7f0000000440)={0x9dca, <r6=>0x0, 0x10002, 0x4})
ioctl$DRM_IOCTL_AGP_BIND(r4, 0x40106436, &(0x7f00000004c0)={r6, 0x676})
ioctl$sock_ifreq(r4, 0x8917, &(0x7f0000000300)={'lo\x00', @ifru_data=&(0x7f00000001c0)="16e667ea25efad95e8e866bb6ef7f6ba94b72b63a28bcb7eafa978bdbe09a4d8"})
getsockopt$inet_int(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000600), &(0x7f0000000640)=0x4)
getsockname$unix(r1, &(0x7f0000000680), &(0x7f0000000700)=0x6e)

2018/03/30 13:05:53 executing program 0:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYBLOB="22811e2630b1d0ac3463"], 0x1)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = getpgid(0xffffffffffffffff)
syz_open_procfs(r3, &(0x7f00000005c0)='net/ip6_tables_targets\x00')
process_vm_writev(r3, &(0x7f0000000180)=[{&(0x7f0000000140)=""/22, 0x16}], 0x1, &(0x7f00000003c0)=[{&(0x7f0000000740)=""/173, 0xad}], 0x1, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
r4 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
setns(r2, 0x0)
r5 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
r6 = dup3(0xffffffffffffffff, r0, 0x80000)
setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8)
syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00')
sendmsg$IPVS_CMD_NEW_DEST(r6, &(0x7f0000000540)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x2000400}, 0xc, &(0x7f0000000500)={&(0x7f0000000240)=ANY=[@ANYPTR], 0x1}, 0x1, 0x0, 0x0, 0x10}, 0x0)
sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10}, 0xc, &(0x7f0000000340)={&(0x7f0000000480)=ANY=[@ANYBLOB='H\x00\x00\x00'], 0x1}, 0x1}, 0x0)
fcntl$setstatus(r1, 0x4, 0x6000)
mq_open(&(0x7f0000000800)=':em1\x00', 0x40, 0x4, &(0x7f0000000840)={0x4000000000000000, 0x0, 0x9, 0x6, 0x0, 0xff, 0x7})
pwritev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000c00)}], 0x1, 0x0)
ioctl$DRM_IOCTL_AGP_ALLOC(r6, 0xc0206434, &(0x7f0000000440)={0x9dca, <r7=>0x0, 0x10002, 0x4})
ioctl$DRM_IOCTL_AGP_BIND(r5, 0x40106436, &(0x7f00000004c0)={r7, 0x676})
ioctl$sock_ifreq(r5, 0x8917, &(0x7f0000000300)={'lo\x00', @ifru_data=&(0x7f00000001c0)="16e667ea25efad95e8e866bb6ef7f6ba94b72b63a28bcb7eafa978bdbe09a4d8"})
getsockopt$inet_int(r4, 0x0, 0x0, &(0x7f0000000600), &(0x7f0000000640)=0x4)
getsockname$unix(r1, &(0x7f0000000680), &(0x7f0000000700)=0x6e)

2018/03/30 13:05:53 executing program 2:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYBLOB="22811e2630b1d0ac3463"], 0x1)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(0xffffffffffffffff, r2, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = getpgid(0xffffffffffffffff)
syz_open_procfs(r3, &(0x7f00000005c0)='net/ip6_tables_targets\x00')
process_vm_writev(r3, &(0x7f0000000180)=[{&(0x7f0000000140)=""/22, 0x16}], 0x1, &(0x7f00000003c0)=[{&(0x7f0000000740)=""/173, 0xad}], 0x1, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
r4 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
setns(r2, 0x0)
r5 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
r6 = dup3(0xffffffffffffffff, r0, 0x80000)
setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8)
syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00')
sendmsg$IPVS_CMD_NEW_DEST(r6, &(0x7f0000000540)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x2000400}, 0xc, &(0x7f0000000500)={&(0x7f0000000240)=ANY=[@ANYPTR], 0x1}, 0x1, 0x0, 0x0, 0x10}, 0x4)
sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10}, 0xc, &(0x7f0000000340)={&(0x7f0000000480)=ANY=[@ANYBLOB='H\x00\x00\x00'], 0x1}, 0x1}, 0x0)
fcntl$setstatus(r1, 0x4, 0x6000)
mq_open(&(0x7f0000000800)=':em1\x00', 0x40, 0x4, &(0x7f0000000840)={0x0, 0x0, 0x9, 0x6, 0x0, 0xff, 0x7})
pwritev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000c00)}], 0x1, 0x0)
ioctl$DRM_IOCTL_AGP_ALLOC(r6, 0xc0206434, &(0x7f0000000440)={0x9dca, <r7=>0x0, 0x10002, 0x4})
ioctl$DRM_IOCTL_AGP_BIND(r5, 0x40106436, &(0x7f00000004c0)={r7, 0x676})
ioctl$sock_ifreq(r5, 0x8917, &(0x7f0000000300)={'lo\x00', @ifru_data=&(0x7f00000001c0)="16e667ea25efad95e8e866bb6ef7f6ba94b72b63a28bcb7eafa978bdbe09a4d8"})
getsockopt$inet_int(r4, 0x0, 0x0, &(0x7f0000000600), &(0x7f0000000640)=0x4)
getsockname$unix(r1, &(0x7f0000000680), &(0x7f0000000700)=0x6e)

2018/03/30 13:05:53 executing program 3:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x0)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[], 0x0)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r1, r2, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
setns(r2, 0x0)
r3 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/loop-control\x00', 0x0, 0x0)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)
r4 = dup(r3)
getsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffff9c, 0x84, 0x6f, &(0x7f0000000340)={<r5=>0x0, 0x3c, &(0x7f00000005c0)=[@in={0x2, 0x4e23, @local={0xac, 0x14, 0x14, 0xaa}}, @in={0x2, 0x4e24, @broadcast=0xffffffff}, @in6={0xa, 0x0, 0x100000000, @loopback={0x0, 0x1}, 0x323d000000000}]}, &(0x7f0000000640)=0xc)
setsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r4, 0x84, 0xa, &(0x7f0000000680)={0xcff3, 0x80000000, 0x3, 0x0, 0x0, 0x66e, 0x5, 0x1, r5}, 0x20)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)
mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x5c831, 0xffffffffffffffff, 0x0)
openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/mls\x00', 0x0, 0x0)
setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(0xffffffffffffffff, 0x10e, 0x2, &(0x7f0000000340)=0xc, 0x4)
madvise(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x9)
r6 = syz_open_dev$usbmon(&(0x7f0000000040)='/dev/usbmon#\x00', 0x0, 0x80000)
ioctl$KDSKBMODE(0xffffffffffffffff, 0x4b45, &(0x7f0000000080))
getsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r6, 0x84, 0x75, &(0x7f00000000c0)={0x0, 0x6}, &(0x7f0000000100)=0x8)
setsockopt$inet_sctp6_SCTP_AUTH_KEY(r6, 0x84, 0x17, &(0x7f0000000500)=ANY=[], 0x0)
ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82)
ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82)
r7 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
ioctl$TIOCLINUX3(r7, 0x541c, &(0x7f0000000040)=0x3)
ioctl$LOOP_CTL_REMOVE(r3, 0x4c81, 0x0)

** 1 printk messages dropped ** [  584.860632] binder: 29212:29219 ioctl 40046207 0 returned -16
** 1 printk messages dropped ** [  584.861830] binder: 29212:29219 transaction failed 29201/-22, size 40-16 line 3197
[  584.872735] binder: undelivered TRANSACTION_ERROR: 29201
[  584.880860] binder: BINDER_SET_CONTEXT_MGR already set
2018/03/30 13:05:53 executing program 5:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYBLOB="00811e2630b1d0ac3463"], 0x1)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r1, r2, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
setns(r2, 0x0)
r3 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/loop-control\x00', 0x0, 0x0)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)
r4 = dup(r3)
getsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffff9c, 0x84, 0x6f, &(0x7f0000000340)={<r5=>0x0, 0x3c, &(0x7f00000005c0)=[@in={0x2, 0x4e23, @local={0xac, 0x14, 0x14, 0xaa}}, @in={0x2, 0x4e24, @broadcast=0xffffffff}, @in6={0xa, 0x0, 0x100000000, @loopback={0x0, 0x1}, 0x323d000000000}]}, &(0x7f0000000640)=0xc)
setsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r4, 0x84, 0xa, &(0x7f0000000680)={0xcff3, 0x80000000, 0x3, 0x0, 0x0, 0x66e, 0x5, 0x0, r5}, 0x20)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)
mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x5c831, 0xffffffffffffffff, 0x0)
openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/mls\x00', 0x0, 0x0)
setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(0xffffffffffffffff, 0x10e, 0x2, &(0x7f0000000340)=0xc, 0x4)
madvise(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x9)
r6 = syz_open_dev$usbmon(&(0x7f0000000040)='/dev/usbmon#\x00', 0x0, 0x80000)
ioctl$KDSKBMODE(0xffffffffffffffff, 0x4b45, &(0x7f0000000080))
getsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r6, 0x84, 0x75, &(0x7f00000000c0)={0x0, 0x6}, &(0x7f0000000100)=0x8)
setsockopt$inet_sctp6_SCTP_AUTH_KEY(r6, 0x84, 0x17, &(0x7f0000000500)=ANY=[], 0x0)
ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82)
r7 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
ioctl$TIOCLINUX3(r7, 0x541c, &(0x7f0000000040)=0x3)
ioctl$LOOP_CTL_REMOVE(r3, 0x4c81, 0x0)

2018/03/30 13:05:53 executing program 7:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x0)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYBLOB="22811e2630b1d0ac3463"], 0x1)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r1, r2, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = getpgid(0xffffffffffffffff)
syz_open_procfs(r3, &(0x7f00000005c0)='net/ip6_tables_targets\x00')
process_vm_writev(r3, &(0x7f0000000180)=[{&(0x7f0000000140)=""/22, 0x16}], 0x1, &(0x7f00000003c0)=[{&(0x7f0000000740)=""/173, 0xad}], 0x1, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
r4 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
r5 = dup3(0xffffffffffffffff, r0, 0x80000)
setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8)
syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00')
fcntl$setstatus(r1, 0x4, 0x6000)
mq_open(&(0x7f0000000800)=':em1\x00', 0x40, 0x4, &(0x7f0000000840)={0x4000000000000000, 0x0, 0x9, 0x6, 0x0, 0xff, 0x7})
pwritev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000c00)}], 0x1, 0x0)
ioctl$DRM_IOCTL_AGP_ALLOC(r5, 0xc0206434, &(0x7f0000000440)={0x9dca, <r6=>0x0, 0x10002, 0x4})
ioctl$DRM_IOCTL_AGP_BIND(r4, 0x40106436, &(0x7f00000004c0)={r6, 0x676})
ioctl$sock_ifreq(r4, 0x8917, &(0x7f0000000300)={'lo\x00', @ifru_data=&(0x7f00000001c0)="16e667ea25efad95e8e866bb6ef7f6ba94b72b63a28bcb7eafa978bdbe09a4d8"})
getsockopt$inet_int(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000600), &(0x7f0000000640)=0x4)
getsockname$unix(r1, &(0x7f0000000680), &(0x7f0000000700)=0x6e)

[  584.880869] binder: 29215:29220 ioctl 40046207 0 returned -16
** 21 printk messages dropped ** [  584.946235] binder: 29230:29238 transaction failed 29201/-22, size 40-16 line 3197
2018/03/30 13:05:53 executing program 6:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYBLOB="22811e2630b1d0ac3463"], 0x1)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r1, r2, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = getpgid(0xffffffffffffffff)
syz_open_procfs(r3, &(0x7f00000005c0)='net/ip6_tables_targets\x00')
process_vm_writev(r3, &(0x7f0000000180)=[{&(0x7f0000000140)=""/22, 0x16}], 0x1, &(0x7f00000003c0)=[{&(0x7f0000000740)=""/173, 0xad}], 0x1, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
r4 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
r5 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
r6 = dup3(0xffffffffffffffff, r0, 0x0)
setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8)
syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00')
sendmsg$IPVS_CMD_NEW_DEST(r6, &(0x7f0000000540)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x2000400}, 0xc, &(0x7f0000000500)={&(0x7f0000000240)=ANY=[@ANYPTR], 0x1}, 0x1, 0x0, 0x0, 0x10}, 0x4)
fcntl$setstatus(r1, 0x4, 0x6000)
mq_open(&(0x7f0000000800)=':em1\x00', 0x40, 0x4, &(0x7f0000000840)={0x4000000000000000, 0x0, 0x9, 0x6, 0x0, 0x0, 0x7})
pwritev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000c00)}], 0x1, 0x0)
ioctl$DRM_IOCTL_AGP_ALLOC(r6, 0xc0206434, &(0x7f0000000440)={0x9dca, <r7=>0x0, 0x10002, 0x4})
ioctl$DRM_IOCTL_AGP_BIND(r5, 0x40106436, &(0x7f00000004c0)={r7, 0x676})
ioctl$sock_ifreq(r5, 0x8917, &(0x7f0000000300)={'lo\x00', @ifru_data=&(0x7f00000001c0)="16e667ea25efad95e8e866bb6ef7f6ba94b72b63a28bcb7eafa978bdbe09a4d8"})
getsockopt$inet_int(r4, 0x0, 0x0, &(0x7f0000000600), &(0x7f0000000640)=0x4)
getsockname$unix(r1, &(0x7f0000000680), &(0x7f0000000700)=0x6e)

2018/03/30 13:05:53 executing program 2:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYBLOB="22811e2630b1d0ac3463"], 0x1)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(0xffffffffffffffff, r2, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = getpgid(0xffffffffffffffff)
syz_open_procfs(r3, &(0x7f00000005c0)='net/ip6_tables_targets\x00')
process_vm_writev(r3, &(0x7f0000000180)=[{&(0x7f0000000140)=""/22, 0x16}], 0x1, &(0x7f00000003c0)=[{&(0x7f0000000740)=""/173, 0xad}], 0x1, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
r4 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
setns(r2, 0x0)
r5 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
r6 = dup3(0xffffffffffffffff, r0, 0x80000)
setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8)
syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00')
sendmsg$IPVS_CMD_NEW_DEST(r6, &(0x7f0000000540)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x2000400}, 0xc, &(0x7f0000000500)={&(0x7f0000000240)=ANY=[@ANYPTR], 0x1}, 0x1, 0x0, 0x0, 0x10}, 0x4)
sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10}, 0xc, &(0x7f0000000340)={&(0x7f0000000480)=ANY=[@ANYBLOB='H\x00\x00\x00'], 0x1}, 0x1}, 0x0)
fcntl$setstatus(r1, 0x4, 0x6000)
mq_open(&(0x7f0000000800)=':em1\x00', 0x40, 0x4, &(0x7f0000000840)={0x0, 0x0, 0x9, 0x6, 0x0, 0xff, 0x7})
pwritev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000c00)}], 0x1, 0x0)
ioctl$DRM_IOCTL_AGP_ALLOC(r6, 0xc0206434, &(0x7f0000000440)={0x9dca, <r7=>0x0, 0x10002, 0x4})
ioctl$DRM_IOCTL_AGP_BIND(r5, 0x40106436, &(0x7f00000004c0)={r7, 0x676})
ioctl$sock_ifreq(r5, 0x8917, &(0x7f0000000300)={'lo\x00', @ifru_data=&(0x7f00000001c0)="16e667ea25efad95e8e866bb6ef7f6ba94b72b63a28bcb7eafa978bdbe09a4d8"})
getsockopt$inet_int(r4, 0x0, 0x0, &(0x7f0000000600), &(0x7f0000000640)=0x4)
getsockname$unix(r1, &(0x7f0000000680), &(0x7f0000000700)=0x6e)

2018/03/30 13:05:53 executing program 1:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYBLOB="22811e2630b1d0ac3463"], 0x1)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r1, r2, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = getpgid(0xffffffffffffffff)
syz_open_procfs(r3, &(0x7f00000005c0)='net/ip6_tables_targets\x00')
process_vm_writev(r3, &(0x7f0000000180), 0x0, &(0x7f00000003c0)=[{&(0x7f0000000740)=""/173, 0xad}], 0x1, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
r4 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
r5 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
r6 = dup3(0xffffffffffffffff, r0, 0x80000)
setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8)
syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00')
fcntl$setstatus(r1, 0x4, 0x6000)
mq_open(&(0x7f0000000800)=':em1\x00', 0x40, 0x4, &(0x7f0000000840)={0x4000000000000000, 0x0, 0x9, 0x0, 0x0, 0xff, 0x7})
pwritev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000c00)}], 0x1, 0x0)
ioctl$DRM_IOCTL_AGP_ALLOC(r6, 0xc0206434, &(0x7f0000000440)={0x9dca, <r7=>0x0, 0x10002, 0x4})
ioctl$DRM_IOCTL_AGP_BIND(r5, 0x40106436, &(0x7f00000004c0)={r7, 0x676})
ioctl$sock_ifreq(r5, 0x8917, &(0x7f0000000300)={'lo\x00', @ifru_data=&(0x7f00000001c0)="16e667ea25efad95e8e866bb6ef7f6ba94b72b63a28bcb7eafa978bdbe09a4d8"})
getsockopt$inet_int(r4, 0x0, 0x0, &(0x7f0000000600), &(0x7f0000000640)=0x4)
getsockname$unix(r1, &(0x7f0000000680), &(0x7f0000000700)=0x6e)

2018/03/30 13:05:53 executing program 4:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
r1 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000002880)='/selinux/avc/cache_stats\x00', 0x0, 0x0)
ioctl$EVIOCSABS20(r1, 0x401845e0, &(0x7f00000028c0)={0x1000, 0x7fff, 0x1ff, 0xffffffff, 0x7, 0x40})
fchdir(r0)
r2 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(r2, &(0x7f0000000080)=ANY=[@ANYBLOB="00811e2630b1d0ac3463"], 0x1)
setsockopt$packet_add_memb(r2, 0x107, 0x1, &(0x7f0000002900)={0x0, 0x1, 0x6}, 0x10)
r3 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r2, r3, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r3, 0x0)
inotify_init1(0x800)
ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
r4 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
setns(r3, 0x8000000)
r5 = socket$nl_xfrm(0x10, 0x3, 0x6)
r6 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
dup3(r3, r0, 0x80000)
setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8)
r7 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00')
sendmsg$IPVS_CMD_NEW_DEST(0xffffffffffffffff, &(0x7f0000000540)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x2000400}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)=ANY=[@ANYBLOB=',\x00\x00\x00'], 0x1}, 0x1, 0x0, 0x0, 0x10}, 0x4)
sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10}, 0xc, &(0x7f0000000340)={&(0x7f0000000480)=ANY=[@ANYBLOB='H\x00\x00\x00'], 0x1}, 0x1}, 0x0)
sendmsg$IPVS_CMD_GET_DEST(r2, &(0x7f0000000880)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f00000005c0)={&(0x7f0000000740)={0x138, r7, 0x208, 0x70bd2b, 0x25dfdbfb, {0x8}, [@IPVS_CMD_ATTR_SERVICE={0x28, 0x1, [@IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@multicast2=0xe0000002}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x3}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x7fff}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x8c6}, @IPVS_CMD_ATTR_DAEMON={0x50, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @remote={0xac, 0x14, 0x14, 0xbb}}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x400}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x10001}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'syz_tun\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x6}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x2}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x30, 0x2, [@IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x2}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv6=@ipv4={[], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0xffffffff}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0xafa6}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x1}, @IPVS_CMD_ATTR_DEST={0x6c, 0x2, [@IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x7}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv4=@remote={0xac, 0x14, 0x14, 0xbb}}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x8}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x1}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x5}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x3}, @IPVS_DEST_ATTR_PORT={0x8, 0x2, 0x4e22}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv6=@mcast2={0xff, 0x2, [], 0x1}}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x10000}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x701a3921}]}]}, 0x138}, 0x1, 0x0, 0x0, 0x90}, 0x4)
fcntl$setstatus(r2, 0x4, 0x6000)
setsockopt$sock_linger(r4, 0x1, 0xd, &(0x7f00000008c0)={0x1, 0x2}, 0x8)
pwritev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000c00)="cfb93447d6feaef9f73c0561e075a8295d43017ab1a157786dcda36c5eec92a4306f284fa7e3ed364cc2da5c08cf7e4030d394520e123eee6d9ab275c91c174b1364fc943b49faefe12f605b5ce6c1400a91210c00477f900aff390901bf594c18557cb38a7d57ac8ded098b96b9dfc125e3bdc9305193f4cd256068baca5208160d820b9e7a043666ba4801cf6d557fc0f97f35c13ec6c0d1fe97ce1af1c17078ef47ab955200836671e402717481d14936b09828fd6f55fda2f11eb4c61b480e941133c0a4c5ec54033d0d174742191754ffe28b093596286a78ea01078337ada8585aa98dcc1143689002e31ccc5b9f5cfd2bbce5683a0f91b395391a60ba8e8f4d3c10c82c71caa74c44c8b0f3e42f1fc264497d5b9dabf309bad7bd", 0x11e}], 0x1, 0x0)
sendmmsg(r5, &(0x7f00000027c0)=[{{0x0, 0x0, &(0x7f0000000a00)=[{&(0x7f0000000900)="913da470640ae70fe168a71ad316e5525ce43547f28d8c56cb5cd246950c2d44a514698b3aebf2b60d933814378b0b9b750dec28bdbeedda6c8af5f3418ff8c43701e5dea492428ecdcf0e8c2a19f60e388b478179256834360c5ee359dbe4fabee36883a8314f0ea64dea3a732dffbe26a02e8327a0f7174a6990389e5b608d5300c271f26b3b37cc88e720a477e5f1aa2751af90d35d72606ac73f72dab39aad418a6335d44c785ba83edc9619a3221ae39ef2fed1657e426fa293a739cd779a6c645b3d29bb184041476e8e6e737e5fa1c4312360", 0xd6}], 0x1, 0x0, 0x0, 0x8000}, 0x3f}, {{&(0x7f0000002240)=@nl=@unspec, 0x80, &(0x7f0000002680)=[{&(0x7f00000022c0)="756a6b1895d55b0b292a3985cd35f28cfa8d5ab20a3448791e47ec9e971be82f993ebd55ec843a76ccd644a71222e57119e6f8866f59ba0b89c4cf71a9ce853f72bd99ac9097baf924ea3e3fbceaf0a0df15deb45ae757832bec56c67c0ad44e0ea5fcbc12f898989e1773427ad180efff1044e98613dab446587dd52a0deacb4074e01d97cd46c6e633ae1c1011fd2123c766e6fea028799cf82a562bd9d52c544241172f684398ac1b", 0xaa}, {&(0x7f0000002440)="c802b7c29c92c7ddcf8b11133e071ae83e8c0b0827764303ad44356d381633ce1fdd31e1641872e8d6b4c1a974d97d", 0x2f}, {&(0x7f0000002540)="446c9b3779f2a3dc39f3a3541d912b01ca9865e4172a83cda910f6b10dd97377212eb5279c", 0x25}], 0x3, &(0x7f0000002700)=[{0x80, 0x10f, 0x200, "4f483406ed4a2e47550522989e031e3e239b59c5dc988744d266f33171b6d4a8e54f025a1e1be02c21ad9675e29aea96625352eec0db268e5c70b8e22a2bb0e11b9e6d9613d4e8e338194d9a41821db1ef97a16b16e5263d008bb6ce86b1e26f4d59926a9a72bed62192dc96"}], 0x80, 0x800}, 0x1200000}], 0x2, 0x20040000)
sendmsg$IPVS_CMD_DEL_DAEMON(r2, &(0x7f0000000280)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000240)={&(0x7f0000000180)={0x28, 0x0, 0xb30, 0x0, 0x25dfdbfc, {0xa}, [@IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x3ff}, @IPVS_CMD_ATTR_SERVICE={0xc, 0x1, [@IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8}]}]}, 0x28}, 0x1}, 0x0)
ioctl$sock_ifreq(r6, 0x8917, &(0x7f0000000300)={'lo\x00', @ifru_data=&(0x7f00000001c0)="16e667ea25efad95e8e866bb6ef7f6ba94b72b63a28bcb7eafa978bdbe09a4d8"})
getsockopt$inet_int(r4, 0x0, 0x0, &(0x7f0000000600), &(0x7f0000000640)=0x4)
getsockname$unix(r2, &(0x7f0000000680), &(0x7f0000000700)=0x6e)

2018/03/30 13:05:53 executing program 3:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[], 0x0)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(0xffffffffffffffff, r2, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
setns(r2, 0x0)
r3 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/loop-control\x00', 0x0, 0x0)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)
r4 = dup(r3)
getsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffff9c, 0x84, 0x6f, &(0x7f0000000340)={<r5=>0x0, 0x3c, &(0x7f00000005c0)=[@in={0x2, 0x4e23, @local={0xac, 0x14, 0x14, 0xaa}}, @in={0x2, 0x4e24, @broadcast=0xffffffff}, @in6={0xa, 0x0, 0x100000000, @loopback={0x0, 0x1}, 0x323d000000000}]}, &(0x7f0000000640)=0xc)
setsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r4, 0x84, 0xa, &(0x7f0000000680)={0xcff3, 0x80000000, 0x3, 0x0, 0x0, 0x66e, 0x5, 0x1, r5}, 0x20)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)
mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x5c831, 0xffffffffffffffff, 0x0)
openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/mls\x00', 0x0, 0x0)
setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(0xffffffffffffffff, 0x10e, 0x2, &(0x7f0000000340)=0xc, 0x4)
madvise(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x9)
r6 = syz_open_dev$usbmon(&(0x7f0000000040)='/dev/usbmon#\x00', 0x0, 0x80000)
ioctl$KDSKBMODE(0xffffffffffffffff, 0x4b45, &(0x7f0000000080))
getsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r6, 0x84, 0x75, &(0x7f00000000c0)={0x0, 0x6}, &(0x7f0000000100)=0x8)
setsockopt$inet_sctp6_SCTP_AUTH_KEY(r6, 0x84, 0x17, &(0x7f0000000500)=ANY=[], 0x0)
ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82)
ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82)
r7 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
ioctl$TIOCLINUX3(r7, 0x541c, &(0x7f0000000040)=0x3)
ioctl$LOOP_CTL_REMOVE(r3, 0x4c81, 0x0)

** 9 printk messages dropped ** [  584.971033] binder_alloc: 29234: binder_alloc_buf, no vma
** 13 printk messages dropped ** [  585.056749] binder: BINDER_SET_CONTEXT_MGR already set
** 12 printk messages dropped ** [  585.065492] binder: 29261:29263 transaction failed 29201/-22, size 40-16 line 3197
2018/03/30 13:05:54 executing program 5:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYBLOB="00811e2630b1d0ac3463"], 0x1)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r1, r2, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
setns(r2, 0x0)
r3 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/loop-control\x00', 0x0, 0x0)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)
r4 = dup(r3)
getsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffff9c, 0x84, 0x6f, &(0x7f0000000340)={<r5=>0x0, 0x3c, &(0x7f00000005c0)=[@in={0x2, 0x4e23, @local={0xac, 0x14, 0x14, 0xaa}}, @in={0x2, 0x4e24, @broadcast=0xffffffff}, @in6={0xa, 0x0, 0x100000000, @loopback={0x0, 0x1}, 0x323d000000000}]}, &(0x7f0000000640)=0xc)
setsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r4, 0x84, 0xa, &(0x7f0000000680)={0xcff3, 0x80000000, 0x3, 0x0, 0x0, 0x66e, 0x5, 0x0, r5}, 0x20)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)
mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x5c831, 0xffffffffffffffff, 0x0)
openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/mls\x00', 0x0, 0x0)
setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(0xffffffffffffffff, 0x10e, 0x2, &(0x7f0000000340)=0xc, 0x4)
madvise(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x9)
r6 = syz_open_dev$usbmon(&(0x7f0000000040)='/dev/usbmon#\x00', 0x0, 0x80000)
ioctl$KDSKBMODE(0xffffffffffffffff, 0x4b45, &(0x7f0000000080))
getsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r6, 0x84, 0x75, &(0x7f00000000c0)={0x0, 0x6}, &(0x7f0000000100)=0x8)
setsockopt$inet_sctp6_SCTP_AUTH_KEY(r6, 0x84, 0x17, &(0x7f0000000500)=ANY=[], 0x0)
ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82)
r7 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
ioctl$TIOCLINUX3(r7, 0x541c, &(0x7f0000000040)=0x3)
ioctl$LOOP_CTL_REMOVE(r3, 0x4c81, 0x0)

2018/03/30 13:05:54 executing program 4:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
r1 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000002880)='/selinux/avc/cache_stats\x00', 0x0, 0x0)
ioctl$EVIOCSABS20(r1, 0x401845e0, &(0x7f00000028c0)={0x1000, 0x7fff, 0x1ff, 0xffffffff, 0x7, 0x40})
fchdir(r0)
r2 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(r2, &(0x7f0000000080)=ANY=[@ANYBLOB="00811e2630b1d0ac3463"], 0x1)
setsockopt$packet_add_memb(r2, 0x107, 0x1, &(0x7f0000002900)={0x0, 0x1, 0x6}, 0x10)
r3 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r2, r3, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r3, 0x0)
inotify_init1(0x800)
ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
r4 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
setns(r3, 0x8000000)
r5 = socket$nl_xfrm(0x10, 0x3, 0x6)
r6 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
dup3(r3, r0, 0x80000)
setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8)
r7 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00')
sendmsg$IPVS_CMD_NEW_DEST(0xffffffffffffffff, &(0x7f0000000540)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x2000400}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)=ANY=[@ANYBLOB=',\x00\x00\x00'], 0x1}, 0x1, 0x0, 0x0, 0x10}, 0x4)
sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10}, 0xc, &(0x7f0000000340)={&(0x7f0000000480)=ANY=[@ANYBLOB='H\x00\x00\x00'], 0x1}, 0x1}, 0x0)
sendmsg$IPVS_CMD_GET_DEST(r2, &(0x7f0000000880)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f00000005c0)={&(0x7f0000000740)={0x138, r7, 0x208, 0x70bd2b, 0x25dfdbfb, {0x8}, [@IPVS_CMD_ATTR_SERVICE={0x28, 0x1, [@IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@multicast2=0xe0000002}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x3}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x7fff}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x8c6}, @IPVS_CMD_ATTR_DAEMON={0x50, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @remote={0xac, 0x14, 0x14, 0xbb}}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x400}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x10001}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'syz_tun\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x6}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x2}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x30, 0x2, [@IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x2}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv6=@ipv4={[], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0xffffffff}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0xafa6}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x1}, @IPVS_CMD_ATTR_DEST={0x6c, 0x2, [@IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x7}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv4=@remote={0xac, 0x14, 0x14, 0xbb}}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x8}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x1}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x5}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x3}, @IPVS_DEST_ATTR_PORT={0x8, 0x2, 0x4e22}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv6=@mcast2={0xff, 0x2, [], 0x1}}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x10000}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x701a3921}]}]}, 0x138}, 0x1, 0x0, 0x0, 0x90}, 0x4)
fcntl$setstatus(r2, 0x4, 0x6000)
setsockopt$sock_linger(r4, 0x1, 0xd, &(0x7f00000008c0)={0x1, 0x2}, 0x8)
pwritev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000c00)="cfb93447d6feaef9f73c0561e075a8295d43017ab1a157786dcda36c5eec92a4306f284fa7e3ed364cc2da5c08cf7e4030d394520e123eee6d9ab275c91c174b1364fc943b49faefe12f605b5ce6c1400a91210c00477f900aff390901bf594c18557cb38a7d57ac8ded098b96b9dfc125e3bdc9305193f4cd256068baca5208160d820b9e7a043666ba4801cf6d557fc0f97f35c13ec6c0d1fe97ce1af1c17078ef47ab955200836671e402717481d14936b09828fd6f55fda2f11eb4c61b480e941133c0a4c5ec54033d0d174742191754ffe28b093596286a78ea01078337ada8585aa98dcc1143689002e31ccc5b9f5cfd2bbce5683a0f91b395391a60ba8e8f4d3c10c82c71caa74c44c8b0f3e42f1fc264497d5b9dabf309bad7bd", 0x11e}], 0x1, 0x0)
sendmmsg(r5, &(0x7f00000027c0)=[{{0x0, 0x0, &(0x7f0000000a00)=[{&(0x7f0000000900)="913da470640ae70fe168a71ad316e5525ce43547f28d8c56cb5cd246950c2d44a514698b3aebf2b60d933814378b0b9b750dec28bdbeedda6c8af5f3418ff8c43701e5dea492428ecdcf0e8c2a19f60e388b478179256834360c5ee359dbe4fabee36883a8314f0ea64dea3a732dffbe26a02e8327a0f7174a6990389e5b608d5300c271f26b3b37cc88e720a477e5f1aa2751af90d35d72606ac73f72dab39aad418a6335d44c785ba83edc9619a3221ae39ef2fed1657e426fa293a739cd779a6c645b3d29bb184041476e8e6e737e5fa1c4312360", 0xd6}], 0x1, 0x0, 0x0, 0x8000}, 0x3f}, {{&(0x7f0000002240)=@nl=@unspec, 0x80, &(0x7f0000002680)=[{&(0x7f00000022c0)="756a6b1895d55b0b292a3985cd35f28cfa8d5ab20a3448791e47ec9e971be82f993ebd55ec843a76ccd644a71222e57119e6f8866f59ba0b89c4cf71a9ce853f72bd99ac9097baf924ea3e3fbceaf0a0df15deb45ae757832bec56c67c0ad44e0ea5fcbc12f898989e1773427ad180efff1044e98613dab446587dd52a0deacb4074e01d97cd46c6e633ae1c1011fd2123c766e6fea028799cf82a562bd9d52c544241172f684398ac1b", 0xaa}, {&(0x7f0000002440)="c802b7c29c92c7ddcf8b11133e071ae83e8c0b0827764303ad44356d381633ce1fdd31e1641872e8d6b4c1a974d97d", 0x2f}, {&(0x7f0000002540)="446c9b3779f2a3dc39f3a3541d912b01ca9865e4172a83cda910f6b10dd97377212eb5279c", 0x25}], 0x3, &(0x7f0000002700)=[{0x90, 0x10f, 0x200, "4f483406ed4a2e47550522989e031e3e239b59c5dc988744d266f33171b6d4a8e54f025a1e1be02c21ad9675e29aea96625352eec0db268e5c70b8e22a2bb0e11b9e6d9613d4e8e338194d9a41821db1ef97a16b16e5263d008bb6ce86b1e26f4d59926a9a72bed62192dc96eaa8a033c9ddaf2fc8c5fb9e765e5ff99cc5"}], 0x90, 0x800}, 0x1200000}], 0x2, 0x20040000)
sendmsg$IPVS_CMD_DEL_DAEMON(r2, &(0x7f0000000280)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000240)={&(0x7f0000000180)={0x28, 0x0, 0xb30, 0x0, 0x25dfdbfc, {0xa}, [@IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x3ff}, @IPVS_CMD_ATTR_SERVICE={0xc, 0x1, [@IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8}]}]}, 0x28}, 0x1}, 0x0)
ioctl$sock_ifreq(r6, 0x8917, &(0x7f0000000300)={'lo\x00', @ifru_data=&(0x7f00000001c0)="16e667ea25efad95e8e866bb6ef7f6ba94b72b63a28bcb7eafa978bdbe09a4d8"})
getsockopt$inet_int(r4, 0x0, 0x0, &(0x7f0000000600), &(0x7f0000000640)=0x4)
getsockname$unix(r2, &(0x7f0000000680), &(0x7f0000000700)=0x6e)

2018/03/30 13:05:54 executing program 6:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYBLOB="22811e2630b1d0ac3463"], 0x1)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r1, r2, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = getpgid(0xffffffffffffffff)
syz_open_procfs(r3, &(0x7f00000005c0)='net/ip6_tables_targets\x00')
process_vm_writev(r3, &(0x7f0000000180)=[{&(0x7f0000000140)=""/22, 0x16}], 0x1, &(0x7f00000003c0)=[{&(0x7f0000000740)=""/173, 0xad}], 0x1, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
r4 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
r5 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
r6 = dup3(0xffffffffffffffff, r0, 0x0)
setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8)
syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00')
sendmsg$IPVS_CMD_NEW_DEST(r6, &(0x7f0000000540)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x2000400}, 0xc, &(0x7f0000000500)={&(0x7f0000000240)=ANY=[@ANYPTR], 0x1}, 0x1, 0x0, 0x0, 0x10}, 0x4)
fcntl$setstatus(r1, 0x4, 0x6000)
mq_open(&(0x7f0000000800)=':em1\x00', 0x40, 0x4, &(0x7f0000000840)={0x4000000000000000, 0x0, 0x9, 0x6, 0x0, 0x0, 0x7})
pwritev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000c00)}], 0x1, 0x0)
ioctl$DRM_IOCTL_AGP_ALLOC(r6, 0xc0206434, &(0x7f0000000440)={0x9dca, <r7=>0x0, 0x10002, 0x4})
ioctl$DRM_IOCTL_AGP_BIND(r5, 0x40106436, &(0x7f00000004c0)={r7, 0x676})
ioctl$sock_ifreq(r5, 0x8917, &(0x7f0000000300)={'lo\x00', @ifru_data=&(0x7f00000001c0)="16e667ea25efad95e8e866bb6ef7f6ba94b72b63a28bcb7eafa978bdbe09a4d8"})
getsockopt$inet_int(r4, 0x0, 0x0, &(0x7f0000000600), &(0x7f0000000640)=0x4)
getsockname$unix(r1, &(0x7f0000000680), &(0x7f0000000700)=0x6e)

[  585.069435] binder: 29260:29265 got transaction with invalid offset (0, min 24 max 40) or object.
** 5 printk messages dropped ** [  585.081163] binder: 29259:29268 got transaction with invalid offset (0, min 24 max 40) or object.
2018/03/30 13:05:54 executing program 0:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYBLOB="22811e2630b1d0ac3463"], 0x1)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = getpgid(0xffffffffffffffff)
syz_open_procfs(r3, &(0x7f00000005c0)='net/ip6_tables_targets\x00')
process_vm_writev(r3, &(0x7f0000000180)=[{&(0x7f0000000140)=""/22, 0x16}], 0x1, &(0x7f00000003c0)=[{&(0x7f0000000740)=""/173, 0xad}], 0x1, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
r4 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
setns(r2, 0x0)
r5 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
r6 = dup3(0xffffffffffffffff, r0, 0x80000)
setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8)
syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00')
sendmsg$IPVS_CMD_NEW_DEST(r6, &(0x7f0000000540)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x2000400}, 0xc, &(0x7f0000000500)={&(0x7f0000000240)=ANY=[@ANYPTR], 0x1}, 0x1, 0x0, 0x0, 0x10}, 0x0)
sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10}, 0xc, &(0x7f0000000340)={&(0x7f0000000480)=ANY=[@ANYBLOB='H\x00\x00\x00'], 0x1}, 0x1}, 0x0)
fcntl$setstatus(r1, 0x4, 0x6000)
mq_open(&(0x7f0000000800)=':em1\x00', 0x40, 0x4, &(0x7f0000000840)={0x4000000000000000, 0x0, 0x9, 0x6, 0x0, 0xff, 0x7})
pwritev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000c00)}], 0x1, 0x0)
ioctl$DRM_IOCTL_AGP_ALLOC(r6, 0xc0206434, &(0x7f0000000440)={0x9dca, <r7=>0x0, 0x10002, 0x4})
ioctl$DRM_IOCTL_AGP_BIND(r5, 0x40106436, &(0x7f00000004c0)={r7, 0x676})
ioctl$sock_ifreq(r5, 0x8917, &(0x7f0000000300)={'lo\x00', @ifru_data=&(0x7f00000001c0)="16e667ea25efad95e8e866bb6ef7f6ba94b72b63a28bcb7eafa978bdbe09a4d8"})
getsockopt$inet_int(r4, 0x0, 0x0, &(0x7f0000000600), &(0x7f0000000640)=0x4)
getsockname$unix(r1, &(0x7f0000000680), &(0x7f0000000700)=0x6e)

2018/03/30 13:05:54 executing program 7:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x0)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYBLOB="22811e2630b1d0ac3463"], 0x1)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r1, r2, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = getpgid(0xffffffffffffffff)
syz_open_procfs(r3, &(0x7f00000005c0)='net/ip6_tables_targets\x00')
process_vm_writev(r3, &(0x7f0000000180)=[{&(0x7f0000000140)=""/22, 0x16}], 0x1, &(0x7f00000003c0)=[{&(0x7f0000000740)=""/173, 0xad}], 0x1, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
r4 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
r5 = dup3(0xffffffffffffffff, r0, 0x80000)
setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8)
syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00')
fcntl$setstatus(r1, 0x4, 0x6000)
mq_open(&(0x7f0000000800)=':em1\x00', 0x40, 0x4, &(0x7f0000000840)={0x4000000000000000, 0x0, 0x9, 0x6, 0x0, 0xff, 0x7})
pwritev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000c00)}], 0x1, 0x0)
ioctl$DRM_IOCTL_AGP_ALLOC(r5, 0xc0206434, &(0x7f0000000440)={0x9dca, <r6=>0x0, 0x10002, 0x4})
ioctl$DRM_IOCTL_AGP_BIND(r4, 0x40106436, &(0x7f00000004c0)={r6, 0x676})
ioctl$sock_ifreq(r4, 0x8917, &(0x7f0000000300)={'lo\x00', @ifru_data=&(0x7f00000001c0)="16e667ea25efad95e8e866bb6ef7f6ba94b72b63a28bcb7eafa978bdbe09a4d8"})
getsockopt$inet_int(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000600), &(0x7f0000000640)=0x4)
getsockname$unix(r1, &(0x7f0000000680), &(0x7f0000000700)=0x6e)

2018/03/30 13:05:54 executing program 2:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYBLOB="22811e2630b1d0ac3463"], 0x1)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r1, 0xffffffffffffffff, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = getpgid(0xffffffffffffffff)
syz_open_procfs(r3, &(0x7f00000005c0)='net/ip6_tables_targets\x00')
process_vm_writev(r3, &(0x7f0000000180)=[{&(0x7f0000000140)=""/22, 0x16}], 0x1, &(0x7f00000003c0)=[{&(0x7f0000000740)=""/173, 0xad}], 0x1, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
r4 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
setns(r2, 0x0)
r5 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
r6 = dup3(0xffffffffffffffff, r0, 0x80000)
setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8)
syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00')
sendmsg$IPVS_CMD_NEW_DEST(r6, &(0x7f0000000540)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x2000400}, 0xc, &(0x7f0000000500)={&(0x7f0000000240)=ANY=[@ANYPTR], 0x1}, 0x1, 0x0, 0x0, 0x10}, 0x4)
sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10}, 0xc, &(0x7f0000000340)={&(0x7f0000000480)=ANY=[@ANYBLOB='H\x00\x00\x00'], 0x1}, 0x1}, 0x0)
fcntl$setstatus(r1, 0x4, 0x6000)
mq_open(&(0x7f0000000800)=':em1\x00', 0x40, 0x4, &(0x7f0000000840)={0x0, 0x0, 0x9, 0x6, 0x0, 0xff, 0x7})
pwritev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000c00)}], 0x1, 0x0)
ioctl$DRM_IOCTL_AGP_ALLOC(r6, 0xc0206434, &(0x7f0000000440)={0x9dca, <r7=>0x0, 0x10002, 0x4})
ioctl$DRM_IOCTL_AGP_BIND(r5, 0x40106436, &(0x7f00000004c0)={r7, 0x676})
ioctl$sock_ifreq(r5, 0x8917, &(0x7f0000000300)={'lo\x00', @ifru_data=&(0x7f00000001c0)="16e667ea25efad95e8e866bb6ef7f6ba94b72b63a28bcb7eafa978bdbe09a4d8"})
getsockopt$inet_int(r4, 0x0, 0x0, &(0x7f0000000600), &(0x7f0000000640)=0x4)
getsockname$unix(r1, &(0x7f0000000680), &(0x7f0000000700)=0x6e)

2018/03/30 13:05:54 executing program 1:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYBLOB="22811e2630b1d0ac3463"], 0x1)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r1, r2, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = getpgid(0xffffffffffffffff)
syz_open_procfs(r3, &(0x7f00000005c0)='net/ip6_tables_targets\x00')
process_vm_writev(r3, &(0x7f0000000180), 0x0, &(0x7f00000003c0)=[{&(0x7f0000000740)=""/173, 0xad}], 0x1, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
r4 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
r5 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
r6 = dup3(0xffffffffffffffff, r0, 0x80000)
setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8)
syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00')
fcntl$setstatus(r1, 0x4, 0x6000)
mq_open(&(0x7f0000000800)=':em1\x00', 0x40, 0x4, &(0x7f0000000840)={0x4000000000000000, 0x0, 0x9, 0x6, 0x0, 0x0, 0x7})
pwritev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000c00)}], 0x1, 0x0)
ioctl$DRM_IOCTL_AGP_ALLOC(r6, 0xc0206434, &(0x7f0000000440)={0x9dca, <r7=>0x0, 0x10002, 0x4})
ioctl$DRM_IOCTL_AGP_BIND(r5, 0x40106436, &(0x7f00000004c0)={r7, 0x676})
ioctl$sock_ifreq(r5, 0x8917, &(0x7f0000000300)={'lo\x00', @ifru_data=&(0x7f00000001c0)="16e667ea25efad95e8e866bb6ef7f6ba94b72b63a28bcb7eafa978bdbe09a4d8"})
getsockopt$inet_int(r4, 0x0, 0x0, &(0x7f0000000600), &(0x7f0000000640)=0x4)
getsockname$unix(r1, &(0x7f0000000680), &(0x7f0000000700)=0x6e)

2018/03/30 13:05:54 executing program 3:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[], 0x0)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(0xffffffffffffffff, r2, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
setns(r2, 0x0)
r3 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/loop-control\x00', 0x0, 0x0)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)
r4 = dup(r3)
getsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffff9c, 0x84, 0x6f, &(0x7f0000000340)={<r5=>0x0, 0x3c, &(0x7f00000005c0)=[@in={0x2, 0x4e23, @local={0xac, 0x14, 0x14, 0xaa}}, @in={0x2, 0x4e24, @broadcast=0xffffffff}, @in6={0xa, 0x0, 0x100000000, @loopback={0x0, 0x1}, 0x323d000000000}]}, &(0x7f0000000640)=0xc)
setsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r4, 0x84, 0xa, &(0x7f0000000680)={0xcff3, 0x80000000, 0x3, 0x0, 0x0, 0x66e, 0x5, 0x1, r5}, 0x20)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)
mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x5c831, 0xffffffffffffffff, 0x0)
openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/mls\x00', 0x0, 0x0)
setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(0xffffffffffffffff, 0x10e, 0x2, &(0x7f0000000340)=0xc, 0x4)
madvise(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x9)
r6 = syz_open_dev$usbmon(&(0x7f0000000040)='/dev/usbmon#\x00', 0x0, 0x80000)
ioctl$KDSKBMODE(0xffffffffffffffff, 0x4b45, &(0x7f0000000080))
getsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r6, 0x84, 0x75, &(0x7f00000000c0)={0x0, 0x6}, &(0x7f0000000100)=0x8)
setsockopt$inet_sctp6_SCTP_AUTH_KEY(r6, 0x84, 0x17, &(0x7f0000000500)=ANY=[], 0x0)
ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82)
ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82)
r7 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
ioctl$TIOCLINUX3(r7, 0x541c, &(0x7f0000000040)=0x3)
ioctl$LOOP_CTL_REMOVE(r3, 0x4c81, 0x0)

[  585.081321] binder: 29259:29268 transaction failed 29201/-22, size 40-16 line 3197
[  585.086398] binder: 29257:29267 got transaction with invalid offset (0, min 24 max 40) or object.
2018/03/30 13:05:54 executing program 6:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYBLOB="22811e2630b1d0ac3463"], 0x1)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r1, r2, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = getpgid(0xffffffffffffffff)
syz_open_procfs(r3, &(0x7f00000005c0)='net/ip6_tables_targets\x00')
process_vm_writev(r3, &(0x7f0000000180)=[{&(0x7f0000000140)=""/22, 0x16}], 0x1, &(0x7f00000003c0)=[{&(0x7f0000000740)=""/173, 0xad}], 0x1, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
r4 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
r5 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
r6 = dup3(0xffffffffffffffff, r0, 0x0)
setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8)
syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00')
sendmsg$IPVS_CMD_NEW_DEST(r6, &(0x7f0000000540)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x2000400}, 0xc, &(0x7f0000000500)={&(0x7f0000000240)=ANY=[@ANYPTR], 0x1}, 0x1, 0x0, 0x0, 0x10}, 0x4)
fcntl$setstatus(r1, 0x4, 0x6000)
mq_open(&(0x7f0000000800)=':em1\x00', 0x40, 0x4, &(0x7f0000000840)={0x4000000000000000, 0x0, 0x9, 0x6, 0x0, 0xff})
pwritev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000c00)}], 0x1, 0x0)
ioctl$DRM_IOCTL_AGP_ALLOC(r6, 0xc0206434, &(0x7f0000000440)={0x9dca, <r7=>0x0, 0x10002, 0x4})
ioctl$DRM_IOCTL_AGP_BIND(r5, 0x40106436, &(0x7f00000004c0)={r7, 0x676})
ioctl$sock_ifreq(r5, 0x8917, &(0x7f0000000300)={'lo\x00', @ifru_data=&(0x7f00000001c0)="16e667ea25efad95e8e866bb6ef7f6ba94b72b63a28bcb7eafa978bdbe09a4d8"})
getsockopt$inet_int(r4, 0x0, 0x0, &(0x7f0000000600), &(0x7f0000000640)=0x4)
getsockname$unix(r1, &(0x7f0000000680), &(0x7f0000000700)=0x6e)

2018/03/30 13:05:54 executing program 5:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYBLOB="00811e2630b1d0ac3463"], 0x1)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r1, r2, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
setns(r2, 0x0)
r3 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/loop-control\x00', 0x0, 0x0)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)
r4 = dup(r3)
getsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffff9c, 0x84, 0x6f, &(0x7f0000000340)={<r5=>0x0, 0x3c, &(0x7f00000005c0)=[@in={0x2, 0x4e23, @local={0xac, 0x14, 0x14, 0xaa}}, @in={0x2, 0x4e24, @broadcast=0xffffffff}, @in6={0xa, 0x0, 0x100000000, @loopback={0x0, 0x1}, 0x323d000000000}]}, &(0x7f0000000640)=0xc)
setsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r4, 0x84, 0xa, &(0x7f0000000680)={0xcff3, 0x80000000, 0x3, 0x0, 0x0, 0x66e, 0x5, 0x0, r5}, 0x20)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)
mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x5c831, 0xffffffffffffffff, 0x0)
openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/mls\x00', 0x0, 0x0)
setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(0xffffffffffffffff, 0x10e, 0x2, &(0x7f0000000340)=0xc, 0x4)
madvise(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x9)
r6 = syz_open_dev$usbmon(&(0x7f0000000040)='/dev/usbmon#\x00', 0x0, 0x80000)
ioctl$KDSKBMODE(0xffffffffffffffff, 0x4b45, &(0x7f0000000080))
getsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r6, 0x84, 0x75, &(0x7f00000000c0)={0x0, 0x6}, &(0x7f0000000100)=0x8)
setsockopt$inet_sctp6_SCTP_AUTH_KEY(r6, 0x84, 0x17, &(0x7f0000000500)=ANY=[], 0x0)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)
r7 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
ioctl$TIOCLINUX3(r7, 0x541c, &(0x7f0000000040)=0x3)
ioctl$LOOP_CTL_REMOVE(r3, 0x4c81, 0x0)

2018/03/30 13:05:54 executing program 2:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYBLOB="22811e2630b1d0ac3463"], 0x1)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r1, 0xffffffffffffffff, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = getpgid(0xffffffffffffffff)
syz_open_procfs(r3, &(0x7f00000005c0)='net/ip6_tables_targets\x00')
process_vm_writev(r3, &(0x7f0000000180)=[{&(0x7f0000000140)=""/22, 0x16}], 0x1, &(0x7f00000003c0)=[{&(0x7f0000000740)=""/173, 0xad}], 0x1, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
r4 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
setns(r2, 0x0)
r5 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
r6 = dup3(0xffffffffffffffff, r0, 0x80000)
setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8)
syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00')
sendmsg$IPVS_CMD_NEW_DEST(r6, &(0x7f0000000540)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x2000400}, 0xc, &(0x7f0000000500)={&(0x7f0000000240)=ANY=[@ANYPTR], 0x1}, 0x1, 0x0, 0x0, 0x10}, 0x4)
sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10}, 0xc, &(0x7f0000000340)={&(0x7f0000000480)=ANY=[@ANYBLOB='H\x00\x00\x00'], 0x1}, 0x1}, 0x0)
fcntl$setstatus(r1, 0x4, 0x6000)
mq_open(&(0x7f0000000800)=':em1\x00', 0x40, 0x4, &(0x7f0000000840)={0x0, 0x0, 0x9, 0x6, 0x0, 0xff, 0x7})
pwritev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000c00)}], 0x1, 0x0)
ioctl$DRM_IOCTL_AGP_ALLOC(r6, 0xc0206434, &(0x7f0000000440)={0x9dca, <r7=>0x0, 0x10002, 0x4})
ioctl$DRM_IOCTL_AGP_BIND(r5, 0x40106436, &(0x7f00000004c0)={r7, 0x676})
ioctl$sock_ifreq(r5, 0x8917, &(0x7f0000000300)={'lo\x00', @ifru_data=&(0x7f00000001c0)="16e667ea25efad95e8e866bb6ef7f6ba94b72b63a28bcb7eafa978bdbe09a4d8"})
getsockopt$inet_int(r4, 0x0, 0x0, &(0x7f0000000600), &(0x7f0000000640)=0x4)
getsockname$unix(r1, &(0x7f0000000680), &(0x7f0000000700)=0x6e)

2018/03/30 13:05:54 executing program 7:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[], 0x0)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r1, r2, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = getpgid(0xffffffffffffffff)
syz_open_procfs(r3, &(0x7f00000005c0)='net/ip6_tables_targets\x00')
process_vm_writev(r3, &(0x7f0000000180)=[{&(0x7f0000000140)=""/22, 0x16}], 0x1, &(0x7f00000003c0)=[{&(0x7f0000000740)=""/173, 0xad}], 0x1, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
r4 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
r5 = dup3(0xffffffffffffffff, r0, 0x80000)
setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8)
syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00')
fcntl$setstatus(r1, 0x4, 0x6000)
mq_open(&(0x7f0000000800)=':em1\x00', 0x40, 0x4, &(0x7f0000000840)={0x4000000000000000, 0x0, 0x9, 0x6, 0x0, 0xff, 0x7})
pwritev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000c00)}], 0x1, 0x0)
ioctl$DRM_IOCTL_AGP_ALLOC(r5, 0xc0206434, &(0x7f0000000440)={0x9dca, <r6=>0x0, 0x10002, 0x4})
ioctl$DRM_IOCTL_AGP_BIND(r4, 0x40106436, &(0x7f00000004c0)={r6, 0x676})
ioctl$sock_ifreq(r4, 0x8917, &(0x7f0000000300)={'lo\x00', @ifru_data=&(0x7f00000001c0)="16e667ea25efad95e8e866bb6ef7f6ba94b72b63a28bcb7eafa978bdbe09a4d8"})
getsockopt$inet_int(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000600), &(0x7f0000000640)=0x4)
getsockname$unix(r1, &(0x7f0000000680), &(0x7f0000000700)=0x6e)

2018/03/30 13:05:54 executing program 1:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYBLOB="22811e2630b1d0ac3463"], 0x1)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r1, r2, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = getpgid(0xffffffffffffffff)
syz_open_procfs(r3, &(0x7f00000005c0)='net/ip6_tables_targets\x00')
process_vm_writev(r3, &(0x7f0000000180), 0x0, &(0x7f00000003c0)=[{&(0x7f0000000740)=""/173, 0xad}], 0x1, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
r4 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
r5 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
r6 = dup3(0xffffffffffffffff, r0, 0x80000)
setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8)
syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00')
fcntl$setstatus(r1, 0x4, 0x6000)
mq_open(&(0x7f0000000800)=':em1\x00', 0x40, 0x4, &(0x7f0000000840)={0x4000000000000000, 0x0, 0x9, 0x6, 0x0, 0x0, 0x7})
pwritev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000c00)}], 0x1, 0x0)
ioctl$DRM_IOCTL_AGP_ALLOC(r6, 0xc0206434, &(0x7f0000000440)={0x9dca, <r7=>0x0, 0x10002, 0x4})
ioctl$DRM_IOCTL_AGP_BIND(r5, 0x40106436, &(0x7f00000004c0)={r7, 0x676})
ioctl$sock_ifreq(r5, 0x8917, &(0x7f0000000300)={'lo\x00', @ifru_data=&(0x7f00000001c0)="16e667ea25efad95e8e866bb6ef7f6ba94b72b63a28bcb7eafa978bdbe09a4d8"})
getsockopt$inet_int(r4, 0x0, 0x0, &(0x7f0000000600), &(0x7f0000000640)=0x4)
getsockname$unix(r1, &(0x7f0000000680), &(0x7f0000000700)=0x6e)

2018/03/30 13:05:54 executing program 3:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[], 0x0)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(0xffffffffffffffff, r2, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
setns(r2, 0x0)
r3 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/loop-control\x00', 0x0, 0x0)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)
r4 = dup(r3)
getsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffff9c, 0x84, 0x6f, &(0x7f0000000340)={<r5=>0x0, 0x3c, &(0x7f00000005c0)=[@in={0x2, 0x4e23, @local={0xac, 0x14, 0x14, 0xaa}}, @in={0x2, 0x4e24, @broadcast=0xffffffff}, @in6={0xa, 0x0, 0x100000000, @loopback={0x0, 0x1}, 0x323d000000000}]}, &(0x7f0000000640)=0xc)
setsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r4, 0x84, 0xa, &(0x7f0000000680)={0xcff3, 0x80000000, 0x3, 0x0, 0x0, 0x66e, 0x5, 0x1, r5}, 0x20)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)
mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x5c831, 0xffffffffffffffff, 0x0)
openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/mls\x00', 0x0, 0x0)
setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(0xffffffffffffffff, 0x10e, 0x2, &(0x7f0000000340)=0xc, 0x4)
madvise(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x9)
r6 = syz_open_dev$usbmon(&(0x7f0000000040)='/dev/usbmon#\x00', 0x0, 0x80000)
ioctl$KDSKBMODE(0xffffffffffffffff, 0x4b45, &(0x7f0000000080))
getsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r6, 0x84, 0x75, &(0x7f00000000c0)={0x0, 0x6}, &(0x7f0000000100)=0x8)
setsockopt$inet_sctp6_SCTP_AUTH_KEY(r6, 0x84, 0x17, &(0x7f0000000500)=ANY=[], 0x0)
ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82)
ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82)
r7 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
ioctl$TIOCLINUX3(r7, 0x541c, &(0x7f0000000040)=0x3)
ioctl$LOOP_CTL_REMOVE(r3, 0x4c81, 0x0)

2018/03/30 13:05:54 executing program 0:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYBLOB="22811e2630b1d0ac3463"], 0x1)
tee(r1, 0xffffffffffffffff, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r2 = getpgid(0xffffffffffffffff)
syz_open_procfs(r2, &(0x7f00000005c0)='net/ip6_tables_targets\x00')
process_vm_writev(r2, &(0x7f0000000180)=[{&(0x7f0000000140)=""/22, 0x16}], 0x1, &(0x7f00000003c0)=[{&(0x7f0000000740)=""/173, 0xad}], 0x1, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
r3 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
setns(0xffffffffffffffff, 0x0)
r4 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
r5 = dup3(0xffffffffffffffff, r0, 0x80000)
setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8)
syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00')
sendmsg$IPVS_CMD_NEW_DEST(r5, &(0x7f0000000540)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x2000400}, 0xc, &(0x7f0000000500)={&(0x7f0000000240)=ANY=[@ANYPTR], 0x1}, 0x1, 0x0, 0x0, 0x10}, 0x0)
sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10}, 0xc, &(0x7f0000000340)={&(0x7f0000000480)=ANY=[@ANYBLOB='H\x00\x00\x00'], 0x1}, 0x1}, 0x0)
fcntl$setstatus(r1, 0x4, 0x6000)
mq_open(&(0x7f0000000800)=':em1\x00', 0x40, 0x4, &(0x7f0000000840)={0x4000000000000000, 0x0, 0x9, 0x6, 0x0, 0xff, 0x7})
pwritev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000c00)}], 0x1, 0x0)
ioctl$DRM_IOCTL_AGP_ALLOC(r5, 0xc0206434, &(0x7f0000000440)={0x9dca, <r6=>0x0, 0x10002, 0x4})
ioctl$DRM_IOCTL_AGP_BIND(r4, 0x40106436, &(0x7f00000004c0)={r6, 0x676})
ioctl$sock_ifreq(r4, 0x8917, &(0x7f0000000300)={'lo\x00', @ifru_data=&(0x7f00000001c0)="16e667ea25efad95e8e866bb6ef7f6ba94b72b63a28bcb7eafa978bdbe09a4d8"})
getsockopt$inet_int(r3, 0x0, 0x0, &(0x7f0000000600), &(0x7f0000000640)=0x4)
getsockname$unix(r1, &(0x7f0000000680), &(0x7f0000000700)=0x6e)

** 32 printk messages dropped ** [  585.260134] binder: BINDER_SET_CONTEXT_MGR already set
** 1 printk messages dropped ** [  585.261390] binder: 29296:29305 got transaction with invalid offset (0, min 24 max 40) or object.
2018/03/30 13:05:54 executing program 4:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
r1 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000002880)='/selinux/avc/cache_stats\x00', 0x0, 0x0)
ioctl$EVIOCSABS20(r1, 0x401845e0, &(0x7f00000028c0)={0x1000, 0x7fff, 0x1ff, 0xffffffff, 0x7, 0x40})
fchdir(r0)
r2 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(r2, &(0x7f0000000080)=ANY=[@ANYBLOB="00811e2630b1d0ac3463"], 0x1)
setsockopt$packet_add_memb(r2, 0x107, 0x1, &(0x7f0000002900)={0x0, 0x1, 0x6}, 0x10)
r3 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r2, r3, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r3, 0x0)
inotify_init1(0x800)
ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
r4 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
setns(r3, 0x8000000)
r5 = socket$nl_xfrm(0x10, 0x3, 0x6)
r6 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
dup3(r3, r0, 0x80000)
setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8)
r7 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00')
sendmsg$IPVS_CMD_NEW_DEST(0xffffffffffffffff, &(0x7f0000000540)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x2000400}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)=ANY=[@ANYBLOB=',\x00\x00\x00'], 0x1}, 0x1, 0x0, 0x0, 0x10}, 0x4)
sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10}, 0xc, &(0x7f0000000340)={&(0x7f0000000480)=ANY=[@ANYBLOB='H\x00\x00\x00'], 0x1}, 0x1}, 0x0)
sendmsg$IPVS_CMD_GET_DEST(r2, &(0x7f0000000880)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f00000005c0)={&(0x7f0000000740)={0x138, r7, 0x208, 0x70bd2b, 0x25dfdbfb, {0x8}, [@IPVS_CMD_ATTR_SERVICE={0x28, 0x1, [@IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@multicast2=0xe0000002}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x3}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x7fff}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x8c6}, @IPVS_CMD_ATTR_DAEMON={0x50, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @remote={0xac, 0x14, 0x14, 0xbb}}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x400}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x10001}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'syz_tun\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x6}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x2}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x30, 0x2, [@IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x2}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv6=@ipv4={[], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0xffffffff}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0xafa6}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x1}, @IPVS_CMD_ATTR_DEST={0x6c, 0x2, [@IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x7}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv4=@remote={0xac, 0x14, 0x14, 0xbb}}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x8}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x1}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x5}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x3}, @IPVS_DEST_ATTR_PORT={0x8, 0x2, 0x4e22}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv6=@mcast2={0xff, 0x2, [], 0x1}}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x10000}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x701a3921}]}]}, 0x138}, 0x1, 0x0, 0x0, 0x90}, 0x4)
fcntl$setstatus(r2, 0x4, 0x6000)
setsockopt$sock_linger(r4, 0x1, 0xd, &(0x7f00000008c0)={0x1, 0x2}, 0x8)
pwritev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000c00)="cfb93447d6feaef9f73c0561e075a8295d43017ab1a157786dcda36c5eec92a4306f284fa7e3ed364cc2da5c08cf7e4030d394520e123eee6d9ab275c91c174b1364fc943b49faefe12f605b5ce6c1400a91210c00477f900aff390901bf594c18557cb38a7d57ac8ded098b96b9dfc125e3bdc9305193f4cd256068baca5208160d820b9e7a043666ba4801cf6d557fc0f97f35c13ec6c0d1fe97ce1af1c17078ef47ab955200836671e402717481d14936b09828fd6f55fda2f11eb4c61b480e941133c0a4c5ec54033d0d174742191754ffe28b093596286a78ea01078337ada8585aa98dcc1143689002e31ccc5b9f5cfd2bbce5683a0f91b395391a60ba8e8f4d3c10c82c71caa74c44c8b0f3e42f1fc264497d5b9dabf309bad7bd", 0x11e}], 0x1, 0x0)
sendmmsg(r5, &(0x7f00000027c0)=[{{0x0, 0x0, &(0x7f0000000a00)=[{&(0x7f0000000900)="913da470640ae70fe168a71ad316e5525ce43547f28d8c56cb5cd246950c2d44a514698b3aebf2b60d933814378b0b9b750dec28bdbeedda6c8af5f3418ff8c43701e5dea492428ecdcf0e8c2a19f60e388b478179256834360c5ee359dbe4fabee36883a8314f0ea64dea3a732dffbe26a02e8327a0f7174a6990389e5b608d5300c271f26b3b37cc88e720a477e5f1aa2751af90d35d72606ac73f72dab39aad418a6335d44c785ba83edc9619a3221ae39ef2fed1657e426fa293a739cd779a6c645b3d29bb184041476e8e6e737e5fa1c4312360", 0xd6}], 0x1, 0x0, 0x0, 0x8000}, 0x3f}, {{&(0x7f0000002240)=@nl=@unspec, 0x80, &(0x7f0000002680)=[{&(0x7f00000022c0)="756a6b1895d55b0b292a3985cd35f28cfa8d5ab20a3448791e47ec9e971be82f993ebd55ec843a76ccd644a71222e57119e6f8866f59ba0b89c4cf71a9ce853f72bd99ac9097baf924ea3e3fbceaf0a0df15deb45ae757832bec56c67c0ad44e0ea5fcbc12f898989e1773427ad180efff1044e98613dab446587dd52a0deacb4074e01d97cd46c6e633ae1c1011fd2123c766e6fea028799cf82a562bd9d52c544241172f684398ac1b", 0xaa}, {&(0x7f0000002440)="c802b7c29c92c7ddcf8b11133e071ae83e8c0b0827764303ad44356d381633ce1fdd31e1641872e8d6b4c1a974d97d", 0x2f}, {&(0x7f0000002540)="446c9b3779f2a3dc39f3a3541d912b01ca9865e4172a83cda910f6b10dd97377212eb5279c", 0x25}], 0x3, &(0x7f0000002700)=[{0x90, 0x10f, 0x200, "4f483406ed4a2e47550522989e031e3e239b59c5dc988744d266f33171b6d4a8e54f025a1e1be02c21ad9675e29aea96625352eec0db268e5c70b8e22a2bb0e11b9e6d9613d4e8e338194d9a41821db1ef97a16b16e5263d008bb6ce86b1e26f4d59926a9a72bed62192dc96eaa8a033c9ddaf2fc8c5fb9e765e5ff99cc5"}], 0x90, 0x800}, 0x1200000}], 0x2, 0x20040000)
sendmsg$IPVS_CMD_DEL_DAEMON(r2, &(0x7f0000000280)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000240)={&(0x7f0000000180)={0x28, 0x0, 0xb30, 0x0, 0x25dfdbfc, {0xa}, [@IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x3ff}, @IPVS_CMD_ATTR_SERVICE={0xc, 0x1, [@IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8}]}]}, 0x28}, 0x1}, 0x0)
ioctl$sock_ifreq(r6, 0x8917, &(0x7f0000000300)={'lo\x00', @ifru_data=&(0x7f00000001c0)="16e667ea25efad95e8e866bb6ef7f6ba94b72b63a28bcb7eafa978bdbe09a4d8"})
getsockopt$inet_int(r4, 0x0, 0x0, &(0x7f0000000600), &(0x7f0000000640)=0x4)
getsockname$unix(r2, &(0x7f0000000680), &(0x7f0000000700)=0x6e)

** 13 printk messages dropped ** [  585.271638] binder: 29299:29308 got transaction with invalid offset (0, min 24 max 40) or object.
** 16 printk messages dropped ** [  585.350152] binder: undelivered TRANSACTION_ERROR: 29201
[  585.351269] binder: undelivered TRANSACTION_ERROR: 29201
[  585.357227] binder: undelivered TRANSACTION_ERROR: 29201
[  585.364831] binder: undelivered TRANSACTION_ERROR: 29201
[  585.366484] binder: 29327:29330 got transaction with invalid offset (0, min 24 max 40) or object.
2018/03/30 13:05:54 executing program 5:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYBLOB="00811e2630b1d0ac3463"], 0x1)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r1, r2, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
setns(r2, 0x0)
r3 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/loop-control\x00', 0x0, 0x0)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)
r4 = dup(r3)
getsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffff9c, 0x84, 0x6f, &(0x7f0000000340)={<r5=>0x0, 0x3c, &(0x7f00000005c0)=[@in={0x2, 0x4e23, @local={0xac, 0x14, 0x14, 0xaa}}, @in={0x2, 0x4e24, @broadcast=0xffffffff}, @in6={0xa, 0x0, 0x100000000, @loopback={0x0, 0x1}, 0x323d000000000}]}, &(0x7f0000000640)=0xc)
setsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r4, 0x84, 0xa, &(0x7f0000000680)={0xcff3, 0x80000000, 0x3, 0x0, 0x0, 0x66e, 0x5, 0x0, r5}, 0x20)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)
mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x5c831, 0xffffffffffffffff, 0x0)
openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/mls\x00', 0x0, 0x0)
setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(0xffffffffffffffff, 0x10e, 0x2, &(0x7f0000000340)=0xc, 0x4)
madvise(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x9)
r6 = syz_open_dev$usbmon(&(0x7f0000000040)='/dev/usbmon#\x00', 0x0, 0x80000)
ioctl$KDSKBMODE(0xffffffffffffffff, 0x4b45, &(0x7f0000000080))
getsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r6, 0x84, 0x75, &(0x7f00000000c0)={0x0, 0x6}, &(0x7f0000000100)=0x8)
setsockopt$inet_sctp6_SCTP_AUTH_KEY(r6, 0x84, 0x17, &(0x7f0000000500)=ANY=[], 0x0)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)
r7 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
ioctl$TIOCLINUX3(r7, 0x541c, &(0x7f0000000040)=0x3)
ioctl$LOOP_CTL_REMOVE(r3, 0x4c81, 0x0)

2018/03/30 13:05:54 executing program 1:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYBLOB="22811e2630b1d0ac3463"], 0x1)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r1, r2, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = getpgid(0xffffffffffffffff)
syz_open_procfs(r3, &(0x7f00000005c0)='net/ip6_tables_targets\x00')
process_vm_writev(r3, &(0x7f0000000180), 0x0, &(0x7f00000003c0)=[{&(0x7f0000000740)=""/173, 0xad}], 0x1, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
r4 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
r5 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
r6 = dup3(0xffffffffffffffff, r0, 0x80000)
setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8)
syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00')
fcntl$setstatus(r1, 0x4, 0x6000)
mq_open(&(0x7f0000000800)=':em1\x00', 0x40, 0x4, &(0x7f0000000840)={0x4000000000000000, 0x0, 0x9, 0x6, 0x0, 0x0, 0x7})
pwritev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000c00)}], 0x1, 0x0)
ioctl$DRM_IOCTL_AGP_ALLOC(r6, 0xc0206434, &(0x7f0000000440)={0x9dca, <r7=>0x0, 0x10002, 0x4})
ioctl$DRM_IOCTL_AGP_BIND(r5, 0x40106436, &(0x7f00000004c0)={r7, 0x676})
ioctl$sock_ifreq(r5, 0x8917, &(0x7f0000000300)={'lo\x00', @ifru_data=&(0x7f00000001c0)="16e667ea25efad95e8e866bb6ef7f6ba94b72b63a28bcb7eafa978bdbe09a4d8"})
getsockopt$inet_int(r4, 0x0, 0x0, &(0x7f0000000600), &(0x7f0000000640)=0x4)
getsockname$unix(r1, &(0x7f0000000680), &(0x7f0000000700)=0x6e)

2018/03/30 13:05:54 executing program 7:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[], 0x0)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r1, r2, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = getpgid(0xffffffffffffffff)
syz_open_procfs(r3, &(0x7f00000005c0)='net/ip6_tables_targets\x00')
process_vm_writev(r3, &(0x7f0000000180)=[{&(0x7f0000000140)=""/22, 0x16}], 0x1, &(0x7f00000003c0)=[{&(0x7f0000000740)=""/173, 0xad}], 0x1, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
r4 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
r5 = dup3(0xffffffffffffffff, r0, 0x80000)
setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8)
syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00')
fcntl$setstatus(r1, 0x4, 0x6000)
mq_open(&(0x7f0000000800)=':em1\x00', 0x40, 0x4, &(0x7f0000000840)={0x4000000000000000, 0x0, 0x9, 0x6, 0x0, 0xff, 0x7})
pwritev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000c00)}], 0x1, 0x0)
ioctl$DRM_IOCTL_AGP_ALLOC(r5, 0xc0206434, &(0x7f0000000440)={0x9dca, <r6=>0x0, 0x10002, 0x4})
ioctl$DRM_IOCTL_AGP_BIND(r4, 0x40106436, &(0x7f00000004c0)={r6, 0x676})
ioctl$sock_ifreq(r4, 0x8917, &(0x7f0000000300)={'lo\x00', @ifru_data=&(0x7f00000001c0)="16e667ea25efad95e8e866bb6ef7f6ba94b72b63a28bcb7eafa978bdbe09a4d8"})
getsockopt$inet_int(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000600), &(0x7f0000000640)=0x4)
getsockname$unix(r1, &(0x7f0000000680), &(0x7f0000000700)=0x6e)

2018/03/30 13:05:54 executing program 6:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYBLOB="22811e2630b1d0ac3463"], 0x1)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r1, r2, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = getpgid(0xffffffffffffffff)
syz_open_procfs(r3, &(0x7f00000005c0)='net/ip6_tables_targets\x00')
process_vm_writev(r3, &(0x7f0000000180)=[{&(0x7f0000000140)=""/22, 0x16}], 0x1, &(0x7f00000003c0)=[{&(0x7f0000000740)=""/173, 0xad}], 0x1, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
r4 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
r5 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
r6 = dup3(0xffffffffffffffff, r0, 0x0)
setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8)
syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00')
sendmsg$IPVS_CMD_NEW_DEST(r6, &(0x7f0000000540)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x2000400}, 0xc, &(0x7f0000000500)={&(0x7f0000000240)=ANY=[@ANYPTR], 0x1}, 0x1, 0x0, 0x0, 0x10}, 0x4)
fcntl$setstatus(r1, 0x4, 0x6000)
mq_open(&(0x7f0000000800)=':em1\x00', 0x40, 0x4, &(0x7f0000000840)={0x4000000000000000, 0x0, 0x9, 0x6, 0x0, 0xff})
pwritev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000c00)}], 0x1, 0x0)
ioctl$DRM_IOCTL_AGP_ALLOC(r6, 0xc0206434, &(0x7f0000000440)={0x9dca, <r7=>0x0, 0x10002, 0x4})
ioctl$DRM_IOCTL_AGP_BIND(r5, 0x40106436, &(0x7f00000004c0)={r7, 0x676})
ioctl$sock_ifreq(r5, 0x8917, &(0x7f0000000300)={'lo\x00', @ifru_data=&(0x7f00000001c0)="16e667ea25efad95e8e866bb6ef7f6ba94b72b63a28bcb7eafa978bdbe09a4d8"})
getsockopt$inet_int(r4, 0x0, 0x0, &(0x7f0000000600), &(0x7f0000000640)=0x4)
getsockname$unix(r1, &(0x7f0000000680), &(0x7f0000000700)=0x6e)

2018/03/30 13:05:54 executing program 3:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[], 0x0)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r1, 0xffffffffffffffff, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
setns(r2, 0x0)
r3 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/loop-control\x00', 0x0, 0x0)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)
r4 = dup(r3)
getsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffff9c, 0x84, 0x6f, &(0x7f0000000340)={<r5=>0x0, 0x3c, &(0x7f00000005c0)=[@in={0x2, 0x4e23, @local={0xac, 0x14, 0x14, 0xaa}}, @in={0x2, 0x4e24, @broadcast=0xffffffff}, @in6={0xa, 0x0, 0x100000000, @loopback={0x0, 0x1}, 0x323d000000000}]}, &(0x7f0000000640)=0xc)
setsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r4, 0x84, 0xa, &(0x7f0000000680)={0xcff3, 0x80000000, 0x3, 0x0, 0x0, 0x66e, 0x5, 0x1, r5}, 0x20)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)
mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x5c831, 0xffffffffffffffff, 0x0)
openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/mls\x00', 0x0, 0x0)
setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(0xffffffffffffffff, 0x10e, 0x2, &(0x7f0000000340)=0xc, 0x4)
madvise(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x9)
r6 = syz_open_dev$usbmon(&(0x7f0000000040)='/dev/usbmon#\x00', 0x0, 0x80000)
ioctl$KDSKBMODE(0xffffffffffffffff, 0x4b45, &(0x7f0000000080))
getsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r6, 0x84, 0x75, &(0x7f00000000c0)={0x0, 0x6}, &(0x7f0000000100)=0x8)
setsockopt$inet_sctp6_SCTP_AUTH_KEY(r6, 0x84, 0x17, &(0x7f0000000500)=ANY=[], 0x0)
ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82)
ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82)
r7 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
ioctl$TIOCLINUX3(r7, 0x541c, &(0x7f0000000040)=0x3)
ioctl$LOOP_CTL_REMOVE(r3, 0x4c81, 0x0)

2018/03/30 13:05:54 executing program 4:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
r1 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000002880)='/selinux/avc/cache_stats\x00', 0x0, 0x0)
ioctl$EVIOCSABS20(r1, 0x401845e0, &(0x7f00000028c0)={0x1000, 0x7fff, 0x1ff, 0xffffffff, 0x7, 0x40})
fchdir(r0)
r2 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(r2, &(0x7f0000000080)=ANY=[@ANYBLOB="00811e2630b1d0ac3463"], 0x1)
setsockopt$packet_add_memb(r2, 0x107, 0x1, &(0x7f0000002900)={0x0, 0x1, 0x6}, 0x10)
r3 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r2, r3, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r3, 0x0)
inotify_init1(0x800)
ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
r4 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
setns(r3, 0x8000000)
r5 = socket$nl_xfrm(0x10, 0x3, 0x6)
r6 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
dup3(r3, r0, 0x80000)
setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8)
r7 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00')
sendmsg$IPVS_CMD_NEW_DEST(0xffffffffffffffff, &(0x7f0000000540)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x2000400}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)=ANY=[@ANYBLOB=',\x00\x00\x00'], 0x1}, 0x1, 0x0, 0x0, 0x10}, 0x4)
sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10}, 0xc, &(0x7f0000000340)={&(0x7f0000000480)=ANY=[@ANYBLOB='H\x00\x00\x00'], 0x1}, 0x1}, 0x0)
sendmsg$IPVS_CMD_GET_DEST(r2, &(0x7f0000000880)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f00000005c0)={&(0x7f0000000740)={0x138, r7, 0x208, 0x70bd2b, 0x25dfdbfb, {0x8}, [@IPVS_CMD_ATTR_SERVICE={0x28, 0x1, [@IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@multicast2=0xe0000002}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x3}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x7fff}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x8c6}, @IPVS_CMD_ATTR_DAEMON={0x50, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @remote={0xac, 0x14, 0x14, 0xbb}}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x400}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x10001}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'syz_tun\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x6}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x2}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x30, 0x2, [@IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x2}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv6=@ipv4={[], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0xffffffff}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0xafa6}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x1}, @IPVS_CMD_ATTR_DEST={0x6c, 0x2, [@IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x7}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv4=@remote={0xac, 0x14, 0x14, 0xbb}}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x8}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x1}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x5}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x3}, @IPVS_DEST_ATTR_PORT={0x8, 0x2, 0x4e22}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv6=@mcast2={0xff, 0x2, [], 0x1}}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x10000}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x701a3921}]}]}, 0x138}, 0x1, 0x0, 0x0, 0x90}, 0x4)
fcntl$setstatus(r2, 0x4, 0x6000)
setsockopt$sock_linger(r4, 0x1, 0xd, &(0x7f00000008c0)={0x1, 0x2}, 0x8)
pwritev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000c00)="cfb93447d6feaef9f73c0561e075a8295d43017ab1a157786dcda36c5eec92a4306f284fa7e3ed364cc2da5c08cf7e4030d394520e123eee6d9ab275c91c174b1364fc943b49faefe12f605b5ce6c1400a91210c00477f900aff390901bf594c18557cb38a7d57ac8ded098b96b9dfc125e3bdc9305193f4cd256068baca5208160d820b9e7a043666ba4801cf6d557fc0f97f35c13ec6c0d1fe97ce1af1c17078ef47ab955200836671e402717481d14936b09828fd6f55fda2f11eb4c61b480e941133c0a4c5ec54033d0d174742191754ffe28b093596286a78ea01078337ada8585aa98dcc1143689002e31ccc5b9f5cfd2bbce5683a0f91b395391a60ba8e8f4d3c10c82c71caa74c44c8b0f3e42f1fc264497d5b9dabf309bad7bd", 0x11e}], 0x1, 0x0)
sendmmsg(r5, &(0x7f00000027c0)=[{{0x0, 0x0, &(0x7f0000000a00)=[{&(0x7f0000000900)="913da470640ae70fe168a71ad316e5525ce43547f28d8c56cb5cd246950c2d44a514698b3aebf2b60d933814378b0b9b750dec28bdbeedda6c8af5f3418ff8c43701e5dea492428ecdcf0e8c2a19f60e388b478179256834360c5ee359dbe4fabee36883a8314f0ea64dea3a732dffbe26a02e8327a0f7174a6990389e5b608d5300c271f26b3b37cc88e720a477e5f1aa2751af90d35d72606ac73f72dab39aad418a6335d44c785ba83edc9619a3221ae39ef2fed1657e426fa293a739cd779a6c645b3d29bb184041476e8e6e737e5fa1c4312360", 0xd6}], 0x1, 0x0, 0x0, 0x8000}, 0x3f}, {{&(0x7f0000002240)=@nl=@unspec, 0x80, &(0x7f0000002680)=[{&(0x7f00000022c0)="756a6b1895d55b0b292a3985cd35f28cfa8d5ab20a3448791e47ec9e971be82f993ebd55ec843a76ccd644a71222e57119e6f8866f59ba0b89c4cf71a9ce853f72bd99ac9097baf924ea3e3fbceaf0a0df15deb45ae757832bec56c67c0ad44e0ea5fcbc12f898989e1773427ad180efff1044e98613dab446587dd52a0deacb4074e01d97cd46c6e633ae1c1011fd2123c766e6fea028799cf82a562bd9d52c544241172f684398ac1b", 0xaa}, {&(0x7f0000002440)="c802b7c29c92c7ddcf8b11133e071ae83e8c0b0827764303ad44356d381633ce1fdd31e1641872e8d6b4c1a974d97d", 0x2f}, {&(0x7f0000002540)="446c9b3779f2a3dc39f3a3541d912b01ca9865e4172a83cda910f6b10dd97377212eb5279c", 0x25}], 0x3, &(0x7f0000002700)=[{0x90, 0x10f, 0x200, "4f483406ed4a2e47550522989e031e3e239b59c5dc988744d266f33171b6d4a8e54f025a1e1be02c21ad9675e29aea96625352eec0db268e5c70b8e22a2bb0e11b9e6d9613d4e8e338194d9a41821db1ef97a16b16e5263d008bb6ce86b1e26f4d59926a9a72bed62192dc96eaa8a033c9ddaf2fc8c5fb9e765e5ff99cc5"}], 0x90, 0x800}, 0x1200000}], 0x2, 0x20040000)
sendmsg$IPVS_CMD_DEL_DAEMON(r2, &(0x7f0000000280)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000240)={&(0x7f0000000180)={0x28, 0x0, 0xb30, 0x0, 0x25dfdbfc, {0xa}, [@IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x3ff}, @IPVS_CMD_ATTR_SERVICE={0xc, 0x1, [@IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8}]}]}, 0x28}, 0x1}, 0x0)
ioctl$sock_ifreq(r6, 0x8917, &(0x7f0000000300)={'lo\x00', @ifru_data=&(0x7f00000001c0)="16e667ea25efad95e8e866bb6ef7f6ba94b72b63a28bcb7eafa978bdbe09a4d8"})
getsockopt$inet_int(r4, 0x0, 0x0, &(0x7f0000000600), &(0x7f0000000640)=0x4)
getsockname$unix(r2, &(0x7f0000000680), &(0x7f0000000700)=0x6e)

2018/03/30 13:05:54 executing program 2:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYBLOB="22811e2630b1d0ac3463"], 0x1)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r1, 0xffffffffffffffff, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = getpgid(0xffffffffffffffff)
syz_open_procfs(r3, &(0x7f00000005c0)='net/ip6_tables_targets\x00')
process_vm_writev(r3, &(0x7f0000000180)=[{&(0x7f0000000140)=""/22, 0x16}], 0x1, &(0x7f00000003c0)=[{&(0x7f0000000740)=""/173, 0xad}], 0x1, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
r4 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
setns(r2, 0x0)
r5 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
r6 = dup3(0xffffffffffffffff, r0, 0x80000)
setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8)
syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00')
sendmsg$IPVS_CMD_NEW_DEST(r6, &(0x7f0000000540)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x2000400}, 0xc, &(0x7f0000000500)={&(0x7f0000000240)=ANY=[@ANYPTR], 0x1}, 0x1, 0x0, 0x0, 0x10}, 0x4)
sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10}, 0xc, &(0x7f0000000340)={&(0x7f0000000480)=ANY=[@ANYBLOB='H\x00\x00\x00'], 0x1}, 0x1}, 0x0)
fcntl$setstatus(r1, 0x4, 0x6000)
mq_open(&(0x7f0000000800)=':em1\x00', 0x40, 0x4, &(0x7f0000000840)={0x0, 0x0, 0x9, 0x6, 0x0, 0xff, 0x7})
pwritev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000c00)}], 0x1, 0x0)
ioctl$DRM_IOCTL_AGP_ALLOC(r6, 0xc0206434, &(0x7f0000000440)={0x9dca, <r7=>0x0, 0x10002, 0x4})
ioctl$DRM_IOCTL_AGP_BIND(r5, 0x40106436, &(0x7f00000004c0)={r7, 0x676})
ioctl$sock_ifreq(r5, 0x8917, &(0x7f0000000300)={'lo\x00', @ifru_data=&(0x7f00000001c0)="16e667ea25efad95e8e866bb6ef7f6ba94b72b63a28bcb7eafa978bdbe09a4d8"})
getsockopt$inet_int(r4, 0x0, 0x0, &(0x7f0000000600), &(0x7f0000000640)=0x4)
getsockname$unix(r1, &(0x7f0000000680), &(0x7f0000000700)=0x6e)

2018/03/30 13:05:54 executing program 0:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYBLOB="22811e2630b1d0ac3463"], 0x1)
tee(r1, 0xffffffffffffffff, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r2 = getpgid(0xffffffffffffffff)
syz_open_procfs(r2, &(0x7f00000005c0)='net/ip6_tables_targets\x00')
process_vm_writev(r2, &(0x7f0000000180)=[{&(0x7f0000000140)=""/22, 0x16}], 0x1, &(0x7f00000003c0)=[{&(0x7f0000000740)=""/173, 0xad}], 0x1, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
r3 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
setns(0xffffffffffffffff, 0x0)
r4 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
r5 = dup3(0xffffffffffffffff, r0, 0x80000)
setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8)
syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00')
sendmsg$IPVS_CMD_NEW_DEST(r5, &(0x7f0000000540)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x2000400}, 0xc, &(0x7f0000000500)={&(0x7f0000000240)=ANY=[@ANYPTR], 0x1}, 0x1, 0x0, 0x0, 0x10}, 0x0)
sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10}, 0xc, &(0x7f0000000340)={&(0x7f0000000480)=ANY=[@ANYBLOB='H\x00\x00\x00'], 0x1}, 0x1}, 0x0)
fcntl$setstatus(r1, 0x4, 0x6000)
mq_open(&(0x7f0000000800)=':em1\x00', 0x40, 0x4, &(0x7f0000000840)={0x4000000000000000, 0x0, 0x9, 0x6, 0x0, 0xff, 0x7})
pwritev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000c00)}], 0x1, 0x0)
ioctl$DRM_IOCTL_AGP_ALLOC(r5, 0xc0206434, &(0x7f0000000440)={0x9dca, <r6=>0x0, 0x10002, 0x4})
ioctl$DRM_IOCTL_AGP_BIND(r4, 0x40106436, &(0x7f00000004c0)={r6, 0x676})
ioctl$sock_ifreq(r4, 0x8917, &(0x7f0000000300)={'lo\x00', @ifru_data=&(0x7f00000001c0)="16e667ea25efad95e8e866bb6ef7f6ba94b72b63a28bcb7eafa978bdbe09a4d8"})
getsockopt$inet_int(r3, 0x0, 0x0, &(0x7f0000000600), &(0x7f0000000640)=0x4)
getsockname$unix(r1, &(0x7f0000000680), &(0x7f0000000700)=0x6e)

[  585.376174] binder: BINDER_SET_CONTEXT_MGR already set
[  585.376182] binder: 29328:29331 ioctl 40046207 0 returned -16
2018/03/30 13:05:54 executing program 5:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYBLOB="00811e2630b1d0ac3463"], 0x1)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r1, r2, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
setns(r2, 0x0)
r3 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/loop-control\x00', 0x0, 0x0)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)
r4 = dup(r3)
getsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffff9c, 0x84, 0x6f, &(0x7f0000000340)={<r5=>0x0, 0x3c, &(0x7f00000005c0)=[@in={0x2, 0x4e23, @local={0xac, 0x14, 0x14, 0xaa}}, @in={0x2, 0x4e24, @broadcast=0xffffffff}, @in6={0xa, 0x0, 0x100000000, @loopback={0x0, 0x1}, 0x323d000000000}]}, &(0x7f0000000640)=0xc)
setsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r4, 0x84, 0xa, &(0x7f0000000680)={0xcff3, 0x80000000, 0x3, 0x0, 0x0, 0x66e, 0x5, 0x0, r5}, 0x20)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)
mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x5c831, 0xffffffffffffffff, 0x0)
openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/mls\x00', 0x0, 0x0)
setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(0xffffffffffffffff, 0x10e, 0x2, &(0x7f0000000340)=0xc, 0x4)
madvise(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x9)
r6 = syz_open_dev$usbmon(&(0x7f0000000040)='/dev/usbmon#\x00', 0x0, 0x80000)
ioctl$KDSKBMODE(0xffffffffffffffff, 0x4b45, &(0x7f0000000080))
getsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r6, 0x84, 0x75, &(0x7f00000000c0)={0x0, 0x6}, &(0x7f0000000100)=0x8)
setsockopt$inet_sctp6_SCTP_AUTH_KEY(r6, 0x84, 0x17, &(0x7f0000000500)=ANY=[], 0x0)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)
r7 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
ioctl$TIOCLINUX3(r7, 0x541c, &(0x7f0000000040)=0x3)
ioctl$LOOP_CTL_REMOVE(r3, 0x4c81, 0x0)

2018/03/30 13:05:54 executing program 1:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYBLOB="22811e2630b1d0ac3463"], 0x1)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r1, r2, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = getpgid(0xffffffffffffffff)
syz_open_procfs(r3, &(0x7f00000005c0)='net/ip6_tables_targets\x00')
process_vm_writev(r3, &(0x7f0000000180), 0x0, &(0x7f00000003c0)=[{&(0x7f0000000740)=""/173, 0xad}], 0x1, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
r4 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
r5 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
r6 = dup3(0xffffffffffffffff, r0, 0x80000)
setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8)
syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00')
fcntl$setstatus(r1, 0x4, 0x6000)
mq_open(&(0x7f0000000800)=':em1\x00', 0x40, 0x4, &(0x7f0000000840)={0x4000000000000000, 0x0, 0x9, 0x6, 0x0, 0xff})
pwritev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000c00)}], 0x1, 0x0)
ioctl$DRM_IOCTL_AGP_ALLOC(r6, 0xc0206434, &(0x7f0000000440)={0x9dca, <r7=>0x0, 0x10002, 0x4})
ioctl$DRM_IOCTL_AGP_BIND(r5, 0x40106436, &(0x7f00000004c0)={r7, 0x676})
ioctl$sock_ifreq(r5, 0x8917, &(0x7f0000000300)={'lo\x00', @ifru_data=&(0x7f00000001c0)="16e667ea25efad95e8e866bb6ef7f6ba94b72b63a28bcb7eafa978bdbe09a4d8"})
getsockopt$inet_int(r4, 0x0, 0x0, &(0x7f0000000600), &(0x7f0000000640)=0x4)
getsockname$unix(r1, &(0x7f0000000680), &(0x7f0000000700)=0x6e)

2018/03/30 13:05:54 executing program 7:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[], 0x0)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r1, r2, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = getpgid(0xffffffffffffffff)
syz_open_procfs(r3, &(0x7f00000005c0)='net/ip6_tables_targets\x00')
process_vm_writev(r3, &(0x7f0000000180)=[{&(0x7f0000000140)=""/22, 0x16}], 0x1, &(0x7f00000003c0)=[{&(0x7f0000000740)=""/173, 0xad}], 0x1, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
r4 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
r5 = dup3(0xffffffffffffffff, r0, 0x80000)
setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8)
syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00')
fcntl$setstatus(r1, 0x4, 0x6000)
mq_open(&(0x7f0000000800)=':em1\x00', 0x40, 0x4, &(0x7f0000000840)={0x4000000000000000, 0x0, 0x9, 0x6, 0x0, 0xff, 0x7})
pwritev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000c00)}], 0x1, 0x0)
ioctl$DRM_IOCTL_AGP_ALLOC(r5, 0xc0206434, &(0x7f0000000440)={0x9dca, <r6=>0x0, 0x10002, 0x4})
ioctl$DRM_IOCTL_AGP_BIND(r4, 0x40106436, &(0x7f00000004c0)={r6, 0x676})
ioctl$sock_ifreq(r4, 0x8917, &(0x7f0000000300)={'lo\x00', @ifru_data=&(0x7f00000001c0)="16e667ea25efad95e8e866bb6ef7f6ba94b72b63a28bcb7eafa978bdbe09a4d8"})
getsockopt$inet_int(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000600), &(0x7f0000000640)=0x4)
getsockname$unix(r1, &(0x7f0000000680), &(0x7f0000000700)=0x6e)

2018/03/30 13:05:54 executing program 2:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYBLOB="22811e2630b1d0ac3463"], 0x1)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r1, r2, 0x0, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = getpgid(0xffffffffffffffff)
syz_open_procfs(r3, &(0x7f00000005c0)='net/ip6_tables_targets\x00')
process_vm_writev(r3, &(0x7f0000000180)=[{&(0x7f0000000140)=""/22, 0x16}], 0x1, &(0x7f00000003c0)=[{&(0x7f0000000740)=""/173, 0xad}], 0x1, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
r4 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
setns(r2, 0x0)
r5 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
r6 = dup3(0xffffffffffffffff, r0, 0x80000)
setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8)
syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00')
sendmsg$IPVS_CMD_NEW_DEST(r6, &(0x7f0000000540)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x2000400}, 0xc, &(0x7f0000000500)={&(0x7f0000000240)=ANY=[@ANYPTR], 0x1}, 0x1, 0x0, 0x0, 0x10}, 0x4)
sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10}, 0xc, &(0x7f0000000340)={&(0x7f0000000480)=ANY=[@ANYBLOB='H\x00\x00\x00'], 0x1}, 0x1}, 0x0)
fcntl$setstatus(r1, 0x4, 0x6000)
mq_open(&(0x7f0000000800)=':em1\x00', 0x40, 0x4, &(0x7f0000000840)={0x0, 0x0, 0x9, 0x6, 0x0, 0xff, 0x7})
pwritev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000c00)}], 0x1, 0x0)
ioctl$DRM_IOCTL_AGP_ALLOC(r6, 0xc0206434, &(0x7f0000000440)={0x9dca, <r7=>0x0, 0x10002, 0x4})
ioctl$DRM_IOCTL_AGP_BIND(r5, 0x40106436, &(0x7f00000004c0)={r7, 0x676})
ioctl$sock_ifreq(r5, 0x8917, &(0x7f0000000300)={'lo\x00', @ifru_data=&(0x7f00000001c0)="16e667ea25efad95e8e866bb6ef7f6ba94b72b63a28bcb7eafa978bdbe09a4d8"})
getsockopt$inet_int(r4, 0x0, 0x0, &(0x7f0000000600), &(0x7f0000000640)=0x4)
getsockname$unix(r1, &(0x7f0000000680), &(0x7f0000000700)=0x6e)

2018/03/30 13:05:54 executing program 6:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYBLOB="22811e2630b1d0ac3463"], 0x1)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r1, r2, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = getpgid(0xffffffffffffffff)
syz_open_procfs(r3, &(0x7f00000005c0)='net/ip6_tables_targets\x00')
process_vm_writev(r3, &(0x7f0000000180)=[{&(0x7f0000000140)=""/22, 0x16}], 0x1, &(0x7f00000003c0)=[{&(0x7f0000000740)=""/173, 0xad}], 0x1, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
r4 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
r5 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
r6 = dup3(0xffffffffffffffff, r0, 0x0)
setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8)
syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00')
sendmsg$IPVS_CMD_NEW_DEST(r6, &(0x7f0000000540)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x2000400}, 0xc, &(0x7f0000000500)={&(0x7f0000000240)=ANY=[@ANYPTR], 0x1}, 0x1, 0x0, 0x0, 0x10}, 0x4)
fcntl$setstatus(r1, 0x4, 0x6000)
mq_open(&(0x7f0000000800)=':em1\x00', 0x40, 0x4, &(0x7f0000000840)={0x4000000000000000, 0x0, 0x9, 0x6, 0x0, 0xff})
pwritev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000c00)}], 0x1, 0x0)
ioctl$DRM_IOCTL_AGP_ALLOC(r6, 0xc0206434, &(0x7f0000000440)={0x9dca, <r7=>0x0, 0x10002, 0x4})
ioctl$DRM_IOCTL_AGP_BIND(r5, 0x40106436, &(0x7f00000004c0)={r7, 0x676})
ioctl$sock_ifreq(r5, 0x8917, &(0x7f0000000300)={'lo\x00', @ifru_data=&(0x7f00000001c0)="16e667ea25efad95e8e866bb6ef7f6ba94b72b63a28bcb7eafa978bdbe09a4d8"})
getsockopt$inet_int(r4, 0x0, 0x0, &(0x7f0000000600), &(0x7f0000000640)=0x4)
getsockname$unix(r1, &(0x7f0000000680), &(0x7f0000000700)=0x6e)

** 20 printk messages dropped ** [  585.406299] binder: 29335:29340 transaction failed 29201/-22, size 40-16 line 3197
** 3 printk messages dropped ** [  585.422068] binder: 29342:29348 transaction failed 29201/-22, size 40-16 line 3197
2018/03/30 13:05:54 executing program 0:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYBLOB="22811e2630b1d0ac3463"], 0x1)
tee(r1, 0xffffffffffffffff, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r2 = getpgid(0xffffffffffffffff)
syz_open_procfs(r2, &(0x7f00000005c0)='net/ip6_tables_targets\x00')
process_vm_writev(r2, &(0x7f0000000180)=[{&(0x7f0000000140)=""/22, 0x16}], 0x1, &(0x7f00000003c0)=[{&(0x7f0000000740)=""/173, 0xad}], 0x1, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
r3 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
setns(0xffffffffffffffff, 0x0)
r4 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
r5 = dup3(0xffffffffffffffff, r0, 0x80000)
setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8)
syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00')
sendmsg$IPVS_CMD_NEW_DEST(r5, &(0x7f0000000540)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x2000400}, 0xc, &(0x7f0000000500)={&(0x7f0000000240)=ANY=[@ANYPTR], 0x1}, 0x1, 0x0, 0x0, 0x10}, 0x0)
sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10}, 0xc, &(0x7f0000000340)={&(0x7f0000000480)=ANY=[@ANYBLOB='H\x00\x00\x00'], 0x1}, 0x1}, 0x0)
fcntl$setstatus(r1, 0x4, 0x6000)
mq_open(&(0x7f0000000800)=':em1\x00', 0x40, 0x4, &(0x7f0000000840)={0x4000000000000000, 0x0, 0x9, 0x6, 0x0, 0xff, 0x7})
pwritev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000c00)}], 0x1, 0x0)
ioctl$DRM_IOCTL_AGP_ALLOC(r5, 0xc0206434, &(0x7f0000000440)={0x9dca, <r6=>0x0, 0x10002, 0x4})
ioctl$DRM_IOCTL_AGP_BIND(r4, 0x40106436, &(0x7f00000004c0)={r6, 0x676})
ioctl$sock_ifreq(r4, 0x8917, &(0x7f0000000300)={'lo\x00', @ifru_data=&(0x7f00000001c0)="16e667ea25efad95e8e866bb6ef7f6ba94b72b63a28bcb7eafa978bdbe09a4d8"})
getsockopt$inet_int(r3, 0x0, 0x0, &(0x7f0000000600), &(0x7f0000000640)=0x4)
getsockname$unix(r1, &(0x7f0000000680), &(0x7f0000000700)=0x6e)

2018/03/30 13:05:54 executing program 4:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
r1 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000002880)='/selinux/avc/cache_stats\x00', 0x0, 0x0)
ioctl$EVIOCSABS20(r1, 0x401845e0, &(0x7f00000028c0)={0x1000, 0x7fff, 0x1ff, 0xffffffff, 0x7, 0x40})
fchdir(r0)
r2 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(r2, &(0x7f0000000080)=ANY=[@ANYBLOB="00811e2630b1d0ac3463"], 0x1)
setsockopt$packet_add_memb(r2, 0x107, 0x1, &(0x7f0000002900)={0x0, 0x1, 0x6}, 0x10)
r3 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r2, r3, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r3, 0x0)
inotify_init1(0x800)
ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
r4 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
setns(r3, 0x8000000)
r5 = socket$nl_xfrm(0x10, 0x3, 0x6)
r6 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
dup3(r3, r0, 0x80000)
setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8)
r7 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00')
sendmsg$IPVS_CMD_NEW_DEST(0xffffffffffffffff, &(0x7f0000000540)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x2000400}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)=ANY=[@ANYBLOB=',\x00\x00\x00'], 0x1}, 0x1, 0x0, 0x0, 0x10}, 0x4)
sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10}, 0xc, &(0x7f0000000340)={&(0x7f0000000480)=ANY=[@ANYBLOB='H\x00\x00\x00'], 0x1}, 0x1}, 0x0)
sendmsg$IPVS_CMD_GET_DEST(r2, &(0x7f0000000880)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f00000005c0)={&(0x7f0000000740)={0x138, r7, 0x208, 0x70bd2b, 0x25dfdbfb, {0x8}, [@IPVS_CMD_ATTR_SERVICE={0x28, 0x1, [@IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@multicast2=0xe0000002}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x3}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x7fff}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x8c6}, @IPVS_CMD_ATTR_DAEMON={0x50, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @remote={0xac, 0x14, 0x14, 0xbb}}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x400}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x10001}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'syz_tun\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x6}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x2}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x30, 0x2, [@IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x2}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv6=@ipv4={[], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0xffffffff}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0xafa6}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x1}, @IPVS_CMD_ATTR_DEST={0x6c, 0x2, [@IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x7}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv4=@remote={0xac, 0x14, 0x14, 0xbb}}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x8}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x1}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x5}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x3}, @IPVS_DEST_ATTR_PORT={0x8, 0x2, 0x4e22}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv6=@mcast2={0xff, 0x2, [], 0x1}}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x10000}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x701a3921}]}]}, 0x138}, 0x1, 0x0, 0x0, 0x90}, 0x4)
fcntl$setstatus(r2, 0x4, 0x6000)
setsockopt$sock_linger(r4, 0x1, 0xd, &(0x7f00000008c0)={0x1, 0x2}, 0x8)
pwritev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000c00)="cfb93447d6feaef9f73c0561e075a8295d43017ab1a157786dcda36c5eec92a4306f284fa7e3ed364cc2da5c08cf7e4030d394520e123eee6d9ab275c91c174b1364fc943b49faefe12f605b5ce6c1400a91210c00477f900aff390901bf594c18557cb38a7d57ac8ded098b96b9dfc125e3bdc9305193f4cd256068baca5208160d820b9e7a043666ba4801cf6d557fc0f97f35c13ec6c0d1fe97ce1af1c17078ef47ab955200836671e402717481d14936b09828fd6f55fda2f11eb4c61b480e941133c0a4c5ec54033d0d174742191754ffe28b093596286a78ea01078337ada8585aa98dcc1143689002e31ccc5b9f5cfd2bbce5683a0f91b395391a60ba8e8f4d3c10c82c71caa74c44c8b0f3e42f1fc264497d5b9dabf309bad7bd", 0x11e}], 0x1, 0x0)
sendmmsg(r5, &(0x7f00000027c0)=[{{0x0, 0x0, &(0x7f0000000a00)=[{&(0x7f0000000900)="913da470640ae70fe168a71ad316e5525ce43547f28d8c56cb5cd246950c2d44a514698b3aebf2b60d933814378b0b9b750dec28bdbeedda6c8af5f3418ff8c43701e5dea492428ecdcf0e8c2a19f60e388b478179256834360c5ee359dbe4fabee36883a8314f0ea64dea3a732dffbe26a02e8327a0f7174a6990389e5b608d5300c271f26b3b37cc88e720a477e5f1aa2751af90d35d72606ac73f72dab39aad418a6335d44c785ba83edc9619a3221ae39ef2fed1657e426fa293a739cd779a6c645b3d29bb184041476e8e6e737e5fa1c4312360", 0xd6}], 0x1, 0x0, 0x0, 0x8000}, 0x3f}, {{&(0x7f0000002240)=@nl=@unspec, 0x80, &(0x7f0000002680)=[{&(0x7f00000022c0)="756a6b1895d55b0b292a3985cd35f28cfa8d5ab20a3448791e47ec9e971be82f993ebd55ec843a76ccd644a71222e57119e6f8866f59ba0b89c4cf71a9ce853f72bd99ac9097baf924ea3e3fbceaf0a0df15deb45ae757832bec56c67c0ad44e0ea5fcbc12f898989e1773427ad180efff1044e98613dab446587dd52a0deacb4074e01d97cd46c6e633ae1c1011fd2123c766e6fea028799cf82a562bd9d52c544241172f684398ac1b", 0xaa}, {&(0x7f0000002440)="c802b7c29c92c7ddcf8b11133e071ae83e8c0b0827764303ad44356d381633ce1fdd31e1641872e8d6b4c1a974d97d", 0x2f}, {&(0x7f0000002540)="446c9b3779f2a3dc39f3a3541d912b01ca9865e4172a83cda910f6b10dd97377212eb5279c", 0x25}], 0x3, &(0x7f0000002700)=[{0x98, 0x10f, 0x200, "4f483406ed4a2e47550522989e031e3e239b59c5dc988744d266f33171b6d4a8e54f025a1e1be02c21ad9675e29aea96625352eec0db268e5c70b8e22a2bb0e11b9e6d9613d4e8e338194d9a41821db1ef97a16b16e5263d008bb6ce86b1e26f4d59926a9a72bed62192dc96eaa8a033c9ddaf2fc8c5fb9e765e5ff99cc5ae6fa7bc4a4f0abcb9"}], 0x98, 0x800}, 0x1200000}], 0x2, 0x20040000)
sendmsg$IPVS_CMD_DEL_DAEMON(r2, &(0x7f0000000280)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000240)={&(0x7f0000000180)={0x28, 0x0, 0xb30, 0x0, 0x25dfdbfc, {0xa}, [@IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x3ff}, @IPVS_CMD_ATTR_SERVICE={0xc, 0x1, [@IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8}]}]}, 0x28}, 0x1}, 0x0)
ioctl$sock_ifreq(r6, 0x8917, &(0x7f0000000300)={'lo\x00', @ifru_data=&(0x7f00000001c0)="16e667ea25efad95e8e866bb6ef7f6ba94b72b63a28bcb7eafa978bdbe09a4d8"})
getsockopt$inet_int(r4, 0x0, 0x0, &(0x7f0000000600), &(0x7f0000000640)=0x4)
getsockname$unix(r2, &(0x7f0000000680), &(0x7f0000000700)=0x6e)

2018/03/30 13:05:54 executing program 5:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYBLOB="00811e2630b1d0ac3463"], 0x1)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r1, r2, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
setns(r2, 0x0)
r3 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/loop-control\x00', 0x0, 0x0)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)
r4 = dup(r3)
getsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffff9c, 0x84, 0x6f, &(0x7f0000000340)={<r5=>0x0, 0x3c, &(0x7f00000005c0)=[@in={0x2, 0x4e23, @local={0xac, 0x14, 0x14, 0xaa}}, @in={0x2, 0x4e24, @broadcast=0xffffffff}, @in6={0xa, 0x0, 0x100000000, @loopback={0x0, 0x1}, 0x323d000000000}]}, &(0x7f0000000640)=0xc)
setsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r4, 0x84, 0xa, &(0x7f0000000680)={0xcff3, 0x80000000, 0x3, 0x0, 0x0, 0x66e, 0x5, 0x0, r5}, 0x20)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)
mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x5c831, 0xffffffffffffffff, 0x0)
openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/mls\x00', 0x0, 0x0)
setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(0xffffffffffffffff, 0x10e, 0x2, &(0x7f0000000340)=0xc, 0x4)
madvise(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x9)
r6 = syz_open_dev$usbmon(&(0x7f0000000040)='/dev/usbmon#\x00', 0x0, 0x80000)
ioctl$KDSKBMODE(0xffffffffffffffff, 0x4b45, &(0x7f0000000080))
getsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r6, 0x84, 0x75, &(0x7f00000000c0)={0x0, 0x6}, &(0x7f0000000100)=0x8)
ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)
r7 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
ioctl$TIOCLINUX3(r7, 0x541c, &(0x7f0000000040)=0x3)
ioctl$LOOP_CTL_REMOVE(r3, 0x4c81, 0x0)

2018/03/30 13:05:54 executing program 3:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[], 0x0)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r1, 0xffffffffffffffff, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
setns(r2, 0x0)
r3 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/loop-control\x00', 0x0, 0x0)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)
r4 = dup(r3)
getsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffff9c, 0x84, 0x6f, &(0x7f0000000340)={<r5=>0x0, 0x3c, &(0x7f00000005c0)=[@in={0x2, 0x4e23, @local={0xac, 0x14, 0x14, 0xaa}}, @in={0x2, 0x4e24, @broadcast=0xffffffff}, @in6={0xa, 0x0, 0x100000000, @loopback={0x0, 0x1}, 0x323d000000000}]}, &(0x7f0000000640)=0xc)
setsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r4, 0x84, 0xa, &(0x7f0000000680)={0xcff3, 0x80000000, 0x3, 0x0, 0x0, 0x66e, 0x5, 0x1, r5}, 0x20)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)
mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x5c831, 0xffffffffffffffff, 0x0)
openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/mls\x00', 0x0, 0x0)
setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(0xffffffffffffffff, 0x10e, 0x2, &(0x7f0000000340)=0xc, 0x4)
madvise(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x9)
r6 = syz_open_dev$usbmon(&(0x7f0000000040)='/dev/usbmon#\x00', 0x0, 0x80000)
ioctl$KDSKBMODE(0xffffffffffffffff, 0x4b45, &(0x7f0000000080))
getsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r6, 0x84, 0x75, &(0x7f00000000c0)={0x0, 0x6}, &(0x7f0000000100)=0x8)
setsockopt$inet_sctp6_SCTP_AUTH_KEY(r6, 0x84, 0x17, &(0x7f0000000500)=ANY=[], 0x0)
ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82)
ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82)
r7 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
ioctl$TIOCLINUX3(r7, 0x541c, &(0x7f0000000040)=0x3)
ioctl$LOOP_CTL_REMOVE(r3, 0x4c81, 0x0)

** 5 printk messages dropped ** [  585.450199] binder: undelivered TRANSACTION_ERROR: 29201
** 4 printk messages dropped ** [  585.475599] binder: 29347:29351 transaction failed 29201/-22, size 40-16 line 3197
** 21 printk messages dropped ** [  585.539803] binder: 29357:29366 transaction failed 29201/-22, size 40-16 line 3197
** 1 printk messages dropped ** [  585.540184] binder: 29362:29368 transaction failed 29201/-22, size 40-16 line 3197
2018/03/30 13:05:54 executing program 4:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
r1 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000002880)='/selinux/avc/cache_stats\x00', 0x0, 0x0)
ioctl$EVIOCSABS20(r1, 0x401845e0, &(0x7f00000028c0)={0x1000, 0x7fff, 0x1ff, 0xffffffff, 0x7, 0x40})
fchdir(r0)
r2 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(r2, &(0x7f0000000080)=ANY=[@ANYBLOB="00811e2630b1d0ac3463"], 0x1)
setsockopt$packet_add_memb(r2, 0x107, 0x1, &(0x7f0000002900)={0x0, 0x1, 0x6}, 0x10)
r3 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r2, r3, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r3, 0x0)
inotify_init1(0x800)
ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
r4 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
setns(r3, 0x8000000)
r5 = socket$nl_xfrm(0x10, 0x3, 0x6)
r6 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
dup3(r3, r0, 0x80000)
setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8)
r7 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00')
sendmsg$IPVS_CMD_NEW_DEST(0xffffffffffffffff, &(0x7f0000000540)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x2000400}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)=ANY=[@ANYBLOB=',\x00\x00\x00'], 0x1}, 0x1, 0x0, 0x0, 0x10}, 0x4)
sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10}, 0xc, &(0x7f0000000340)={&(0x7f0000000480)=ANY=[@ANYBLOB='H\x00\x00\x00'], 0x1}, 0x1}, 0x0)
sendmsg$IPVS_CMD_GET_DEST(r2, &(0x7f0000000880)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f00000005c0)={&(0x7f0000000740)={0x138, r7, 0x208, 0x70bd2b, 0x25dfdbfb, {0x8}, [@IPVS_CMD_ATTR_SERVICE={0x28, 0x1, [@IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@multicast2=0xe0000002}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x3}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x7fff}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x8c6}, @IPVS_CMD_ATTR_DAEMON={0x50, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @remote={0xac, 0x14, 0x14, 0xbb}}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x400}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x10001}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'syz_tun\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x6}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x2}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x30, 0x2, [@IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x2}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv6=@ipv4={[], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0xffffffff}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0xafa6}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x1}, @IPVS_CMD_ATTR_DEST={0x6c, 0x2, [@IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x7}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv4=@remote={0xac, 0x14, 0x14, 0xbb}}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x8}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x1}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x5}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x3}, @IPVS_DEST_ATTR_PORT={0x8, 0x2, 0x4e22}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv6=@mcast2={0xff, 0x2, [], 0x1}}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x10000}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x701a3921}]}]}, 0x138}, 0x1, 0x0, 0x0, 0x90}, 0x4)
fcntl$setstatus(r2, 0x4, 0x6000)
setsockopt$sock_linger(r4, 0x1, 0xd, &(0x7f00000008c0)={0x1, 0x2}, 0x8)
pwritev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000c00)="cfb93447d6feaef9f73c0561e075a8295d43017ab1a157786dcda36c5eec92a4306f284fa7e3ed364cc2da5c08cf7e4030d394520e123eee6d9ab275c91c174b1364fc943b49faefe12f605b5ce6c1400a91210c00477f900aff390901bf594c18557cb38a7d57ac8ded098b96b9dfc125e3bdc9305193f4cd256068baca5208160d820b9e7a043666ba4801cf6d557fc0f97f35c13ec6c0d1fe97ce1af1c17078ef47ab955200836671e402717481d14936b09828fd6f55fda2f11eb4c61b480e941133c0a4c5ec54033d0d174742191754ffe28b093596286a78ea01078337ada8585aa98dcc1143689002e31ccc5b9f5cfd2bbce5683a0f91b395391a60ba8e8f4d3c10c82c71caa74c44c8b0f3e42f1fc264497d5b9dabf309bad7bd", 0x11e}], 0x1, 0x0)
sendmmsg(r5, &(0x7f00000027c0)=[{{0x0, 0x0, &(0x7f0000000a00)=[{&(0x7f0000000900)="913da470640ae70fe168a71ad316e5525ce43547f28d8c56cb5cd246950c2d44a514698b3aebf2b60d933814378b0b9b750dec28bdbeedda6c8af5f3418ff8c43701e5dea492428ecdcf0e8c2a19f60e388b478179256834360c5ee359dbe4fabee36883a8314f0ea64dea3a732dffbe26a02e8327a0f7174a6990389e5b608d5300c271f26b3b37cc88e720a477e5f1aa2751af90d35d72606ac73f72dab39aad418a6335d44c785ba83edc9619a3221ae39ef2fed1657e426fa293a739cd779a6c645b3d29bb184041476e8e6e737e5fa1c4312360", 0xd6}], 0x1, 0x0, 0x0, 0x8000}, 0x3f}, {{&(0x7f0000002240)=@nl=@unspec, 0x80, &(0x7f0000002680)=[{&(0x7f00000022c0)="756a6b1895d55b0b292a3985cd35f28cfa8d5ab20a3448791e47ec9e971be82f993ebd55ec843a76ccd644a71222e57119e6f8866f59ba0b89c4cf71a9ce853f72bd99ac9097baf924ea3e3fbceaf0a0df15deb45ae757832bec56c67c0ad44e0ea5fcbc12f898989e1773427ad180efff1044e98613dab446587dd52a0deacb4074e01d97cd46c6e633ae1c1011fd2123c766e6fea028799cf82a562bd9d52c544241172f684398ac1b", 0xaa}, {&(0x7f0000002440)="c802b7c29c92c7ddcf8b11133e071ae83e8c0b0827764303ad44356d381633ce1fdd31e1641872e8d6b4c1a974d97d", 0x2f}, {&(0x7f0000002540)="446c9b3779f2a3dc39f3a3541d912b01ca9865e4172a83cda910f6b10dd97377212eb5279c", 0x25}], 0x3, &(0x7f0000002700)=[{0x98, 0x10f, 0x200, "4f483406ed4a2e47550522989e031e3e239b59c5dc988744d266f33171b6d4a8e54f025a1e1be02c21ad9675e29aea96625352eec0db268e5c70b8e22a2bb0e11b9e6d9613d4e8e338194d9a41821db1ef97a16b16e5263d008bb6ce86b1e26f4d59926a9a72bed62192dc96eaa8a033c9ddaf2fc8c5fb9e765e5ff99cc5ae6fa7bc4a4f0abcb9"}], 0x98, 0x800}, 0x1200000}], 0x2, 0x20040000)
sendmsg$IPVS_CMD_DEL_DAEMON(r2, &(0x7f0000000280)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000240)={&(0x7f0000000180)={0x28, 0x0, 0xb30, 0x0, 0x25dfdbfc, {0xa}, [@IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x3ff}, @IPVS_CMD_ATTR_SERVICE={0xc, 0x1, [@IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8}]}]}, 0x28}, 0x1}, 0x0)
ioctl$sock_ifreq(r6, 0x8917, &(0x7f0000000300)={'lo\x00', @ifru_data=&(0x7f00000001c0)="16e667ea25efad95e8e866bb6ef7f6ba94b72b63a28bcb7eafa978bdbe09a4d8"})
getsockopt$inet_int(r4, 0x0, 0x0, &(0x7f0000000600), &(0x7f0000000640)=0x4)
getsockname$unix(r2, &(0x7f0000000680), &(0x7f0000000700)=0x6e)

2018/03/30 13:05:54 executing program 6:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYBLOB="22811e2630b1d0ac3463"], 0x1)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r1, r2, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = getpgid(0xffffffffffffffff)
syz_open_procfs(r3, &(0x7f00000005c0)='net/ip6_tables_targets\x00')
process_vm_writev(r3, &(0x7f0000000180)=[{&(0x7f0000000140)=""/22, 0x16}], 0x1, &(0x7f00000003c0)=[{&(0x7f0000000740)=""/173, 0xad}], 0x1, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
r4 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
r5 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
r6 = dup3(0xffffffffffffffff, r0, 0x0)
setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8)
syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00')
sendmsg$IPVS_CMD_NEW_DEST(r6, &(0x7f0000000540)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x2000400}, 0xc, &(0x7f0000000500)={&(0x7f0000000240)=ANY=[@ANYPTR], 0x1}, 0x1, 0x0, 0x0, 0x10}, 0x4)
fcntl$setstatus(r1, 0x4, 0x6000)
mq_open(&(0x7f0000000800)=':em1\x00', 0x40, 0x4, &(0x7f0000000840)={0x4000000000000000, 0x0, 0x9, 0x6, 0x0, 0xff, 0x7})
pwritev(0xffffffffffffffff, &(0x7f00000000c0), 0x0, 0x0)
ioctl$DRM_IOCTL_AGP_ALLOC(r6, 0xc0206434, &(0x7f0000000440)={0x9dca, <r7=>0x0, 0x10002, 0x4})
ioctl$DRM_IOCTL_AGP_BIND(r5, 0x40106436, &(0x7f00000004c0)={r7, 0x676})
ioctl$sock_ifreq(r5, 0x8917, &(0x7f0000000300)={'lo\x00', @ifru_data=&(0x7f00000001c0)="16e667ea25efad95e8e866bb6ef7f6ba94b72b63a28bcb7eafa978bdbe09a4d8"})
getsockopt$inet_int(r4, 0x0, 0x0, &(0x7f0000000600), &(0x7f0000000640)=0x4)
getsockname$unix(r1, &(0x7f0000000680), &(0x7f0000000700)=0x6e)

2018/03/30 13:05:54 executing program 7:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYBLOB], 0x1)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r1, r2, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = getpgid(0xffffffffffffffff)
syz_open_procfs(r3, &(0x7f00000005c0)='net/ip6_tables_targets\x00')
process_vm_writev(r3, &(0x7f0000000180)=[{&(0x7f0000000140)=""/22, 0x16}], 0x1, &(0x7f00000003c0)=[{&(0x7f0000000740)=""/173, 0xad}], 0x1, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
r4 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
r5 = dup3(0xffffffffffffffff, r0, 0x80000)
setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8)
syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00')
fcntl$setstatus(r1, 0x4, 0x6000)
mq_open(&(0x7f0000000800)=':em1\x00', 0x40, 0x4, &(0x7f0000000840)={0x4000000000000000, 0x0, 0x9, 0x6, 0x0, 0xff, 0x7})
pwritev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000c00)}], 0x1, 0x0)
ioctl$DRM_IOCTL_AGP_ALLOC(r5, 0xc0206434, &(0x7f0000000440)={0x9dca, <r6=>0x0, 0x10002, 0x4})
ioctl$DRM_IOCTL_AGP_BIND(r4, 0x40106436, &(0x7f00000004c0)={r6, 0x676})
ioctl$sock_ifreq(r4, 0x8917, &(0x7f0000000300)={'lo\x00', @ifru_data=&(0x7f00000001c0)="16e667ea25efad95e8e866bb6ef7f6ba94b72b63a28bcb7eafa978bdbe09a4d8"})
getsockopt$inet_int(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000600), &(0x7f0000000640)=0x4)
getsockname$unix(r1, &(0x7f0000000680), &(0x7f0000000700)=0x6e)

2018/03/30 13:05:54 executing program 5:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYBLOB="00811e2630b1d0ac3463"], 0x1)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r1, r2, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
setns(r2, 0x0)
r3 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/loop-control\x00', 0x0, 0x0)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)
r4 = dup(r3)
getsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffff9c, 0x84, 0x6f, &(0x7f0000000340)={<r5=>0x0, 0x3c, &(0x7f00000005c0)=[@in={0x2, 0x4e23, @local={0xac, 0x14, 0x14, 0xaa}}, @in={0x2, 0x4e24, @broadcast=0xffffffff}, @in6={0xa, 0x0, 0x100000000, @loopback={0x0, 0x1}, 0x323d000000000}]}, &(0x7f0000000640)=0xc)
setsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r4, 0x84, 0xa, &(0x7f0000000680)={0xcff3, 0x80000000, 0x3, 0x0, 0x0, 0x66e, 0x5, 0x0, r5}, 0x20)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)
mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x5c831, 0xffffffffffffffff, 0x0)
openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/mls\x00', 0x0, 0x0)
setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(0xffffffffffffffff, 0x10e, 0x2, &(0x7f0000000340)=0xc, 0x4)
madvise(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x9)
r6 = syz_open_dev$usbmon(&(0x7f0000000040)='/dev/usbmon#\x00', 0x0, 0x80000)
ioctl$KDSKBMODE(0xffffffffffffffff, 0x4b45, &(0x7f0000000080))
getsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r6, 0x84, 0x75, &(0x7f00000000c0)={0x0, 0x6}, &(0x7f0000000100)=0x8)
ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)
r7 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
ioctl$TIOCLINUX3(r7, 0x541c, &(0x7f0000000040)=0x3)
ioctl$LOOP_CTL_REMOVE(r3, 0x4c81, 0x0)

2018/03/30 13:05:54 executing program 0:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r1, r2, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = getpgid(0xffffffffffffffff)
syz_open_procfs(r3, &(0x7f00000005c0)='net/ip6_tables_targets\x00')
process_vm_writev(r3, &(0x7f0000000180)=[{&(0x7f0000000140)=""/22, 0x16}], 0x1, &(0x7f00000003c0)=[{&(0x7f0000000740)=""/173, 0xad}], 0x1, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
r4 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
setns(r2, 0x0)
r5 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
r6 = dup3(0xffffffffffffffff, r0, 0x80000)
setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8)
syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00')
sendmsg$IPVS_CMD_NEW_DEST(r6, &(0x7f0000000540)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x2000400}, 0xc, &(0x7f0000000500)={&(0x7f0000000240)=ANY=[@ANYPTR], 0x1}, 0x1, 0x0, 0x0, 0x10}, 0x0)
sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10}, 0xc, &(0x7f0000000340)={&(0x7f0000000480)=ANY=[@ANYBLOB='H\x00\x00\x00'], 0x1}, 0x1}, 0x0)
fcntl$setstatus(r1, 0x4, 0x6000)
mq_open(&(0x7f0000000800)=':em1\x00', 0x40, 0x4, &(0x7f0000000840)={0x4000000000000000, 0x0, 0x9, 0x6, 0x0, 0xff, 0x7})
pwritev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000c00)}], 0x1, 0x0)
ioctl$DRM_IOCTL_AGP_ALLOC(r6, 0xc0206434, &(0x7f0000000440)={0x9dca, <r7=>0x0, 0x10002, 0x4})
ioctl$DRM_IOCTL_AGP_BIND(r5, 0x40106436, &(0x7f00000004c0)={r7, 0x676})
ioctl$sock_ifreq(r5, 0x8917, &(0x7f0000000300)={'lo\x00', @ifru_data=&(0x7f00000001c0)="16e667ea25efad95e8e866bb6ef7f6ba94b72b63a28bcb7eafa978bdbe09a4d8"})
getsockopt$inet_int(r4, 0x0, 0x0, &(0x7f0000000600), &(0x7f0000000640)=0x4)
getsockname$unix(r1, &(0x7f0000000680), &(0x7f0000000700)=0x6e)

2018/03/30 13:05:54 executing program 2:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYBLOB="22811e2630b1d0ac3463"], 0x1)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r1, r2, 0x0, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = getpgid(0xffffffffffffffff)
syz_open_procfs(r3, &(0x7f00000005c0)='net/ip6_tables_targets\x00')
process_vm_writev(r3, &(0x7f0000000180)=[{&(0x7f0000000140)=""/22, 0x16}], 0x1, &(0x7f00000003c0)=[{&(0x7f0000000740)=""/173, 0xad}], 0x1, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
r4 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
setns(r2, 0x0)
r5 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
r6 = dup3(0xffffffffffffffff, r0, 0x80000)
setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8)
syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00')
sendmsg$IPVS_CMD_NEW_DEST(r6, &(0x7f0000000540)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x2000400}, 0xc, &(0x7f0000000500)={&(0x7f0000000240)=ANY=[@ANYPTR], 0x1}, 0x1, 0x0, 0x0, 0x10}, 0x4)
sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10}, 0xc, &(0x7f0000000340)={&(0x7f0000000480)=ANY=[@ANYBLOB='H\x00\x00\x00'], 0x1}, 0x1}, 0x0)
fcntl$setstatus(r1, 0x4, 0x6000)
mq_open(&(0x7f0000000800)=':em1\x00', 0x40, 0x4, &(0x7f0000000840)={0x0, 0x0, 0x9, 0x6, 0x0, 0xff, 0x7})
pwritev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000c00)}], 0x1, 0x0)
ioctl$DRM_IOCTL_AGP_ALLOC(r6, 0xc0206434, &(0x7f0000000440)={0x9dca, <r7=>0x0, 0x10002, 0x4})
ioctl$DRM_IOCTL_AGP_BIND(r5, 0x40106436, &(0x7f00000004c0)={r7, 0x676})
ioctl$sock_ifreq(r5, 0x8917, &(0x7f0000000300)={'lo\x00', @ifru_data=&(0x7f00000001c0)="16e667ea25efad95e8e866bb6ef7f6ba94b72b63a28bcb7eafa978bdbe09a4d8"})
getsockopt$inet_int(r4, 0x0, 0x0, &(0x7f0000000600), &(0x7f0000000640)=0x4)
getsockname$unix(r1, &(0x7f0000000680), &(0x7f0000000700)=0x6e)

2018/03/30 13:05:54 executing program 3:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[], 0x0)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r1, 0xffffffffffffffff, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
setns(r2, 0x0)
r3 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/loop-control\x00', 0x0, 0x0)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)
r4 = dup(r3)
getsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffff9c, 0x84, 0x6f, &(0x7f0000000340)={<r5=>0x0, 0x3c, &(0x7f00000005c0)=[@in={0x2, 0x4e23, @local={0xac, 0x14, 0x14, 0xaa}}, @in={0x2, 0x4e24, @broadcast=0xffffffff}, @in6={0xa, 0x0, 0x100000000, @loopback={0x0, 0x1}, 0x323d000000000}]}, &(0x7f0000000640)=0xc)
setsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r4, 0x84, 0xa, &(0x7f0000000680)={0xcff3, 0x80000000, 0x3, 0x0, 0x0, 0x66e, 0x5, 0x1, r5}, 0x20)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)
mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x5c831, 0xffffffffffffffff, 0x0)
openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/mls\x00', 0x0, 0x0)
setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(0xffffffffffffffff, 0x10e, 0x2, &(0x7f0000000340)=0xc, 0x4)
madvise(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x9)
r6 = syz_open_dev$usbmon(&(0x7f0000000040)='/dev/usbmon#\x00', 0x0, 0x80000)
ioctl$KDSKBMODE(0xffffffffffffffff, 0x4b45, &(0x7f0000000080))
getsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r6, 0x84, 0x75, &(0x7f00000000c0)={0x0, 0x6}, &(0x7f0000000100)=0x8)
setsockopt$inet_sctp6_SCTP_AUTH_KEY(r6, 0x84, 0x17, &(0x7f0000000500)=ANY=[], 0x0)
ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82)
ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82)
r7 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
ioctl$TIOCLINUX3(r7, 0x541c, &(0x7f0000000040)=0x3)
ioctl$LOOP_CTL_REMOVE(r3, 0x4c81, 0x0)

2018/03/30 13:05:54 executing program 1:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYBLOB="22811e2630b1d0ac3463"], 0x1)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r1, r2, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = getpgid(0xffffffffffffffff)
syz_open_procfs(r3, &(0x7f00000005c0)='net/ip6_tables_targets\x00')
process_vm_writev(r3, &(0x7f0000000180), 0x0, &(0x7f00000003c0)=[{&(0x7f0000000740)=""/173, 0xad}], 0x1, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
r4 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
r5 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
r6 = dup3(0xffffffffffffffff, r0, 0x80000)
setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8)
syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00')
fcntl$setstatus(r1, 0x4, 0x6000)
mq_open(&(0x7f0000000800)=':em1\x00', 0x40, 0x4, &(0x7f0000000840)={0x4000000000000000, 0x0, 0x9, 0x6, 0x0, 0xff})
pwritev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000c00)}], 0x1, 0x0)
ioctl$DRM_IOCTL_AGP_ALLOC(r6, 0xc0206434, &(0x7f0000000440)={0x9dca, <r7=>0x0, 0x10002, 0x4})
ioctl$DRM_IOCTL_AGP_BIND(r5, 0x40106436, &(0x7f00000004c0)={r7, 0x676})
ioctl$sock_ifreq(r5, 0x8917, &(0x7f0000000300)={'lo\x00', @ifru_data=&(0x7f00000001c0)="16e667ea25efad95e8e866bb6ef7f6ba94b72b63a28bcb7eafa978bdbe09a4d8"})
getsockopt$inet_int(r4, 0x0, 0x0, &(0x7f0000000600), &(0x7f0000000640)=0x4)
getsockname$unix(r1, &(0x7f0000000680), &(0x7f0000000700)=0x6e)

** 2 printk messages dropped ** [  585.546549] binder: BINDER_SET_CONTEXT_MGR already set
[  585.546557] binder: 29358:29370 ioctl 40046207 0 returned -16
[  585.549213] binder: 29358:29370 got transaction with invalid offset (0, min 24 max 40) or object.
2018/03/30 13:05:54 executing program 5:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYBLOB="00811e2630b1d0ac3463"], 0x1)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r1, r2, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
setns(r2, 0x0)
r3 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/loop-control\x00', 0x0, 0x0)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)
r4 = dup(r3)
getsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffff9c, 0x84, 0x6f, &(0x7f0000000340)={<r5=>0x0, 0x3c, &(0x7f00000005c0)=[@in={0x2, 0x4e23, @local={0xac, 0x14, 0x14, 0xaa}}, @in={0x2, 0x4e24, @broadcast=0xffffffff}, @in6={0xa, 0x0, 0x100000000, @loopback={0x0, 0x1}, 0x323d000000000}]}, &(0x7f0000000640)=0xc)
setsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r4, 0x84, 0xa, &(0x7f0000000680)={0xcff3, 0x80000000, 0x3, 0x0, 0x0, 0x66e, 0x5, 0x0, r5}, 0x20)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)
mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x5c831, 0xffffffffffffffff, 0x0)
openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/mls\x00', 0x0, 0x0)
setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(0xffffffffffffffff, 0x10e, 0x2, &(0x7f0000000340)=0xc, 0x4)
madvise(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x9)
r6 = syz_open_dev$usbmon(&(0x7f0000000040)='/dev/usbmon#\x00', 0x0, 0x80000)
ioctl$KDSKBMODE(0xffffffffffffffff, 0x4b45, &(0x7f0000000080))
getsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r6, 0x84, 0x75, &(0x7f00000000c0)={0x0, 0x6}, &(0x7f0000000100)=0x8)
ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)
r7 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
ioctl$TIOCLINUX3(r7, 0x541c, &(0x7f0000000040)=0x3)
ioctl$LOOP_CTL_REMOVE(r3, 0x4c81, 0x0)

2018/03/30 13:05:54 executing program 6:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYBLOB="22811e2630b1d0ac3463"], 0x1)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r1, r2, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = getpgid(0xffffffffffffffff)
syz_open_procfs(r3, &(0x7f00000005c0)='net/ip6_tables_targets\x00')
process_vm_writev(r3, &(0x7f0000000180)=[{&(0x7f0000000140)=""/22, 0x16}], 0x1, &(0x7f00000003c0)=[{&(0x7f0000000740)=""/173, 0xad}], 0x1, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
r4 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
r5 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
r6 = dup3(0xffffffffffffffff, r0, 0x0)
setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8)
syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00')
sendmsg$IPVS_CMD_NEW_DEST(r6, &(0x7f0000000540)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x2000400}, 0xc, &(0x7f0000000500)={&(0x7f0000000240)=ANY=[@ANYPTR], 0x1}, 0x1, 0x0, 0x0, 0x10}, 0x4)
fcntl$setstatus(r1, 0x4, 0x6000)
mq_open(&(0x7f0000000800)=':em1\x00', 0x40, 0x4, &(0x7f0000000840)={0x4000000000000000, 0x0, 0x9, 0x6, 0x0, 0xff, 0x7})
pwritev(0xffffffffffffffff, &(0x7f00000000c0), 0x0, 0x0)
ioctl$DRM_IOCTL_AGP_ALLOC(r6, 0xc0206434, &(0x7f0000000440)={0x9dca, <r7=>0x0, 0x10002, 0x4})
ioctl$DRM_IOCTL_AGP_BIND(r5, 0x40106436, &(0x7f00000004c0)={r7, 0x676})
ioctl$sock_ifreq(r5, 0x8917, &(0x7f0000000300)={'lo\x00', @ifru_data=&(0x7f00000001c0)="16e667ea25efad95e8e866bb6ef7f6ba94b72b63a28bcb7eafa978bdbe09a4d8"})
getsockopt$inet_int(r4, 0x0, 0x0, &(0x7f0000000600), &(0x7f0000000640)=0x4)
getsockname$unix(r1, &(0x7f0000000680), &(0x7f0000000700)=0x6e)

** 28 printk messages dropped ** [  585.687467] binder: 29387:29395 got transaction with invalid offset (0, min 24 max 40) or object.
** 2 printk messages dropped ** [  585.689278] binder: 29389:29396 transaction failed 29201/-22, size 40-16 line 3197
2018/03/30 13:05:54 executing program 1:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYBLOB="22811e2630b1d0ac3463"], 0x1)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r1, r2, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = getpgid(0xffffffffffffffff)
syz_open_procfs(r3, &(0x7f00000005c0)='net/ip6_tables_targets\x00')
process_vm_writev(r3, &(0x7f0000000180), 0x0, &(0x7f00000003c0)=[{&(0x7f0000000740)=""/173, 0xad}], 0x1, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
r4 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
r5 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
r6 = dup3(0xffffffffffffffff, r0, 0x80000)
setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8)
syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00')
fcntl$setstatus(r1, 0x4, 0x6000)
mq_open(&(0x7f0000000800)=':em1\x00', 0x40, 0x4, &(0x7f0000000840)={0x4000000000000000, 0x0, 0x9, 0x6, 0x0, 0xff})
pwritev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000c00)}], 0x1, 0x0)
ioctl$DRM_IOCTL_AGP_ALLOC(r6, 0xc0206434, &(0x7f0000000440)={0x9dca, <r7=>0x0, 0x10002, 0x4})
ioctl$DRM_IOCTL_AGP_BIND(r5, 0x40106436, &(0x7f00000004c0)={r7, 0x676})
ioctl$sock_ifreq(r5, 0x8917, &(0x7f0000000300)={'lo\x00', @ifru_data=&(0x7f00000001c0)="16e667ea25efad95e8e866bb6ef7f6ba94b72b63a28bcb7eafa978bdbe09a4d8"})
getsockopt$inet_int(r4, 0x0, 0x0, &(0x7f0000000600), &(0x7f0000000640)=0x4)
getsockname$unix(r1, &(0x7f0000000680), &(0x7f0000000700)=0x6e)

2018/03/30 13:05:54 executing program 7:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYBLOB], 0x1)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r1, r2, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = getpgid(0xffffffffffffffff)
syz_open_procfs(r3, &(0x7f00000005c0)='net/ip6_tables_targets\x00')
process_vm_writev(r3, &(0x7f0000000180)=[{&(0x7f0000000140)=""/22, 0x16}], 0x1, &(0x7f00000003c0)=[{&(0x7f0000000740)=""/173, 0xad}], 0x1, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
r4 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
r5 = dup3(0xffffffffffffffff, r0, 0x80000)
setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8)
syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00')
fcntl$setstatus(r1, 0x4, 0x6000)
mq_open(&(0x7f0000000800)=':em1\x00', 0x40, 0x4, &(0x7f0000000840)={0x4000000000000000, 0x0, 0x9, 0x6, 0x0, 0xff, 0x7})
pwritev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000c00)}], 0x1, 0x0)
ioctl$DRM_IOCTL_AGP_ALLOC(r5, 0xc0206434, &(0x7f0000000440)={0x9dca, <r6=>0x0, 0x10002, 0x4})
ioctl$DRM_IOCTL_AGP_BIND(r4, 0x40106436, &(0x7f00000004c0)={r6, 0x676})
ioctl$sock_ifreq(r4, 0x8917, &(0x7f0000000300)={'lo\x00', @ifru_data=&(0x7f00000001c0)="16e667ea25efad95e8e866bb6ef7f6ba94b72b63a28bcb7eafa978bdbe09a4d8"})
getsockopt$inet_int(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000600), &(0x7f0000000640)=0x4)
getsockname$unix(r1, &(0x7f0000000680), &(0x7f0000000700)=0x6e)

2018/03/30 13:05:54 executing program 2:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYBLOB="22811e2630b1d0ac3463"], 0x1)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r1, r2, 0x0, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = getpgid(0xffffffffffffffff)
syz_open_procfs(r3, &(0x7f00000005c0)='net/ip6_tables_targets\x00')
process_vm_writev(r3, &(0x7f0000000180)=[{&(0x7f0000000140)=""/22, 0x16}], 0x1, &(0x7f00000003c0)=[{&(0x7f0000000740)=""/173, 0xad}], 0x1, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
r4 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
setns(r2, 0x0)
r5 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
r6 = dup3(0xffffffffffffffff, r0, 0x80000)
setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8)
syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00')
sendmsg$IPVS_CMD_NEW_DEST(r6, &(0x7f0000000540)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x2000400}, 0xc, &(0x7f0000000500)={&(0x7f0000000240)=ANY=[@ANYPTR], 0x1}, 0x1, 0x0, 0x0, 0x10}, 0x4)
sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10}, 0xc, &(0x7f0000000340)={&(0x7f0000000480)=ANY=[@ANYBLOB='H\x00\x00\x00'], 0x1}, 0x1}, 0x0)
fcntl$setstatus(r1, 0x4, 0x6000)
mq_open(&(0x7f0000000800)=':em1\x00', 0x40, 0x4, &(0x7f0000000840)={0x0, 0x0, 0x9, 0x6, 0x0, 0xff, 0x7})
pwritev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000c00)}], 0x1, 0x0)
ioctl$DRM_IOCTL_AGP_ALLOC(r6, 0xc0206434, &(0x7f0000000440)={0x9dca, <r7=>0x0, 0x10002, 0x4})
ioctl$DRM_IOCTL_AGP_BIND(r5, 0x40106436, &(0x7f00000004c0)={r7, 0x676})
ioctl$sock_ifreq(r5, 0x8917, &(0x7f0000000300)={'lo\x00', @ifru_data=&(0x7f00000001c0)="16e667ea25efad95e8e866bb6ef7f6ba94b72b63a28bcb7eafa978bdbe09a4d8"})
getsockopt$inet_int(r4, 0x0, 0x0, &(0x7f0000000600), &(0x7f0000000640)=0x4)
getsockname$unix(r1, &(0x7f0000000680), &(0x7f0000000700)=0x6e)

2018/03/30 13:05:54 executing program 4:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
r1 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000002880)='/selinux/avc/cache_stats\x00', 0x0, 0x0)
ioctl$EVIOCSABS20(r1, 0x401845e0, &(0x7f00000028c0)={0x1000, 0x7fff, 0x1ff, 0xffffffff, 0x7, 0x40})
fchdir(r0)
r2 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(r2, &(0x7f0000000080)=ANY=[@ANYBLOB="00811e2630b1d0ac3463"], 0x1)
setsockopt$packet_add_memb(r2, 0x107, 0x1, &(0x7f0000002900)={0x0, 0x1, 0x6}, 0x10)
r3 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r2, r3, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r3, 0x0)
inotify_init1(0x800)
ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
r4 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
setns(r3, 0x8000000)
r5 = socket$nl_xfrm(0x10, 0x3, 0x6)
r6 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
dup3(r3, r0, 0x80000)
setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8)
r7 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00')
sendmsg$IPVS_CMD_NEW_DEST(0xffffffffffffffff, &(0x7f0000000540)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x2000400}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)=ANY=[@ANYBLOB=',\x00\x00\x00'], 0x1}, 0x1, 0x0, 0x0, 0x10}, 0x4)
sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10}, 0xc, &(0x7f0000000340)={&(0x7f0000000480)=ANY=[@ANYBLOB='H\x00\x00\x00'], 0x1}, 0x1}, 0x0)
sendmsg$IPVS_CMD_GET_DEST(r2, &(0x7f0000000880)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f00000005c0)={&(0x7f0000000740)={0x138, r7, 0x208, 0x70bd2b, 0x25dfdbfb, {0x8}, [@IPVS_CMD_ATTR_SERVICE={0x28, 0x1, [@IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@multicast2=0xe0000002}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x3}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x7fff}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x8c6}, @IPVS_CMD_ATTR_DAEMON={0x50, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @remote={0xac, 0x14, 0x14, 0xbb}}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x400}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x10001}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'syz_tun\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x6}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x2}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x30, 0x2, [@IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x2}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv6=@ipv4={[], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0xffffffff}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0xafa6}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x1}, @IPVS_CMD_ATTR_DEST={0x6c, 0x2, [@IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x7}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv4=@remote={0xac, 0x14, 0x14, 0xbb}}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x8}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x1}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x5}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x3}, @IPVS_DEST_ATTR_PORT={0x8, 0x2, 0x4e22}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv6=@mcast2={0xff, 0x2, [], 0x1}}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x10000}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x701a3921}]}]}, 0x138}, 0x1, 0x0, 0x0, 0x90}, 0x4)
fcntl$setstatus(r2, 0x4, 0x6000)
setsockopt$sock_linger(r4, 0x1, 0xd, &(0x7f00000008c0)={0x1, 0x2}, 0x8)
pwritev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000c00)="cfb93447d6feaef9f73c0561e075a8295d43017ab1a157786dcda36c5eec92a4306f284fa7e3ed364cc2da5c08cf7e4030d394520e123eee6d9ab275c91c174b1364fc943b49faefe12f605b5ce6c1400a91210c00477f900aff390901bf594c18557cb38a7d57ac8ded098b96b9dfc125e3bdc9305193f4cd256068baca5208160d820b9e7a043666ba4801cf6d557fc0f97f35c13ec6c0d1fe97ce1af1c17078ef47ab955200836671e402717481d14936b09828fd6f55fda2f11eb4c61b480e941133c0a4c5ec54033d0d174742191754ffe28b093596286a78ea01078337ada8585aa98dcc1143689002e31ccc5b9f5cfd2bbce5683a0f91b395391a60ba8e8f4d3c10c82c71caa74c44c8b0f3e42f1fc264497d5b9dabf309bad7bd", 0x11e}], 0x1, 0x0)
sendmmsg(r5, &(0x7f00000027c0)=[{{0x0, 0x0, &(0x7f0000000a00)=[{&(0x7f0000000900)="913da470640ae70fe168a71ad316e5525ce43547f28d8c56cb5cd246950c2d44a514698b3aebf2b60d933814378b0b9b750dec28bdbeedda6c8af5f3418ff8c43701e5dea492428ecdcf0e8c2a19f60e388b478179256834360c5ee359dbe4fabee36883a8314f0ea64dea3a732dffbe26a02e8327a0f7174a6990389e5b608d5300c271f26b3b37cc88e720a477e5f1aa2751af90d35d72606ac73f72dab39aad418a6335d44c785ba83edc9619a3221ae39ef2fed1657e426fa293a739cd779a6c645b3d29bb184041476e8e6e737e5fa1c4312360", 0xd6}], 0x1, 0x0, 0x0, 0x8000}, 0x3f}, {{&(0x7f0000002240)=@nl=@unspec, 0x80, &(0x7f0000002680)=[{&(0x7f00000022c0)="756a6b1895d55b0b292a3985cd35f28cfa8d5ab20a3448791e47ec9e971be82f993ebd55ec843a76ccd644a71222e57119e6f8866f59ba0b89c4cf71a9ce853f72bd99ac9097baf924ea3e3fbceaf0a0df15deb45ae757832bec56c67c0ad44e0ea5fcbc12f898989e1773427ad180efff1044e98613dab446587dd52a0deacb4074e01d97cd46c6e633ae1c1011fd2123c766e6fea028799cf82a562bd9d52c544241172f684398ac1b", 0xaa}, {&(0x7f0000002440)="c802b7c29c92c7ddcf8b11133e071ae83e8c0b0827764303ad44356d381633ce1fdd31e1641872e8d6b4c1a974d97d", 0x2f}, {&(0x7f0000002540)="446c9b3779f2a3dc39f3a3541d912b01ca9865e4172a83cda910f6b10dd97377212eb5279c", 0x25}], 0x3, &(0x7f0000002700)=[{0x98, 0x10f, 0x200, "4f483406ed4a2e47550522989e031e3e239b59c5dc988744d266f33171b6d4a8e54f025a1e1be02c21ad9675e29aea96625352eec0db268e5c70b8e22a2bb0e11b9e6d9613d4e8e338194d9a41821db1ef97a16b16e5263d008bb6ce86b1e26f4d59926a9a72bed62192dc96eaa8a033c9ddaf2fc8c5fb9e765e5ff99cc5ae6fa7bc4a4f0abcb9"}], 0x98, 0x800}, 0x1200000}], 0x2, 0x20040000)
sendmsg$IPVS_CMD_DEL_DAEMON(r2, &(0x7f0000000280)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000240)={&(0x7f0000000180)={0x28, 0x0, 0xb30, 0x0, 0x25dfdbfc, {0xa}, [@IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x3ff}, @IPVS_CMD_ATTR_SERVICE={0xc, 0x1, [@IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8}]}]}, 0x28}, 0x1}, 0x0)
ioctl$sock_ifreq(r6, 0x8917, &(0x7f0000000300)={'lo\x00', @ifru_data=&(0x7f00000001c0)="16e667ea25efad95e8e866bb6ef7f6ba94b72b63a28bcb7eafa978bdbe09a4d8"})
getsockopt$inet_int(r4, 0x0, 0x0, &(0x7f0000000600), &(0x7f0000000640)=0x4)
getsockname$unix(r2, &(0x7f0000000680), &(0x7f0000000700)=0x6e)

2018/03/30 13:05:54 executing program 0:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r1, r2, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = getpgid(0xffffffffffffffff)
syz_open_procfs(r3, &(0x7f00000005c0)='net/ip6_tables_targets\x00')
process_vm_writev(r3, &(0x7f0000000180)=[{&(0x7f0000000140)=""/22, 0x16}], 0x1, &(0x7f00000003c0)=[{&(0x7f0000000740)=""/173, 0xad}], 0x1, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
r4 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
setns(r2, 0x0)
r5 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
r6 = dup3(0xffffffffffffffff, r0, 0x80000)
setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8)
syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00')
sendmsg$IPVS_CMD_NEW_DEST(r6, &(0x7f0000000540)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x2000400}, 0xc, &(0x7f0000000500)={&(0x7f0000000240)=ANY=[@ANYPTR], 0x1}, 0x1, 0x0, 0x0, 0x10}, 0x0)
sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10}, 0xc, &(0x7f0000000340)={&(0x7f0000000480)=ANY=[@ANYBLOB='H\x00\x00\x00'], 0x1}, 0x1}, 0x0)
fcntl$setstatus(r1, 0x4, 0x6000)
mq_open(&(0x7f0000000800)=':em1\x00', 0x40, 0x4, &(0x7f0000000840)={0x4000000000000000, 0x0, 0x9, 0x6, 0x0, 0xff, 0x7})
pwritev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000c00)}], 0x1, 0x0)
ioctl$DRM_IOCTL_AGP_ALLOC(r6, 0xc0206434, &(0x7f0000000440)={0x9dca, <r7=>0x0, 0x10002, 0x4})
ioctl$DRM_IOCTL_AGP_BIND(r5, 0x40106436, &(0x7f00000004c0)={r7, 0x676})
ioctl$sock_ifreq(r5, 0x8917, &(0x7f0000000300)={'lo\x00', @ifru_data=&(0x7f00000001c0)="16e667ea25efad95e8e866bb6ef7f6ba94b72b63a28bcb7eafa978bdbe09a4d8"})
getsockopt$inet_int(r4, 0x0, 0x0, &(0x7f0000000600), &(0x7f0000000640)=0x4)
getsockname$unix(r1, &(0x7f0000000680), &(0x7f0000000700)=0x6e)

2018/03/30 13:05:54 executing program 3:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[], 0x0)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r1, r2, 0x0, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
setns(r2, 0x0)
r3 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/loop-control\x00', 0x0, 0x0)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)
r4 = dup(r3)
getsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffff9c, 0x84, 0x6f, &(0x7f0000000340)={<r5=>0x0, 0x3c, &(0x7f00000005c0)=[@in={0x2, 0x4e23, @local={0xac, 0x14, 0x14, 0xaa}}, @in={0x2, 0x4e24, @broadcast=0xffffffff}, @in6={0xa, 0x0, 0x100000000, @loopback={0x0, 0x1}, 0x323d000000000}]}, &(0x7f0000000640)=0xc)
setsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r4, 0x84, 0xa, &(0x7f0000000680)={0xcff3, 0x80000000, 0x3, 0x0, 0x0, 0x66e, 0x5, 0x1, r5}, 0x20)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)
mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x5c831, 0xffffffffffffffff, 0x0)
openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/mls\x00', 0x0, 0x0)
setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(0xffffffffffffffff, 0x10e, 0x2, &(0x7f0000000340)=0xc, 0x4)
madvise(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x9)
r6 = syz_open_dev$usbmon(&(0x7f0000000040)='/dev/usbmon#\x00', 0x0, 0x80000)
ioctl$KDSKBMODE(0xffffffffffffffff, 0x4b45, &(0x7f0000000080))
getsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r6, 0x84, 0x75, &(0x7f00000000c0)={0x0, 0x6}, &(0x7f0000000100)=0x8)
setsockopt$inet_sctp6_SCTP_AUTH_KEY(r6, 0x84, 0x17, &(0x7f0000000500)=ANY=[], 0x0)
ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82)
ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82)
r7 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
ioctl$TIOCLINUX3(r7, 0x541c, &(0x7f0000000040)=0x3)
ioctl$LOOP_CTL_REMOVE(r3, 0x4c81, 0x0)

** 2 printk messages dropped ** [  585.690873] binder: BINDER_SET_CONTEXT_MGR already set
** 12 printk messages dropped ** [  585.724429] binder: 29394:29402 ioctl 40046207 0 returned -16
** 11 printk messages dropped ** [  585.778870] binder: 29417:29420 transaction failed 29201/-22, size 40-16 line 3197
** 4 printk messages dropped ** [  585.817156] binder: BINDER_SET_CONTEXT_MGR already set
[  585.817165] binder: 29423:29433 ioctl 40046207 0 returned -16
[  585.820171] binder: 29423:29433 got transaction with invalid offset (0, min 24 max 40) or object.
[  585.820259] binder: 29423:29433 transaction failed 29201/-22, size 40-16 line 3197
** 1 printk messages dropped ** [  585.822292] binder: 29426:29432 transaction failed 29201/-22, size 40-16 line 3197
[  585.824454] binder: BINDER_SET_CONTEXT_MGR already set
[  585.824461] binder: 29422:29430 ioctl 40046207 0 returned -16
2018/03/30 13:05:54 executing program 5:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYBLOB="00811e2630b1d0ac3463"], 0x1)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r1, r2, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
setns(r2, 0x0)
r3 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/loop-control\x00', 0x0, 0x0)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)
r4 = dup(r3)
getsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffff9c, 0x84, 0x6f, &(0x7f0000000340)={<r5=>0x0, 0x3c, &(0x7f00000005c0)=[@in={0x2, 0x4e23, @local={0xac, 0x14, 0x14, 0xaa}}, @in={0x2, 0x4e24, @broadcast=0xffffffff}, @in6={0xa, 0x0, 0x100000000, @loopback={0x0, 0x1}, 0x323d000000000}]}, &(0x7f0000000640)=0xc)
setsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r4, 0x84, 0xa, &(0x7f0000000680)={0xcff3, 0x80000000, 0x3, 0x0, 0x0, 0x66e, 0x5, 0x0, r5}, 0x20)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)
mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x5c831, 0xffffffffffffffff, 0x0)
openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/mls\x00', 0x0, 0x0)
setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(0xffffffffffffffff, 0x10e, 0x2, &(0x7f0000000340)=0xc, 0x4)
madvise(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x9)
r6 = syz_open_dev$usbmon(&(0x7f0000000040)='/dev/usbmon#\x00', 0x0, 0x80000)
ioctl$KDSKBMODE(0xffffffffffffffff, 0x4b45, &(0x7f0000000080))
setsockopt$inet_sctp6_SCTP_AUTH_KEY(r6, 0x84, 0x17, &(0x7f0000000500)=ANY=[], 0x0)
ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)
r7 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
ioctl$TIOCLINUX3(r7, 0x541c, &(0x7f0000000040)=0x3)
ioctl$LOOP_CTL_REMOVE(r3, 0x4c81, 0x0)

2018/03/30 13:05:54 executing program 2:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYBLOB="22811e2630b1d0ac3463"], 0x1)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r1, r2, 0x1, 0x0)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = getpgid(0xffffffffffffffff)
syz_open_procfs(r3, &(0x7f00000005c0)='net/ip6_tables_targets\x00')
process_vm_writev(r3, &(0x7f0000000180)=[{&(0x7f0000000140)=""/22, 0x16}], 0x1, &(0x7f00000003c0)=[{&(0x7f0000000740)=""/173, 0xad}], 0x1, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
r4 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
setns(r2, 0x0)
r5 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
r6 = dup3(0xffffffffffffffff, r0, 0x80000)
setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8)
syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00')
sendmsg$IPVS_CMD_NEW_DEST(r6, &(0x7f0000000540)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x2000400}, 0xc, &(0x7f0000000500)={&(0x7f0000000240)=ANY=[@ANYPTR], 0x1}, 0x1, 0x0, 0x0, 0x10}, 0x4)
sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10}, 0xc, &(0x7f0000000340)={&(0x7f0000000480)=ANY=[@ANYBLOB='H\x00\x00\x00'], 0x1}, 0x1}, 0x0)
fcntl$setstatus(r1, 0x4, 0x6000)
mq_open(&(0x7f0000000800)=':em1\x00', 0x40, 0x4, &(0x7f0000000840)={0x0, 0x0, 0x9, 0x6, 0x0, 0xff, 0x7})
pwritev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000c00)}], 0x1, 0x0)
ioctl$DRM_IOCTL_AGP_ALLOC(r6, 0xc0206434, &(0x7f0000000440)={0x9dca, <r7=>0x0, 0x10002, 0x4})
ioctl$DRM_IOCTL_AGP_BIND(r5, 0x40106436, &(0x7f00000004c0)={r7, 0x676})
ioctl$sock_ifreq(r5, 0x8917, &(0x7f0000000300)={'lo\x00', @ifru_data=&(0x7f00000001c0)="16e667ea25efad95e8e866bb6ef7f6ba94b72b63a28bcb7eafa978bdbe09a4d8"})
getsockopt$inet_int(r4, 0x0, 0x0, &(0x7f0000000600), &(0x7f0000000640)=0x4)
getsockname$unix(r1, &(0x7f0000000680), &(0x7f0000000700)=0x6e)

2018/03/30 13:05:54 executing program 6:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYBLOB="22811e2630b1d0ac3463"], 0x1)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r1, r2, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = getpgid(0xffffffffffffffff)
syz_open_procfs(r3, &(0x7f00000005c0)='net/ip6_tables_targets\x00')
process_vm_writev(r3, &(0x7f0000000180)=[{&(0x7f0000000140)=""/22, 0x16}], 0x1, &(0x7f00000003c0)=[{&(0x7f0000000740)=""/173, 0xad}], 0x1, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
r4 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
r5 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
r6 = dup3(0xffffffffffffffff, r0, 0x0)
setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8)
syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00')
sendmsg$IPVS_CMD_NEW_DEST(r6, &(0x7f0000000540)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x2000400}, 0xc, &(0x7f0000000500)={&(0x7f0000000240)=ANY=[@ANYPTR], 0x1}, 0x1, 0x0, 0x0, 0x10}, 0x4)
fcntl$setstatus(r1, 0x4, 0x6000)
mq_open(&(0x7f0000000800)=':em1\x00', 0x40, 0x4, &(0x7f0000000840)={0x4000000000000000, 0x0, 0x9, 0x6, 0x0, 0xff, 0x7})
pwritev(0xffffffffffffffff, &(0x7f00000000c0), 0x0, 0x0)
ioctl$DRM_IOCTL_AGP_ALLOC(r6, 0xc0206434, &(0x7f0000000440)={0x9dca, <r7=>0x0, 0x10002, 0x4})
ioctl$DRM_IOCTL_AGP_BIND(r5, 0x40106436, &(0x7f00000004c0)={r7, 0x676})
ioctl$sock_ifreq(r5, 0x8917, &(0x7f0000000300)={'lo\x00', @ifru_data=&(0x7f00000001c0)="16e667ea25efad95e8e866bb6ef7f6ba94b72b63a28bcb7eafa978bdbe09a4d8"})
getsockopt$inet_int(r4, 0x0, 0x0, &(0x7f0000000600), &(0x7f0000000640)=0x4)
getsockname$unix(r1, &(0x7f0000000680), &(0x7f0000000700)=0x6e)

2018/03/30 13:05:54 executing program 1:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYBLOB="22811e2630b1d0ac3463"], 0x1)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r1, r2, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = getpgid(0xffffffffffffffff)
syz_open_procfs(r3, &(0x7f00000005c0)='net/ip6_tables_targets\x00')
process_vm_writev(r3, &(0x7f0000000180), 0x0, &(0x7f00000003c0)=[{&(0x7f0000000740)=""/173, 0xad}], 0x1, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
r4 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
r5 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
r6 = dup3(0xffffffffffffffff, r0, 0x80000)
setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8)
syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00')
fcntl$setstatus(r1, 0x4, 0x6000)
mq_open(&(0x7f0000000800)=':em1\x00', 0x40, 0x4, &(0x7f0000000840)={0x4000000000000000, 0x0, 0x9, 0x6, 0x0, 0xff, 0x7})
pwritev(0xffffffffffffffff, &(0x7f00000000c0), 0x0, 0x0)
ioctl$DRM_IOCTL_AGP_ALLOC(r6, 0xc0206434, &(0x7f0000000440)={0x9dca, <r7=>0x0, 0x10002, 0x4})
ioctl$DRM_IOCTL_AGP_BIND(r5, 0x40106436, &(0x7f00000004c0)={r7, 0x676})
ioctl$sock_ifreq(r5, 0x8917, &(0x7f0000000300)={'lo\x00', @ifru_data=&(0x7f00000001c0)="16e667ea25efad95e8e866bb6ef7f6ba94b72b63a28bcb7eafa978bdbe09a4d8"})
getsockopt$inet_int(r4, 0x0, 0x0, &(0x7f0000000600), &(0x7f0000000640)=0x4)
getsockname$unix(r1, &(0x7f0000000680), &(0x7f0000000700)=0x6e)

2018/03/30 13:05:54 executing program 7:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYBLOB], 0x1)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r1, r2, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = getpgid(0xffffffffffffffff)
syz_open_procfs(r3, &(0x7f00000005c0)='net/ip6_tables_targets\x00')
process_vm_writev(r3, &(0x7f0000000180)=[{&(0x7f0000000140)=""/22, 0x16}], 0x1, &(0x7f00000003c0)=[{&(0x7f0000000740)=""/173, 0xad}], 0x1, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
r4 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
r5 = dup3(0xffffffffffffffff, r0, 0x80000)
setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8)
syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00')
fcntl$setstatus(r1, 0x4, 0x6000)
mq_open(&(0x7f0000000800)=':em1\x00', 0x40, 0x4, &(0x7f0000000840)={0x4000000000000000, 0x0, 0x9, 0x6, 0x0, 0xff, 0x7})
pwritev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000c00)}], 0x1, 0x0)
ioctl$DRM_IOCTL_AGP_ALLOC(r5, 0xc0206434, &(0x7f0000000440)={0x9dca, <r6=>0x0, 0x10002, 0x4})
ioctl$DRM_IOCTL_AGP_BIND(r4, 0x40106436, &(0x7f00000004c0)={r6, 0x676})
ioctl$sock_ifreq(r4, 0x8917, &(0x7f0000000300)={'lo\x00', @ifru_data=&(0x7f00000001c0)="16e667ea25efad95e8e866bb6ef7f6ba94b72b63a28bcb7eafa978bdbe09a4d8"})
getsockopt$inet_int(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000600), &(0x7f0000000640)=0x4)
getsockname$unix(r1, &(0x7f0000000680), &(0x7f0000000700)=0x6e)

2018/03/30 13:05:54 executing program 3:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[], 0x0)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r1, r2, 0x0, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
setns(r2, 0x0)
r3 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/loop-control\x00', 0x0, 0x0)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)
r4 = dup(r3)
getsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffff9c, 0x84, 0x6f, &(0x7f0000000340)={<r5=>0x0, 0x3c, &(0x7f00000005c0)=[@in={0x2, 0x4e23, @local={0xac, 0x14, 0x14, 0xaa}}, @in={0x2, 0x4e24, @broadcast=0xffffffff}, @in6={0xa, 0x0, 0x100000000, @loopback={0x0, 0x1}, 0x323d000000000}]}, &(0x7f0000000640)=0xc)
setsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r4, 0x84, 0xa, &(0x7f0000000680)={0xcff3, 0x80000000, 0x3, 0x0, 0x0, 0x66e, 0x5, 0x1, r5}, 0x20)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)
mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x5c831, 0xffffffffffffffff, 0x0)
openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/mls\x00', 0x0, 0x0)
setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(0xffffffffffffffff, 0x10e, 0x2, &(0x7f0000000340)=0xc, 0x4)
madvise(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x9)
r6 = syz_open_dev$usbmon(&(0x7f0000000040)='/dev/usbmon#\x00', 0x0, 0x80000)
ioctl$KDSKBMODE(0xffffffffffffffff, 0x4b45, &(0x7f0000000080))
getsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r6, 0x84, 0x75, &(0x7f00000000c0)={0x0, 0x6}, &(0x7f0000000100)=0x8)
setsockopt$inet_sctp6_SCTP_AUTH_KEY(r6, 0x84, 0x17, &(0x7f0000000500)=ANY=[], 0x0)
ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82)
ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82)
r7 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
ioctl$TIOCLINUX3(r7, 0x541c, &(0x7f0000000040)=0x3)
ioctl$LOOP_CTL_REMOVE(r3, 0x4c81, 0x0)

2018/03/30 13:05:54 executing program 4:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
r1 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000002880)='/selinux/avc/cache_stats\x00', 0x0, 0x0)
ioctl$EVIOCSABS20(r1, 0x401845e0, &(0x7f00000028c0)={0x1000, 0x7fff, 0x1ff, 0xffffffff, 0x7, 0x40})
fchdir(r0)
r2 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(r2, &(0x7f0000000080)=ANY=[@ANYBLOB="00811e2630b1d0ac3463"], 0x1)
setsockopt$packet_add_memb(r2, 0x107, 0x1, &(0x7f0000002900)={0x0, 0x1, 0x6}, 0x10)
r3 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r2, r3, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r3, 0x0)
inotify_init1(0x800)
ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
r4 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
setns(r3, 0x8000000)
r5 = socket$nl_xfrm(0x10, 0x3, 0x6)
r6 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
dup3(r3, r0, 0x80000)
setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8)
r7 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00')
sendmsg$IPVS_CMD_NEW_DEST(0xffffffffffffffff, &(0x7f0000000540)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x2000400}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)=ANY=[@ANYBLOB=',\x00\x00\x00'], 0x1}, 0x1, 0x0, 0x0, 0x10}, 0x4)
sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10}, 0xc, &(0x7f0000000340)={&(0x7f0000000480)=ANY=[@ANYBLOB='H\x00\x00\x00'], 0x1}, 0x1}, 0x0)
sendmsg$IPVS_CMD_GET_DEST(r2, &(0x7f0000000880)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f00000005c0)={&(0x7f0000000740)={0x138, r7, 0x208, 0x70bd2b, 0x25dfdbfb, {0x8}, [@IPVS_CMD_ATTR_SERVICE={0x28, 0x1, [@IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@multicast2=0xe0000002}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x3}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x7fff}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x8c6}, @IPVS_CMD_ATTR_DAEMON={0x50, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @remote={0xac, 0x14, 0x14, 0xbb}}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x400}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x10001}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'syz_tun\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x6}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x2}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x30, 0x2, [@IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x2}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv6=@ipv4={[], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0xffffffff}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0xafa6}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x1}, @IPVS_CMD_ATTR_DEST={0x6c, 0x2, [@IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x7}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv4=@remote={0xac, 0x14, 0x14, 0xbb}}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x8}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x1}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x5}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x3}, @IPVS_DEST_ATTR_PORT={0x8, 0x2, 0x4e22}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv6=@mcast2={0xff, 0x2, [], 0x1}}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x10000}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x701a3921}]}]}, 0x138}, 0x1, 0x0, 0x0, 0x90}, 0x4)
fcntl$setstatus(r2, 0x4, 0x6000)
setsockopt$sock_linger(r4, 0x1, 0xd, &(0x7f00000008c0)={0x1, 0x2}, 0x8)
pwritev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000c00)="cfb93447d6feaef9f73c0561e075a8295d43017ab1a157786dcda36c5eec92a4306f284fa7e3ed364cc2da5c08cf7e4030d394520e123eee6d9ab275c91c174b1364fc943b49faefe12f605b5ce6c1400a91210c00477f900aff390901bf594c18557cb38a7d57ac8ded098b96b9dfc125e3bdc9305193f4cd256068baca5208160d820b9e7a043666ba4801cf6d557fc0f97f35c13ec6c0d1fe97ce1af1c17078ef47ab955200836671e402717481d14936b09828fd6f55fda2f11eb4c61b480e941133c0a4c5ec54033d0d174742191754ffe28b093596286a78ea01078337ada8585aa98dcc1143689002e31ccc5b9f5cfd2bbce5683a0f91b395391a60ba8e8f4d3c10c82c71caa74c44c8b0f3e42f1fc264497d5b9dabf309bad7bd", 0x11e}], 0x1, 0x0)
sendmmsg(r5, &(0x7f00000027c0)=[{{0x0, 0x0, &(0x7f0000000a00)=[{&(0x7f0000000900)="913da470640ae70fe168a71ad316e5525ce43547f28d8c56cb5cd246950c2d44a514698b3aebf2b60d933814378b0b9b750dec28bdbeedda6c8af5f3418ff8c43701e5dea492428ecdcf0e8c2a19f60e388b478179256834360c5ee359dbe4fabee36883a8314f0ea64dea3a732dffbe26a02e8327a0f7174a6990389e5b608d5300c271f26b3b37cc88e720a477e5f1aa2751af90d35d72606ac73f72dab39aad418a6335d44c785ba83edc9619a3221ae39ef2fed1657e426fa293a739cd779a6c645b3d29bb184041476e8e6e737e5fa1c4312360", 0xd6}], 0x1, 0x0, 0x0, 0x8000}, 0x3f}, {{&(0x7f0000002240)=@nl=@unspec, 0x80, &(0x7f0000002680)=[{&(0x7f00000022c0)="756a6b1895d55b0b292a3985cd35f28cfa8d5ab20a3448791e47ec9e971be82f993ebd55ec843a76ccd644a71222e57119e6f8866f59ba0b89c4cf71a9ce853f72bd99ac9097baf924ea3e3fbceaf0a0df15deb45ae757832bec56c67c0ad44e0ea5fcbc12f898989e1773427ad180efff1044e98613dab446587dd52a0deacb4074e01d97cd46c6e633ae1c1011fd2123c766e6fea028799cf82a562bd9d52c544241172f684398ac1b", 0xaa}, {&(0x7f0000002440)="c802b7c29c92c7ddcf8b11133e071ae83e8c0b0827764303ad44356d381633ce1fdd31e1641872e8d6b4c1a974d97d", 0x2f}, {&(0x7f0000002540)="446c9b3779f2a3dc39f3a3541d912b01ca9865e4172a83cda910f6b10dd97377212eb5279c", 0x25}], 0x3, &(0x7f0000002700)=[{0xa0, 0x10f, 0x200, "4f483406ed4a2e47550522989e031e3e239b59c5dc988744d266f33171b6d4a8e54f025a1e1be02c21ad9675e29aea96625352eec0db268e5c70b8e22a2bb0e11b9e6d9613d4e8e338194d9a41821db1ef97a16b16e5263d008bb6ce86b1e26f4d59926a9a72bed62192dc96eaa8a033c9ddaf2fc8c5fb9e765e5ff99cc5ae6fa7bc4a4f0abcb9c9745b54"}], 0xa0, 0x800}, 0x1200000}], 0x2, 0x20040000)
sendmsg$IPVS_CMD_DEL_DAEMON(r2, &(0x7f0000000280)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000240)={&(0x7f0000000180)={0x28, 0x0, 0xb30, 0x0, 0x25dfdbfc, {0xa}, [@IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x3ff}, @IPVS_CMD_ATTR_SERVICE={0xc, 0x1, [@IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8}]}]}, 0x28}, 0x1}, 0x0)
ioctl$sock_ifreq(r6, 0x8917, &(0x7f0000000300)={'lo\x00', @ifru_data=&(0x7f00000001c0)="16e667ea25efad95e8e866bb6ef7f6ba94b72b63a28bcb7eafa978bdbe09a4d8"})
getsockopt$inet_int(r4, 0x0, 0x0, &(0x7f0000000600), &(0x7f0000000640)=0x4)
getsockname$unix(r2, &(0x7f0000000680), &(0x7f0000000700)=0x6e)

2018/03/30 13:05:54 executing program 0:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r1, r2, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = getpgid(0xffffffffffffffff)
syz_open_procfs(r3, &(0x7f00000005c0)='net/ip6_tables_targets\x00')
process_vm_writev(r3, &(0x7f0000000180)=[{&(0x7f0000000140)=""/22, 0x16}], 0x1, &(0x7f00000003c0)=[{&(0x7f0000000740)=""/173, 0xad}], 0x1, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
r4 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
setns(r2, 0x0)
r5 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
r6 = dup3(0xffffffffffffffff, r0, 0x80000)
setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8)
syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00')
sendmsg$IPVS_CMD_NEW_DEST(r6, &(0x7f0000000540)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x2000400}, 0xc, &(0x7f0000000500)={&(0x7f0000000240)=ANY=[@ANYPTR], 0x1}, 0x1, 0x0, 0x0, 0x10}, 0x0)
sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10}, 0xc, &(0x7f0000000340)={&(0x7f0000000480)=ANY=[@ANYBLOB='H\x00\x00\x00'], 0x1}, 0x1}, 0x0)
fcntl$setstatus(r1, 0x4, 0x6000)
mq_open(&(0x7f0000000800)=':em1\x00', 0x40, 0x4, &(0x7f0000000840)={0x4000000000000000, 0x0, 0x9, 0x6, 0x0, 0xff, 0x7})
pwritev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000c00)}], 0x1, 0x0)
ioctl$DRM_IOCTL_AGP_ALLOC(r6, 0xc0206434, &(0x7f0000000440)={0x9dca, <r7=>0x0, 0x10002, 0x4})
ioctl$DRM_IOCTL_AGP_BIND(r5, 0x40106436, &(0x7f00000004c0)={r7, 0x676})
ioctl$sock_ifreq(r5, 0x8917, &(0x7f0000000300)={'lo\x00', @ifru_data=&(0x7f00000001c0)="16e667ea25efad95e8e866bb6ef7f6ba94b72b63a28bcb7eafa978bdbe09a4d8"})
getsockopt$inet_int(r4, 0x0, 0x0, &(0x7f0000000600), &(0x7f0000000640)=0x4)
getsockname$unix(r1, &(0x7f0000000680), &(0x7f0000000700)=0x6e)

2018/03/30 13:05:54 executing program 5:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYBLOB="00811e2630b1d0ac3463"], 0x1)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r1, r2, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
setns(r2, 0x0)
r3 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/loop-control\x00', 0x0, 0x0)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)
r4 = dup(r3)
getsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffff9c, 0x84, 0x6f, &(0x7f0000000340)={<r5=>0x0, 0x3c, &(0x7f00000005c0)=[@in={0x2, 0x4e23, @local={0xac, 0x14, 0x14, 0xaa}}, @in={0x2, 0x4e24, @broadcast=0xffffffff}, @in6={0xa, 0x0, 0x100000000, @loopback={0x0, 0x1}, 0x323d000000000}]}, &(0x7f0000000640)=0xc)
setsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r4, 0x84, 0xa, &(0x7f0000000680)={0xcff3, 0x80000000, 0x3, 0x0, 0x0, 0x66e, 0x5, 0x0, r5}, 0x20)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)
mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x5c831, 0xffffffffffffffff, 0x0)
openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/mls\x00', 0x0, 0x0)
setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(0xffffffffffffffff, 0x10e, 0x2, &(0x7f0000000340)=0xc, 0x4)
madvise(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x9)
r6 = syz_open_dev$usbmon(&(0x7f0000000040)='/dev/usbmon#\x00', 0x0, 0x80000)
ioctl$KDSKBMODE(0xffffffffffffffff, 0x4b45, &(0x7f0000000080))
setsockopt$inet_sctp6_SCTP_AUTH_KEY(r6, 0x84, 0x17, &(0x7f0000000500)=ANY=[], 0x0)
ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)
r7 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
ioctl$TIOCLINUX3(r7, 0x541c, &(0x7f0000000040)=0x3)
ioctl$LOOP_CTL_REMOVE(r3, 0x4c81, 0x0)

[  585.826543] binder: BINDER_SET_CONTEXT_MGR already set
[  585.826554] binder: 29421:29428 ioctl 40046207 0 returned -16
[  585.828450] binder: 29421:29428 got transaction with invalid offset (0, min 24 max 40) or object.
2018/03/30 13:05:54 executing program 4:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
r1 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000002880)='/selinux/avc/cache_stats\x00', 0x0, 0x0)
ioctl$EVIOCSABS20(r1, 0x401845e0, &(0x7f00000028c0)={0x1000, 0x7fff, 0x1ff, 0xffffffff, 0x7, 0x40})
fchdir(r0)
r2 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(r2, &(0x7f0000000080)=ANY=[@ANYBLOB="00811e2630b1d0ac3463"], 0x1)
setsockopt$packet_add_memb(r2, 0x107, 0x1, &(0x7f0000002900)={0x0, 0x1, 0x6}, 0x10)
r3 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r2, r3, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r3, 0x0)
inotify_init1(0x800)
ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
r4 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
setns(r3, 0x8000000)
r5 = socket$nl_xfrm(0x10, 0x3, 0x6)
r6 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
dup3(r3, r0, 0x80000)
setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8)
r7 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00')
sendmsg$IPVS_CMD_NEW_DEST(0xffffffffffffffff, &(0x7f0000000540)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x2000400}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)=ANY=[@ANYBLOB=',\x00\x00\x00'], 0x1}, 0x1, 0x0, 0x0, 0x10}, 0x4)
sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10}, 0xc, &(0x7f0000000340)={&(0x7f0000000480)=ANY=[@ANYBLOB='H\x00\x00\x00'], 0x1}, 0x1}, 0x0)
sendmsg$IPVS_CMD_GET_DEST(r2, &(0x7f0000000880)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f00000005c0)={&(0x7f0000000740)={0x138, r7, 0x208, 0x70bd2b, 0x25dfdbfb, {0x8}, [@IPVS_CMD_ATTR_SERVICE={0x28, 0x1, [@IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@multicast2=0xe0000002}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x3}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x7fff}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x8c6}, @IPVS_CMD_ATTR_DAEMON={0x50, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @remote={0xac, 0x14, 0x14, 0xbb}}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x400}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x10001}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'syz_tun\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x6}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x2}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x30, 0x2, [@IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x2}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv6=@ipv4={[], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0xffffffff}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0xafa6}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x1}, @IPVS_CMD_ATTR_DEST={0x6c, 0x2, [@IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x7}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv4=@remote={0xac, 0x14, 0x14, 0xbb}}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x8}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x1}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x5}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x3}, @IPVS_DEST_ATTR_PORT={0x8, 0x2, 0x4e22}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv6=@mcast2={0xff, 0x2, [], 0x1}}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x10000}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x701a3921}]}]}, 0x138}, 0x1, 0x0, 0x0, 0x90}, 0x4)
fcntl$setstatus(r2, 0x4, 0x6000)
setsockopt$sock_linger(r4, 0x1, 0xd, &(0x7f00000008c0)={0x1, 0x2}, 0x8)
pwritev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000c00)="cfb93447d6feaef9f73c0561e075a8295d43017ab1a157786dcda36c5eec92a4306f284fa7e3ed364cc2da5c08cf7e4030d394520e123eee6d9ab275c91c174b1364fc943b49faefe12f605b5ce6c1400a91210c00477f900aff390901bf594c18557cb38a7d57ac8ded098b96b9dfc125e3bdc9305193f4cd256068baca5208160d820b9e7a043666ba4801cf6d557fc0f97f35c13ec6c0d1fe97ce1af1c17078ef47ab955200836671e402717481d14936b09828fd6f55fda2f11eb4c61b480e941133c0a4c5ec54033d0d174742191754ffe28b093596286a78ea01078337ada8585aa98dcc1143689002e31ccc5b9f5cfd2bbce5683a0f91b395391a60ba8e8f4d3c10c82c71caa74c44c8b0f3e42f1fc264497d5b9dabf309bad7bd", 0x11e}], 0x1, 0x0)
sendmmsg(r5, &(0x7f00000027c0)=[{{0x0, 0x0, &(0x7f0000000a00)=[{&(0x7f0000000900)="913da470640ae70fe168a71ad316e5525ce43547f28d8c56cb5cd246950c2d44a514698b3aebf2b60d933814378b0b9b750dec28bdbeedda6c8af5f3418ff8c43701e5dea492428ecdcf0e8c2a19f60e388b478179256834360c5ee359dbe4fabee36883a8314f0ea64dea3a732dffbe26a02e8327a0f7174a6990389e5b608d5300c271f26b3b37cc88e720a477e5f1aa2751af90d35d72606ac73f72dab39aad418a6335d44c785ba83edc9619a3221ae39ef2fed1657e426fa293a739cd779a6c645b3d29bb184041476e8e6e737e5fa1c4312360", 0xd6}], 0x1, 0x0, 0x0, 0x8000}, 0x3f}, {{&(0x7f0000002240)=@nl=@unspec, 0x80, &(0x7f0000002680)=[{&(0x7f00000022c0)="756a6b1895d55b0b292a3985cd35f28cfa8d5ab20a3448791e47ec9e971be82f993ebd55ec843a76ccd644a71222e57119e6f8866f59ba0b89c4cf71a9ce853f72bd99ac9097baf924ea3e3fbceaf0a0df15deb45ae757832bec56c67c0ad44e0ea5fcbc12f898989e1773427ad180efff1044e98613dab446587dd52a0deacb4074e01d97cd46c6e633ae1c1011fd2123c766e6fea028799cf82a562bd9d52c544241172f684398ac1b", 0xaa}, {&(0x7f0000002440)="c802b7c29c92c7ddcf8b11133e071ae83e8c0b0827764303ad44356d381633ce1fdd31e1641872e8d6b4c1a974d97d", 0x2f}, {&(0x7f0000002540)="446c9b3779f2a3dc39f3a3541d912b01ca9865e4172a83cda910f6b10dd97377212eb5279c", 0x25}], 0x3, &(0x7f0000002700)=[{0xa0, 0x10f, 0x200, "4f483406ed4a2e47550522989e031e3e239b59c5dc988744d266f33171b6d4a8e54f025a1e1be02c21ad9675e29aea96625352eec0db268e5c70b8e22a2bb0e11b9e6d9613d4e8e338194d9a41821db1ef97a16b16e5263d008bb6ce86b1e26f4d59926a9a72bed62192dc96eaa8a033c9ddaf2fc8c5fb9e765e5ff99cc5ae6fa7bc4a4f0abcb9c9745b54"}], 0xa0, 0x800}, 0x1200000}], 0x2, 0x20040000)
sendmsg$IPVS_CMD_DEL_DAEMON(r2, &(0x7f0000000280)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000240)={&(0x7f0000000180)={0x28, 0x0, 0xb30, 0x0, 0x25dfdbfc, {0xa}, [@IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x3ff}, @IPVS_CMD_ATTR_SERVICE={0xc, 0x1, [@IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8}]}]}, 0x28}, 0x1}, 0x0)
ioctl$sock_ifreq(r6, 0x8917, &(0x7f0000000300)={'lo\x00', @ifru_data=&(0x7f00000001c0)="16e667ea25efad95e8e866bb6ef7f6ba94b72b63a28bcb7eafa978bdbe09a4d8"})
getsockopt$inet_int(r4, 0x0, 0x0, &(0x7f0000000600), &(0x7f0000000640)=0x4)
getsockname$unix(r2, &(0x7f0000000680), &(0x7f0000000700)=0x6e)

2018/03/30 13:05:54 executing program 6:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYBLOB="22811e2630b1d0ac3463"], 0x1)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r1, r2, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = getpgid(0xffffffffffffffff)
syz_open_procfs(r3, &(0x7f00000005c0)='net/ip6_tables_targets\x00')
process_vm_writev(r3, &(0x7f0000000180)=[{&(0x7f0000000140)=""/22, 0x16}], 0x1, &(0x7f00000003c0)=[{&(0x7f0000000740)=""/173, 0xad}], 0x1, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
r4 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
r5 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
r6 = dup3(0xffffffffffffffff, r0, 0x0)
setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8)
syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00')
sendmsg$IPVS_CMD_NEW_DEST(r6, &(0x7f0000000540)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x2000400}, 0xc, &(0x7f0000000500)={&(0x7f0000000240)=ANY=[@ANYPTR], 0x1}, 0x1, 0x0, 0x0, 0x10}, 0x4)
fcntl$setstatus(r1, 0x4, 0x6000)
mq_open(&(0x7f0000000800)=':em1\x00', 0x40, 0x4, &(0x7f0000000840)={0x4000000000000000, 0x0, 0x9, 0x6, 0x0, 0xff, 0x7})
pwritev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000c00)}], 0x1, 0x0)
ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffffff, 0xc0206434, &(0x7f0000000440)={0x9dca, <r7=>0x0, 0x10002, 0x4})
ioctl$DRM_IOCTL_AGP_BIND(r5, 0x40106436, &(0x7f00000004c0)={r7, 0x676})
ioctl$sock_ifreq(r5, 0x8917, &(0x7f0000000300)={'lo\x00', @ifru_data=&(0x7f00000001c0)="16e667ea25efad95e8e866bb6ef7f6ba94b72b63a28bcb7eafa978bdbe09a4d8"})
getsockopt$inet_int(r4, 0x0, 0x0, &(0x7f0000000600), &(0x7f0000000640)=0x4)
getsockname$unix(r1, &(0x7f0000000680), &(0x7f0000000700)=0x6e)

** 21 printk messages dropped ** [  585.926746] binder: 29445:29448 got transaction with invalid offset (0, min 24 max 40) or object.
2018/03/30 13:05:55 executing program 2:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYBLOB="22811e2630b1d0ac3463"], 0x1)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r1, r2, 0x1, 0x0)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = getpgid(0xffffffffffffffff)
syz_open_procfs(r3, &(0x7f00000005c0)='net/ip6_tables_targets\x00')
process_vm_writev(r3, &(0x7f0000000180)=[{&(0x7f0000000140)=""/22, 0x16}], 0x1, &(0x7f00000003c0)=[{&(0x7f0000000740)=""/173, 0xad}], 0x1, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
r4 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
setns(r2, 0x0)
r5 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
r6 = dup3(0xffffffffffffffff, r0, 0x80000)
setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8)
syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00')
sendmsg$IPVS_CMD_NEW_DEST(r6, &(0x7f0000000540)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x2000400}, 0xc, &(0x7f0000000500)={&(0x7f0000000240)=ANY=[@ANYPTR], 0x1}, 0x1, 0x0, 0x0, 0x10}, 0x4)
sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10}, 0xc, &(0x7f0000000340)={&(0x7f0000000480)=ANY=[@ANYBLOB='H\x00\x00\x00'], 0x1}, 0x1}, 0x0)
fcntl$setstatus(r1, 0x4, 0x6000)
mq_open(&(0x7f0000000800)=':em1\x00', 0x40, 0x4, &(0x7f0000000840)={0x0, 0x0, 0x9, 0x6, 0x0, 0xff, 0x7})
pwritev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000c00)}], 0x1, 0x0)
ioctl$DRM_IOCTL_AGP_ALLOC(r6, 0xc0206434, &(0x7f0000000440)={0x9dca, <r7=>0x0, 0x10002, 0x4})
ioctl$DRM_IOCTL_AGP_BIND(r5, 0x40106436, &(0x7f00000004c0)={r7, 0x676})
ioctl$sock_ifreq(r5, 0x8917, &(0x7f0000000300)={'lo\x00', @ifru_data=&(0x7f00000001c0)="16e667ea25efad95e8e866bb6ef7f6ba94b72b63a28bcb7eafa978bdbe09a4d8"})
getsockopt$inet_int(r4, 0x0, 0x0, &(0x7f0000000600), &(0x7f0000000640)=0x4)
getsockname$unix(r1, &(0x7f0000000680), &(0x7f0000000700)=0x6e)

2018/03/30 13:05:55 executing program 1:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYBLOB="22811e2630b1d0ac3463"], 0x1)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r1, r2, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = getpgid(0xffffffffffffffff)
syz_open_procfs(r3, &(0x7f00000005c0)='net/ip6_tables_targets\x00')
process_vm_writev(r3, &(0x7f0000000180), 0x0, &(0x7f00000003c0)=[{&(0x7f0000000740)=""/173, 0xad}], 0x1, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
r4 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
r5 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
r6 = dup3(0xffffffffffffffff, r0, 0x80000)
setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8)
syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00')
fcntl$setstatus(r1, 0x4, 0x6000)
mq_open(&(0x7f0000000800)=':em1\x00', 0x40, 0x4, &(0x7f0000000840)={0x4000000000000000, 0x0, 0x9, 0x6, 0x0, 0xff, 0x7})
pwritev(0xffffffffffffffff, &(0x7f00000000c0), 0x0, 0x0)
ioctl$DRM_IOCTL_AGP_ALLOC(r6, 0xc0206434, &(0x7f0000000440)={0x9dca, <r7=>0x0, 0x10002, 0x4})
ioctl$DRM_IOCTL_AGP_BIND(r5, 0x40106436, &(0x7f00000004c0)={r7, 0x676})
ioctl$sock_ifreq(r5, 0x8917, &(0x7f0000000300)={'lo\x00', @ifru_data=&(0x7f00000001c0)="16e667ea25efad95e8e866bb6ef7f6ba94b72b63a28bcb7eafa978bdbe09a4d8"})
getsockopt$inet_int(r4, 0x0, 0x0, &(0x7f0000000600), &(0x7f0000000640)=0x4)
getsockname$unix(r1, &(0x7f0000000680), &(0x7f0000000700)=0x6e)

2018/03/30 13:05:55 executing program 7:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYBLOB="22811e2630"], 0x1)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r1, r2, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = getpgid(0xffffffffffffffff)
syz_open_procfs(r3, &(0x7f00000005c0)='net/ip6_tables_targets\x00')
process_vm_writev(r3, &(0x7f0000000180)=[{&(0x7f0000000140)=""/22, 0x16}], 0x1, &(0x7f00000003c0)=[{&(0x7f0000000740)=""/173, 0xad}], 0x1, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
r4 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
r5 = dup3(0xffffffffffffffff, r0, 0x80000)
setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8)
syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00')
fcntl$setstatus(r1, 0x4, 0x6000)
mq_open(&(0x7f0000000800)=':em1\x00', 0x40, 0x4, &(0x7f0000000840)={0x4000000000000000, 0x0, 0x9, 0x6, 0x0, 0xff, 0x7})
pwritev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000c00)}], 0x1, 0x0)
ioctl$DRM_IOCTL_AGP_ALLOC(r5, 0xc0206434, &(0x7f0000000440)={0x9dca, <r6=>0x0, 0x10002, 0x4})
ioctl$DRM_IOCTL_AGP_BIND(r4, 0x40106436, &(0x7f00000004c0)={r6, 0x676})
ioctl$sock_ifreq(r4, 0x8917, &(0x7f0000000300)={'lo\x00', @ifru_data=&(0x7f00000001c0)="16e667ea25efad95e8e866bb6ef7f6ba94b72b63a28bcb7eafa978bdbe09a4d8"})
getsockopt$inet_int(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000600), &(0x7f0000000640)=0x4)
getsockname$unix(r1, &(0x7f0000000680), &(0x7f0000000700)=0x6e)

** 13 printk messages dropped ** [  585.981774] binder: 29456:29459 transaction failed 29201/-22, size 40-16 line 3197
[  585.989783] binder: BINDER_SET_CONTEXT_MGR already set
** 2 printk messages dropped ** [  585.990642] binder: 29452:29461 ioctl 40046207 0 returned -16
** 14 printk messages dropped ** [  586.044046] binder: undelivered TRANSACTION_ERROR: 29201
[  586.053051] binder: undelivered TRANSACTION_ERROR: 29201
[  586.071841] binder: undelivered TRANSACTION_ERROR: 29201
[  586.071981] binder: undelivered TRANSACTION_ERROR: 29201
[  586.083033] binder: BINDER_SET_CONTEXT_MGR already set
[  586.083042] binder: 29476:29478 ioctl 40046207 0 returned -16
[  586.083382] binder: 29482:29486 got transaction with invalid offset (0, min 24 max 40) or object.
[  586.083472] binder: 29482:29486 transaction failed 29201/-22, size 40-16 line 3197
[  586.086401] binder: BINDER_SET_CONTEXT_MGR already set
2018/03/30 13:05:55 executing program 5:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYBLOB="00811e2630b1d0ac3463"], 0x1)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r1, r2, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
setns(r2, 0x0)
r3 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/loop-control\x00', 0x0, 0x0)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)
r4 = dup(r3)
getsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffff9c, 0x84, 0x6f, &(0x7f0000000340)={<r5=>0x0, 0x3c, &(0x7f00000005c0)=[@in={0x2, 0x4e23, @local={0xac, 0x14, 0x14, 0xaa}}, @in={0x2, 0x4e24, @broadcast=0xffffffff}, @in6={0xa, 0x0, 0x100000000, @loopback={0x0, 0x1}, 0x323d000000000}]}, &(0x7f0000000640)=0xc)
setsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r4, 0x84, 0xa, &(0x7f0000000680)={0xcff3, 0x80000000, 0x3, 0x0, 0x0, 0x66e, 0x5, 0x0, r5}, 0x20)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)
mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x5c831, 0xffffffffffffffff, 0x0)
openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/mls\x00', 0x0, 0x0)
setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(0xffffffffffffffff, 0x10e, 0x2, &(0x7f0000000340)=0xc, 0x4)
madvise(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x9)
r6 = syz_open_dev$usbmon(&(0x7f0000000040)='/dev/usbmon#\x00', 0x0, 0x80000)
ioctl$KDSKBMODE(0xffffffffffffffff, 0x4b45, &(0x7f0000000080))
setsockopt$inet_sctp6_SCTP_AUTH_KEY(r6, 0x84, 0x17, &(0x7f0000000500)=ANY=[], 0x0)
ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)
r7 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
ioctl$TIOCLINUX3(r7, 0x541c, &(0x7f0000000040)=0x3)
ioctl$LOOP_CTL_REMOVE(r3, 0x4c81, 0x0)

2018/03/30 13:05:55 executing program 4:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
r1 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000002880)='/selinux/avc/cache_stats\x00', 0x0, 0x0)
ioctl$EVIOCSABS20(r1, 0x401845e0, &(0x7f00000028c0)={0x1000, 0x7fff, 0x1ff, 0xffffffff, 0x7, 0x40})
fchdir(r0)
r2 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(r2, &(0x7f0000000080)=ANY=[@ANYBLOB="00811e2630b1d0ac3463"], 0x1)
setsockopt$packet_add_memb(r2, 0x107, 0x1, &(0x7f0000002900)={0x0, 0x1, 0x6}, 0x10)
r3 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r2, r3, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r3, 0x0)
inotify_init1(0x800)
ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
r4 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
setns(r3, 0x8000000)
r5 = socket$nl_xfrm(0x10, 0x3, 0x6)
r6 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
dup3(r3, r0, 0x80000)
setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8)
r7 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00')
sendmsg$IPVS_CMD_NEW_DEST(0xffffffffffffffff, &(0x7f0000000540)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x2000400}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)=ANY=[@ANYBLOB=',\x00\x00\x00'], 0x1}, 0x1, 0x0, 0x0, 0x10}, 0x4)
sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10}, 0xc, &(0x7f0000000340)={&(0x7f0000000480)=ANY=[@ANYBLOB='H\x00\x00\x00'], 0x1}, 0x1}, 0x0)
sendmsg$IPVS_CMD_GET_DEST(r2, &(0x7f0000000880)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f00000005c0)={&(0x7f0000000740)={0x138, r7, 0x208, 0x70bd2b, 0x25dfdbfb, {0x8}, [@IPVS_CMD_ATTR_SERVICE={0x28, 0x1, [@IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@multicast2=0xe0000002}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x3}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x7fff}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x8c6}, @IPVS_CMD_ATTR_DAEMON={0x50, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @remote={0xac, 0x14, 0x14, 0xbb}}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x400}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x10001}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'syz_tun\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x6}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x2}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x30, 0x2, [@IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x2}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv6=@ipv4={[], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0xffffffff}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0xafa6}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x1}, @IPVS_CMD_ATTR_DEST={0x6c, 0x2, [@IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x7}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv4=@remote={0xac, 0x14, 0x14, 0xbb}}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x8}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x1}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x5}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x3}, @IPVS_DEST_ATTR_PORT={0x8, 0x2, 0x4e22}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv6=@mcast2={0xff, 0x2, [], 0x1}}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x10000}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x701a3921}]}]}, 0x138}, 0x1, 0x0, 0x0, 0x90}, 0x4)
fcntl$setstatus(r2, 0x4, 0x6000)
setsockopt$sock_linger(r4, 0x1, 0xd, &(0x7f00000008c0)={0x1, 0x2}, 0x8)
pwritev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000c00)="cfb93447d6feaef9f73c0561e075a8295d43017ab1a157786dcda36c5eec92a4306f284fa7e3ed364cc2da5c08cf7e4030d394520e123eee6d9ab275c91c174b1364fc943b49faefe12f605b5ce6c1400a91210c00477f900aff390901bf594c18557cb38a7d57ac8ded098b96b9dfc125e3bdc9305193f4cd256068baca5208160d820b9e7a043666ba4801cf6d557fc0f97f35c13ec6c0d1fe97ce1af1c17078ef47ab955200836671e402717481d14936b09828fd6f55fda2f11eb4c61b480e941133c0a4c5ec54033d0d174742191754ffe28b093596286a78ea01078337ada8585aa98dcc1143689002e31ccc5b9f5cfd2bbce5683a0f91b395391a60ba8e8f4d3c10c82c71caa74c44c8b0f3e42f1fc264497d5b9dabf309bad7bd", 0x11e}], 0x1, 0x0)
sendmmsg(r5, &(0x7f00000027c0)=[{{0x0, 0x0, &(0x7f0000000a00)=[{&(0x7f0000000900)="913da470640ae70fe168a71ad316e5525ce43547f28d8c56cb5cd246950c2d44a514698b3aebf2b60d933814378b0b9b750dec28bdbeedda6c8af5f3418ff8c43701e5dea492428ecdcf0e8c2a19f60e388b478179256834360c5ee359dbe4fabee36883a8314f0ea64dea3a732dffbe26a02e8327a0f7174a6990389e5b608d5300c271f26b3b37cc88e720a477e5f1aa2751af90d35d72606ac73f72dab39aad418a6335d44c785ba83edc9619a3221ae39ef2fed1657e426fa293a739cd779a6c645b3d29bb184041476e8e6e737e5fa1c4312360", 0xd6}], 0x1, 0x0, 0x0, 0x8000}, 0x3f}, {{&(0x7f0000002240)=@nl=@unspec, 0x80, &(0x7f0000002680)=[{&(0x7f00000022c0)="756a6b1895d55b0b292a3985cd35f28cfa8d5ab20a3448791e47ec9e971be82f993ebd55ec843a76ccd644a71222e57119e6f8866f59ba0b89c4cf71a9ce853f72bd99ac9097baf924ea3e3fbceaf0a0df15deb45ae757832bec56c67c0ad44e0ea5fcbc12f898989e1773427ad180efff1044e98613dab446587dd52a0deacb4074e01d97cd46c6e633ae1c1011fd2123c766e6fea028799cf82a562bd9d52c544241172f684398ac1b", 0xaa}, {&(0x7f0000002440)="c802b7c29c92c7ddcf8b11133e071ae83e8c0b0827764303ad44356d381633ce1fdd31e1641872e8d6b4c1a974d97d", 0x2f}, {&(0x7f0000002540)="446c9b3779f2a3dc39f3a3541d912b01ca9865e4172a83cda910f6b10dd97377212eb5279c", 0x25}], 0x3, &(0x7f0000002700)=[{0xa0, 0x10f, 0x200, "4f483406ed4a2e47550522989e031e3e239b59c5dc988744d266f33171b6d4a8e54f025a1e1be02c21ad9675e29aea96625352eec0db268e5c70b8e22a2bb0e11b9e6d9613d4e8e338194d9a41821db1ef97a16b16e5263d008bb6ce86b1e26f4d59926a9a72bed62192dc96eaa8a033c9ddaf2fc8c5fb9e765e5ff99cc5ae6fa7bc4a4f0abcb9c9745b54"}], 0xa0, 0x800}, 0x1200000}], 0x2, 0x20040000)
sendmsg$IPVS_CMD_DEL_DAEMON(r2, &(0x7f0000000280)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000240)={&(0x7f0000000180)={0x28, 0x0, 0xb30, 0x0, 0x25dfdbfc, {0xa}, [@IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x3ff}, @IPVS_CMD_ATTR_SERVICE={0xc, 0x1, [@IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8}]}]}, 0x28}, 0x1}, 0x0)
ioctl$sock_ifreq(r6, 0x8917, &(0x7f0000000300)={'lo\x00', @ifru_data=&(0x7f00000001c0)="16e667ea25efad95e8e866bb6ef7f6ba94b72b63a28bcb7eafa978bdbe09a4d8"})
getsockopt$inet_int(r4, 0x0, 0x0, &(0x7f0000000600), &(0x7f0000000640)=0x4)
getsockname$unix(r2, &(0x7f0000000680), &(0x7f0000000700)=0x6e)

2018/03/30 13:05:55 executing program 0:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYBLOB="22811e2630b1d0ac3463"], 0x1)
r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(0xffffffffffffffff, r1, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
r2 = getpgid(0xffffffffffffffff)
syz_open_procfs(r2, &(0x7f00000005c0)='net/ip6_tables_targets\x00')
process_vm_writev(r2, &(0x7f0000000180)=[{&(0x7f0000000140)=""/22, 0x16}], 0x1, &(0x7f00000003c0)=[{&(0x7f0000000740)=""/173, 0xad}], 0x1, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
r3 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
setns(r1, 0x0)
r4 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
r5 = dup3(0xffffffffffffffff, r0, 0x80000)
setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8)
syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00')
sendmsg$IPVS_CMD_NEW_DEST(r5, &(0x7f0000000540)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x2000400}, 0xc, &(0x7f0000000500)={&(0x7f0000000240)=ANY=[@ANYPTR], 0x1}, 0x1, 0x0, 0x0, 0x10}, 0x0)
sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10}, 0xc, &(0x7f0000000340)={&(0x7f0000000480)=ANY=[@ANYBLOB='H\x00\x00\x00'], 0x1}, 0x1}, 0x0)
fcntl$setstatus(0xffffffffffffffff, 0x4, 0x6000)
mq_open(&(0x7f0000000800)=':em1\x00', 0x40, 0x4, &(0x7f0000000840)={0x4000000000000000, 0x0, 0x9, 0x6, 0x0, 0xff, 0x7})
pwritev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000c00)}], 0x1, 0x0)
ioctl$DRM_IOCTL_AGP_ALLOC(r5, 0xc0206434, &(0x7f0000000440)={0x9dca, <r6=>0x0, 0x10002, 0x4})
ioctl$DRM_IOCTL_AGP_BIND(r4, 0x40106436, &(0x7f00000004c0)={r6, 0x676})
ioctl$sock_ifreq(r4, 0x8917, &(0x7f0000000300)={'lo\x00', @ifru_data=&(0x7f00000001c0)="16e667ea25efad95e8e866bb6ef7f6ba94b72b63a28bcb7eafa978bdbe09a4d8"})
getsockopt$inet_int(r3, 0x0, 0x0, &(0x7f0000000600), &(0x7f0000000640)=0x4)
getsockname$unix(0xffffffffffffffff, &(0x7f0000000680), &(0x7f0000000700)=0x6e)

2018/03/30 13:05:55 executing program 3:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[], 0x0)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r1, r2, 0x0, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
setns(r2, 0x0)
r3 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/loop-control\x00', 0x0, 0x0)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)
r4 = dup(r3)
getsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffff9c, 0x84, 0x6f, &(0x7f0000000340)={<r5=>0x0, 0x3c, &(0x7f00000005c0)=[@in={0x2, 0x4e23, @local={0xac, 0x14, 0x14, 0xaa}}, @in={0x2, 0x4e24, @broadcast=0xffffffff}, @in6={0xa, 0x0, 0x100000000, @loopback={0x0, 0x1}, 0x323d000000000}]}, &(0x7f0000000640)=0xc)
setsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r4, 0x84, 0xa, &(0x7f0000000680)={0xcff3, 0x80000000, 0x3, 0x0, 0x0, 0x66e, 0x5, 0x1, r5}, 0x20)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)
mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x5c831, 0xffffffffffffffff, 0x0)
openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/mls\x00', 0x0, 0x0)
setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(0xffffffffffffffff, 0x10e, 0x2, &(0x7f0000000340)=0xc, 0x4)
madvise(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x9)
r6 = syz_open_dev$usbmon(&(0x7f0000000040)='/dev/usbmon#\x00', 0x0, 0x80000)
ioctl$KDSKBMODE(0xffffffffffffffff, 0x4b45, &(0x7f0000000080))
getsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r6, 0x84, 0x75, &(0x7f00000000c0)={0x0, 0x6}, &(0x7f0000000100)=0x8)
setsockopt$inet_sctp6_SCTP_AUTH_KEY(r6, 0x84, 0x17, &(0x7f0000000500)=ANY=[], 0x0)
ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82)
ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82)
r7 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
ioctl$TIOCLINUX3(r7, 0x541c, &(0x7f0000000040)=0x3)
ioctl$LOOP_CTL_REMOVE(r3, 0x4c81, 0x0)

2018/03/30 13:05:55 executing program 6:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYBLOB="22811e2630b1d0ac3463"], 0x1)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r1, r2, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = getpgid(0xffffffffffffffff)
syz_open_procfs(r3, &(0x7f00000005c0)='net/ip6_tables_targets\x00')
process_vm_writev(r3, &(0x7f0000000180)=[{&(0x7f0000000140)=""/22, 0x16}], 0x1, &(0x7f00000003c0)=[{&(0x7f0000000740)=""/173, 0xad}], 0x1, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
r4 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
r5 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
r6 = dup3(0xffffffffffffffff, r0, 0x0)
setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8)
syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00')
sendmsg$IPVS_CMD_NEW_DEST(r6, &(0x7f0000000540)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x2000400}, 0xc, &(0x7f0000000500)={&(0x7f0000000240)=ANY=[@ANYPTR], 0x1}, 0x1, 0x0, 0x0, 0x10}, 0x4)
fcntl$setstatus(r1, 0x4, 0x6000)
mq_open(&(0x7f0000000800)=':em1\x00', 0x40, 0x4, &(0x7f0000000840)={0x4000000000000000, 0x0, 0x9, 0x6, 0x0, 0xff, 0x7})
pwritev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000c00)}], 0x1, 0x0)
ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffffff, 0xc0206434, &(0x7f0000000440)={0x9dca, <r7=>0x0, 0x10002, 0x4})
ioctl$DRM_IOCTL_AGP_BIND(r5, 0x40106436, &(0x7f00000004c0)={r7, 0x676})
ioctl$sock_ifreq(r5, 0x8917, &(0x7f0000000300)={'lo\x00', @ifru_data=&(0x7f00000001c0)="16e667ea25efad95e8e866bb6ef7f6ba94b72b63a28bcb7eafa978bdbe09a4d8"})
getsockopt$inet_int(r4, 0x0, 0x0, &(0x7f0000000600), &(0x7f0000000640)=0x4)
getsockname$unix(r1, &(0x7f0000000680), &(0x7f0000000700)=0x6e)

2018/03/30 13:05:55 executing program 7:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYBLOB="22811e2630"], 0x1)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r1, r2, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = getpgid(0xffffffffffffffff)
syz_open_procfs(r3, &(0x7f00000005c0)='net/ip6_tables_targets\x00')
process_vm_writev(r3, &(0x7f0000000180)=[{&(0x7f0000000140)=""/22, 0x16}], 0x1, &(0x7f00000003c0)=[{&(0x7f0000000740)=""/173, 0xad}], 0x1, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
r4 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
r5 = dup3(0xffffffffffffffff, r0, 0x80000)
setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8)
syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00')
fcntl$setstatus(r1, 0x4, 0x6000)
mq_open(&(0x7f0000000800)=':em1\x00', 0x40, 0x4, &(0x7f0000000840)={0x4000000000000000, 0x0, 0x9, 0x6, 0x0, 0xff, 0x7})
pwritev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000c00)}], 0x1, 0x0)
ioctl$DRM_IOCTL_AGP_ALLOC(r5, 0xc0206434, &(0x7f0000000440)={0x9dca, <r6=>0x0, 0x10002, 0x4})
ioctl$DRM_IOCTL_AGP_BIND(r4, 0x40106436, &(0x7f00000004c0)={r6, 0x676})
ioctl$sock_ifreq(r4, 0x8917, &(0x7f0000000300)={'lo\x00', @ifru_data=&(0x7f00000001c0)="16e667ea25efad95e8e866bb6ef7f6ba94b72b63a28bcb7eafa978bdbe09a4d8"})
getsockopt$inet_int(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000600), &(0x7f0000000640)=0x4)
getsockname$unix(r1, &(0x7f0000000680), &(0x7f0000000700)=0x6e)

2018/03/30 13:05:55 executing program 2:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYBLOB="22811e2630b1d0ac3463"], 0x1)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r1, r2, 0x1, 0x0)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = getpgid(0xffffffffffffffff)
syz_open_procfs(r3, &(0x7f00000005c0)='net/ip6_tables_targets\x00')
process_vm_writev(r3, &(0x7f0000000180)=[{&(0x7f0000000140)=""/22, 0x16}], 0x1, &(0x7f00000003c0)=[{&(0x7f0000000740)=""/173, 0xad}], 0x1, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
r4 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
setns(r2, 0x0)
r5 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
r6 = dup3(0xffffffffffffffff, r0, 0x80000)
setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8)
syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00')
sendmsg$IPVS_CMD_NEW_DEST(r6, &(0x7f0000000540)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x2000400}, 0xc, &(0x7f0000000500)={&(0x7f0000000240)=ANY=[@ANYPTR], 0x1}, 0x1, 0x0, 0x0, 0x10}, 0x4)
sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10}, 0xc, &(0x7f0000000340)={&(0x7f0000000480)=ANY=[@ANYBLOB='H\x00\x00\x00'], 0x1}, 0x1}, 0x0)
fcntl$setstatus(r1, 0x4, 0x6000)
mq_open(&(0x7f0000000800)=':em1\x00', 0x40, 0x4, &(0x7f0000000840)={0x0, 0x0, 0x9, 0x6, 0x0, 0xff, 0x7})
pwritev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000c00)}], 0x1, 0x0)
ioctl$DRM_IOCTL_AGP_ALLOC(r6, 0xc0206434, &(0x7f0000000440)={0x9dca, <r7=>0x0, 0x10002, 0x4})
ioctl$DRM_IOCTL_AGP_BIND(r5, 0x40106436, &(0x7f00000004c0)={r7, 0x676})
ioctl$sock_ifreq(r5, 0x8917, &(0x7f0000000300)={'lo\x00', @ifru_data=&(0x7f00000001c0)="16e667ea25efad95e8e866bb6ef7f6ba94b72b63a28bcb7eafa978bdbe09a4d8"})
getsockopt$inet_int(r4, 0x0, 0x0, &(0x7f0000000600), &(0x7f0000000640)=0x4)
getsockname$unix(r1, &(0x7f0000000680), &(0x7f0000000700)=0x6e)

2018/03/30 13:05:55 executing program 1:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYBLOB="22811e2630b1d0ac3463"], 0x1)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r1, r2, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = getpgid(0xffffffffffffffff)
syz_open_procfs(r3, &(0x7f00000005c0)='net/ip6_tables_targets\x00')
process_vm_writev(r3, &(0x7f0000000180), 0x0, &(0x7f00000003c0)=[{&(0x7f0000000740)=""/173, 0xad}], 0x1, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
r4 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
r5 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
r6 = dup3(0xffffffffffffffff, r0, 0x80000)
setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8)
syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00')
fcntl$setstatus(r1, 0x4, 0x6000)
mq_open(&(0x7f0000000800)=':em1\x00', 0x40, 0x4, &(0x7f0000000840)={0x4000000000000000, 0x0, 0x9, 0x6, 0x0, 0xff, 0x7})
pwritev(0xffffffffffffffff, &(0x7f00000000c0), 0x0, 0x0)
ioctl$DRM_IOCTL_AGP_ALLOC(r6, 0xc0206434, &(0x7f0000000440)={0x9dca, <r7=>0x0, 0x10002, 0x4})
ioctl$DRM_IOCTL_AGP_BIND(r5, 0x40106436, &(0x7f00000004c0)={r7, 0x676})
ioctl$sock_ifreq(r5, 0x8917, &(0x7f0000000300)={'lo\x00', @ifru_data=&(0x7f00000001c0)="16e667ea25efad95e8e866bb6ef7f6ba94b72b63a28bcb7eafa978bdbe09a4d8"})
getsockopt$inet_int(r4, 0x0, 0x0, &(0x7f0000000600), &(0x7f0000000640)=0x4)
getsockname$unix(r1, &(0x7f0000000680), &(0x7f0000000700)=0x6e)

[  586.086409] binder: 29477:29480 ioctl 40046207 0 returned -16
[  586.087597] binder: 29476:29478 got transaction with invalid offset (0, min 24 max 40) or object.
** 6 printk messages dropped ** [  586.113127] binder: BINDER_SET_CONTEXT_MGR already set
2018/03/30 13:05:55 executing program 1:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYBLOB="22811e2630b1d0ac3463"], 0x1)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r1, r2, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = getpgid(0xffffffffffffffff)
syz_open_procfs(r3, &(0x7f00000005c0)='net/ip6_tables_targets\x00')
process_vm_writev(r3, &(0x7f0000000180), 0x0, &(0x7f00000003c0)=[{&(0x7f0000000740)=""/173, 0xad}], 0x1, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
r4 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
r5 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
r6 = dup3(0xffffffffffffffff, r0, 0x80000)
setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8)
syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00')
fcntl$setstatus(r1, 0x4, 0x6000)
mq_open(&(0x7f0000000800)=':em1\x00', 0x40, 0x4, &(0x7f0000000840)={0x4000000000000000, 0x0, 0x9, 0x6, 0x0, 0xff, 0x7})
pwritev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000c00)}], 0x1, 0x0)
ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffffff, 0xc0206434, &(0x7f0000000440)={0x9dca, <r7=>0x0, 0x10002, 0x4})
ioctl$DRM_IOCTL_AGP_BIND(r5, 0x40106436, &(0x7f00000004c0)={r7, 0x676})
ioctl$sock_ifreq(r5, 0x8917, &(0x7f0000000300)={'lo\x00', @ifru_data=&(0x7f00000001c0)="16e667ea25efad95e8e866bb6ef7f6ba94b72b63a28bcb7eafa978bdbe09a4d8"})
getsockopt$inet_int(r4, 0x0, 0x0, &(0x7f0000000600), &(0x7f0000000640)=0x4)
getsockname$unix(r1, &(0x7f0000000680), &(0x7f0000000700)=0x6e)

2018/03/30 13:05:55 executing program 5:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYBLOB="00811e2630b1d0ac3463"], 0x1)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r1, r2, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
setns(r2, 0x0)
r3 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/loop-control\x00', 0x0, 0x0)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)
r4 = dup(r3)
getsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffff9c, 0x84, 0x6f, &(0x7f0000000340)={<r5=>0x0, 0x3c, &(0x7f00000005c0)=[@in={0x2, 0x4e23, @local={0xac, 0x14, 0x14, 0xaa}}, @in={0x2, 0x4e24, @broadcast=0xffffffff}, @in6={0xa, 0x0, 0x100000000, @loopback={0x0, 0x1}, 0x323d000000000}]}, &(0x7f0000000640)=0xc)
setsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r4, 0x84, 0xa, &(0x7f0000000680)={0xcff3, 0x80000000, 0x3, 0x0, 0x0, 0x66e, 0x5, 0x0, r5}, 0x20)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)
mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x5c831, 0xffffffffffffffff, 0x0)
openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/mls\x00', 0x0, 0x0)
setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(0xffffffffffffffff, 0x10e, 0x2, &(0x7f0000000340)=0xc, 0x4)
madvise(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x9)
r6 = syz_open_dev$usbmon(&(0x7f0000000040)='/dev/usbmon#\x00', 0x0, 0x80000)
getsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r6, 0x84, 0x75, &(0x7f00000000c0)={0x0, 0x6}, &(0x7f0000000100)=0x8)
setsockopt$inet_sctp6_SCTP_AUTH_KEY(r6, 0x84, 0x17, &(0x7f0000000500)=ANY=[], 0x0)
ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)
r7 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
ioctl$TIOCLINUX3(r7, 0x541c, &(0x7f0000000040)=0x3)
ioctl$LOOP_CTL_REMOVE(r3, 0x4c81, 0x0)

2018/03/30 13:05:55 executing program 2:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYBLOB="22811e2630b1d0ac3463"], 0x1)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r1, r2, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x0, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = getpgid(0xffffffffffffffff)
syz_open_procfs(r3, &(0x7f00000005c0)='net/ip6_tables_targets\x00')
process_vm_writev(r3, &(0x7f0000000180)=[{&(0x7f0000000140)=""/22, 0x16}], 0x1, &(0x7f00000003c0)=[{&(0x7f0000000740)=""/173, 0xad}], 0x1, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
r4 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
setns(r2, 0x0)
r5 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
r6 = dup3(0xffffffffffffffff, r0, 0x80000)
setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8)
syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00')
sendmsg$IPVS_CMD_NEW_DEST(r6, &(0x7f0000000540)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x2000400}, 0xc, &(0x7f0000000500)={&(0x7f0000000240)=ANY=[@ANYPTR], 0x1}, 0x1, 0x0, 0x0, 0x10}, 0x4)
sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10}, 0xc, &(0x7f0000000340)={&(0x7f0000000480)=ANY=[@ANYBLOB='H\x00\x00\x00'], 0x1}, 0x1}, 0x0)
fcntl$setstatus(r1, 0x4, 0x6000)
mq_open(&(0x7f0000000800)=':em1\x00', 0x40, 0x4, &(0x7f0000000840)={0x0, 0x0, 0x9, 0x6, 0x0, 0xff, 0x7})
pwritev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000c00)}], 0x1, 0x0)
ioctl$DRM_IOCTL_AGP_ALLOC(r6, 0xc0206434, &(0x7f0000000440)={0x9dca, <r7=>0x0, 0x10002, 0x4})
ioctl$DRM_IOCTL_AGP_BIND(r5, 0x40106436, &(0x7f00000004c0)={r7, 0x676})
ioctl$sock_ifreq(r5, 0x8917, &(0x7f0000000300)={'lo\x00', @ifru_data=&(0x7f00000001c0)="16e667ea25efad95e8e866bb6ef7f6ba94b72b63a28bcb7eafa978bdbe09a4d8"})
getsockopt$inet_int(r4, 0x0, 0x0, &(0x7f0000000600), &(0x7f0000000640)=0x4)
getsockname$unix(r1, &(0x7f0000000680), &(0x7f0000000700)=0x6e)

** 19 printk messages dropped ** [  586.195794] binder: 29499:29503 transaction failed 29201/-22, size 40-16 line 3197
[  586.201712] binder: BINDER_SET_CONTEXT_MGR already set
[  586.201719] binder: 29504:29506 ioctl 40046207 0 returned -16
2018/03/30 13:05:55 executing program 3:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[], 0x0)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r1, r2, 0x1, 0x0)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
setns(r2, 0x0)
r3 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/loop-control\x00', 0x0, 0x0)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)
r4 = dup(r3)
getsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffff9c, 0x84, 0x6f, &(0x7f0000000340)={<r5=>0x0, 0x3c, &(0x7f00000005c0)=[@in={0x2, 0x4e23, @local={0xac, 0x14, 0x14, 0xaa}}, @in={0x2, 0x4e24, @broadcast=0xffffffff}, @in6={0xa, 0x0, 0x100000000, @loopback={0x0, 0x1}, 0x323d000000000}]}, &(0x7f0000000640)=0xc)
setsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r4, 0x84, 0xa, &(0x7f0000000680)={0xcff3, 0x80000000, 0x3, 0x0, 0x0, 0x66e, 0x5, 0x1, r5}, 0x20)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)
mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x5c831, 0xffffffffffffffff, 0x0)
openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/mls\x00', 0x0, 0x0)
setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(0xffffffffffffffff, 0x10e, 0x2, &(0x7f0000000340)=0xc, 0x4)
madvise(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x9)
r6 = syz_open_dev$usbmon(&(0x7f0000000040)='/dev/usbmon#\x00', 0x0, 0x80000)
ioctl$KDSKBMODE(0xffffffffffffffff, 0x4b45, &(0x7f0000000080))
getsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r6, 0x84, 0x75, &(0x7f00000000c0)={0x0, 0x6}, &(0x7f0000000100)=0x8)
setsockopt$inet_sctp6_SCTP_AUTH_KEY(r6, 0x84, 0x17, &(0x7f0000000500)=ANY=[], 0x0)
ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82)
ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82)
r7 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
ioctl$TIOCLINUX3(r7, 0x541c, &(0x7f0000000040)=0x3)
ioctl$LOOP_CTL_REMOVE(r3, 0x4c81, 0x0)

2018/03/30 13:05:55 executing program 7:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYBLOB="22811e2630"], 0x1)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r1, r2, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = getpgid(0xffffffffffffffff)
syz_open_procfs(r3, &(0x7f00000005c0)='net/ip6_tables_targets\x00')
process_vm_writev(r3, &(0x7f0000000180)=[{&(0x7f0000000140)=""/22, 0x16}], 0x1, &(0x7f00000003c0)=[{&(0x7f0000000740)=""/173, 0xad}], 0x1, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
r4 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
r5 = dup3(0xffffffffffffffff, r0, 0x80000)
setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8)
syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00')
fcntl$setstatus(r1, 0x4, 0x6000)
mq_open(&(0x7f0000000800)=':em1\x00', 0x40, 0x4, &(0x7f0000000840)={0x4000000000000000, 0x0, 0x9, 0x6, 0x0, 0xff, 0x7})
pwritev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000c00)}], 0x1, 0x0)
ioctl$DRM_IOCTL_AGP_ALLOC(r5, 0xc0206434, &(0x7f0000000440)={0x9dca, <r6=>0x0, 0x10002, 0x4})
ioctl$DRM_IOCTL_AGP_BIND(r4, 0x40106436, &(0x7f00000004c0)={r6, 0x676})
ioctl$sock_ifreq(r4, 0x8917, &(0x7f0000000300)={'lo\x00', @ifru_data=&(0x7f00000001c0)="16e667ea25efad95e8e866bb6ef7f6ba94b72b63a28bcb7eafa978bdbe09a4d8"})
getsockopt$inet_int(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000600), &(0x7f0000000640)=0x4)
getsockname$unix(r1, &(0x7f0000000680), &(0x7f0000000700)=0x6e)

2018/03/30 13:05:55 executing program 6:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYBLOB="22811e2630b1d0ac3463"], 0x1)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r1, r2, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = getpgid(0xffffffffffffffff)
syz_open_procfs(r3, &(0x7f00000005c0)='net/ip6_tables_targets\x00')
process_vm_writev(r3, &(0x7f0000000180)=[{&(0x7f0000000140)=""/22, 0x16}], 0x1, &(0x7f00000003c0)=[{&(0x7f0000000740)=""/173, 0xad}], 0x1, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
r4 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
r5 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
r6 = dup3(0xffffffffffffffff, r0, 0x0)
setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8)
syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00')
sendmsg$IPVS_CMD_NEW_DEST(r6, &(0x7f0000000540)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x2000400}, 0xc, &(0x7f0000000500)={&(0x7f0000000240)=ANY=[@ANYPTR], 0x1}, 0x1, 0x0, 0x0, 0x10}, 0x4)
fcntl$setstatus(r1, 0x4, 0x6000)
mq_open(&(0x7f0000000800)=':em1\x00', 0x40, 0x4, &(0x7f0000000840)={0x4000000000000000, 0x0, 0x9, 0x6, 0x0, 0xff, 0x7})
pwritev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000c00)}], 0x1, 0x0)
ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffffff, 0xc0206434, &(0x7f0000000440)={0x9dca, <r7=>0x0, 0x10002, 0x4})
ioctl$DRM_IOCTL_AGP_BIND(r5, 0x40106436, &(0x7f00000004c0)={r7, 0x676})
ioctl$sock_ifreq(r5, 0x8917, &(0x7f0000000300)={'lo\x00', @ifru_data=&(0x7f00000001c0)="16e667ea25efad95e8e866bb6ef7f6ba94b72b63a28bcb7eafa978bdbe09a4d8"})
getsockopt$inet_int(r4, 0x0, 0x0, &(0x7f0000000600), &(0x7f0000000640)=0x4)
getsockname$unix(r1, &(0x7f0000000680), &(0x7f0000000700)=0x6e)

2018/03/30 13:05:55 executing program 5:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYBLOB="00811e2630b1d0ac3463"], 0x1)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r1, r2, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
setns(r2, 0x0)
r3 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/loop-control\x00', 0x0, 0x0)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)
r4 = dup(r3)
getsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffff9c, 0x84, 0x6f, &(0x7f0000000340)={<r5=>0x0, 0x3c, &(0x7f00000005c0)=[@in={0x2, 0x4e23, @local={0xac, 0x14, 0x14, 0xaa}}, @in={0x2, 0x4e24, @broadcast=0xffffffff}, @in6={0xa, 0x0, 0x100000000, @loopback={0x0, 0x1}, 0x323d000000000}]}, &(0x7f0000000640)=0xc)
setsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r4, 0x84, 0xa, &(0x7f0000000680)={0xcff3, 0x80000000, 0x3, 0x0, 0x0, 0x66e, 0x5, 0x0, r5}, 0x20)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)
mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x5c831, 0xffffffffffffffff, 0x0)
openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/mls\x00', 0x0, 0x0)
setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(0xffffffffffffffff, 0x10e, 0x2, &(0x7f0000000340)=0xc, 0x4)
madvise(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x9)
r6 = syz_open_dev$usbmon(&(0x7f0000000040)='/dev/usbmon#\x00', 0x0, 0x80000)
getsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r6, 0x84, 0x75, &(0x7f00000000c0)={0x0, 0x6}, &(0x7f0000000100)=0x8)
setsockopt$inet_sctp6_SCTP_AUTH_KEY(r6, 0x84, 0x17, &(0x7f0000000500)=ANY=[], 0x0)
ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)
r7 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
ioctl$TIOCLINUX3(r7, 0x541c, &(0x7f0000000040)=0x3)
ioctl$LOOP_CTL_REMOVE(r3, 0x4c81, 0x0)

** 4 printk messages dropped ** [  586.267353] binder: 29511:29518 got transaction with invalid offset (0, min 24 max 40) or object.
2018/03/30 13:05:55 executing program 4:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
r1 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000002880)='/selinux/avc/cache_stats\x00', 0x0, 0x0)
ioctl$EVIOCSABS20(r1, 0x401845e0, &(0x7f00000028c0)={0x1000, 0x7fff, 0x1ff, 0xffffffff, 0x7, 0x40})
fchdir(r0)
r2 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(r2, &(0x7f0000000080)=ANY=[@ANYBLOB="00811e2630b1d0ac3463"], 0x1)
setsockopt$packet_add_memb(r2, 0x107, 0x1, &(0x7f0000002900)={0x0, 0x1, 0x6}, 0x10)
r3 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r2, r3, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r3, 0x0)
inotify_init1(0x800)
ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
r4 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
setns(r3, 0x8000000)
r5 = socket$nl_xfrm(0x10, 0x3, 0x6)
r6 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
dup3(r3, r0, 0x80000)
setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8)
r7 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00')
sendmsg$IPVS_CMD_NEW_DEST(0xffffffffffffffff, &(0x7f0000000540)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x2000400}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)=ANY=[@ANYBLOB=',\x00\x00\x00'], 0x1}, 0x1, 0x0, 0x0, 0x10}, 0x4)
sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10}, 0xc, &(0x7f0000000340)={&(0x7f0000000480)=ANY=[@ANYBLOB='H\x00\x00\x00'], 0x1}, 0x1}, 0x0)
sendmsg$IPVS_CMD_GET_DEST(r2, &(0x7f0000000880)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f00000005c0)={&(0x7f0000000740)={0x138, r7, 0x208, 0x70bd2b, 0x25dfdbfb, {0x8}, [@IPVS_CMD_ATTR_SERVICE={0x28, 0x1, [@IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@multicast2=0xe0000002}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x3}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x7fff}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x8c6}, @IPVS_CMD_ATTR_DAEMON={0x50, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @remote={0xac, 0x14, 0x14, 0xbb}}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x400}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x10001}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'syz_tun\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x6}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x2}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x30, 0x2, [@IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x2}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv6=@ipv4={[], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0xffffffff}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0xafa6}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x1}, @IPVS_CMD_ATTR_DEST={0x6c, 0x2, [@IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x7}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv4=@remote={0xac, 0x14, 0x14, 0xbb}}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x8}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x1}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x5}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x3}, @IPVS_DEST_ATTR_PORT={0x8, 0x2, 0x4e22}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv6=@mcast2={0xff, 0x2, [], 0x1}}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x10000}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x701a3921}]}]}, 0x138}, 0x1, 0x0, 0x0, 0x90}, 0x4)
fcntl$setstatus(r2, 0x4, 0x6000)
setsockopt$sock_linger(r4, 0x1, 0xd, &(0x7f00000008c0)={0x1, 0x2}, 0x8)
pwritev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000c00)="cfb93447d6feaef9f73c0561e075a8295d43017ab1a157786dcda36c5eec92a4306f284fa7e3ed364cc2da5c08cf7e4030d394520e123eee6d9ab275c91c174b1364fc943b49faefe12f605b5ce6c1400a91210c00477f900aff390901bf594c18557cb38a7d57ac8ded098b96b9dfc125e3bdc9305193f4cd256068baca5208160d820b9e7a043666ba4801cf6d557fc0f97f35c13ec6c0d1fe97ce1af1c17078ef47ab955200836671e402717481d14936b09828fd6f55fda2f11eb4c61b480e941133c0a4c5ec54033d0d174742191754ffe28b093596286a78ea01078337ada8585aa98dcc1143689002e31ccc5b9f5cfd2bbce5683a0f91b395391a60ba8e8f4d3c10c82c71caa74c44c8b0f3e42f1fc264497d5b9dabf309bad7bd", 0x11e}], 0x1, 0x0)
sendmmsg(r5, &(0x7f00000027c0)=[{{0x0, 0x0, &(0x7f0000000a00)=[{&(0x7f0000000900)="913da470640ae70fe168a71ad316e5525ce43547f28d8c56cb5cd246950c2d44a514698b3aebf2b60d933814378b0b9b750dec28bdbeedda6c8af5f3418ff8c43701e5dea492428ecdcf0e8c2a19f60e388b478179256834360c5ee359dbe4fabee36883a8314f0ea64dea3a732dffbe26a02e8327a0f7174a6990389e5b608d5300c271f26b3b37cc88e720a477e5f1aa2751af90d35d72606ac73f72dab39aad418a6335d44c785ba83edc9619a3221ae39ef2fed1657e426fa293a739cd779a6c645b3d29bb184041476e8e6e737e5fa1c4312360", 0xd6}], 0x1, 0x0, 0x0, 0x8000}, 0x3f}, {{&(0x7f0000002240)=@nl=@unspec, 0x80, &(0x7f0000002680)=[{&(0x7f00000022c0)="756a6b1895d55b0b292a3985cd35f28cfa8d5ab20a3448791e47ec9e971be82f993ebd55ec843a76ccd644a71222e57119e6f8866f59ba0b89c4cf71a9ce853f72bd99ac9097baf924ea3e3fbceaf0a0df15deb45ae757832bec56c67c0ad44e0ea5fcbc12f898989e1773427ad180efff1044e98613dab446587dd52a0deacb4074e01d97cd46c6e633ae1c1011fd2123c766e6fea028799cf82a562bd9d52c544241172f684398ac1b", 0xaa}, {&(0x7f0000002440)="c802b7c29c92c7ddcf8b11133e071ae83e8c0b0827764303ad44356d381633ce1fdd31e1641872e8d6b4c1a974d97d", 0x2f}, {&(0x7f0000002540)="446c9b3779f2a3dc39f3a3541d912b01ca9865e4172a83cda910f6b10dd97377212eb5279c", 0x25}], 0x3, &(0x7f0000002700)=[{0xa0, 0x10f, 0x200, "4f483406ed4a2e47550522989e031e3e239b59c5dc988744d266f33171b6d4a8e54f025a1e1be02c21ad9675e29aea96625352eec0db268e5c70b8e22a2bb0e11b9e6d9613d4e8e338194d9a41821db1ef97a16b16e5263d008bb6ce86b1e26f4d59926a9a72bed62192dc96eaa8a033c9ddaf2fc8c5fb9e765e5ff99cc5ae6fa7bc4a4f0abcb9c9745b54449a"}], 0xa0, 0x800}, 0x1200000}], 0x2, 0x20040000)
sendmsg$IPVS_CMD_DEL_DAEMON(r2, &(0x7f0000000280)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000240)={&(0x7f0000000180)={0x28, 0x0, 0xb30, 0x0, 0x25dfdbfc, {0xa}, [@IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x3ff}, @IPVS_CMD_ATTR_SERVICE={0xc, 0x1, [@IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8}]}]}, 0x28}, 0x1}, 0x0)
ioctl$sock_ifreq(r6, 0x8917, &(0x7f0000000300)={'lo\x00', @ifru_data=&(0x7f00000001c0)="16e667ea25efad95e8e866bb6ef7f6ba94b72b63a28bcb7eafa978bdbe09a4d8"})
getsockopt$inet_int(r4, 0x0, 0x0, &(0x7f0000000600), &(0x7f0000000640)=0x4)
getsockname$unix(r2, &(0x7f0000000680), &(0x7f0000000700)=0x6e)

** 9 printk messages dropped ** [  586.277650] binder: 29513:29519 got transaction with invalid offset (0, min 24 max 40) or object.
** 13 printk messages dropped ** [  586.294437] binder: 29517:29523 got transaction with invalid offset (0, min 24 max 40) or object.
** 4 printk messages dropped ** [  586.337397] binder: undelivered TRANSACTION_ERROR: 29201
2018/03/30 13:05:55 executing program 2:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYBLOB="22811e2630b1d0ac3463"], 0x1)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r1, r2, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x0, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = getpgid(0xffffffffffffffff)
syz_open_procfs(r3, &(0x7f00000005c0)='net/ip6_tables_targets\x00')
process_vm_writev(r3, &(0x7f0000000180)=[{&(0x7f0000000140)=""/22, 0x16}], 0x1, &(0x7f00000003c0)=[{&(0x7f0000000740)=""/173, 0xad}], 0x1, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
r4 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
setns(r2, 0x0)
r5 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
r6 = dup3(0xffffffffffffffff, r0, 0x80000)
setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8)
syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00')
sendmsg$IPVS_CMD_NEW_DEST(r6, &(0x7f0000000540)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x2000400}, 0xc, &(0x7f0000000500)={&(0x7f0000000240)=ANY=[@ANYPTR], 0x1}, 0x1, 0x0, 0x0, 0x10}, 0x4)
sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10}, 0xc, &(0x7f0000000340)={&(0x7f0000000480)=ANY=[@ANYBLOB='H\x00\x00\x00'], 0x1}, 0x1}, 0x0)
fcntl$setstatus(r1, 0x4, 0x6000)
mq_open(&(0x7f0000000800)=':em1\x00', 0x40, 0x4, &(0x7f0000000840)={0x0, 0x0, 0x9, 0x6, 0x0, 0xff, 0x7})
pwritev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000c00)}], 0x1, 0x0)
ioctl$DRM_IOCTL_AGP_ALLOC(r6, 0xc0206434, &(0x7f0000000440)={0x9dca, <r7=>0x0, 0x10002, 0x4})
ioctl$DRM_IOCTL_AGP_BIND(r5, 0x40106436, &(0x7f00000004c0)={r7, 0x676})
ioctl$sock_ifreq(r5, 0x8917, &(0x7f0000000300)={'lo\x00', @ifru_data=&(0x7f00000001c0)="16e667ea25efad95e8e866bb6ef7f6ba94b72b63a28bcb7eafa978bdbe09a4d8"})
getsockopt$inet_int(r4, 0x0, 0x0, &(0x7f0000000600), &(0x7f0000000640)=0x4)
getsockname$unix(r1, &(0x7f0000000680), &(0x7f0000000700)=0x6e)

2018/03/30 13:05:55 executing program 1:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYBLOB="22811e2630b1d0ac3463"], 0x1)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r1, r2, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = getpgid(0xffffffffffffffff)
syz_open_procfs(r3, &(0x7f00000005c0)='net/ip6_tables_targets\x00')
process_vm_writev(r3, &(0x7f0000000180), 0x0, &(0x7f00000003c0)=[{&(0x7f0000000740)=""/173, 0xad}], 0x1, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
r4 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
r5 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
r6 = dup3(0xffffffffffffffff, r0, 0x80000)
setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8)
syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00')
fcntl$setstatus(r1, 0x4, 0x6000)
mq_open(&(0x7f0000000800)=':em1\x00', 0x40, 0x4, &(0x7f0000000840)={0x4000000000000000, 0x0, 0x9, 0x6, 0x0, 0xff, 0x7})
pwritev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000c00)}], 0x1, 0x0)
ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffffff, 0xc0206434, &(0x7f0000000440)={0x9dca, <r7=>0x0, 0x10002, 0x4})
ioctl$DRM_IOCTL_AGP_BIND(r5, 0x40106436, &(0x7f00000004c0)={r7, 0x676})
ioctl$sock_ifreq(r5, 0x8917, &(0x7f0000000300)={'lo\x00', @ifru_data=&(0x7f00000001c0)="16e667ea25efad95e8e866bb6ef7f6ba94b72b63a28bcb7eafa978bdbe09a4d8"})
getsockopt$inet_int(r4, 0x0, 0x0, &(0x7f0000000600), &(0x7f0000000640)=0x4)
getsockname$unix(r1, &(0x7f0000000680), &(0x7f0000000700)=0x6e)

2018/03/30 13:05:55 executing program 3:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[], 0x0)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r1, r2, 0x1, 0x0)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
setns(r2, 0x0)
r3 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/loop-control\x00', 0x0, 0x0)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)
r4 = dup(r3)
getsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffff9c, 0x84, 0x6f, &(0x7f0000000340)={<r5=>0x0, 0x3c, &(0x7f00000005c0)=[@in={0x2, 0x4e23, @local={0xac, 0x14, 0x14, 0xaa}}, @in={0x2, 0x4e24, @broadcast=0xffffffff}, @in6={0xa, 0x0, 0x100000000, @loopback={0x0, 0x1}, 0x323d000000000}]}, &(0x7f0000000640)=0xc)
setsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r4, 0x84, 0xa, &(0x7f0000000680)={0xcff3, 0x80000000, 0x3, 0x0, 0x0, 0x66e, 0x5, 0x1, r5}, 0x20)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)
mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x5c831, 0xffffffffffffffff, 0x0)
openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/mls\x00', 0x0, 0x0)
setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(0xffffffffffffffff, 0x10e, 0x2, &(0x7f0000000340)=0xc, 0x4)
madvise(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x9)
r6 = syz_open_dev$usbmon(&(0x7f0000000040)='/dev/usbmon#\x00', 0x0, 0x80000)
ioctl$KDSKBMODE(0xffffffffffffffff, 0x4b45, &(0x7f0000000080))
getsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r6, 0x84, 0x75, &(0x7f00000000c0)={0x0, 0x6}, &(0x7f0000000100)=0x8)
setsockopt$inet_sctp6_SCTP_AUTH_KEY(r6, 0x84, 0x17, &(0x7f0000000500)=ANY=[], 0x0)
ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82)
ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82)
r7 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
ioctl$TIOCLINUX3(r7, 0x541c, &(0x7f0000000040)=0x3)
ioctl$LOOP_CTL_REMOVE(r3, 0x4c81, 0x0)

2018/03/30 13:05:55 executing program 0:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYBLOB="22811e2630b1d0ac3463"], 0x1)
r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(0xffffffffffffffff, r1, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
r2 = getpgid(0xffffffffffffffff)
syz_open_procfs(r2, &(0x7f00000005c0)='net/ip6_tables_targets\x00')
process_vm_writev(r2, &(0x7f0000000180)=[{&(0x7f0000000140)=""/22, 0x16}], 0x1, &(0x7f00000003c0)=[{&(0x7f0000000740)=""/173, 0xad}], 0x1, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
r3 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
setns(r1, 0x0)
r4 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
r5 = dup3(0xffffffffffffffff, r0, 0x80000)
setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8)
syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00')
sendmsg$IPVS_CMD_NEW_DEST(r5, &(0x7f0000000540)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x2000400}, 0xc, &(0x7f0000000500)={&(0x7f0000000240)=ANY=[@ANYPTR], 0x1}, 0x1, 0x0, 0x0, 0x10}, 0x0)
sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10}, 0xc, &(0x7f0000000340)={&(0x7f0000000480)=ANY=[@ANYBLOB='H\x00\x00\x00'], 0x1}, 0x1}, 0x0)
fcntl$setstatus(0xffffffffffffffff, 0x4, 0x6000)
mq_open(&(0x7f0000000800)=':em1\x00', 0x40, 0x4, &(0x7f0000000840)={0x4000000000000000, 0x0, 0x9, 0x6, 0x0, 0xff, 0x7})
pwritev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000c00)}], 0x1, 0x0)
ioctl$DRM_IOCTL_AGP_ALLOC(r5, 0xc0206434, &(0x7f0000000440)={0x9dca, <r6=>0x0, 0x10002, 0x4})
ioctl$DRM_IOCTL_AGP_BIND(r4, 0x40106436, &(0x7f00000004c0)={r6, 0x676})
ioctl$sock_ifreq(r4, 0x8917, &(0x7f0000000300)={'lo\x00', @ifru_data=&(0x7f00000001c0)="16e667ea25efad95e8e866bb6ef7f6ba94b72b63a28bcb7eafa978bdbe09a4d8"})
getsockopt$inet_int(r3, 0x0, 0x0, &(0x7f0000000600), &(0x7f0000000640)=0x4)
getsockname$unix(0xffffffffffffffff, &(0x7f0000000680), &(0x7f0000000700)=0x6e)

2018/03/30 13:05:55 executing program 5:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYBLOB="00811e2630b1d0ac3463"], 0x1)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r1, r2, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
setns(r2, 0x0)
r3 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/loop-control\x00', 0x0, 0x0)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)
r4 = dup(r3)
getsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffff9c, 0x84, 0x6f, &(0x7f0000000340)={<r5=>0x0, 0x3c, &(0x7f00000005c0)=[@in={0x2, 0x4e23, @local={0xac, 0x14, 0x14, 0xaa}}, @in={0x2, 0x4e24, @broadcast=0xffffffff}, @in6={0xa, 0x0, 0x100000000, @loopback={0x0, 0x1}, 0x323d000000000}]}, &(0x7f0000000640)=0xc)
setsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r4, 0x84, 0xa, &(0x7f0000000680)={0xcff3, 0x80000000, 0x3, 0x0, 0x0, 0x66e, 0x5, 0x0, r5}, 0x20)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)
mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x5c831, 0xffffffffffffffff, 0x0)
openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/mls\x00', 0x0, 0x0)
setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(0xffffffffffffffff, 0x10e, 0x2, &(0x7f0000000340)=0xc, 0x4)
madvise(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x9)
r6 = syz_open_dev$usbmon(&(0x7f0000000040)='/dev/usbmon#\x00', 0x0, 0x80000)
getsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r6, 0x84, 0x75, &(0x7f00000000c0)={0x0, 0x6}, &(0x7f0000000100)=0x8)
setsockopt$inet_sctp6_SCTP_AUTH_KEY(r6, 0x84, 0x17, &(0x7f0000000500)=ANY=[], 0x0)
ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)
r7 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
ioctl$TIOCLINUX3(r7, 0x541c, &(0x7f0000000040)=0x3)
ioctl$LOOP_CTL_REMOVE(r3, 0x4c81, 0x0)

2018/03/30 13:05:55 executing program 4:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
r1 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000002880)='/selinux/avc/cache_stats\x00', 0x0, 0x0)
ioctl$EVIOCSABS20(r1, 0x401845e0, &(0x7f00000028c0)={0x1000, 0x7fff, 0x1ff, 0xffffffff, 0x7, 0x40})
fchdir(r0)
r2 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(r2, &(0x7f0000000080)=ANY=[@ANYBLOB="00811e2630b1d0ac3463"], 0x1)
setsockopt$packet_add_memb(r2, 0x107, 0x1, &(0x7f0000002900)={0x0, 0x1, 0x6}, 0x10)
r3 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r2, r3, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r3, 0x0)
inotify_init1(0x800)
ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
r4 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
setns(r3, 0x8000000)
r5 = socket$nl_xfrm(0x10, 0x3, 0x6)
r6 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
dup3(r3, r0, 0x80000)
setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8)
r7 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00')
sendmsg$IPVS_CMD_NEW_DEST(0xffffffffffffffff, &(0x7f0000000540)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x2000400}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)=ANY=[@ANYBLOB=',\x00\x00\x00'], 0x1}, 0x1, 0x0, 0x0, 0x10}, 0x4)
sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10}, 0xc, &(0x7f0000000340)={&(0x7f0000000480)=ANY=[@ANYBLOB='H\x00\x00\x00'], 0x1}, 0x1}, 0x0)
sendmsg$IPVS_CMD_GET_DEST(r2, &(0x7f0000000880)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f00000005c0)={&(0x7f0000000740)={0x138, r7, 0x208, 0x70bd2b, 0x25dfdbfb, {0x8}, [@IPVS_CMD_ATTR_SERVICE={0x28, 0x1, [@IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@multicast2=0xe0000002}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x3}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x7fff}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x8c6}, @IPVS_CMD_ATTR_DAEMON={0x50, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @remote={0xac, 0x14, 0x14, 0xbb}}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x400}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x10001}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'syz_tun\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x6}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x2}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x30, 0x2, [@IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x2}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv6=@ipv4={[], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0xffffffff}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0xafa6}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x1}, @IPVS_CMD_ATTR_DEST={0x6c, 0x2, [@IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x7}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv4=@remote={0xac, 0x14, 0x14, 0xbb}}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x8}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x1}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x5}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x3}, @IPVS_DEST_ATTR_PORT={0x8, 0x2, 0x4e22}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv6=@mcast2={0xff, 0x2, [], 0x1}}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x10000}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x701a3921}]}]}, 0x138}, 0x1, 0x0, 0x0, 0x90}, 0x4)
fcntl$setstatus(r2, 0x4, 0x6000)
setsockopt$sock_linger(r4, 0x1, 0xd, &(0x7f00000008c0)={0x1, 0x2}, 0x8)
pwritev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000c00)="cfb93447d6feaef9f73c0561e075a8295d43017ab1a157786dcda36c5eec92a4306f284fa7e3ed364cc2da5c08cf7e4030d394520e123eee6d9ab275c91c174b1364fc943b49faefe12f605b5ce6c1400a91210c00477f900aff390901bf594c18557cb38a7d57ac8ded098b96b9dfc125e3bdc9305193f4cd256068baca5208160d820b9e7a043666ba4801cf6d557fc0f97f35c13ec6c0d1fe97ce1af1c17078ef47ab955200836671e402717481d14936b09828fd6f55fda2f11eb4c61b480e941133c0a4c5ec54033d0d174742191754ffe28b093596286a78ea01078337ada8585aa98dcc1143689002e31ccc5b9f5cfd2bbce5683a0f91b395391a60ba8e8f4d3c10c82c71caa74c44c8b0f3e42f1fc264497d5b9dabf309bad7bd", 0x11e}], 0x1, 0x0)
sendmmsg(r5, &(0x7f00000027c0)=[{{0x0, 0x0, &(0x7f0000000a00)=[{&(0x7f0000000900)="913da470640ae70fe168a71ad316e5525ce43547f28d8c56cb5cd246950c2d44a514698b3aebf2b60d933814378b0b9b750dec28bdbeedda6c8af5f3418ff8c43701e5dea492428ecdcf0e8c2a19f60e388b478179256834360c5ee359dbe4fabee36883a8314f0ea64dea3a732dffbe26a02e8327a0f7174a6990389e5b608d5300c271f26b3b37cc88e720a477e5f1aa2751af90d35d72606ac73f72dab39aad418a6335d44c785ba83edc9619a3221ae39ef2fed1657e426fa293a739cd779a6c645b3d29bb184041476e8e6e737e5fa1c4312360", 0xd6}], 0x1, 0x0, 0x0, 0x8000}, 0x3f}, {{&(0x7f0000002240)=@nl=@unspec, 0x80, &(0x7f0000002680)=[{&(0x7f00000022c0)="756a6b1895d55b0b292a3985cd35f28cfa8d5ab20a3448791e47ec9e971be82f993ebd55ec843a76ccd644a71222e57119e6f8866f59ba0b89c4cf71a9ce853f72bd99ac9097baf924ea3e3fbceaf0a0df15deb45ae757832bec56c67c0ad44e0ea5fcbc12f898989e1773427ad180efff1044e98613dab446587dd52a0deacb4074e01d97cd46c6e633ae1c1011fd2123c766e6fea028799cf82a562bd9d52c544241172f684398ac1b", 0xaa}, {&(0x7f0000002440)="c802b7c29c92c7ddcf8b11133e071ae83e8c0b0827764303ad44356d381633ce1fdd31e1641872e8d6b4c1a974d97d", 0x2f}, {&(0x7f0000002540)="446c9b3779f2a3dc39f3a3541d912b01ca9865e4172a83cda910f6b10dd97377212eb5279c", 0x25}], 0x3, &(0x7f0000002700)=[{0xa0, 0x10f, 0x200, "4f483406ed4a2e47550522989e031e3e239b59c5dc988744d266f33171b6d4a8e54f025a1e1be02c21ad9675e29aea96625352eec0db268e5c70b8e22a2bb0e11b9e6d9613d4e8e338194d9a41821db1ef97a16b16e5263d008bb6ce86b1e26f4d59926a9a72bed62192dc96eaa8a033c9ddaf2fc8c5fb9e765e5ff99cc5ae6fa7bc4a4f0abcb9c9745b54449a"}], 0xa0, 0x800}, 0x1200000}], 0x2, 0x20040000)
sendmsg$IPVS_CMD_DEL_DAEMON(r2, &(0x7f0000000280)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000240)={&(0x7f0000000180)={0x28, 0x0, 0xb30, 0x0, 0x25dfdbfc, {0xa}, [@IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x3ff}, @IPVS_CMD_ATTR_SERVICE={0xc, 0x1, [@IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8}]}]}, 0x28}, 0x1}, 0x0)
ioctl$sock_ifreq(r6, 0x8917, &(0x7f0000000300)={'lo\x00', @ifru_data=&(0x7f00000001c0)="16e667ea25efad95e8e866bb6ef7f6ba94b72b63a28bcb7eafa978bdbe09a4d8"})
getsockopt$inet_int(r4, 0x0, 0x0, &(0x7f0000000600), &(0x7f0000000640)=0x4)
getsockname$unix(r2, &(0x7f0000000680), &(0x7f0000000700)=0x6e)

2018/03/30 13:05:55 executing program 7:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYBLOB="22811e2630b1d0ac"], 0x1)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r1, r2, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = getpgid(0xffffffffffffffff)
syz_open_procfs(r3, &(0x7f00000005c0)='net/ip6_tables_targets\x00')
process_vm_writev(r3, &(0x7f0000000180)=[{&(0x7f0000000140)=""/22, 0x16}], 0x1, &(0x7f00000003c0)=[{&(0x7f0000000740)=""/173, 0xad}], 0x1, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
r4 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
r5 = dup3(0xffffffffffffffff, r0, 0x80000)
setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8)
syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00')
fcntl$setstatus(r1, 0x4, 0x6000)
mq_open(&(0x7f0000000800)=':em1\x00', 0x40, 0x4, &(0x7f0000000840)={0x4000000000000000, 0x0, 0x9, 0x6, 0x0, 0xff, 0x7})
pwritev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000c00)}], 0x1, 0x0)
ioctl$DRM_IOCTL_AGP_ALLOC(r5, 0xc0206434, &(0x7f0000000440)={0x9dca, <r6=>0x0, 0x10002, 0x4})
ioctl$DRM_IOCTL_AGP_BIND(r4, 0x40106436, &(0x7f00000004c0)={r6, 0x676})
ioctl$sock_ifreq(r4, 0x8917, &(0x7f0000000300)={'lo\x00', @ifru_data=&(0x7f00000001c0)="16e667ea25efad95e8e866bb6ef7f6ba94b72b63a28bcb7eafa978bdbe09a4d8"})
getsockopt$inet_int(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000600), &(0x7f0000000640)=0x4)
getsockname$unix(r1, &(0x7f0000000680), &(0x7f0000000700)=0x6e)

2018/03/30 13:05:55 executing program 6:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYBLOB="22811e2630b1d0ac3463"], 0x1)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r1, r2, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = getpgid(0xffffffffffffffff)
syz_open_procfs(r3, &(0x7f00000005c0)='net/ip6_tables_targets\x00')
process_vm_writev(r3, &(0x7f0000000180)=[{&(0x7f0000000140)=""/22, 0x16}], 0x1, &(0x7f00000003c0)=[{&(0x7f0000000740)=""/173, 0xad}], 0x1, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
r4 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
r5 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
r6 = dup3(0xffffffffffffffff, r0, 0x0)
setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8)
syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00')
sendmsg$IPVS_CMD_NEW_DEST(r6, &(0x7f0000000540)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x2000400}, 0xc, &(0x7f0000000500)={&(0x7f0000000240)=ANY=[@ANYPTR], 0x1}, 0x1, 0x0, 0x0, 0x10}, 0x4)
fcntl$setstatus(r1, 0x4, 0x6000)
mq_open(&(0x7f0000000800)=':em1\x00', 0x40, 0x4, &(0x7f0000000840)={0x4000000000000000, 0x0, 0x9, 0x6, 0x0, 0xff, 0x7})
pwritev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000c00)}], 0x1, 0x0)
ioctl$DRM_IOCTL_AGP_ALLOC(r6, 0xc0206434, &(0x7f0000000440)={0x0, <r7=>0x0, 0x10002, 0x4})
ioctl$DRM_IOCTL_AGP_BIND(r5, 0x40106436, &(0x7f00000004c0)={r7, 0x676})
ioctl$sock_ifreq(r5, 0x8917, &(0x7f0000000300)={'lo\x00', @ifru_data=&(0x7f00000001c0)="16e667ea25efad95e8e866bb6ef7f6ba94b72b63a28bcb7eafa978bdbe09a4d8"})
getsockopt$inet_int(r4, 0x0, 0x0, &(0x7f0000000600), &(0x7f0000000640)=0x4)
getsockname$unix(r1, &(0x7f0000000680), &(0x7f0000000700)=0x6e)

[  586.345051] binder: undelivered TRANSACTION_ERROR: 29201
[  586.351187] binder: undelivered TRANSACTION_ERROR: 29201
[  586.357397] binder: undelivered TRANSACTION_ERROR: 29201
[  586.363200] binder: BINDER_SET_CONTEXT_MGR already set
2018/03/30 13:05:55 executing program 5:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYBLOB="00811e2630b1d0ac3463"], 0x1)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r1, r2, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
setns(r2, 0x0)
r3 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/loop-control\x00', 0x0, 0x0)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)
r4 = dup(r3)
getsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffff9c, 0x84, 0x6f, &(0x7f0000000340)={<r5=>0x0, 0x3c, &(0x7f00000005c0)=[@in={0x2, 0x4e23, @local={0xac, 0x14, 0x14, 0xaa}}, @in={0x2, 0x4e24, @broadcast=0xffffffff}, @in6={0xa, 0x0, 0x100000000, @loopback={0x0, 0x1}, 0x323d000000000}]}, &(0x7f0000000640)=0xc)
setsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r4, 0x84, 0xa, &(0x7f0000000680)={0xcff3, 0x80000000, 0x3, 0x0, 0x0, 0x66e, 0x5, 0x0, r5}, 0x20)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)
mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x5c831, 0xffffffffffffffff, 0x0)
openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/mls\x00', 0x0, 0x0)
setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(0xffffffffffffffff, 0x10e, 0x2, &(0x7f0000000340)=0xc, 0x4)
madvise(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x9)
ioctl$KDSKBMODE(0xffffffffffffffff, 0x4b45, &(0x7f0000000080))
getsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(0xffffffffffffffff, 0x84, 0x75, &(0x7f00000000c0)={0x0, 0x6}, &(0x7f0000000100)=0x8)
setsockopt$inet_sctp6_SCTP_AUTH_KEY(0xffffffffffffffff, 0x84, 0x17, &(0x7f0000000500)=ANY=[], 0x0)
ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)
r6 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
ioctl$TIOCLINUX3(r6, 0x541c, &(0x7f0000000040)=0x3)
ioctl$LOOP_CTL_REMOVE(r3, 0x4c81, 0x0)

2018/03/30 13:05:55 executing program 2:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYBLOB="22811e2630b1d0ac3463"], 0x1)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r1, r2, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x0, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = getpgid(0xffffffffffffffff)
syz_open_procfs(r3, &(0x7f00000005c0)='net/ip6_tables_targets\x00')
process_vm_writev(r3, &(0x7f0000000180)=[{&(0x7f0000000140)=""/22, 0x16}], 0x1, &(0x7f00000003c0)=[{&(0x7f0000000740)=""/173, 0xad}], 0x1, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
r4 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
setns(r2, 0x0)
r5 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
r6 = dup3(0xffffffffffffffff, r0, 0x80000)
setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8)
syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00')
sendmsg$IPVS_CMD_NEW_DEST(r6, &(0x7f0000000540)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x2000400}, 0xc, &(0x7f0000000500)={&(0x7f0000000240)=ANY=[@ANYPTR], 0x1}, 0x1, 0x0, 0x0, 0x10}, 0x4)
sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10}, 0xc, &(0x7f0000000340)={&(0x7f0000000480)=ANY=[@ANYBLOB='H\x00\x00\x00'], 0x1}, 0x1}, 0x0)
fcntl$setstatus(r1, 0x4, 0x6000)
mq_open(&(0x7f0000000800)=':em1\x00', 0x40, 0x4, &(0x7f0000000840)={0x0, 0x0, 0x9, 0x6, 0x0, 0xff, 0x7})
pwritev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000c00)}], 0x1, 0x0)
ioctl$DRM_IOCTL_AGP_ALLOC(r6, 0xc0206434, &(0x7f0000000440)={0x9dca, <r7=>0x0, 0x10002, 0x4})
ioctl$DRM_IOCTL_AGP_BIND(r5, 0x40106436, &(0x7f00000004c0)={r7, 0x676})
ioctl$sock_ifreq(r5, 0x8917, &(0x7f0000000300)={'lo\x00', @ifru_data=&(0x7f00000001c0)="16e667ea25efad95e8e866bb6ef7f6ba94b72b63a28bcb7eafa978bdbe09a4d8"})
getsockopt$inet_int(r4, 0x0, 0x0, &(0x7f0000000600), &(0x7f0000000640)=0x4)
getsockname$unix(r1, &(0x7f0000000680), &(0x7f0000000700)=0x6e)

2018/03/30 13:05:55 executing program 6:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYBLOB="22811e2630b1d0ac3463"], 0x1)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r1, r2, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = getpgid(0xffffffffffffffff)
syz_open_procfs(r3, &(0x7f00000005c0)='net/ip6_tables_targets\x00')
process_vm_writev(r3, &(0x7f0000000180)=[{&(0x7f0000000140)=""/22, 0x16}], 0x1, &(0x7f00000003c0)=[{&(0x7f0000000740)=""/173, 0xad}], 0x1, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
r4 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
r5 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
r6 = dup3(0xffffffffffffffff, r0, 0x0)
setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8)
syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00')
sendmsg$IPVS_CMD_NEW_DEST(r6, &(0x7f0000000540)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x2000400}, 0xc, &(0x7f0000000500)={&(0x7f0000000240)=ANY=[@ANYPTR], 0x1}, 0x1, 0x0, 0x0, 0x10}, 0x4)
fcntl$setstatus(r1, 0x4, 0x6000)
mq_open(&(0x7f0000000800)=':em1\x00', 0x40, 0x4, &(0x7f0000000840)={0x4000000000000000, 0x0, 0x9, 0x6, 0x0, 0xff, 0x7})
pwritev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000c00)}], 0x1, 0x0)
ioctl$DRM_IOCTL_AGP_ALLOC(r6, 0xc0206434, &(0x7f0000000440)={0x0, <r7=>0x0, 0x10002, 0x4})
ioctl$DRM_IOCTL_AGP_BIND(r5, 0x40106436, &(0x7f00000004c0)={r7, 0x676})
ioctl$sock_ifreq(r5, 0x8917, &(0x7f0000000300)={'lo\x00', @ifru_data=&(0x7f00000001c0)="16e667ea25efad95e8e866bb6ef7f6ba94b72b63a28bcb7eafa978bdbe09a4d8"})
getsockopt$inet_int(r4, 0x0, 0x0, &(0x7f0000000600), &(0x7f0000000640)=0x4)
getsockname$unix(r1, &(0x7f0000000680), &(0x7f0000000700)=0x6e)

2018/03/30 13:05:55 executing program 1:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYBLOB="22811e2630b1d0ac3463"], 0x1)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r1, r2, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = getpgid(0xffffffffffffffff)
syz_open_procfs(r3, &(0x7f00000005c0)='net/ip6_tables_targets\x00')
process_vm_writev(r3, &(0x7f0000000180), 0x0, &(0x7f00000003c0)=[{&(0x7f0000000740)=""/173, 0xad}], 0x1, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
r4 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
r5 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
r6 = dup3(0xffffffffffffffff, r0, 0x80000)
setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8)
syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00')
fcntl$setstatus(r1, 0x4, 0x6000)
mq_open(&(0x7f0000000800)=':em1\x00', 0x40, 0x4, &(0x7f0000000840)={0x4000000000000000, 0x0, 0x9, 0x6, 0x0, 0xff, 0x7})
pwritev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000c00)}], 0x1, 0x0)
ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffffff, 0xc0206434, &(0x7f0000000440)={0x9dca, <r7=>0x0, 0x10002, 0x4})
ioctl$DRM_IOCTL_AGP_BIND(r5, 0x40106436, &(0x7f00000004c0)={r7, 0x676})
ioctl$sock_ifreq(r5, 0x8917, &(0x7f0000000300)={'lo\x00', @ifru_data=&(0x7f00000001c0)="16e667ea25efad95e8e866bb6ef7f6ba94b72b63a28bcb7eafa978bdbe09a4d8"})
getsockopt$inet_int(r4, 0x0, 0x0, &(0x7f0000000600), &(0x7f0000000640)=0x4)
getsockname$unix(r1, &(0x7f0000000680), &(0x7f0000000700)=0x6e)

** 19 printk messages dropped ** [  586.421953] binder: 29547:29551 transaction failed 29201/-22, size 40-16 line 3197
2018/03/30 13:05:55 executing program 7:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYBLOB="22811e2630b1d0ac"], 0x1)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r1, r2, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = getpgid(0xffffffffffffffff)
syz_open_procfs(r3, &(0x7f00000005c0)='net/ip6_tables_targets\x00')
process_vm_writev(r3, &(0x7f0000000180)=[{&(0x7f0000000140)=""/22, 0x16}], 0x1, &(0x7f00000003c0)=[{&(0x7f0000000740)=""/173, 0xad}], 0x1, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
r4 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
r5 = dup3(0xffffffffffffffff, r0, 0x80000)
setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8)
syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00')
fcntl$setstatus(r1, 0x4, 0x6000)
mq_open(&(0x7f0000000800)=':em1\x00', 0x40, 0x4, &(0x7f0000000840)={0x4000000000000000, 0x0, 0x9, 0x6, 0x0, 0xff, 0x7})
pwritev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000c00)}], 0x1, 0x0)
ioctl$DRM_IOCTL_AGP_ALLOC(r5, 0xc0206434, &(0x7f0000000440)={0x9dca, <r6=>0x0, 0x10002, 0x4})
ioctl$DRM_IOCTL_AGP_BIND(r4, 0x40106436, &(0x7f00000004c0)={r6, 0x676})
ioctl$sock_ifreq(r4, 0x8917, &(0x7f0000000300)={'lo\x00', @ifru_data=&(0x7f00000001c0)="16e667ea25efad95e8e866bb6ef7f6ba94b72b63a28bcb7eafa978bdbe09a4d8"})
getsockopt$inet_int(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000600), &(0x7f0000000640)=0x4)
getsockname$unix(r1, &(0x7f0000000680), &(0x7f0000000700)=0x6e)

2018/03/30 13:05:55 executing program 4:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
r1 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000002880)='/selinux/avc/cache_stats\x00', 0x0, 0x0)
ioctl$EVIOCSABS20(r1, 0x401845e0, &(0x7f00000028c0)={0x1000, 0x7fff, 0x1ff, 0xffffffff, 0x7, 0x40})
fchdir(r0)
r2 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(r2, &(0x7f0000000080)=ANY=[@ANYBLOB="00811e2630b1d0ac3463"], 0x1)
setsockopt$packet_add_memb(r2, 0x107, 0x1, &(0x7f0000002900)={0x0, 0x1, 0x6}, 0x10)
r3 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r2, r3, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r3, 0x0)
inotify_init1(0x800)
ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
r4 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
setns(r3, 0x8000000)
r5 = socket$nl_xfrm(0x10, 0x3, 0x6)
r6 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
dup3(r3, r0, 0x80000)
setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8)
r7 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00')
sendmsg$IPVS_CMD_NEW_DEST(0xffffffffffffffff, &(0x7f0000000540)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x2000400}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)=ANY=[@ANYBLOB=',\x00\x00\x00'], 0x1}, 0x1, 0x0, 0x0, 0x10}, 0x4)
sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10}, 0xc, &(0x7f0000000340)={&(0x7f0000000480)=ANY=[@ANYBLOB='H\x00\x00\x00'], 0x1}, 0x1}, 0x0)
sendmsg$IPVS_CMD_GET_DEST(r2, &(0x7f0000000880)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f00000005c0)={&(0x7f0000000740)={0x138, r7, 0x208, 0x70bd2b, 0x25dfdbfb, {0x8}, [@IPVS_CMD_ATTR_SERVICE={0x28, 0x1, [@IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@multicast2=0xe0000002}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x3}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x7fff}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x8c6}, @IPVS_CMD_ATTR_DAEMON={0x50, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @remote={0xac, 0x14, 0x14, 0xbb}}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x400}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x10001}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'syz_tun\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x6}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x2}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x30, 0x2, [@IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x2}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv6=@ipv4={[], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0xffffffff}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0xafa6}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x1}, @IPVS_CMD_ATTR_DEST={0x6c, 0x2, [@IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x7}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv4=@remote={0xac, 0x14, 0x14, 0xbb}}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x8}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x1}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x5}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x3}, @IPVS_DEST_ATTR_PORT={0x8, 0x2, 0x4e22}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv6=@mcast2={0xff, 0x2, [], 0x1}}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x10000}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x701a3921}]}]}, 0x138}, 0x1, 0x0, 0x0, 0x90}, 0x4)
fcntl$setstatus(r2, 0x4, 0x6000)
setsockopt$sock_linger(r4, 0x1, 0xd, &(0x7f00000008c0)={0x1, 0x2}, 0x8)
pwritev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000c00)="cfb93447d6feaef9f73c0561e075a8295d43017ab1a157786dcda36c5eec92a4306f284fa7e3ed364cc2da5c08cf7e4030d394520e123eee6d9ab275c91c174b1364fc943b49faefe12f605b5ce6c1400a91210c00477f900aff390901bf594c18557cb38a7d57ac8ded098b96b9dfc125e3bdc9305193f4cd256068baca5208160d820b9e7a043666ba4801cf6d557fc0f97f35c13ec6c0d1fe97ce1af1c17078ef47ab955200836671e402717481d14936b09828fd6f55fda2f11eb4c61b480e941133c0a4c5ec54033d0d174742191754ffe28b093596286a78ea01078337ada8585aa98dcc1143689002e31ccc5b9f5cfd2bbce5683a0f91b395391a60ba8e8f4d3c10c82c71caa74c44c8b0f3e42f1fc264497d5b9dabf309bad7bd", 0x11e}], 0x1, 0x0)
sendmmsg(r5, &(0x7f00000027c0)=[{{0x0, 0x0, &(0x7f0000000a00)=[{&(0x7f0000000900)="913da470640ae70fe168a71ad316e5525ce43547f28d8c56cb5cd246950c2d44a514698b3aebf2b60d933814378b0b9b750dec28bdbeedda6c8af5f3418ff8c43701e5dea492428ecdcf0e8c2a19f60e388b478179256834360c5ee359dbe4fabee36883a8314f0ea64dea3a732dffbe26a02e8327a0f7174a6990389e5b608d5300c271f26b3b37cc88e720a477e5f1aa2751af90d35d72606ac73f72dab39aad418a6335d44c785ba83edc9619a3221ae39ef2fed1657e426fa293a739cd779a6c645b3d29bb184041476e8e6e737e5fa1c4312360", 0xd6}], 0x1, 0x0, 0x0, 0x8000}, 0x3f}, {{&(0x7f0000002240)=@nl=@unspec, 0x80, &(0x7f0000002680)=[{&(0x7f00000022c0)="756a6b1895d55b0b292a3985cd35f28cfa8d5ab20a3448791e47ec9e971be82f993ebd55ec843a76ccd644a71222e57119e6f8866f59ba0b89c4cf71a9ce853f72bd99ac9097baf924ea3e3fbceaf0a0df15deb45ae757832bec56c67c0ad44e0ea5fcbc12f898989e1773427ad180efff1044e98613dab446587dd52a0deacb4074e01d97cd46c6e633ae1c1011fd2123c766e6fea028799cf82a562bd9d52c544241172f684398ac1b", 0xaa}, {&(0x7f0000002440)="c802b7c29c92c7ddcf8b11133e071ae83e8c0b0827764303ad44356d381633ce1fdd31e1641872e8d6b4c1a974d97d", 0x2f}, {&(0x7f0000002540)="446c9b3779f2a3dc39f3a3541d912b01ca9865e4172a83cda910f6b10dd97377212eb5279c", 0x25}], 0x3, &(0x7f0000002700)=[{0xa0, 0x10f, 0x200, "4f483406ed4a2e47550522989e031e3e239b59c5dc988744d266f33171b6d4a8e54f025a1e1be02c21ad9675e29aea96625352eec0db268e5c70b8e22a2bb0e11b9e6d9613d4e8e338194d9a41821db1ef97a16b16e5263d008bb6ce86b1e26f4d59926a9a72bed62192dc96eaa8a033c9ddaf2fc8c5fb9e765e5ff99cc5ae6fa7bc4a4f0abcb9c9745b54449a"}], 0xa0, 0x800}, 0x1200000}], 0x2, 0x20040000)
sendmsg$IPVS_CMD_DEL_DAEMON(r2, &(0x7f0000000280)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000240)={&(0x7f0000000180)={0x28, 0x0, 0xb30, 0x0, 0x25dfdbfc, {0xa}, [@IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x3ff}, @IPVS_CMD_ATTR_SERVICE={0xc, 0x1, [@IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8}]}]}, 0x28}, 0x1}, 0x0)
ioctl$sock_ifreq(r6, 0x8917, &(0x7f0000000300)={'lo\x00', @ifru_data=&(0x7f00000001c0)="16e667ea25efad95e8e866bb6ef7f6ba94b72b63a28bcb7eafa978bdbe09a4d8"})
getsockopt$inet_int(r4, 0x0, 0x0, &(0x7f0000000600), &(0x7f0000000640)=0x4)
getsockname$unix(r2, &(0x7f0000000680), &(0x7f0000000700)=0x6e)

2018/03/30 13:05:55 executing program 2:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYBLOB="22811e2630b1d0ac3463"], 0x1)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r1, r2, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = getpgid(0xffffffffffffffff)
syz_open_procfs(r3, &(0x7f00000005c0)='net/ip6_tables_targets\x00')
process_vm_writev(r3, &(0x7f0000000180)=[{&(0x7f0000000140)=""/22, 0x16}], 0x1, &(0x7f00000003c0)=[{&(0x7f0000000740)=""/173, 0xad}], 0x1, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
r4 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
setns(r2, 0x0)
r5 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
r6 = dup3(0xffffffffffffffff, r0, 0x80000)
setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8)
syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00')
sendmsg$IPVS_CMD_NEW_DEST(r6, &(0x7f0000000540)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x2000400}, 0xc, &(0x7f0000000500)={&(0x7f0000000240)=ANY=[@ANYPTR], 0x1}, 0x1, 0x0, 0x0, 0x10}, 0x4)
sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10}, 0xc, &(0x7f0000000340)={&(0x7f0000000480)=ANY=[@ANYBLOB='H\x00\x00\x00'], 0x1}, 0x1}, 0x0)
fcntl$setstatus(r1, 0x4, 0x6000)
mq_open(&(0x7f0000000800)=':em1\x00', 0x40, 0x4, &(0x7f0000000840)={0x0, 0x0, 0x9, 0x6, 0x0, 0xff, 0x7})
pwritev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000c00)}], 0x1, 0x0)
ioctl$DRM_IOCTL_AGP_ALLOC(r6, 0xc0206434, &(0x7f0000000440)={0x9dca, <r7=>0x0, 0x10002, 0x4})
ioctl$DRM_IOCTL_AGP_BIND(r5, 0x40106436, &(0x7f00000004c0)={r7, 0x676})
ioctl$sock_ifreq(r5, 0x8917, &(0x7f0000000300)={'lo\x00', @ifru_data=&(0x7f00000001c0)="16e667ea25efad95e8e866bb6ef7f6ba94b72b63a28bcb7eafa978bdbe09a4d8"})
getsockopt$inet_int(r4, 0x0, 0x0, &(0x7f0000000600), &(0x7f0000000640)=0x4)
getsockname$unix(r1, &(0x7f0000000680), &(0x7f0000000700)=0x6e)

2018/03/30 13:05:55 executing program 5:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYBLOB="00811e2630b1d0ac3463"], 0x1)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r1, r2, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
setns(r2, 0x0)
r3 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/loop-control\x00', 0x0, 0x0)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)
r4 = dup(r3)
getsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffff9c, 0x84, 0x6f, &(0x7f0000000340)={<r5=>0x0, 0x3c, &(0x7f00000005c0)=[@in={0x2, 0x4e23, @local={0xac, 0x14, 0x14, 0xaa}}, @in={0x2, 0x4e24, @broadcast=0xffffffff}, @in6={0xa, 0x0, 0x100000000, @loopback={0x0, 0x1}, 0x323d000000000}]}, &(0x7f0000000640)=0xc)
setsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r4, 0x84, 0xa, &(0x7f0000000680)={0xcff3, 0x80000000, 0x3, 0x0, 0x0, 0x66e, 0x5, 0x0, r5}, 0x20)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)
mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x5c831, 0xffffffffffffffff, 0x0)
openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/mls\x00', 0x0, 0x0)
setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(0xffffffffffffffff, 0x10e, 0x2, &(0x7f0000000340)=0xc, 0x4)
madvise(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x9)
ioctl$KDSKBMODE(0xffffffffffffffff, 0x4b45, &(0x7f0000000080))
getsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(0xffffffffffffffff, 0x84, 0x75, &(0x7f00000000c0)={0x0, 0x6}, &(0x7f0000000100)=0x8)
setsockopt$inet_sctp6_SCTP_AUTH_KEY(0xffffffffffffffff, 0x84, 0x17, &(0x7f0000000500)=ANY=[], 0x0)
ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)
r6 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
ioctl$TIOCLINUX3(r6, 0x541c, &(0x7f0000000040)=0x3)
ioctl$LOOP_CTL_REMOVE(r3, 0x4c81, 0x0)

2018/03/30 13:05:55 executing program 3:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[], 0x0)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r1, r2, 0x1, 0x0)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
setns(r2, 0x0)
r3 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/loop-control\x00', 0x0, 0x0)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)
r4 = dup(r3)
getsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffff9c, 0x84, 0x6f, &(0x7f0000000340)={<r5=>0x0, 0x3c, &(0x7f00000005c0)=[@in={0x2, 0x4e23, @local={0xac, 0x14, 0x14, 0xaa}}, @in={0x2, 0x4e24, @broadcast=0xffffffff}, @in6={0xa, 0x0, 0x100000000, @loopback={0x0, 0x1}, 0x323d000000000}]}, &(0x7f0000000640)=0xc)
setsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r4, 0x84, 0xa, &(0x7f0000000680)={0xcff3, 0x80000000, 0x3, 0x0, 0x0, 0x66e, 0x5, 0x1, r5}, 0x20)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)
mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x5c831, 0xffffffffffffffff, 0x0)
openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/mls\x00', 0x0, 0x0)
setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(0xffffffffffffffff, 0x10e, 0x2, &(0x7f0000000340)=0xc, 0x4)
madvise(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x9)
r6 = syz_open_dev$usbmon(&(0x7f0000000040)='/dev/usbmon#\x00', 0x0, 0x80000)
ioctl$KDSKBMODE(0xffffffffffffffff, 0x4b45, &(0x7f0000000080))
getsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r6, 0x84, 0x75, &(0x7f00000000c0)={0x0, 0x6}, &(0x7f0000000100)=0x8)
setsockopt$inet_sctp6_SCTP_AUTH_KEY(r6, 0x84, 0x17, &(0x7f0000000500)=ANY=[], 0x0)
ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82)
ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82)
r7 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
ioctl$TIOCLINUX3(r7, 0x541c, &(0x7f0000000040)=0x3)
ioctl$LOOP_CTL_REMOVE(r3, 0x4c81, 0x0)

2018/03/30 13:05:55 executing program 0:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYBLOB="22811e2630b1d0ac3463"], 0x1)
r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(0xffffffffffffffff, r1, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
r2 = getpgid(0xffffffffffffffff)
syz_open_procfs(r2, &(0x7f00000005c0)='net/ip6_tables_targets\x00')
process_vm_writev(r2, &(0x7f0000000180)=[{&(0x7f0000000140)=""/22, 0x16}], 0x1, &(0x7f00000003c0)=[{&(0x7f0000000740)=""/173, 0xad}], 0x1, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
r3 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
setns(r1, 0x0)
r4 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
r5 = dup3(0xffffffffffffffff, r0, 0x80000)
setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8)
syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00')
sendmsg$IPVS_CMD_NEW_DEST(r5, &(0x7f0000000540)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x2000400}, 0xc, &(0x7f0000000500)={&(0x7f0000000240)=ANY=[@ANYPTR], 0x1}, 0x1, 0x0, 0x0, 0x10}, 0x0)
sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10}, 0xc, &(0x7f0000000340)={&(0x7f0000000480)=ANY=[@ANYBLOB='H\x00\x00\x00'], 0x1}, 0x1}, 0x0)
fcntl$setstatus(0xffffffffffffffff, 0x4, 0x6000)
mq_open(&(0x7f0000000800)=':em1\x00', 0x40, 0x4, &(0x7f0000000840)={0x4000000000000000, 0x0, 0x9, 0x6, 0x0, 0xff, 0x7})
pwritev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000c00)}], 0x1, 0x0)
ioctl$DRM_IOCTL_AGP_ALLOC(r5, 0xc0206434, &(0x7f0000000440)={0x9dca, <r6=>0x0, 0x10002, 0x4})
ioctl$DRM_IOCTL_AGP_BIND(r4, 0x40106436, &(0x7f00000004c0)={r6, 0x676})
ioctl$sock_ifreq(r4, 0x8917, &(0x7f0000000300)={'lo\x00', @ifru_data=&(0x7f00000001c0)="16e667ea25efad95e8e866bb6ef7f6ba94b72b63a28bcb7eafa978bdbe09a4d8"})
getsockopt$inet_int(r3, 0x0, 0x0, &(0x7f0000000600), &(0x7f0000000640)=0x4)
getsockname$unix(0xffffffffffffffff, &(0x7f0000000680), &(0x7f0000000700)=0x6e)

** 12 printk messages dropped ** [  586.453495] binder: 29552:29559 transaction failed 29201/-22, size 40-16 line 3197
2018/03/30 13:05:55 executing program 4:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
r1 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000002880)='/selinux/avc/cache_stats\x00', 0x0, 0x0)
ioctl$EVIOCSABS20(r1, 0x401845e0, &(0x7f00000028c0)={0x1000, 0x7fff, 0x1ff, 0xffffffff, 0x7, 0x40})
fchdir(r0)
r2 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(r2, &(0x7f0000000080)=ANY=[@ANYBLOB="00811e2630b1d0ac3463"], 0x1)
setsockopt$packet_add_memb(r2, 0x107, 0x1, &(0x7f0000002900)={0x0, 0x1, 0x6}, 0x10)
r3 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r2, r3, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r3, 0x0)
inotify_init1(0x800)
ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
r4 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
setns(r3, 0x8000000)
r5 = socket$nl_xfrm(0x10, 0x3, 0x6)
r6 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
dup3(r3, r0, 0x80000)
setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8)
r7 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00')
sendmsg$IPVS_CMD_NEW_DEST(0xffffffffffffffff, &(0x7f0000000540)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x2000400}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)=ANY=[@ANYBLOB=',\x00\x00\x00'], 0x1}, 0x1, 0x0, 0x0, 0x10}, 0x4)
sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10}, 0xc, &(0x7f0000000340)={&(0x7f0000000480)=ANY=[@ANYBLOB='H\x00\x00\x00'], 0x1}, 0x1}, 0x0)
sendmsg$IPVS_CMD_GET_DEST(r2, &(0x7f0000000880)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f00000005c0)={&(0x7f0000000740)={0x138, r7, 0x208, 0x70bd2b, 0x25dfdbfb, {0x8}, [@IPVS_CMD_ATTR_SERVICE={0x28, 0x1, [@IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@multicast2=0xe0000002}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x3}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x7fff}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x8c6}, @IPVS_CMD_ATTR_DAEMON={0x50, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @remote={0xac, 0x14, 0x14, 0xbb}}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x400}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x10001}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'syz_tun\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x6}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x2}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x30, 0x2, [@IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x2}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv6=@ipv4={[], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0xffffffff}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0xafa6}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x1}, @IPVS_CMD_ATTR_DEST={0x6c, 0x2, [@IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x7}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv4=@remote={0xac, 0x14, 0x14, 0xbb}}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x8}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x1}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x5}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x3}, @IPVS_DEST_ATTR_PORT={0x8, 0x2, 0x4e22}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv6=@mcast2={0xff, 0x2, [], 0x1}}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x10000}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x701a3921}]}]}, 0x138}, 0x1, 0x0, 0x0, 0x90}, 0x4)
fcntl$setstatus(r2, 0x4, 0x6000)
setsockopt$sock_linger(r4, 0x1, 0xd, &(0x7f00000008c0)={0x1, 0x2}, 0x8)
pwritev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000c00)="cfb93447d6feaef9f73c0561e075a8295d43017ab1a157786dcda36c5eec92a4306f284fa7e3ed364cc2da5c08cf7e4030d394520e123eee6d9ab275c91c174b1364fc943b49faefe12f605b5ce6c1400a91210c00477f900aff390901bf594c18557cb38a7d57ac8ded098b96b9dfc125e3bdc9305193f4cd256068baca5208160d820b9e7a043666ba4801cf6d557fc0f97f35c13ec6c0d1fe97ce1af1c17078ef47ab955200836671e402717481d14936b09828fd6f55fda2f11eb4c61b480e941133c0a4c5ec54033d0d174742191754ffe28b093596286a78ea01078337ada8585aa98dcc1143689002e31ccc5b9f5cfd2bbce5683a0f91b395391a60ba8e8f4d3c10c82c71caa74c44c8b0f3e42f1fc264497d5b9dabf309bad7bd", 0x11e}], 0x1, 0x0)
sendmmsg(r5, &(0x7f00000027c0)=[{{0x0, 0x0, &(0x7f0000000a00)=[{&(0x7f0000000900)="913da470640ae70fe168a71ad316e5525ce43547f28d8c56cb5cd246950c2d44a514698b3aebf2b60d933814378b0b9b750dec28bdbeedda6c8af5f3418ff8c43701e5dea492428ecdcf0e8c2a19f60e388b478179256834360c5ee359dbe4fabee36883a8314f0ea64dea3a732dffbe26a02e8327a0f7174a6990389e5b608d5300c271f26b3b37cc88e720a477e5f1aa2751af90d35d72606ac73f72dab39aad418a6335d44c785ba83edc9619a3221ae39ef2fed1657e426fa293a739cd779a6c645b3d29bb184041476e8e6e737e5fa1c4312360", 0xd6}], 0x1, 0x0, 0x0, 0x8000}, 0x3f}, {{&(0x7f0000002240)=@nl=@unspec, 0x80, &(0x7f0000002680)=[{&(0x7f00000022c0)="756a6b1895d55b0b292a3985cd35f28cfa8d5ab20a3448791e47ec9e971be82f993ebd55ec843a76ccd644a71222e57119e6f8866f59ba0b89c4cf71a9ce853f72bd99ac9097baf924ea3e3fbceaf0a0df15deb45ae757832bec56c67c0ad44e0ea5fcbc12f898989e1773427ad180efff1044e98613dab446587dd52a0deacb4074e01d97cd46c6e633ae1c1011fd2123c766e6fea028799cf82a562bd9d52c544241172f684398ac1b", 0xaa}, {&(0x7f0000002440)="c802b7c29c92c7ddcf8b11133e071ae83e8c0b0827764303ad44356d381633ce1fdd31e1641872e8d6b4c1a974d97d", 0x2f}, {&(0x7f0000002540)="446c9b3779f2a3dc39f3a3541d912b01ca9865e4172a83cda910f6b10dd97377212eb5279c", 0x25}], 0x3, &(0x7f0000002700)=[{0xa0, 0x10f, 0x200, "4f483406ed4a2e47550522989e031e3e239b59c5dc988744d266f33171b6d4a8e54f025a1e1be02c21ad9675e29aea96625352eec0db268e5c70b8e22a2bb0e11b9e6d9613d4e8e338194d9a41821db1ef97a16b16e5263d008bb6ce86b1e26f4d59926a9a72bed62192dc96eaa8a033c9ddaf2fc8c5fb9e765e5ff99cc5ae6fa7bc4a4f0abcb9c9745b54449ab3"}], 0xa0, 0x800}, 0x1200000}], 0x2, 0x20040000)
sendmsg$IPVS_CMD_DEL_DAEMON(r2, &(0x7f0000000280)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000240)={&(0x7f0000000180)={0x28, 0x0, 0xb30, 0x0, 0x25dfdbfc, {0xa}, [@IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x3ff}, @IPVS_CMD_ATTR_SERVICE={0xc, 0x1, [@IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8}]}]}, 0x28}, 0x1}, 0x0)
ioctl$sock_ifreq(r6, 0x8917, &(0x7f0000000300)={'lo\x00', @ifru_data=&(0x7f00000001c0)="16e667ea25efad95e8e866bb6ef7f6ba94b72b63a28bcb7eafa978bdbe09a4d8"})
getsockopt$inet_int(r4, 0x0, 0x0, &(0x7f0000000600), &(0x7f0000000640)=0x4)
getsockname$unix(r2, &(0x7f0000000680), &(0x7f0000000700)=0x6e)

2018/03/30 13:05:55 executing program 2:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYBLOB="22811e2630b1d0ac3463"], 0x1)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r1, r2, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = getpgid(0xffffffffffffffff)
syz_open_procfs(r3, &(0x7f00000005c0)='net/ip6_tables_targets\x00')
process_vm_writev(r3, &(0x7f0000000180)=[{&(0x7f0000000140)=""/22, 0x16}], 0x1, &(0x7f00000003c0)=[{&(0x7f0000000740)=""/173, 0xad}], 0x1, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
r4 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
setns(r2, 0x0)
r5 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
r6 = dup3(0xffffffffffffffff, r0, 0x80000)
setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8)
syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00')
sendmsg$IPVS_CMD_NEW_DEST(r6, &(0x7f0000000540)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x2000400}, 0xc, &(0x7f0000000500)={&(0x7f0000000240)=ANY=[@ANYPTR], 0x1}, 0x1, 0x0, 0x0, 0x10}, 0x4)
sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10}, 0xc, &(0x7f0000000340)={&(0x7f0000000480)=ANY=[@ANYBLOB='H\x00\x00\x00'], 0x1}, 0x1}, 0x0)
fcntl$setstatus(r1, 0x4, 0x6000)
mq_open(&(0x7f0000000800)=':em1\x00', 0x40, 0x4, &(0x7f0000000840)={0x0, 0x0, 0x9, 0x6, 0x0, 0xff, 0x7})
pwritev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000c00)}], 0x1, 0x0)
ioctl$DRM_IOCTL_AGP_ALLOC(r6, 0xc0206434, &(0x7f0000000440)={0x9dca, <r7=>0x0, 0x10002, 0x4})
ioctl$DRM_IOCTL_AGP_BIND(r5, 0x40106436, &(0x7f00000004c0)={r7, 0x676})
ioctl$sock_ifreq(r5, 0x8917, &(0x7f0000000300)={'lo\x00', @ifru_data=&(0x7f00000001c0)="16e667ea25efad95e8e866bb6ef7f6ba94b72b63a28bcb7eafa978bdbe09a4d8"})
getsockopt$inet_int(r4, 0x0, 0x0, &(0x7f0000000600), &(0x7f0000000640)=0x4)
getsockname$unix(r1, &(0x7f0000000680), &(0x7f0000000700)=0x6e)

** 32 printk messages dropped ** [  586.569023] binder: undelivered TRANSACTION_ERROR: 29201
** 11 printk messages dropped ** [  586.633009] binder: undelivered TRANSACTION_ERROR: 29201
2018/03/30 13:05:55 executing program 6:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYBLOB="22811e2630b1d0ac3463"], 0x1)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r1, r2, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = getpgid(0xffffffffffffffff)
syz_open_procfs(r3, &(0x7f00000005c0)='net/ip6_tables_targets\x00')
process_vm_writev(r3, &(0x7f0000000180)=[{&(0x7f0000000140)=""/22, 0x16}], 0x1, &(0x7f00000003c0)=[{&(0x7f0000000740)=""/173, 0xad}], 0x1, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
r4 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
r5 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
r6 = dup3(0xffffffffffffffff, r0, 0x0)
setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8)
syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00')
sendmsg$IPVS_CMD_NEW_DEST(r6, &(0x7f0000000540)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x2000400}, 0xc, &(0x7f0000000500)={&(0x7f0000000240)=ANY=[@ANYPTR], 0x1}, 0x1, 0x0, 0x0, 0x10}, 0x4)
fcntl$setstatus(r1, 0x4, 0x6000)
mq_open(&(0x7f0000000800)=':em1\x00', 0x40, 0x4, &(0x7f0000000840)={0x4000000000000000, 0x0, 0x9, 0x6, 0x0, 0xff, 0x7})
pwritev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000c00)}], 0x1, 0x0)
ioctl$DRM_IOCTL_AGP_ALLOC(r6, 0xc0206434, &(0x7f0000000440)={0x0, <r7=>0x0, 0x10002, 0x4})
ioctl$DRM_IOCTL_AGP_BIND(r5, 0x40106436, &(0x7f00000004c0)={r7, 0x676})
ioctl$sock_ifreq(r5, 0x8917, &(0x7f0000000300)={'lo\x00', @ifru_data=&(0x7f00000001c0)="16e667ea25efad95e8e866bb6ef7f6ba94b72b63a28bcb7eafa978bdbe09a4d8"})
getsockopt$inet_int(r4, 0x0, 0x0, &(0x7f0000000600), &(0x7f0000000640)=0x4)
getsockname$unix(r1, &(0x7f0000000680), &(0x7f0000000700)=0x6e)

2018/03/30 13:05:55 executing program 2:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYBLOB="22811e2630b1d0ac3463"], 0x1)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r1, r2, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = getpgid(0xffffffffffffffff)
syz_open_procfs(r3, &(0x7f00000005c0)='net/ip6_tables_targets\x00')
process_vm_writev(r3, &(0x7f0000000180)=[{&(0x7f0000000140)=""/22, 0x16}], 0x1, &(0x7f00000003c0)=[{&(0x7f0000000740)=""/173, 0xad}], 0x1, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
r4 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
setns(r2, 0x0)
r5 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
r6 = dup3(0xffffffffffffffff, r0, 0x80000)
setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8)
syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00')
sendmsg$IPVS_CMD_NEW_DEST(r6, &(0x7f0000000540)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x2000400}, 0xc, &(0x7f0000000500)={&(0x7f0000000240)=ANY=[@ANYPTR], 0x1}, 0x1, 0x0, 0x0, 0x10}, 0x4)
sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10}, 0xc, &(0x7f0000000340)={&(0x7f0000000480)=ANY=[@ANYBLOB='H\x00\x00\x00'], 0x1}, 0x1}, 0x0)
fcntl$setstatus(r1, 0x4, 0x6000)
mq_open(&(0x7f0000000800)=':em1\x00', 0x40, 0x4, &(0x7f0000000840)={0x0, 0x0, 0x9, 0x6, 0x0, 0xff, 0x7})
pwritev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000c00)}], 0x1, 0x0)
ioctl$DRM_IOCTL_AGP_ALLOC(r6, 0xc0206434, &(0x7f0000000440)={0x9dca, <r7=>0x0, 0x10002, 0x4})
ioctl$DRM_IOCTL_AGP_BIND(r5, 0x40106436, &(0x7f00000004c0)={r7, 0x676})
ioctl$sock_ifreq(r5, 0x8917, &(0x7f0000000300)={'lo\x00', @ifru_data=&(0x7f00000001c0)="16e667ea25efad95e8e866bb6ef7f6ba94b72b63a28bcb7eafa978bdbe09a4d8"})
getsockopt$inet_int(r4, 0x0, 0x0, &(0x7f0000000600), &(0x7f0000000640)=0x4)
getsockname$unix(r1, &(0x7f0000000680), &(0x7f0000000700)=0x6e)

2018/03/30 13:05:55 executing program 1:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYBLOB="22811e2630b1d0ac3463"], 0x1)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r1, r2, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = getpgid(0xffffffffffffffff)
syz_open_procfs(r3, &(0x7f00000005c0)='net/ip6_tables_targets\x00')
process_vm_writev(r3, &(0x7f0000000180), 0x0, &(0x7f00000003c0)=[{&(0x7f0000000740)=""/173, 0xad}], 0x1, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
r4 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
r5 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
r6 = dup3(0xffffffffffffffff, r0, 0x80000)
setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8)
syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00')
fcntl$setstatus(r1, 0x4, 0x6000)
mq_open(&(0x7f0000000800)=':em1\x00', 0x40, 0x4, &(0x7f0000000840)={0x4000000000000000, 0x0, 0x9, 0x6, 0x0, 0xff, 0x7})
pwritev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000c00)}], 0x1, 0x0)
ioctl$DRM_IOCTL_AGP_ALLOC(r6, 0xc0206434, &(0x7f0000000440)={0x0, <r7=>0x0, 0x10002, 0x4})
ioctl$DRM_IOCTL_AGP_BIND(r5, 0x40106436, &(0x7f00000004c0)={r7, 0x676})
ioctl$sock_ifreq(r5, 0x8917, &(0x7f0000000300)={'lo\x00', @ifru_data=&(0x7f00000001c0)="16e667ea25efad95e8e866bb6ef7f6ba94b72b63a28bcb7eafa978bdbe09a4d8"})
getsockopt$inet_int(r4, 0x0, 0x0, &(0x7f0000000600), &(0x7f0000000640)=0x4)
getsockname$unix(r1, &(0x7f0000000680), &(0x7f0000000700)=0x6e)

2018/03/30 13:05:55 executing program 5:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYBLOB="00811e2630b1d0ac3463"], 0x1)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r1, r2, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
setns(r2, 0x0)
r3 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/loop-control\x00', 0x0, 0x0)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)
r4 = dup(r3)
getsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffff9c, 0x84, 0x6f, &(0x7f0000000340)={<r5=>0x0, 0x3c, &(0x7f00000005c0)=[@in={0x2, 0x4e23, @local={0xac, 0x14, 0x14, 0xaa}}, @in={0x2, 0x4e24, @broadcast=0xffffffff}, @in6={0xa, 0x0, 0x100000000, @loopback={0x0, 0x1}, 0x323d000000000}]}, &(0x7f0000000640)=0xc)
setsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r4, 0x84, 0xa, &(0x7f0000000680)={0xcff3, 0x80000000, 0x3, 0x0, 0x0, 0x66e, 0x5, 0x0, r5}, 0x20)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)
mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x5c831, 0xffffffffffffffff, 0x0)
openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/mls\x00', 0x0, 0x0)
setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(0xffffffffffffffff, 0x10e, 0x2, &(0x7f0000000340)=0xc, 0x4)
madvise(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x9)
ioctl$KDSKBMODE(0xffffffffffffffff, 0x4b45, &(0x7f0000000080))
getsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(0xffffffffffffffff, 0x84, 0x75, &(0x7f00000000c0)={0x0, 0x6}, &(0x7f0000000100)=0x8)
setsockopt$inet_sctp6_SCTP_AUTH_KEY(0xffffffffffffffff, 0x84, 0x17, &(0x7f0000000500)=ANY=[], 0x0)
ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)
r6 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
ioctl$TIOCLINUX3(r6, 0x541c, &(0x7f0000000040)=0x3)
ioctl$LOOP_CTL_REMOVE(r3, 0x4c81, 0x0)

2018/03/30 13:05:55 executing program 4:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
r1 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000002880)='/selinux/avc/cache_stats\x00', 0x0, 0x0)
ioctl$EVIOCSABS20(r1, 0x401845e0, &(0x7f00000028c0)={0x1000, 0x7fff, 0x1ff, 0xffffffff, 0x7, 0x40})
fchdir(r0)
r2 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(r2, &(0x7f0000000080)=ANY=[@ANYBLOB="00811e2630b1d0ac3463"], 0x1)
setsockopt$packet_add_memb(r2, 0x107, 0x1, &(0x7f0000002900)={0x0, 0x1, 0x6}, 0x10)
r3 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r2, r3, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r3, 0x0)
inotify_init1(0x800)
ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
r4 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
setns(r3, 0x8000000)
r5 = socket$nl_xfrm(0x10, 0x3, 0x6)
r6 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
dup3(r3, r0, 0x80000)
setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8)
r7 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00')
sendmsg$IPVS_CMD_NEW_DEST(0xffffffffffffffff, &(0x7f0000000540)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x2000400}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)=ANY=[@ANYBLOB=',\x00\x00\x00'], 0x1}, 0x1, 0x0, 0x0, 0x10}, 0x4)
sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10}, 0xc, &(0x7f0000000340)={&(0x7f0000000480)=ANY=[@ANYBLOB='H\x00\x00\x00'], 0x1}, 0x1}, 0x0)
sendmsg$IPVS_CMD_GET_DEST(r2, &(0x7f0000000880)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f00000005c0)={&(0x7f0000000740)={0x138, r7, 0x208, 0x70bd2b, 0x25dfdbfb, {0x8}, [@IPVS_CMD_ATTR_SERVICE={0x28, 0x1, [@IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@multicast2=0xe0000002}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x3}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x7fff}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x8c6}, @IPVS_CMD_ATTR_DAEMON={0x50, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @remote={0xac, 0x14, 0x14, 0xbb}}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x400}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x10001}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'syz_tun\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x6}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x2}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x30, 0x2, [@IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x2}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv6=@ipv4={[], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0xffffffff}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0xafa6}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x1}, @IPVS_CMD_ATTR_DEST={0x6c, 0x2, [@IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x7}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv4=@remote={0xac, 0x14, 0x14, 0xbb}}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x8}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x1}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x5}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x3}, @IPVS_DEST_ATTR_PORT={0x8, 0x2, 0x4e22}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv6=@mcast2={0xff, 0x2, [], 0x1}}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x10000}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x701a3921}]}]}, 0x138}, 0x1, 0x0, 0x0, 0x90}, 0x4)
fcntl$setstatus(r2, 0x4, 0x6000)
setsockopt$sock_linger(r4, 0x1, 0xd, &(0x7f00000008c0)={0x1, 0x2}, 0x8)
pwritev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000c00)="cfb93447d6feaef9f73c0561e075a8295d43017ab1a157786dcda36c5eec92a4306f284fa7e3ed364cc2da5c08cf7e4030d394520e123eee6d9ab275c91c174b1364fc943b49faefe12f605b5ce6c1400a91210c00477f900aff390901bf594c18557cb38a7d57ac8ded098b96b9dfc125e3bdc9305193f4cd256068baca5208160d820b9e7a043666ba4801cf6d557fc0f97f35c13ec6c0d1fe97ce1af1c17078ef47ab955200836671e402717481d14936b09828fd6f55fda2f11eb4c61b480e941133c0a4c5ec54033d0d174742191754ffe28b093596286a78ea01078337ada8585aa98dcc1143689002e31ccc5b9f5cfd2bbce5683a0f91b395391a60ba8e8f4d3c10c82c71caa74c44c8b0f3e42f1fc264497d5b9dabf309bad7bd", 0x11e}], 0x1, 0x0)
sendmmsg(r5, &(0x7f00000027c0)=[{{0x0, 0x0, &(0x7f0000000a00)=[{&(0x7f0000000900)="913da470640ae70fe168a71ad316e5525ce43547f28d8c56cb5cd246950c2d44a514698b3aebf2b60d933814378b0b9b750dec28bdbeedda6c8af5f3418ff8c43701e5dea492428ecdcf0e8c2a19f60e388b478179256834360c5ee359dbe4fabee36883a8314f0ea64dea3a732dffbe26a02e8327a0f7174a6990389e5b608d5300c271f26b3b37cc88e720a477e5f1aa2751af90d35d72606ac73f72dab39aad418a6335d44c785ba83edc9619a3221ae39ef2fed1657e426fa293a739cd779a6c645b3d29bb184041476e8e6e737e5fa1c4312360", 0xd6}], 0x1, 0x0, 0x0, 0x8000}, 0x3f}, {{&(0x7f0000002240)=@nl=@unspec, 0x80, &(0x7f0000002680)=[{&(0x7f00000022c0)="756a6b1895d55b0b292a3985cd35f28cfa8d5ab20a3448791e47ec9e971be82f993ebd55ec843a76ccd644a71222e57119e6f8866f59ba0b89c4cf71a9ce853f72bd99ac9097baf924ea3e3fbceaf0a0df15deb45ae757832bec56c67c0ad44e0ea5fcbc12f898989e1773427ad180efff1044e98613dab446587dd52a0deacb4074e01d97cd46c6e633ae1c1011fd2123c766e6fea028799cf82a562bd9d52c544241172f684398ac1b", 0xaa}, {&(0x7f0000002440)="c802b7c29c92c7ddcf8b11133e071ae83e8c0b0827764303ad44356d381633ce1fdd31e1641872e8d6b4c1a974d97d", 0x2f}, {&(0x7f0000002540)="446c9b3779f2a3dc39f3a3541d912b01ca9865e4172a83cda910f6b10dd97377212eb5279c", 0x25}], 0x3, &(0x7f0000002700)=[{0xa0, 0x10f, 0x200, "4f483406ed4a2e47550522989e031e3e239b59c5dc988744d266f33171b6d4a8e54f025a1e1be02c21ad9675e29aea96625352eec0db268e5c70b8e22a2bb0e11b9e6d9613d4e8e338194d9a41821db1ef97a16b16e5263d008bb6ce86b1e26f4d59926a9a72bed62192dc96eaa8a033c9ddaf2fc8c5fb9e765e5ff99cc5ae6fa7bc4a4f0abcb9c9745b54449ab3"}], 0xa0, 0x800}, 0x1200000}], 0x2, 0x20040000)
sendmsg$IPVS_CMD_DEL_DAEMON(r2, &(0x7f0000000280)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000240)={&(0x7f0000000180)={0x28, 0x0, 0xb30, 0x0, 0x25dfdbfc, {0xa}, [@IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x3ff}, @IPVS_CMD_ATTR_SERVICE={0xc, 0x1, [@IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8}]}]}, 0x28}, 0x1}, 0x0)
ioctl$sock_ifreq(r6, 0x8917, &(0x7f0000000300)={'lo\x00', @ifru_data=&(0x7f00000001c0)="16e667ea25efad95e8e866bb6ef7f6ba94b72b63a28bcb7eafa978bdbe09a4d8"})
getsockopt$inet_int(r4, 0x0, 0x0, &(0x7f0000000600), &(0x7f0000000640)=0x4)
getsockname$unix(r2, &(0x7f0000000680), &(0x7f0000000700)=0x6e)

2018/03/30 13:05:55 executing program 7:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYBLOB="22811e2630b1d0ac"], 0x1)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r1, r2, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = getpgid(0xffffffffffffffff)
syz_open_procfs(r3, &(0x7f00000005c0)='net/ip6_tables_targets\x00')
process_vm_writev(r3, &(0x7f0000000180)=[{&(0x7f0000000140)=""/22, 0x16}], 0x1, &(0x7f00000003c0)=[{&(0x7f0000000740)=""/173, 0xad}], 0x1, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
r4 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
r5 = dup3(0xffffffffffffffff, r0, 0x80000)
setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8)
syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00')
fcntl$setstatus(r1, 0x4, 0x6000)
mq_open(&(0x7f0000000800)=':em1\x00', 0x40, 0x4, &(0x7f0000000840)={0x4000000000000000, 0x0, 0x9, 0x6, 0x0, 0xff, 0x7})
pwritev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000c00)}], 0x1, 0x0)
ioctl$DRM_IOCTL_AGP_ALLOC(r5, 0xc0206434, &(0x7f0000000440)={0x9dca, <r6=>0x0, 0x10002, 0x4})
ioctl$DRM_IOCTL_AGP_BIND(r4, 0x40106436, &(0x7f00000004c0)={r6, 0x676})
ioctl$sock_ifreq(r4, 0x8917, &(0x7f0000000300)={'lo\x00', @ifru_data=&(0x7f00000001c0)="16e667ea25efad95e8e866bb6ef7f6ba94b72b63a28bcb7eafa978bdbe09a4d8"})
getsockopt$inet_int(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000600), &(0x7f0000000640)=0x4)
getsockname$unix(r1, &(0x7f0000000680), &(0x7f0000000700)=0x6e)

2018/03/30 13:05:55 executing program 3:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[], 0x0)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r1, r2, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x0, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
setns(r2, 0x0)
r3 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/loop-control\x00', 0x0, 0x0)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)
r4 = dup(r3)
getsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffff9c, 0x84, 0x6f, &(0x7f0000000340)={<r5=>0x0, 0x3c, &(0x7f00000005c0)=[@in={0x2, 0x4e23, @local={0xac, 0x14, 0x14, 0xaa}}, @in={0x2, 0x4e24, @broadcast=0xffffffff}, @in6={0xa, 0x0, 0x100000000, @loopback={0x0, 0x1}, 0x323d000000000}]}, &(0x7f0000000640)=0xc)
setsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r4, 0x84, 0xa, &(0x7f0000000680)={0xcff3, 0x80000000, 0x3, 0x0, 0x0, 0x66e, 0x5, 0x1, r5}, 0x20)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)
mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x5c831, 0xffffffffffffffff, 0x0)
openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/mls\x00', 0x0, 0x0)
setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(0xffffffffffffffff, 0x10e, 0x2, &(0x7f0000000340)=0xc, 0x4)
madvise(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x9)
r6 = syz_open_dev$usbmon(&(0x7f0000000040)='/dev/usbmon#\x00', 0x0, 0x80000)
ioctl$KDSKBMODE(0xffffffffffffffff, 0x4b45, &(0x7f0000000080))
getsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r6, 0x84, 0x75, &(0x7f00000000c0)={0x0, 0x6}, &(0x7f0000000100)=0x8)
setsockopt$inet_sctp6_SCTP_AUTH_KEY(r6, 0x84, 0x17, &(0x7f0000000500)=ANY=[], 0x0)
ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82)
ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82)
r7 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
ioctl$TIOCLINUX3(r7, 0x541c, &(0x7f0000000040)=0x3)
ioctl$LOOP_CTL_REMOVE(r3, 0x4c81, 0x0)

2018/03/30 13:05:55 executing program 0:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYBLOB="22811e2630b1d0ac3463"], 0x1)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r1, r2, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = getpgid(0xffffffffffffffff)
syz_open_procfs(r3, &(0x7f00000005c0)='net/ip6_tables_targets\x00')
process_vm_writev(r3, &(0x7f0000000180)=[{&(0x7f0000000140)=""/22, 0x16}], 0x1, &(0x7f00000003c0)=[{&(0x7f0000000740)=""/173, 0xad}], 0x1, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
r4 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
setns(r2, 0x0)
r5 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
r6 = dup3(0xffffffffffffffff, r0, 0x80000)
setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8)
syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00')
sendmsg$IPVS_CMD_NEW_DEST(r6, &(0x7f0000000540)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x2000400}, 0xc, &(0x7f0000000500)={&(0x7f0000000240)=ANY=[@ANYPTR], 0x1}, 0x1, 0x0, 0x0, 0x10}, 0x0)
sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10}, 0xc, &(0x7f0000000340)={&(0x7f0000000480)=ANY=[@ANYBLOB='H\x00\x00\x00'], 0x1}, 0x1}, 0x0)
fcntl$setstatus(r1, 0x4, 0x6000)
mq_open(&(0x7f0000000800)=':em1\x00', 0x40, 0x4, &(0x7f0000000840)={0x4000000000000000, 0x0, 0x9, 0x6, 0x0, 0xff, 0x7})
pwritev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000c00)}], 0x1, 0x0)
ioctl$DRM_IOCTL_AGP_ALLOC(r6, 0xc0206434, &(0x7f0000000440)={0x9dca, <r7=>0x0, 0x10002, 0x4})
ioctl$DRM_IOCTL_AGP_BIND(r5, 0x40106436, &(0x7f00000004c0)={r7, 0x676})
ioctl$sock_ifreq(r5, 0x8917, &(0x7f0000000300)={'lo\x00', @ifru_data=&(0x7f00000001c0)="16e667ea25efad95e8e866bb6ef7f6ba94b72b63a28bcb7eafa978bdbe09a4d8"})
getsockopt$inet_int(r4, 0x0, 0x0, &(0x7f0000000600), &(0x7f0000000640)=0x4)
getsockname$unix(r1, &(0x7f0000000680), &(0x7f0000000700)=0x6e)

** 5 printk messages dropped ** [  586.649342] binder: 29597:29599 ioctl 40046207 0 returned -16
[  586.651030] binder: 29597:29599 got transaction with invalid offset (0, min 24 max 40) or object.
[  586.651118] binder: 29597:29599 transaction failed 29201/-22, size 40-16 line 3197
[  586.653411] binder: undelivered TRANSACTION_ERROR: 29201
2018/03/30 13:05:55 executing program 2:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYBLOB="22811e2630b1d0ac3463"], 0x1)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r1, r2, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r3 = getpgid(0xffffffffffffffff)
syz_open_procfs(r3, &(0x7f00000005c0)='net/ip6_tables_targets\x00')
process_vm_writev(r3, &(0x7f0000000180)=[{&(0x7f0000000140)=""/22, 0x16}], 0x1, &(0x7f00000003c0)=[{&(0x7f0000000740)=""/173, 0xad}], 0x1, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
r4 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
setns(r2, 0x0)
r5 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
r6 = dup3(0xffffffffffffffff, r0, 0x80000)
setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8)
syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00')
sendmsg$IPVS_CMD_NEW_DEST(r6, &(0x7f0000000540)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x2000400}, 0xc, &(0x7f0000000500)={&(0x7f0000000240)=ANY=[@ANYPTR], 0x1}, 0x1, 0x0, 0x0, 0x10}, 0x4)
sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10}, 0xc, &(0x7f0000000340)={&(0x7f0000000480)=ANY=[@ANYBLOB='H\x00\x00\x00'], 0x1}, 0x1}, 0x0)
fcntl$setstatus(r1, 0x4, 0x6000)
mq_open(&(0x7f0000000800)=':em1\x00', 0x40, 0x4, &(0x7f0000000840)={0x0, 0x0, 0x9, 0x6, 0x0, 0xff, 0x7})
pwritev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000c00)}], 0x1, 0x0)
ioctl$DRM_IOCTL_AGP_ALLOC(r6, 0xc0206434, &(0x7f0000000440)={0x9dca, <r7=>0x0, 0x10002, 0x4})
ioctl$DRM_IOCTL_AGP_BIND(r5, 0x40106436, &(0x7f00000004c0)={r7, 0x676})
ioctl$sock_ifreq(r5, 0x8917, &(0x7f0000000300)={'lo\x00', @ifru_data=&(0x7f00000001c0)="16e667ea25efad95e8e866bb6ef7f6ba94b72b63a28bcb7eafa978bdbe09a4d8"})
getsockopt$inet_int(r4, 0x0, 0x0, &(0x7f0000000600), &(0x7f0000000640)=0x4)
getsockname$unix(r1, &(0x7f0000000680), &(0x7f0000000700)=0x6e)

[  586.671214] binder: undelivered TRANSACTION_ERROR: 29201
** 27 printk messages dropped ** [  586.791374] binder: 29610:29623 got transaction with invalid offset (0, min 24 max 40) or object.
2018/03/30 13:05:55 executing program 5:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYBLOB="00811e2630b1d0ac3463"], 0x1)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r1, r2, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
setns(r2, 0x0)
r3 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/loop-control\x00', 0x0, 0x0)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)
r4 = dup(r3)
getsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffff9c, 0x84, 0x6f, &(0x7f0000000340)={<r5=>0x0, 0x3c, &(0x7f00000005c0)=[@in={0x2, 0x4e23, @local={0xac, 0x14, 0x14, 0xaa}}, @in={0x2, 0x4e24, @broadcast=0xffffffff}, @in6={0xa, 0x0, 0x100000000, @loopback={0x0, 0x1}, 0x323d000000000}]}, &(0x7f0000000640)=0xc)
setsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r4, 0x84, 0xa, &(0x7f0000000680)={0xcff3, 0x80000000, 0x3, 0x0, 0x0, 0x66e, 0x5, 0x0, r5}, 0x20)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)
mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x5c831, 0xffffffffffffffff, 0x0)
openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/mls\x00', 0x0, 0x0)
setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(0xffffffffffffffff, 0x10e, 0x2, &(0x7f0000000340)=0xc, 0x4)
r6 = syz_open_dev$usbmon(&(0x7f0000000040)='/dev/usbmon#\x00', 0x0, 0x80000)
ioctl$KDSKBMODE(0xffffffffffffffff, 0x4b45, &(0x7f0000000080))
getsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r6, 0x84, 0x75, &(0x7f00000000c0)={0x0, 0x6}, &(0x7f0000000100)=0x8)
setsockopt$inet_sctp6_SCTP_AUTH_KEY(r6, 0x84, 0x17, &(0x7f0000000500)=ANY=[], 0x0)
ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)
r7 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
ioctl$TIOCLINUX3(r7, 0x541c, &(0x7f0000000040)=0x3)
ioctl$LOOP_CTL_REMOVE(r3, 0x4c81, 0x0)

2018/03/30 13:05:55 executing program 1:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYBLOB="22811e2630b1d0ac3463"], 0x1)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r1, r2, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = getpgid(0xffffffffffffffff)
syz_open_procfs(r3, &(0x7f00000005c0)='net/ip6_tables_targets\x00')
process_vm_writev(r3, &(0x7f0000000180), 0x0, &(0x7f00000003c0)=[{&(0x7f0000000740)=""/173, 0xad}], 0x1, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
r4 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
r5 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
r6 = dup3(0xffffffffffffffff, r0, 0x80000)
setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8)
syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00')
fcntl$setstatus(r1, 0x4, 0x6000)
mq_open(&(0x7f0000000800)=':em1\x00', 0x40, 0x4, &(0x7f0000000840)={0x4000000000000000, 0x0, 0x9, 0x6, 0x0, 0xff, 0x7})
pwritev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000c00)}], 0x1, 0x0)
ioctl$DRM_IOCTL_AGP_ALLOC(r6, 0xc0206434, &(0x7f0000000440)={0x0, <r7=>0x0, 0x10002, 0x4})
ioctl$DRM_IOCTL_AGP_BIND(r5, 0x40106436, &(0x7f00000004c0)={r7, 0x676})
ioctl$sock_ifreq(r5, 0x8917, &(0x7f0000000300)={'lo\x00', @ifru_data=&(0x7f00000001c0)="16e667ea25efad95e8e866bb6ef7f6ba94b72b63a28bcb7eafa978bdbe09a4d8"})
getsockopt$inet_int(r4, 0x0, 0x0, &(0x7f0000000600), &(0x7f0000000640)=0x4)
getsockname$unix(r1, &(0x7f0000000680), &(0x7f0000000700)=0x6e)

2018/03/30 13:05:55 executing program 6:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYBLOB="22811e2630b1d0ac3463"], 0x1)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r1, r2, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = getpgid(0xffffffffffffffff)
syz_open_procfs(r3, &(0x7f00000005c0)='net/ip6_tables_targets\x00')
process_vm_writev(r3, &(0x7f0000000180)=[{&(0x7f0000000140)=""/22, 0x16}], 0x1, &(0x7f00000003c0)=[{&(0x7f0000000740)=""/173, 0xad}], 0x1, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
r4 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
r5 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
r6 = dup3(0xffffffffffffffff, r0, 0x0)
setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8)
syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00')
sendmsg$IPVS_CMD_NEW_DEST(r6, &(0x7f0000000540)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x2000400}, 0xc, &(0x7f0000000500)={&(0x7f0000000240)=ANY=[@ANYPTR], 0x1}, 0x1, 0x0, 0x0, 0x10}, 0x4)
fcntl$setstatus(r1, 0x4, 0x6000)
mq_open(&(0x7f0000000800)=':em1\x00', 0x40, 0x4, &(0x7f0000000840)={0x4000000000000000, 0x0, 0x9, 0x6, 0x0, 0xff, 0x7})
pwritev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000c00)}], 0x1, 0x0)
ioctl$DRM_IOCTL_AGP_ALLOC(r6, 0xc0206434, &(0x7f0000000440)={0x9dca, <r7=>0x0, 0x0, 0x4})
ioctl$DRM_IOCTL_AGP_BIND(r5, 0x40106436, &(0x7f00000004c0)={r7, 0x676})
ioctl$sock_ifreq(r5, 0x8917, &(0x7f0000000300)={'lo\x00', @ifru_data=&(0x7f00000001c0)="16e667ea25efad95e8e866bb6ef7f6ba94b72b63a28bcb7eafa978bdbe09a4d8"})
getsockopt$inet_int(r4, 0x0, 0x0, &(0x7f0000000600), &(0x7f0000000640)=0x4)
getsockname$unix(r1, &(0x7f0000000680), &(0x7f0000000700)=0x6e)

2018/03/30 13:05:55 executing program 7:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYBLOB="22811e2630b1d0ac34"], 0x1)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r1, r2, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = getpgid(0xffffffffffffffff)
syz_open_procfs(r3, &(0x7f00000005c0)='net/ip6_tables_targets\x00')
process_vm_writev(r3, &(0x7f0000000180)=[{&(0x7f0000000140)=""/22, 0x16}], 0x1, &(0x7f00000003c0)=[{&(0x7f0000000740)=""/173, 0xad}], 0x1, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
r4 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
r5 = dup3(0xffffffffffffffff, r0, 0x80000)
setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8)
syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00')
fcntl$setstatus(r1, 0x4, 0x6000)
mq_open(&(0x7f0000000800)=':em1\x00', 0x40, 0x4, &(0x7f0000000840)={0x4000000000000000, 0x0, 0x9, 0x6, 0x0, 0xff, 0x7})
pwritev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000c00)}], 0x1, 0x0)
ioctl$DRM_IOCTL_AGP_ALLOC(r5, 0xc0206434, &(0x7f0000000440)={0x9dca, <r6=>0x0, 0x10002, 0x4})
ioctl$DRM_IOCTL_AGP_BIND(r4, 0x40106436, &(0x7f00000004c0)={r6, 0x676})
ioctl$sock_ifreq(r4, 0x8917, &(0x7f0000000300)={'lo\x00', @ifru_data=&(0x7f00000001c0)="16e667ea25efad95e8e866bb6ef7f6ba94b72b63a28bcb7eafa978bdbe09a4d8"})
getsockopt$inet_int(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000600), &(0x7f0000000640)=0x4)
getsockname$unix(r1, &(0x7f0000000680), &(0x7f0000000700)=0x6e)

** 2 printk messages dropped ** [  586.800891] binder: 29617:29621 ioctl 40046207 0 returned -16
** 2 printk messages dropped ** [  586.815392] binder: release 29612:29616 transaction 41648 out, still active
** 8 printk messages dropped ** [  586.829360] binder: undelivered TRANSACTION_ERROR: 29201
2018/03/30 13:05:55 executing program 3:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[], 0x0)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r1, r2, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x0, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
setns(r2, 0x0)
r3 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/loop-control\x00', 0x0, 0x0)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)
r4 = dup(r3)
getsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffff9c, 0x84, 0x6f, &(0x7f0000000340)={<r5=>0x0, 0x3c, &(0x7f00000005c0)=[@in={0x2, 0x4e23, @local={0xac, 0x14, 0x14, 0xaa}}, @in={0x2, 0x4e24, @broadcast=0xffffffff}, @in6={0xa, 0x0, 0x100000000, @loopback={0x0, 0x1}, 0x323d000000000}]}, &(0x7f0000000640)=0xc)
setsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r4, 0x84, 0xa, &(0x7f0000000680)={0xcff3, 0x80000000, 0x3, 0x0, 0x0, 0x66e, 0x5, 0x1, r5}, 0x20)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)
mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x5c831, 0xffffffffffffffff, 0x0)
openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/mls\x00', 0x0, 0x0)
setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(0xffffffffffffffff, 0x10e, 0x2, &(0x7f0000000340)=0xc, 0x4)
madvise(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x9)
r6 = syz_open_dev$usbmon(&(0x7f0000000040)='/dev/usbmon#\x00', 0x0, 0x80000)
ioctl$KDSKBMODE(0xffffffffffffffff, 0x4b45, &(0x7f0000000080))
getsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r6, 0x84, 0x75, &(0x7f00000000c0)={0x0, 0x6}, &(0x7f0000000100)=0x8)
setsockopt$inet_sctp6_SCTP_AUTH_KEY(r6, 0x84, 0x17, &(0x7f0000000500)=ANY=[], 0x0)
ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82)
ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82)
r7 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
ioctl$TIOCLINUX3(r7, 0x541c, &(0x7f0000000040)=0x3)
ioctl$LOOP_CTL_REMOVE(r3, 0x4c81, 0x0)

2018/03/30 13:05:55 executing program 2:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYBLOB="22811e2630b1d0ac3463"], 0x1)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r1, r2, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r3 = getpgid(0xffffffffffffffff)
syz_open_procfs(r3, &(0x7f00000005c0)='net/ip6_tables_targets\x00')
process_vm_writev(r3, &(0x7f0000000180)=[{&(0x7f0000000140)=""/22, 0x16}], 0x1, &(0x7f00000003c0)=[{&(0x7f0000000740)=""/173, 0xad}], 0x1, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
r4 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
setns(r2, 0x0)
r5 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
r6 = dup3(0xffffffffffffffff, r0, 0x80000)
setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8)
syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00')
sendmsg$IPVS_CMD_NEW_DEST(r6, &(0x7f0000000540)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x2000400}, 0xc, &(0x7f0000000500)={&(0x7f0000000240)=ANY=[@ANYPTR], 0x1}, 0x1, 0x0, 0x0, 0x10}, 0x4)
sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10}, 0xc, &(0x7f0000000340)={&(0x7f0000000480)=ANY=[@ANYBLOB='H\x00\x00\x00'], 0x1}, 0x1}, 0x0)
fcntl$setstatus(r1, 0x4, 0x6000)
mq_open(&(0x7f0000000800)=':em1\x00', 0x40, 0x4, &(0x7f0000000840)={0x0, 0x0, 0x9, 0x6, 0x0, 0xff, 0x7})
pwritev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000c00)}], 0x1, 0x0)
ioctl$DRM_IOCTL_AGP_ALLOC(r6, 0xc0206434, &(0x7f0000000440)={0x9dca, <r7=>0x0, 0x10002, 0x4})
ioctl$DRM_IOCTL_AGP_BIND(r5, 0x40106436, &(0x7f00000004c0)={r7, 0x676})
ioctl$sock_ifreq(r5, 0x8917, &(0x7f0000000300)={'lo\x00', @ifru_data=&(0x7f00000001c0)="16e667ea25efad95e8e866bb6ef7f6ba94b72b63a28bcb7eafa978bdbe09a4d8"})
getsockopt$inet_int(r4, 0x0, 0x0, &(0x7f0000000600), &(0x7f0000000640)=0x4)
getsockname$unix(r1, &(0x7f0000000680), &(0x7f0000000700)=0x6e)

2018/03/30 13:05:55 executing program 4:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
r1 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000002880)='/selinux/avc/cache_stats\x00', 0x0, 0x0)
ioctl$EVIOCSABS20(r1, 0x401845e0, &(0x7f00000028c0)={0x1000, 0x7fff, 0x1ff, 0xffffffff, 0x7, 0x40})
fchdir(r0)
r2 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(r2, &(0x7f0000000080)=ANY=[@ANYBLOB="00811e2630b1d0ac3463"], 0x1)
setsockopt$packet_add_memb(r2, 0x107, 0x1, &(0x7f0000002900)={0x0, 0x1, 0x6}, 0x10)
r3 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r2, r3, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r3, 0x0)
inotify_init1(0x800)
ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
r4 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
setns(r3, 0x8000000)
r5 = socket$nl_xfrm(0x10, 0x3, 0x6)
r6 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
dup3(r3, r0, 0x80000)
setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8)
r7 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00')
sendmsg$IPVS_CMD_NEW_DEST(0xffffffffffffffff, &(0x7f0000000540)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x2000400}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)=ANY=[@ANYBLOB=',\x00\x00\x00'], 0x1}, 0x1, 0x0, 0x0, 0x10}, 0x4)
sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10}, 0xc, &(0x7f0000000340)={&(0x7f0000000480)=ANY=[@ANYBLOB='H\x00\x00\x00'], 0x1}, 0x1}, 0x0)
sendmsg$IPVS_CMD_GET_DEST(r2, &(0x7f0000000880)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f00000005c0)={&(0x7f0000000740)={0x138, r7, 0x208, 0x70bd2b, 0x25dfdbfb, {0x8}, [@IPVS_CMD_ATTR_SERVICE={0x28, 0x1, [@IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@multicast2=0xe0000002}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x3}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x7fff}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x8c6}, @IPVS_CMD_ATTR_DAEMON={0x50, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @remote={0xac, 0x14, 0x14, 0xbb}}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x400}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x10001}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'syz_tun\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x6}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x2}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x30, 0x2, [@IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x2}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv6=@ipv4={[], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0xffffffff}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0xafa6}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x1}, @IPVS_CMD_ATTR_DEST={0x6c, 0x2, [@IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x7}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv4=@remote={0xac, 0x14, 0x14, 0xbb}}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x8}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x1}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x5}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x3}, @IPVS_DEST_ATTR_PORT={0x8, 0x2, 0x4e22}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv6=@mcast2={0xff, 0x2, [], 0x1}}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x10000}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x701a3921}]}]}, 0x138}, 0x1, 0x0, 0x0, 0x90}, 0x4)
fcntl$setstatus(r2, 0x4, 0x6000)
setsockopt$sock_linger(r4, 0x1, 0xd, &(0x7f00000008c0)={0x1, 0x2}, 0x8)
pwritev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000c00)="cfb93447d6feaef9f73c0561e075a8295d43017ab1a157786dcda36c5eec92a4306f284fa7e3ed364cc2da5c08cf7e4030d394520e123eee6d9ab275c91c174b1364fc943b49faefe12f605b5ce6c1400a91210c00477f900aff390901bf594c18557cb38a7d57ac8ded098b96b9dfc125e3bdc9305193f4cd256068baca5208160d820b9e7a043666ba4801cf6d557fc0f97f35c13ec6c0d1fe97ce1af1c17078ef47ab955200836671e402717481d14936b09828fd6f55fda2f11eb4c61b480e941133c0a4c5ec54033d0d174742191754ffe28b093596286a78ea01078337ada8585aa98dcc1143689002e31ccc5b9f5cfd2bbce5683a0f91b395391a60ba8e8f4d3c10c82c71caa74c44c8b0f3e42f1fc264497d5b9dabf309bad7bd", 0x11e}], 0x1, 0x0)
sendmmsg(r5, &(0x7f00000027c0)=[{{0x0, 0x0, &(0x7f0000000a00)=[{&(0x7f0000000900)="913da470640ae70fe168a71ad316e5525ce43547f28d8c56cb5cd246950c2d44a514698b3aebf2b60d933814378b0b9b750dec28bdbeedda6c8af5f3418ff8c43701e5dea492428ecdcf0e8c2a19f60e388b478179256834360c5ee359dbe4fabee36883a8314f0ea64dea3a732dffbe26a02e8327a0f7174a6990389e5b608d5300c271f26b3b37cc88e720a477e5f1aa2751af90d35d72606ac73f72dab39aad418a6335d44c785ba83edc9619a3221ae39ef2fed1657e426fa293a739cd779a6c645b3d29bb184041476e8e6e737e5fa1c4312360", 0xd6}], 0x1, 0x0, 0x0, 0x8000}, 0x3f}, {{&(0x7f0000002240)=@nl=@unspec, 0x80, &(0x7f0000002680)=[{&(0x7f00000022c0)="756a6b1895d55b0b292a3985cd35f28cfa8d5ab20a3448791e47ec9e971be82f993ebd55ec843a76ccd644a71222e57119e6f8866f59ba0b89c4cf71a9ce853f72bd99ac9097baf924ea3e3fbceaf0a0df15deb45ae757832bec56c67c0ad44e0ea5fcbc12f898989e1773427ad180efff1044e98613dab446587dd52a0deacb4074e01d97cd46c6e633ae1c1011fd2123c766e6fea028799cf82a562bd9d52c544241172f684398ac1b", 0xaa}, {&(0x7f0000002440)="c802b7c29c92c7ddcf8b11133e071ae83e8c0b0827764303ad44356d381633ce1fdd31e1641872e8d6b4c1a974d97d", 0x2f}, {&(0x7f0000002540)="446c9b3779f2a3dc39f3a3541d912b01ca9865e4172a83cda910f6b10dd97377212eb5279c", 0x25}], 0x3, &(0x7f0000002700)=[{0xa0, 0x10f, 0x200, "4f483406ed4a2e47550522989e031e3e239b59c5dc988744d266f33171b6d4a8e54f025a1e1be02c21ad9675e29aea96625352eec0db268e5c70b8e22a2bb0e11b9e6d9613d4e8e338194d9a41821db1ef97a16b16e5263d008bb6ce86b1e26f4d59926a9a72bed62192dc96eaa8a033c9ddaf2fc8c5fb9e765e5ff99cc5ae6fa7bc4a4f0abcb9c9745b54449ab3"}], 0xa0, 0x800}, 0x1200000}], 0x2, 0x20040000)
sendmsg$IPVS_CMD_DEL_DAEMON(r2, &(0x7f0000000280)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000240)={&(0x7f0000000180)={0x28, 0x0, 0xb30, 0x0, 0x25dfdbfc, {0xa}, [@IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x3ff}, @IPVS_CMD_ATTR_SERVICE={0xc, 0x1, [@IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8}]}]}, 0x28}, 0x1}, 0x0)
ioctl$sock_ifreq(r6, 0x8917, &(0x7f0000000300)={'lo\x00', @ifru_data=&(0x7f00000001c0)="16e667ea25efad95e8e866bb6ef7f6ba94b72b63a28bcb7eafa978bdbe09a4d8"})
getsockopt$inet_int(r4, 0x0, 0x0, &(0x7f0000000600), &(0x7f0000000640)=0x4)
getsockname$unix(r2, &(0x7f0000000680), &(0x7f0000000700)=0x6e)

2018/03/30 13:05:55 executing program 0:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYBLOB="22811e2630b1d0ac3463"], 0x1)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r1, r2, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = getpgid(0xffffffffffffffff)
syz_open_procfs(r3, &(0x7f00000005c0)='net/ip6_tables_targets\x00')
process_vm_writev(r3, &(0x7f0000000180)=[{&(0x7f0000000140)=""/22, 0x16}], 0x1, &(0x7f00000003c0)=[{&(0x7f0000000740)=""/173, 0xad}], 0x1, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
r4 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
setns(r2, 0x0)
r5 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
r6 = dup3(0xffffffffffffffff, r0, 0x80000)
setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8)
syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00')
sendmsg$IPVS_CMD_NEW_DEST(r6, &(0x7f0000000540)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x2000400}, 0xc, &(0x7f0000000500)={&(0x7f0000000240)=ANY=[@ANYPTR], 0x1}, 0x1, 0x0, 0x0, 0x10}, 0x0)
sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10}, 0xc, &(0x7f0000000340)={&(0x7f0000000480)=ANY=[@ANYBLOB='H\x00\x00\x00'], 0x1}, 0x1}, 0x0)
fcntl$setstatus(r1, 0x4, 0x6000)
mq_open(&(0x7f0000000800)=':em1\x00', 0x40, 0x4, &(0x7f0000000840)={0x4000000000000000, 0x0, 0x9, 0x6, 0x0, 0xff, 0x7})
pwritev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000c00)}], 0x1, 0x0)
ioctl$DRM_IOCTL_AGP_ALLOC(r6, 0xc0206434, &(0x7f0000000440)={0x9dca, <r7=>0x0, 0x10002, 0x4})
ioctl$DRM_IOCTL_AGP_BIND(r5, 0x40106436, &(0x7f00000004c0)={r7, 0x676})
ioctl$sock_ifreq(r5, 0x8917, &(0x7f0000000300)={'lo\x00', @ifru_data=&(0x7f00000001c0)="16e667ea25efad95e8e866bb6ef7f6ba94b72b63a28bcb7eafa978bdbe09a4d8"})
getsockopt$inet_int(r4, 0x0, 0x0, &(0x7f0000000600), &(0x7f0000000640)=0x4)
getsockname$unix(r1, &(0x7f0000000680), &(0x7f0000000700)=0x6e)

2018/03/30 13:05:55 executing program 1:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYBLOB="22811e2630b1d0ac3463"], 0x1)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r1, r2, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = getpgid(0xffffffffffffffff)
syz_open_procfs(r3, &(0x7f00000005c0)='net/ip6_tables_targets\x00')
process_vm_writev(r3, &(0x7f0000000180), 0x0, &(0x7f00000003c0)=[{&(0x7f0000000740)=""/173, 0xad}], 0x1, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
r4 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
r5 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
r6 = dup3(0xffffffffffffffff, r0, 0x80000)
setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8)
syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00')
fcntl$setstatus(r1, 0x4, 0x6000)
mq_open(&(0x7f0000000800)=':em1\x00', 0x40, 0x4, &(0x7f0000000840)={0x4000000000000000, 0x0, 0x9, 0x6, 0x0, 0xff, 0x7})
pwritev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000c00)}], 0x1, 0x0)
ioctl$DRM_IOCTL_AGP_ALLOC(r6, 0xc0206434, &(0x7f0000000440)={0x0, <r7=>0x0, 0x10002, 0x4})
ioctl$DRM_IOCTL_AGP_BIND(r5, 0x40106436, &(0x7f00000004c0)={r7, 0x676})
ioctl$sock_ifreq(r5, 0x8917, &(0x7f0000000300)={'lo\x00', @ifru_data=&(0x7f00000001c0)="16e667ea25efad95e8e866bb6ef7f6ba94b72b63a28bcb7eafa978bdbe09a4d8"})
getsockopt$inet_int(r4, 0x0, 0x0, &(0x7f0000000600), &(0x7f0000000640)=0x4)
getsockname$unix(r1, &(0x7f0000000680), &(0x7f0000000700)=0x6e)

2018/03/30 13:05:55 executing program 5:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYBLOB="00811e2630b1d0ac3463"], 0x1)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r1, r2, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
setns(r2, 0x0)
r3 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/loop-control\x00', 0x0, 0x0)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)
r4 = dup(r3)
getsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffff9c, 0x84, 0x6f, &(0x7f0000000340)={<r5=>0x0, 0x3c, &(0x7f00000005c0)=[@in={0x2, 0x4e23, @local={0xac, 0x14, 0x14, 0xaa}}, @in={0x2, 0x4e24, @broadcast=0xffffffff}, @in6={0xa, 0x0, 0x100000000, @loopback={0x0, 0x1}, 0x323d000000000}]}, &(0x7f0000000640)=0xc)
setsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r4, 0x84, 0xa, &(0x7f0000000680)={0xcff3, 0x80000000, 0x3, 0x0, 0x0, 0x66e, 0x5, 0x0, r5}, 0x20)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)
mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x5c831, 0xffffffffffffffff, 0x0)
openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/mls\x00', 0x0, 0x0)
setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(0xffffffffffffffff, 0x10e, 0x2, &(0x7f0000000340)=0xc, 0x4)
r6 = syz_open_dev$usbmon(&(0x7f0000000040)='/dev/usbmon#\x00', 0x0, 0x80000)
ioctl$KDSKBMODE(0xffffffffffffffff, 0x4b45, &(0x7f0000000080))
getsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r6, 0x84, 0x75, &(0x7f00000000c0)={0x0, 0x6}, &(0x7f0000000100)=0x8)
setsockopt$inet_sctp6_SCTP_AUTH_KEY(r6, 0x84, 0x17, &(0x7f0000000500)=ANY=[], 0x0)
ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)
r7 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
ioctl$TIOCLINUX3(r7, 0x541c, &(0x7f0000000040)=0x3)
ioctl$LOOP_CTL_REMOVE(r3, 0x4c81, 0x0)

2018/03/30 13:05:55 executing program 6:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYBLOB="22811e2630b1d0ac3463"], 0x1)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r1, r2, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = getpgid(0xffffffffffffffff)
syz_open_procfs(r3, &(0x7f00000005c0)='net/ip6_tables_targets\x00')
process_vm_writev(r3, &(0x7f0000000180)=[{&(0x7f0000000140)=""/22, 0x16}], 0x1, &(0x7f00000003c0)=[{&(0x7f0000000740)=""/173, 0xad}], 0x1, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
r4 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
r5 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
r6 = dup3(0xffffffffffffffff, r0, 0x0)
setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8)
syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00')
sendmsg$IPVS_CMD_NEW_DEST(r6, &(0x7f0000000540)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x2000400}, 0xc, &(0x7f0000000500)={&(0x7f0000000240)=ANY=[@ANYPTR], 0x1}, 0x1, 0x0, 0x0, 0x10}, 0x4)
fcntl$setstatus(r1, 0x4, 0x6000)
mq_open(&(0x7f0000000800)=':em1\x00', 0x40, 0x4, &(0x7f0000000840)={0x4000000000000000, 0x0, 0x9, 0x6, 0x0, 0xff, 0x7})
pwritev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000c00)}], 0x1, 0x0)
ioctl$DRM_IOCTL_AGP_ALLOC(r6, 0xc0206434, &(0x7f0000000440)={0x9dca, <r7=>0x0, 0x0, 0x4})
ioctl$DRM_IOCTL_AGP_BIND(r5, 0x40106436, &(0x7f00000004c0)={r7, 0x676})
ioctl$sock_ifreq(r5, 0x8917, &(0x7f0000000300)={'lo\x00', @ifru_data=&(0x7f00000001c0)="16e667ea25efad95e8e866bb6ef7f6ba94b72b63a28bcb7eafa978bdbe09a4d8"})
getsockopt$inet_int(r4, 0x0, 0x0, &(0x7f0000000600), &(0x7f0000000640)=0x4)
getsockname$unix(r1, &(0x7f0000000680), &(0x7f0000000700)=0x6e)

2018/03/30 13:05:55 executing program 7:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYBLOB="22811e2630b1d0ac34"], 0x1)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r1, r2, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = getpgid(0xffffffffffffffff)
syz_open_procfs(r3, &(0x7f00000005c0)='net/ip6_tables_targets\x00')
process_vm_writev(r3, &(0x7f0000000180)=[{&(0x7f0000000140)=""/22, 0x16}], 0x1, &(0x7f00000003c0)=[{&(0x7f0000000740)=""/173, 0xad}], 0x1, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
r4 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
r5 = dup3(0xffffffffffffffff, r0, 0x80000)
setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8)
syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00')
fcntl$setstatus(r1, 0x4, 0x6000)
mq_open(&(0x7f0000000800)=':em1\x00', 0x40, 0x4, &(0x7f0000000840)={0x4000000000000000, 0x0, 0x9, 0x6, 0x0, 0xff, 0x7})
pwritev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000c00)}], 0x1, 0x0)
ioctl$DRM_IOCTL_AGP_ALLOC(r5, 0xc0206434, &(0x7f0000000440)={0x9dca, <r6=>0x0, 0x10002, 0x4})
ioctl$DRM_IOCTL_AGP_BIND(r4, 0x40106436, &(0x7f00000004c0)={r6, 0x676})
ioctl$sock_ifreq(r4, 0x8917, &(0x7f0000000300)={'lo\x00', @ifru_data=&(0x7f00000001c0)="16e667ea25efad95e8e866bb6ef7f6ba94b72b63a28bcb7eafa978bdbe09a4d8"})
getsockopt$inet_int(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000600), &(0x7f0000000640)=0x4)
getsockname$unix(r1, &(0x7f0000000680), &(0x7f0000000700)=0x6e)

** 6 printk messages dropped ** [  586.867476] binder: send failed reply for transaction 41648, target dead
** 1 printk messages dropped ** [  586.867785] binder: undelivered TRANSACTION_ERROR: 29201
[  586.876142] binder: undelivered TRANSACTION_COMPLETE
[  586.876154] binder: undelivered TRANSACTION_ERROR: 29189
[  586.880322] binder: 29640:29642 got transaction with invalid offset (0, min 24 max 40) or object.
[  586.880413] binder: 29640:29642 transaction failed 29201/-22, size 40-16 line 3197
2018/03/30 13:05:56 executing program 5:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYBLOB="00811e2630b1d0ac3463"], 0x1)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r1, r2, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
setns(r2, 0x0)
r3 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/loop-control\x00', 0x0, 0x0)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)
r4 = dup(r3)
getsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffff9c, 0x84, 0x6f, &(0x7f0000000340)={<r5=>0x0, 0x3c, &(0x7f00000005c0)=[@in={0x2, 0x4e23, @local={0xac, 0x14, 0x14, 0xaa}}, @in={0x2, 0x4e24, @broadcast=0xffffffff}, @in6={0xa, 0x0, 0x100000000, @loopback={0x0, 0x1}, 0x323d000000000}]}, &(0x7f0000000640)=0xc)
setsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r4, 0x84, 0xa, &(0x7f0000000680)={0xcff3, 0x80000000, 0x3, 0x0, 0x0, 0x66e, 0x5, 0x0, r5}, 0x20)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)
mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x5c831, 0xffffffffffffffff, 0x0)
openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/mls\x00', 0x0, 0x0)
setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(0xffffffffffffffff, 0x10e, 0x2, &(0x7f0000000340)=0xc, 0x4)
r6 = syz_open_dev$usbmon(&(0x7f0000000040)='/dev/usbmon#\x00', 0x0, 0x80000)
ioctl$KDSKBMODE(0xffffffffffffffff, 0x4b45, &(0x7f0000000080))
getsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r6, 0x84, 0x75, &(0x7f00000000c0)={0x0, 0x6}, &(0x7f0000000100)=0x8)
setsockopt$inet_sctp6_SCTP_AUTH_KEY(r6, 0x84, 0x17, &(0x7f0000000500)=ANY=[], 0x0)
ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)
r7 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
ioctl$TIOCLINUX3(r7, 0x541c, &(0x7f0000000040)=0x3)
ioctl$LOOP_CTL_REMOVE(r3, 0x4c81, 0x0)

2018/03/30 13:05:56 executing program 3:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[], 0x0)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r1, r2, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x0, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
setns(r2, 0x0)
r3 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/loop-control\x00', 0x0, 0x0)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)
r4 = dup(r3)
getsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffff9c, 0x84, 0x6f, &(0x7f0000000340)={<r5=>0x0, 0x3c, &(0x7f00000005c0)=[@in={0x2, 0x4e23, @local={0xac, 0x14, 0x14, 0xaa}}, @in={0x2, 0x4e24, @broadcast=0xffffffff}, @in6={0xa, 0x0, 0x100000000, @loopback={0x0, 0x1}, 0x323d000000000}]}, &(0x7f0000000640)=0xc)
setsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r4, 0x84, 0xa, &(0x7f0000000680)={0xcff3, 0x80000000, 0x3, 0x0, 0x0, 0x66e, 0x5, 0x1, r5}, 0x20)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)
mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x5c831, 0xffffffffffffffff, 0x0)
openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/mls\x00', 0x0, 0x0)
setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(0xffffffffffffffff, 0x10e, 0x2, &(0x7f0000000340)=0xc, 0x4)
madvise(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x9)
r6 = syz_open_dev$usbmon(&(0x7f0000000040)='/dev/usbmon#\x00', 0x0, 0x80000)
ioctl$KDSKBMODE(0xffffffffffffffff, 0x4b45, &(0x7f0000000080))
getsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r6, 0x84, 0x75, &(0x7f00000000c0)={0x0, 0x6}, &(0x7f0000000100)=0x8)
setsockopt$inet_sctp6_SCTP_AUTH_KEY(r6, 0x84, 0x17, &(0x7f0000000500)=ANY=[], 0x0)
ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82)
ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82)
r7 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
ioctl$TIOCLINUX3(r7, 0x541c, &(0x7f0000000040)=0x3)
ioctl$LOOP_CTL_REMOVE(r3, 0x4c81, 0x0)

** 13 printk messages dropped ** [  586.919074] binder: BINDER_SET_CONTEXT_MGR already set
2018/03/30 13:05:56 executing program 4:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
r1 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000002880)='/selinux/avc/cache_stats\x00', 0x0, 0x0)
ioctl$EVIOCSABS20(r1, 0x401845e0, &(0x7f00000028c0)={0x1000, 0x7fff, 0x1ff, 0xffffffff, 0x7, 0x40})
fchdir(r0)
r2 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(r2, &(0x7f0000000080)=ANY=[@ANYBLOB="00811e2630b1d0ac3463"], 0x1)
setsockopt$packet_add_memb(r2, 0x107, 0x1, &(0x7f0000002900)={0x0, 0x1, 0x6}, 0x10)
r3 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r2, r3, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r3, 0x0)
inotify_init1(0x800)
ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
r4 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
setns(r3, 0x8000000)
r5 = socket$nl_xfrm(0x10, 0x3, 0x6)
r6 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
dup3(r3, r0, 0x80000)
setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8)
r7 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00')
sendmsg$IPVS_CMD_NEW_DEST(0xffffffffffffffff, &(0x7f0000000540)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x2000400}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)=ANY=[@ANYBLOB=',\x00\x00\x00'], 0x1}, 0x1, 0x0, 0x0, 0x10}, 0x4)
sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10}, 0xc, &(0x7f0000000340)={&(0x7f0000000480)=ANY=[@ANYBLOB='H\x00\x00\x00'], 0x1}, 0x1}, 0x0)
sendmsg$IPVS_CMD_GET_DEST(r2, &(0x7f0000000880)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f00000005c0)={&(0x7f0000000740)={0x138, r7, 0x208, 0x70bd2b, 0x25dfdbfb, {0x8}, [@IPVS_CMD_ATTR_SERVICE={0x28, 0x1, [@IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@multicast2=0xe0000002}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x3}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x7fff}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x8c6}, @IPVS_CMD_ATTR_DAEMON={0x50, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @remote={0xac, 0x14, 0x14, 0xbb}}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x400}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x10001}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'syz_tun\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x6}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x2}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x30, 0x2, [@IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x2}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv6=@ipv4={[], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0xffffffff}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0xafa6}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x1}, @IPVS_CMD_ATTR_DEST={0x6c, 0x2, [@IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x7}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv4=@remote={0xac, 0x14, 0x14, 0xbb}}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x8}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x1}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x5}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x3}, @IPVS_DEST_ATTR_PORT={0x8, 0x2, 0x4e22}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv6=@mcast2={0xff, 0x2, [], 0x1}}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x10000}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x701a3921}]}]}, 0x138}, 0x1, 0x0, 0x0, 0x90}, 0x4)
fcntl$setstatus(r2, 0x4, 0x6000)
setsockopt$sock_linger(r4, 0x1, 0xd, &(0x7f00000008c0)={0x1, 0x2}, 0x8)
pwritev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000c00)="cfb93447d6feaef9f73c0561e075a8295d43017ab1a157786dcda36c5eec92a4306f284fa7e3ed364cc2da5c08cf7e4030d394520e123eee6d9ab275c91c174b1364fc943b49faefe12f605b5ce6c1400a91210c00477f900aff390901bf594c18557cb38a7d57ac8ded098b96b9dfc125e3bdc9305193f4cd256068baca5208160d820b9e7a043666ba4801cf6d557fc0f97f35c13ec6c0d1fe97ce1af1c17078ef47ab955200836671e402717481d14936b09828fd6f55fda2f11eb4c61b480e941133c0a4c5ec54033d0d174742191754ffe28b093596286a78ea01078337ada8585aa98dcc1143689002e31ccc5b9f5cfd2bbce5683a0f91b395391a60ba8e8f4d3c10c82c71caa74c44c8b0f3e42f1fc264497d5b9dabf309bad7bd", 0x11e}], 0x1, 0x0)
sendmmsg(r5, &(0x7f00000027c0)=[{{0x0, 0x0, &(0x7f0000000a00)=[{&(0x7f0000000900)="913da470640ae70fe168a71ad316e5525ce43547f28d8c56cb5cd246950c2d44a514698b3aebf2b60d933814378b0b9b750dec28bdbeedda6c8af5f3418ff8c43701e5dea492428ecdcf0e8c2a19f60e388b478179256834360c5ee359dbe4fabee36883a8314f0ea64dea3a732dffbe26a02e8327a0f7174a6990389e5b608d5300c271f26b3b37cc88e720a477e5f1aa2751af90d35d72606ac73f72dab39aad418a6335d44c785ba83edc9619a3221ae39ef2fed1657e426fa293a739cd779a6c645b3d29bb184041476e8e6e737e5fa1c4312360", 0xd6}], 0x1, 0x0, 0x0, 0x8000}, 0x3f}, {{&(0x7f0000002240)=@nl=@unspec, 0x80, &(0x7f0000002680)=[{&(0x7f00000022c0)="756a6b1895d55b0b292a3985cd35f28cfa8d5ab20a3448791e47ec9e971be82f993ebd55ec843a76ccd644a71222e57119e6f8866f59ba0b89c4cf71a9ce853f72bd99ac9097baf924ea3e3fbceaf0a0df15deb45ae757832bec56c67c0ad44e0ea5fcbc12f898989e1773427ad180efff1044e98613dab446587dd52a0deacb4074e01d97cd46c6e633ae1c1011fd2123c766e6fea028799cf82a562bd9d52c544241172f684398ac1b", 0xaa}, {&(0x7f0000002440)="c802b7c29c92c7ddcf8b11133e071ae83e8c0b0827764303ad44356d381633ce1fdd31e1641872e8d6b4c1a974d97d", 0x2f}, {&(0x7f0000002540)="446c9b3779f2a3dc39f3a3541d912b01ca9865e4172a83cda910f6b10dd97377212eb5279c", 0x25}], 0x3, &(0x7f0000002700)=[{0xa0, 0x10f, 0x200, "4f483406ed4a2e47550522989e031e3e239b59c5dc988744d266f33171b6d4a8e54f025a1e1be02c21ad9675e29aea96625352eec0db268e5c70b8e22a2bb0e11b9e6d9613d4e8e338194d9a41821db1ef97a16b16e5263d008bb6ce86b1e26f4d59926a9a72bed62192dc96eaa8a033c9ddaf2fc8c5fb9e765e5ff99cc5ae6fa7bc4a4f0abcb9c9745b54449ab38c"}], 0xa0}, 0x1200000}], 0x2, 0x20040000)
sendmsg$IPVS_CMD_DEL_DAEMON(r2, &(0x7f0000000280)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000240)={&(0x7f0000000180)={0x28, 0x0, 0xb30, 0x0, 0x25dfdbfc, {0xa}, [@IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x3ff}, @IPVS_CMD_ATTR_SERVICE={0xc, 0x1, [@IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8}]}]}, 0x28}, 0x1}, 0x0)
ioctl$sock_ifreq(r6, 0x8917, &(0x7f0000000300)={'lo\x00', @ifru_data=&(0x7f00000001c0)="16e667ea25efad95e8e866bb6ef7f6ba94b72b63a28bcb7eafa978bdbe09a4d8"})
getsockopt$inet_int(r4, 0x0, 0x0, &(0x7f0000000600), &(0x7f0000000640)=0x4)
getsockname$unix(r2, &(0x7f0000000680), &(0x7f0000000700)=0x6e)

2018/03/30 13:05:56 executing program 2:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYBLOB="22811e2630b1d0ac3463"], 0x1)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r1, r2, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r3 = getpgid(0xffffffffffffffff)
syz_open_procfs(r3, &(0x7f00000005c0)='net/ip6_tables_targets\x00')
process_vm_writev(r3, &(0x7f0000000180)=[{&(0x7f0000000140)=""/22, 0x16}], 0x1, &(0x7f00000003c0)=[{&(0x7f0000000740)=""/173, 0xad}], 0x1, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
r4 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
setns(r2, 0x0)
r5 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
r6 = dup3(0xffffffffffffffff, r0, 0x80000)
setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8)
syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00')
sendmsg$IPVS_CMD_NEW_DEST(r6, &(0x7f0000000540)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x2000400}, 0xc, &(0x7f0000000500)={&(0x7f0000000240)=ANY=[@ANYPTR], 0x1}, 0x1, 0x0, 0x0, 0x10}, 0x4)
sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10}, 0xc, &(0x7f0000000340)={&(0x7f0000000480)=ANY=[@ANYBLOB='H\x00\x00\x00'], 0x1}, 0x1}, 0x0)
fcntl$setstatus(r1, 0x4, 0x6000)
mq_open(&(0x7f0000000800)=':em1\x00', 0x40, 0x4, &(0x7f0000000840)={0x0, 0x0, 0x9, 0x6, 0x0, 0xff, 0x7})
pwritev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000c00)}], 0x1, 0x0)
ioctl$DRM_IOCTL_AGP_ALLOC(r6, 0xc0206434, &(0x7f0000000440)={0x9dca, <r7=>0x0, 0x10002, 0x4})
ioctl$DRM_IOCTL_AGP_BIND(r5, 0x40106436, &(0x7f00000004c0)={r7, 0x676})
ioctl$sock_ifreq(r5, 0x8917, &(0x7f0000000300)={'lo\x00', @ifru_data=&(0x7f00000001c0)="16e667ea25efad95e8e866bb6ef7f6ba94b72b63a28bcb7eafa978bdbe09a4d8"})
getsockopt$inet_int(r4, 0x0, 0x0, &(0x7f0000000600), &(0x7f0000000640)=0x4)
getsockname$unix(r1, &(0x7f0000000680), &(0x7f0000000700)=0x6e)

2018/03/30 13:05:56 executing program 6:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYBLOB="22811e2630b1d0ac3463"], 0x1)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r1, r2, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = getpgid(0xffffffffffffffff)
syz_open_procfs(r3, &(0x7f00000005c0)='net/ip6_tables_targets\x00')
process_vm_writev(r3, &(0x7f0000000180)=[{&(0x7f0000000140)=""/22, 0x16}], 0x1, &(0x7f00000003c0)=[{&(0x7f0000000740)=""/173, 0xad}], 0x1, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
r4 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
r5 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
r6 = dup3(0xffffffffffffffff, r0, 0x0)
setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8)
syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00')
sendmsg$IPVS_CMD_NEW_DEST(r6, &(0x7f0000000540)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x2000400}, 0xc, &(0x7f0000000500)={&(0x7f0000000240)=ANY=[@ANYPTR], 0x1}, 0x1, 0x0, 0x0, 0x10}, 0x4)
fcntl$setstatus(r1, 0x4, 0x6000)
mq_open(&(0x7f0000000800)=':em1\x00', 0x40, 0x4, &(0x7f0000000840)={0x4000000000000000, 0x0, 0x9, 0x6, 0x0, 0xff, 0x7})
pwritev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000c00)}], 0x1, 0x0)
ioctl$DRM_IOCTL_AGP_ALLOC(r6, 0xc0206434, &(0x7f0000000440)={0x9dca, <r7=>0x0, 0x0, 0x4})
ioctl$DRM_IOCTL_AGP_BIND(r5, 0x40106436, &(0x7f00000004c0)={r7, 0x676})
ioctl$sock_ifreq(r5, 0x8917, &(0x7f0000000300)={'lo\x00', @ifru_data=&(0x7f00000001c0)="16e667ea25efad95e8e866bb6ef7f6ba94b72b63a28bcb7eafa978bdbe09a4d8"})
getsockopt$inet_int(r4, 0x0, 0x0, &(0x7f0000000600), &(0x7f0000000640)=0x4)
getsockname$unix(r1, &(0x7f0000000680), &(0x7f0000000700)=0x6e)

2018/03/30 13:05:56 executing program 1:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYBLOB="22811e2630b1d0ac3463"], 0x1)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r1, r2, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = getpgid(0xffffffffffffffff)
syz_open_procfs(r3, &(0x7f00000005c0)='net/ip6_tables_targets\x00')
process_vm_writev(r3, &(0x7f0000000180), 0x0, &(0x7f00000003c0)=[{&(0x7f0000000740)=""/173, 0xad}], 0x1, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
r4 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
r5 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
r6 = dup3(0xffffffffffffffff, r0, 0x80000)
setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8)
syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00')
fcntl$setstatus(r1, 0x4, 0x6000)
mq_open(&(0x7f0000000800)=':em1\x00', 0x40, 0x4, &(0x7f0000000840)={0x4000000000000000, 0x0, 0x9, 0x6, 0x0, 0xff, 0x7})
pwritev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000c00)}], 0x1, 0x0)
ioctl$DRM_IOCTL_AGP_ALLOC(r6, 0xc0206434, &(0x7f0000000440)={0x9dca, <r7=>0x0, 0x0, 0x4})
ioctl$DRM_IOCTL_AGP_BIND(r5, 0x40106436, &(0x7f00000004c0)={r7, 0x676})
ioctl$sock_ifreq(r5, 0x8917, &(0x7f0000000300)={'lo\x00', @ifru_data=&(0x7f00000001c0)="16e667ea25efad95e8e866bb6ef7f6ba94b72b63a28bcb7eafa978bdbe09a4d8"})
getsockopt$inet_int(r4, 0x0, 0x0, &(0x7f0000000600), &(0x7f0000000640)=0x4)
getsockname$unix(r1, &(0x7f0000000680), &(0x7f0000000700)=0x6e)

2018/03/30 13:05:56 executing program 7:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYBLOB="22811e2630b1d0ac34"], 0x1)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r1, r2, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = getpgid(0xffffffffffffffff)
syz_open_procfs(r3, &(0x7f00000005c0)='net/ip6_tables_targets\x00')
process_vm_writev(r3, &(0x7f0000000180)=[{&(0x7f0000000140)=""/22, 0x16}], 0x1, &(0x7f00000003c0)=[{&(0x7f0000000740)=""/173, 0xad}], 0x1, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
r4 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
r5 = dup3(0xffffffffffffffff, r0, 0x80000)
setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8)
syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00')
fcntl$setstatus(r1, 0x4, 0x6000)
mq_open(&(0x7f0000000800)=':em1\x00', 0x40, 0x4, &(0x7f0000000840)={0x4000000000000000, 0x0, 0x9, 0x6, 0x0, 0xff, 0x7})
pwritev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000c00)}], 0x1, 0x0)
ioctl$DRM_IOCTL_AGP_ALLOC(r5, 0xc0206434, &(0x7f0000000440)={0x9dca, <r6=>0x0, 0x10002, 0x4})
ioctl$DRM_IOCTL_AGP_BIND(r4, 0x40106436, &(0x7f00000004c0)={r6, 0x676})
ioctl$sock_ifreq(r4, 0x8917, &(0x7f0000000300)={'lo\x00', @ifru_data=&(0x7f00000001c0)="16e667ea25efad95e8e866bb6ef7f6ba94b72b63a28bcb7eafa978bdbe09a4d8"})
getsockopt$inet_int(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000600), &(0x7f0000000640)=0x4)
getsockname$unix(r1, &(0x7f0000000680), &(0x7f0000000700)=0x6e)

** 17 printk messages dropped ** [  586.994883] binder: send failed reply for transaction 41692, target dead
2018/03/30 13:05:56 executing program 0:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYBLOB="22811e2630b1d0ac3463"], 0x1)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r1, r2, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = getpgid(0xffffffffffffffff)
syz_open_procfs(r3, &(0x7f00000005c0)='net/ip6_tables_targets\x00')
process_vm_writev(r3, &(0x7f0000000180)=[{&(0x7f0000000140)=""/22, 0x16}], 0x1, &(0x7f00000003c0)=[{&(0x7f0000000740)=""/173, 0xad}], 0x1, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
r4 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
setns(r2, 0x0)
r5 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
r6 = dup3(0xffffffffffffffff, r0, 0x80000)
setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8)
syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00')
sendmsg$IPVS_CMD_NEW_DEST(r6, &(0x7f0000000540)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x2000400}, 0xc, &(0x7f0000000500)={&(0x7f0000000240)=ANY=[@ANYPTR], 0x1}, 0x1, 0x0, 0x0, 0x10}, 0x0)
sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10}, 0xc, &(0x7f0000000340)={&(0x7f0000000480)=ANY=[@ANYBLOB='H\x00\x00\x00'], 0x1}, 0x1}, 0x0)
fcntl$setstatus(r1, 0x4, 0x6000)
mq_open(&(0x7f0000000800)=':em1\x00', 0x40, 0x4, &(0x7f0000000840)={0x4000000000000000, 0x0, 0x9, 0x6, 0x0, 0xff, 0x7})
pwritev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000c00)}], 0x1, 0x0)
ioctl$DRM_IOCTL_AGP_ALLOC(r6, 0xc0206434, &(0x7f0000000440)={0x9dca, <r7=>0x0, 0x10002, 0x4})
ioctl$DRM_IOCTL_AGP_BIND(r5, 0x40106436, &(0x7f00000004c0)={r7, 0x676})
ioctl$sock_ifreq(r5, 0x8917, &(0x7f0000000300)={'lo\x00', @ifru_data=&(0x7f00000001c0)="16e667ea25efad95e8e866bb6ef7f6ba94b72b63a28bcb7eafa978bdbe09a4d8"})
getsockopt$inet_int(r4, 0x0, 0x0, &(0x7f0000000600), &(0x7f0000000640)=0x4)
getsockname$unix(r1, &(0x7f0000000680), &(0x7f0000000700)=0x6e)

2018/03/30 13:05:56 executing program 5:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYBLOB="00811e2630b1d0ac3463"], 0x1)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r1, r2, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
setns(r2, 0x0)
r3 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/loop-control\x00', 0x0, 0x0)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)
r4 = dup(r3)
getsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffff9c, 0x84, 0x6f, &(0x7f0000000340)={<r5=>0x0, 0x3c, &(0x7f00000005c0)=[@in={0x2, 0x4e23, @local={0xac, 0x14, 0x14, 0xaa}}, @in={0x2, 0x4e24, @broadcast=0xffffffff}, @in6={0xa, 0x0, 0x100000000, @loopback={0x0, 0x1}, 0x323d000000000}]}, &(0x7f0000000640)=0xc)
setsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r4, 0x84, 0xa, &(0x7f0000000680)={0xcff3, 0x80000000, 0x3, 0x0, 0x0, 0x66e, 0x5, 0x0, r5}, 0x20)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)
mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x5c831, 0xffffffffffffffff, 0x0)
openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/mls\x00', 0x0, 0x0)
madvise(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x9)
r6 = syz_open_dev$usbmon(&(0x7f0000000040)='/dev/usbmon#\x00', 0x0, 0x80000)
ioctl$KDSKBMODE(0xffffffffffffffff, 0x4b45, &(0x7f0000000080))
getsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r6, 0x84, 0x75, &(0x7f00000000c0)={0x0, 0x6}, &(0x7f0000000100)=0x8)
setsockopt$inet_sctp6_SCTP_AUTH_KEY(r6, 0x84, 0x17, &(0x7f0000000500)=ANY=[], 0x0)
ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)
r7 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
ioctl$TIOCLINUX3(r7, 0x541c, &(0x7f0000000040)=0x3)
ioctl$LOOP_CTL_REMOVE(r3, 0x4c81, 0x0)

** 10 printk messages dropped ** [  587.029635] binder: 29665:29668 got transaction with invalid offset (0, min 24 max 40) or object.
2018/03/30 13:05:56 executing program 4:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
r1 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000002880)='/selinux/avc/cache_stats\x00', 0x0, 0x0)
ioctl$EVIOCSABS20(r1, 0x401845e0, &(0x7f00000028c0)={0x1000, 0x7fff, 0x1ff, 0xffffffff, 0x7, 0x40})
fchdir(r0)
r2 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(r2, &(0x7f0000000080)=ANY=[@ANYBLOB="00811e2630b1d0ac3463"], 0x1)
setsockopt$packet_add_memb(r2, 0x107, 0x1, &(0x7f0000002900)={0x0, 0x1, 0x6}, 0x10)
r3 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r2, r3, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r3, 0x0)
inotify_init1(0x800)
ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
r4 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
setns(r3, 0x8000000)
r5 = socket$nl_xfrm(0x10, 0x3, 0x6)
r6 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
dup3(r3, r0, 0x80000)
setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8)
r7 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00')
sendmsg$IPVS_CMD_NEW_DEST(0xffffffffffffffff, &(0x7f0000000540)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x2000400}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)=ANY=[@ANYBLOB=',\x00\x00\x00'], 0x1}, 0x1, 0x0, 0x0, 0x10}, 0x4)
sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10}, 0xc, &(0x7f0000000340)={&(0x7f0000000480)=ANY=[@ANYBLOB='H\x00\x00\x00'], 0x1}, 0x1}, 0x0)
sendmsg$IPVS_CMD_GET_DEST(r2, &(0x7f0000000880)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f00000005c0)={&(0x7f0000000740)={0x138, r7, 0x208, 0x70bd2b, 0x25dfdbfb, {0x8}, [@IPVS_CMD_ATTR_SERVICE={0x28, 0x1, [@IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@multicast2=0xe0000002}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x3}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x7fff}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x8c6}, @IPVS_CMD_ATTR_DAEMON={0x50, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @remote={0xac, 0x14, 0x14, 0xbb}}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x400}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x10001}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'syz_tun\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x6}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x2}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x30, 0x2, [@IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x2}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv6=@ipv4={[], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0xffffffff}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0xafa6}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x1}, @IPVS_CMD_ATTR_DEST={0x6c, 0x2, [@IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x7}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv4=@remote={0xac, 0x14, 0x14, 0xbb}}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x8}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x1}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x5}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x3}, @IPVS_DEST_ATTR_PORT={0x8, 0x2, 0x4e22}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv6=@mcast2={0xff, 0x2, [], 0x1}}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x10000}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x701a3921}]}]}, 0x138}, 0x1, 0x0, 0x0, 0x90}, 0x4)
fcntl$setstatus(r2, 0x4, 0x6000)
setsockopt$sock_linger(r4, 0x1, 0xd, &(0x7f00000008c0)={0x1, 0x2}, 0x8)
pwritev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000c00)="cfb93447d6feaef9f73c0561e075a8295d43017ab1a157786dcda36c5eec92a4306f284fa7e3ed364cc2da5c08cf7e4030d394520e123eee6d9ab275c91c174b1364fc943b49faefe12f605b5ce6c1400a91210c00477f900aff390901bf594c18557cb38a7d57ac8ded098b96b9dfc125e3bdc9305193f4cd256068baca5208160d820b9e7a043666ba4801cf6d557fc0f97f35c13ec6c0d1fe97ce1af1c17078ef47ab955200836671e402717481d14936b09828fd6f55fda2f11eb4c61b480e941133c0a4c5ec54033d0d174742191754ffe28b093596286a78ea01078337ada8585aa98dcc1143689002e31ccc5b9f5cfd2bbce5683a0f91b395391a60ba8e8f4d3c10c82c71caa74c44c8b0f3e42f1fc264497d5b9dabf309bad7bd", 0x11e}], 0x1, 0x0)
sendmmsg(r5, &(0x7f00000027c0)=[{{0x0, 0x0, &(0x7f0000000a00)=[{&(0x7f0000000900)="913da470640ae70fe168a71ad316e5525ce43547f28d8c56cb5cd246950c2d44a514698b3aebf2b60d933814378b0b9b750dec28bdbeedda6c8af5f3418ff8c43701e5dea492428ecdcf0e8c2a19f60e388b478179256834360c5ee359dbe4fabee36883a8314f0ea64dea3a732dffbe26a02e8327a0f7174a6990389e5b608d5300c271f26b3b37cc88e720a477e5f1aa2751af90d35d72606ac73f72dab39aad418a6335d44c785ba83edc9619a3221ae39ef2fed1657e426fa293a739cd779a6c645b3d29bb184041476e8e6e737e5fa1c4312360", 0xd6}], 0x1, 0x0, 0x0, 0x8000}, 0x3f}, {{&(0x7f0000002240)=@nl=@unspec, 0x80, &(0x7f0000002680)=[{&(0x7f00000022c0)="756a6b1895d55b0b292a3985cd35f28cfa8d5ab20a3448791e47ec9e971be82f993ebd55ec843a76ccd644a71222e57119e6f8866f59ba0b89c4cf71a9ce853f72bd99ac9097baf924ea3e3fbceaf0a0df15deb45ae757832bec56c67c0ad44e0ea5fcbc12f898989e1773427ad180efff1044e98613dab446587dd52a0deacb4074e01d97cd46c6e633ae1c1011fd2123c766e6fea028799cf82a562bd9d52c544241172f684398ac1b", 0xaa}, {&(0x7f0000002440)="c802b7c29c92c7ddcf8b11133e071ae83e8c0b0827764303ad44356d381633ce1fdd31e1641872e8d6b4c1a974d97d", 0x2f}, {&(0x7f0000002540)="446c9b3779f2a3dc39f3a3541d912b01ca9865e4172a83cda910f6b10dd97377212eb5279c", 0x25}], 0x3, &(0x7f0000002700)=[{0xa0, 0x10f, 0x200, "4f483406ed4a2e47550522989e031e3e239b59c5dc988744d266f33171b6d4a8e54f025a1e1be02c21ad9675e29aea96625352eec0db268e5c70b8e22a2bb0e11b9e6d9613d4e8e338194d9a41821db1ef97a16b16e5263d008bb6ce86b1e26f4d59926a9a72bed62192dc96eaa8a033c9ddaf2fc8c5fb9e765e5ff99cc5ae6fa7bc4a4f0abcb9c9745b54449ab38c"}], 0xa0}, 0x1200000}], 0x2, 0x20040000)
sendmsg$IPVS_CMD_DEL_DAEMON(r2, &(0x7f0000000280)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000240)={&(0x7f0000000180)={0x28, 0x0, 0xb30, 0x0, 0x25dfdbfc, {0xa}, [@IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x3ff}, @IPVS_CMD_ATTR_SERVICE={0xc, 0x1, [@IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8}]}]}, 0x28}, 0x1}, 0x0)
ioctl$sock_ifreq(r6, 0x8917, &(0x7f0000000300)={'lo\x00', @ifru_data=&(0x7f00000001c0)="16e667ea25efad95e8e866bb6ef7f6ba94b72b63a28bcb7eafa978bdbe09a4d8"})
getsockopt$inet_int(r4, 0x0, 0x0, &(0x7f0000000600), &(0x7f0000000640)=0x4)
getsockname$unix(r2, &(0x7f0000000680), &(0x7f0000000700)=0x6e)

2018/03/30 13:05:56 executing program 2:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYBLOB="22811e2630b1d0ac3463"], 0x1)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r1, r2, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = getpgid(0xffffffffffffffff)
syz_open_procfs(0x0, &(0x7f00000005c0)='net/ip6_tables_targets\x00')
process_vm_writev(r3, &(0x7f0000000180)=[{&(0x7f0000000140)=""/22, 0x16}], 0x1, &(0x7f00000003c0)=[{&(0x7f0000000740)=""/173, 0xad}], 0x1, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
r4 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
setns(r2, 0x0)
r5 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
r6 = dup3(0xffffffffffffffff, r0, 0x80000)
setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8)
syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00')
sendmsg$IPVS_CMD_NEW_DEST(r6, &(0x7f0000000540)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x2000400}, 0xc, &(0x7f0000000500)={&(0x7f0000000240)=ANY=[@ANYPTR], 0x1}, 0x1, 0x0, 0x0, 0x10}, 0x4)
sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10}, 0xc, &(0x7f0000000340)={&(0x7f0000000480)=ANY=[@ANYBLOB='H\x00\x00\x00'], 0x1}, 0x1}, 0x0)
fcntl$setstatus(r1, 0x4, 0x6000)
mq_open(&(0x7f0000000800)=':em1\x00', 0x40, 0x4, &(0x7f0000000840)={0x0, 0x0, 0x9, 0x6, 0x0, 0xff, 0x7})
pwritev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000c00)}], 0x1, 0x0)
ioctl$DRM_IOCTL_AGP_ALLOC(r6, 0xc0206434, &(0x7f0000000440)={0x9dca, <r7=>0x0, 0x10002, 0x4})
ioctl$DRM_IOCTL_AGP_BIND(r5, 0x40106436, &(0x7f00000004c0)={r7, 0x676})
ioctl$sock_ifreq(r5, 0x8917, &(0x7f0000000300)={'lo\x00', @ifru_data=&(0x7f00000001c0)="16e667ea25efad95e8e866bb6ef7f6ba94b72b63a28bcb7eafa978bdbe09a4d8"})
getsockopt$inet_int(r4, 0x0, 0x0, &(0x7f0000000600), &(0x7f0000000640)=0x4)
getsockname$unix(r1, &(0x7f0000000680), &(0x7f0000000700)=0x6e)

** 20 printk messages dropped ** [  587.106866] binder: 29679:29685 ioctl 40046207 0 returned -16
** 2 printk messages dropped ** [  587.117725] binder: undelivered TRANSACTION_ERROR: 29201
** 8 printk messages dropped ** [  587.148695] binder: undelivered TRANSACTION_COMPLETE
2018/03/30 13:05:56 executing program 3:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[], 0x0)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r1, r2, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
setns(r2, 0x0)
r3 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/loop-control\x00', 0x0, 0x0)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)
r4 = dup(r3)
getsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffff9c, 0x84, 0x6f, &(0x7f0000000340)={<r5=>0x0, 0x3c, &(0x7f00000005c0)=[@in={0x2, 0x4e23, @local={0xac, 0x14, 0x14, 0xaa}}, @in={0x2, 0x4e24, @broadcast=0xffffffff}, @in6={0xa, 0x0, 0x100000000, @loopback={0x0, 0x1}, 0x323d000000000}]}, &(0x7f0000000640)=0xc)
setsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r4, 0x84, 0xa, &(0x7f0000000680)={0xcff3, 0x80000000, 0x3, 0x0, 0x0, 0x66e, 0x5, 0x1, r5}, 0x20)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)
mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x5c831, 0xffffffffffffffff, 0x0)
openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/mls\x00', 0x0, 0x0)
setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(0xffffffffffffffff, 0x10e, 0x2, &(0x7f0000000340)=0xc, 0x4)
madvise(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x9)
r6 = syz_open_dev$usbmon(&(0x7f0000000040)='/dev/usbmon#\x00', 0x0, 0x80000)
ioctl$KDSKBMODE(0xffffffffffffffff, 0x4b45, &(0x7f0000000080))
getsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r6, 0x84, 0x75, &(0x7f00000000c0)={0x0, 0x6}, &(0x7f0000000100)=0x8)
setsockopt$inet_sctp6_SCTP_AUTH_KEY(r6, 0x84, 0x17, &(0x7f0000000500)=ANY=[], 0x0)
ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82)
ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82)
r7 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
ioctl$TIOCLINUX3(r7, 0x541c, &(0x7f0000000040)=0x3)
ioctl$LOOP_CTL_REMOVE(r3, 0x4c81, 0x0)

2018/03/30 13:05:56 executing program 7:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYBLOB="22811e2630b1d0ac3463"], 0x1)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(0xffffffffffffffff, r2, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = getpgid(0xffffffffffffffff)
syz_open_procfs(r3, &(0x7f00000005c0)='net/ip6_tables_targets\x00')
process_vm_writev(r3, &(0x7f0000000180)=[{&(0x7f0000000140)=""/22, 0x16}], 0x1, &(0x7f00000003c0)=[{&(0x7f0000000740)=""/173, 0xad}], 0x1, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
r4 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
r5 = dup3(0xffffffffffffffff, r0, 0x80000)
setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8)
syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00')
fcntl$setstatus(r1, 0x4, 0x6000)
mq_open(&(0x7f0000000800)=':em1\x00', 0x40, 0x4, &(0x7f0000000840)={0x4000000000000000, 0x0, 0x9, 0x6, 0x0, 0xff, 0x7})
pwritev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000c00)}], 0x1, 0x0)
ioctl$DRM_IOCTL_AGP_ALLOC(r5, 0xc0206434, &(0x7f0000000440)={0x9dca, <r6=>0x0, 0x10002, 0x4})
ioctl$DRM_IOCTL_AGP_BIND(r4, 0x40106436, &(0x7f00000004c0)={r6, 0x676})
ioctl$sock_ifreq(r4, 0x8917, &(0x7f0000000300)={'lo\x00', @ifru_data=&(0x7f00000001c0)="16e667ea25efad95e8e866bb6ef7f6ba94b72b63a28bcb7eafa978bdbe09a4d8"})
getsockopt$inet_int(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000600), &(0x7f0000000640)=0x4)
getsockname$unix(r1, &(0x7f0000000680), &(0x7f0000000700)=0x6e)

2018/03/30 13:05:56 executing program 5:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYBLOB="00811e2630b1d0ac3463"], 0x1)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r1, r2, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
setns(r2, 0x0)
r3 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/loop-control\x00', 0x0, 0x0)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)
r4 = dup(r3)
getsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffff9c, 0x84, 0x6f, &(0x7f0000000340)={<r5=>0x0, 0x3c, &(0x7f00000005c0)=[@in={0x2, 0x4e23, @local={0xac, 0x14, 0x14, 0xaa}}, @in={0x2, 0x4e24, @broadcast=0xffffffff}, @in6={0xa, 0x0, 0x100000000, @loopback={0x0, 0x1}, 0x323d000000000}]}, &(0x7f0000000640)=0xc)
setsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r4, 0x84, 0xa, &(0x7f0000000680)={0xcff3, 0x80000000, 0x3, 0x0, 0x0, 0x66e, 0x5, 0x0, r5}, 0x20)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)
mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x5c831, 0xffffffffffffffff, 0x0)
openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/mls\x00', 0x0, 0x0)
madvise(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x9)
r6 = syz_open_dev$usbmon(&(0x7f0000000040)='/dev/usbmon#\x00', 0x0, 0x80000)
ioctl$KDSKBMODE(0xffffffffffffffff, 0x4b45, &(0x7f0000000080))
getsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r6, 0x84, 0x75, &(0x7f00000000c0)={0x0, 0x6}, &(0x7f0000000100)=0x8)
setsockopt$inet_sctp6_SCTP_AUTH_KEY(r6, 0x84, 0x17, &(0x7f0000000500)=ANY=[], 0x0)
ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)
r7 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
ioctl$TIOCLINUX3(r7, 0x541c, &(0x7f0000000040)=0x3)
ioctl$LOOP_CTL_REMOVE(r3, 0x4c81, 0x0)

2018/03/30 13:05:56 executing program 6:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYBLOB="22811e2630b1d0ac3463"], 0x1)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r1, r2, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = getpgid(0xffffffffffffffff)
syz_open_procfs(r3, &(0x7f00000005c0)='net/ip6_tables_targets\x00')
process_vm_writev(r3, &(0x7f0000000180)=[{&(0x7f0000000140)=""/22, 0x16}], 0x1, &(0x7f00000003c0)=[{&(0x7f0000000740)=""/173, 0xad}], 0x1, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
r4 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
r5 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
r6 = dup3(0xffffffffffffffff, r0, 0x0)
setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8)
syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00')
sendmsg$IPVS_CMD_NEW_DEST(r6, &(0x7f0000000540)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x2000400}, 0xc, &(0x7f0000000500)={&(0x7f0000000240)=ANY=[@ANYPTR], 0x1}, 0x1, 0x0, 0x0, 0x10}, 0x4)
fcntl$setstatus(r1, 0x4, 0x6000)
mq_open(&(0x7f0000000800)=':em1\x00', 0x40, 0x4, &(0x7f0000000840)={0x4000000000000000, 0x0, 0x9, 0x6, 0x0, 0xff, 0x7})
pwritev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000c00)}], 0x1, 0x0)
ioctl$DRM_IOCTL_AGP_ALLOC(r6, 0xc0206434, &(0x7f0000000440)={0x9dca, <r7=>0x0, 0x10002})
ioctl$DRM_IOCTL_AGP_BIND(r5, 0x40106436, &(0x7f00000004c0)={r7, 0x676})
ioctl$sock_ifreq(r5, 0x8917, &(0x7f0000000300)={'lo\x00', @ifru_data=&(0x7f00000001c0)="16e667ea25efad95e8e866bb6ef7f6ba94b72b63a28bcb7eafa978bdbe09a4d8"})
getsockopt$inet_int(r4, 0x0, 0x0, &(0x7f0000000600), &(0x7f0000000640)=0x4)
getsockname$unix(r1, &(0x7f0000000680), &(0x7f0000000700)=0x6e)

2018/03/30 13:05:56 executing program 1:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYBLOB="22811e2630b1d0ac3463"], 0x1)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r1, r2, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = getpgid(0xffffffffffffffff)
syz_open_procfs(r3, &(0x7f00000005c0)='net/ip6_tables_targets\x00')
process_vm_writev(r3, &(0x7f0000000180), 0x0, &(0x7f00000003c0)=[{&(0x7f0000000740)=""/173, 0xad}], 0x1, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
r4 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
r5 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
r6 = dup3(0xffffffffffffffff, r0, 0x80000)
setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8)
syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00')
fcntl$setstatus(r1, 0x4, 0x6000)
mq_open(&(0x7f0000000800)=':em1\x00', 0x40, 0x4, &(0x7f0000000840)={0x4000000000000000, 0x0, 0x9, 0x6, 0x0, 0xff, 0x7})
pwritev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000c00)}], 0x1, 0x0)
ioctl$DRM_IOCTL_AGP_ALLOC(r6, 0xc0206434, &(0x7f0000000440)={0x9dca, <r7=>0x0, 0x0, 0x4})
ioctl$DRM_IOCTL_AGP_BIND(r5, 0x40106436, &(0x7f00000004c0)={r7, 0x676})
ioctl$sock_ifreq(r5, 0x8917, &(0x7f0000000300)={'lo\x00', @ifru_data=&(0x7f00000001c0)="16e667ea25efad95e8e866bb6ef7f6ba94b72b63a28bcb7eafa978bdbe09a4d8"})
getsockopt$inet_int(r4, 0x0, 0x0, &(0x7f0000000600), &(0x7f0000000640)=0x4)
getsockname$unix(r1, &(0x7f0000000680), &(0x7f0000000700)=0x6e)

2018/03/30 13:05:56 executing program 2:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYBLOB="22811e2630b1d0ac3463"], 0x1)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r1, r2, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = getpgid(0xffffffffffffffff)
syz_open_procfs(0x0, &(0x7f00000005c0)='net/ip6_tables_targets\x00')
process_vm_writev(r3, &(0x7f0000000180)=[{&(0x7f0000000140)=""/22, 0x16}], 0x1, &(0x7f00000003c0)=[{&(0x7f0000000740)=""/173, 0xad}], 0x1, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
r4 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
setns(r2, 0x0)
r5 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
r6 = dup3(0xffffffffffffffff, r0, 0x80000)
setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8)
syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00')
sendmsg$IPVS_CMD_NEW_DEST(r6, &(0x7f0000000540)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x2000400}, 0xc, &(0x7f0000000500)={&(0x7f0000000240)=ANY=[@ANYPTR], 0x1}, 0x1, 0x0, 0x0, 0x10}, 0x4)
sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10}, 0xc, &(0x7f0000000340)={&(0x7f0000000480)=ANY=[@ANYBLOB='H\x00\x00\x00'], 0x1}, 0x1}, 0x0)
fcntl$setstatus(r1, 0x4, 0x6000)
mq_open(&(0x7f0000000800)=':em1\x00', 0x40, 0x4, &(0x7f0000000840)={0x0, 0x0, 0x9, 0x6, 0x0, 0xff, 0x7})
pwritev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000c00)}], 0x1, 0x0)
ioctl$DRM_IOCTL_AGP_ALLOC(r6, 0xc0206434, &(0x7f0000000440)={0x9dca, <r7=>0x0, 0x10002, 0x4})
ioctl$DRM_IOCTL_AGP_BIND(r5, 0x40106436, &(0x7f00000004c0)={r7, 0x676})
ioctl$sock_ifreq(r5, 0x8917, &(0x7f0000000300)={'lo\x00', @ifru_data=&(0x7f00000001c0)="16e667ea25efad95e8e866bb6ef7f6ba94b72b63a28bcb7eafa978bdbe09a4d8"})
getsockopt$inet_int(r4, 0x0, 0x0, &(0x7f0000000600), &(0x7f0000000640)=0x4)
getsockname$unix(r1, &(0x7f0000000680), &(0x7f0000000700)=0x6e)

2018/03/30 13:05:56 executing program 4:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
r1 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000002880)='/selinux/avc/cache_stats\x00', 0x0, 0x0)
ioctl$EVIOCSABS20(r1, 0x401845e0, &(0x7f00000028c0)={0x1000, 0x7fff, 0x1ff, 0xffffffff, 0x7, 0x40})
fchdir(r0)
r2 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(r2, &(0x7f0000000080)=ANY=[@ANYBLOB="00811e2630b1d0ac3463"], 0x1)
setsockopt$packet_add_memb(r2, 0x107, 0x1, &(0x7f0000002900)={0x0, 0x1, 0x6}, 0x10)
r3 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r2, r3, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r3, 0x0)
inotify_init1(0x800)
ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
r4 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
setns(r3, 0x8000000)
r5 = socket$nl_xfrm(0x10, 0x3, 0x6)
r6 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
dup3(r3, r0, 0x80000)
setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8)
r7 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00')
sendmsg$IPVS_CMD_NEW_DEST(0xffffffffffffffff, &(0x7f0000000540)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x2000400}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)=ANY=[@ANYBLOB=',\x00\x00\x00'], 0x1}, 0x1, 0x0, 0x0, 0x10}, 0x4)
sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10}, 0xc, &(0x7f0000000340)={&(0x7f0000000480)=ANY=[@ANYBLOB='H\x00\x00\x00'], 0x1}, 0x1}, 0x0)
sendmsg$IPVS_CMD_GET_DEST(r2, &(0x7f0000000880)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f00000005c0)={&(0x7f0000000740)={0x138, r7, 0x208, 0x70bd2b, 0x25dfdbfb, {0x8}, [@IPVS_CMD_ATTR_SERVICE={0x28, 0x1, [@IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@multicast2=0xe0000002}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x3}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x7fff}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x8c6}, @IPVS_CMD_ATTR_DAEMON={0x50, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @remote={0xac, 0x14, 0x14, 0xbb}}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x400}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x10001}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'syz_tun\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x6}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x2}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x30, 0x2, [@IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x2}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv6=@ipv4={[], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0xffffffff}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0xafa6}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x1}, @IPVS_CMD_ATTR_DEST={0x6c, 0x2, [@IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x7}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv4=@remote={0xac, 0x14, 0x14, 0xbb}}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x8}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x1}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x5}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x3}, @IPVS_DEST_ATTR_PORT={0x8, 0x2, 0x4e22}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv6=@mcast2={0xff, 0x2, [], 0x1}}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x10000}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x701a3921}]}]}, 0x138}, 0x1, 0x0, 0x0, 0x90}, 0x4)
fcntl$setstatus(r2, 0x4, 0x6000)
setsockopt$sock_linger(r4, 0x1, 0xd, &(0x7f00000008c0)={0x1, 0x2}, 0x8)
pwritev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000c00)="cfb93447d6feaef9f73c0561e075a8295d43017ab1a157786dcda36c5eec92a4306f284fa7e3ed364cc2da5c08cf7e4030d394520e123eee6d9ab275c91c174b1364fc943b49faefe12f605b5ce6c1400a91210c00477f900aff390901bf594c18557cb38a7d57ac8ded098b96b9dfc125e3bdc9305193f4cd256068baca5208160d820b9e7a043666ba4801cf6d557fc0f97f35c13ec6c0d1fe97ce1af1c17078ef47ab955200836671e402717481d14936b09828fd6f55fda2f11eb4c61b480e941133c0a4c5ec54033d0d174742191754ffe28b093596286a78ea01078337ada8585aa98dcc1143689002e31ccc5b9f5cfd2bbce5683a0f91b395391a60ba8e8f4d3c10c82c71caa74c44c8b0f3e42f1fc264497d5b9dabf309bad7bd", 0x11e}], 0x1, 0x0)
sendmmsg(r5, &(0x7f00000027c0)=[{{0x0, 0x0, &(0x7f0000000a00)=[{&(0x7f0000000900)="913da470640ae70fe168a71ad316e5525ce43547f28d8c56cb5cd246950c2d44a514698b3aebf2b60d933814378b0b9b750dec28bdbeedda6c8af5f3418ff8c43701e5dea492428ecdcf0e8c2a19f60e388b478179256834360c5ee359dbe4fabee36883a8314f0ea64dea3a732dffbe26a02e8327a0f7174a6990389e5b608d5300c271f26b3b37cc88e720a477e5f1aa2751af90d35d72606ac73f72dab39aad418a6335d44c785ba83edc9619a3221ae39ef2fed1657e426fa293a739cd779a6c645b3d29bb184041476e8e6e737e5fa1c4312360", 0xd6}], 0x1, 0x0, 0x0, 0x8000}, 0x3f}, {{&(0x7f0000002240)=@nl=@unspec, 0x80, &(0x7f0000002680)=[{&(0x7f00000022c0)="756a6b1895d55b0b292a3985cd35f28cfa8d5ab20a3448791e47ec9e971be82f993ebd55ec843a76ccd644a71222e57119e6f8866f59ba0b89c4cf71a9ce853f72bd99ac9097baf924ea3e3fbceaf0a0df15deb45ae757832bec56c67c0ad44e0ea5fcbc12f898989e1773427ad180efff1044e98613dab446587dd52a0deacb4074e01d97cd46c6e633ae1c1011fd2123c766e6fea028799cf82a562bd9d52c544241172f684398ac1b", 0xaa}, {&(0x7f0000002440)="c802b7c29c92c7ddcf8b11133e071ae83e8c0b0827764303ad44356d381633ce1fdd31e1641872e8d6b4c1a974d97d", 0x2f}, {&(0x7f0000002540)="446c9b3779f2a3dc39f3a3541d912b01ca9865e4172a83cda910f6b10dd97377212eb5279c", 0x25}], 0x3, &(0x7f0000002700)=[{0xa0, 0x10f, 0x200, "4f483406ed4a2e47550522989e031e3e239b59c5dc988744d266f33171b6d4a8e54f025a1e1be02c21ad9675e29aea96625352eec0db268e5c70b8e22a2bb0e11b9e6d9613d4e8e338194d9a41821db1ef97a16b16e5263d008bb6ce86b1e26f4d59926a9a72bed62192dc96eaa8a033c9ddaf2fc8c5fb9e765e5ff99cc5ae6fa7bc4a4f0abcb9c9745b54449ab38c"}], 0xa0}, 0x1200000}], 0x2, 0x20040000)
sendmsg$IPVS_CMD_DEL_DAEMON(r2, &(0x7f0000000280)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000240)={&(0x7f0000000180)={0x28, 0x0, 0xb30, 0x0, 0x25dfdbfc, {0xa}, [@IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x3ff}, @IPVS_CMD_ATTR_SERVICE={0xc, 0x1, [@IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8}]}]}, 0x28}, 0x1}, 0x0)
ioctl$sock_ifreq(r6, 0x8917, &(0x7f0000000300)={'lo\x00', @ifru_data=&(0x7f00000001c0)="16e667ea25efad95e8e866bb6ef7f6ba94b72b63a28bcb7eafa978bdbe09a4d8"})
getsockopt$inet_int(r4, 0x0, 0x0, &(0x7f0000000600), &(0x7f0000000640)=0x4)
getsockname$unix(r2, &(0x7f0000000680), &(0x7f0000000700)=0x6e)

2018/03/30 13:05:56 executing program 0:
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYBLOB="22811e2630b1d0ac3463"], 0x1)
r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r0, r1, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
r2 = getpgid(0xffffffffffffffff)
syz_open_procfs(r2, &(0x7f00000005c0)='net/ip6_tables_targets\x00')
process_vm_writev(r2, &(0x7f0000000180)=[{&(0x7f0000000140)=""/22, 0x16}], 0x1, &(0x7f00000003c0)=[{&(0x7f0000000740)=""/173, 0xad}], 0x1, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
r3 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
setns(r1, 0x0)
r4 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
r5 = dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000)
setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8)
syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00')
sendmsg$IPVS_CMD_NEW_DEST(r5, &(0x7f0000000540)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x2000400}, 0xc, &(0x7f0000000500)={&(0x7f0000000240)=ANY=[@ANYPTR], 0x1}, 0x1, 0x0, 0x0, 0x10}, 0x0)
sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10}, 0xc, &(0x7f0000000340)={&(0x7f0000000480)=ANY=[@ANYBLOB='H\x00\x00\x00'], 0x1}, 0x1}, 0x0)
fcntl$setstatus(r0, 0x4, 0x6000)
mq_open(&(0x7f0000000800)=':em1\x00', 0x40, 0x4, &(0x7f0000000840)={0x4000000000000000, 0x0, 0x9, 0x6, 0x0, 0xff, 0x7})
pwritev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000c00)}], 0x1, 0x0)
ioctl$DRM_IOCTL_AGP_ALLOC(r5, 0xc0206434, &(0x7f0000000440)={0x9dca, <r6=>0x0, 0x10002, 0x4})
ioctl$DRM_IOCTL_AGP_BIND(r4, 0x40106436, &(0x7f00000004c0)={r6, 0x676})
ioctl$sock_ifreq(r4, 0x8917, &(0x7f0000000300)={'lo\x00', @ifru_data=&(0x7f00000001c0)="16e667ea25efad95e8e866bb6ef7f6ba94b72b63a28bcb7eafa978bdbe09a4d8"})
getsockopt$inet_int(r3, 0x0, 0x0, &(0x7f0000000600), &(0x7f0000000640)=0x4)
getsockname$unix(r0, &(0x7f0000000680), &(0x7f0000000700)=0x6e)

** 7 printk messages dropped ** [  587.184265] binder: 29698:29699 got transaction with invalid offset (0, min 24 max 40) or object.
[  587.184361] binder: 29698:29699 transaction failed 29201/-22, size 40-16 line 3197
[  587.185628] binder: 29694:29697 got transaction with invalid offset (0, min 24 max 40) or object.
[  587.185714] binder: 29694:29697 transaction failed 29201/-22, size 40-16 line 3197
[  587.189160] binder: undelivered TRANSACTION_ERROR: 29201
2018/03/30 13:05:56 executing program 5:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYBLOB="00811e2630b1d0ac3463"], 0x1)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r1, r2, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
setns(r2, 0x0)
r3 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/loop-control\x00', 0x0, 0x0)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)
r4 = dup(r3)
getsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffff9c, 0x84, 0x6f, &(0x7f0000000340)={<r5=>0x0, 0x3c, &(0x7f00000005c0)=[@in={0x2, 0x4e23, @local={0xac, 0x14, 0x14, 0xaa}}, @in={0x2, 0x4e24, @broadcast=0xffffffff}, @in6={0xa, 0x0, 0x100000000, @loopback={0x0, 0x1}, 0x323d000000000}]}, &(0x7f0000000640)=0xc)
setsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r4, 0x84, 0xa, &(0x7f0000000680)={0xcff3, 0x80000000, 0x3, 0x0, 0x0, 0x66e, 0x5, 0x0, r5}, 0x20)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)
mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x5c831, 0xffffffffffffffff, 0x0)
openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/mls\x00', 0x0, 0x0)
madvise(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x9)
r6 = syz_open_dev$usbmon(&(0x7f0000000040)='/dev/usbmon#\x00', 0x0, 0x80000)
ioctl$KDSKBMODE(0xffffffffffffffff, 0x4b45, &(0x7f0000000080))
getsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r6, 0x84, 0x75, &(0x7f00000000c0)={0x0, 0x6}, &(0x7f0000000100)=0x8)
setsockopt$inet_sctp6_SCTP_AUTH_KEY(r6, 0x84, 0x17, &(0x7f0000000500)=ANY=[], 0x0)
ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)
r7 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
ioctl$TIOCLINUX3(r7, 0x541c, &(0x7f0000000040)=0x3)
ioctl$LOOP_CTL_REMOVE(r3, 0x4c81, 0x0)

2018/03/30 13:05:56 executing program 6:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYBLOB="22811e2630b1d0ac3463"], 0x1)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r1, r2, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = getpgid(0xffffffffffffffff)
syz_open_procfs(r3, &(0x7f00000005c0)='net/ip6_tables_targets\x00')
process_vm_writev(r3, &(0x7f0000000180)=[{&(0x7f0000000140)=""/22, 0x16}], 0x1, &(0x7f00000003c0)=[{&(0x7f0000000740)=""/173, 0xad}], 0x1, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
r4 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
r5 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
r6 = dup3(0xffffffffffffffff, r0, 0x0)
setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8)
syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00')
sendmsg$IPVS_CMD_NEW_DEST(r6, &(0x7f0000000540)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x2000400}, 0xc, &(0x7f0000000500)={&(0x7f0000000240)=ANY=[@ANYPTR], 0x1}, 0x1, 0x0, 0x0, 0x10}, 0x4)
fcntl$setstatus(r1, 0x4, 0x6000)
mq_open(&(0x7f0000000800)=':em1\x00', 0x40, 0x4, &(0x7f0000000840)={0x4000000000000000, 0x0, 0x9, 0x6, 0x0, 0xff, 0x7})
pwritev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000c00)}], 0x1, 0x0)
ioctl$DRM_IOCTL_AGP_ALLOC(r6, 0xc0206434, &(0x7f0000000440)={0x9dca, <r7=>0x0, 0x10002})
ioctl$DRM_IOCTL_AGP_BIND(r5, 0x40106436, &(0x7f00000004c0)={r7, 0x676})
ioctl$sock_ifreq(r5, 0x8917, &(0x7f0000000300)={'lo\x00', @ifru_data=&(0x7f00000001c0)="16e667ea25efad95e8e866bb6ef7f6ba94b72b63a28bcb7eafa978bdbe09a4d8"})
getsockopt$inet_int(r4, 0x0, 0x0, &(0x7f0000000600), &(0x7f0000000640)=0x4)
getsockname$unix(r1, &(0x7f0000000680), &(0x7f0000000700)=0x6e)

[  587.207235] binder: undelivered TRANSACTION_ERROR: 29201
** 18 printk messages dropped ** [  587.268650] binder: BINDER_SET_CONTEXT_MGR already set
2018/03/30 13:05:56 executing program 7:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYBLOB="22811e2630b1d0ac3463"], 0x1)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(0xffffffffffffffff, r2, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = getpgid(0xffffffffffffffff)
syz_open_procfs(r3, &(0x7f00000005c0)='net/ip6_tables_targets\x00')
process_vm_writev(r3, &(0x7f0000000180)=[{&(0x7f0000000140)=""/22, 0x16}], 0x1, &(0x7f00000003c0)=[{&(0x7f0000000740)=""/173, 0xad}], 0x1, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
r4 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
r5 = dup3(0xffffffffffffffff, r0, 0x80000)
setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8)
syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00')
fcntl$setstatus(r1, 0x4, 0x6000)
mq_open(&(0x7f0000000800)=':em1\x00', 0x40, 0x4, &(0x7f0000000840)={0x4000000000000000, 0x0, 0x9, 0x6, 0x0, 0xff, 0x7})
pwritev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000c00)}], 0x1, 0x0)
ioctl$DRM_IOCTL_AGP_ALLOC(r5, 0xc0206434, &(0x7f0000000440)={0x9dca, <r6=>0x0, 0x10002, 0x4})
ioctl$DRM_IOCTL_AGP_BIND(r4, 0x40106436, &(0x7f00000004c0)={r6, 0x676})
ioctl$sock_ifreq(r4, 0x8917, &(0x7f0000000300)={'lo\x00', @ifru_data=&(0x7f00000001c0)="16e667ea25efad95e8e866bb6ef7f6ba94b72b63a28bcb7eafa978bdbe09a4d8"})
getsockopt$inet_int(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000600), &(0x7f0000000640)=0x4)
getsockname$unix(r1, &(0x7f0000000680), &(0x7f0000000700)=0x6e)

2018/03/30 13:05:56 executing program 3:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[], 0x0)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r1, r2, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
setns(r2, 0x0)
r3 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/loop-control\x00', 0x0, 0x0)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)
r4 = dup(r3)
getsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffff9c, 0x84, 0x6f, &(0x7f0000000340)={<r5=>0x0, 0x3c, &(0x7f00000005c0)=[@in={0x2, 0x4e23, @local={0xac, 0x14, 0x14, 0xaa}}, @in={0x2, 0x4e24, @broadcast=0xffffffff}, @in6={0xa, 0x0, 0x100000000, @loopback={0x0, 0x1}, 0x323d000000000}]}, &(0x7f0000000640)=0xc)
setsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r4, 0x84, 0xa, &(0x7f0000000680)={0xcff3, 0x80000000, 0x3, 0x0, 0x0, 0x66e, 0x5, 0x1, r5}, 0x20)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)
mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x5c831, 0xffffffffffffffff, 0x0)
openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/mls\x00', 0x0, 0x0)
setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(0xffffffffffffffff, 0x10e, 0x2, &(0x7f0000000340)=0xc, 0x4)
madvise(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x9)
r6 = syz_open_dev$usbmon(&(0x7f0000000040)='/dev/usbmon#\x00', 0x0, 0x80000)
ioctl$KDSKBMODE(0xffffffffffffffff, 0x4b45, &(0x7f0000000080))
getsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r6, 0x84, 0x75, &(0x7f00000000c0)={0x0, 0x6}, &(0x7f0000000100)=0x8)
setsockopt$inet_sctp6_SCTP_AUTH_KEY(r6, 0x84, 0x17, &(0x7f0000000500)=ANY=[], 0x0)
ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82)
ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82)
r7 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
ioctl$TIOCLINUX3(r7, 0x541c, &(0x7f0000000040)=0x3)
ioctl$LOOP_CTL_REMOVE(r3, 0x4c81, 0x0)

2018/03/30 13:05:56 executing program 1:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYBLOB="22811e2630b1d0ac3463"], 0x1)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r1, r2, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = getpgid(0xffffffffffffffff)
syz_open_procfs(r3, &(0x7f00000005c0)='net/ip6_tables_targets\x00')
process_vm_writev(r3, &(0x7f0000000180), 0x0, &(0x7f00000003c0)=[{&(0x7f0000000740)=""/173, 0xad}], 0x1, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
r4 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
r5 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
r6 = dup3(0xffffffffffffffff, r0, 0x80000)
setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8)
syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00')
fcntl$setstatus(r1, 0x4, 0x6000)
mq_open(&(0x7f0000000800)=':em1\x00', 0x40, 0x4, &(0x7f0000000840)={0x4000000000000000, 0x0, 0x9, 0x6, 0x0, 0xff, 0x7})
pwritev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000c00)}], 0x1, 0x0)
ioctl$DRM_IOCTL_AGP_ALLOC(r6, 0xc0206434, &(0x7f0000000440)={0x9dca, <r7=>0x0, 0x0, 0x4})
ioctl$DRM_IOCTL_AGP_BIND(r5, 0x40106436, &(0x7f00000004c0)={r7, 0x676})
ioctl$sock_ifreq(r5, 0x8917, &(0x7f0000000300)={'lo\x00', @ifru_data=&(0x7f00000001c0)="16e667ea25efad95e8e866bb6ef7f6ba94b72b63a28bcb7eafa978bdbe09a4d8"})
getsockopt$inet_int(r4, 0x0, 0x0, &(0x7f0000000600), &(0x7f0000000640)=0x4)
getsockname$unix(r1, &(0x7f0000000680), &(0x7f0000000700)=0x6e)

** 11 printk messages dropped ** [  587.301992] binder: 29712:29719 transaction failed 29201/-22, size 40-16 line 3197
** 2 printk messages dropped ** [  587.306215] binder: undelivered TRANSACTION_COMPLETE
** 1 printk messages dropped ** [  587.316547] binder: send failed reply for transaction 41748, target dead
[  587.317049] binder: undelivered TRANSACTION_ERROR: 29201
** 9 printk messages dropped ** [  587.372133] binder: 29730:29734 transaction failed 29201/-22, size 40-16 line 3197
** 3 printk messages dropped ** [  587.380686] binder: 29733:29738 transaction failed 29189/-3, size 40-16 line 3134
2018/03/30 13:05:56 executing program 4:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
r1 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000002880)='/selinux/avc/cache_stats\x00', 0x0, 0x0)
ioctl$EVIOCSABS20(r1, 0x401845e0, &(0x7f00000028c0)={0x1000, 0x7fff, 0x1ff, 0xffffffff, 0x7, 0x40})
fchdir(r0)
r2 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(r2, &(0x7f0000000080)=ANY=[@ANYBLOB="00811e2630b1d0ac3463"], 0x1)
setsockopt$packet_add_memb(r2, 0x107, 0x1, &(0x7f0000002900)={0x0, 0x1, 0x6}, 0x10)
r3 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r2, r3, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r3, 0x0)
inotify_init1(0x800)
ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
r4 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
setns(r3, 0x8000000)
r5 = socket$nl_xfrm(0x10, 0x3, 0x6)
r6 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
dup3(r3, r0, 0x80000)
setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8)
r7 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00')
sendmsg$IPVS_CMD_NEW_DEST(0xffffffffffffffff, &(0x7f0000000540)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x2000400}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)=ANY=[@ANYBLOB=',\x00\x00\x00'], 0x1}, 0x1, 0x0, 0x0, 0x10}, 0x4)
sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10}, 0xc, &(0x7f0000000340)={&(0x7f0000000480)=ANY=[@ANYBLOB='H\x00\x00\x00'], 0x1}, 0x1}, 0x0)
sendmsg$IPVS_CMD_GET_DEST(r2, &(0x7f0000000880)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f00000005c0)={&(0x7f0000000740)={0x138, r7, 0x208, 0x70bd2b, 0x25dfdbfb, {0x8}, [@IPVS_CMD_ATTR_SERVICE={0x28, 0x1, [@IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@multicast2=0xe0000002}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x3}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x7fff}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x8c6}, @IPVS_CMD_ATTR_DAEMON={0x50, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @remote={0xac, 0x14, 0x14, 0xbb}}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x400}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x10001}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'syz_tun\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x6}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x2}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x30, 0x2, [@IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x2}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv6=@ipv4={[], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0xffffffff}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0xafa6}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x1}, @IPVS_CMD_ATTR_DEST={0x6c, 0x2, [@IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x7}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv4=@remote={0xac, 0x14, 0x14, 0xbb}}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x8}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x1}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x5}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x3}, @IPVS_DEST_ATTR_PORT={0x8, 0x2, 0x4e22}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv6=@mcast2={0xff, 0x2, [], 0x1}}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x10000}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x701a3921}]}]}, 0x138}, 0x1, 0x0, 0x0, 0x90}, 0x4)
fcntl$setstatus(r2, 0x4, 0x6000)
setsockopt$sock_linger(r4, 0x1, 0xd, &(0x7f00000008c0)={0x1, 0x2}, 0x8)
pwritev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000c00)="cfb93447d6feaef9f73c0561e075a8295d43017ab1a157786dcda36c5eec92a4306f284fa7e3ed364cc2da5c08cf7e4030d394520e123eee6d9ab275c91c174b1364fc943b49faefe12f605b5ce6c1400a91210c00477f900aff390901bf594c18557cb38a7d57ac8ded098b96b9dfc125e3bdc9305193f4cd256068baca5208160d820b9e7a043666ba4801cf6d557fc0f97f35c13ec6c0d1fe97ce1af1c17078ef47ab955200836671e402717481d14936b09828fd6f55fda2f11eb4c61b480e941133c0a4c5ec54033d0d174742191754ffe28b093596286a78ea01078337ada8585aa98dcc1143689002e31ccc5b9f5cfd2bbce5683a0f91b395391a60ba8e8f4d3c10c82c71caa74c44c8b0f3e42f1fc264497d5b9dabf309bad7bd", 0x11e}], 0x1, 0x0)
sendmmsg(r5, &(0x7f00000027c0)=[{{0x0, 0x0, &(0x7f0000000a00)=[{&(0x7f0000000900)="913da470640ae70fe168a71ad316e5525ce43547f28d8c56cb5cd246950c2d44a514698b3aebf2b60d933814378b0b9b750dec28bdbeedda6c8af5f3418ff8c43701e5dea492428ecdcf0e8c2a19f60e388b478179256834360c5ee359dbe4fabee36883a8314f0ea64dea3a732dffbe26a02e8327a0f7174a6990389e5b608d5300c271f26b3b37cc88e720a477e5f1aa2751af90d35d72606ac73f72dab39aad418a6335d44c785ba83edc9619a3221ae39ef2fed1657e426fa293a739cd779a6c645b3d29bb184041476e8e6e737e5fa1c4312360", 0xd6}], 0x1, 0x0, 0x0, 0x8000}, 0x3f}, {{&(0x7f0000002240)=@nl=@unspec, 0x80, &(0x7f0000002680)=[{&(0x7f00000022c0)="756a6b1895d55b0b292a3985cd35f28cfa8d5ab20a3448791e47ec9e971be82f993ebd55ec843a76ccd644a71222e57119e6f8866f59ba0b89c4cf71a9ce853f72bd99ac9097baf924ea3e3fbceaf0a0df15deb45ae757832bec56c67c0ad44e0ea5fcbc12f898989e1773427ad180efff1044e98613dab446587dd52a0deacb4074e01d97cd46c6e633ae1c1011fd2123c766e6fea028799cf82a562bd9d52c544241172f684398ac1b", 0xaa}, {&(0x7f0000002440)="c802b7c29c92c7ddcf8b11133e071ae83e8c0b0827764303ad44356d381633ce1fdd31e1641872e8d6b4c1a974d97d", 0x2f}, {&(0x7f0000002540)="446c9b3779f2a3dc39f3a3541d912b01ca9865e4172a83cda910f6b10dd97377212eb5279c", 0x25}], 0x3, &(0x7f0000002700)=[{0xa0, 0x10f, 0x200, "4f483406ed4a2e47550522989e031e3e239b59c5dc988744d266f33171b6d4a8e54f025a1e1be02c21ad9675e29aea96625352eec0db268e5c70b8e22a2bb0e11b9e6d9613d4e8e338194d9a41821db1ef97a16b16e5263d008bb6ce86b1e26f4d59926a9a72bed62192dc96eaa8a033c9ddaf2fc8c5fb9e765e5ff99cc5ae6fa7bc4a4f0abcb9c9745b54449ab38c"}], 0xa0, 0x800}}], 0x2, 0x20040000)
sendmsg$IPVS_CMD_DEL_DAEMON(r2, &(0x7f0000000280)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000240)={&(0x7f0000000180)={0x28, 0x0, 0xb30, 0x0, 0x25dfdbfc, {0xa}, [@IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x3ff}, @IPVS_CMD_ATTR_SERVICE={0xc, 0x1, [@IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8}]}]}, 0x28}, 0x1}, 0x0)
ioctl$sock_ifreq(r6, 0x8917, &(0x7f0000000300)={'lo\x00', @ifru_data=&(0x7f00000001c0)="16e667ea25efad95e8e866bb6ef7f6ba94b72b63a28bcb7eafa978bdbe09a4d8"})
getsockopt$inet_int(r4, 0x0, 0x0, &(0x7f0000000600), &(0x7f0000000640)=0x4)
getsockname$unix(r2, &(0x7f0000000680), &(0x7f0000000700)=0x6e)

2018/03/30 13:05:56 executing program 6:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYBLOB="22811e2630b1d0ac3463"], 0x1)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r1, r2, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = getpgid(0xffffffffffffffff)
syz_open_procfs(r3, &(0x7f00000005c0)='net/ip6_tables_targets\x00')
process_vm_writev(r3, &(0x7f0000000180)=[{&(0x7f0000000140)=""/22, 0x16}], 0x1, &(0x7f00000003c0)=[{&(0x7f0000000740)=""/173, 0xad}], 0x1, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
r4 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
r5 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
r6 = dup3(0xffffffffffffffff, r0, 0x0)
setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8)
syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00')
sendmsg$IPVS_CMD_NEW_DEST(r6, &(0x7f0000000540)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x2000400}, 0xc, &(0x7f0000000500)={&(0x7f0000000240)=ANY=[@ANYPTR], 0x1}, 0x1, 0x0, 0x0, 0x10}, 0x4)
fcntl$setstatus(r1, 0x4, 0x6000)
mq_open(&(0x7f0000000800)=':em1\x00', 0x40, 0x4, &(0x7f0000000840)={0x4000000000000000, 0x0, 0x9, 0x6, 0x0, 0xff, 0x7})
pwritev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000c00)}], 0x1, 0x0)
ioctl$DRM_IOCTL_AGP_ALLOC(r6, 0xc0206434, &(0x7f0000000440)={0x9dca, <r7=>0x0, 0x10002})
ioctl$DRM_IOCTL_AGP_BIND(r5, 0x40106436, &(0x7f00000004c0)={r7, 0x676})
ioctl$sock_ifreq(r5, 0x8917, &(0x7f0000000300)={'lo\x00', @ifru_data=&(0x7f00000001c0)="16e667ea25efad95e8e866bb6ef7f6ba94b72b63a28bcb7eafa978bdbe09a4d8"})
getsockopt$inet_int(r4, 0x0, 0x0, &(0x7f0000000600), &(0x7f0000000640)=0x4)
getsockname$unix(r1, &(0x7f0000000680), &(0x7f0000000700)=0x6e)

2018/03/30 13:05:56 executing program 2:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYBLOB="22811e2630b1d0ac3463"], 0x1)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r1, r2, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = getpgid(0xffffffffffffffff)
syz_open_procfs(0x0, &(0x7f00000005c0)='net/ip6_tables_targets\x00')
process_vm_writev(r3, &(0x7f0000000180)=[{&(0x7f0000000140)=""/22, 0x16}], 0x1, &(0x7f00000003c0)=[{&(0x7f0000000740)=""/173, 0xad}], 0x1, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
r4 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
setns(r2, 0x0)
r5 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
r6 = dup3(0xffffffffffffffff, r0, 0x80000)
setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8)
syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00')
sendmsg$IPVS_CMD_NEW_DEST(r6, &(0x7f0000000540)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x2000400}, 0xc, &(0x7f0000000500)={&(0x7f0000000240)=ANY=[@ANYPTR], 0x1}, 0x1, 0x0, 0x0, 0x10}, 0x4)
sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10}, 0xc, &(0x7f0000000340)={&(0x7f0000000480)=ANY=[@ANYBLOB='H\x00\x00\x00'], 0x1}, 0x1}, 0x0)
fcntl$setstatus(r1, 0x4, 0x6000)
mq_open(&(0x7f0000000800)=':em1\x00', 0x40, 0x4, &(0x7f0000000840)={0x0, 0x0, 0x9, 0x6, 0x0, 0xff, 0x7})
pwritev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000c00)}], 0x1, 0x0)
ioctl$DRM_IOCTL_AGP_ALLOC(r6, 0xc0206434, &(0x7f0000000440)={0x9dca, <r7=>0x0, 0x10002, 0x4})
ioctl$DRM_IOCTL_AGP_BIND(r5, 0x40106436, &(0x7f00000004c0)={r7, 0x676})
ioctl$sock_ifreq(r5, 0x8917, &(0x7f0000000300)={'lo\x00', @ifru_data=&(0x7f00000001c0)="16e667ea25efad95e8e866bb6ef7f6ba94b72b63a28bcb7eafa978bdbe09a4d8"})
getsockopt$inet_int(r4, 0x0, 0x0, &(0x7f0000000600), &(0x7f0000000640)=0x4)
getsockname$unix(r1, &(0x7f0000000680), &(0x7f0000000700)=0x6e)

2018/03/30 13:05:56 executing program 5:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYBLOB="00811e2630b1d0ac3463"], 0x1)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r1, r2, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
setns(r2, 0x0)
r3 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/loop-control\x00', 0x0, 0x0)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)
r4 = dup(r3)
getsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffff9c, 0x84, 0x6f, &(0x7f0000000340)={<r5=>0x0, 0x3c, &(0x7f00000005c0)=[@in={0x2, 0x4e23, @local={0xac, 0x14, 0x14, 0xaa}}, @in={0x2, 0x4e24, @broadcast=0xffffffff}, @in6={0xa, 0x0, 0x100000000, @loopback={0x0, 0x1}, 0x323d000000000}]}, &(0x7f0000000640)=0xc)
setsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r4, 0x84, 0xa, &(0x7f0000000680)={0xcff3, 0x80000000, 0x3, 0x0, 0x0, 0x66e, 0x5, 0x0, r5}, 0x20)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)
mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x5c831, 0xffffffffffffffff, 0x0)
setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(0xffffffffffffffff, 0x10e, 0x2, &(0x7f0000000340)=0xc, 0x4)
madvise(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x9)
r6 = syz_open_dev$usbmon(&(0x7f0000000040)='/dev/usbmon#\x00', 0x0, 0x80000)
ioctl$KDSKBMODE(0xffffffffffffffff, 0x4b45, &(0x7f0000000080))
getsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r6, 0x84, 0x75, &(0x7f00000000c0)={0x0, 0x6}, &(0x7f0000000100)=0x8)
setsockopt$inet_sctp6_SCTP_AUTH_KEY(r6, 0x84, 0x17, &(0x7f0000000500)=ANY=[], 0x0)
ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)
r7 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
ioctl$TIOCLINUX3(r7, 0x541c, &(0x7f0000000040)=0x3)
ioctl$LOOP_CTL_REMOVE(r3, 0x4c81, 0x0)

2018/03/30 13:05:56 executing program 3:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[], 0x0)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r1, r2, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
setns(r2, 0x0)
r3 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/loop-control\x00', 0x0, 0x0)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)
r4 = dup(r3)
getsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffff9c, 0x84, 0x6f, &(0x7f0000000340)={<r5=>0x0, 0x3c, &(0x7f00000005c0)=[@in={0x2, 0x4e23, @local={0xac, 0x14, 0x14, 0xaa}}, @in={0x2, 0x4e24, @broadcast=0xffffffff}, @in6={0xa, 0x0, 0x100000000, @loopback={0x0, 0x1}, 0x323d000000000}]}, &(0x7f0000000640)=0xc)
setsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r4, 0x84, 0xa, &(0x7f0000000680)={0xcff3, 0x80000000, 0x3, 0x0, 0x0, 0x66e, 0x5, 0x1, r5}, 0x20)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)
mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x5c831, 0xffffffffffffffff, 0x0)
openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/mls\x00', 0x0, 0x0)
setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(0xffffffffffffffff, 0x10e, 0x2, &(0x7f0000000340)=0xc, 0x4)
madvise(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x9)
r6 = syz_open_dev$usbmon(&(0x7f0000000040)='/dev/usbmon#\x00', 0x0, 0x80000)
ioctl$KDSKBMODE(0xffffffffffffffff, 0x4b45, &(0x7f0000000080))
getsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r6, 0x84, 0x75, &(0x7f00000000c0)={0x0, 0x6}, &(0x7f0000000100)=0x8)
setsockopt$inet_sctp6_SCTP_AUTH_KEY(r6, 0x84, 0x17, &(0x7f0000000500)=ANY=[], 0x0)
ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82)
ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82)
r7 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
ioctl$TIOCLINUX3(r7, 0x541c, &(0x7f0000000040)=0x3)
ioctl$LOOP_CTL_REMOVE(r3, 0x4c81, 0x0)

2018/03/30 13:05:56 executing program 1:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYBLOB="22811e2630b1d0ac3463"], 0x1)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r1, r2, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = getpgid(0xffffffffffffffff)
syz_open_procfs(r3, &(0x7f00000005c0)='net/ip6_tables_targets\x00')
process_vm_writev(r3, &(0x7f0000000180), 0x0, &(0x7f00000003c0)=[{&(0x7f0000000740)=""/173, 0xad}], 0x1, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
r4 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
r5 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
r6 = dup3(0xffffffffffffffff, r0, 0x80000)
setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8)
syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00')
fcntl$setstatus(r1, 0x4, 0x6000)
mq_open(&(0x7f0000000800)=':em1\x00', 0x40, 0x4, &(0x7f0000000840)={0x4000000000000000, 0x0, 0x9, 0x6, 0x0, 0xff, 0x7})
pwritev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000c00)}], 0x1, 0x0)
ioctl$DRM_IOCTL_AGP_ALLOC(r6, 0xc0206434, &(0x7f0000000440)={0x9dca, <r7=>0x0, 0x10002})
ioctl$DRM_IOCTL_AGP_BIND(r5, 0x40106436, &(0x7f00000004c0)={r7, 0x676})
ioctl$sock_ifreq(r5, 0x8917, &(0x7f0000000300)={'lo\x00', @ifru_data=&(0x7f00000001c0)="16e667ea25efad95e8e866bb6ef7f6ba94b72b63a28bcb7eafa978bdbe09a4d8"})
getsockopt$inet_int(r4, 0x0, 0x0, &(0x7f0000000600), &(0x7f0000000640)=0x4)
getsockname$unix(r1, &(0x7f0000000680), &(0x7f0000000700)=0x6e)

2018/03/30 13:05:56 executing program 7:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYBLOB="22811e2630b1d0ac3463"], 0x1)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(0xffffffffffffffff, r2, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = getpgid(0xffffffffffffffff)
syz_open_procfs(r3, &(0x7f00000005c0)='net/ip6_tables_targets\x00')
process_vm_writev(r3, &(0x7f0000000180)=[{&(0x7f0000000140)=""/22, 0x16}], 0x1, &(0x7f00000003c0)=[{&(0x7f0000000740)=""/173, 0xad}], 0x1, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
r4 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
r5 = dup3(0xffffffffffffffff, r0, 0x80000)
setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8)
syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00')
fcntl$setstatus(r1, 0x4, 0x6000)
mq_open(&(0x7f0000000800)=':em1\x00', 0x40, 0x4, &(0x7f0000000840)={0x4000000000000000, 0x0, 0x9, 0x6, 0x0, 0xff, 0x7})
pwritev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000c00)}], 0x1, 0x0)
ioctl$DRM_IOCTL_AGP_ALLOC(r5, 0xc0206434, &(0x7f0000000440)={0x9dca, <r6=>0x0, 0x10002, 0x4})
ioctl$DRM_IOCTL_AGP_BIND(r4, 0x40106436, &(0x7f00000004c0)={r6, 0x676})
ioctl$sock_ifreq(r4, 0x8917, &(0x7f0000000300)={'lo\x00', @ifru_data=&(0x7f00000001c0)="16e667ea25efad95e8e866bb6ef7f6ba94b72b63a28bcb7eafa978bdbe09a4d8"})
getsockopt$inet_int(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000600), &(0x7f0000000640)=0x4)
getsockname$unix(r1, &(0x7f0000000680), &(0x7f0000000700)=0x6e)

2018/03/30 13:05:56 executing program 0:
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYBLOB="22811e2630b1d0ac3463"], 0x1)
r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r0, r1, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
r2 = getpgid(0xffffffffffffffff)
syz_open_procfs(r2, &(0x7f00000005c0)='net/ip6_tables_targets\x00')
process_vm_writev(r2, &(0x7f0000000180)=[{&(0x7f0000000140)=""/22, 0x16}], 0x1, &(0x7f00000003c0)=[{&(0x7f0000000740)=""/173, 0xad}], 0x1, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
r3 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
setns(r1, 0x0)
r4 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
r5 = dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000)
setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8)
syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00')
sendmsg$IPVS_CMD_NEW_DEST(r5, &(0x7f0000000540)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x2000400}, 0xc, &(0x7f0000000500)={&(0x7f0000000240)=ANY=[@ANYPTR], 0x1}, 0x1, 0x0, 0x0, 0x10}, 0x0)
sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10}, 0xc, &(0x7f0000000340)={&(0x7f0000000480)=ANY=[@ANYBLOB='H\x00\x00\x00'], 0x1}, 0x1}, 0x0)
fcntl$setstatus(r0, 0x4, 0x6000)
mq_open(&(0x7f0000000800)=':em1\x00', 0x40, 0x4, &(0x7f0000000840)={0x4000000000000000, 0x0, 0x9, 0x6, 0x0, 0xff, 0x7})
pwritev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000c00)}], 0x1, 0x0)
ioctl$DRM_IOCTL_AGP_ALLOC(r5, 0xc0206434, &(0x7f0000000440)={0x9dca, <r6=>0x0, 0x10002, 0x4})
ioctl$DRM_IOCTL_AGP_BIND(r4, 0x40106436, &(0x7f00000004c0)={r6, 0x676})
ioctl$sock_ifreq(r4, 0x8917, &(0x7f0000000300)={'lo\x00', @ifru_data=&(0x7f00000001c0)="16e667ea25efad95e8e866bb6ef7f6ba94b72b63a28bcb7eafa978bdbe09a4d8"})
getsockopt$inet_int(r3, 0x0, 0x0, &(0x7f0000000600), &(0x7f0000000640)=0x4)
getsockname$unix(r0, &(0x7f0000000680), &(0x7f0000000700)=0x6e)

** 3 printk messages dropped ** [  587.389572] binder: BINDER_SET_CONTEXT_MGR already set
[  587.389579] binder: 29736:29741 ioctl 40046207 0 returned -16
[  587.389799] binder: undelivered TRANSACTION_ERROR: 29201
2018/03/30 13:05:56 executing program 5:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYBLOB="00811e2630b1d0ac3463"], 0x1)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r1, r2, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
setns(r2, 0x0)
r3 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/loop-control\x00', 0x0, 0x0)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)
r4 = dup(r3)
getsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffff9c, 0x84, 0x6f, &(0x7f0000000340)={<r5=>0x0, 0x3c, &(0x7f00000005c0)=[@in={0x2, 0x4e23, @local={0xac, 0x14, 0x14, 0xaa}}, @in={0x2, 0x4e24, @broadcast=0xffffffff}, @in6={0xa, 0x0, 0x100000000, @loopback={0x0, 0x1}, 0x323d000000000}]}, &(0x7f0000000640)=0xc)
setsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r4, 0x84, 0xa, &(0x7f0000000680)={0xcff3, 0x80000000, 0x3, 0x0, 0x0, 0x66e, 0x5, 0x0, r5}, 0x20)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)
mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x5c831, 0xffffffffffffffff, 0x0)
setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(0xffffffffffffffff, 0x10e, 0x2, &(0x7f0000000340)=0xc, 0x4)
madvise(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x9)
r6 = syz_open_dev$usbmon(&(0x7f0000000040)='/dev/usbmon#\x00', 0x0, 0x80000)
ioctl$KDSKBMODE(0xffffffffffffffff, 0x4b45, &(0x7f0000000080))
getsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r6, 0x84, 0x75, &(0x7f00000000c0)={0x0, 0x6}, &(0x7f0000000100)=0x8)
setsockopt$inet_sctp6_SCTP_AUTH_KEY(r6, 0x84, 0x17, &(0x7f0000000500)=ANY=[], 0x0)
ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)
r7 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
ioctl$TIOCLINUX3(r7, 0x541c, &(0x7f0000000040)=0x3)
ioctl$LOOP_CTL_REMOVE(r3, 0x4c81, 0x0)

2018/03/30 13:05:56 executing program 2:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYBLOB="22811e2630b1d0ac3463"], 0x1)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r1, r2, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = getpgid(0xffffffffffffffff)
syz_open_procfs(r3, &(0x7f00000005c0)='net/ip6_tables_targets\x00')
process_vm_writev(0x0, &(0x7f0000000180)=[{&(0x7f0000000140)=""/22, 0x16}], 0x1, &(0x7f00000003c0)=[{&(0x7f0000000740)=""/173, 0xad}], 0x1, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
r4 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
setns(r2, 0x0)
r5 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
r6 = dup3(0xffffffffffffffff, r0, 0x80000)
setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8)
syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00')
sendmsg$IPVS_CMD_NEW_DEST(r6, &(0x7f0000000540)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x2000400}, 0xc, &(0x7f0000000500)={&(0x7f0000000240)=ANY=[@ANYPTR], 0x1}, 0x1, 0x0, 0x0, 0x10}, 0x4)
sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10}, 0xc, &(0x7f0000000340)={&(0x7f0000000480)=ANY=[@ANYBLOB='H\x00\x00\x00'], 0x1}, 0x1}, 0x0)
fcntl$setstatus(r1, 0x4, 0x6000)
mq_open(&(0x7f0000000800)=':em1\x00', 0x40, 0x4, &(0x7f0000000840)={0x0, 0x0, 0x9, 0x6, 0x0, 0xff, 0x7})
pwritev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000c00)}], 0x1, 0x0)
ioctl$DRM_IOCTL_AGP_ALLOC(r6, 0xc0206434, &(0x7f0000000440)={0x9dca, <r7=>0x0, 0x10002, 0x4})
ioctl$DRM_IOCTL_AGP_BIND(r5, 0x40106436, &(0x7f00000004c0)={r7, 0x676})
ioctl$sock_ifreq(r5, 0x8917, &(0x7f0000000300)={'lo\x00', @ifru_data=&(0x7f00000001c0)="16e667ea25efad95e8e866bb6ef7f6ba94b72b63a28bcb7eafa978bdbe09a4d8"})
getsockopt$inet_int(r4, 0x0, 0x0, &(0x7f0000000600), &(0x7f0000000640)=0x4)
getsockname$unix(r1, &(0x7f0000000680), &(0x7f0000000700)=0x6e)

** 20 printk messages dropped ** [  587.486807] binder: undelivered TRANSACTION_ERROR: 29201
2018/03/30 13:05:56 executing program 3:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[], 0x0)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r1, r2, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
setns(r2, 0x0)
r3 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/loop-control\x00', 0x0, 0x0)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)
r4 = dup(r3)
getsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffff9c, 0x84, 0x6f, &(0x7f0000000340)={<r5=>0x0, 0x3c, &(0x7f00000005c0)=[@in={0x2, 0x4e23, @local={0xac, 0x14, 0x14, 0xaa}}, @in={0x2, 0x4e24, @broadcast=0xffffffff}, @in6={0xa, 0x0, 0x100000000, @loopback={0x0, 0x1}, 0x323d000000000}]}, &(0x7f0000000640)=0xc)
setsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r4, 0x84, 0xa, &(0x7f0000000680)={0xcff3, 0x80000000, 0x3, 0x0, 0x0, 0x66e, 0x5, 0x1, r5}, 0x20)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)
mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x5c831, 0xffffffffffffffff, 0x0)
openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/mls\x00', 0x0, 0x0)
setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(0xffffffffffffffff, 0x10e, 0x2, &(0x7f0000000340)=0xc, 0x4)
madvise(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x9)
r6 = syz_open_dev$usbmon(&(0x7f0000000040)='/dev/usbmon#\x00', 0x0, 0x80000)
ioctl$KDSKBMODE(0xffffffffffffffff, 0x4b45, &(0x7f0000000080))
getsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r6, 0x84, 0x75, &(0x7f00000000c0)={0x0, 0x6}, &(0x7f0000000100)=0x8)
setsockopt$inet_sctp6_SCTP_AUTH_KEY(r6, 0x84, 0x17, &(0x7f0000000500)=ANY=[], 0x0)
ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82)
ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82)
r7 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
ioctl$TIOCLINUX3(r7, 0x541c, &(0x7f0000000040)=0x3)
ioctl$LOOP_CTL_REMOVE(r3, 0x4c81, 0x0)

2018/03/30 13:05:56 executing program 6:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYBLOB="22811e2630b1d0ac3463"], 0x1)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r1, r2, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = getpgid(0xffffffffffffffff)
syz_open_procfs(r3, &(0x7f00000005c0)='net/ip6_tables_targets\x00')
process_vm_writev(r3, &(0x7f0000000180)=[{&(0x7f0000000140)=""/22, 0x16}], 0x1, &(0x7f00000003c0)=[{&(0x7f0000000740)=""/173, 0xad}], 0x1, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
r4 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
r5 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
r6 = dup3(0xffffffffffffffff, r0, 0x0)
setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8)
syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00')
sendmsg$IPVS_CMD_NEW_DEST(r6, &(0x7f0000000540)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x2000400}, 0xc, &(0x7f0000000500)={&(0x7f0000000240)=ANY=[@ANYPTR], 0x1}, 0x1, 0x0, 0x0, 0x10}, 0x4)
fcntl$setstatus(r1, 0x4, 0x6000)
mq_open(&(0x7f0000000800)=':em1\x00', 0x40, 0x4, &(0x7f0000000840)={0x4000000000000000, 0x0, 0x9, 0x6, 0x0, 0xff, 0x7})
pwritev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000c00)}], 0x1, 0x0)
ioctl$DRM_IOCTL_AGP_ALLOC(r6, 0xc0206434, &(0x7f0000000440)={0x9dca, <r7=>0x0, 0x10002, 0x4})
ioctl$DRM_IOCTL_AGP_BIND(0xffffffffffffffff, 0x40106436, &(0x7f00000004c0)={r7, 0x676})
ioctl$sock_ifreq(r5, 0x8917, &(0x7f0000000300)={'lo\x00', @ifru_data=&(0x7f00000001c0)="16e667ea25efad95e8e866bb6ef7f6ba94b72b63a28bcb7eafa978bdbe09a4d8"})
getsockopt$inet_int(r4, 0x0, 0x0, &(0x7f0000000600), &(0x7f0000000640)=0x4)
getsockname$unix(r1, &(0x7f0000000680), &(0x7f0000000700)=0x6e)

2018/03/30 13:05:56 executing program 7:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYBLOB="22811e2630b1d0ac3463"], 0x1)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r1, 0xffffffffffffffff, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = getpgid(0xffffffffffffffff)
syz_open_procfs(r3, &(0x7f00000005c0)='net/ip6_tables_targets\x00')
process_vm_writev(r3, &(0x7f0000000180)=[{&(0x7f0000000140)=""/22, 0x16}], 0x1, &(0x7f00000003c0)=[{&(0x7f0000000740)=""/173, 0xad}], 0x1, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
r4 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
r5 = dup3(0xffffffffffffffff, r0, 0x80000)
setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8)
syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00')
fcntl$setstatus(r1, 0x4, 0x6000)
mq_open(&(0x7f0000000800)=':em1\x00', 0x40, 0x4, &(0x7f0000000840)={0x4000000000000000, 0x0, 0x9, 0x6, 0x0, 0xff, 0x7})
pwritev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000c00)}], 0x1, 0x0)
ioctl$DRM_IOCTL_AGP_ALLOC(r5, 0xc0206434, &(0x7f0000000440)={0x9dca, <r6=>0x0, 0x10002, 0x4})
ioctl$DRM_IOCTL_AGP_BIND(r4, 0x40106436, &(0x7f00000004c0)={r6, 0x676})
ioctl$sock_ifreq(r4, 0x8917, &(0x7f0000000300)={'lo\x00', @ifru_data=&(0x7f00000001c0)="16e667ea25efad95e8e866bb6ef7f6ba94b72b63a28bcb7eafa978bdbe09a4d8"})
getsockopt$inet_int(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000600), &(0x7f0000000640)=0x4)
getsockname$unix(r1, &(0x7f0000000680), &(0x7f0000000700)=0x6e)

2018/03/30 13:05:56 executing program 4:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
r1 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000002880)='/selinux/avc/cache_stats\x00', 0x0, 0x0)
ioctl$EVIOCSABS20(r1, 0x401845e0, &(0x7f00000028c0)={0x1000, 0x7fff, 0x1ff, 0xffffffff, 0x7, 0x40})
fchdir(r0)
r2 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(r2, &(0x7f0000000080)=ANY=[@ANYBLOB="00811e2630b1d0ac3463"], 0x1)
setsockopt$packet_add_memb(r2, 0x107, 0x1, &(0x7f0000002900)={0x0, 0x1, 0x6}, 0x10)
r3 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r2, r3, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r3, 0x0)
inotify_init1(0x800)
ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
r4 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
setns(r3, 0x8000000)
r5 = socket$nl_xfrm(0x10, 0x3, 0x6)
r6 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
dup3(r3, r0, 0x80000)
setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8)
r7 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00')
sendmsg$IPVS_CMD_NEW_DEST(0xffffffffffffffff, &(0x7f0000000540)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x2000400}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)=ANY=[@ANYBLOB=',\x00\x00\x00'], 0x1}, 0x1, 0x0, 0x0, 0x10}, 0x4)
sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10}, 0xc, &(0x7f0000000340)={&(0x7f0000000480)=ANY=[@ANYBLOB='H\x00\x00\x00'], 0x1}, 0x1}, 0x0)
sendmsg$IPVS_CMD_GET_DEST(r2, &(0x7f0000000880)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f00000005c0)={&(0x7f0000000740)={0x138, r7, 0x208, 0x70bd2b, 0x25dfdbfb, {0x8}, [@IPVS_CMD_ATTR_SERVICE={0x28, 0x1, [@IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@multicast2=0xe0000002}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x3}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x7fff}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x8c6}, @IPVS_CMD_ATTR_DAEMON={0x50, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @remote={0xac, 0x14, 0x14, 0xbb}}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x400}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x10001}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'syz_tun\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x6}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x2}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x30, 0x2, [@IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x2}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv6=@ipv4={[], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0xffffffff}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0xafa6}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x1}, @IPVS_CMD_ATTR_DEST={0x6c, 0x2, [@IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x7}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv4=@remote={0xac, 0x14, 0x14, 0xbb}}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x8}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x1}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x5}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x3}, @IPVS_DEST_ATTR_PORT={0x8, 0x2, 0x4e22}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv6=@mcast2={0xff, 0x2, [], 0x1}}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x10000}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x701a3921}]}]}, 0x138}, 0x1, 0x0, 0x0, 0x90}, 0x4)
fcntl$setstatus(r2, 0x4, 0x6000)
setsockopt$sock_linger(r4, 0x1, 0xd, &(0x7f00000008c0)={0x1, 0x2}, 0x8)
pwritev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000c00)="cfb93447d6feaef9f73c0561e075a8295d43017ab1a157786dcda36c5eec92a4306f284fa7e3ed364cc2da5c08cf7e4030d394520e123eee6d9ab275c91c174b1364fc943b49faefe12f605b5ce6c1400a91210c00477f900aff390901bf594c18557cb38a7d57ac8ded098b96b9dfc125e3bdc9305193f4cd256068baca5208160d820b9e7a043666ba4801cf6d557fc0f97f35c13ec6c0d1fe97ce1af1c17078ef47ab955200836671e402717481d14936b09828fd6f55fda2f11eb4c61b480e941133c0a4c5ec54033d0d174742191754ffe28b093596286a78ea01078337ada8585aa98dcc1143689002e31ccc5b9f5cfd2bbce5683a0f91b395391a60ba8e8f4d3c10c82c71caa74c44c8b0f3e42f1fc264497d5b9dabf309bad7bd", 0x11e}], 0x1, 0x0)
sendmmsg(r5, &(0x7f00000027c0)=[{{0x0, 0x0, &(0x7f0000000a00)=[{&(0x7f0000000900)="913da470640ae70fe168a71ad316e5525ce43547f28d8c56cb5cd246950c2d44a514698b3aebf2b60d933814378b0b9b750dec28bdbeedda6c8af5f3418ff8c43701e5dea492428ecdcf0e8c2a19f60e388b478179256834360c5ee359dbe4fabee36883a8314f0ea64dea3a732dffbe26a02e8327a0f7174a6990389e5b608d5300c271f26b3b37cc88e720a477e5f1aa2751af90d35d72606ac73f72dab39aad418a6335d44c785ba83edc9619a3221ae39ef2fed1657e426fa293a739cd779a6c645b3d29bb184041476e8e6e737e5fa1c4312360", 0xd6}], 0x1, 0x0, 0x0, 0x8000}, 0x3f}, {{&(0x7f0000002240)=@nl=@unspec, 0x80, &(0x7f0000002680)=[{&(0x7f00000022c0)="756a6b1895d55b0b292a3985cd35f28cfa8d5ab20a3448791e47ec9e971be82f993ebd55ec843a76ccd644a71222e57119e6f8866f59ba0b89c4cf71a9ce853f72bd99ac9097baf924ea3e3fbceaf0a0df15deb45ae757832bec56c67c0ad44e0ea5fcbc12f898989e1773427ad180efff1044e98613dab446587dd52a0deacb4074e01d97cd46c6e633ae1c1011fd2123c766e6fea028799cf82a562bd9d52c544241172f684398ac1b", 0xaa}, {&(0x7f0000002440)="c802b7c29c92c7ddcf8b11133e071ae83e8c0b0827764303ad44356d381633ce1fdd31e1641872e8d6b4c1a974d97d", 0x2f}, {&(0x7f0000002540)="446c9b3779f2a3dc39f3a3541d912b01ca9865e4172a83cda910f6b10dd97377212eb5279c", 0x25}], 0x3, &(0x7f0000002700)=[{0xa0, 0x10f, 0x200, "4f483406ed4a2e47550522989e031e3e239b59c5dc988744d266f33171b6d4a8e54f025a1e1be02c21ad9675e29aea96625352eec0db268e5c70b8e22a2bb0e11b9e6d9613d4e8e338194d9a41821db1ef97a16b16e5263d008bb6ce86b1e26f4d59926a9a72bed62192dc96eaa8a033c9ddaf2fc8c5fb9e765e5ff99cc5ae6fa7bc4a4f0abcb9c9745b54449ab38c"}], 0xa0, 0x800}}], 0x2, 0x20040000)
sendmsg$IPVS_CMD_DEL_DAEMON(r2, &(0x7f0000000280)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000240)={&(0x7f0000000180)={0x28, 0x0, 0xb30, 0x0, 0x25dfdbfc, {0xa}, [@IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x3ff}, @IPVS_CMD_ATTR_SERVICE={0xc, 0x1, [@IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8}]}]}, 0x28}, 0x1}, 0x0)
ioctl$sock_ifreq(r6, 0x8917, &(0x7f0000000300)={'lo\x00', @ifru_data=&(0x7f00000001c0)="16e667ea25efad95e8e866bb6ef7f6ba94b72b63a28bcb7eafa978bdbe09a4d8"})
getsockopt$inet_int(r4, 0x0, 0x0, &(0x7f0000000600), &(0x7f0000000640)=0x4)
getsockname$unix(r2, &(0x7f0000000680), &(0x7f0000000700)=0x6e)

2018/03/30 13:05:56 executing program 1:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYBLOB="22811e2630b1d0ac3463"], 0x1)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r1, r2, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = getpgid(0xffffffffffffffff)
syz_open_procfs(r3, &(0x7f00000005c0)='net/ip6_tables_targets\x00')
process_vm_writev(r3, &(0x7f0000000180), 0x0, &(0x7f00000003c0)=[{&(0x7f0000000740)=""/173, 0xad}], 0x1, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
r4 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
r5 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
r6 = dup3(0xffffffffffffffff, r0, 0x80000)
setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8)
syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00')
fcntl$setstatus(r1, 0x4, 0x6000)
mq_open(&(0x7f0000000800)=':em1\x00', 0x40, 0x4, &(0x7f0000000840)={0x4000000000000000, 0x0, 0x9, 0x6, 0x0, 0xff, 0x7})
pwritev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000c00)}], 0x1, 0x0)
ioctl$DRM_IOCTL_AGP_ALLOC(r6, 0xc0206434, &(0x7f0000000440)={0x9dca, <r7=>0x0, 0x10002})
ioctl$DRM_IOCTL_AGP_BIND(r5, 0x40106436, &(0x7f00000004c0)={r7, 0x676})
ioctl$sock_ifreq(r5, 0x8917, &(0x7f0000000300)={'lo\x00', @ifru_data=&(0x7f00000001c0)="16e667ea25efad95e8e866bb6ef7f6ba94b72b63a28bcb7eafa978bdbe09a4d8"})
getsockopt$inet_int(r4, 0x0, 0x0, &(0x7f0000000600), &(0x7f0000000640)=0x4)
getsockname$unix(r1, &(0x7f0000000680), &(0x7f0000000700)=0x6e)

** 12 printk messages dropped ** [  587.508102] binder: 29764:29768 got transaction with invalid offset (0, min 24 max 40) or object.
2018/03/30 13:05:56 executing program 5:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYBLOB="00811e2630b1d0ac3463"], 0x1)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r1, r2, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
setns(r2, 0x0)
r3 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/loop-control\x00', 0x0, 0x0)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)
r4 = dup(r3)
getsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffff9c, 0x84, 0x6f, &(0x7f0000000340)={<r5=>0x0, 0x3c, &(0x7f00000005c0)=[@in={0x2, 0x4e23, @local={0xac, 0x14, 0x14, 0xaa}}, @in={0x2, 0x4e24, @broadcast=0xffffffff}, @in6={0xa, 0x0, 0x100000000, @loopback={0x0, 0x1}, 0x323d000000000}]}, &(0x7f0000000640)=0xc)
setsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r4, 0x84, 0xa, &(0x7f0000000680)={0xcff3, 0x80000000, 0x3, 0x0, 0x0, 0x66e, 0x5, 0x0, r5}, 0x20)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)
mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x5c831, 0xffffffffffffffff, 0x0)
setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(0xffffffffffffffff, 0x10e, 0x2, &(0x7f0000000340)=0xc, 0x4)
madvise(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x9)
r6 = syz_open_dev$usbmon(&(0x7f0000000040)='/dev/usbmon#\x00', 0x0, 0x80000)
ioctl$KDSKBMODE(0xffffffffffffffff, 0x4b45, &(0x7f0000000080))
getsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r6, 0x84, 0x75, &(0x7f00000000c0)={0x0, 0x6}, &(0x7f0000000100)=0x8)
setsockopt$inet_sctp6_SCTP_AUTH_KEY(r6, 0x84, 0x17, &(0x7f0000000500)=ANY=[], 0x0)
ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)
r7 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
ioctl$TIOCLINUX3(r7, 0x541c, &(0x7f0000000040)=0x3)
ioctl$LOOP_CTL_REMOVE(r3, 0x4c81, 0x0)

2018/03/30 13:05:56 executing program 0:
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYBLOB="22811e2630b1d0ac3463"], 0x1)
r1 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r0, r1, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
r2 = getpgid(0xffffffffffffffff)
syz_open_procfs(r2, &(0x7f00000005c0)='net/ip6_tables_targets\x00')
process_vm_writev(r2, &(0x7f0000000180)=[{&(0x7f0000000140)=""/22, 0x16}], 0x1, &(0x7f00000003c0)=[{&(0x7f0000000740)=""/173, 0xad}], 0x1, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
r3 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
setns(r1, 0x0)
r4 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
r5 = dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000)
setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8)
syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00')
sendmsg$IPVS_CMD_NEW_DEST(r5, &(0x7f0000000540)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x2000400}, 0xc, &(0x7f0000000500)={&(0x7f0000000240)=ANY=[@ANYPTR], 0x1}, 0x1, 0x0, 0x0, 0x10}, 0x0)
sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10}, 0xc, &(0x7f0000000340)={&(0x7f0000000480)=ANY=[@ANYBLOB='H\x00\x00\x00'], 0x1}, 0x1}, 0x0)
fcntl$setstatus(r0, 0x4, 0x6000)
mq_open(&(0x7f0000000800)=':em1\x00', 0x40, 0x4, &(0x7f0000000840)={0x4000000000000000, 0x0, 0x9, 0x6, 0x0, 0xff, 0x7})
pwritev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000c00)}], 0x1, 0x0)
ioctl$DRM_IOCTL_AGP_ALLOC(r5, 0xc0206434, &(0x7f0000000440)={0x9dca, <r6=>0x0, 0x10002, 0x4})
ioctl$DRM_IOCTL_AGP_BIND(r4, 0x40106436, &(0x7f00000004c0)={r6, 0x676})
ioctl$sock_ifreq(r4, 0x8917, &(0x7f0000000300)={'lo\x00', @ifru_data=&(0x7f00000001c0)="16e667ea25efad95e8e866bb6ef7f6ba94b72b63a28bcb7eafa978bdbe09a4d8"})
getsockopt$inet_int(r3, 0x0, 0x0, &(0x7f0000000600), &(0x7f0000000640)=0x4)
getsockname$unix(r0, &(0x7f0000000680), &(0x7f0000000700)=0x6e)

** 24 printk messages dropped ** [  587.642002] binder: 29779:29784 transaction failed 29201/-22, size 40-16 line 3197
2018/03/30 13:05:56 executing program 2:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYBLOB="22811e2630b1d0ac3463"], 0x1)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r1, r2, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = getpgid(0xffffffffffffffff)
syz_open_procfs(r3, &(0x7f00000005c0)='net/ip6_tables_targets\x00')
process_vm_writev(0x0, &(0x7f0000000180)=[{&(0x7f0000000140)=""/22, 0x16}], 0x1, &(0x7f00000003c0)=[{&(0x7f0000000740)=""/173, 0xad}], 0x1, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
r4 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
setns(r2, 0x0)
r5 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
r6 = dup3(0xffffffffffffffff, r0, 0x80000)
setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8)
syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00')
sendmsg$IPVS_CMD_NEW_DEST(r6, &(0x7f0000000540)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x2000400}, 0xc, &(0x7f0000000500)={&(0x7f0000000240)=ANY=[@ANYPTR], 0x1}, 0x1, 0x0, 0x0, 0x10}, 0x4)
sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10}, 0xc, &(0x7f0000000340)={&(0x7f0000000480)=ANY=[@ANYBLOB='H\x00\x00\x00'], 0x1}, 0x1}, 0x0)
fcntl$setstatus(r1, 0x4, 0x6000)
mq_open(&(0x7f0000000800)=':em1\x00', 0x40, 0x4, &(0x7f0000000840)={0x0, 0x0, 0x9, 0x6, 0x0, 0xff, 0x7})
pwritev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000c00)}], 0x1, 0x0)
ioctl$DRM_IOCTL_AGP_ALLOC(r6, 0xc0206434, &(0x7f0000000440)={0x9dca, <r7=>0x0, 0x10002, 0x4})
ioctl$DRM_IOCTL_AGP_BIND(r5, 0x40106436, &(0x7f00000004c0)={r7, 0x676})
ioctl$sock_ifreq(r5, 0x8917, &(0x7f0000000300)={'lo\x00', @ifru_data=&(0x7f00000001c0)="16e667ea25efad95e8e866bb6ef7f6ba94b72b63a28bcb7eafa978bdbe09a4d8"})
getsockopt$inet_int(r4, 0x0, 0x0, &(0x7f0000000600), &(0x7f0000000640)=0x4)
getsockname$unix(r1, &(0x7f0000000680), &(0x7f0000000700)=0x6e)

2018/03/30 13:05:56 executing program 4:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
r1 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000002880)='/selinux/avc/cache_stats\x00', 0x0, 0x0)
ioctl$EVIOCSABS20(r1, 0x401845e0, &(0x7f00000028c0)={0x1000, 0x7fff, 0x1ff, 0xffffffff, 0x7, 0x40})
fchdir(r0)
r2 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(r2, &(0x7f0000000080)=ANY=[@ANYBLOB="00811e2630b1d0ac3463"], 0x1)
setsockopt$packet_add_memb(r2, 0x107, 0x1, &(0x7f0000002900)={0x0, 0x1, 0x6}, 0x10)
r3 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r2, r3, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r3, 0x0)
inotify_init1(0x800)
ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
r4 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
setns(r3, 0x8000000)
r5 = socket$nl_xfrm(0x10, 0x3, 0x6)
r6 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
dup3(r3, r0, 0x80000)
setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8)
r7 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00')
sendmsg$IPVS_CMD_NEW_DEST(0xffffffffffffffff, &(0x7f0000000540)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x2000400}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)=ANY=[@ANYBLOB=',\x00\x00\x00'], 0x1}, 0x1, 0x0, 0x0, 0x10}, 0x4)
sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10}, 0xc, &(0x7f0000000340)={&(0x7f0000000480)=ANY=[@ANYBLOB='H\x00\x00\x00'], 0x1}, 0x1}, 0x0)
sendmsg$IPVS_CMD_GET_DEST(r2, &(0x7f0000000880)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f00000005c0)={&(0x7f0000000740)={0x138, r7, 0x208, 0x70bd2b, 0x25dfdbfb, {0x8}, [@IPVS_CMD_ATTR_SERVICE={0x28, 0x1, [@IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@multicast2=0xe0000002}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x3}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x7fff}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x8c6}, @IPVS_CMD_ATTR_DAEMON={0x50, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @remote={0xac, 0x14, 0x14, 0xbb}}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x400}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x10001}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'syz_tun\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x6}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x2}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x30, 0x2, [@IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x2}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv6=@ipv4={[], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0xffffffff}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0xafa6}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x1}, @IPVS_CMD_ATTR_DEST={0x6c, 0x2, [@IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x7}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv4=@remote={0xac, 0x14, 0x14, 0xbb}}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x8}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x1}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x5}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x3}, @IPVS_DEST_ATTR_PORT={0x8, 0x2, 0x4e22}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv6=@mcast2={0xff, 0x2, [], 0x1}}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x10000}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x701a3921}]}]}, 0x138}, 0x1, 0x0, 0x0, 0x90}, 0x4)
fcntl$setstatus(r2, 0x4, 0x6000)
setsockopt$sock_linger(r4, 0x1, 0xd, &(0x7f00000008c0)={0x1, 0x2}, 0x8)
pwritev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000c00)="cfb93447d6feaef9f73c0561e075a8295d43017ab1a157786dcda36c5eec92a4306f284fa7e3ed364cc2da5c08cf7e4030d394520e123eee6d9ab275c91c174b1364fc943b49faefe12f605b5ce6c1400a91210c00477f900aff390901bf594c18557cb38a7d57ac8ded098b96b9dfc125e3bdc9305193f4cd256068baca5208160d820b9e7a043666ba4801cf6d557fc0f97f35c13ec6c0d1fe97ce1af1c17078ef47ab955200836671e402717481d14936b09828fd6f55fda2f11eb4c61b480e941133c0a4c5ec54033d0d174742191754ffe28b093596286a78ea01078337ada8585aa98dcc1143689002e31ccc5b9f5cfd2bbce5683a0f91b395391a60ba8e8f4d3c10c82c71caa74c44c8b0f3e42f1fc264497d5b9dabf309bad7bd", 0x11e}], 0x1, 0x0)
sendmmsg(r5, &(0x7f00000027c0)=[{{0x0, 0x0, &(0x7f0000000a00)=[{&(0x7f0000000900)="913da470640ae70fe168a71ad316e5525ce43547f28d8c56cb5cd246950c2d44a514698b3aebf2b60d933814378b0b9b750dec28bdbeedda6c8af5f3418ff8c43701e5dea492428ecdcf0e8c2a19f60e388b478179256834360c5ee359dbe4fabee36883a8314f0ea64dea3a732dffbe26a02e8327a0f7174a6990389e5b608d5300c271f26b3b37cc88e720a477e5f1aa2751af90d35d72606ac73f72dab39aad418a6335d44c785ba83edc9619a3221ae39ef2fed1657e426fa293a739cd779a6c645b3d29bb184041476e8e6e737e5fa1c4312360", 0xd6}], 0x1, 0x0, 0x0, 0x8000}, 0x3f}, {{&(0x7f0000002240)=@nl=@unspec, 0x80, &(0x7f0000002680)=[{&(0x7f00000022c0)="756a6b1895d55b0b292a3985cd35f28cfa8d5ab20a3448791e47ec9e971be82f993ebd55ec843a76ccd644a71222e57119e6f8866f59ba0b89c4cf71a9ce853f72bd99ac9097baf924ea3e3fbceaf0a0df15deb45ae757832bec56c67c0ad44e0ea5fcbc12f898989e1773427ad180efff1044e98613dab446587dd52a0deacb4074e01d97cd46c6e633ae1c1011fd2123c766e6fea028799cf82a562bd9d52c544241172f684398ac1b", 0xaa}, {&(0x7f0000002440)="c802b7c29c92c7ddcf8b11133e071ae83e8c0b0827764303ad44356d381633ce1fdd31e1641872e8d6b4c1a974d97d", 0x2f}, {&(0x7f0000002540)="446c9b3779f2a3dc39f3a3541d912b01ca9865e4172a83cda910f6b10dd97377212eb5279c", 0x25}], 0x3, &(0x7f0000002700)=[{0xa0, 0x10f, 0x200, "4f483406ed4a2e47550522989e031e3e239b59c5dc988744d266f33171b6d4a8e54f025a1e1be02c21ad9675e29aea96625352eec0db268e5c70b8e22a2bb0e11b9e6d9613d4e8e338194d9a41821db1ef97a16b16e5263d008bb6ce86b1e26f4d59926a9a72bed62192dc96eaa8a033c9ddaf2fc8c5fb9e765e5ff99cc5ae6fa7bc4a4f0abcb9c9745b54449ab38c"}], 0xa0, 0x800}}], 0x2, 0x20040000)
sendmsg$IPVS_CMD_DEL_DAEMON(r2, &(0x7f0000000280)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000240)={&(0x7f0000000180)={0x28, 0x0, 0xb30, 0x0, 0x25dfdbfc, {0xa}, [@IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x3ff}, @IPVS_CMD_ATTR_SERVICE={0xc, 0x1, [@IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8}]}]}, 0x28}, 0x1}, 0x0)
ioctl$sock_ifreq(r6, 0x8917, &(0x7f0000000300)={'lo\x00', @ifru_data=&(0x7f00000001c0)="16e667ea25efad95e8e866bb6ef7f6ba94b72b63a28bcb7eafa978bdbe09a4d8"})
getsockopt$inet_int(r4, 0x0, 0x0, &(0x7f0000000600), &(0x7f0000000640)=0x4)
getsockname$unix(r2, &(0x7f0000000680), &(0x7f0000000700)=0x6e)

2018/03/30 13:05:56 executing program 6:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYBLOB="22811e2630b1d0ac3463"], 0x1)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r1, r2, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = getpgid(0xffffffffffffffff)
syz_open_procfs(r3, &(0x7f00000005c0)='net/ip6_tables_targets\x00')
process_vm_writev(r3, &(0x7f0000000180)=[{&(0x7f0000000140)=""/22, 0x16}], 0x1, &(0x7f00000003c0)=[{&(0x7f0000000740)=""/173, 0xad}], 0x1, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
r4 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
r5 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
r6 = dup3(0xffffffffffffffff, r0, 0x0)
setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8)
syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00')
sendmsg$IPVS_CMD_NEW_DEST(r6, &(0x7f0000000540)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x2000400}, 0xc, &(0x7f0000000500)={&(0x7f0000000240)=ANY=[@ANYPTR], 0x1}, 0x1, 0x0, 0x0, 0x10}, 0x4)
fcntl$setstatus(r1, 0x4, 0x6000)
mq_open(&(0x7f0000000800)=':em1\x00', 0x40, 0x4, &(0x7f0000000840)={0x4000000000000000, 0x0, 0x9, 0x6, 0x0, 0xff, 0x7})
pwritev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000c00)}], 0x1, 0x0)
ioctl$DRM_IOCTL_AGP_ALLOC(r6, 0xc0206434, &(0x7f0000000440)={0x9dca, <r7=>0x0, 0x10002, 0x4})
ioctl$DRM_IOCTL_AGP_BIND(0xffffffffffffffff, 0x40106436, &(0x7f00000004c0)={r7, 0x676})
ioctl$sock_ifreq(r5, 0x8917, &(0x7f0000000300)={'lo\x00', @ifru_data=&(0x7f00000001c0)="16e667ea25efad95e8e866bb6ef7f6ba94b72b63a28bcb7eafa978bdbe09a4d8"})
getsockopt$inet_int(r4, 0x0, 0x0, &(0x7f0000000600), &(0x7f0000000640)=0x4)
getsockname$unix(r1, &(0x7f0000000680), &(0x7f0000000700)=0x6e)

2018/03/30 13:05:56 executing program 7:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYBLOB="22811e2630b1d0ac3463"], 0x1)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r1, 0xffffffffffffffff, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = getpgid(0xffffffffffffffff)
syz_open_procfs(r3, &(0x7f00000005c0)='net/ip6_tables_targets\x00')
process_vm_writev(r3, &(0x7f0000000180)=[{&(0x7f0000000140)=""/22, 0x16}], 0x1, &(0x7f00000003c0)=[{&(0x7f0000000740)=""/173, 0xad}], 0x1, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
r4 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
r5 = dup3(0xffffffffffffffff, r0, 0x80000)
setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8)
syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00')
fcntl$setstatus(r1, 0x4, 0x6000)
mq_open(&(0x7f0000000800)=':em1\x00', 0x40, 0x4, &(0x7f0000000840)={0x4000000000000000, 0x0, 0x9, 0x6, 0x0, 0xff, 0x7})
pwritev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000c00)}], 0x1, 0x0)
ioctl$DRM_IOCTL_AGP_ALLOC(r5, 0xc0206434, &(0x7f0000000440)={0x9dca, <r6=>0x0, 0x10002, 0x4})
ioctl$DRM_IOCTL_AGP_BIND(r4, 0x40106436, &(0x7f00000004c0)={r6, 0x676})
ioctl$sock_ifreq(r4, 0x8917, &(0x7f0000000300)={'lo\x00', @ifru_data=&(0x7f00000001c0)="16e667ea25efad95e8e866bb6ef7f6ba94b72b63a28bcb7eafa978bdbe09a4d8"})
getsockopt$inet_int(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000600), &(0x7f0000000640)=0x4)
getsockname$unix(r1, &(0x7f0000000680), &(0x7f0000000700)=0x6e)

2018/03/30 13:05:56 executing program 3:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[], 0x0)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r1, r2, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
setns(r2, 0x0)
r3 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/loop-control\x00', 0x0, 0x0)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)
r4 = dup(r3)
getsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffff9c, 0x84, 0x6f, &(0x7f0000000340)={<r5=>0x0, 0x3c, &(0x7f00000005c0)=[@in={0x2, 0x4e23, @local={0xac, 0x14, 0x14, 0xaa}}, @in={0x2, 0x4e24, @broadcast=0xffffffff}, @in6={0xa, 0x0, 0x100000000, @loopback={0x0, 0x1}, 0x323d000000000}]}, &(0x7f0000000640)=0xc)
setsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r4, 0x84, 0xa, &(0x7f0000000680)={0xcff3, 0x80000000, 0x3, 0x0, 0x0, 0x66e, 0x5, 0x1, r5}, 0x20)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)
mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x5c831, 0xffffffffffffffff, 0x0)
openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/mls\x00', 0x0, 0x0)
setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(0xffffffffffffffff, 0x10e, 0x2, &(0x7f0000000340)=0xc, 0x4)
madvise(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x9)
r6 = syz_open_dev$usbmon(&(0x7f0000000040)='/dev/usbmon#\x00', 0x0, 0x80000)
ioctl$KDSKBMODE(0xffffffffffffffff, 0x4b45, &(0x7f0000000080))
getsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r6, 0x84, 0x75, &(0x7f00000000c0)={0x0, 0x6}, &(0x7f0000000100)=0x8)
setsockopt$inet_sctp6_SCTP_AUTH_KEY(r6, 0x84, 0x17, &(0x7f0000000500)=ANY=[], 0x0)
ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82)
ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82)
r7 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
ioctl$TIOCLINUX3(r7, 0x541c, &(0x7f0000000040)=0x3)
ioctl$LOOP_CTL_REMOVE(r3, 0x4c81, 0x0)

2018/03/30 13:05:56 executing program 1:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYBLOB="22811e2630b1d0ac3463"], 0x1)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r1, r2, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = getpgid(0xffffffffffffffff)
syz_open_procfs(r3, &(0x7f00000005c0)='net/ip6_tables_targets\x00')
process_vm_writev(r3, &(0x7f0000000180), 0x0, &(0x7f00000003c0)=[{&(0x7f0000000740)=""/173, 0xad}], 0x1, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
r4 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
r5 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
r6 = dup3(0xffffffffffffffff, r0, 0x80000)
setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8)
syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00')
fcntl$setstatus(r1, 0x4, 0x6000)
mq_open(&(0x7f0000000800)=':em1\x00', 0x40, 0x4, &(0x7f0000000840)={0x4000000000000000, 0x0, 0x9, 0x6, 0x0, 0xff, 0x7})
pwritev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000c00)}], 0x1, 0x0)
ioctl$DRM_IOCTL_AGP_ALLOC(r6, 0xc0206434, &(0x7f0000000440)={0x9dca, <r7=>0x0, 0x10002})
ioctl$DRM_IOCTL_AGP_BIND(r5, 0x40106436, &(0x7f00000004c0)={r7, 0x676})
ioctl$sock_ifreq(r5, 0x8917, &(0x7f0000000300)={'lo\x00', @ifru_data=&(0x7f00000001c0)="16e667ea25efad95e8e866bb6ef7f6ba94b72b63a28bcb7eafa978bdbe09a4d8"})
getsockopt$inet_int(r4, 0x0, 0x0, &(0x7f0000000600), &(0x7f0000000640)=0x4)
getsockname$unix(r1, &(0x7f0000000680), &(0x7f0000000700)=0x6e)

2018/03/30 13:05:56 executing program 0:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYBLOB="22811e2630b1d0ac3463"], 0x1)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r1, r2, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = getpgid(0xffffffffffffffff)
syz_open_procfs(r3, &(0x7f00000005c0)='net/ip6_tables_targets\x00')
process_vm_writev(r3, &(0x7f0000000180)=[{&(0x7f0000000140)=""/22, 0x16}], 0x1, &(0x7f00000003c0)=[{&(0x7f0000000740)=""/173, 0xad}], 0x1, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
r4 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
setns(r2, 0x0)
r5 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
r6 = dup3(0xffffffffffffffff, r0, 0x80000)
setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8)
syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00')
sendmsg$IPVS_CMD_NEW_DEST(r6, &(0x7f0000000540)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x2000400}, 0xc, &(0x7f0000000500)={&(0x7f0000000240)=ANY=[@ANYPTR], 0x1}, 0x1, 0x0, 0x0, 0x10}, 0x0)
sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10}, 0xc, &(0x7f0000000340)={&(0x7f0000000480)=ANY=[@ANYBLOB='H\x00\x00\x00'], 0x1}, 0x1}, 0x0)
fcntl$setstatus(r1, 0x4, 0x6000)
mq_open(&(0x7f0000000800)=':em1\x00', 0x40, 0x4, &(0x7f0000000840)={0x4000000000000000, 0x0, 0x9, 0x6, 0x0, 0xff, 0x7})
pwritev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000c00)}], 0x1, 0x0)
ioctl$DRM_IOCTL_AGP_ALLOC(r6, 0xc0206434, &(0x7f0000000440)={0x9dca, <r7=>0x0, 0x10002, 0x4})
ioctl$DRM_IOCTL_AGP_BIND(r5, 0x40106436, &(0x7f00000004c0)={r7, 0x676})
ioctl$sock_ifreq(r5, 0x8917, &(0x7f0000000300)={'lo\x00', @ifru_data=&(0x7f00000001c0)="16e667ea25efad95e8e866bb6ef7f6ba94b72b63a28bcb7eafa978bdbe09a4d8"})
getsockopt$inet_int(r4, 0x0, 0x0, &(0x7f0000000600), &(0x7f0000000640)=0x4)
getsockname$unix(r1, &(0x7f0000000680), &(0x7f0000000700)=0x6e)

2018/03/30 13:05:56 executing program 5:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYBLOB="00811e2630b1d0ac3463"], 0x1)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r1, r2, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
setns(r2, 0x0)
r3 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/loop-control\x00', 0x0, 0x0)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)
r4 = dup(r3)
getsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffff9c, 0x84, 0x6f, &(0x7f0000000340)={<r5=>0x0, 0x3c, &(0x7f00000005c0)=[@in={0x2, 0x4e23, @local={0xac, 0x14, 0x14, 0xaa}}, @in={0x2, 0x4e24, @broadcast=0xffffffff}, @in6={0xa, 0x0, 0x100000000, @loopback={0x0, 0x1}, 0x323d000000000}]}, &(0x7f0000000640)=0xc)
setsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r4, 0x84, 0xa, &(0x7f0000000680)={0xcff3, 0x80000000, 0x3, 0x0, 0x0, 0x66e, 0x5, 0x0, r5}, 0x20)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)
openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/mls\x00', 0x0, 0x0)
setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(0xffffffffffffffff, 0x10e, 0x2, &(0x7f0000000340)=0xc, 0x4)
madvise(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x9)
r6 = syz_open_dev$usbmon(&(0x7f0000000040)='/dev/usbmon#\x00', 0x0, 0x80000)
ioctl$KDSKBMODE(0xffffffffffffffff, 0x4b45, &(0x7f0000000080))
getsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r6, 0x84, 0x75, &(0x7f00000000c0)={0x0, 0x6}, &(0x7f0000000100)=0x8)
setsockopt$inet_sctp6_SCTP_AUTH_KEY(r6, 0x84, 0x17, &(0x7f0000000500)=ANY=[], 0x0)
ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)
r7 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
ioctl$TIOCLINUX3(r7, 0x541c, &(0x7f0000000040)=0x3)
ioctl$LOOP_CTL_REMOVE(r3, 0x4c81, 0x0)

** 17 printk messages dropped ** [  587.720704] binder: undelivered TRANSACTION_ERROR: 29201
[  587.723791] binder: BINDER_SET_CONTEXT_MGR already set
[  587.723798] binder: 29801:29806 ioctl 40046207 0 returned -16
2018/03/30 13:05:56 executing program 1:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYBLOB="22811e2630b1d0ac3463"], 0x1)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r1, r2, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = getpgid(0xffffffffffffffff)
syz_open_procfs(r3, &(0x7f00000005c0)='net/ip6_tables_targets\x00')
process_vm_writev(r3, &(0x7f0000000180), 0x0, &(0x7f00000003c0)=[{&(0x7f0000000740)=""/173, 0xad}], 0x1, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
r4 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
r5 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
r6 = dup3(0xffffffffffffffff, r0, 0x80000)
setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8)
syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00')
fcntl$setstatus(r1, 0x4, 0x6000)
mq_open(&(0x7f0000000800)=':em1\x00', 0x40, 0x4, &(0x7f0000000840)={0x4000000000000000, 0x0, 0x9, 0x6, 0x0, 0xff, 0x7})
pwritev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000c00)}], 0x1, 0x0)
ioctl$DRM_IOCTL_AGP_ALLOC(r6, 0xc0206434, &(0x7f0000000440)={0x9dca, <r7=>0x0, 0x10002, 0x4})
ioctl$DRM_IOCTL_AGP_BIND(0xffffffffffffffff, 0x40106436, &(0x7f00000004c0)={r7, 0x676})
ioctl$sock_ifreq(r5, 0x8917, &(0x7f0000000300)={'lo\x00', @ifru_data=&(0x7f00000001c0)="16e667ea25efad95e8e866bb6ef7f6ba94b72b63a28bcb7eafa978bdbe09a4d8"})
getsockopt$inet_int(r4, 0x0, 0x0, &(0x7f0000000600), &(0x7f0000000640)=0x4)
getsockname$unix(r1, &(0x7f0000000680), &(0x7f0000000700)=0x6e)

** 11 printk messages dropped ** [  587.756323] binder: 29808:29811 got transaction with invalid offset (0, min 24 max 40) or object.
** 12 printk messages dropped ** [  587.841302] binder: 29825:29829 ioctl 40046207 0 returned -16
2018/03/30 13:05:56 executing program 2:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYBLOB="22811e2630b1d0ac3463"], 0x1)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r1, r2, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = getpgid(0xffffffffffffffff)
syz_open_procfs(r3, &(0x7f00000005c0)='net/ip6_tables_targets\x00')
process_vm_writev(0x0, &(0x7f0000000180)=[{&(0x7f0000000140)=""/22, 0x16}], 0x1, &(0x7f00000003c0)=[{&(0x7f0000000740)=""/173, 0xad}], 0x1, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
r4 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
setns(r2, 0x0)
r5 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
r6 = dup3(0xffffffffffffffff, r0, 0x80000)
setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8)
syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00')
sendmsg$IPVS_CMD_NEW_DEST(r6, &(0x7f0000000540)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x2000400}, 0xc, &(0x7f0000000500)={&(0x7f0000000240)=ANY=[@ANYPTR], 0x1}, 0x1, 0x0, 0x0, 0x10}, 0x4)
sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10}, 0xc, &(0x7f0000000340)={&(0x7f0000000480)=ANY=[@ANYBLOB='H\x00\x00\x00'], 0x1}, 0x1}, 0x0)
fcntl$setstatus(r1, 0x4, 0x6000)
mq_open(&(0x7f0000000800)=':em1\x00', 0x40, 0x4, &(0x7f0000000840)={0x0, 0x0, 0x9, 0x6, 0x0, 0xff, 0x7})
pwritev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000c00)}], 0x1, 0x0)
ioctl$DRM_IOCTL_AGP_ALLOC(r6, 0xc0206434, &(0x7f0000000440)={0x9dca, <r7=>0x0, 0x10002, 0x4})
ioctl$DRM_IOCTL_AGP_BIND(r5, 0x40106436, &(0x7f00000004c0)={r7, 0x676})
ioctl$sock_ifreq(r5, 0x8917, &(0x7f0000000300)={'lo\x00', @ifru_data=&(0x7f00000001c0)="16e667ea25efad95e8e866bb6ef7f6ba94b72b63a28bcb7eafa978bdbe09a4d8"})
getsockopt$inet_int(r4, 0x0, 0x0, &(0x7f0000000600), &(0x7f0000000640)=0x4)
getsockname$unix(r1, &(0x7f0000000680), &(0x7f0000000700)=0x6e)

2018/03/30 13:05:56 executing program 5:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYBLOB="00811e2630b1d0ac3463"], 0x1)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r1, r2, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
setns(r2, 0x0)
r3 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/loop-control\x00', 0x0, 0x0)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)
r4 = dup(r3)
getsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffff9c, 0x84, 0x6f, &(0x7f0000000340)={<r5=>0x0, 0x3c, &(0x7f00000005c0)=[@in={0x2, 0x4e23, @local={0xac, 0x14, 0x14, 0xaa}}, @in={0x2, 0x4e24, @broadcast=0xffffffff}, @in6={0xa, 0x0, 0x100000000, @loopback={0x0, 0x1}, 0x323d000000000}]}, &(0x7f0000000640)=0xc)
setsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r4, 0x84, 0xa, &(0x7f0000000680)={0xcff3, 0x80000000, 0x3, 0x0, 0x0, 0x66e, 0x5, 0x0, r5}, 0x20)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)
openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/mls\x00', 0x0, 0x0)
setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(0xffffffffffffffff, 0x10e, 0x2, &(0x7f0000000340)=0xc, 0x4)
madvise(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x9)
r6 = syz_open_dev$usbmon(&(0x7f0000000040)='/dev/usbmon#\x00', 0x0, 0x80000)
ioctl$KDSKBMODE(0xffffffffffffffff, 0x4b45, &(0x7f0000000080))
getsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r6, 0x84, 0x75, &(0x7f00000000c0)={0x0, 0x6}, &(0x7f0000000100)=0x8)
setsockopt$inet_sctp6_SCTP_AUTH_KEY(r6, 0x84, 0x17, &(0x7f0000000500)=ANY=[], 0x0)
ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)
r7 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
ioctl$TIOCLINUX3(r7, 0x541c, &(0x7f0000000040)=0x3)
ioctl$LOOP_CTL_REMOVE(r3, 0x4c81, 0x0)

2018/03/30 13:05:56 executing program 4:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
r1 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000002880)='/selinux/avc/cache_stats\x00', 0x0, 0x0)
ioctl$EVIOCSABS20(r1, 0x401845e0, &(0x7f00000028c0)={0x1000, 0x7fff, 0x1ff, 0xffffffff, 0x7, 0x40})
fchdir(r0)
r2 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(r2, &(0x7f0000000080)=ANY=[@ANYBLOB="00811e2630b1d0ac3463"], 0x1)
setsockopt$packet_add_memb(r2, 0x107, 0x1, &(0x7f0000002900)={0x0, 0x1, 0x6}, 0x10)
r3 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r2, r3, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r3, 0x0)
inotify_init1(0x800)
ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
r4 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
setns(r3, 0x8000000)
r5 = socket$nl_xfrm(0x10, 0x3, 0x6)
r6 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
dup3(r3, r0, 0x80000)
setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8)
r7 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00')
sendmsg$IPVS_CMD_NEW_DEST(0xffffffffffffffff, &(0x7f0000000540)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x2000400}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)=ANY=[@ANYBLOB=',\x00\x00\x00'], 0x1}, 0x1, 0x0, 0x0, 0x10}, 0x4)
sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10}, 0xc, &(0x7f0000000340)={&(0x7f0000000480)=ANY=[@ANYBLOB='H\x00\x00\x00'], 0x1}, 0x1}, 0x0)
sendmsg$IPVS_CMD_GET_DEST(r2, &(0x7f0000000880)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f00000005c0)={&(0x7f0000000740)={0x138, r7, 0x208, 0x70bd2b, 0x25dfdbfb, {0x8}, [@IPVS_CMD_ATTR_SERVICE={0x28, 0x1, [@IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@multicast2=0xe0000002}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x3}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x7fff}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x8c6}, @IPVS_CMD_ATTR_DAEMON={0x50, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @remote={0xac, 0x14, 0x14, 0xbb}}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x400}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x10001}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'syz_tun\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x6}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x2}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x30, 0x2, [@IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x2}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv6=@ipv4={[], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0xffffffff}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0xafa6}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x1}, @IPVS_CMD_ATTR_DEST={0x6c, 0x2, [@IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x7}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv4=@remote={0xac, 0x14, 0x14, 0xbb}}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x8}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x1}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x5}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x3}, @IPVS_DEST_ATTR_PORT={0x8, 0x2, 0x4e22}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv6=@mcast2={0xff, 0x2, [], 0x1}}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x10000}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x701a3921}]}]}, 0x138}, 0x1, 0x0, 0x0, 0x90}, 0x4)
fcntl$setstatus(r2, 0x4, 0x6000)
setsockopt$sock_linger(r4, 0x1, 0xd, &(0x7f00000008c0)={0x1, 0x2}, 0x8)
pwritev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000c00)="cfb93447d6feaef9f73c0561e075a8295d43017ab1a157786dcda36c5eec92a4306f284fa7e3ed364cc2da5c08cf7e4030d394520e123eee6d9ab275c91c174b1364fc943b49faefe12f605b5ce6c1400a91210c00477f900aff390901bf594c18557cb38a7d57ac8ded098b96b9dfc125e3bdc9305193f4cd256068baca5208160d820b9e7a043666ba4801cf6d557fc0f97f35c13ec6c0d1fe97ce1af1c17078ef47ab955200836671e402717481d14936b09828fd6f55fda2f11eb4c61b480e941133c0a4c5ec54033d0d174742191754ffe28b093596286a78ea01078337ada8585aa98dcc1143689002e31ccc5b9f5cfd2bbce5683a0f91b395391a60ba8e8f4d3c10c82c71caa74c44c8b0f3e42f1fc264497d5b9dabf309bad7bd", 0x11e}], 0x1, 0x0)
sendmmsg(r5, &(0x7f00000027c0)=[{{0x0, 0x0, &(0x7f0000000a00)=[{&(0x7f0000000900)="913da470640ae70fe168a71ad316e5525ce43547f28d8c56cb5cd246950c2d44a514698b3aebf2b60d933814378b0b9b750dec28bdbeedda6c8af5f3418ff8c43701e5dea492428ecdcf0e8c2a19f60e388b478179256834360c5ee359dbe4fabee36883a8314f0ea64dea3a732dffbe26a02e8327a0f7174a6990389e5b608d5300c271f26b3b37cc88e720a477e5f1aa2751af90d35d72606ac73f72dab39aad418a6335d44c785ba83edc9619a3221ae39ef2fed1657e426fa293a739cd779a6c645b3d29bb184041476e8e6e737e5fa1c4312360", 0xd6}], 0x1, 0x0, 0x0, 0x8000}, 0x3f}, {{&(0x7f0000002240)=@nl=@unspec, 0x80, &(0x7f0000002680)=[{&(0x7f00000022c0)="756a6b1895d55b0b292a3985cd35f28cfa8d5ab20a3448791e47ec9e971be82f993ebd55ec843a76ccd644a71222e57119e6f8866f59ba0b89c4cf71a9ce853f72bd99ac9097baf924ea3e3fbceaf0a0df15deb45ae757832bec56c67c0ad44e0ea5fcbc12f898989e1773427ad180efff1044e98613dab446587dd52a0deacb4074e01d97cd46c6e633ae1c1011fd2123c766e6fea028799cf82a562bd9d52c544241172f684398ac1b", 0xaa}, {&(0x7f0000002440)="c802b7c29c92c7ddcf8b11133e071ae83e8c0b0827764303ad44356d381633ce1fdd31e1641872e8d6b4c1a974d97d", 0x2f}, {&(0x7f0000002540)="446c9b3779f2a3dc39f3a3541d912b01ca9865e4172a83cda910f6b10dd97377212eb5279c", 0x25}], 0x3, &(0x7f0000002700)=[{0xa0, 0x10f, 0x200, "4f483406ed4a2e47550522989e031e3e239b59c5dc988744d266f33171b6d4a8e54f025a1e1be02c21ad9675e29aea96625352eec0db268e5c70b8e22a2bb0e11b9e6d9613d4e8e338194d9a41821db1ef97a16b16e5263d008bb6ce86b1e26f4d59926a9a72bed62192dc96eaa8a033c9ddaf2fc8c5fb9e765e5ff99cc5ae6fa7bc4a4f0abcb9c9745b54449ab38c"}], 0xa0, 0x800}, 0x1200000}], 0x2, 0x0)
sendmsg$IPVS_CMD_DEL_DAEMON(r2, &(0x7f0000000280)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000240)={&(0x7f0000000180)={0x28, 0x0, 0xb30, 0x0, 0x25dfdbfc, {0xa}, [@IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x3ff}, @IPVS_CMD_ATTR_SERVICE={0xc, 0x1, [@IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8}]}]}, 0x28}, 0x1}, 0x0)
ioctl$sock_ifreq(r6, 0x8917, &(0x7f0000000300)={'lo\x00', @ifru_data=&(0x7f00000001c0)="16e667ea25efad95e8e866bb6ef7f6ba94b72b63a28bcb7eafa978bdbe09a4d8"})
getsockopt$inet_int(r4, 0x0, 0x0, &(0x7f0000000600), &(0x7f0000000640)=0x4)
getsockname$unix(r2, &(0x7f0000000680), &(0x7f0000000700)=0x6e)

2018/03/30 13:05:56 executing program 7:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYBLOB="22811e2630b1d0ac3463"], 0x1)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r1, 0xffffffffffffffff, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = getpgid(0xffffffffffffffff)
syz_open_procfs(r3, &(0x7f00000005c0)='net/ip6_tables_targets\x00')
process_vm_writev(r3, &(0x7f0000000180)=[{&(0x7f0000000140)=""/22, 0x16}], 0x1, &(0x7f00000003c0)=[{&(0x7f0000000740)=""/173, 0xad}], 0x1, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
r4 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
r5 = dup3(0xffffffffffffffff, r0, 0x80000)
setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8)
syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00')
fcntl$setstatus(r1, 0x4, 0x6000)
mq_open(&(0x7f0000000800)=':em1\x00', 0x40, 0x4, &(0x7f0000000840)={0x4000000000000000, 0x0, 0x9, 0x6, 0x0, 0xff, 0x7})
pwritev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000c00)}], 0x1, 0x0)
ioctl$DRM_IOCTL_AGP_ALLOC(r5, 0xc0206434, &(0x7f0000000440)={0x9dca, <r6=>0x0, 0x10002, 0x4})
ioctl$DRM_IOCTL_AGP_BIND(r4, 0x40106436, &(0x7f00000004c0)={r6, 0x676})
ioctl$sock_ifreq(r4, 0x8917, &(0x7f0000000300)={'lo\x00', @ifru_data=&(0x7f00000001c0)="16e667ea25efad95e8e866bb6ef7f6ba94b72b63a28bcb7eafa978bdbe09a4d8"})
getsockopt$inet_int(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000600), &(0x7f0000000640)=0x4)
getsockname$unix(r1, &(0x7f0000000680), &(0x7f0000000700)=0x6e)

2018/03/30 13:05:56 executing program 6:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYBLOB="22811e2630b1d0ac3463"], 0x1)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r1, r2, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = getpgid(0xffffffffffffffff)
syz_open_procfs(r3, &(0x7f00000005c0)='net/ip6_tables_targets\x00')
process_vm_writev(r3, &(0x7f0000000180)=[{&(0x7f0000000140)=""/22, 0x16}], 0x1, &(0x7f00000003c0)=[{&(0x7f0000000740)=""/173, 0xad}], 0x1, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
r4 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
r5 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
r6 = dup3(0xffffffffffffffff, r0, 0x0)
setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8)
syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00')
sendmsg$IPVS_CMD_NEW_DEST(r6, &(0x7f0000000540)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x2000400}, 0xc, &(0x7f0000000500)={&(0x7f0000000240)=ANY=[@ANYPTR], 0x1}, 0x1, 0x0, 0x0, 0x10}, 0x4)
fcntl$setstatus(r1, 0x4, 0x6000)
mq_open(&(0x7f0000000800)=':em1\x00', 0x40, 0x4, &(0x7f0000000840)={0x4000000000000000, 0x0, 0x9, 0x6, 0x0, 0xff, 0x7})
pwritev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000c00)}], 0x1, 0x0)
ioctl$DRM_IOCTL_AGP_ALLOC(r6, 0xc0206434, &(0x7f0000000440)={0x9dca, <r7=>0x0, 0x10002, 0x4})
ioctl$DRM_IOCTL_AGP_BIND(0xffffffffffffffff, 0x40106436, &(0x7f00000004c0)={r7, 0x676})
ioctl$sock_ifreq(r5, 0x8917, &(0x7f0000000300)={'lo\x00', @ifru_data=&(0x7f00000001c0)="16e667ea25efad95e8e866bb6ef7f6ba94b72b63a28bcb7eafa978bdbe09a4d8"})
getsockopt$inet_int(r4, 0x0, 0x0, &(0x7f0000000600), &(0x7f0000000640)=0x4)
getsockname$unix(r1, &(0x7f0000000680), &(0x7f0000000700)=0x6e)

** 2 printk messages dropped ** [  587.843171] binder: 29817:29828 got transaction with invalid offset (0, min 24 max 40) or object.
2018/03/30 13:05:56 executing program 5:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYBLOB="00811e2630b1d0ac3463"], 0x1)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r1, r2, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
setns(r2, 0x0)
r3 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/loop-control\x00', 0x0, 0x0)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)
r4 = dup(r3)
getsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffff9c, 0x84, 0x6f, &(0x7f0000000340)={<r5=>0x0, 0x3c, &(0x7f00000005c0)=[@in={0x2, 0x4e23, @local={0xac, 0x14, 0x14, 0xaa}}, @in={0x2, 0x4e24, @broadcast=0xffffffff}, @in6={0xa, 0x0, 0x100000000, @loopback={0x0, 0x1}, 0x323d000000000}]}, &(0x7f0000000640)=0xc)
setsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r4, 0x84, 0xa, &(0x7f0000000680)={0xcff3, 0x80000000, 0x3, 0x0, 0x0, 0x66e, 0x5, 0x0, r5}, 0x20)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)
openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/mls\x00', 0x0, 0x0)
setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(0xffffffffffffffff, 0x10e, 0x2, &(0x7f0000000340)=0xc, 0x4)
madvise(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x9)
r6 = syz_open_dev$usbmon(&(0x7f0000000040)='/dev/usbmon#\x00', 0x0, 0x80000)
ioctl$KDSKBMODE(0xffffffffffffffff, 0x4b45, &(0x7f0000000080))
getsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r6, 0x84, 0x75, &(0x7f00000000c0)={0x0, 0x6}, &(0x7f0000000100)=0x8)
setsockopt$inet_sctp6_SCTP_AUTH_KEY(r6, 0x84, 0x17, &(0x7f0000000500)=ANY=[], 0x0)
ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)
r7 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
ioctl$TIOCLINUX3(r7, 0x541c, &(0x7f0000000040)=0x3)
ioctl$LOOP_CTL_REMOVE(r3, 0x4c81, 0x0)

2018/03/30 13:05:56 executing program 3:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[], 0x0)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r1, r2, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
setns(r2, 0x0)
r3 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/loop-control\x00', 0x0, 0x0)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)
r4 = dup(r3)
getsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffff9c, 0x84, 0x6f, &(0x7f0000000340)={<r5=>0x0, 0x3c, &(0x7f00000005c0)=[@in={0x2, 0x4e23, @local={0xac, 0x14, 0x14, 0xaa}}, @in={0x2, 0x4e24, @broadcast=0xffffffff}, @in6={0xa, 0x0, 0x100000000, @loopback={0x0, 0x1}, 0x323d000000000}]}, &(0x7f0000000640)=0xc)
setsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r4, 0x84, 0xa, &(0x7f0000000680)={0xcff3, 0x80000000, 0x3, 0x0, 0x0, 0x66e, 0x5, 0x1, r5}, 0x20)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)
mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x5c831, 0xffffffffffffffff, 0x0)
openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/mls\x00', 0x0, 0x0)
setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(0xffffffffffffffff, 0x10e, 0x2, &(0x7f0000000340)=0xc, 0x4)
madvise(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x9)
r6 = syz_open_dev$usbmon(&(0x7f0000000040)='/dev/usbmon#\x00', 0x0, 0x80000)
ioctl$KDSKBMODE(0xffffffffffffffff, 0x4b45, &(0x7f0000000080))
getsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r6, 0x84, 0x75, &(0x7f00000000c0)={0x0, 0x6}, &(0x7f0000000100)=0x8)
setsockopt$inet_sctp6_SCTP_AUTH_KEY(r6, 0x84, 0x17, &(0x7f0000000500)=ANY=[], 0x0)
ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82)
ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82)
r7 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
ioctl$TIOCLINUX3(r7, 0x541c, &(0x7f0000000040)=0x3)
ioctl$LOOP_CTL_REMOVE(r3, 0x4c81, 0x0)

** 25 printk messages dropped ** [  587.918034] binder: undelivered TRANSACTION_ERROR: 29201
** 14 printk messages dropped ** [  587.984515] binder: 29852:29858 transaction failed 29201/-22, size 40-16 line 3197
[  587.987084] binder: BINDER_SET_CONTEXT_MGR already set
[  587.987092] binder: 29856:29859 ioctl 40046207 0 returned -16
[  587.988027] binder: 29856:29859 got transaction with invalid offset (0, min 24 max 40) or object.
[  587.988132] binder: 29856:29859 transaction failed 29201/-22, size 40-16 line 3197
[  587.988397] binder: BINDER_SET_CONTEXT_MGR already set
2018/03/30 13:05:57 executing program 1:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYBLOB="22811e2630b1d0ac3463"], 0x1)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r1, r2, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = getpgid(0xffffffffffffffff)
syz_open_procfs(r3, &(0x7f00000005c0)='net/ip6_tables_targets\x00')
process_vm_writev(r3, &(0x7f0000000180), 0x0, &(0x7f00000003c0)=[{&(0x7f0000000740)=""/173, 0xad}], 0x1, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
r4 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
r5 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
r6 = dup3(0xffffffffffffffff, r0, 0x80000)
setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8)
syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00')
fcntl$setstatus(r1, 0x4, 0x6000)
mq_open(&(0x7f0000000800)=':em1\x00', 0x40, 0x4, &(0x7f0000000840)={0x4000000000000000, 0x0, 0x9, 0x6, 0x0, 0xff, 0x7})
pwritev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000c00)}], 0x1, 0x0)
ioctl$DRM_IOCTL_AGP_ALLOC(r6, 0xc0206434, &(0x7f0000000440)={0x9dca, <r7=>0x0, 0x10002, 0x4})
ioctl$DRM_IOCTL_AGP_BIND(0xffffffffffffffff, 0x40106436, &(0x7f00000004c0)={r7, 0x676})
ioctl$sock_ifreq(r5, 0x8917, &(0x7f0000000300)={'lo\x00', @ifru_data=&(0x7f00000001c0)="16e667ea25efad95e8e866bb6ef7f6ba94b72b63a28bcb7eafa978bdbe09a4d8"})
getsockopt$inet_int(r4, 0x0, 0x0, &(0x7f0000000600), &(0x7f0000000640)=0x4)
getsockname$unix(r1, &(0x7f0000000680), &(0x7f0000000700)=0x6e)

2018/03/30 13:05:57 executing program 2:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYBLOB="22811e2630b1d0ac3463"], 0x1)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r1, r2, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = getpgid(0xffffffffffffffff)
syz_open_procfs(r3, &(0x7f00000005c0)='net/ip6_tables_targets\x00')
process_vm_writev(r3, &(0x7f0000000180), 0x0, &(0x7f00000003c0)=[{&(0x7f0000000740)=""/173, 0xad}], 0x1, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
r4 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
setns(r2, 0x0)
r5 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
r6 = dup3(0xffffffffffffffff, r0, 0x80000)
setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8)
syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00')
sendmsg$IPVS_CMD_NEW_DEST(r6, &(0x7f0000000540)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x2000400}, 0xc, &(0x7f0000000500)={&(0x7f0000000240)=ANY=[@ANYPTR], 0x1}, 0x1, 0x0, 0x0, 0x10}, 0x4)
sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10}, 0xc, &(0x7f0000000340)={&(0x7f0000000480)=ANY=[@ANYBLOB='H\x00\x00\x00'], 0x1}, 0x1}, 0x0)
fcntl$setstatus(r1, 0x4, 0x6000)
mq_open(&(0x7f0000000800)=':em1\x00', 0x40, 0x4, &(0x7f0000000840)={0x0, 0x0, 0x9, 0x6, 0x0, 0xff, 0x7})
pwritev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000c00)}], 0x1, 0x0)
ioctl$DRM_IOCTL_AGP_ALLOC(r6, 0xc0206434, &(0x7f0000000440)={0x9dca, <r7=>0x0, 0x10002, 0x4})
ioctl$DRM_IOCTL_AGP_BIND(r5, 0x40106436, &(0x7f00000004c0)={r7, 0x676})
ioctl$sock_ifreq(r5, 0x8917, &(0x7f0000000300)={'lo\x00', @ifru_data=&(0x7f00000001c0)="16e667ea25efad95e8e866bb6ef7f6ba94b72b63a28bcb7eafa978bdbe09a4d8"})
getsockopt$inet_int(r4, 0x0, 0x0, &(0x7f0000000600), &(0x7f0000000640)=0x4)
getsockname$unix(r1, &(0x7f0000000680), &(0x7f0000000700)=0x6e)

2018/03/30 13:05:57 executing program 7:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYBLOB="22811e2630b1d0ac3463"], 0x1)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r1, r2, 0x0, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = getpgid(0xffffffffffffffff)
syz_open_procfs(r3, &(0x7f00000005c0)='net/ip6_tables_targets\x00')
process_vm_writev(r3, &(0x7f0000000180)=[{&(0x7f0000000140)=""/22, 0x16}], 0x1, &(0x7f00000003c0)=[{&(0x7f0000000740)=""/173, 0xad}], 0x1, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
r4 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
r5 = dup3(0xffffffffffffffff, r0, 0x80000)
setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8)
syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00')
fcntl$setstatus(r1, 0x4, 0x6000)
mq_open(&(0x7f0000000800)=':em1\x00', 0x40, 0x4, &(0x7f0000000840)={0x4000000000000000, 0x0, 0x9, 0x6, 0x0, 0xff, 0x7})
pwritev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000c00)}], 0x1, 0x0)
ioctl$DRM_IOCTL_AGP_ALLOC(r5, 0xc0206434, &(0x7f0000000440)={0x9dca, <r6=>0x0, 0x10002, 0x4})
ioctl$DRM_IOCTL_AGP_BIND(r4, 0x40106436, &(0x7f00000004c0)={r6, 0x676})
ioctl$sock_ifreq(r4, 0x8917, &(0x7f0000000300)={'lo\x00', @ifru_data=&(0x7f00000001c0)="16e667ea25efad95e8e866bb6ef7f6ba94b72b63a28bcb7eafa978bdbe09a4d8"})
getsockopt$inet_int(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000600), &(0x7f0000000640)=0x4)
getsockname$unix(r1, &(0x7f0000000680), &(0x7f0000000700)=0x6e)

2018/03/30 13:05:57 executing program 0:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYBLOB="22811e2630b1d0ac3463"], 0x1)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r1, r2, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = getpgid(0xffffffffffffffff)
syz_open_procfs(r3, &(0x7f00000005c0)='net/ip6_tables_targets\x00')
process_vm_writev(r3, &(0x7f0000000180)=[{&(0x7f0000000140)=""/22, 0x16}], 0x1, &(0x7f00000003c0)=[{&(0x7f0000000740)=""/173, 0xad}], 0x1, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
r4 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
setns(r2, 0x0)
r5 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
r6 = dup3(0xffffffffffffffff, r0, 0x80000)
setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8)
syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00')
sendmsg$IPVS_CMD_NEW_DEST(r6, &(0x7f0000000540)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x2000400}, 0xc, &(0x7f0000000500)={&(0x7f0000000240)=ANY=[@ANYPTR], 0x1}, 0x1, 0x0, 0x0, 0x10}, 0x0)
sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10}, 0xc, &(0x7f0000000340)={&(0x7f0000000480)=ANY=[@ANYBLOB='H\x00\x00\x00'], 0x1}, 0x1}, 0x0)
fcntl$setstatus(r1, 0x4, 0x6000)
mq_open(&(0x7f0000000800)=':em1\x00', 0x40, 0x4, &(0x7f0000000840)={0x4000000000000000, 0x0, 0x9, 0x6, 0x0, 0xff, 0x7})
pwritev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000c00)}], 0x1, 0x0)
ioctl$DRM_IOCTL_AGP_ALLOC(r6, 0xc0206434, &(0x7f0000000440)={0x9dca, <r7=>0x0, 0x10002, 0x4})
ioctl$DRM_IOCTL_AGP_BIND(r5, 0x40106436, &(0x7f00000004c0)={r7, 0x676})
ioctl$sock_ifreq(r5, 0x8917, &(0x7f0000000300)={'lo\x00', @ifru_data=&(0x7f00000001c0)="16e667ea25efad95e8e866bb6ef7f6ba94b72b63a28bcb7eafa978bdbe09a4d8"})
getsockopt$inet_int(r4, 0x0, 0x0, &(0x7f0000000600), &(0x7f0000000640)=0x4)
getsockname$unix(r1, &(0x7f0000000680), &(0x7f0000000700)=0x6e)

2018/03/30 13:05:57 executing program 6:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYBLOB="22811e2630b1d0ac3463"], 0x1)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r1, r2, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = getpgid(0xffffffffffffffff)
syz_open_procfs(r3, &(0x7f00000005c0)='net/ip6_tables_targets\x00')
process_vm_writev(r3, &(0x7f0000000180)=[{&(0x7f0000000140)=""/22, 0x16}], 0x1, &(0x7f00000003c0)=[{&(0x7f0000000740)=""/173, 0xad}], 0x1, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
r4 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
r5 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
r6 = dup3(0xffffffffffffffff, r0, 0x0)
setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8)
syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00')
sendmsg$IPVS_CMD_NEW_DEST(r6, &(0x7f0000000540)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x2000400}, 0xc, &(0x7f0000000500)={&(0x7f0000000240)=ANY=[@ANYPTR], 0x1}, 0x1, 0x0, 0x0, 0x10}, 0x4)
fcntl$setstatus(r1, 0x4, 0x6000)
mq_open(&(0x7f0000000800)=':em1\x00', 0x40, 0x4, &(0x7f0000000840)={0x4000000000000000, 0x0, 0x9, 0x6, 0x0, 0xff, 0x7})
pwritev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000c00)}], 0x1, 0x0)
ioctl$DRM_IOCTL_AGP_ALLOC(r6, 0xc0206434, &(0x7f0000000440)={0x9dca, <r7=>0x0, 0x10002, 0x4})
ioctl$DRM_IOCTL_AGP_BIND(r5, 0x40106436, &(0x7f00000004c0)={0x0, 0x676})
ioctl$sock_ifreq(r5, 0x8917, &(0x7f0000000300)={'lo\x00', @ifru_data=&(0x7f00000001c0)="16e667ea25efad95e8e866bb6ef7f6ba94b72b63a28bcb7eafa978bdbe09a4d8"})
getsockopt$inet_int(r4, 0x0, 0x0, &(0x7f0000000600), &(0x7f0000000640)=0x4)
getsockname$unix(r1, &(0x7f0000000680), &(0x7f0000000700)=0x6e)

2018/03/30 13:05:57 executing program 3:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[], 0x0)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r1, r2, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
setns(r2, 0x0)
r3 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/loop-control\x00', 0x0, 0x0)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)
r4 = dup(r3)
getsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffff9c, 0x84, 0x6f, &(0x7f0000000340)={<r5=>0x0, 0x3c, &(0x7f00000005c0)=[@in={0x2, 0x4e23, @local={0xac, 0x14, 0x14, 0xaa}}, @in={0x2, 0x4e24, @broadcast=0xffffffff}, @in6={0xa, 0x0, 0x100000000, @loopback={0x0, 0x1}, 0x323d000000000}]}, &(0x7f0000000640)=0xc)
setsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r4, 0x84, 0xa, &(0x7f0000000680)={0xcff3, 0x80000000, 0x3, 0x0, 0x0, 0x66e, 0x5, 0x1, r5}, 0x20)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)
mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x5c831, 0xffffffffffffffff, 0x0)
openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/mls\x00', 0x0, 0x0)
setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(0xffffffffffffffff, 0x10e, 0x2, &(0x7f0000000340)=0xc, 0x4)
madvise(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x9)
r6 = syz_open_dev$usbmon(&(0x7f0000000040)='/dev/usbmon#\x00', 0x0, 0x80000)
ioctl$KDSKBMODE(0xffffffffffffffff, 0x4b45, &(0x7f0000000080))
getsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r6, 0x84, 0x75, &(0x7f00000000c0)={0x0, 0x6}, &(0x7f0000000100)=0x8)
setsockopt$inet_sctp6_SCTP_AUTH_KEY(r6, 0x84, 0x17, &(0x7f0000000500)=ANY=[], 0x0)
ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82)
ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82)
r7 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
ioctl$TIOCLINUX3(r7, 0x541c, &(0x7f0000000040)=0x3)
ioctl$LOOP_CTL_REMOVE(r3, 0x4c81, 0x0)

2018/03/30 13:05:57 executing program 4:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
r1 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000002880)='/selinux/avc/cache_stats\x00', 0x0, 0x0)
ioctl$EVIOCSABS20(r1, 0x401845e0, &(0x7f00000028c0)={0x1000, 0x7fff, 0x1ff, 0xffffffff, 0x7, 0x40})
fchdir(r0)
r2 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(r2, &(0x7f0000000080)=ANY=[@ANYBLOB="00811e2630b1d0ac3463"], 0x1)
setsockopt$packet_add_memb(r2, 0x107, 0x1, &(0x7f0000002900)={0x0, 0x1, 0x6}, 0x10)
r3 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r2, r3, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r3, 0x0)
inotify_init1(0x800)
ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
r4 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
setns(r3, 0x8000000)
r5 = socket$nl_xfrm(0x10, 0x3, 0x6)
r6 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
dup3(r3, r0, 0x80000)
setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8)
r7 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00')
sendmsg$IPVS_CMD_NEW_DEST(0xffffffffffffffff, &(0x7f0000000540)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x2000400}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)=ANY=[@ANYBLOB=',\x00\x00\x00'], 0x1}, 0x1, 0x0, 0x0, 0x10}, 0x4)
sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10}, 0xc, &(0x7f0000000340)={&(0x7f0000000480)=ANY=[@ANYBLOB='H\x00\x00\x00'], 0x1}, 0x1}, 0x0)
sendmsg$IPVS_CMD_GET_DEST(r2, &(0x7f0000000880)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f00000005c0)={&(0x7f0000000740)={0x138, r7, 0x208, 0x70bd2b, 0x25dfdbfb, {0x8}, [@IPVS_CMD_ATTR_SERVICE={0x28, 0x1, [@IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@multicast2=0xe0000002}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x3}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x7fff}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x8c6}, @IPVS_CMD_ATTR_DAEMON={0x50, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @remote={0xac, 0x14, 0x14, 0xbb}}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x400}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x10001}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'syz_tun\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x6}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x2}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x30, 0x2, [@IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x2}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv6=@ipv4={[], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0xffffffff}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0xafa6}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x1}, @IPVS_CMD_ATTR_DEST={0x6c, 0x2, [@IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x7}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv4=@remote={0xac, 0x14, 0x14, 0xbb}}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x8}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x1}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x5}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x3}, @IPVS_DEST_ATTR_PORT={0x8, 0x2, 0x4e22}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv6=@mcast2={0xff, 0x2, [], 0x1}}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x10000}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x701a3921}]}]}, 0x138}, 0x1, 0x0, 0x0, 0x90}, 0x4)
fcntl$setstatus(r2, 0x4, 0x6000)
setsockopt$sock_linger(r4, 0x1, 0xd, &(0x7f00000008c0)={0x1, 0x2}, 0x8)
pwritev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000c00)="cfb93447d6feaef9f73c0561e075a8295d43017ab1a157786dcda36c5eec92a4306f284fa7e3ed364cc2da5c08cf7e4030d394520e123eee6d9ab275c91c174b1364fc943b49faefe12f605b5ce6c1400a91210c00477f900aff390901bf594c18557cb38a7d57ac8ded098b96b9dfc125e3bdc9305193f4cd256068baca5208160d820b9e7a043666ba4801cf6d557fc0f97f35c13ec6c0d1fe97ce1af1c17078ef47ab955200836671e402717481d14936b09828fd6f55fda2f11eb4c61b480e941133c0a4c5ec54033d0d174742191754ffe28b093596286a78ea01078337ada8585aa98dcc1143689002e31ccc5b9f5cfd2bbce5683a0f91b395391a60ba8e8f4d3c10c82c71caa74c44c8b0f3e42f1fc264497d5b9dabf309bad7bd", 0x11e}], 0x1, 0x0)
sendmmsg(r5, &(0x7f00000027c0)=[{{0x0, 0x0, &(0x7f0000000a00)=[{&(0x7f0000000900)="913da470640ae70fe168a71ad316e5525ce43547f28d8c56cb5cd246950c2d44a514698b3aebf2b60d933814378b0b9b750dec28bdbeedda6c8af5f3418ff8c43701e5dea492428ecdcf0e8c2a19f60e388b478179256834360c5ee359dbe4fabee36883a8314f0ea64dea3a732dffbe26a02e8327a0f7174a6990389e5b608d5300c271f26b3b37cc88e720a477e5f1aa2751af90d35d72606ac73f72dab39aad418a6335d44c785ba83edc9619a3221ae39ef2fed1657e426fa293a739cd779a6c645b3d29bb184041476e8e6e737e5fa1c4312360", 0xd6}], 0x1, 0x0, 0x0, 0x8000}, 0x3f}, {{&(0x7f0000002240)=@nl=@unspec, 0x80, &(0x7f0000002680)=[{&(0x7f00000022c0)="756a6b1895d55b0b292a3985cd35f28cfa8d5ab20a3448791e47ec9e971be82f993ebd55ec843a76ccd644a71222e57119e6f8866f59ba0b89c4cf71a9ce853f72bd99ac9097baf924ea3e3fbceaf0a0df15deb45ae757832bec56c67c0ad44e0ea5fcbc12f898989e1773427ad180efff1044e98613dab446587dd52a0deacb4074e01d97cd46c6e633ae1c1011fd2123c766e6fea028799cf82a562bd9d52c544241172f684398ac1b", 0xaa}, {&(0x7f0000002440)="c802b7c29c92c7ddcf8b11133e071ae83e8c0b0827764303ad44356d381633ce1fdd31e1641872e8d6b4c1a974d97d", 0x2f}, {&(0x7f0000002540)="446c9b3779f2a3dc39f3a3541d912b01ca9865e4172a83cda910f6b10dd97377212eb5279c", 0x25}], 0x3, &(0x7f0000002700)=[{0xa0, 0x10f, 0x200, "4f483406ed4a2e47550522989e031e3e239b59c5dc988744d266f33171b6d4a8e54f025a1e1be02c21ad9675e29aea96625352eec0db268e5c70b8e22a2bb0e11b9e6d9613d4e8e338194d9a41821db1ef97a16b16e5263d008bb6ce86b1e26f4d59926a9a72bed62192dc96eaa8a033c9ddaf2fc8c5fb9e765e5ff99cc5ae6fa7bc4a4f0abcb9c9745b54449ab38c"}], 0xa0, 0x800}, 0x1200000}], 0x2, 0x0)
sendmsg$IPVS_CMD_DEL_DAEMON(r2, &(0x7f0000000280)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000240)={&(0x7f0000000180)={0x28, 0x0, 0xb30, 0x0, 0x25dfdbfc, {0xa}, [@IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x3ff}, @IPVS_CMD_ATTR_SERVICE={0xc, 0x1, [@IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8}]}]}, 0x28}, 0x1}, 0x0)
ioctl$sock_ifreq(r6, 0x8917, &(0x7f0000000300)={'lo\x00', @ifru_data=&(0x7f00000001c0)="16e667ea25efad95e8e866bb6ef7f6ba94b72b63a28bcb7eafa978bdbe09a4d8"})
getsockopt$inet_int(r4, 0x0, 0x0, &(0x7f0000000600), &(0x7f0000000640)=0x4)
getsockname$unix(r2, &(0x7f0000000680), &(0x7f0000000700)=0x6e)

2018/03/30 13:05:57 executing program 5:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYBLOB="00811e2630b1d0ac3463"], 0x1)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r1, r2, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
setns(r2, 0x0)
r3 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/loop-control\x00', 0x0, 0x0)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)
r4 = dup(r3)
getsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffff9c, 0x84, 0x6f, &(0x7f0000000340)={<r5=>0x0, 0x3c, &(0x7f00000005c0)=[@in={0x2, 0x4e23, @local={0xac, 0x14, 0x14, 0xaa}}, @in={0x2, 0x4e24, @broadcast=0xffffffff}, @in6={0xa, 0x0, 0x100000000, @loopback={0x0, 0x1}, 0x323d000000000}]}, &(0x7f0000000640)=0xc)
setsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r4, 0x84, 0xa, &(0x7f0000000680)={0xcff3, 0x80000000, 0x3, 0x0, 0x0, 0x66e, 0x5, 0x0, r5}, 0x20)
mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x5c831, 0xffffffffffffffff, 0x0)
openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/mls\x00', 0x0, 0x0)
setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(0xffffffffffffffff, 0x10e, 0x2, &(0x7f0000000340)=0xc, 0x4)
madvise(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x9)
r6 = syz_open_dev$usbmon(&(0x7f0000000040)='/dev/usbmon#\x00', 0x0, 0x80000)
ioctl$KDSKBMODE(0xffffffffffffffff, 0x4b45, &(0x7f0000000080))
getsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r6, 0x84, 0x75, &(0x7f00000000c0)={0x0, 0x6}, &(0x7f0000000100)=0x8)
setsockopt$inet_sctp6_SCTP_AUTH_KEY(r6, 0x84, 0x17, &(0x7f0000000500)=ANY=[], 0x0)
ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)
r7 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
ioctl$TIOCLINUX3(r7, 0x541c, &(0x7f0000000040)=0x3)
ioctl$LOOP_CTL_REMOVE(r3, 0x4c81, 0x0)

[  587.988445] binder: 29850:29854 ioctl 40046207 0 returned -16
[  587.990168] binder: 29850:29854 got transaction with invalid offset (0, min 24 max 40) or object.
[  587.990250] binder: 29850:29854 transaction failed 29201/-22, size 40-16 line 3197
[  587.996033] binder: BINDER_SET_CONTEXT_MGR already set
[  587.996041] binder: 29855:29862 ioctl 40046207 0 returned -16
[  587.998932] binder: 29855:29862 got transaction with invalid offset (0, min 24 max 40) or object.
[  587.999029] binder: 29855:29862 transaction failed 29201/-22, size 40-16 line 3197
[  588.017204] binder: undelivered TRANSACTION_ERROR: 29201
[  588.020723] binder: BINDER_SET_CONTEXT_MGR already set
2018/03/30 13:05:57 executing program 5:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYBLOB="00811e2630b1d0ac3463"], 0x1)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r1, r2, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
setns(r2, 0x0)
r3 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/loop-control\x00', 0x0, 0x0)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)
r4 = dup(r3)
getsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffff9c, 0x84, 0x6f, &(0x7f0000000340)={<r5=>0x0, 0x3c, &(0x7f00000005c0)=[@in={0x2, 0x4e23, @local={0xac, 0x14, 0x14, 0xaa}}, @in={0x2, 0x4e24, @broadcast=0xffffffff}, @in6={0xa, 0x0, 0x100000000, @loopback={0x0, 0x1}, 0x323d000000000}]}, &(0x7f0000000640)=0xc)
setsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r4, 0x84, 0xa, &(0x7f0000000680)={0xcff3, 0x80000000, 0x3, 0x0, 0x0, 0x66e, 0x5, 0x0, r5}, 0x20)
mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x5c831, 0xffffffffffffffff, 0x0)
openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/mls\x00', 0x0, 0x0)
setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(0xffffffffffffffff, 0x10e, 0x2, &(0x7f0000000340)=0xc, 0x4)
madvise(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x9)
r6 = syz_open_dev$usbmon(&(0x7f0000000040)='/dev/usbmon#\x00', 0x0, 0x80000)
ioctl$KDSKBMODE(0xffffffffffffffff, 0x4b45, &(0x7f0000000080))
getsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r6, 0x84, 0x75, &(0x7f00000000c0)={0x0, 0x6}, &(0x7f0000000100)=0x8)
setsockopt$inet_sctp6_SCTP_AUTH_KEY(r6, 0x84, 0x17, &(0x7f0000000500)=ANY=[], 0x0)
ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)
r7 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
ioctl$TIOCLINUX3(r7, 0x541c, &(0x7f0000000040)=0x3)
ioctl$LOOP_CTL_REMOVE(r3, 0x4c81, 0x0)

2018/03/30 13:05:57 executing program 3:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[], 0x0)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r1, r2, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
setns(r2, 0x0)
r3 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/loop-control\x00', 0x0, 0x0)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)
r4 = dup(r3)
getsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffff9c, 0x84, 0x6f, &(0x7f0000000340)={<r5=>0x0, 0x3c, &(0x7f00000005c0)=[@in={0x2, 0x4e23, @local={0xac, 0x14, 0x14, 0xaa}}, @in={0x2, 0x4e24, @broadcast=0xffffffff}, @in6={0xa, 0x0, 0x100000000, @loopback={0x0, 0x1}, 0x323d000000000}]}, &(0x7f0000000640)=0xc)
setsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r4, 0x84, 0xa, &(0x7f0000000680)={0xcff3, 0x80000000, 0x3, 0x0, 0x0, 0x66e, 0x5, 0x1, r5}, 0x20)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)
mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x5c831, 0xffffffffffffffff, 0x0)
openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/mls\x00', 0x0, 0x0)
setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(0xffffffffffffffff, 0x10e, 0x2, &(0x7f0000000340)=0xc, 0x4)
madvise(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x9)
r6 = syz_open_dev$usbmon(&(0x7f0000000040)='/dev/usbmon#\x00', 0x0, 0x80000)
ioctl$KDSKBMODE(0xffffffffffffffff, 0x4b45, &(0x7f0000000080))
getsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r6, 0x84, 0x75, &(0x7f00000000c0)={0x0, 0x6}, &(0x7f0000000100)=0x8)
setsockopt$inet_sctp6_SCTP_AUTH_KEY(r6, 0x84, 0x17, &(0x7f0000000500)=ANY=[], 0x0)
ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82)
ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82)
r7 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
ioctl$TIOCLINUX3(r7, 0x541c, &(0x7f0000000040)=0x3)
ioctl$LOOP_CTL_REMOVE(r3, 0x4c81, 0x0)

[  588.020771] binder: 29861:29868 ioctl 40046207 0 returned -16
[  588.024772] binder: BINDER_SET_CONTEXT_MGR already set
2018/03/30 13:05:57 executing program 1:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYBLOB="22811e2630b1d0ac3463"], 0x1)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r1, r2, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = getpgid(0xffffffffffffffff)
syz_open_procfs(r3, &(0x7f00000005c0)='net/ip6_tables_targets\x00')
process_vm_writev(r3, &(0x7f0000000180), 0x0, &(0x7f00000003c0)=[{&(0x7f0000000740)=""/173, 0xad}], 0x1, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
r4 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
r5 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
r6 = dup3(0xffffffffffffffff, r0, 0x80000)
setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8)
syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00')
fcntl$setstatus(r1, 0x4, 0x6000)
mq_open(&(0x7f0000000800)=':em1\x00', 0x40, 0x4, &(0x7f0000000840)={0x4000000000000000, 0x0, 0x9, 0x6, 0x0, 0xff, 0x7})
pwritev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000c00)}], 0x1, 0x0)
ioctl$DRM_IOCTL_AGP_ALLOC(r6, 0xc0206434, &(0x7f0000000440)={0x9dca, <r7=>0x0, 0x10002, 0x4})
ioctl$DRM_IOCTL_AGP_BIND(0xffffffffffffffff, 0x40106436, &(0x7f00000004c0)={r7, 0x676})
ioctl$sock_ifreq(r5, 0x8917, &(0x7f0000000300)={'lo\x00', @ifru_data=&(0x7f00000001c0)="16e667ea25efad95e8e866bb6ef7f6ba94b72b63a28bcb7eafa978bdbe09a4d8"})
getsockopt$inet_int(r4, 0x0, 0x0, &(0x7f0000000600), &(0x7f0000000640)=0x4)
getsockname$unix(r1, &(0x7f0000000680), &(0x7f0000000700)=0x6e)

2018/03/30 13:05:57 executing program 2:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYBLOB="22811e2630b1d0ac3463"], 0x1)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r1, r2, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = getpgid(0xffffffffffffffff)
syz_open_procfs(r3, &(0x7f00000005c0)='net/ip6_tables_targets\x00')
process_vm_writev(r3, &(0x7f0000000180), 0x0, &(0x7f00000003c0)=[{&(0x7f0000000740)=""/173, 0xad}], 0x1, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
r4 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
setns(r2, 0x0)
r5 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
r6 = dup3(0xffffffffffffffff, r0, 0x80000)
setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8)
syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00')
sendmsg$IPVS_CMD_NEW_DEST(r6, &(0x7f0000000540)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x2000400}, 0xc, &(0x7f0000000500)={&(0x7f0000000240)=ANY=[@ANYPTR], 0x1}, 0x1, 0x0, 0x0, 0x10}, 0x4)
sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10}, 0xc, &(0x7f0000000340)={&(0x7f0000000480)=ANY=[@ANYBLOB='H\x00\x00\x00'], 0x1}, 0x1}, 0x0)
fcntl$setstatus(r1, 0x4, 0x6000)
mq_open(&(0x7f0000000800)=':em1\x00', 0x40, 0x4, &(0x7f0000000840)={0x0, 0x0, 0x9, 0x6, 0x0, 0xff, 0x7})
pwritev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000c00)}], 0x1, 0x0)
ioctl$DRM_IOCTL_AGP_ALLOC(r6, 0xc0206434, &(0x7f0000000440)={0x9dca, <r7=>0x0, 0x10002, 0x4})
ioctl$DRM_IOCTL_AGP_BIND(r5, 0x40106436, &(0x7f00000004c0)={r7, 0x676})
ioctl$sock_ifreq(r5, 0x8917, &(0x7f0000000300)={'lo\x00', @ifru_data=&(0x7f00000001c0)="16e667ea25efad95e8e866bb6ef7f6ba94b72b63a28bcb7eafa978bdbe09a4d8"})
getsockopt$inet_int(r4, 0x0, 0x0, &(0x7f0000000600), &(0x7f0000000640)=0x4)
getsockname$unix(r1, &(0x7f0000000680), &(0x7f0000000700)=0x6e)

** 9 printk messages dropped ** [  588.055422] binder: 29865:29873 transaction failed 29201/-22, size 40-16 line 3197
** 14 printk messages dropped ** [  588.127571] binder: 29880:29885 got transaction with invalid offset (0, min 24 max 40) or object.
2018/03/30 13:05:57 executing program 5:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYBLOB="00811e2630b1d0ac3463"], 0x1)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r1, r2, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
setns(r2, 0x0)
r3 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/loop-control\x00', 0x0, 0x0)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)
r4 = dup(r3)
getsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffff9c, 0x84, 0x6f, &(0x7f0000000340)={<r5=>0x0, 0x3c, &(0x7f00000005c0)=[@in={0x2, 0x4e23, @local={0xac, 0x14, 0x14, 0xaa}}, @in={0x2, 0x4e24, @broadcast=0xffffffff}, @in6={0xa, 0x0, 0x100000000, @loopback={0x0, 0x1}, 0x323d000000000}]}, &(0x7f0000000640)=0xc)
setsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r4, 0x84, 0xa, &(0x7f0000000680)={0xcff3, 0x80000000, 0x3, 0x0, 0x0, 0x66e, 0x5, 0x0, r5}, 0x20)
mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x5c831, 0xffffffffffffffff, 0x0)
openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/mls\x00', 0x0, 0x0)
setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(0xffffffffffffffff, 0x10e, 0x2, &(0x7f0000000340)=0xc, 0x4)
madvise(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x9)
r6 = syz_open_dev$usbmon(&(0x7f0000000040)='/dev/usbmon#\x00', 0x0, 0x80000)
ioctl$KDSKBMODE(0xffffffffffffffff, 0x4b45, &(0x7f0000000080))
getsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r6, 0x84, 0x75, &(0x7f00000000c0)={0x0, 0x6}, &(0x7f0000000100)=0x8)
setsockopt$inet_sctp6_SCTP_AUTH_KEY(r6, 0x84, 0x17, &(0x7f0000000500)=ANY=[], 0x0)
ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)
r7 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
ioctl$TIOCLINUX3(r7, 0x541c, &(0x7f0000000040)=0x3)
ioctl$LOOP_CTL_REMOVE(r3, 0x4c81, 0x0)

2018/03/30 13:05:57 executing program 3:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[], 0x0)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r1, r2, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
setns(r2, 0x0)
r3 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/loop-control\x00', 0x0, 0x0)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)
r4 = dup(r3)
getsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffff9c, 0x84, 0x6f, &(0x7f0000000340)={<r5=>0x0, 0x3c, &(0x7f00000005c0)=[@in={0x2, 0x4e23, @local={0xac, 0x14, 0x14, 0xaa}}, @in={0x2, 0x4e24, @broadcast=0xffffffff}, @in6={0xa, 0x0, 0x100000000, @loopback={0x0, 0x1}, 0x323d000000000}]}, &(0x7f0000000640)=0xc)
setsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r4, 0x84, 0xa, &(0x7f0000000680)={0xcff3, 0x80000000, 0x3, 0x0, 0x0, 0x66e, 0x5, 0x1, r5}, 0x20)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)
mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x5c831, 0xffffffffffffffff, 0x0)
openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/mls\x00', 0x0, 0x0)
setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(0xffffffffffffffff, 0x10e, 0x2, &(0x7f0000000340)=0xc, 0x4)
madvise(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x9)
r6 = syz_open_dev$usbmon(&(0x7f0000000040)='/dev/usbmon#\x00', 0x0, 0x80000)
ioctl$KDSKBMODE(0xffffffffffffffff, 0x4b45, &(0x7f0000000080))
getsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r6, 0x84, 0x75, &(0x7f00000000c0)={0x0, 0x6}, &(0x7f0000000100)=0x8)
setsockopt$inet_sctp6_SCTP_AUTH_KEY(r6, 0x84, 0x17, &(0x7f0000000500)=ANY=[], 0x0)
ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82)
ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82)
r7 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
ioctl$TIOCLINUX3(r7, 0x541c, &(0x7f0000000040)=0x3)
ioctl$LOOP_CTL_REMOVE(r3, 0x4c81, 0x0)

2018/03/30 13:05:57 executing program 7:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYBLOB="22811e2630b1d0ac3463"], 0x1)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r1, r2, 0x0, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = getpgid(0xffffffffffffffff)
syz_open_procfs(r3, &(0x7f00000005c0)='net/ip6_tables_targets\x00')
process_vm_writev(r3, &(0x7f0000000180)=[{&(0x7f0000000140)=""/22, 0x16}], 0x1, &(0x7f00000003c0)=[{&(0x7f0000000740)=""/173, 0xad}], 0x1, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
r4 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
r5 = dup3(0xffffffffffffffff, r0, 0x80000)
setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8)
syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00')
fcntl$setstatus(r1, 0x4, 0x6000)
mq_open(&(0x7f0000000800)=':em1\x00', 0x40, 0x4, &(0x7f0000000840)={0x4000000000000000, 0x0, 0x9, 0x6, 0x0, 0xff, 0x7})
pwritev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000c00)}], 0x1, 0x0)
ioctl$DRM_IOCTL_AGP_ALLOC(r5, 0xc0206434, &(0x7f0000000440)={0x9dca, <r6=>0x0, 0x10002, 0x4})
ioctl$DRM_IOCTL_AGP_BIND(r4, 0x40106436, &(0x7f00000004c0)={r6, 0x676})
ioctl$sock_ifreq(r4, 0x8917, &(0x7f0000000300)={'lo\x00', @ifru_data=&(0x7f00000001c0)="16e667ea25efad95e8e866bb6ef7f6ba94b72b63a28bcb7eafa978bdbe09a4d8"})
getsockopt$inet_int(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000600), &(0x7f0000000640)=0x4)
getsockname$unix(r1, &(0x7f0000000680), &(0x7f0000000700)=0x6e)

2018/03/30 13:05:57 executing program 1:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYBLOB="22811e2630b1d0ac3463"], 0x1)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r1, r2, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = getpgid(0xffffffffffffffff)
syz_open_procfs(r3, &(0x7f00000005c0)='net/ip6_tables_targets\x00')
process_vm_writev(r3, &(0x7f0000000180), 0x0, &(0x7f00000003c0)=[{&(0x7f0000000740)=""/173, 0xad}], 0x1, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
r4 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
r5 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
r6 = dup3(0xffffffffffffffff, r0, 0x80000)
setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8)
syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00')
fcntl$setstatus(r1, 0x4, 0x6000)
mq_open(&(0x7f0000000800)=':em1\x00', 0x40, 0x4, &(0x7f0000000840)={0x4000000000000000, 0x0, 0x9, 0x6, 0x0, 0xff, 0x7})
pwritev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000c00)}], 0x1, 0x0)
ioctl$DRM_IOCTL_AGP_ALLOC(r6, 0xc0206434, &(0x7f0000000440)={0x9dca, <r7=>0x0, 0x10002, 0x4})
ioctl$DRM_IOCTL_AGP_BIND(r5, 0x40106436, &(0x7f00000004c0)={0x0, 0x676})
ioctl$sock_ifreq(r5, 0x8917, &(0x7f0000000300)={'lo\x00', @ifru_data=&(0x7f00000001c0)="16e667ea25efad95e8e866bb6ef7f6ba94b72b63a28bcb7eafa978bdbe09a4d8"})
getsockopt$inet_int(r4, 0x0, 0x0, &(0x7f0000000600), &(0x7f0000000640)=0x4)
getsockname$unix(r1, &(0x7f0000000680), &(0x7f0000000700)=0x6e)

2018/03/30 13:05:57 executing program 6:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYBLOB="22811e2630b1d0ac3463"], 0x1)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r1, r2, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = getpgid(0xffffffffffffffff)
syz_open_procfs(r3, &(0x7f00000005c0)='net/ip6_tables_targets\x00')
process_vm_writev(r3, &(0x7f0000000180)=[{&(0x7f0000000140)=""/22, 0x16}], 0x1, &(0x7f00000003c0)=[{&(0x7f0000000740)=""/173, 0xad}], 0x1, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
r4 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
r5 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
r6 = dup3(0xffffffffffffffff, r0, 0x0)
setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8)
syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00')
sendmsg$IPVS_CMD_NEW_DEST(r6, &(0x7f0000000540)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x2000400}, 0xc, &(0x7f0000000500)={&(0x7f0000000240)=ANY=[@ANYPTR], 0x1}, 0x1, 0x0, 0x0, 0x10}, 0x4)
fcntl$setstatus(r1, 0x4, 0x6000)
mq_open(&(0x7f0000000800)=':em1\x00', 0x40, 0x4, &(0x7f0000000840)={0x4000000000000000, 0x0, 0x9, 0x6, 0x0, 0xff, 0x7})
pwritev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000c00)}], 0x1, 0x0)
ioctl$DRM_IOCTL_AGP_ALLOC(r6, 0xc0206434, &(0x7f0000000440)={0x9dca, <r7=>0x0, 0x10002, 0x4})
ioctl$DRM_IOCTL_AGP_BIND(r5, 0x40106436, &(0x7f00000004c0)={0x0, 0x676})
ioctl$sock_ifreq(r5, 0x8917, &(0x7f0000000300)={'lo\x00', @ifru_data=&(0x7f00000001c0)="16e667ea25efad95e8e866bb6ef7f6ba94b72b63a28bcb7eafa978bdbe09a4d8"})
getsockopt$inet_int(r4, 0x0, 0x0, &(0x7f0000000600), &(0x7f0000000640)=0x4)
getsockname$unix(r1, &(0x7f0000000680), &(0x7f0000000700)=0x6e)

** 7 printk messages dropped ** [  588.184767] binder: BINDER_SET_CONTEXT_MGR already set
[  588.184773] binder: 29889:29897 ioctl 40046207 0 returned -16
[  588.185658] binder: BINDER_SET_CONTEXT_MGR already set
[  588.185665] binder: 29896:29900 ioctl 40046207 0 returned -16
[  588.185733] binder: 29891:29898 transaction failed 29201/-22, size 40-16 line 3197
2018/03/30 13:05:57 executing program 4:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
r1 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000002880)='/selinux/avc/cache_stats\x00', 0x0, 0x0)
ioctl$EVIOCSABS20(r1, 0x401845e0, &(0x7f00000028c0)={0x1000, 0x7fff, 0x1ff, 0xffffffff, 0x7, 0x40})
fchdir(r0)
r2 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(r2, &(0x7f0000000080)=ANY=[@ANYBLOB="00811e2630b1d0ac3463"], 0x1)
setsockopt$packet_add_memb(r2, 0x107, 0x1, &(0x7f0000002900)={0x0, 0x1, 0x6}, 0x10)
r3 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r2, r3, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r3, 0x0)
inotify_init1(0x800)
ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
r4 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
setns(r3, 0x8000000)
r5 = socket$nl_xfrm(0x10, 0x3, 0x6)
r6 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
dup3(r3, r0, 0x80000)
setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8)
r7 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00')
sendmsg$IPVS_CMD_NEW_DEST(0xffffffffffffffff, &(0x7f0000000540)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x2000400}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)=ANY=[@ANYBLOB=',\x00\x00\x00'], 0x1}, 0x1, 0x0, 0x0, 0x10}, 0x4)
sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10}, 0xc, &(0x7f0000000340)={&(0x7f0000000480)=ANY=[@ANYBLOB='H\x00\x00\x00'], 0x1}, 0x1}, 0x0)
sendmsg$IPVS_CMD_GET_DEST(r2, &(0x7f0000000880)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f00000005c0)={&(0x7f0000000740)={0x138, r7, 0x208, 0x70bd2b, 0x25dfdbfb, {0x8}, [@IPVS_CMD_ATTR_SERVICE={0x28, 0x1, [@IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@multicast2=0xe0000002}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x3}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x7fff}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x8c6}, @IPVS_CMD_ATTR_DAEMON={0x50, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @remote={0xac, 0x14, 0x14, 0xbb}}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x400}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x10001}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'syz_tun\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x6}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x2}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x30, 0x2, [@IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x2}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv6=@ipv4={[], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0xffffffff}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0xafa6}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x1}, @IPVS_CMD_ATTR_DEST={0x6c, 0x2, [@IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x7}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv4=@remote={0xac, 0x14, 0x14, 0xbb}}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x8}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x1}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x5}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x3}, @IPVS_DEST_ATTR_PORT={0x8, 0x2, 0x4e22}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv6=@mcast2={0xff, 0x2, [], 0x1}}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x10000}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x701a3921}]}]}, 0x138}, 0x1, 0x0, 0x0, 0x90}, 0x4)
fcntl$setstatus(r2, 0x4, 0x6000)
setsockopt$sock_linger(r4, 0x1, 0xd, &(0x7f00000008c0)={0x1, 0x2}, 0x8)
pwritev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000c00)="cfb93447d6feaef9f73c0561e075a8295d43017ab1a157786dcda36c5eec92a4306f284fa7e3ed364cc2da5c08cf7e4030d394520e123eee6d9ab275c91c174b1364fc943b49faefe12f605b5ce6c1400a91210c00477f900aff390901bf594c18557cb38a7d57ac8ded098b96b9dfc125e3bdc9305193f4cd256068baca5208160d820b9e7a043666ba4801cf6d557fc0f97f35c13ec6c0d1fe97ce1af1c17078ef47ab955200836671e402717481d14936b09828fd6f55fda2f11eb4c61b480e941133c0a4c5ec54033d0d174742191754ffe28b093596286a78ea01078337ada8585aa98dcc1143689002e31ccc5b9f5cfd2bbce5683a0f91b395391a60ba8e8f4d3c10c82c71caa74c44c8b0f3e42f1fc264497d5b9dabf309bad7bd", 0x11e}], 0x1, 0x0)
sendmmsg(r5, &(0x7f00000027c0)=[{{0x0, 0x0, &(0x7f0000000a00)=[{&(0x7f0000000900)="913da470640ae70fe168a71ad316e5525ce43547f28d8c56cb5cd246950c2d44a514698b3aebf2b60d933814378b0b9b750dec28bdbeedda6c8af5f3418ff8c43701e5dea492428ecdcf0e8c2a19f60e388b478179256834360c5ee359dbe4fabee36883a8314f0ea64dea3a732dffbe26a02e8327a0f7174a6990389e5b608d5300c271f26b3b37cc88e720a477e5f1aa2751af90d35d72606ac73f72dab39aad418a6335d44c785ba83edc9619a3221ae39ef2fed1657e426fa293a739cd779a6c645b3d29bb184041476e8e6e737e5fa1c4312360", 0xd6}], 0x1, 0x0, 0x0, 0x8000}, 0x3f}, {{&(0x7f0000002240)=@nl=@unspec, 0x80, &(0x7f0000002680)=[{&(0x7f00000022c0)="756a6b1895d55b0b292a3985cd35f28cfa8d5ab20a3448791e47ec9e971be82f993ebd55ec843a76ccd644a71222e57119e6f8866f59ba0b89c4cf71a9ce853f72bd99ac9097baf924ea3e3fbceaf0a0df15deb45ae757832bec56c67c0ad44e0ea5fcbc12f898989e1773427ad180efff1044e98613dab446587dd52a0deacb4074e01d97cd46c6e633ae1c1011fd2123c766e6fea028799cf82a562bd9d52c544241172f684398ac1b", 0xaa}, {&(0x7f0000002440)="c802b7c29c92c7ddcf8b11133e071ae83e8c0b0827764303ad44356d381633ce1fdd31e1641872e8d6b4c1a974d97d", 0x2f}, {&(0x7f0000002540)="446c9b3779f2a3dc39f3a3541d912b01ca9865e4172a83cda910f6b10dd97377212eb5279c", 0x25}], 0x3, &(0x7f0000002700)=[{0xa0, 0x10f, 0x200, "4f483406ed4a2e47550522989e031e3e239b59c5dc988744d266f33171b6d4a8e54f025a1e1be02c21ad9675e29aea96625352eec0db268e5c70b8e22a2bb0e11b9e6d9613d4e8e338194d9a41821db1ef97a16b16e5263d008bb6ce86b1e26f4d59926a9a72bed62192dc96eaa8a033c9ddaf2fc8c5fb9e765e5ff99cc5ae6fa7bc4a4f0abcb9c9745b54449ab38c"}], 0xa0, 0x800}, 0x1200000}], 0x2, 0x0)
sendmsg$IPVS_CMD_DEL_DAEMON(r2, &(0x7f0000000280)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000240)={&(0x7f0000000180)={0x28, 0x0, 0xb30, 0x0, 0x25dfdbfc, {0xa}, [@IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x3ff}, @IPVS_CMD_ATTR_SERVICE={0xc, 0x1, [@IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8}]}]}, 0x28}, 0x1}, 0x0)
ioctl$sock_ifreq(r6, 0x8917, &(0x7f0000000300)={'lo\x00', @ifru_data=&(0x7f00000001c0)="16e667ea25efad95e8e866bb6ef7f6ba94b72b63a28bcb7eafa978bdbe09a4d8"})
getsockopt$inet_int(r4, 0x0, 0x0, &(0x7f0000000600), &(0x7f0000000640)=0x4)
getsockname$unix(r2, &(0x7f0000000680), &(0x7f0000000700)=0x6e)

2018/03/30 13:05:57 executing program 0:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYBLOB="22811e2630b1d0ac3463"], 0x1)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r1, r2, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = getpgid(0xffffffffffffffff)
syz_open_procfs(r3, &(0x7f00000005c0)='net/ip6_tables_targets\x00')
process_vm_writev(r3, &(0x7f0000000180)=[{&(0x7f0000000140)=""/22, 0x16}], 0x1, &(0x7f00000003c0)=[{&(0x7f0000000740)=""/173, 0xad}], 0x1, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
r4 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
setns(r2, 0x0)
r5 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
r6 = dup3(0xffffffffffffffff, r0, 0x80000)
setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8)
syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00')
sendmsg$IPVS_CMD_NEW_DEST(r6, &(0x7f0000000540)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x2000400}, 0xc, &(0x7f0000000500)={&(0x7f0000000240)=ANY=[@ANYPTR], 0x1}, 0x1, 0x0, 0x0, 0x10}, 0x0)
sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10}, 0xc, &(0x7f0000000340)={&(0x7f0000000480)=ANY=[@ANYBLOB='H\x00\x00\x00'], 0x1}, 0x1}, 0x0)
fcntl$setstatus(r1, 0x4, 0x6000)
mq_open(&(0x7f0000000800)=':em1\x00', 0x40, 0x4, &(0x7f0000000840)={0x4000000000000000, 0x0, 0x9, 0x6, 0x0, 0xff, 0x7})
pwritev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000c00)}], 0x1, 0x0)
ioctl$DRM_IOCTL_AGP_ALLOC(r6, 0xc0206434, &(0x7f0000000440)={0x9dca, <r7=>0x0, 0x10002, 0x4})
ioctl$DRM_IOCTL_AGP_BIND(r5, 0x40106436, &(0x7f00000004c0)={r7, 0x676})
ioctl$sock_ifreq(r5, 0x8917, &(0x7f0000000300)={'lo\x00', @ifru_data=&(0x7f00000001c0)="16e667ea25efad95e8e866bb6ef7f6ba94b72b63a28bcb7eafa978bdbe09a4d8"})
getsockopt$inet_int(r4, 0x0, 0x0, &(0x7f0000000600), &(0x7f0000000640)=0x4)
getsockname$unix(r1, &(0x7f0000000680), &(0x7f0000000700)=0x6e)

2018/03/30 13:05:57 executing program 2:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYBLOB="22811e2630b1d0ac3463"], 0x1)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r1, r2, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = getpgid(0xffffffffffffffff)
syz_open_procfs(r3, &(0x7f00000005c0)='net/ip6_tables_targets\x00')
process_vm_writev(r3, &(0x7f0000000180), 0x0, &(0x7f00000003c0)=[{&(0x7f0000000740)=""/173, 0xad}], 0x1, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
r4 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
setns(r2, 0x0)
r5 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
r6 = dup3(0xffffffffffffffff, r0, 0x80000)
setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8)
syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00')
sendmsg$IPVS_CMD_NEW_DEST(r6, &(0x7f0000000540)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x2000400}, 0xc, &(0x7f0000000500)={&(0x7f0000000240)=ANY=[@ANYPTR], 0x1}, 0x1, 0x0, 0x0, 0x10}, 0x4)
sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10}, 0xc, &(0x7f0000000340)={&(0x7f0000000480)=ANY=[@ANYBLOB='H\x00\x00\x00'], 0x1}, 0x1}, 0x0)
fcntl$setstatus(r1, 0x4, 0x6000)
mq_open(&(0x7f0000000800)=':em1\x00', 0x40, 0x4, &(0x7f0000000840)={0x0, 0x0, 0x9, 0x6, 0x0, 0xff, 0x7})
pwritev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000c00)}], 0x1, 0x0)
ioctl$DRM_IOCTL_AGP_ALLOC(r6, 0xc0206434, &(0x7f0000000440)={0x9dca, <r7=>0x0, 0x10002, 0x4})
ioctl$DRM_IOCTL_AGP_BIND(r5, 0x40106436, &(0x7f00000004c0)={r7, 0x676})
ioctl$sock_ifreq(r5, 0x8917, &(0x7f0000000300)={'lo\x00', @ifru_data=&(0x7f00000001c0)="16e667ea25efad95e8e866bb6ef7f6ba94b72b63a28bcb7eafa978bdbe09a4d8"})
getsockopt$inet_int(r4, 0x0, 0x0, &(0x7f0000000600), &(0x7f0000000640)=0x4)
getsockname$unix(r1, &(0x7f0000000680), &(0x7f0000000700)=0x6e)

[  588.186774] binder: BINDER_SET_CONTEXT_MGR already set
[  588.186784] binder: 29890:29895 ioctl 40046207 0 returned -16
2018/03/30 13:05:57 executing program 7:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYBLOB="22811e2630b1d0ac3463"], 0x1)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r1, r2, 0x0, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = getpgid(0xffffffffffffffff)
syz_open_procfs(r3, &(0x7f00000005c0)='net/ip6_tables_targets\x00')
process_vm_writev(r3, &(0x7f0000000180)=[{&(0x7f0000000140)=""/22, 0x16}], 0x1, &(0x7f00000003c0)=[{&(0x7f0000000740)=""/173, 0xad}], 0x1, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
r4 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
r5 = dup3(0xffffffffffffffff, r0, 0x80000)
setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8)
syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00')
fcntl$setstatus(r1, 0x4, 0x6000)
mq_open(&(0x7f0000000800)=':em1\x00', 0x40, 0x4, &(0x7f0000000840)={0x4000000000000000, 0x0, 0x9, 0x6, 0x0, 0xff, 0x7})
pwritev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000c00)}], 0x1, 0x0)
ioctl$DRM_IOCTL_AGP_ALLOC(r5, 0xc0206434, &(0x7f0000000440)={0x9dca, <r6=>0x0, 0x10002, 0x4})
ioctl$DRM_IOCTL_AGP_BIND(r4, 0x40106436, &(0x7f00000004c0)={r6, 0x676})
ioctl$sock_ifreq(r4, 0x8917, &(0x7f0000000300)={'lo\x00', @ifru_data=&(0x7f00000001c0)="16e667ea25efad95e8e866bb6ef7f6ba94b72b63a28bcb7eafa978bdbe09a4d8"})
getsockopt$inet_int(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000600), &(0x7f0000000640)=0x4)
getsockname$unix(r1, &(0x7f0000000680), &(0x7f0000000700)=0x6e)

2018/03/30 13:05:57 executing program 5:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYBLOB="00811e2630b1d0ac3463"], 0x1)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r1, r2, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
setns(r2, 0x0)
r3 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/loop-control\x00', 0x0, 0x0)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)
dup(r3)
getsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffff9c, 0x84, 0x6f, &(0x7f0000000340)={0x0, 0x3c, &(0x7f00000005c0)=[@in={0x2, 0x4e23, @local={0xac, 0x14, 0x14, 0xaa}}, @in={0x2, 0x4e24, @broadcast=0xffffffff}, @in6={0xa, 0x0, 0x100000000, @loopback={0x0, 0x1}, 0x323d000000000}]}, &(0x7f0000000640)=0xc)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)
mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x5c831, 0xffffffffffffffff, 0x0)
openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/mls\x00', 0x0, 0x0)
setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(0xffffffffffffffff, 0x10e, 0x2, &(0x7f0000000340)=0xc, 0x4)
madvise(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x9)
r4 = syz_open_dev$usbmon(&(0x7f0000000040)='/dev/usbmon#\x00', 0x0, 0x80000)
ioctl$KDSKBMODE(0xffffffffffffffff, 0x4b45, &(0x7f0000000080))
getsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r4, 0x84, 0x75, &(0x7f00000000c0)={0x0, 0x6}, &(0x7f0000000100)=0x8)
setsockopt$inet_sctp6_SCTP_AUTH_KEY(r4, 0x84, 0x17, &(0x7f0000000500)=ANY=[], 0x0)
ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)
r5 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
ioctl$TIOCLINUX3(r5, 0x541c, &(0x7f0000000040)=0x3)
ioctl$LOOP_CTL_REMOVE(r3, 0x4c81, 0x0)

** 22 printk messages dropped ** [  588.269869] binder: undelivered TRANSACTION_ERROR: 29201
2018/03/30 13:05:57 executing program 2:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYBLOB="22811e2630b1d0ac3463"], 0x1)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r1, r2, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = getpgid(0xffffffffffffffff)
syz_open_procfs(r3, &(0x7f00000005c0)='net/ip6_tables_targets\x00')
process_vm_writev(r3, &(0x7f0000000180)=[{&(0x7f0000000140)=""/22, 0x16}], 0x1, &(0x7f00000003c0), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
r4 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
setns(r2, 0x0)
r5 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
r6 = dup3(0xffffffffffffffff, r0, 0x80000)
setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8)
syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00')
sendmsg$IPVS_CMD_NEW_DEST(r6, &(0x7f0000000540)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x2000400}, 0xc, &(0x7f0000000500)={&(0x7f0000000240)=ANY=[@ANYPTR], 0x1}, 0x1, 0x0, 0x0, 0x10}, 0x4)
sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10}, 0xc, &(0x7f0000000340)={&(0x7f0000000480)=ANY=[@ANYBLOB='H\x00\x00\x00'], 0x1}, 0x1}, 0x0)
fcntl$setstatus(r1, 0x4, 0x6000)
mq_open(&(0x7f0000000800)=':em1\x00', 0x40, 0x4, &(0x7f0000000840)={0x0, 0x0, 0x9, 0x6, 0x0, 0xff, 0x7})
pwritev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000c00)}], 0x1, 0x0)
ioctl$DRM_IOCTL_AGP_ALLOC(r6, 0xc0206434, &(0x7f0000000440)={0x9dca, <r7=>0x0, 0x10002, 0x4})
ioctl$DRM_IOCTL_AGP_BIND(r5, 0x40106436, &(0x7f00000004c0)={r7, 0x676})
ioctl$sock_ifreq(r5, 0x8917, &(0x7f0000000300)={'lo\x00', @ifru_data=&(0x7f00000001c0)="16e667ea25efad95e8e866bb6ef7f6ba94b72b63a28bcb7eafa978bdbe09a4d8"})
getsockopt$inet_int(r4, 0x0, 0x0, &(0x7f0000000600), &(0x7f0000000640)=0x4)
getsockname$unix(r1, &(0x7f0000000680), &(0x7f0000000700)=0x6e)

2018/03/30 13:05:57 executing program 1:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYBLOB="22811e2630b1d0ac3463"], 0x1)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r1, r2, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = getpgid(0xffffffffffffffff)
syz_open_procfs(r3, &(0x7f00000005c0)='net/ip6_tables_targets\x00')
process_vm_writev(r3, &(0x7f0000000180), 0x0, &(0x7f00000003c0)=[{&(0x7f0000000740)=""/173, 0xad}], 0x1, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
r4 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
r5 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
r6 = dup3(0xffffffffffffffff, r0, 0x80000)
setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8)
syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00')
fcntl$setstatus(r1, 0x4, 0x6000)
mq_open(&(0x7f0000000800)=':em1\x00', 0x40, 0x4, &(0x7f0000000840)={0x4000000000000000, 0x0, 0x9, 0x6, 0x0, 0xff, 0x7})
pwritev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000c00)}], 0x1, 0x0)
ioctl$DRM_IOCTL_AGP_ALLOC(r6, 0xc0206434, &(0x7f0000000440)={0x9dca, <r7=>0x0, 0x10002, 0x4})
ioctl$DRM_IOCTL_AGP_BIND(r5, 0x40106436, &(0x7f00000004c0)={0x0, 0x676})
ioctl$sock_ifreq(r5, 0x8917, &(0x7f0000000300)={'lo\x00', @ifru_data=&(0x7f00000001c0)="16e667ea25efad95e8e866bb6ef7f6ba94b72b63a28bcb7eafa978bdbe09a4d8"})
getsockopt$inet_int(r4, 0x0, 0x0, &(0x7f0000000600), &(0x7f0000000640)=0x4)
getsockname$unix(r1, &(0x7f0000000680), &(0x7f0000000700)=0x6e)

2018/03/30 13:05:57 executing program 6:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYBLOB="22811e2630b1d0ac3463"], 0x1)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r1, r2, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = getpgid(0xffffffffffffffff)
syz_open_procfs(r3, &(0x7f00000005c0)='net/ip6_tables_targets\x00')
process_vm_writev(r3, &(0x7f0000000180)=[{&(0x7f0000000140)=""/22, 0x16}], 0x1, &(0x7f00000003c0)=[{&(0x7f0000000740)=""/173, 0xad}], 0x1, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
r4 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
r5 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
r6 = dup3(0xffffffffffffffff, r0, 0x0)
setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8)
syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00')
sendmsg$IPVS_CMD_NEW_DEST(r6, &(0x7f0000000540)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x2000400}, 0xc, &(0x7f0000000500)={&(0x7f0000000240)=ANY=[@ANYPTR], 0x1}, 0x1, 0x0, 0x0, 0x10}, 0x4)
fcntl$setstatus(r1, 0x4, 0x6000)
mq_open(&(0x7f0000000800)=':em1\x00', 0x40, 0x4, &(0x7f0000000840)={0x4000000000000000, 0x0, 0x9, 0x6, 0x0, 0xff, 0x7})
pwritev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000c00)}], 0x1, 0x0)
ioctl$DRM_IOCTL_AGP_ALLOC(r6, 0xc0206434, &(0x7f0000000440)={0x9dca, <r7=>0x0, 0x10002, 0x4})
ioctl$DRM_IOCTL_AGP_BIND(r5, 0x40106436, &(0x7f00000004c0)={0x0, 0x676})
ioctl$sock_ifreq(r5, 0x8917, &(0x7f0000000300)={'lo\x00', @ifru_data=&(0x7f00000001c0)="16e667ea25efad95e8e866bb6ef7f6ba94b72b63a28bcb7eafa978bdbe09a4d8"})
getsockopt$inet_int(r4, 0x0, 0x0, &(0x7f0000000600), &(0x7f0000000640)=0x4)
getsockname$unix(r1, &(0x7f0000000680), &(0x7f0000000700)=0x6e)

2018/03/30 13:05:57 executing program 4:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
r1 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000002880)='/selinux/avc/cache_stats\x00', 0x0, 0x0)
ioctl$EVIOCSABS20(r1, 0x401845e0, &(0x7f00000028c0)={0x1000, 0x7fff, 0x1ff, 0xffffffff, 0x7, 0x40})
fchdir(r0)
r2 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(r2, &(0x7f0000000080)=ANY=[@ANYBLOB="00811e2630b1d0ac3463"], 0x1)
setsockopt$packet_add_memb(r2, 0x107, 0x1, &(0x7f0000002900)={0x0, 0x1, 0x6}, 0x10)
r3 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r2, r3, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r3, 0x0)
inotify_init1(0x800)
ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
r4 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
setns(r3, 0x8000000)
r5 = socket$nl_xfrm(0x10, 0x3, 0x6)
r6 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
dup3(r3, r0, 0x80000)
setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8)
r7 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00')
sendmsg$IPVS_CMD_NEW_DEST(0xffffffffffffffff, &(0x7f0000000540)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x2000400}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)=ANY=[@ANYBLOB=',\x00\x00\x00'], 0x1}, 0x1, 0x0, 0x0, 0x10}, 0x4)
sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10}, 0xc, &(0x7f0000000340)={&(0x7f0000000480)=ANY=[@ANYBLOB='H\x00\x00\x00'], 0x1}, 0x1}, 0x0)
sendmsg$IPVS_CMD_GET_DEST(r2, &(0x7f0000000880)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f00000005c0)={&(0x7f0000000740)={0x138, r7, 0x208, 0x70bd2b, 0x25dfdbfb, {0x8}, [@IPVS_CMD_ATTR_SERVICE={0x28, 0x1, [@IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@multicast2=0xe0000002}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x3}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x7fff}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x8c6}, @IPVS_CMD_ATTR_DAEMON={0x50, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @remote={0xac, 0x14, 0x14, 0xbb}}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x400}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x10001}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'syz_tun\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x6}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x2}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x30, 0x2, [@IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x2}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv6=@ipv4={[], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0xffffffff}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0xafa6}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x1}, @IPVS_CMD_ATTR_DEST={0x6c, 0x2, [@IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x7}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv4=@remote={0xac, 0x14, 0x14, 0xbb}}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x8}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x1}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x5}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x3}, @IPVS_DEST_ATTR_PORT={0x8, 0x2, 0x4e22}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv6=@mcast2={0xff, 0x2, [], 0x1}}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x10000}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x701a3921}]}]}, 0x138}, 0x1, 0x0, 0x0, 0x90}, 0x4)
fcntl$setstatus(r2, 0x4, 0x6000)
setsockopt$sock_linger(r4, 0x1, 0xd, &(0x7f00000008c0)={0x1, 0x2}, 0x8)
pwritev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000c00)="cfb93447d6feaef9f73c0561e075a8295d43017ab1a157786dcda36c5eec92a4306f284fa7e3ed364cc2da5c08cf7e4030d394520e123eee6d9ab275c91c174b1364fc943b49faefe12f605b5ce6c1400a91210c00477f900aff390901bf594c18557cb38a7d57ac8ded098b96b9dfc125e3bdc9305193f4cd256068baca5208160d820b9e7a043666ba4801cf6d557fc0f97f35c13ec6c0d1fe97ce1af1c17078ef47ab955200836671e402717481d14936b09828fd6f55fda2f11eb4c61b480e941133c0a4c5ec54033d0d174742191754ffe28b093596286a78ea01078337ada8585aa98dcc1143689002e31ccc5b9f5cfd2bbce5683a0f91b395391a60ba8e8f4d3c10c82c71caa74c44c8b0f3e42f1fc264497d5b9dabf309bad7bd", 0x11e}], 0x1, 0x0)
sendmmsg(r5, &(0x7f00000027c0)=[{{0x0, 0x0, &(0x7f0000000a00)=[{&(0x7f0000000900)="913da470640ae70fe168a71ad316e5525ce43547f28d8c56cb5cd246950c2d44a514698b3aebf2b60d933814378b0b9b750dec28bdbeedda6c8af5f3418ff8c43701e5dea492428ecdcf0e8c2a19f60e388b478179256834360c5ee359dbe4fabee36883a8314f0ea64dea3a732dffbe26a02e8327a0f7174a6990389e5b608d5300c271f26b3b37cc88e720a477e5f1aa2751af90d35d72606ac73f72dab39aad418a6335d44c785ba83edc9619a3221ae39ef2fed1657e426fa293a739cd779a6c645b3d29bb184041476e8e6e737e5fa1c4312360", 0xd6}], 0x1, 0x0, 0x0, 0x8000}, 0x3f}, {{&(0x7f0000002240)=@nl=@unspec, 0x80, &(0x7f0000002680)=[{&(0x7f00000022c0)="756a6b1895d55b0b292a3985cd35f28cfa8d5ab20a3448791e47ec9e971be82f993ebd55ec843a76ccd644a71222e57119e6f8866f59ba0b89c4cf71a9ce853f72bd99ac9097baf924ea3e3fbceaf0a0df15deb45ae757832bec56c67c0ad44e0ea5fcbc12f898989e1773427ad180efff1044e98613dab446587dd52a0deacb4074e01d97cd46c6e633ae1c1011fd2123c766e6fea028799cf82a562bd9d52c544241172f684398ac1b", 0xaa}, {&(0x7f0000002440)="c802b7c29c92c7ddcf8b11133e071ae83e8c0b0827764303ad44356d381633ce1fdd31e1641872e8d6b4c1a974d97d", 0x2f}, {&(0x7f0000002540)="446c9b3779f2a3dc39f3a3541d912b01ca9865e4172a83cda910f6b10dd97377212eb5279c", 0x25}], 0x3, &(0x7f0000002700)=[{0xa0, 0x10f, 0x200, "4f483406ed4a2e47550522989e031e3e239b59c5dc988744d266f33171b6d4a8e54f025a1e1be02c21ad9675e29aea96625352eec0db268e5c70b8e22a2bb0e11b9e6d9613d4e8e338194d9a41821db1ef97a16b16e5263d008bb6ce86b1e26f4d59926a9a72bed62192dc96eaa8a033c9ddaf2fc8c5fb9e765e5ff99cc5ae6fa7bc4a4f0abcb9c9745b54449ab38c"}], 0xa0, 0x800}, 0x1200000}], 0x2, 0x20040000)
sendmsg$IPVS_CMD_DEL_DAEMON(0xffffffffffffffff, &(0x7f0000000280)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000240)={&(0x7f0000000180)={0x28, 0x0, 0xb30, 0x0, 0x25dfdbfc, {0xa}, [@IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x3ff}, @IPVS_CMD_ATTR_SERVICE={0xc, 0x1, [@IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8}]}]}, 0x28}, 0x1}, 0x0)
ioctl$sock_ifreq(r6, 0x8917, &(0x7f0000000300)={'lo\x00', @ifru_data=&(0x7f00000001c0)="16e667ea25efad95e8e866bb6ef7f6ba94b72b63a28bcb7eafa978bdbe09a4d8"})
getsockopt$inet_int(r4, 0x0, 0x0, &(0x7f0000000600), &(0x7f0000000640)=0x4)
getsockname$unix(r2, &(0x7f0000000680), &(0x7f0000000700)=0x6e)

2018/03/30 13:05:57 executing program 0:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x0)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYBLOB="22811e2630b1d0ac3463"], 0x1)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r1, r2, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = getpgid(0xffffffffffffffff)
syz_open_procfs(r3, &(0x7f00000005c0)='net/ip6_tables_targets\x00')
process_vm_writev(r3, &(0x7f0000000180)=[{&(0x7f0000000140)=""/22, 0x16}], 0x1, &(0x7f00000003c0)=[{&(0x7f0000000740)=""/173, 0xad}], 0x1, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
r4 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
setns(r2, 0x0)
r5 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
r6 = dup3(0xffffffffffffffff, r0, 0x80000)
setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8)
syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00')
sendmsg$IPVS_CMD_NEW_DEST(r6, &(0x7f0000000540)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x2000400}, 0xc, &(0x7f0000000500)={&(0x7f0000000240)=ANY=[@ANYPTR], 0x1}, 0x1, 0x0, 0x0, 0x10}, 0x0)
sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10}, 0xc, &(0x7f0000000340)={&(0x7f0000000480)=ANY=[@ANYBLOB='H\x00\x00\x00'], 0x1}, 0x1}, 0x0)
fcntl$setstatus(r1, 0x4, 0x6000)
mq_open(&(0x7f0000000800)=':em1\x00', 0x40, 0x4, &(0x7f0000000840)={0x4000000000000000, 0x0, 0x9, 0x6, 0x0, 0xff, 0x7})
pwritev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000c00)}], 0x1, 0x0)
ioctl$DRM_IOCTL_AGP_ALLOC(r6, 0xc0206434, &(0x7f0000000440)={0x9dca, <r7=>0x0, 0x10002, 0x4})
ioctl$DRM_IOCTL_AGP_BIND(r5, 0x40106436, &(0x7f00000004c0)={r7, 0x676})
ioctl$sock_ifreq(r5, 0x8917, &(0x7f0000000300)={'lo\x00', @ifru_data=&(0x7f00000001c0)="16e667ea25efad95e8e866bb6ef7f6ba94b72b63a28bcb7eafa978bdbe09a4d8"})
getsockopt$inet_int(r4, 0x0, 0x0, &(0x7f0000000600), &(0x7f0000000640)=0x4)
getsockname$unix(r1, &(0x7f0000000680), &(0x7f0000000700)=0x6e)

2018/03/30 13:05:57 executing program 5:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYBLOB="00811e2630b1d0ac3463"], 0x1)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r1, r2, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
setns(r2, 0x0)
r3 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/loop-control\x00', 0x0, 0x0)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)
dup(r3)
getsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffff9c, 0x84, 0x6f, &(0x7f0000000340)={0x0, 0x3c, &(0x7f00000005c0)=[@in={0x2, 0x4e23, @local={0xac, 0x14, 0x14, 0xaa}}, @in={0x2, 0x4e24, @broadcast=0xffffffff}, @in6={0xa, 0x0, 0x100000000, @loopback={0x0, 0x1}, 0x323d000000000}]}, &(0x7f0000000640)=0xc)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)
mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x5c831, 0xffffffffffffffff, 0x0)
openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/mls\x00', 0x0, 0x0)
setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(0xffffffffffffffff, 0x10e, 0x2, &(0x7f0000000340)=0xc, 0x4)
madvise(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x9)
r4 = syz_open_dev$usbmon(&(0x7f0000000040)='/dev/usbmon#\x00', 0x0, 0x80000)
ioctl$KDSKBMODE(0xffffffffffffffff, 0x4b45, &(0x7f0000000080))
getsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r4, 0x84, 0x75, &(0x7f00000000c0)={0x0, 0x6}, &(0x7f0000000100)=0x8)
setsockopt$inet_sctp6_SCTP_AUTH_KEY(r4, 0x84, 0x17, &(0x7f0000000500)=ANY=[], 0x0)
ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)
r5 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
ioctl$TIOCLINUX3(r5, 0x541c, &(0x7f0000000040)=0x3)
ioctl$LOOP_CTL_REMOVE(r3, 0x4c81, 0x0)

** 2 printk messages dropped ** [  588.277720] binder: 29914:29919 transaction failed 29201/-22, size 40-16 line 3197
2018/03/30 13:05:57 executing program 2:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYBLOB="22811e2630b1d0ac3463"], 0x1)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r1, r2, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = getpgid(0xffffffffffffffff)
syz_open_procfs(r3, &(0x7f00000005c0)='net/ip6_tables_targets\x00')
process_vm_writev(r3, &(0x7f0000000180)=[{&(0x7f0000000140)=""/22, 0x16}], 0x1, &(0x7f00000003c0), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
r4 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
setns(r2, 0x0)
r5 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
r6 = dup3(0xffffffffffffffff, r0, 0x80000)
setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8)
syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00')
sendmsg$IPVS_CMD_NEW_DEST(r6, &(0x7f0000000540)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x2000400}, 0xc, &(0x7f0000000500)={&(0x7f0000000240)=ANY=[@ANYPTR], 0x1}, 0x1, 0x0, 0x0, 0x10}, 0x4)
sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10}, 0xc, &(0x7f0000000340)={&(0x7f0000000480)=ANY=[@ANYBLOB='H\x00\x00\x00'], 0x1}, 0x1}, 0x0)
fcntl$setstatus(r1, 0x4, 0x6000)
mq_open(&(0x7f0000000800)=':em1\x00', 0x40, 0x4, &(0x7f0000000840)={0x0, 0x0, 0x9, 0x6, 0x0, 0xff, 0x7})
pwritev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000c00)}], 0x1, 0x0)
ioctl$DRM_IOCTL_AGP_ALLOC(r6, 0xc0206434, &(0x7f0000000440)={0x9dca, <r7=>0x0, 0x10002, 0x4})
ioctl$DRM_IOCTL_AGP_BIND(r5, 0x40106436, &(0x7f00000004c0)={r7, 0x676})
ioctl$sock_ifreq(r5, 0x8917, &(0x7f0000000300)={'lo\x00', @ifru_data=&(0x7f00000001c0)="16e667ea25efad95e8e866bb6ef7f6ba94b72b63a28bcb7eafa978bdbe09a4d8"})
getsockopt$inet_int(r4, 0x0, 0x0, &(0x7f0000000600), &(0x7f0000000640)=0x4)
getsockname$unix(r1, &(0x7f0000000680), &(0x7f0000000700)=0x6e)

2018/03/30 13:05:57 executing program 7:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYBLOB="22811e2630b1d0ac3463"], 0x1)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r1, r2, 0x1, 0x0)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = getpgid(0xffffffffffffffff)
syz_open_procfs(r3, &(0x7f00000005c0)='net/ip6_tables_targets\x00')
process_vm_writev(r3, &(0x7f0000000180)=[{&(0x7f0000000140)=""/22, 0x16}], 0x1, &(0x7f00000003c0)=[{&(0x7f0000000740)=""/173, 0xad}], 0x1, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
r4 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
r5 = dup3(0xffffffffffffffff, r0, 0x80000)
setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8)
syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00')
fcntl$setstatus(r1, 0x4, 0x6000)
mq_open(&(0x7f0000000800)=':em1\x00', 0x40, 0x4, &(0x7f0000000840)={0x4000000000000000, 0x0, 0x9, 0x6, 0x0, 0xff, 0x7})
pwritev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000c00)}], 0x1, 0x0)
ioctl$DRM_IOCTL_AGP_ALLOC(r5, 0xc0206434, &(0x7f0000000440)={0x9dca, <r6=>0x0, 0x10002, 0x4})
ioctl$DRM_IOCTL_AGP_BIND(r4, 0x40106436, &(0x7f00000004c0)={r6, 0x676})
ioctl$sock_ifreq(r4, 0x8917, &(0x7f0000000300)={'lo\x00', @ifru_data=&(0x7f00000001c0)="16e667ea25efad95e8e866bb6ef7f6ba94b72b63a28bcb7eafa978bdbe09a4d8"})
getsockopt$inet_int(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000600), &(0x7f0000000640)=0x4)
getsockname$unix(r1, &(0x7f0000000680), &(0x7f0000000700)=0x6e)

2018/03/30 13:05:57 executing program 3:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[], 0x0)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r1, r2, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x0, 0x0, &(0x7f0000004fbc), 0x0, 0x0, &(0x7f0000000680)})
openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
setns(r2, 0x0)
r3 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/loop-control\x00', 0x0, 0x0)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)
r4 = dup(r3)
getsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffff9c, 0x84, 0x6f, &(0x7f0000000340)={<r5=>0x0, 0x3c, &(0x7f00000005c0)=[@in={0x2, 0x4e23, @local={0xac, 0x14, 0x14, 0xaa}}, @in={0x2, 0x4e24, @broadcast=0xffffffff}, @in6={0xa, 0x0, 0x100000000, @loopback={0x0, 0x1}, 0x323d000000000}]}, &(0x7f0000000640)=0xc)
setsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r4, 0x84, 0xa, &(0x7f0000000680)={0xcff3, 0x80000000, 0x3, 0x0, 0x0, 0x66e, 0x5, 0x1, r5}, 0x20)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)
mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x5c831, 0xffffffffffffffff, 0x0)
openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/mls\x00', 0x0, 0x0)
setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(0xffffffffffffffff, 0x10e, 0x2, &(0x7f0000000340)=0xc, 0x4)
madvise(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x9)
r6 = syz_open_dev$usbmon(&(0x7f0000000040)='/dev/usbmon#\x00', 0x0, 0x80000)
ioctl$KDSKBMODE(0xffffffffffffffff, 0x4b45, &(0x7f0000000080))
getsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r6, 0x84, 0x75, &(0x7f00000000c0)={0x0, 0x6}, &(0x7f0000000100)=0x8)
setsockopt$inet_sctp6_SCTP_AUTH_KEY(r6, 0x84, 0x17, &(0x7f0000000500)=ANY=[], 0x0)
ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82)
ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82)
r7 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
ioctl$TIOCLINUX3(r7, 0x541c, &(0x7f0000000040)=0x3)
ioctl$LOOP_CTL_REMOVE(r3, 0x4c81, 0x0)

** 17 printk messages dropped ** [  588.368554] binder: 29929:29935 got transaction with invalid offset (0, min 24 max 40) or object.
** 4 printk messages dropped ** [  588.373772] binder: 29931:29937 transaction failed 29201/-22, size 40-16 line 3197
** 12 printk messages dropped ** [  588.392302] binder: 29932:29940 got transaction with invalid offset (0, min 24 max 40) or object.
** 8 printk messages dropped ** [  588.400471] binder: 29933:29944 ioctl 40046207 0 returned -16
[  588.402232] binder: undelivered TRANSACTION_ERROR: 29201
[  588.404711] binder: 29933:29944 got transaction with invalid offset (0, min 24 max 40) or object.
2018/03/30 13:05:57 executing program 6:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYBLOB="22811e2630b1d0ac3463"], 0x1)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r1, r2, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = getpgid(0xffffffffffffffff)
syz_open_procfs(r3, &(0x7f00000005c0)='net/ip6_tables_targets\x00')
process_vm_writev(r3, &(0x7f0000000180)=[{&(0x7f0000000140)=""/22, 0x16}], 0x1, &(0x7f00000003c0)=[{&(0x7f0000000740)=""/173, 0xad}], 0x1, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
r4 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
r5 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
r6 = dup3(0xffffffffffffffff, r0, 0x0)
setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8)
syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00')
sendmsg$IPVS_CMD_NEW_DEST(r6, &(0x7f0000000540)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x2000400}, 0xc, &(0x7f0000000500)={&(0x7f0000000240)=ANY=[@ANYPTR], 0x1}, 0x1, 0x0, 0x0, 0x10}, 0x4)
fcntl$setstatus(r1, 0x4, 0x6000)
mq_open(&(0x7f0000000800)=':em1\x00', 0x40, 0x4, &(0x7f0000000840)={0x4000000000000000, 0x0, 0x9, 0x6, 0x0, 0xff, 0x7})
pwritev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000c00)}], 0x1, 0x0)
ioctl$DRM_IOCTL_AGP_ALLOC(r6, 0xc0206434, &(0x7f0000000440)={0x9dca, <r7=>0x0, 0x10002, 0x4})
ioctl$DRM_IOCTL_AGP_BIND(r5, 0x40106436, &(0x7f00000004c0)={r7})
ioctl$sock_ifreq(r5, 0x8917, &(0x7f0000000300)={'lo\x00', @ifru_data=&(0x7f00000001c0)="16e667ea25efad95e8e866bb6ef7f6ba94b72b63a28bcb7eafa978bdbe09a4d8"})
getsockopt$inet_int(r4, 0x0, 0x0, &(0x7f0000000600), &(0x7f0000000640)=0x4)
getsockname$unix(r1, &(0x7f0000000680), &(0x7f0000000700)=0x6e)

2018/03/30 13:05:57 executing program 7:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYBLOB="22811e2630b1d0ac3463"], 0x1)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r1, r2, 0x1, 0x0)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = getpgid(0xffffffffffffffff)
syz_open_procfs(r3, &(0x7f00000005c0)='net/ip6_tables_targets\x00')
process_vm_writev(r3, &(0x7f0000000180)=[{&(0x7f0000000140)=""/22, 0x16}], 0x1, &(0x7f00000003c0)=[{&(0x7f0000000740)=""/173, 0xad}], 0x1, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
r4 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
r5 = dup3(0xffffffffffffffff, r0, 0x80000)
setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8)
syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00')
fcntl$setstatus(r1, 0x4, 0x6000)
mq_open(&(0x7f0000000800)=':em1\x00', 0x40, 0x4, &(0x7f0000000840)={0x4000000000000000, 0x0, 0x9, 0x6, 0x0, 0xff, 0x7})
pwritev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000c00)}], 0x1, 0x0)
ioctl$DRM_IOCTL_AGP_ALLOC(r5, 0xc0206434, &(0x7f0000000440)={0x9dca, <r6=>0x0, 0x10002, 0x4})
ioctl$DRM_IOCTL_AGP_BIND(r4, 0x40106436, &(0x7f00000004c0)={r6, 0x676})
ioctl$sock_ifreq(r4, 0x8917, &(0x7f0000000300)={'lo\x00', @ifru_data=&(0x7f00000001c0)="16e667ea25efad95e8e866bb6ef7f6ba94b72b63a28bcb7eafa978bdbe09a4d8"})
getsockopt$inet_int(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000600), &(0x7f0000000640)=0x4)
getsockname$unix(r1, &(0x7f0000000680), &(0x7f0000000700)=0x6e)

2018/03/30 13:05:57 executing program 4:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
r1 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000002880)='/selinux/avc/cache_stats\x00', 0x0, 0x0)
ioctl$EVIOCSABS20(r1, 0x401845e0, &(0x7f00000028c0)={0x1000, 0x7fff, 0x1ff, 0xffffffff, 0x7, 0x40})
fchdir(r0)
r2 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(r2, &(0x7f0000000080)=ANY=[@ANYBLOB="00811e2630b1d0ac3463"], 0x1)
setsockopt$packet_add_memb(r2, 0x107, 0x1, &(0x7f0000002900)={0x0, 0x1, 0x6}, 0x10)
r3 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r2, r3, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r3, 0x0)
inotify_init1(0x800)
ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
r4 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
setns(r3, 0x8000000)
r5 = socket$nl_xfrm(0x10, 0x3, 0x6)
r6 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
dup3(r3, r0, 0x80000)
setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8)
r7 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00')
sendmsg$IPVS_CMD_NEW_DEST(0xffffffffffffffff, &(0x7f0000000540)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x2000400}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)=ANY=[@ANYBLOB=',\x00\x00\x00'], 0x1}, 0x1, 0x0, 0x0, 0x10}, 0x4)
sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10}, 0xc, &(0x7f0000000340)={&(0x7f0000000480)=ANY=[@ANYBLOB='H\x00\x00\x00'], 0x1}, 0x1}, 0x0)
sendmsg$IPVS_CMD_GET_DEST(r2, &(0x7f0000000880)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f00000005c0)={&(0x7f0000000740)={0x138, r7, 0x208, 0x70bd2b, 0x25dfdbfb, {0x8}, [@IPVS_CMD_ATTR_SERVICE={0x28, 0x1, [@IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@multicast2=0xe0000002}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x3}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x7fff}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x8c6}, @IPVS_CMD_ATTR_DAEMON={0x50, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @remote={0xac, 0x14, 0x14, 0xbb}}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x400}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x10001}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'syz_tun\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x6}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x2}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x30, 0x2, [@IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x2}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv6=@ipv4={[], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0xffffffff}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0xafa6}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x1}, @IPVS_CMD_ATTR_DEST={0x6c, 0x2, [@IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x7}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv4=@remote={0xac, 0x14, 0x14, 0xbb}}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x8}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x1}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x5}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x3}, @IPVS_DEST_ATTR_PORT={0x8, 0x2, 0x4e22}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv6=@mcast2={0xff, 0x2, [], 0x1}}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x10000}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x701a3921}]}]}, 0x138}, 0x1, 0x0, 0x0, 0x90}, 0x4)
fcntl$setstatus(r2, 0x4, 0x6000)
setsockopt$sock_linger(r4, 0x1, 0xd, &(0x7f00000008c0)={0x1, 0x2}, 0x8)
pwritev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000c00)="cfb93447d6feaef9f73c0561e075a8295d43017ab1a157786dcda36c5eec92a4306f284fa7e3ed364cc2da5c08cf7e4030d394520e123eee6d9ab275c91c174b1364fc943b49faefe12f605b5ce6c1400a91210c00477f900aff390901bf594c18557cb38a7d57ac8ded098b96b9dfc125e3bdc9305193f4cd256068baca5208160d820b9e7a043666ba4801cf6d557fc0f97f35c13ec6c0d1fe97ce1af1c17078ef47ab955200836671e402717481d14936b09828fd6f55fda2f11eb4c61b480e941133c0a4c5ec54033d0d174742191754ffe28b093596286a78ea01078337ada8585aa98dcc1143689002e31ccc5b9f5cfd2bbce5683a0f91b395391a60ba8e8f4d3c10c82c71caa74c44c8b0f3e42f1fc264497d5b9dabf309bad7bd", 0x11e}], 0x1, 0x0)
sendmmsg(r5, &(0x7f00000027c0)=[{{0x0, 0x0, &(0x7f0000000a00)=[{&(0x7f0000000900)="913da470640ae70fe168a71ad316e5525ce43547f28d8c56cb5cd246950c2d44a514698b3aebf2b60d933814378b0b9b750dec28bdbeedda6c8af5f3418ff8c43701e5dea492428ecdcf0e8c2a19f60e388b478179256834360c5ee359dbe4fabee36883a8314f0ea64dea3a732dffbe26a02e8327a0f7174a6990389e5b608d5300c271f26b3b37cc88e720a477e5f1aa2751af90d35d72606ac73f72dab39aad418a6335d44c785ba83edc9619a3221ae39ef2fed1657e426fa293a739cd779a6c645b3d29bb184041476e8e6e737e5fa1c4312360", 0xd6}], 0x1, 0x0, 0x0, 0x8000}, 0x3f}, {{&(0x7f0000002240)=@nl=@unspec, 0x80, &(0x7f0000002680)=[{&(0x7f00000022c0)="756a6b1895d55b0b292a3985cd35f28cfa8d5ab20a3448791e47ec9e971be82f993ebd55ec843a76ccd644a71222e57119e6f8866f59ba0b89c4cf71a9ce853f72bd99ac9097baf924ea3e3fbceaf0a0df15deb45ae757832bec56c67c0ad44e0ea5fcbc12f898989e1773427ad180efff1044e98613dab446587dd52a0deacb4074e01d97cd46c6e633ae1c1011fd2123c766e6fea028799cf82a562bd9d52c544241172f684398ac1b", 0xaa}, {&(0x7f0000002440)="c802b7c29c92c7ddcf8b11133e071ae83e8c0b0827764303ad44356d381633ce1fdd31e1641872e8d6b4c1a974d97d", 0x2f}, {&(0x7f0000002540)="446c9b3779f2a3dc39f3a3541d912b01ca9865e4172a83cda910f6b10dd97377212eb5279c", 0x25}], 0x3, &(0x7f0000002700)=[{0xa0, 0x10f, 0x200, "4f483406ed4a2e47550522989e031e3e239b59c5dc988744d266f33171b6d4a8e54f025a1e1be02c21ad9675e29aea96625352eec0db268e5c70b8e22a2bb0e11b9e6d9613d4e8e338194d9a41821db1ef97a16b16e5263d008bb6ce86b1e26f4d59926a9a72bed62192dc96eaa8a033c9ddaf2fc8c5fb9e765e5ff99cc5ae6fa7bc4a4f0abcb9c9745b54449ab38c"}], 0xa0, 0x800}, 0x1200000}], 0x2, 0x20040000)
sendmsg$IPVS_CMD_DEL_DAEMON(0xffffffffffffffff, &(0x7f0000000280)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000240)={&(0x7f0000000180)={0x28, 0x0, 0xb30, 0x0, 0x25dfdbfc, {0xa}, [@IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x3ff}, @IPVS_CMD_ATTR_SERVICE={0xc, 0x1, [@IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8}]}]}, 0x28}, 0x1}, 0x0)
ioctl$sock_ifreq(r6, 0x8917, &(0x7f0000000300)={'lo\x00', @ifru_data=&(0x7f00000001c0)="16e667ea25efad95e8e866bb6ef7f6ba94b72b63a28bcb7eafa978bdbe09a4d8"})
getsockopt$inet_int(r4, 0x0, 0x0, &(0x7f0000000600), &(0x7f0000000640)=0x4)
getsockname$unix(r2, &(0x7f0000000680), &(0x7f0000000700)=0x6e)

2018/03/30 13:05:57 executing program 5:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYBLOB="00811e2630b1d0ac3463"], 0x1)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r1, r2, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
setns(r2, 0x0)
r3 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/loop-control\x00', 0x0, 0x0)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)
dup(r3)
getsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffff9c, 0x84, 0x6f, &(0x7f0000000340)={0x0, 0x3c, &(0x7f00000005c0)=[@in={0x2, 0x4e23, @local={0xac, 0x14, 0x14, 0xaa}}, @in={0x2, 0x4e24, @broadcast=0xffffffff}, @in6={0xa, 0x0, 0x100000000, @loopback={0x0, 0x1}, 0x323d000000000}]}, &(0x7f0000000640)=0xc)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)
mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x5c831, 0xffffffffffffffff, 0x0)
openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/mls\x00', 0x0, 0x0)
setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(0xffffffffffffffff, 0x10e, 0x2, &(0x7f0000000340)=0xc, 0x4)
madvise(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x9)
r4 = syz_open_dev$usbmon(&(0x7f0000000040)='/dev/usbmon#\x00', 0x0, 0x80000)
ioctl$KDSKBMODE(0xffffffffffffffff, 0x4b45, &(0x7f0000000080))
getsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r4, 0x84, 0x75, &(0x7f00000000c0)={0x0, 0x6}, &(0x7f0000000100)=0x8)
setsockopt$inet_sctp6_SCTP_AUTH_KEY(r4, 0x84, 0x17, &(0x7f0000000500)=ANY=[], 0x0)
ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)
r5 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
ioctl$TIOCLINUX3(r5, 0x541c, &(0x7f0000000040)=0x3)
ioctl$LOOP_CTL_REMOVE(r3, 0x4c81, 0x0)

2018/03/30 13:05:57 executing program 0:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x0)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYBLOB="22811e2630b1d0ac3463"], 0x1)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r1, r2, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = getpgid(0xffffffffffffffff)
syz_open_procfs(r3, &(0x7f00000005c0)='net/ip6_tables_targets\x00')
process_vm_writev(r3, &(0x7f0000000180)=[{&(0x7f0000000140)=""/22, 0x16}], 0x1, &(0x7f00000003c0)=[{&(0x7f0000000740)=""/173, 0xad}], 0x1, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
r4 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
setns(r2, 0x0)
r5 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
r6 = dup3(0xffffffffffffffff, r0, 0x80000)
setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8)
syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00')
sendmsg$IPVS_CMD_NEW_DEST(r6, &(0x7f0000000540)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x2000400}, 0xc, &(0x7f0000000500)={&(0x7f0000000240)=ANY=[@ANYPTR], 0x1}, 0x1, 0x0, 0x0, 0x10}, 0x0)
sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10}, 0xc, &(0x7f0000000340)={&(0x7f0000000480)=ANY=[@ANYBLOB='H\x00\x00\x00'], 0x1}, 0x1}, 0x0)
fcntl$setstatus(r1, 0x4, 0x6000)
mq_open(&(0x7f0000000800)=':em1\x00', 0x40, 0x4, &(0x7f0000000840)={0x4000000000000000, 0x0, 0x9, 0x6, 0x0, 0xff, 0x7})
pwritev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000c00)}], 0x1, 0x0)
ioctl$DRM_IOCTL_AGP_ALLOC(r6, 0xc0206434, &(0x7f0000000440)={0x9dca, <r7=>0x0, 0x10002, 0x4})
ioctl$DRM_IOCTL_AGP_BIND(r5, 0x40106436, &(0x7f00000004c0)={r7, 0x676})
ioctl$sock_ifreq(r5, 0x8917, &(0x7f0000000300)={'lo\x00', @ifru_data=&(0x7f00000001c0)="16e667ea25efad95e8e866bb6ef7f6ba94b72b63a28bcb7eafa978bdbe09a4d8"})
getsockopt$inet_int(r4, 0x0, 0x0, &(0x7f0000000600), &(0x7f0000000640)=0x4)
getsockname$unix(r1, &(0x7f0000000680), &(0x7f0000000700)=0x6e)

2018/03/30 13:05:57 executing program 1:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYBLOB="22811e2630b1d0ac3463"], 0x1)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r1, r2, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = getpgid(0xffffffffffffffff)
syz_open_procfs(r3, &(0x7f00000005c0)='net/ip6_tables_targets\x00')
process_vm_writev(r3, &(0x7f0000000180), 0x0, &(0x7f00000003c0)=[{&(0x7f0000000740)=""/173, 0xad}], 0x1, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
r4 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
r5 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
r6 = dup3(0xffffffffffffffff, r0, 0x80000)
setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8)
syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00')
fcntl$setstatus(r1, 0x4, 0x6000)
mq_open(&(0x7f0000000800)=':em1\x00', 0x40, 0x4, &(0x7f0000000840)={0x4000000000000000, 0x0, 0x9, 0x6, 0x0, 0xff, 0x7})
pwritev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000c00)}], 0x1, 0x0)
ioctl$DRM_IOCTL_AGP_ALLOC(r6, 0xc0206434, &(0x7f0000000440)={0x9dca, <r7=>0x0, 0x10002, 0x4})
ioctl$DRM_IOCTL_AGP_BIND(r5, 0x40106436, &(0x7f00000004c0)={0x0, 0x676})
ioctl$sock_ifreq(r5, 0x8917, &(0x7f0000000300)={'lo\x00', @ifru_data=&(0x7f00000001c0)="16e667ea25efad95e8e866bb6ef7f6ba94b72b63a28bcb7eafa978bdbe09a4d8"})
getsockopt$inet_int(r4, 0x0, 0x0, &(0x7f0000000600), &(0x7f0000000640)=0x4)
getsockname$unix(r1, &(0x7f0000000680), &(0x7f0000000700)=0x6e)

2018/03/30 13:05:57 executing program 2:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYBLOB="22811e2630b1d0ac3463"], 0x1)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r1, r2, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = getpgid(0xffffffffffffffff)
syz_open_procfs(r3, &(0x7f00000005c0)='net/ip6_tables_targets\x00')
process_vm_writev(r3, &(0x7f0000000180)=[{&(0x7f0000000140)=""/22, 0x16}], 0x1, &(0x7f00000003c0), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
r4 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
setns(r2, 0x0)
r5 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
r6 = dup3(0xffffffffffffffff, r0, 0x80000)
setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8)
syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00')
sendmsg$IPVS_CMD_NEW_DEST(r6, &(0x7f0000000540)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x2000400}, 0xc, &(0x7f0000000500)={&(0x7f0000000240)=ANY=[@ANYPTR], 0x1}, 0x1, 0x0, 0x0, 0x10}, 0x4)
sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10}, 0xc, &(0x7f0000000340)={&(0x7f0000000480)=ANY=[@ANYBLOB='H\x00\x00\x00'], 0x1}, 0x1}, 0x0)
fcntl$setstatus(r1, 0x4, 0x6000)
mq_open(&(0x7f0000000800)=':em1\x00', 0x40, 0x4, &(0x7f0000000840)={0x0, 0x0, 0x9, 0x6, 0x0, 0xff, 0x7})
pwritev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000c00)}], 0x1, 0x0)
ioctl$DRM_IOCTL_AGP_ALLOC(r6, 0xc0206434, &(0x7f0000000440)={0x9dca, <r7=>0x0, 0x10002, 0x4})
ioctl$DRM_IOCTL_AGP_BIND(r5, 0x40106436, &(0x7f00000004c0)={r7, 0x676})
ioctl$sock_ifreq(r5, 0x8917, &(0x7f0000000300)={'lo\x00', @ifru_data=&(0x7f00000001c0)="16e667ea25efad95e8e866bb6ef7f6ba94b72b63a28bcb7eafa978bdbe09a4d8"})
getsockopt$inet_int(r4, 0x0, 0x0, &(0x7f0000000600), &(0x7f0000000640)=0x4)
getsockname$unix(r1, &(0x7f0000000680), &(0x7f0000000700)=0x6e)

2018/03/30 13:05:57 executing program 3:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[], 0x0)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r1, r2, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x0, 0x0, &(0x7f0000004fbc), 0x0, 0x0, &(0x7f0000000680)})
openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
setns(r2, 0x0)
r3 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/loop-control\x00', 0x0, 0x0)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)
r4 = dup(r3)
getsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffff9c, 0x84, 0x6f, &(0x7f0000000340)={<r5=>0x0, 0x3c, &(0x7f00000005c0)=[@in={0x2, 0x4e23, @local={0xac, 0x14, 0x14, 0xaa}}, @in={0x2, 0x4e24, @broadcast=0xffffffff}, @in6={0xa, 0x0, 0x100000000, @loopback={0x0, 0x1}, 0x323d000000000}]}, &(0x7f0000000640)=0xc)
setsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r4, 0x84, 0xa, &(0x7f0000000680)={0xcff3, 0x80000000, 0x3, 0x0, 0x0, 0x66e, 0x5, 0x1, r5}, 0x20)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)
mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x5c831, 0xffffffffffffffff, 0x0)
openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/mls\x00', 0x0, 0x0)
setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(0xffffffffffffffff, 0x10e, 0x2, &(0x7f0000000340)=0xc, 0x4)
madvise(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x9)
r6 = syz_open_dev$usbmon(&(0x7f0000000040)='/dev/usbmon#\x00', 0x0, 0x80000)
ioctl$KDSKBMODE(0xffffffffffffffff, 0x4b45, &(0x7f0000000080))
getsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r6, 0x84, 0x75, &(0x7f00000000c0)={0x0, 0x6}, &(0x7f0000000100)=0x8)
setsockopt$inet_sctp6_SCTP_AUTH_KEY(r6, 0x84, 0x17, &(0x7f0000000500)=ANY=[], 0x0)
ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82)
ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82)
r7 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
ioctl$TIOCLINUX3(r7, 0x541c, &(0x7f0000000040)=0x3)
ioctl$LOOP_CTL_REMOVE(r3, 0x4c81, 0x0)

[  588.404799] binder: 29933:29944 transaction failed 29201/-22, size 40-16 line 3197
[  588.425328] binder: undelivered TRANSACTION_ERROR: 29201
[  588.453371] binder: undelivered TRANSACTION_ERROR: 29201
[  588.461584] binder: undelivered TRANSACTION_ERROR: 29201
[  588.465596] binder: undelivered TRANSACTION_ERROR: 29201
[  588.473296] binder: undelivered TRANSACTION_ERROR: 29201
[  588.484991] binder: 29952:29958 got transaction with invalid offset (0, min 24 max 40) or object.
2018/03/30 13:05:57 executing program 1:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYBLOB="22811e2630b1d0ac3463"], 0x1)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r1, r2, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = getpgid(0xffffffffffffffff)
syz_open_procfs(r3, &(0x7f00000005c0)='net/ip6_tables_targets\x00')
process_vm_writev(r3, &(0x7f0000000180), 0x0, &(0x7f00000003c0)=[{&(0x7f0000000740)=""/173, 0xad}], 0x1, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
r4 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
r5 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
r6 = dup3(0xffffffffffffffff, r0, 0x80000)
setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8)
syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00')
fcntl$setstatus(r1, 0x4, 0x6000)
mq_open(&(0x7f0000000800)=':em1\x00', 0x40, 0x4, &(0x7f0000000840)={0x4000000000000000, 0x0, 0x9, 0x6, 0x0, 0xff, 0x7})
pwritev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000c00)}], 0x1, 0x0)
ioctl$DRM_IOCTL_AGP_ALLOC(r6, 0xc0206434, &(0x7f0000000440)={0x9dca, <r7=>0x0, 0x10002, 0x4})
ioctl$DRM_IOCTL_AGP_BIND(r5, 0x40106436, &(0x7f00000004c0)={r7})
ioctl$sock_ifreq(r5, 0x8917, &(0x7f0000000300)={'lo\x00', @ifru_data=&(0x7f00000001c0)="16e667ea25efad95e8e866bb6ef7f6ba94b72b63a28bcb7eafa978bdbe09a4d8"})
getsockopt$inet_int(r4, 0x0, 0x0, &(0x7f0000000600), &(0x7f0000000640)=0x4)
getsockname$unix(r1, &(0x7f0000000680), &(0x7f0000000700)=0x6e)

2018/03/30 13:05:57 executing program 5:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYBLOB="00811e2630b1d0ac3463"], 0x1)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r1, r2, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
setns(r2, 0x0)
r3 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/loop-control\x00', 0x0, 0x0)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)
r4 = dup(r3)
setsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r4, 0x84, 0xa, &(0x7f0000000680)={0xcff3, 0x80000000, 0x3, 0x0, 0x0, 0x66e, 0x5}, 0x20)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)
mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x5c831, 0xffffffffffffffff, 0x0)
openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/mls\x00', 0x0, 0x0)
setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(0xffffffffffffffff, 0x10e, 0x2, &(0x7f0000000340)=0xc, 0x4)
madvise(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x9)
r5 = syz_open_dev$usbmon(&(0x7f0000000040)='/dev/usbmon#\x00', 0x0, 0x80000)
ioctl$KDSKBMODE(0xffffffffffffffff, 0x4b45, &(0x7f0000000080))
getsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r5, 0x84, 0x75, &(0x7f00000000c0)={0x0, 0x6}, &(0x7f0000000100)=0x8)
setsockopt$inet_sctp6_SCTP_AUTH_KEY(r5, 0x84, 0x17, &(0x7f0000000500)=ANY=[], 0x0)
ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)
r6 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
ioctl$TIOCLINUX3(r6, 0x541c, &(0x7f0000000040)=0x3)
ioctl$LOOP_CTL_REMOVE(r3, 0x4c81, 0x0)

2018/03/30 13:05:57 executing program 4:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
r1 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000002880)='/selinux/avc/cache_stats\x00', 0x0, 0x0)
ioctl$EVIOCSABS20(r1, 0x401845e0, &(0x7f00000028c0)={0x1000, 0x7fff, 0x1ff, 0xffffffff, 0x7, 0x40})
fchdir(r0)
r2 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(r2, &(0x7f0000000080)=ANY=[@ANYBLOB="00811e2630b1d0ac3463"], 0x1)
setsockopt$packet_add_memb(r2, 0x107, 0x1, &(0x7f0000002900)={0x0, 0x1, 0x6}, 0x10)
r3 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r2, r3, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r3, 0x0)
inotify_init1(0x800)
ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
r4 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
setns(r3, 0x8000000)
r5 = socket$nl_xfrm(0x10, 0x3, 0x6)
r6 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
dup3(r3, r0, 0x80000)
setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8)
r7 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00')
sendmsg$IPVS_CMD_NEW_DEST(0xffffffffffffffff, &(0x7f0000000540)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x2000400}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)=ANY=[@ANYBLOB=',\x00\x00\x00'], 0x1}, 0x1, 0x0, 0x0, 0x10}, 0x4)
sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10}, 0xc, &(0x7f0000000340)={&(0x7f0000000480)=ANY=[@ANYBLOB='H\x00\x00\x00'], 0x1}, 0x1}, 0x0)
sendmsg$IPVS_CMD_GET_DEST(r2, &(0x7f0000000880)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f00000005c0)={&(0x7f0000000740)={0x138, r7, 0x208, 0x70bd2b, 0x25dfdbfb, {0x8}, [@IPVS_CMD_ATTR_SERVICE={0x28, 0x1, [@IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@multicast2=0xe0000002}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x3}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x7fff}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x8c6}, @IPVS_CMD_ATTR_DAEMON={0x50, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @remote={0xac, 0x14, 0x14, 0xbb}}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x400}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x10001}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'syz_tun\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x6}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x2}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x30, 0x2, [@IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x2}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv6=@ipv4={[], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0xffffffff}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0xafa6}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x1}, @IPVS_CMD_ATTR_DEST={0x6c, 0x2, [@IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x7}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv4=@remote={0xac, 0x14, 0x14, 0xbb}}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x8}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x1}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x5}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x3}, @IPVS_DEST_ATTR_PORT={0x8, 0x2, 0x4e22}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv6=@mcast2={0xff, 0x2, [], 0x1}}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x10000}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x701a3921}]}]}, 0x138}, 0x1, 0x0, 0x0, 0x90}, 0x4)
fcntl$setstatus(r2, 0x4, 0x6000)
setsockopt$sock_linger(r4, 0x1, 0xd, &(0x7f00000008c0)={0x1, 0x2}, 0x8)
pwritev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000c00)="cfb93447d6feaef9f73c0561e075a8295d43017ab1a157786dcda36c5eec92a4306f284fa7e3ed364cc2da5c08cf7e4030d394520e123eee6d9ab275c91c174b1364fc943b49faefe12f605b5ce6c1400a91210c00477f900aff390901bf594c18557cb38a7d57ac8ded098b96b9dfc125e3bdc9305193f4cd256068baca5208160d820b9e7a043666ba4801cf6d557fc0f97f35c13ec6c0d1fe97ce1af1c17078ef47ab955200836671e402717481d14936b09828fd6f55fda2f11eb4c61b480e941133c0a4c5ec54033d0d174742191754ffe28b093596286a78ea01078337ada8585aa98dcc1143689002e31ccc5b9f5cfd2bbce5683a0f91b395391a60ba8e8f4d3c10c82c71caa74c44c8b0f3e42f1fc264497d5b9dabf309bad7bd", 0x11e}], 0x1, 0x0)
sendmmsg(r5, &(0x7f00000027c0)=[{{0x0, 0x0, &(0x7f0000000a00)=[{&(0x7f0000000900)="913da470640ae70fe168a71ad316e5525ce43547f28d8c56cb5cd246950c2d44a514698b3aebf2b60d933814378b0b9b750dec28bdbeedda6c8af5f3418ff8c43701e5dea492428ecdcf0e8c2a19f60e388b478179256834360c5ee359dbe4fabee36883a8314f0ea64dea3a732dffbe26a02e8327a0f7174a6990389e5b608d5300c271f26b3b37cc88e720a477e5f1aa2751af90d35d72606ac73f72dab39aad418a6335d44c785ba83edc9619a3221ae39ef2fed1657e426fa293a739cd779a6c645b3d29bb184041476e8e6e737e5fa1c4312360", 0xd6}], 0x1, 0x0, 0x0, 0x8000}, 0x3f}, {{&(0x7f0000002240)=@nl=@unspec, 0x80, &(0x7f0000002680)=[{&(0x7f00000022c0)="756a6b1895d55b0b292a3985cd35f28cfa8d5ab20a3448791e47ec9e971be82f993ebd55ec843a76ccd644a71222e57119e6f8866f59ba0b89c4cf71a9ce853f72bd99ac9097baf924ea3e3fbceaf0a0df15deb45ae757832bec56c67c0ad44e0ea5fcbc12f898989e1773427ad180efff1044e98613dab446587dd52a0deacb4074e01d97cd46c6e633ae1c1011fd2123c766e6fea028799cf82a562bd9d52c544241172f684398ac1b", 0xaa}, {&(0x7f0000002440)="c802b7c29c92c7ddcf8b11133e071ae83e8c0b0827764303ad44356d381633ce1fdd31e1641872e8d6b4c1a974d97d", 0x2f}, {&(0x7f0000002540)="446c9b3779f2a3dc39f3a3541d912b01ca9865e4172a83cda910f6b10dd97377212eb5279c", 0x25}], 0x3, &(0x7f0000002700)=[{0xa0, 0x10f, 0x200, "4f483406ed4a2e47550522989e031e3e239b59c5dc988744d266f33171b6d4a8e54f025a1e1be02c21ad9675e29aea96625352eec0db268e5c70b8e22a2bb0e11b9e6d9613d4e8e338194d9a41821db1ef97a16b16e5263d008bb6ce86b1e26f4d59926a9a72bed62192dc96eaa8a033c9ddaf2fc8c5fb9e765e5ff99cc5ae6fa7bc4a4f0abcb9c9745b54449ab38c"}], 0xa0, 0x800}, 0x1200000}], 0x2, 0x20040000)
sendmsg$IPVS_CMD_DEL_DAEMON(0xffffffffffffffff, &(0x7f0000000280)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000240)={&(0x7f0000000180)={0x28, 0x0, 0xb30, 0x0, 0x25dfdbfc, {0xa}, [@IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x3ff}, @IPVS_CMD_ATTR_SERVICE={0xc, 0x1, [@IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8}]}]}, 0x28}, 0x1}, 0x0)
ioctl$sock_ifreq(r6, 0x8917, &(0x7f0000000300)={'lo\x00', @ifru_data=&(0x7f00000001c0)="16e667ea25efad95e8e866bb6ef7f6ba94b72b63a28bcb7eafa978bdbe09a4d8"})
getsockopt$inet_int(r4, 0x0, 0x0, &(0x7f0000000600), &(0x7f0000000640)=0x4)
getsockname$unix(r2, &(0x7f0000000680), &(0x7f0000000700)=0x6e)

2018/03/30 13:05:57 executing program 7:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYBLOB="22811e2630b1d0ac3463"], 0x1)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r1, r2, 0x1, 0x0)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = getpgid(0xffffffffffffffff)
syz_open_procfs(r3, &(0x7f00000005c0)='net/ip6_tables_targets\x00')
process_vm_writev(r3, &(0x7f0000000180)=[{&(0x7f0000000140)=""/22, 0x16}], 0x1, &(0x7f00000003c0)=[{&(0x7f0000000740)=""/173, 0xad}], 0x1, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
r4 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
r5 = dup3(0xffffffffffffffff, r0, 0x80000)
setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8)
syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00')
fcntl$setstatus(r1, 0x4, 0x6000)
mq_open(&(0x7f0000000800)=':em1\x00', 0x40, 0x4, &(0x7f0000000840)={0x4000000000000000, 0x0, 0x9, 0x6, 0x0, 0xff, 0x7})
pwritev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000c00)}], 0x1, 0x0)
ioctl$DRM_IOCTL_AGP_ALLOC(r5, 0xc0206434, &(0x7f0000000440)={0x9dca, <r6=>0x0, 0x10002, 0x4})
ioctl$DRM_IOCTL_AGP_BIND(r4, 0x40106436, &(0x7f00000004c0)={r6, 0x676})
ioctl$sock_ifreq(r4, 0x8917, &(0x7f0000000300)={'lo\x00', @ifru_data=&(0x7f00000001c0)="16e667ea25efad95e8e866bb6ef7f6ba94b72b63a28bcb7eafa978bdbe09a4d8"})
getsockopt$inet_int(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000600), &(0x7f0000000640)=0x4)
getsockname$unix(r1, &(0x7f0000000680), &(0x7f0000000700)=0x6e)

2018/03/30 13:05:57 executing program 2:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYBLOB="22811e2630b1d0ac3463"], 0x1)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r1, r2, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = getpgid(0xffffffffffffffff)
syz_open_procfs(r3, &(0x7f00000005c0)='net/ip6_tables_targets\x00')
process_vm_writev(r3, &(0x7f0000000180)=[{&(0x7f0000000140)=""/22, 0x16}], 0x1, &(0x7f00000003c0)=[{&(0x7f0000000740)=""/173, 0xad}], 0x1, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
r4 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
setns(r2, 0x0)
r5 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
r6 = dup3(0xffffffffffffffff, r0, 0x80000)
setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8)
syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00')
sendmsg$IPVS_CMD_NEW_DEST(r6, &(0x7f0000000540)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x2000400}, 0xc, &(0x7f0000000500)={&(0x7f0000000240)=ANY=[@ANYPTR], 0x1}, 0x1, 0x0, 0x0, 0x10}, 0x4)
sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10}, 0xc, &(0x7f0000000340)={&(0x7f0000000480)=ANY=[@ANYBLOB='H\x00\x00\x00'], 0x1}, 0x1}, 0x0)
fcntl$setstatus(r1, 0x4, 0x6000)
mq_open(&(0x7f0000000800)=':em1\x00', 0x40, 0x4, &(0x7f0000000840)={0x0, 0x0, 0x9, 0x6, 0x0, 0xff, 0x7})
pwritev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000c00)}], 0x1, 0x0)
ioctl$DRM_IOCTL_AGP_ALLOC(r6, 0xc0206434, &(0x7f0000000440)={0x9dca, <r7=>0x0, 0x10002, 0x4})
ioctl$DRM_IOCTL_AGP_BIND(r5, 0x40106436, &(0x7f00000004c0)={r7, 0x676})
ioctl$sock_ifreq(r5, 0x8917, &(0x7f0000000300)={'lo\x00', @ifru_data=&(0x7f00000001c0)="16e667ea25efad95e8e866bb6ef7f6ba94b72b63a28bcb7eafa978bdbe09a4d8"})
getsockopt$inet_int(r4, 0x0, 0x0, &(0x7f0000000600), &(0x7f0000000640)=0x4)
getsockname$unix(r1, &(0x7f0000000680), &(0x7f0000000700)=0x6e)

2018/03/30 13:05:57 executing program 1:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYBLOB="22811e2630b1d0ac3463"], 0x1)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r1, r2, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = getpgid(0xffffffffffffffff)
syz_open_procfs(r3, &(0x7f00000005c0)='net/ip6_tables_targets\x00')
process_vm_writev(r3, &(0x7f0000000180), 0x0, &(0x7f00000003c0)=[{&(0x7f0000000740)=""/173, 0xad}], 0x1, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
r4 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
r5 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
r6 = dup3(0xffffffffffffffff, r0, 0x80000)
setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8)
syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00')
fcntl$setstatus(r1, 0x4, 0x6000)
mq_open(&(0x7f0000000800)=':em1\x00', 0x40, 0x4, &(0x7f0000000840)={0x4000000000000000, 0x0, 0x9, 0x6, 0x0, 0xff, 0x7})
pwritev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000c00)}], 0x1, 0x0)
ioctl$DRM_IOCTL_AGP_ALLOC(r6, 0xc0206434, &(0x7f0000000440)={0x9dca, <r7=>0x0, 0x10002, 0x4})
ioctl$DRM_IOCTL_AGP_BIND(r5, 0x40106436, &(0x7f00000004c0)={r7})
ioctl$sock_ifreq(r5, 0x8917, &(0x7f0000000300)={'lo\x00', @ifru_data=&(0x7f00000001c0)="16e667ea25efad95e8e866bb6ef7f6ba94b72b63a28bcb7eafa978bdbe09a4d8"})
getsockopt$inet_int(r4, 0x0, 0x0, &(0x7f0000000600), &(0x7f0000000640)=0x4)
getsockname$unix(r1, &(0x7f0000000680), &(0x7f0000000700)=0x6e)

** 23 printk messages dropped ** [  588.538521] binder: 29967:29972 transaction failed 29201/-22, size 40-16 line 3197
** 6 printk messages dropped ** [  588.577127] binder: 29971:29985 got transaction with invalid offset (0, min 24 max 40) or object.
2018/03/30 13:05:57 executing program 6:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYBLOB="22811e2630b1d0ac3463"], 0x1)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r1, r2, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = getpgid(0xffffffffffffffff)
syz_open_procfs(r3, &(0x7f00000005c0)='net/ip6_tables_targets\x00')
process_vm_writev(r3, &(0x7f0000000180)=[{&(0x7f0000000140)=""/22, 0x16}], 0x1, &(0x7f00000003c0)=[{&(0x7f0000000740)=""/173, 0xad}], 0x1, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
r4 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
r5 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
r6 = dup3(0xffffffffffffffff, r0, 0x0)
setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8)
syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00')
sendmsg$IPVS_CMD_NEW_DEST(r6, &(0x7f0000000540)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x2000400}, 0xc, &(0x7f0000000500)={&(0x7f0000000240)=ANY=[@ANYPTR], 0x1}, 0x1, 0x0, 0x0, 0x10}, 0x4)
fcntl$setstatus(r1, 0x4, 0x6000)
mq_open(&(0x7f0000000800)=':em1\x00', 0x40, 0x4, &(0x7f0000000840)={0x4000000000000000, 0x0, 0x9, 0x6, 0x0, 0xff, 0x7})
pwritev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000c00)}], 0x1, 0x0)
ioctl$DRM_IOCTL_AGP_ALLOC(r6, 0xc0206434, &(0x7f0000000440)={0x9dca, <r7=>0x0, 0x10002, 0x4})
ioctl$DRM_IOCTL_AGP_BIND(r5, 0x40106436, &(0x7f00000004c0)={r7})
ioctl$sock_ifreq(r5, 0x8917, &(0x7f0000000300)={'lo\x00', @ifru_data=&(0x7f00000001c0)="16e667ea25efad95e8e866bb6ef7f6ba94b72b63a28bcb7eafa978bdbe09a4d8"})
getsockopt$inet_int(r4, 0x0, 0x0, &(0x7f0000000600), &(0x7f0000000640)=0x4)
getsockname$unix(r1, &(0x7f0000000680), &(0x7f0000000700)=0x6e)

2018/03/30 13:05:57 executing program 3:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[], 0x0)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r1, r2, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x0, 0x0, &(0x7f0000004fbc), 0x0, 0x0, &(0x7f0000000680)})
openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
setns(r2, 0x0)
r3 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/loop-control\x00', 0x0, 0x0)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)
r4 = dup(r3)
getsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffff9c, 0x84, 0x6f, &(0x7f0000000340)={<r5=>0x0, 0x3c, &(0x7f00000005c0)=[@in={0x2, 0x4e23, @local={0xac, 0x14, 0x14, 0xaa}}, @in={0x2, 0x4e24, @broadcast=0xffffffff}, @in6={0xa, 0x0, 0x100000000, @loopback={0x0, 0x1}, 0x323d000000000}]}, &(0x7f0000000640)=0xc)
setsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r4, 0x84, 0xa, &(0x7f0000000680)={0xcff3, 0x80000000, 0x3, 0x0, 0x0, 0x66e, 0x5, 0x1, r5}, 0x20)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)
mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x5c831, 0xffffffffffffffff, 0x0)
openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/mls\x00', 0x0, 0x0)
setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(0xffffffffffffffff, 0x10e, 0x2, &(0x7f0000000340)=0xc, 0x4)
madvise(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x9)
r6 = syz_open_dev$usbmon(&(0x7f0000000040)='/dev/usbmon#\x00', 0x0, 0x80000)
ioctl$KDSKBMODE(0xffffffffffffffff, 0x4b45, &(0x7f0000000080))
getsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r6, 0x84, 0x75, &(0x7f00000000c0)={0x0, 0x6}, &(0x7f0000000100)=0x8)
setsockopt$inet_sctp6_SCTP_AUTH_KEY(r6, 0x84, 0x17, &(0x7f0000000500)=ANY=[], 0x0)
ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82)
ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82)
r7 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
ioctl$TIOCLINUX3(r7, 0x541c, &(0x7f0000000040)=0x3)
ioctl$LOOP_CTL_REMOVE(r3, 0x4c81, 0x0)

** 12 printk messages dropped ** [  588.691278] binder: BINDER_SET_CONTEXT_MGR already set
2018/03/30 13:05:57 executing program 5:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYBLOB="00811e2630b1d0ac3463"], 0x1)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r1, r2, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
setns(r2, 0x0)
r3 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/loop-control\x00', 0x0, 0x0)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)
r4 = dup(r3)
setsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r4, 0x84, 0xa, &(0x7f0000000680)={0xcff3, 0x80000000, 0x3, 0x0, 0x0, 0x66e, 0x5}, 0x20)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)
mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x5c831, 0xffffffffffffffff, 0x0)
openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/mls\x00', 0x0, 0x0)
setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(0xffffffffffffffff, 0x10e, 0x2, &(0x7f0000000340)=0xc, 0x4)
madvise(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x9)
r5 = syz_open_dev$usbmon(&(0x7f0000000040)='/dev/usbmon#\x00', 0x0, 0x80000)
ioctl$KDSKBMODE(0xffffffffffffffff, 0x4b45, &(0x7f0000000080))
getsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r5, 0x84, 0x75, &(0x7f00000000c0)={0x0, 0x6}, &(0x7f0000000100)=0x8)
setsockopt$inet_sctp6_SCTP_AUTH_KEY(r5, 0x84, 0x17, &(0x7f0000000500)=ANY=[], 0x0)
ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)
r6 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
ioctl$TIOCLINUX3(r6, 0x541c, &(0x7f0000000040)=0x3)
ioctl$LOOP_CTL_REMOVE(r3, 0x4c81, 0x0)

2018/03/30 13:05:57 executing program 2:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYBLOB="22811e2630b1d0ac3463"], 0x1)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r1, r2, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = getpgid(0xffffffffffffffff)
syz_open_procfs(r3, &(0x7f00000005c0)='net/ip6_tables_targets\x00')
process_vm_writev(r3, &(0x7f0000000180)=[{&(0x7f0000000140)=""/22, 0x16}], 0x1, &(0x7f00000003c0)=[{&(0x7f0000000740)=""/173, 0xad}], 0x1, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x0, 0x0, &(0x7f0000004fbc), 0x0, 0x0, &(0x7f0000000680)})
r4 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
setns(r2, 0x0)
r5 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
r6 = dup3(0xffffffffffffffff, r0, 0x80000)
setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8)
syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00')
sendmsg$IPVS_CMD_NEW_DEST(r6, &(0x7f0000000540)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x2000400}, 0xc, &(0x7f0000000500)={&(0x7f0000000240)=ANY=[@ANYPTR], 0x1}, 0x1, 0x0, 0x0, 0x10}, 0x4)
sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10}, 0xc, &(0x7f0000000340)={&(0x7f0000000480)=ANY=[@ANYBLOB='H\x00\x00\x00'], 0x1}, 0x1}, 0x0)
fcntl$setstatus(r1, 0x4, 0x6000)
mq_open(&(0x7f0000000800)=':em1\x00', 0x40, 0x4, &(0x7f0000000840)={0x0, 0x0, 0x9, 0x6, 0x0, 0xff, 0x7})
pwritev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000c00)}], 0x1, 0x0)
ioctl$DRM_IOCTL_AGP_ALLOC(r6, 0xc0206434, &(0x7f0000000440)={0x9dca, <r7=>0x0, 0x10002, 0x4})
ioctl$DRM_IOCTL_AGP_BIND(r5, 0x40106436, &(0x7f00000004c0)={r7, 0x676})
ioctl$sock_ifreq(r5, 0x8917, &(0x7f0000000300)={'lo\x00', @ifru_data=&(0x7f00000001c0)="16e667ea25efad95e8e866bb6ef7f6ba94b72b63a28bcb7eafa978bdbe09a4d8"})
getsockopt$inet_int(r4, 0x0, 0x0, &(0x7f0000000600), &(0x7f0000000640)=0x4)
getsockname$unix(r1, &(0x7f0000000680), &(0x7f0000000700)=0x6e)

2018/03/30 13:05:57 executing program 6:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYBLOB="22811e2630b1d0ac3463"], 0x1)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r1, r2, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = getpgid(0xffffffffffffffff)
syz_open_procfs(r3, &(0x7f00000005c0)='net/ip6_tables_targets\x00')
process_vm_writev(r3, &(0x7f0000000180)=[{&(0x7f0000000140)=""/22, 0x16}], 0x1, &(0x7f00000003c0)=[{&(0x7f0000000740)=""/173, 0xad}], 0x1, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
r4 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
r5 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
r6 = dup3(0xffffffffffffffff, r0, 0x0)
setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8)
syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00')
sendmsg$IPVS_CMD_NEW_DEST(r6, &(0x7f0000000540)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x2000400}, 0xc, &(0x7f0000000500)={&(0x7f0000000240)=ANY=[@ANYPTR], 0x1}, 0x1, 0x0, 0x0, 0x10}, 0x4)
fcntl$setstatus(r1, 0x4, 0x6000)
mq_open(&(0x7f0000000800)=':em1\x00', 0x40, 0x4, &(0x7f0000000840)={0x4000000000000000, 0x0, 0x9, 0x6, 0x0, 0xff, 0x7})
pwritev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000c00)}], 0x1, 0x0)
ioctl$DRM_IOCTL_AGP_ALLOC(r6, 0xc0206434, &(0x7f0000000440)={0x9dca, <r7=>0x0, 0x10002, 0x4})
ioctl$DRM_IOCTL_AGP_BIND(r5, 0x40106436, &(0x7f00000004c0)={r7})
ioctl$sock_ifreq(r5, 0x8917, &(0x7f0000000300)={'lo\x00', @ifru_data=&(0x7f00000001c0)="16e667ea25efad95e8e866bb6ef7f6ba94b72b63a28bcb7eafa978bdbe09a4d8"})
getsockopt$inet_int(r4, 0x0, 0x0, &(0x7f0000000600), &(0x7f0000000640)=0x4)
getsockname$unix(r1, &(0x7f0000000680), &(0x7f0000000700)=0x6e)

2018/03/30 13:05:57 executing program 0:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x0)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYBLOB="22811e2630b1d0ac3463"], 0x1)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r1, r2, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = getpgid(0xffffffffffffffff)
syz_open_procfs(r3, &(0x7f00000005c0)='net/ip6_tables_targets\x00')
process_vm_writev(r3, &(0x7f0000000180)=[{&(0x7f0000000140)=""/22, 0x16}], 0x1, &(0x7f00000003c0)=[{&(0x7f0000000740)=""/173, 0xad}], 0x1, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
r4 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
setns(r2, 0x0)
r5 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
r6 = dup3(0xffffffffffffffff, r0, 0x80000)
setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8)
syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00')
sendmsg$IPVS_CMD_NEW_DEST(r6, &(0x7f0000000540)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x2000400}, 0xc, &(0x7f0000000500)={&(0x7f0000000240)=ANY=[@ANYPTR], 0x1}, 0x1, 0x0, 0x0, 0x10}, 0x0)
sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10}, 0xc, &(0x7f0000000340)={&(0x7f0000000480)=ANY=[@ANYBLOB='H\x00\x00\x00'], 0x1}, 0x1}, 0x0)
fcntl$setstatus(r1, 0x4, 0x6000)
mq_open(&(0x7f0000000800)=':em1\x00', 0x40, 0x4, &(0x7f0000000840)={0x4000000000000000, 0x0, 0x9, 0x6, 0x0, 0xff, 0x7})
pwritev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000c00)}], 0x1, 0x0)
ioctl$DRM_IOCTL_AGP_ALLOC(r6, 0xc0206434, &(0x7f0000000440)={0x9dca, <r7=>0x0, 0x10002, 0x4})
ioctl$DRM_IOCTL_AGP_BIND(r5, 0x40106436, &(0x7f00000004c0)={r7, 0x676})
ioctl$sock_ifreq(r5, 0x8917, &(0x7f0000000300)={'lo\x00', @ifru_data=&(0x7f00000001c0)="16e667ea25efad95e8e866bb6ef7f6ba94b72b63a28bcb7eafa978bdbe09a4d8"})
getsockopt$inet_int(r4, 0x0, 0x0, &(0x7f0000000600), &(0x7f0000000640)=0x4)
getsockname$unix(r1, &(0x7f0000000680), &(0x7f0000000700)=0x6e)

2018/03/30 13:05:57 executing program 4:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
r1 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000002880)='/selinux/avc/cache_stats\x00', 0x0, 0x0)
ioctl$EVIOCSABS20(r1, 0x401845e0, &(0x7f00000028c0)={0x1000, 0x7fff, 0x1ff, 0xffffffff, 0x7, 0x40})
fchdir(r0)
r2 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(r2, &(0x7f0000000080)=ANY=[@ANYBLOB="00811e2630b1d0ac3463"], 0x1)
setsockopt$packet_add_memb(r2, 0x107, 0x1, &(0x7f0000002900)={0x0, 0x1, 0x6}, 0x10)
r3 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r2, r3, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r3, 0x0)
inotify_init1(0x800)
ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
r4 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
setns(r3, 0x8000000)
r5 = socket$nl_xfrm(0x10, 0x3, 0x6)
r6 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
dup3(r3, r0, 0x80000)
setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8)
r7 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00')
sendmsg$IPVS_CMD_NEW_DEST(0xffffffffffffffff, &(0x7f0000000540)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x2000400}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)=ANY=[@ANYBLOB=',\x00\x00\x00'], 0x1}, 0x1, 0x0, 0x0, 0x10}, 0x4)
sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10}, 0xc, &(0x7f0000000340)={&(0x7f0000000480)=ANY=[@ANYBLOB='H\x00\x00\x00'], 0x1}, 0x1}, 0x0)
sendmsg$IPVS_CMD_GET_DEST(r2, &(0x7f0000000880)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f00000005c0)={&(0x7f0000000740)={0x138, r7, 0x208, 0x70bd2b, 0x25dfdbfb, {0x8}, [@IPVS_CMD_ATTR_SERVICE={0x28, 0x1, [@IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@multicast2=0xe0000002}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x3}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x7fff}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x8c6}, @IPVS_CMD_ATTR_DAEMON={0x50, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @remote={0xac, 0x14, 0x14, 0xbb}}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x400}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x10001}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'syz_tun\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x6}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x2}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x30, 0x2, [@IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x2}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv6=@ipv4={[], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0xffffffff}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0xafa6}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x1}, @IPVS_CMD_ATTR_DEST={0x6c, 0x2, [@IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x7}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv4=@remote={0xac, 0x14, 0x14, 0xbb}}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x8}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x1}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x5}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x3}, @IPVS_DEST_ATTR_PORT={0x8, 0x2, 0x4e22}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv6=@mcast2={0xff, 0x2, [], 0x1}}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x10000}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x701a3921}]}]}, 0x138}, 0x1, 0x0, 0x0, 0x90}, 0x4)
fcntl$setstatus(r2, 0x4, 0x6000)
setsockopt$sock_linger(r4, 0x1, 0xd, &(0x7f00000008c0)={0x1, 0x2}, 0x8)
pwritev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000c00)="cfb93447d6feaef9f73c0561e075a8295d43017ab1a157786dcda36c5eec92a4306f284fa7e3ed364cc2da5c08cf7e4030d394520e123eee6d9ab275c91c174b1364fc943b49faefe12f605b5ce6c1400a91210c00477f900aff390901bf594c18557cb38a7d57ac8ded098b96b9dfc125e3bdc9305193f4cd256068baca5208160d820b9e7a043666ba4801cf6d557fc0f97f35c13ec6c0d1fe97ce1af1c17078ef47ab955200836671e402717481d14936b09828fd6f55fda2f11eb4c61b480e941133c0a4c5ec54033d0d174742191754ffe28b093596286a78ea01078337ada8585aa98dcc1143689002e31ccc5b9f5cfd2bbce5683a0f91b395391a60ba8e8f4d3c10c82c71caa74c44c8b0f3e42f1fc264497d5b9dabf309bad7bd", 0x11e}], 0x1, 0x0)
sendmmsg(r5, &(0x7f00000027c0)=[{{0x0, 0x0, &(0x7f0000000a00)=[{&(0x7f0000000900)="913da470640ae70fe168a71ad316e5525ce43547f28d8c56cb5cd246950c2d44a514698b3aebf2b60d933814378b0b9b750dec28bdbeedda6c8af5f3418ff8c43701e5dea492428ecdcf0e8c2a19f60e388b478179256834360c5ee359dbe4fabee36883a8314f0ea64dea3a732dffbe26a02e8327a0f7174a6990389e5b608d5300c271f26b3b37cc88e720a477e5f1aa2751af90d35d72606ac73f72dab39aad418a6335d44c785ba83edc9619a3221ae39ef2fed1657e426fa293a739cd779a6c645b3d29bb184041476e8e6e737e5fa1c4312360", 0xd6}], 0x1, 0x0, 0x0, 0x8000}, 0x3f}, {{&(0x7f0000002240)=@nl=@unspec, 0x80, &(0x7f0000002680)=[{&(0x7f00000022c0)="756a6b1895d55b0b292a3985cd35f28cfa8d5ab20a3448791e47ec9e971be82f993ebd55ec843a76ccd644a71222e57119e6f8866f59ba0b89c4cf71a9ce853f72bd99ac9097baf924ea3e3fbceaf0a0df15deb45ae757832bec56c67c0ad44e0ea5fcbc12f898989e1773427ad180efff1044e98613dab446587dd52a0deacb4074e01d97cd46c6e633ae1c1011fd2123c766e6fea028799cf82a562bd9d52c544241172f684398ac1b", 0xaa}, {&(0x7f0000002440)="c802b7c29c92c7ddcf8b11133e071ae83e8c0b0827764303ad44356d381633ce1fdd31e1641872e8d6b4c1a974d97d", 0x2f}, {&(0x7f0000002540)="446c9b3779f2a3dc39f3a3541d912b01ca9865e4172a83cda910f6b10dd97377212eb5279c", 0x25}], 0x3, &(0x7f0000002700)=[{0xa0, 0x10f, 0x200, "4f483406ed4a2e47550522989e031e3e239b59c5dc988744d266f33171b6d4a8e54f025a1e1be02c21ad9675e29aea96625352eec0db268e5c70b8e22a2bb0e11b9e6d9613d4e8e338194d9a41821db1ef97a16b16e5263d008bb6ce86b1e26f4d59926a9a72bed62192dc96eaa8a033c9ddaf2fc8c5fb9e765e5ff99cc5ae6fa7bc4a4f0abcb9c9745b54449ab38c"}], 0xa0, 0x800}, 0x1200000}], 0x2, 0x20040000)
sendmsg$IPVS_CMD_DEL_DAEMON(r2, &(0x7f0000000280)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000240)={&(0x7f0000000180)={0x28, 0x0, 0x0, 0x0, 0x25dfdbfc, {0xa}, [@IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x3ff}, @IPVS_CMD_ATTR_SERVICE={0xc, 0x1, [@IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8}]}]}, 0x28}, 0x1}, 0x0)
ioctl$sock_ifreq(r6, 0x8917, &(0x7f0000000300)={'lo\x00', @ifru_data=&(0x7f00000001c0)="16e667ea25efad95e8e866bb6ef7f6ba94b72b63a28bcb7eafa978bdbe09a4d8"})
getsockopt$inet_int(r4, 0x0, 0x0, &(0x7f0000000600), &(0x7f0000000640)=0x4)
getsockname$unix(r2, &(0x7f0000000680), &(0x7f0000000700)=0x6e)

2018/03/30 13:05:57 executing program 1:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYBLOB="22811e2630b1d0ac3463"], 0x1)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r1, r2, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = getpgid(0xffffffffffffffff)
syz_open_procfs(r3, &(0x7f00000005c0)='net/ip6_tables_targets\x00')
process_vm_writev(r3, &(0x7f0000000180), 0x0, &(0x7f00000003c0)=[{&(0x7f0000000740)=""/173, 0xad}], 0x1, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
r4 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
r5 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
r6 = dup3(0xffffffffffffffff, r0, 0x80000)
setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8)
syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00')
fcntl$setstatus(r1, 0x4, 0x6000)
mq_open(&(0x7f0000000800)=':em1\x00', 0x40, 0x4, &(0x7f0000000840)={0x4000000000000000, 0x0, 0x9, 0x6, 0x0, 0xff, 0x7})
pwritev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000c00)}], 0x1, 0x0)
ioctl$DRM_IOCTL_AGP_ALLOC(r6, 0xc0206434, &(0x7f0000000440)={0x9dca, <r7=>0x0, 0x10002, 0x4})
ioctl$DRM_IOCTL_AGP_BIND(r5, 0x40106436, &(0x7f00000004c0)={r7})
ioctl$sock_ifreq(r5, 0x8917, &(0x7f0000000300)={'lo\x00', @ifru_data=&(0x7f00000001c0)="16e667ea25efad95e8e866bb6ef7f6ba94b72b63a28bcb7eafa978bdbe09a4d8"})
getsockopt$inet_int(r4, 0x0, 0x0, &(0x7f0000000600), &(0x7f0000000640)=0x4)
getsockname$unix(r1, &(0x7f0000000680), &(0x7f0000000700)=0x6e)

2018/03/30 13:05:57 executing program 7:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYBLOB="22811e2630b1d0ac3463"], 0x1)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r1, r2, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x0, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = getpgid(0xffffffffffffffff)
syz_open_procfs(r3, &(0x7f00000005c0)='net/ip6_tables_targets\x00')
process_vm_writev(r3, &(0x7f0000000180)=[{&(0x7f0000000140)=""/22, 0x16}], 0x1, &(0x7f00000003c0)=[{&(0x7f0000000740)=""/173, 0xad}], 0x1, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
r4 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
r5 = dup3(0xffffffffffffffff, r0, 0x80000)
setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8)
syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00')
fcntl$setstatus(r1, 0x4, 0x6000)
mq_open(&(0x7f0000000800)=':em1\x00', 0x40, 0x4, &(0x7f0000000840)={0x4000000000000000, 0x0, 0x9, 0x6, 0x0, 0xff, 0x7})
pwritev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000c00)}], 0x1, 0x0)
ioctl$DRM_IOCTL_AGP_ALLOC(r5, 0xc0206434, &(0x7f0000000440)={0x9dca, <r6=>0x0, 0x10002, 0x4})
ioctl$DRM_IOCTL_AGP_BIND(r4, 0x40106436, &(0x7f00000004c0)={r6, 0x676})
ioctl$sock_ifreq(r4, 0x8917, &(0x7f0000000300)={'lo\x00', @ifru_data=&(0x7f00000001c0)="16e667ea25efad95e8e866bb6ef7f6ba94b72b63a28bcb7eafa978bdbe09a4d8"})
getsockopt$inet_int(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000600), &(0x7f0000000640)=0x4)
getsockname$unix(r1, &(0x7f0000000680), &(0x7f0000000700)=0x6e)

2018/03/30 13:05:57 executing program 3:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[], 0x0)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r1, r2, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, &(0x7f000026c000), &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
setns(r2, 0x0)
r3 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/loop-control\x00', 0x0, 0x0)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)
r4 = dup(r3)
getsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffff9c, 0x84, 0x6f, &(0x7f0000000340)={<r5=>0x0, 0x3c, &(0x7f00000005c0)=[@in={0x2, 0x4e23, @local={0xac, 0x14, 0x14, 0xaa}}, @in={0x2, 0x4e24, @broadcast=0xffffffff}, @in6={0xa, 0x0, 0x100000000, @loopback={0x0, 0x1}, 0x323d000000000}]}, &(0x7f0000000640)=0xc)
setsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r4, 0x84, 0xa, &(0x7f0000000680)={0xcff3, 0x80000000, 0x3, 0x0, 0x0, 0x66e, 0x5, 0x1, r5}, 0x20)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)
mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x5c831, 0xffffffffffffffff, 0x0)
openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/mls\x00', 0x0, 0x0)
setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(0xffffffffffffffff, 0x10e, 0x2, &(0x7f0000000340)=0xc, 0x4)
madvise(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x9)
r6 = syz_open_dev$usbmon(&(0x7f0000000040)='/dev/usbmon#\x00', 0x0, 0x80000)
ioctl$KDSKBMODE(0xffffffffffffffff, 0x4b45, &(0x7f0000000080))
getsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r6, 0x84, 0x75, &(0x7f00000000c0)={0x0, 0x6}, &(0x7f0000000100)=0x8)
setsockopt$inet_sctp6_SCTP_AUTH_KEY(r6, 0x84, 0x17, &(0x7f0000000500)=ANY=[], 0x0)
ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82)
ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82)
r7 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
ioctl$TIOCLINUX3(r7, 0x541c, &(0x7f0000000040)=0x3)
ioctl$LOOP_CTL_REMOVE(r3, 0x4c81, 0x0)

** 12 printk messages dropped ** [  588.701732] binder: 29993:30002 ioctl 40046207 0 returned -16
[  588.702329] binder: BINDER_SET_CONTEXT_MGR already set
[  588.702336] binder: 29997:30003 ioctl 40046207 0 returned -16
[  588.703542] binder: BINDER_SET_CONTEXT_MGR already set
[  588.703549] binder: 29994:30000 ioctl 40046207 0 returned -16
[  588.704856] binder: 29993:30002 got transaction with invalid offset (0, min 24 max 40) or object.
2018/03/30 13:05:57 executing program 5:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYBLOB="00811e2630b1d0ac3463"], 0x1)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r1, r2, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
setns(r2, 0x0)
r3 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/loop-control\x00', 0x0, 0x0)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)
r4 = dup(r3)
setsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r4, 0x84, 0xa, &(0x7f0000000680)={0xcff3, 0x80000000, 0x3, 0x0, 0x0, 0x66e, 0x5}, 0x20)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)
mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x5c831, 0xffffffffffffffff, 0x0)
openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/mls\x00', 0x0, 0x0)
setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(0xffffffffffffffff, 0x10e, 0x2, &(0x7f0000000340)=0xc, 0x4)
madvise(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x9)
r5 = syz_open_dev$usbmon(&(0x7f0000000040)='/dev/usbmon#\x00', 0x0, 0x80000)
ioctl$KDSKBMODE(0xffffffffffffffff, 0x4b45, &(0x7f0000000080))
getsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r5, 0x84, 0x75, &(0x7f00000000c0)={0x0, 0x6}, &(0x7f0000000100)=0x8)
setsockopt$inet_sctp6_SCTP_AUTH_KEY(r5, 0x84, 0x17, &(0x7f0000000500)=ANY=[], 0x0)
ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)
r6 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
ioctl$TIOCLINUX3(r6, 0x541c, &(0x7f0000000040)=0x3)
ioctl$LOOP_CTL_REMOVE(r3, 0x4c81, 0x0)

2018/03/30 13:05:58 executing program 7:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYBLOB="22811e2630b1d0ac3463"], 0x1)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r1, r2, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x0, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = getpgid(0xffffffffffffffff)
syz_open_procfs(r3, &(0x7f00000005c0)='net/ip6_tables_targets\x00')
process_vm_writev(r3, &(0x7f0000000180)=[{&(0x7f0000000140)=""/22, 0x16}], 0x1, &(0x7f00000003c0)=[{&(0x7f0000000740)=""/173, 0xad}], 0x1, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
r4 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
r5 = dup3(0xffffffffffffffff, r0, 0x80000)
setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8)
syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00')
fcntl$setstatus(r1, 0x4, 0x6000)
mq_open(&(0x7f0000000800)=':em1\x00', 0x40, 0x4, &(0x7f0000000840)={0x4000000000000000, 0x0, 0x9, 0x6, 0x0, 0xff, 0x7})
pwritev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000c00)}], 0x1, 0x0)
ioctl$DRM_IOCTL_AGP_ALLOC(r5, 0xc0206434, &(0x7f0000000440)={0x9dca, <r6=>0x0, 0x10002, 0x4})
ioctl$DRM_IOCTL_AGP_BIND(r4, 0x40106436, &(0x7f00000004c0)={r6, 0x676})
ioctl$sock_ifreq(r4, 0x8917, &(0x7f0000000300)={'lo\x00', @ifru_data=&(0x7f00000001c0)="16e667ea25efad95e8e866bb6ef7f6ba94b72b63a28bcb7eafa978bdbe09a4d8"})
getsockopt$inet_int(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000600), &(0x7f0000000640)=0x4)
getsockname$unix(r1, &(0x7f0000000680), &(0x7f0000000700)=0x6e)

2018/03/30 13:05:58 executing program 2:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYBLOB="22811e2630b1d0ac3463"], 0x1)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r1, r2, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = getpgid(0xffffffffffffffff)
syz_open_procfs(r3, &(0x7f00000005c0)='net/ip6_tables_targets\x00')
process_vm_writev(r3, &(0x7f0000000180)=[{&(0x7f0000000140)=""/22, 0x16}], 0x1, &(0x7f00000003c0)=[{&(0x7f0000000740)=""/173, 0xad}], 0x1, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x0, 0x0, &(0x7f0000004fbc), 0x0, 0x0, &(0x7f0000000680)})
r4 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
setns(r2, 0x0)
r5 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
r6 = dup3(0xffffffffffffffff, r0, 0x80000)
setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8)
syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00')
sendmsg$IPVS_CMD_NEW_DEST(r6, &(0x7f0000000540)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x2000400}, 0xc, &(0x7f0000000500)={&(0x7f0000000240)=ANY=[@ANYPTR], 0x1}, 0x1, 0x0, 0x0, 0x10}, 0x4)
sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10}, 0xc, &(0x7f0000000340)={&(0x7f0000000480)=ANY=[@ANYBLOB='H\x00\x00\x00'], 0x1}, 0x1}, 0x0)
fcntl$setstatus(r1, 0x4, 0x6000)
mq_open(&(0x7f0000000800)=':em1\x00', 0x40, 0x4, &(0x7f0000000840)={0x0, 0x0, 0x9, 0x6, 0x0, 0xff, 0x7})
pwritev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000c00)}], 0x1, 0x0)
ioctl$DRM_IOCTL_AGP_ALLOC(r6, 0xc0206434, &(0x7f0000000440)={0x9dca, <r7=>0x0, 0x10002, 0x4})
ioctl$DRM_IOCTL_AGP_BIND(r5, 0x40106436, &(0x7f00000004c0)={r7, 0x676})
ioctl$sock_ifreq(r5, 0x8917, &(0x7f0000000300)={'lo\x00', @ifru_data=&(0x7f00000001c0)="16e667ea25efad95e8e866bb6ef7f6ba94b72b63a28bcb7eafa978bdbe09a4d8"})
getsockopt$inet_int(r4, 0x0, 0x0, &(0x7f0000000600), &(0x7f0000000640)=0x4)
getsockname$unix(r1, &(0x7f0000000680), &(0x7f0000000700)=0x6e)

** 8 printk messages dropped ** [  588.721208] binder: 29994:30000 transaction failed 29201/-22, size 40-16 line 3197
2018/03/30 13:05:58 executing program 4:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
r1 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000002880)='/selinux/avc/cache_stats\x00', 0x0, 0x0)
ioctl$EVIOCSABS20(r1, 0x401845e0, &(0x7f00000028c0)={0x1000, 0x7fff, 0x1ff, 0xffffffff, 0x7, 0x40})
fchdir(r0)
r2 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(r2, &(0x7f0000000080)=ANY=[@ANYBLOB="00811e2630b1d0ac3463"], 0x1)
setsockopt$packet_add_memb(r2, 0x107, 0x1, &(0x7f0000002900)={0x0, 0x1, 0x6}, 0x10)
r3 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r2, r3, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r3, 0x0)
inotify_init1(0x800)
ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
r4 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
setns(r3, 0x8000000)
r5 = socket$nl_xfrm(0x10, 0x3, 0x6)
r6 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
dup3(r3, r0, 0x80000)
setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8)
r7 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00')
sendmsg$IPVS_CMD_NEW_DEST(0xffffffffffffffff, &(0x7f0000000540)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x2000400}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)=ANY=[@ANYBLOB=',\x00\x00\x00'], 0x1}, 0x1, 0x0, 0x0, 0x10}, 0x4)
sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10}, 0xc, &(0x7f0000000340)={&(0x7f0000000480)=ANY=[@ANYBLOB='H\x00\x00\x00'], 0x1}, 0x1}, 0x0)
sendmsg$IPVS_CMD_GET_DEST(r2, &(0x7f0000000880)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f00000005c0)={&(0x7f0000000740)={0x138, r7, 0x208, 0x70bd2b, 0x25dfdbfb, {0x8}, [@IPVS_CMD_ATTR_SERVICE={0x28, 0x1, [@IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@multicast2=0xe0000002}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x3}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x7fff}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x8c6}, @IPVS_CMD_ATTR_DAEMON={0x50, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @remote={0xac, 0x14, 0x14, 0xbb}}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x400}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x10001}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'syz_tun\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x6}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x2}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x30, 0x2, [@IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x2}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv6=@ipv4={[], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0xffffffff}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0xafa6}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x1}, @IPVS_CMD_ATTR_DEST={0x6c, 0x2, [@IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x7}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv4=@remote={0xac, 0x14, 0x14, 0xbb}}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x8}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x1}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x5}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x3}, @IPVS_DEST_ATTR_PORT={0x8, 0x2, 0x4e22}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv6=@mcast2={0xff, 0x2, [], 0x1}}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x10000}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x701a3921}]}]}, 0x138}, 0x1, 0x0, 0x0, 0x90}, 0x4)
fcntl$setstatus(r2, 0x4, 0x6000)
setsockopt$sock_linger(r4, 0x1, 0xd, &(0x7f00000008c0)={0x1, 0x2}, 0x8)
pwritev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000c00)="cfb93447d6feaef9f73c0561e075a8295d43017ab1a157786dcda36c5eec92a4306f284fa7e3ed364cc2da5c08cf7e4030d394520e123eee6d9ab275c91c174b1364fc943b49faefe12f605b5ce6c1400a91210c00477f900aff390901bf594c18557cb38a7d57ac8ded098b96b9dfc125e3bdc9305193f4cd256068baca5208160d820b9e7a043666ba4801cf6d557fc0f97f35c13ec6c0d1fe97ce1af1c17078ef47ab955200836671e402717481d14936b09828fd6f55fda2f11eb4c61b480e941133c0a4c5ec54033d0d174742191754ffe28b093596286a78ea01078337ada8585aa98dcc1143689002e31ccc5b9f5cfd2bbce5683a0f91b395391a60ba8e8f4d3c10c82c71caa74c44c8b0f3e42f1fc264497d5b9dabf309bad7bd", 0x11e}], 0x1, 0x0)
sendmmsg(r5, &(0x7f00000027c0)=[{{0x0, 0x0, &(0x7f0000000a00)=[{&(0x7f0000000900)="913da470640ae70fe168a71ad316e5525ce43547f28d8c56cb5cd246950c2d44a514698b3aebf2b60d933814378b0b9b750dec28bdbeedda6c8af5f3418ff8c43701e5dea492428ecdcf0e8c2a19f60e388b478179256834360c5ee359dbe4fabee36883a8314f0ea64dea3a732dffbe26a02e8327a0f7174a6990389e5b608d5300c271f26b3b37cc88e720a477e5f1aa2751af90d35d72606ac73f72dab39aad418a6335d44c785ba83edc9619a3221ae39ef2fed1657e426fa293a739cd779a6c645b3d29bb184041476e8e6e737e5fa1c4312360", 0xd6}], 0x1, 0x0, 0x0, 0x8000}, 0x3f}, {{&(0x7f0000002240)=@nl=@unspec, 0x80, &(0x7f0000002680)=[{&(0x7f00000022c0)="756a6b1895d55b0b292a3985cd35f28cfa8d5ab20a3448791e47ec9e971be82f993ebd55ec843a76ccd644a71222e57119e6f8866f59ba0b89c4cf71a9ce853f72bd99ac9097baf924ea3e3fbceaf0a0df15deb45ae757832bec56c67c0ad44e0ea5fcbc12f898989e1773427ad180efff1044e98613dab446587dd52a0deacb4074e01d97cd46c6e633ae1c1011fd2123c766e6fea028799cf82a562bd9d52c544241172f684398ac1b", 0xaa}, {&(0x7f0000002440)="c802b7c29c92c7ddcf8b11133e071ae83e8c0b0827764303ad44356d381633ce1fdd31e1641872e8d6b4c1a974d97d", 0x2f}, {&(0x7f0000002540)="446c9b3779f2a3dc39f3a3541d912b01ca9865e4172a83cda910f6b10dd97377212eb5279c", 0x25}], 0x3, &(0x7f0000002700)=[{0xa0, 0x10f, 0x200, "4f483406ed4a2e47550522989e031e3e239b59c5dc988744d266f33171b6d4a8e54f025a1e1be02c21ad9675e29aea96625352eec0db268e5c70b8e22a2bb0e11b9e6d9613d4e8e338194d9a41821db1ef97a16b16e5263d008bb6ce86b1e26f4d59926a9a72bed62192dc96eaa8a033c9ddaf2fc8c5fb9e765e5ff99cc5ae6fa7bc4a4f0abcb9c9745b54449ab38c"}], 0xa0, 0x800}, 0x1200000}], 0x2, 0x20040000)
sendmsg$IPVS_CMD_DEL_DAEMON(r2, &(0x7f0000000280)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000240)={&(0x7f0000000180)={0x28, 0x0, 0x0, 0x0, 0x25dfdbfc, {0xa}, [@IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x3ff}, @IPVS_CMD_ATTR_SERVICE={0xc, 0x1, [@IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8}]}]}, 0x28}, 0x1}, 0x0)
ioctl$sock_ifreq(r6, 0x8917, &(0x7f0000000300)={'lo\x00', @ifru_data=&(0x7f00000001c0)="16e667ea25efad95e8e866bb6ef7f6ba94b72b63a28bcb7eafa978bdbe09a4d8"})
getsockopt$inet_int(r4, 0x0, 0x0, &(0x7f0000000600), &(0x7f0000000640)=0x4)
getsockname$unix(r2, &(0x7f0000000680), &(0x7f0000000700)=0x6e)

2018/03/30 13:05:58 executing program 6:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYBLOB="22811e2630b1d0ac3463"], 0x1)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r1, r2, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = getpgid(0xffffffffffffffff)
syz_open_procfs(r3, &(0x7f00000005c0)='net/ip6_tables_targets\x00')
process_vm_writev(r3, &(0x7f0000000180)=[{&(0x7f0000000140)=""/22, 0x16}], 0x1, &(0x7f00000003c0)=[{&(0x7f0000000740)=""/173, 0xad}], 0x1, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
r4 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
r5 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
r6 = dup3(0xffffffffffffffff, r0, 0x0)
setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8)
syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00')
sendmsg$IPVS_CMD_NEW_DEST(r6, &(0x7f0000000540)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x2000400}, 0xc, &(0x7f0000000500)={&(0x7f0000000240)=ANY=[@ANYPTR], 0x1}, 0x1, 0x0, 0x0, 0x10}, 0x4)
fcntl$setstatus(r1, 0x4, 0x6000)
mq_open(&(0x7f0000000800)=':em1\x00', 0x40, 0x4, &(0x7f0000000840)={0x4000000000000000, 0x0, 0x9, 0x6, 0x0, 0xff, 0x7})
pwritev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000c00)}], 0x1, 0x0)
ioctl$DRM_IOCTL_AGP_ALLOC(r6, 0xc0206434, &(0x7f0000000440)={0x9dca, <r7=>0x0, 0x10002, 0x4})
ioctl$DRM_IOCTL_AGP_BIND(r5, 0x40106436, &(0x7f00000004c0)={r7, 0x676})
ioctl$sock_ifreq(0xffffffffffffffff, 0x8917, &(0x7f0000000300)={'lo\x00', @ifru_data=&(0x7f00000001c0)="16e667ea25efad95e8e866bb6ef7f6ba94b72b63a28bcb7eafa978bdbe09a4d8"})
getsockopt$inet_int(r4, 0x0, 0x0, &(0x7f0000000600), &(0x7f0000000640)=0x4)
getsockname$unix(r1, &(0x7f0000000680), &(0x7f0000000700)=0x6e)

2018/03/30 13:05:58 executing program 1:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYBLOB="22811e2630b1d0ac3463"], 0x1)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r1, r2, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = getpgid(0xffffffffffffffff)
syz_open_procfs(r3, &(0x7f00000005c0)='net/ip6_tables_targets\x00')
process_vm_writev(r3, &(0x7f0000000180), 0x0, &(0x7f00000003c0)=[{&(0x7f0000000740)=""/173, 0xad}], 0x1, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
r4 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
r5 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
r6 = dup3(0xffffffffffffffff, r0, 0x80000)
setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8)
syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00')
fcntl$setstatus(r1, 0x4, 0x6000)
mq_open(&(0x7f0000000800)=':em1\x00', 0x40, 0x4, &(0x7f0000000840)={0x4000000000000000, 0x0, 0x9, 0x6, 0x0, 0xff, 0x7})
pwritev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000c00)}], 0x1, 0x0)
ioctl$DRM_IOCTL_AGP_ALLOC(r6, 0xc0206434, &(0x7f0000000440)={0x9dca, <r7=>0x0, 0x10002, 0x4})
ioctl$DRM_IOCTL_AGP_BIND(r5, 0x40106436, &(0x7f00000004c0)={r7, 0x676})
ioctl$sock_ifreq(0xffffffffffffffff, 0x8917, &(0x7f0000000300)={'lo\x00', @ifru_data=&(0x7f00000001c0)="16e667ea25efad95e8e866bb6ef7f6ba94b72b63a28bcb7eafa978bdbe09a4d8"})
getsockopt$inet_int(r4, 0x0, 0x0, &(0x7f0000000600), &(0x7f0000000640)=0x4)
getsockname$unix(r1, &(0x7f0000000680), &(0x7f0000000700)=0x6e)

2018/03/30 13:05:58 executing program 3:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[], 0x0)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r1, r2, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, &(0x7f000026c000), &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
setns(r2, 0x0)
r3 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/loop-control\x00', 0x0, 0x0)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)
r4 = dup(r3)
getsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffff9c, 0x84, 0x6f, &(0x7f0000000340)={<r5=>0x0, 0x3c, &(0x7f00000005c0)=[@in={0x2, 0x4e23, @local={0xac, 0x14, 0x14, 0xaa}}, @in={0x2, 0x4e24, @broadcast=0xffffffff}, @in6={0xa, 0x0, 0x100000000, @loopback={0x0, 0x1}, 0x323d000000000}]}, &(0x7f0000000640)=0xc)
setsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r4, 0x84, 0xa, &(0x7f0000000680)={0xcff3, 0x80000000, 0x3, 0x0, 0x0, 0x66e, 0x5, 0x1, r5}, 0x20)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)
mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x5c831, 0xffffffffffffffff, 0x0)
openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/mls\x00', 0x0, 0x0)
setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(0xffffffffffffffff, 0x10e, 0x2, &(0x7f0000000340)=0xc, 0x4)
madvise(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x9)
r6 = syz_open_dev$usbmon(&(0x7f0000000040)='/dev/usbmon#\x00', 0x0, 0x80000)
ioctl$KDSKBMODE(0xffffffffffffffff, 0x4b45, &(0x7f0000000080))
getsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r6, 0x84, 0x75, &(0x7f00000000c0)={0x0, 0x6}, &(0x7f0000000100)=0x8)
setsockopt$inet_sctp6_SCTP_AUTH_KEY(r6, 0x84, 0x17, &(0x7f0000000500)=ANY=[], 0x0)
ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82)
ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82)
r7 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
ioctl$TIOCLINUX3(r7, 0x541c, &(0x7f0000000040)=0x3)
ioctl$LOOP_CTL_REMOVE(r3, 0x4c81, 0x0)

2018/03/30 13:05:58 executing program 5:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYBLOB="00811e2630b1d0ac3463"], 0x1)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r1, r2, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
setns(r2, 0x0)
r3 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/loop-control\x00', 0x0, 0x0)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)
getsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffff9c, 0x84, 0x6f, &(0x7f0000000340)={<r4=>0x0, 0x3c, &(0x7f00000005c0)=[@in={0x2, 0x4e23, @local={0xac, 0x14, 0x14, 0xaa}}, @in={0x2, 0x4e24, @broadcast=0xffffffff}, @in6={0xa, 0x0, 0x100000000, @loopback={0x0, 0x1}, 0x323d000000000}]}, &(0x7f0000000640)=0xc)
setsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000000680)={0xcff3, 0x80000000, 0x3, 0x0, 0x0, 0x66e, 0x5, 0x0, r4}, 0x20)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)
mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x5c831, 0xffffffffffffffff, 0x0)
openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/mls\x00', 0x0, 0x0)
setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(0xffffffffffffffff, 0x10e, 0x2, &(0x7f0000000340)=0xc, 0x4)
madvise(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x9)
r5 = syz_open_dev$usbmon(&(0x7f0000000040)='/dev/usbmon#\x00', 0x0, 0x80000)
ioctl$KDSKBMODE(0xffffffffffffffff, 0x4b45, &(0x7f0000000080))
getsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r5, 0x84, 0x75, &(0x7f00000000c0)={0x0, 0x6}, &(0x7f0000000100)=0x8)
setsockopt$inet_sctp6_SCTP_AUTH_KEY(r5, 0x84, 0x17, &(0x7f0000000500)=ANY=[], 0x0)
ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)
r6 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
ioctl$TIOCLINUX3(r6, 0x541c, &(0x7f0000000040)=0x3)
ioctl$LOOP_CTL_REMOVE(r3, 0x4c81, 0x0)

2018/03/30 13:05:58 executing program 0:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
r1 = creat(&(0x7f00000002c0)='./file1\x00', 0x20)
write$tun(0xffffffffffffffff, &(0x7f0000000080)=ANY=[], 0x0)
r2 = syz_open_dev$binder(&(0x7f0000236ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
tee(r1, r2, 0x1, 0x2)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = getpgid(0xffffffffffffffff)
syz_open_procfs(r3, &(0x7f00000005c0)='net/ip6_tables_targets\x00')
process_vm_writev(r3, &(0x7f0000000180)=[{&(0x7f0000000140)=""/22, 0x16}], 0x1, &(0x7f00000003c0)=[{&(0x7f0000000740)=""/173, 0xad}], 0x1, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x2b8, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0, 0x0]}}], 0x0, 0x0, &(0x7f0000000680)})
r4 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
setns(r2, 0x0)
r5 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
r6 = dup3(0xffffffffffffffff, r0, 0x80000)
setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}}}, 0x4, 0x5, 0x20, "0f93acc45b9094fef867e39a275cc5bfbb40be50f0fc0a2a53819a506388ee0caddc8afe157fdedf7987fc3edbe484ef2e5362adea36a7cb9331fcfc4409bd53d8288de784331ab977817eef34cba4b4"}, 0xd8)
syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00')
sendmsg$IPVS_CMD_NEW_DEST(r6, &(0x7f0000000540)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x2000400}, 0xc, &(0x7f0000000500)={&(0x7f0000000240)=ANY=[@ANYPTR], 0x1}, 0x1, 0x0, 0x0, 0x10}, 0x0)
sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10}, 0xc, &(0x7f0000000340)={&(0x7f0000000480)=ANY=[@ANYBLOB='H\x00\x00\x00'], 0x1}, 0x1}, 0x0)
fcntl$setstatus(r1, 0x4, 0x6000)
mq_open(&(0x7f0000000800)=':em1\x00', 0x40, 0x4, &(0x7f0000000840)={0x4000000000000000, 0x0, 0x9, 0x6, 0x0, 0xff, 0x7})
pwritev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000c00)}], 0x1, 0x0)
ioctl$DRM_IOCTL_AGP_ALLOC(r6, 0xc0206434, &(0x7f0000000440)={0x9dca, <r7=>0x0, 0x10002, 0x4})
ioctl$DRM_IOCTL_AGP_BIND(r5, 0x40106436, &(0x7f00000004c0)={r7, 0x676})
ioctl$sock_ifreq(r5, 0x8917, &(0x7f0000000300)={'lo\x00', @ifru_data=&(0x7f00000001c0)="16e667ea25efad95e8e866bb6ef7f6ba94b72b63a28bcb7eafa978bdbe09a4d8"})
getsockopt$inet_int(r4, 0x0, 0x0, &(0x7f0000000600), &(0x7f0000000640)=0x4)
getsockname$unix(r1, &(0x7f0000000680), &(0x7f0000000700)=0x6e)

** 20 printk messages dropped ** [  588.858940] binder: 30026:30029 got transaction with invalid offset (0, min 24 max 40) or object.
** 16 printk messages dropped ** [  588.877188] binder: 30022:30031 transaction failed 29201/-22, size 40-16 line 3197
** 12 printk messages dropped ** [  588.956579] binder: 30048:30049 ioctl 40046207 0 returned -16
** 3 printk messages dropped ** [  588.968371] binder: undelivered TRANSACTION_ERROR: 29201
** 122 printk messages dropped ** [  589.398673] binder: 30127:30135 got transaction with invalid offset (0, min 24 max 40) or object.
[  589.401210] binder: 30127:30135 transaction failed 29201/-22, size 40-16 line 3197
[  589.405838] binder: BINDER_SET_CONTEXT_MGR already set
[  589.405845] binder: 30122:30136 ioctl 40046207 0 returned -16
[  589.406868] binder: BINDER_SET_CONTEXT_MGR already set
[  589.406876] binder: 30126:30137 ioctl 40046207 0 returned -16
[  589.407940] binder: 30122:30136 got transaction with invalid offset (0, min 24 max 40) or object.
[  589.408027] binder: 30122:30136 transaction failed 29201/-22, size 40-16 line 3197
[  589.413130] binder: 30126:30137 got transaction with invalid offset (0, min 24 max 40) or object.
[  589.413227] binder: 30126:30137 transaction failed 29201/-22, size 40-16 line 3197
[  589.433982] binder_alloc: 30131: binder_alloc_buf, no vma
[  589.434023] binder: 30141:30146 transaction failed 29189/-3, size 40-16 line 3134
[  589.435836] binder: undelivered TRANSACTION_ERROR: 29201
[  589.457549] binder: undelivered TRANSACTION_ERROR: 29201
[  589.470705] binder: undelivered TRANSACTION_ERROR: 29189
[  589.471830] binder: undelivered TRANSACTION_ERROR: 29201
[  589.484396] binder: undelivered TRANSACTION_ERROR: 29201
[  589.489747] binder: undelivered TRANSACTION_ERROR: 29189
[  589.501325] binder: BINDER_SET_CONTEXT_MGR already set
[  589.501333] binder: 30154:30158 ioctl 40046207 0 returned -16
[  589.503545] binder: 30154:30158 got transaction with invalid offset (0, min 24 max 40) or object.
[  589.503634] binder: 30154:30158 transaction failed 29201/-22, size 40-16 line 3197
[  589.516671] binder: undelivered TRANSACTION_ERROR: 29189
[  589.523178] binder: BINDER_SET_CONTEXT_MGR already set
[  589.523187] binder: 30156:30159 ioctl 40046207 0 returned -16
[  589.527279] binder: 30156:30159 got transaction with invalid offset (0, min 24 max 40) or object.
[  589.527369] binder: 30156:30159 transaction failed 29201/-22, size 40-16 line 3197
[  589.528844] binder: BINDER_SET_CONTEXT_MGR already set
[  589.528852] binder: 30162:30166 ioctl 40046207 0 returned -16
[  589.529842] binder: 30163:30167 got transaction with invalid offset (0, min 24 max 40) or object.
[  589.529925] binder: 30163:30167 transaction failed 29201/-22, size 40-16 line 3197
[  589.530328] binder: 30162:30166 got transaction with invalid offset (0, min 24 max 40) or object.
[  589.530404] binder: 30162:30166 transaction failed 29201/-22, size 40-16 line 3197
[  589.540778] binder: 30155:30160 got transaction with invalid offset (0, min 24 max 40) or object.
[  589.540874] binder: 30155:30160 transaction failed 29201/-22, size 40-16 line 3197
[  589.543282] binder: BINDER_SET_CONTEXT_MGR already set
[  589.543290] binder: 30161:30168 ioctl 40046207 0 returned -16
[  589.545217] binder: 30161:30168 got transaction with invalid offset (0, min 24 max 40) or object.
[  589.545307] binder: 30161:30168 transaction failed 29201/-22, size 40-16 line 3197
[  589.558643] binder: BINDER_SET_CONTEXT_MGR already set
[  589.558652] binder: 30165:30171 ioctl 40046207 0 returned -16
[  589.559148] binder: undelivered TRANSACTION_ERROR: 29201
[  589.566968] binder_alloc: 30155: binder_alloc_buf, no vma
[  589.567005] binder: 30165:30171 transaction failed 29189/-3, size 40-16 line 3134
[  589.573942] binder: undelivered TRANSACTION_ERROR: 29201
[  589.588574] binder: BINDER_SET_CONTEXT_MGR already set
[  589.588584] binder: 30173:30178 ioctl 40046207 0 returned -16
[  589.594518] binder: undelivered TRANSACTION_ERROR: 29201
[  589.594809] binder: undelivered TRANSACTION_ERROR: 29201
[  589.600272] binder: undelivered TRANSACTION_ERROR: 29201
[  589.606807] binder: undelivered TRANSACTION_ERROR: 29201
[  589.626714] binder: undelivered TRANSACTION_ERROR: 29189
[  589.664609] binder: BINDER_SET_CONTEXT_MGR already set
[  589.664617] binder: 30187:30193 ioctl 40046207 0 returned -16
[  589.665297] binder: BINDER_SET_CONTEXT_MGR already set
[  589.665304] binder: 30190:30195 ioctl 40046207 0 returned -16
[  589.665610] binder: 30187:30193 got transaction with invalid offset (0, min 24 max 40) or object.
[  589.665679] binder: BINDER_SET_CONTEXT_MGR already set
[  589.665691] binder: 30183:30196 ioctl 40046207 0 returned -16
[  589.665701] binder: 30187:30193 transaction failed 29201/-22, size 40-16 line 3197
[  589.667348] binder: 30185:30192 got transaction with invalid offset (0, min 24 max 40) or object.
[  589.667438] binder: 30185:30192 transaction failed 29201/-22, size 40-16 line 3197
[  589.668089] binder: BINDER_SET_CONTEXT_MGR already set
[  589.668096] binder: 30184:30191 ioctl 40046207 0 returned -16
[  589.668533] binder: 30183:30196 got transaction with invalid offset (0, min 24 max 40) or object.
[  589.668613] binder: 30183:30196 transaction failed 29201/-22, size 40-16 line 3197
[  589.669767] binder: 30190:30195 got transaction with invalid offset (0, min 24 max 40) or object.
[  589.669854] binder: 30190:30195 transaction failed 29201/-22, size 40-16 line 3197
[  589.670337] binder: 30184:30191 got transaction with invalid offset (0, min 24 max 40) or object.
[  589.670426] binder: 30184:30191 transaction failed 29201/-22, size 40-16 line 3197
[  589.678042] binder: BINDER_SET_CONTEXT_MGR already set
[  589.678050] binder: 30188:30197 ioctl 40046207 0 returned -16
[  589.682469] binder: 30188:30197 got transaction with invalid offset (0, min 24 max 40) or object.
[  589.683845] binder: BINDER_SET_CONTEXT_MGR already set
[  589.683852] binder: 30186:30198 ioctl 40046207 0 returned -16
[  589.684761] binder: 30186:30198 got transaction with invalid offset (0, min 24 max 40) or object.
[  589.687367] binder: 30188:30197 transaction failed 29201/-22, size 40-16 line 3197
[  589.689001] binder: 30186:30198 transaction failed 29201/-22, size 40-16 line 3197
[  589.696786] binder: undelivered TRANSACTION_ERROR: 29201
[  589.729161] binder: undelivered TRANSACTION_ERROR: 29201
[  589.737710] binder: undelivered TRANSACTION_ERROR: 29201
[  589.744249] binder: undelivered TRANSACTION_ERROR: 29201
[  589.757041] binder: undelivered TRANSACTION_ERROR: 29201
[  589.764744] binder: 30214:30215 got transaction with invalid offset (0, min 24 max 40) or object.
[  589.764836] binder: 30214:30215 transaction failed 29201/-22, size 40-16 line 3197
[  589.768785] binder: undelivered TRANSACTION_ERROR: 29201
[  589.777879] binder: BINDER_SET_CONTEXT_MGR already set
[  589.777888] binder: 30210:30213 ioctl 40046207 0 returned -16
[  589.778731] binder: 30210:30213 got transaction with invalid offset (0, min 24 max 40) or object.
[  589.779239] binder: 30210:30213 transaction failed 29201/-22, size 40-16 line 3197
[  589.779516] binder: undelivered TRANSACTION_ERROR: 29201
[  589.788244] binder: BINDER_SET_CONTEXT_MGR already set
[  589.788253] binder: 30212:30221 ioctl 40046207 0 returned -16
[  589.794035] binder: BINDER_SET_CONTEXT_MGR already set
[  589.794043] binder: 30217:30223 ioctl 40046207 0 returned -16
[  589.797867] binder: 30217:30223 got transaction with invalid offset (0, min 24 max 40) or object.
[  589.797961] binder: 30217:30223 transaction failed 29201/-22, size 40-16 line 3197
[  589.802451] binder: undelivered TRANSACTION_ERROR: 29201
[  589.816371] binder: BINDER_SET_CONTEXT_MGR already set
[  589.816380] binder: 30216:30222 ioctl 40046207 0 returned -16
[  589.818267] binder: 30216:30222 got transaction with invalid offset (0, min 24 max 40) or object.
[  589.818354] binder: 30216:30222 transaction failed 29201/-22, size 40-16 line 3197
[  589.818675] binder: BINDER_SET_CONTEXT_MGR already set
[  589.818681] binder: 30220:30224 ioctl 40046207 0 returned -16
[  589.819587] binder: 30220:30224 got transaction with invalid offset (0, min 24 max 40) or object.
[  589.819670] binder: 30220:30224 transaction failed 29201/-22, size 40-16 line 3197
[  589.824674] binder: undelivered TRANSACTION_ERROR: 29201
[  589.839546] binder: undelivered TRANSACTION_ERROR: 29201
[  589.845088] binder: 30230:30235 got transaction with invalid offset (0, min 24 max 40) or object.
[  589.845186] binder: 30230:30235 transaction failed 29201/-22, size 40-16 line 3197
[  589.862087] binder: BINDER_SET_CONTEXT_MGR already set
[  589.862096] binder: 30225:30237 ioctl 40046207 0 returned -16
[  589.866828] binder: 30225:30237 got transaction with invalid offset (0, min 24 max 40) or object.
[  589.866914] binder: 30225:30237 transaction failed 29201/-22, size 40-16 line 3197
[  589.871545] binder: BINDER_SET_CONTEXT_MGR already set
[  589.871552] binder: 30238:30239 ioctl 40046207 0 returned -16
[  589.872444] binder_alloc: 30230: binder_alloc_buf, no vma
[  589.874613] binder: 30238:30239 transaction failed 29189/-3, size 40-16 line 3134
[  589.874805] binder: undelivered TRANSACTION_ERROR: 29201
[  589.874891] binder: undelivered TRANSACTION_ERROR: 29201
[  589.886419] binder: undelivered TRANSACTION_ERROR: 29201
[  589.909221] binder: undelivered TRANSACTION_ERROR: 29189
[  589.917934] binder: undelivered TRANSACTION_ERROR: 29201
[  589.950582] binder: 30244:30249 got transaction with invalid offset (0, min 24 max 40) or object.
[  589.951249] binder: 30244:30249 transaction failed 29201/-22, size 40-16 line 3197
[  589.951468] binder: BINDER_SET_CONTEXT_MGR already set
[  589.951474] binder: 30243:30248 ioctl 40046207 0 returned -16
[  589.952357] binder: 30243:30248 got transaction with invalid offset (0, min 24 max 40) or object.
[  589.952445] binder: 30243:30248 transaction failed 29201/-22, size 40-16 line 3197
[  589.958083] binder: BINDER_SET_CONTEXT_MGR already set
[  589.958091] binder: 30245:30254 ioctl 40046207 0 returned -16
[  589.961427] binder: 30245:30254 got transaction with invalid offset (0, min 0 max 0) or object.
[  589.961482] binder: 30245:30254 transaction failed 29201/-22, size 0-16 line 3197
[  589.965408] binder: BINDER_SET_CONTEXT_MGR already set
[  589.965416] binder: 30247:30255 ioctl 40046207 0 returned -16
[  589.967329] binder: 30247:30255 got transaction with invalid offset (0, min 24 max 40) or object.
[  589.967417] binder: 30247:30255 transaction failed 29201/-22, size 40-16 line 3197
[  589.968533] binder: BINDER_SET_CONTEXT_MGR already set
[  589.968540] binder: 30242:30252 ioctl 40046207 0 returned -16
[  589.970543] binder: BINDER_SET_CONTEXT_MGR already set
[  589.970549] binder: 30246:30253 ioctl 40046207 0 returned -16
[  589.972415] binder: 30246:30253 got transaction with invalid offset (0, min 24 max 40) or object.
[  589.972894] binder: 30242:30252 got transaction with invalid offset (0, min 24 max 40) or object.
[  589.972986] binder: 30246:30253 transaction failed 29201/-22, size 40-16 line 3197
[  589.973759] binder: 30242:30252 transaction failed 29201/-22, size 40-16 line 3197
[  589.979022] binder: undelivered TRANSACTION_ERROR: 29201
[  589.980540] binder: BINDER_SET_CONTEXT_MGR already set
[  589.980547] binder: 30250:30257 ioctl 40046207 0 returned -16
[  589.981497] binder: 30250:30257 got transaction with invalid offset (0, min 24 max 40) or object.
[  589.981588] binder: 30250:30257 transaction failed 29201/-22, size 40-16 line 3197
[  589.985404] binder: BINDER_SET_CONTEXT_MGR already set
[  589.985410] binder: 30251:30258 ioctl 40046207 0 returned -16
[  589.987959] binder: 30251:30258 got transaction with invalid offset (0, min 24 max 40) or object.
[  589.988052] binder: 30251:30258 transaction failed 29201/-22, size 40-16 line 3197
[  590.006330] binder: undelivered TRANSACTION_ERROR: 29201
[  590.031766] binder: undelivered TRANSACTION_ERROR: 29201
[  590.031966] binder: undelivered TRANSACTION_ERROR: 29201
[  590.032687] binder: undelivered TRANSACTION_ERROR: 29201
[  590.050358] binder: undelivered TRANSACTION_ERROR: 29201
[  590.065748] binder: undelivered TRANSACTION_ERROR: 29201
[  590.075104] binder: undelivered TRANSACTION_ERROR: 29201
[  590.083275] binder: BINDER_SET_CONTEXT_MGR already set
[  590.083283] binder: 30276:30281 ioctl 40046207 0 returned -16
[  590.083344] binder: BINDER_SET_CONTEXT_MGR already set
[  590.083351] binder: 30275:30282 ioctl 40046207 0 returned -16
[  590.085754] binder: BINDER_SET_CONTEXT_MGR already set
[  590.085762] binder: 30265:30271 ioctl 40046207 0 returned -16
[  590.086774] binder: 30265:30271 got transaction with invalid offset (0, min 24 max 40) or object.
[  590.086874] binder: 30265:30271 transaction failed 29201/-22, size 40-16 line 3197
[  590.089420] binder: 30270:30274 got transaction with invalid offset (0, min 24 max 40) or object.
[  590.089503] binder: 30270:30274 transaction failed 29201/-22, size 40-16 line 3197
[  590.096737] binder: 30276:30281 got transaction with invalid offset (0, min 24 max 40) or object.
[  590.096826] binder: 30276:30281 transaction failed 29201/-22, size 40-16 line 3197
[  590.097815] binder: 30275:30282 got transaction with invalid offset (0, min 24 max 40) or object.
[  590.097907] binder: 30275:30282 transaction failed 29201/-22, size 40-16 line 3197
[  590.100305] binder: undelivered TRANSACTION_ERROR: 29201
[  590.117805] binder: undelivered TRANSACTION_ERROR: 29201
[  590.117889] binder: undelivered TRANSACTION_ERROR: 29201
[  590.134838] binder: 30288:30289 got transaction with invalid offset (0, min 24 max 40) or object.
[  590.134927] binder: 30288:30289 transaction failed 29201/-22, size 40-16 line 3197
[  590.136673] binder: BINDER_SET_CONTEXT_MGR already set
[  590.136682] binder: 30280:30293 ioctl 40046207 0 returned -16
[  590.142392] binder: BINDER_SET_CONTEXT_MGR already set
[  590.142399] binder: 30278:30285 ioctl 40046207 0 returned -16
[  590.144641] binder_alloc: 30288: binder_alloc_buf, no vma
[  590.144688] binder: 30278:30285 transaction failed 29189/-3, size 40-16 line 3134
[  590.145009] binder: BINDER_SET_CONTEXT_MGR already set
[  590.145015] binder: 30279:30291 ioctl 40046207 0 returned -16
[  590.146424] binder_alloc: 30288: binder_alloc_buf, no vma
[  590.146466] binder: 30280:30293 transaction failed 29189/-3, size 0-16 line 3134
[  590.147793] binder_alloc: 30288: binder_alloc_buf, no vma
[  590.147831] binder: 30279:30291 transaction failed 29189/-3, size 40-16 line 3134
[  590.149480] binder: BINDER_SET_CONTEXT_MGR already set
[  590.149488] binder: 30284:30294 ioctl 40046207 0 returned -16
[  590.150214] binder_alloc: 30288: binder_alloc_buf, no vma
[  590.150252] binder: 30284:30294 transaction failed 29189/-3, size 40-16 line 3134
[  590.154730] binder: undelivered TRANSACTION_ERROR: 29201
[  590.156496] binder: 30290:30296 got transaction with invalid offset (0, min 24 max 40) or object.
[  590.156569] binder: 30290:30296 transaction failed 29201/-22, size 40-16 line 3197
[  590.173128] binder: undelivered TRANSACTION_ERROR: 29201
[  590.183740] binder: undelivered TRANSACTION_ERROR: 29201
[  590.197655] binder: undelivered TRANSACTION_ERROR: 29189
[  590.207710] binder: undelivered TRANSACTION_ERROR: 29189
[  590.219355] binder: undelivered TRANSACTION_ERROR: 29189
[  590.229656] binder: undelivered TRANSACTION_ERROR: 29189
[  590.261960] binder: 30305:30314 got transaction with invalid offset (0, min 24 max 40) or object.
[  590.262045] binder: 30305:30314 transaction failed 29201/-22, size 40-16 line 3197
[  590.265482] binder: BINDER_SET_CONTEXT_MGR already set
[  590.265490] binder: 30307:30315 ioctl 40046207 0 returned -16
[  590.265745] binder: BINDER_SET_CONTEXT_MGR already set
[  590.265752] binder: 30308:30311 ioctl 40046207 0 returned -16
[  590.265846] binder: BINDER_SET_CONTEXT_MGR already set
[  590.265852] binder: 30304:30312 ioctl 40046207 0 returned -16
[  590.266900] binder: 30307:30315 got transaction with invalid offset (0, min 24 max 40) or object.
[  590.266993] binder: 30307:30315 transaction failed 29201/-22, size 40-16 line 3197
[  590.269594] binder: BINDER_SET_CONTEXT_MGR already set
[  590.269601] binder: 30306:30316 ioctl 40046207 0 returned -16
[  590.269730] binder: 30308:30311 got transaction with invalid offset (0, min 0 max 0) or object.
[  590.269783] binder: 30308:30311 transaction failed 29201/-22, size 0-16 line 3197
[  590.270190] binder: 30304:30312 got transaction with invalid offset (0, min 24 max 40) or object.
[  590.270265] binder: 30304:30312 transaction failed 29201/-22, size 40-16 line 3197
[  590.270446] binder: 30306:30316 got transaction with invalid offset (0, min 24 max 40) or object.
[  590.270534] binder: 30306:30316 transaction failed 29201/-22, size 40-16 line 3197
[  590.277935] binder: BINDER_SET_CONTEXT_MGR already set
[  590.277942] binder: 30310:30318 ioctl 40046207 0 returned -16
[  590.280091] binder: 30310:30318 got transaction with invalid offset (0, min 24 max 40) or object.
[  590.280179] binder: 30310:30318 transaction failed 29201/-22, size 40-16 line 3197
[  590.292220] binder: BINDER_SET_CONTEXT_MGR already set
[  590.292228] binder: 30309:30320 ioctl 40046207 0 returned -16
[  590.292532] binder: BINDER_SET_CONTEXT_MGR already set
[  590.292539] binder: 30313:30317 ioctl 40046207 0 returned -16
[  590.296186] binder: 30309:30320 got transaction with invalid offset (0, min 24 max 40) or object.
[  590.296273] binder: 30309:30320 transaction failed 29201/-22, size 40-16 line 3197
[  590.301414] binder: 30313:30317 got transaction with invalid offset (0, min 24 max 40) or object.
[  590.301504] binder: 30313:30317 transaction failed 29201/-22, size 40-16 line 3197
[  590.308809] binder: undelivered TRANSACTION_ERROR: 29201
[  590.312903] binder: undelivered TRANSACTION_ERROR: 29201
[  590.339750] binder: undelivered TRANSACTION_ERROR: 29201
[  590.343768] binder: undelivered TRANSACTION_ERROR: 29201
[  590.349524] binder: BINDER_SET_CONTEXT_MGR already set
[  590.349531] binder: 30332:30334 ioctl 40046207 0 returned -16
[  590.351142] binder: 30332:30334 got transaction with invalid offset (0, min 24 max 40) or object.
[  590.351232] binder: 30332:30334 transaction failed 29201/-22, size 40-16 line 3197
[  590.353631] binder: BINDER_SET_CONTEXT_MGR already set
[  590.353639] binder: 30333:30335 ioctl 40046207 0 returned -16
[  590.356662] binder: undelivered TRANSACTION_ERROR: 29201
[  590.363198] binder: undelivered TRANSACTION_ERROR: 29201
[  590.363290] binder: send failed reply for transaction 42260 to 30333:30335
[  590.376961] binder: undelivered TRANSACTION_ERROR: 29201
[  590.379125] binder: undelivered TRANSACTION_ERROR: 29201
[  590.379563] binder: undelivered TRANSACTION_ERROR: 29201
[  590.392532] binder: 30338:30340 got transaction with invalid offset (0, min 24 max 40) or object.
[  590.392620] binder: 30338:30340 transaction failed 29201/-22, size 40-16 line 3197
[  590.398268] binder: undelivered TRANSACTION_COMPLETE
[  590.398283] binder: undelivered TRANSACTION_ERROR: 29189
[  590.406753] binder: undelivered TRANSACTION_ERROR: 29201
[  590.438839] binder: 30347:30350 got transaction with invalid offset (0, min 24 max 40) or object.
[  590.438999] binder: 30347:30350 transaction failed 29201/-22, size 40-16 line 3197
[  590.440908] binder: BINDER_SET_CONTEXT_MGR already set
[  590.440916] binder: 30343:30346 ioctl 40046207 0 returned -16
[  590.443542] binder: BINDER_SET_CONTEXT_MGR already set
[  590.443550] binder: 30341:30345 ioctl 40046207 0 returned -16
[  590.444389] binder: 30343:30346 got transaction with invalid offset (0, min 24 max 40) or object.
[  590.444469] binder: 30343:30346 transaction failed 29201/-22, size 40-16 line 3197
[  590.444817] binder: 30341:30345 got transaction with invalid offset (0, min 24 max 40) or object.
[  590.444902] binder: 30341:30345 transaction failed 29201/-22, size 40-16 line 3197
[  590.446193] binder: BINDER_SET_CONTEXT_MGR already set
[  590.446201] binder: 30344:30353 ioctl 40046207 0 returned -16
[  590.450493] binder: 30344:30353 got transaction with invalid offset (0, min 24 max 40) or object.
[  590.450586] binder: 30344:30353 transaction failed 29201/-22, size 40-16 line 3197
[  590.453042] binder: BINDER_SET_CONTEXT_MGR already set
[  590.453050] binder: 30342:30348 ioctl 40046207 0 returned -16
[  590.454920] binder: BINDER_SET_CONTEXT_MGR already set
[  590.454928] binder: 30352:30354 ioctl 40046207 0 returned -16
[  590.456104] binder: 30352:30354 got transaction with invalid offset (0, min 24 max 40) or object.
[  590.456349] binder: 30352:30354 transaction failed 29201/-22, size 40-16 line 3197
[  590.460181] binder: BINDER_SET_CONTEXT_MGR already set
[  590.460188] binder: 30351:30355 ioctl 40046207 0 returned -16
[  590.467630] binder: 30342:30348 got transaction with invalid offset (0, min 24 max 40) or object.
[  590.467719] binder: 30342:30348 transaction failed 29201/-22, size 40-16 line 3197
[  590.471181] binder: BINDER_SET_CONTEXT_MGR already set
[  590.471189] binder: 30349:30356 ioctl 40046207 0 returned -16
[  590.478586] binder: 30349:30356 got transaction with invalid offset (0, min 24 max 40) or object.
[  590.478675] binder: 30349:30356 transaction failed 29201/-22, size 40-16 line 3197
[  590.493045] binder: undelivered TRANSACTION_ERROR: 29201
[  590.496418] binder: undelivered TRANSACTION_ERROR: 29201
[  590.509584] binder: undelivered TRANSACTION_ERROR: 29201
[  590.518149] binder: BINDER_SET_CONTEXT_MGR already set
[  590.518163] binder: 30367:30370 ioctl 40046207 0 returned -16
[  590.525411] binder_alloc: 30347: binder_alloc_buf, no vma
[  590.525443] binder: 30367:30370 transaction failed 29189/-3, size 40-16 line 3134
[  590.527089] binder: BINDER_SET_CONTEXT_MGR already set
[  590.527097] binder: 30368:30371 ioctl 40046207 0 returned -16
[  590.528008] binder_alloc: 30347: binder_alloc_buf, no vma
[  590.528044] binder: 30368:30371 transaction failed 29189/-3, size 40-16 line 3134
[  590.531270] binder: undelivered TRANSACTION_ERROR: 29201
[  590.531358] binder: send failed reply for transaction 42283 to 30351:30355
[  590.531463] binder: undelivered TRANSACTION_ERROR: 29201
[  590.531584] binder: undelivered TRANSACTION_COMPLETE
[  590.531596] binder: undelivered TRANSACTION_ERROR: 29189
[  590.548051] binder: undelivered TRANSACTION_ERROR: 29201
[  590.555911] binder: undelivered TRANSACTION_ERROR: 29201
[  590.569952] binder: undelivered TRANSACTION_ERROR: 29189
[  590.572136] binder: 30373:30378 got transaction with invalid offset (0, min 24 max 40) or object.
[  590.572224] binder: 30373:30378 transaction failed 29201/-22, size 40-16 line 3197
[  590.577734] binder: BINDER_SET_CONTEXT_MGR already set
[  590.577742] binder: 30379:30381 ioctl 40046207 0 returned -16
[  590.578565] binder: 30379:30381 got transaction with invalid offset (0, min 24 max 40) or object.
[  590.578637] binder: 30379:30381 transaction failed 29201/-22, size 40-16 line 3197
[  590.586153] binder: undelivered TRANSACTION_ERROR: 29189
[  590.597643] binder: BINDER_SET_CONTEXT_MGR already set
[  590.597659] binder: 30374:30382 ioctl 40046207 0 returned -16
[  590.599569] binder: 30374:30382 got transaction with invalid offset (0, min 24 max 40) or object.
[  590.599655] binder: 30374:30382 transaction failed 29201/-22, size 40-16 line 3197
[  590.607234] binder: BINDER_SET_CONTEXT_MGR already set
[  590.607242] binder: 30375:30386 ioctl 40046207 0 returned -16
[  590.620437] binder: BINDER_SET_CONTEXT_MGR already set
[  590.620445] binder: 30388:30394 ioctl 40046207 0 returned -16
[  590.621287] binder: BINDER_SET_CONTEXT_MGR already set
[  590.621294] binder: 30385:30392 ioctl 40046207 0 returned -16
[  590.622192] binder: undelivered TRANSACTION_ERROR: 29201
[  590.622253] binder: send failed reply for transaction 42304 to 30375:30386
[  590.622336] binder: 30388:30394 transaction failed 29189/-22, size 40-16 line 3011
[  590.625484] binder: undelivered TRANSACTION_ERROR: 29201
[  590.642029] binder: 30385:30392 got transaction with invalid offset (0, min 24 max 40) or object.
[  590.642131] binder: 30385:30392 transaction failed 29201/-22, size 40-16 line 3197
[  590.643235] binder: 30380:30393 got transaction with invalid offset (0, min 24 max 40) or object.
[  590.643310] binder: 30380:30393 transaction failed 29201/-22, size 40-16 line 3197
[  590.643929] binder: BINDER_SET_CONTEXT_MGR already set
[  590.643935] binder: 30387:30395 ioctl 40046207 0 returned -16
[  590.650831] binder: 30387:30395 got transaction with invalid offset (0, min 24 max 40) or object.
[  590.651949] binder: 30387:30395 transaction failed 29201/-22, size 40-16 line 3197
[  590.660702] binder: undelivered TRANSACTION_ERROR: 29201
[  590.666384] binder: BINDER_SET_CONTEXT_MGR already set
[  590.666392] binder: 30398:30402 ioctl 40046207 0 returned -16
[  590.667456] binder: 30398:30402 got transaction with invalid offset (0, min 24 max 40) or object.
[  590.667540] binder: 30398:30402 transaction failed 29201/-22, size 40-16 line 3197
[  590.668848] binder: undelivered TRANSACTION_ERROR: 29189
[  590.689265] binder: undelivered TRANSACTION_COMPLETE
[  590.689280] binder: undelivered TRANSACTION_ERROR: 29189
[  590.689452] binder: BINDER_SET_CONTEXT_MGR already set
[  590.689460] binder: 30401:30407 ioctl 40046207 0 returned -16
[  590.698977] binder_alloc: 30380: binder_alloc_buf, no vma
[  590.699019] binder: 30401:30407 transaction failed 29189/-3, size 40-16 line 3134
[  590.700982] binder: undelivered TRANSACTION_ERROR: 29201
[  590.701786] binder: undelivered TRANSACTION_ERROR: 29201
[  590.716815] binder: undelivered TRANSACTION_ERROR: 29189
[  590.725975] binder: undelivered TRANSACTION_ERROR: 29201
[  590.726180] binder: undelivered TRANSACTION_ERROR: 29201
[  590.764539] binder: 30411:30418 got transaction with invalid offset (0, min 24 max 40) or object.
[  590.764624] binder: 30411:30418 transaction failed 29201/-22, size 40-16 line 3197
[  590.766164] binder: BINDER_SET_CONTEXT_MGR already set
[  590.766172] binder: 30412:30419 ioctl 40046207 0 returned -16
[  590.767161] binder: BINDER_SET_CONTEXT_MGR already set
[  590.767168] binder: 30413:30422 ioctl 40046207 0 returned -16
[  590.768563] binder: 30413:30422 got transaction with invalid offset (0, min 24 max 40) or object.
[  590.768761] binder: BINDER_SET_CONTEXT_MGR already set
[  590.768768] binder: 30414:30421 ioctl 40046207 0 returned -16
[  590.770232] binder: 30413:30422 transaction failed 29201/-22, size 40-16 line 3197
[  590.770428] binder: 30414:30421 got transaction with invalid offset (0, min 24 max 40) or object.
[  590.770499] binder: 30414:30421 transaction failed 29201/-22, size 40-16 line 3197
[  590.783873] binder: BINDER_SET_CONTEXT_MGR already set
[  590.783881] binder: 30416:30424 ioctl 40046207 0 returned -16
[  590.785059] binder: 30416:30424 got transaction with invalid offset (0, min 24 max 40) or object.
[  590.785128] binder: 30416:30424 transaction failed 29201/-22, size 40-16 line 3197
[  590.785289] binder: BINDER_SET_CONTEXT_MGR already set
[  590.785295] binder: 30417:30425 ioctl 40046207 0 returned -16
[  590.787971] binder: BINDER_SET_CONTEXT_MGR already set
[  590.787979] binder: 30415:30423 ioctl 40046207 0 returned -16
[  590.788741] binder: 30417:30425 got transaction with invalid offset (0, min 24 max 40) or object.
[  590.788813] binder: 30417:30425 transaction failed 29201/-22, size 40-16 line 3197
[  590.789970] binder: 30415:30423 got transaction with invalid offset (0, min 24 max 40) or object.
[  590.790040] binder: 30415:30423 transaction failed 29201/-22, size 40-16 line 3197
[  590.802225] binder: BINDER_SET_CONTEXT_MGR already set
[  590.802233] binder: 30420:30429 ioctl 40046207 0 returned -16
[  590.804495] binder: undelivered TRANSACTION_ERROR: 29201
[  590.809337] binder: undelivered TRANSACTION_ERROR: 29201
[  590.809401] binder: send failed reply for transaction 42329 to 30412:30419
[  590.826897] binder: 30420:30429 transaction failed 29189/-22, size 40-16 line 3011
[  590.826899] binder: undelivered TRANSACTION_COMPLETE
[  590.826921] binder: undelivered TRANSACTION_ERROR: 29189
[  590.828605] binder: undelivered TRANSACTION_ERROR: 29201
[  590.851025] binder: 30437:30441 got transaction with invalid offset (0, min 24 max 40) or object.
[  590.851117] binder: 30437:30441 transaction failed 29201/-22, size 40-16 line 3197
[  590.853463] binder: undelivered TRANSACTION_ERROR: 29201
[  590.867987] binder: BINDER_SET_CONTEXT_MGR already set
[  590.867994] binder: 30439:30445 ioctl 40046207 0 returned -16
[  590.870890] binder: undelivered TRANSACTION_ERROR: 29201
[  590.876920] binder: undelivered TRANSACTION_ERROR: 29201
[  590.891627] binder: BINDER_SET_CONTEXT_MGR already set
[  590.891636] binder: 30440:30442 ioctl 40046207 0 returned -16
[  590.891688] binder: BINDER_SET_CONTEXT_MGR already set
[  590.891694] binder: 30446:30450 ioctl 40046207 0 returned -16
[  590.895170] binder: BINDER_SET_CONTEXT_MGR already set
[  590.895178] binder: 30438:30444 ioctl 40046207 0 returned -16
[  590.895516] binder: 30446:30450 got transaction with invalid offset (0, min 24 max 40) or object.
[  590.895595] binder: 30446:30450 transaction failed 29201/-22, size 40-16 line 3197
[  590.896217] binder: 30438:30444 got transaction with invalid offset (0, min 24 max 40) or object.
[  590.896304] binder: 30438:30444 transaction failed 29201/-22, size 40-16 line 3197
[  590.897413] binder: 30440:30442 got transaction with invalid offset (0, min 24 max 40) or object.
[  590.897501] binder: 30440:30442 transaction failed 29201/-22, size 40-16 line 3197
[  590.913956] binder: undelivered TRANSACTION_ERROR: 29189
[  590.920947] binder: undelivered TRANSACTION_ERROR: 29201
[  590.921000] binder: send failed reply for transaction 42349 to 30439:30445
[  590.925433] binder: 30449:30452 got transaction with invalid offset (0, min 24 max 40) or object.
[  590.925528] binder: 30449:30452 transaction failed 29201/-22, size 40-16 line 3197
[  590.925988] binder: undelivered TRANSACTION_ERROR: 29201
[  590.927186] binder: BINDER_SET_CONTEXT_MGR already set
[  590.927192] binder: 30453:30456 ioctl 40046207 0 returned -16
[  590.930593] binder: undelivered TRANSACTION_ERROR: 29201
[  590.936075] binder: 30453:30456 got transaction with invalid offset (0, min 24 max 40) or object.
[  590.936165] binder: 30453:30456 transaction failed 29201/-22, size 40-16 line 3197
[  590.949817] binder: undelivered TRANSACTION_COMPLETE
[  590.949833] binder: undelivered TRANSACTION_ERROR: 29189
[  590.963241] binder: BINDER_SET_CONTEXT_MGR already set
[  590.963249] binder: 30459:30463 ioctl 40046207 0 returned -16
[  590.964991] binder: 30459:30463 got transaction with invalid offset (0, min 24 max 40) or object.
[  590.965079] binder: 30459:30463 transaction failed 29201/-22, size 40-16 line 3197
[  590.966777] binder: undelivered TRANSACTION_ERROR: 29201
[  591.098640] binder: undelivered TRANSACTION_ERROR: 29201
[  591.114356] binder: BINDER_SET_CONTEXT_MGR already set
[  591.114364] binder: 30462:30464 ioctl 40046207 0 returned -16
[  591.115290] binder: 30462:30464 got transaction with invalid offset (0, min 24 max 40) or object.
[  591.115380] binder: 30462:30464 transaction failed 29201/-22, size 40-16 line 3197
[  591.123578] binder: BINDER_SET_CONTEXT_MGR already set
[  591.123586] binder: 30465:30469 ioctl 40046207 0 returned -16
[  591.126194] binder: 30465:30469 got transaction with invalid offset (0, min 24 max 40) or object.
[  591.126283] binder: 30465:30469 transaction failed 29201/-22, size 40-16 line 3197
[  591.130838] binder: undelivered TRANSACTION_ERROR: 29201
[  591.151436] binder: undelivered TRANSACTION_ERROR: 29201
[  591.169957] binder: undelivered TRANSACTION_ERROR: 29201
[  591.173032] binder: undelivered TRANSACTION_ERROR: 29201
[  591.245982] binder: BINDER_SET_CONTEXT_MGR already set
[  591.245990] binder: 30473:30475 ioctl 40046207 0 returned -16
[  591.247193] binder: 30473:30475 got transaction with invalid offset (0, min 24 max 40) or object.
[  591.247282] binder: 30473:30475 transaction failed 29201/-22, size 40-16 line 3197
[  591.259023] binder: release 30472:30474 transaction 42378 out, still active
[  591.259028] binder: unexpected work type, 4, not freed
[  591.259031] binder: undelivered TRANSACTION_COMPLETE
[  591.259097] binder: send failed reply for transaction 42378, target dead
[  591.276887] binder: undelivered TRANSACTION_ERROR: 29201
[  591.327595] binder: BINDER_SET_CONTEXT_MGR already set
[  591.327602] binder: 30480:30487 ioctl 40046207 0 returned -16
[  591.328726] binder: BINDER_SET_CONTEXT_MGR already set
[  591.328732] binder: 30477:30486 ioctl 40046207 0 returned -16
[  591.328815] binder: BINDER_SET_CONTEXT_MGR already set
[  591.328822] binder: 30485:30490 ioctl 40046207 0 returned -16
[  591.330844] binder: BINDER_SET_CONTEXT_MGR already set
[  591.330851] binder: 30482:30489 ioctl 40046207 0 returned -16
[  591.331082] binder: 30480:30487 got transaction with invalid offset (0, min 24 max 40) or object.
[  591.331172] binder: 30480:30487 transaction failed 29201/-22, size 40-16 line 3197
[  591.331388] binder: 30477:30486 got transaction with invalid offset (0, min 24 max 40) or object.
[  591.331462] binder: 30477:30486 transaction failed 29201/-22, size 40-16 line 3197
[  591.331689] binder: 30485:30490 got transaction with invalid offset (0, min 24 max 40) or object.
[  591.331917] binder: 30482:30489 got transaction with invalid offset (0, min 24 max 40) or object.
[  591.332004] binder: 30482:30489 transaction failed 29201/-22, size 40-16 line 3197
[  591.332334] binder: 30485:30490 transaction failed 29201/-22, size 40-16 line 3197
[  591.332571] binder: BINDER_SET_CONTEXT_MGR already set
[  591.332577] binder: 30484:30491 ioctl 40046207 0 returned -16
[  591.340529] binder_alloc: 30478: binder_alloc_buf, no vma
[  591.340569] binder: 30484:30491 transaction failed 29189/-3, size 40-16 line 3134
[  591.362002] binder: BINDER_SET_CONTEXT_MGR already set
[  591.362013] binder: 30488:30494 ioctl 40046207 0 returned -16
[  591.366479] binder: undelivered TRANSACTION_ERROR: 29201
[  591.374678] binder: 30483:30492 got transaction with invalid offset (0, min 24 max 40) or object.
[  591.374768] binder: 30483:30492 transaction failed 29201/-22, size 40-16 line 3197
[  591.379236] binder: 30488:30494 got transaction with invalid offset (0, min 24 max 40) or object.
[  591.379349] binder: 30488:30494 transaction failed 29201/-22, size 40-16 line 3197
[  591.391493] binder: undelivered TRANSACTION_ERROR: 29201
[  591.397814] binder: BINDER_SET_CONTEXT_MGR already set
[  591.397822] binder: 30505:30506 ioctl 40046207 0 returned -16
[  591.398763] binder: 30505:30506 got transaction with invalid offset (0, min 24 max 40) or object.
[  591.398810] binder: BINDER_SET_CONTEXT_MGR already set
[  591.398853] binder: 30505:30506 transaction failed 29201/-22, size 40-16 line 3197
[  591.399900] binder: 30499:30504 ioctl 40046207 0 returned -16
[  591.402022] binder: undelivered TRANSACTION_ERROR: 29201
[  591.412029] binder: undelivered TRANSACTION_ERROR: 29201
[  591.424154] binder: undelivered TRANSACTION_ERROR: 29189
[  591.425644] binder: undelivered TRANSACTION_ERROR: 29201
[  591.437844] binder: undelivered TRANSACTION_ERROR: 29201
[  591.455782] binder: undelivered TRANSACTION_ERROR: 29201
[  591.498494] binder: BINDER_SET_CONTEXT_MGR already set
[  591.498503] binder: 30517:30520 ioctl 40046207 0 returned -16
[  591.499294] binder: BINDER_SET_CONTEXT_MGR already set
[  591.499302] binder: 30514:30524 ioctl 40046207 0 returned -16
[  591.501094] binder: 30514:30524 got transaction with invalid offset (0, min 24 max 40) or object.
[  591.501183] binder: 30514:30524 transaction failed 29201/-22, size 40-16 line 3197
[  591.501706] binder: 30517:30520 got transaction with invalid offset (0, min 24 max 40) or object.
[  591.501790] binder: 30517:30520 transaction failed 29201/-22, size 40-16 line 3197
[  591.509538] binder: BINDER_SET_CONTEXT_MGR already set
[  591.509547] binder: 30512:30521 ioctl 40046207 0 returned -16
[  591.510586] binder: 30512:30521 got transaction with invalid offset (0, min 24 max 40) or object.
[  591.510673] binder: 30512:30521 transaction failed 29201/-22, size 40-16 line 3197
[  591.511614] binder: BINDER_SET_CONTEXT_MGR already set
[  591.511622] binder: 30519:30522 ioctl 40046207 0 returned -16
[  591.512991] binder: BINDER_SET_CONTEXT_MGR already set
[  591.512998] binder: 30518:30526 ioctl 40046207 0 returned -16
[  591.513939] binder: 30518:30526 got transaction with invalid offset (0, min 24 max 40) or object.
[  591.514040] binder: 30518:30526 transaction failed 29201/-22, size 40-16 line 3197
[  591.515861] binder: 30519:30522 got transaction with invalid offset (0, min 24 max 40) or object.
[  591.516244] binder: 30519:30522 transaction failed 29201/-22, size 40-16 line 3197
[  591.518944] binder: BINDER_SET_CONTEXT_MGR already set
[  591.518952] binder: 30516:30523 ioctl 40046207 0 returned -16
[  591.521302] binder: 30516:30523 got transaction with invalid offset (0, min 24 max 40) or object.
[  591.521390] binder: 30516:30523 transaction failed 29201/-22, size 40-16 line 3197
[  591.530072] binder: BINDER_SET_CONTEXT_MGR already set
[  591.530080] binder: 30525:30529 ioctl 40046207 0 returned -16
[  591.543037] binder: 30525:30529 got transaction with invalid offset (0, min 24 max 40) or object.
[  591.543505] binder: undelivered TRANSACTION_ERROR: 29201
[  591.551360] binder: 30525:30529 transaction failed 29201/-22, size 40-16 line 3197
[  591.564958] binder: undelivered TRANSACTION_ERROR: 29201
[  591.588387] binder: undelivered TRANSACTION_ERROR: 29201
[  591.590629] binder: undelivered TRANSACTION_ERROR: 29201
[  591.591681] binder: undelivered TRANSACTION_ERROR: 29201
[  591.602164] binder: BINDER_SET_CONTEXT_MGR already set
[  591.602172] binder: 30542:30545 ioctl 40046207 0 returned -16
[  591.603696] binder: BINDER_SET_CONTEXT_MGR already set
[  591.603703] binder: 30538:30540 ioctl 40046207 0 returned -16
[  591.608220] binder: 30542:30545 got transaction with invalid offset (0, min 24 max 40) or object.
[  591.608309] binder: 30542:30545 transaction failed 29201/-22, size 40-16 line 3197
[  591.609726] binder: 30538:30540 got transaction with invalid offset (0, min 24 max 40) or object.
[  591.609813] binder: 30538:30540 transaction failed 29201/-22, size 40-16 line 3197
[  591.614695] binder: undelivered TRANSACTION_ERROR: 29201
[  591.640767] binder: undelivered TRANSACTION_ERROR: 29201
[  591.645840] binder: 30549:30554 got transaction with invalid offset (0, min 24 max 40) or object.
[  591.646373] binder: 30549:30554 transaction failed 29201/-22, size 40-16 line 3197
[  591.652923] binder: BINDER_SET_CONTEXT_MGR already set
[  591.652932] binder: 30556:30558 ioctl 40046207 0 returned -16
[  591.654203] binder: undelivered TRANSACTION_ERROR: 29201
[  591.655227] binder: 30556:30558 got transaction with invalid offset (0, min 24 max 40) or object.
[  591.655320] binder: 30556:30558 transaction failed 29201/-22, size 40-16 line 3197
[  591.658122] binder: BINDER_SET_CONTEXT_MGR already set
[  591.658132] binder: 30550:30555 ioctl 40046207 0 returned -16
[  591.659299] binder: 30550:30555 got transaction with invalid offset (0, min 24 max 40) or object.
[  591.659387] binder: 30550:30555 transaction failed 29201/-22, size 40-16 line 3197
[  591.669330] binder: undelivered TRANSACTION_ERROR: 29201
[  591.673798] binder: undelivered TRANSACTION_ERROR: 29201
[  591.681294] binder: 30560:30562 got transaction with invalid offset (0, min 24 max 40) or object.
[  591.681548] binder: 30560:30562 transaction failed 29201/-22, size 40-16 line 3197
[  591.690202] binder: BINDER_SET_CONTEXT_MGR already set
[  591.690210] binder: 30557:30565 ioctl 40046207 0 returned -16
[  591.692775] binder: BINDER_SET_CONTEXT_MGR already set
[  591.692782] binder: 30552:30563 ioctl 40046207 0 returned -16
[  591.693795] binder: 30552:30563 got transaction with invalid offset (0, min 24 max 40) or object.
[  591.697384] binder: 30552:30563 transaction failed 29201/-22, size 40-16 line 3197
[  591.697518] binder: undelivered TRANSACTION_ERROR: 29201
[  591.709490] binder: undelivered TRANSACTION_ERROR: 29201
[  591.718305] binder: undelivered TRANSACTION_ERROR: 29201
[  591.724757] binder: undelivered TRANSACTION_ERROR: 29201
[  591.768101] binder: BINDER_SET_CONTEXT_MGR already set
[  591.768109] binder: 30572:30576 ioctl 40046207 0 returned -16
[  591.768873] binder: 30574:30578 got transaction with invalid offset (0, min 24 max 40) or object.
[  591.768956] binder: 30574:30578 transaction failed 29201/-22, size 40-16 line 3197
[  591.769122] binder: BINDER_SET_CONTEXT_MGR already set
[  591.769128] binder: 30570:30581 ioctl 40046207 0 returned -16
[  591.769141] binder: 30572:30576 got transaction with invalid offset (0, min 24 max 40) or object.
[  591.769228] binder: 30572:30576 transaction failed 29201/-22, size 40-16 line 3197
[  591.769990] binder: BINDER_SET_CONTEXT_MGR already set
[  591.769998] binder: 30569:30579 ioctl 40046207 0 returned -16
[  591.774932] binder: BINDER_SET_CONTEXT_MGR already set
[  591.774940] binder: 30575:30583 ioctl 40046207 0 returned -16
[  591.775542] binder: 30570:30581 got transaction with invalid offset (0, min 24 max 40) or object.
[  591.777026] binder: 30569:30579 got transaction with invalid offset (0, min 24 max 40) or object.
[  591.777218] binder: 30570:30581 transaction failed 29201/-22, size 40-16 line 3197
[  591.778140] binder: BINDER_SET_CONTEXT_MGR already set
[  591.778147] binder: 30573:30582 ioctl 40046207 0 returned -16
[  591.779016] binder: 30569:30579 transaction failed 29201/-22, size 40-16 line 3197
[  591.779294] binder: 30573:30582 got transaction with invalid offset (0, min 24 max 40) or object.
[  591.779384] binder: 30573:30582 transaction failed 29201/-22, size 40-16 line 3197
[  591.794801] binder: undelivered TRANSACTION_ERROR: 29201
[  591.804308] binder: BINDER_SET_CONTEXT_MGR already set
[  591.804317] binder: 30577:30590 ioctl 40046207 0 returned -16
[  591.805423] binder: 30577:30590 got transaction with invalid offset (0, min 24 max 40) or object.
[  591.805515] binder: 30577:30590 transaction failed 29201/-22, size 40-16 line 3197
[  591.811903] binder: 30571:30584 got transaction with invalid offset (0, min 24 max 40) or object.
[  591.811991] binder: 30571:30584 transaction failed 29201/-22, size 40-16 line 3197
[  591.836357] binder: undelivered TRANSACTION_ERROR: 29201
[  591.844811] binder: undelivered TRANSACTION_ERROR: 29201
[  591.844963] binder: BINDER_SET_CONTEXT_MGR already set
[  591.844970] binder: 30597:30601 ioctl 40046207 0 returned -16
[  591.845127] binder: undelivered TRANSACTION_ERROR: 29201
[  591.847155] binder: undelivered TRANSACTION_ERROR: 29201
[  591.868318] binder: 30597:30601 got transaction with invalid offset (0, min 24 max 40) or object.
[  591.868486] binder: 30597:30601 transaction failed 29201/-22, size 40-16 line 3197
[  591.887814] binder: BINDER_SET_CONTEXT_MGR already set
[  591.887821] binder: 30606:30611 ioctl 40046207 0 returned -16
[  591.888350] binder: undelivered TRANSACTION_ERROR: 29201
[  591.891841] binder: BINDER_SET_CONTEXT_MGR already set
[  591.891850] binder: 30603:30610 ioctl 40046207 0 returned -16
[  591.893670] binder: 30606:30611 got transaction with invalid offset (0, min 24 max 40) or object.
[  591.893757] binder: 30606:30611 transaction failed 29201/-22, size 40-16 line 3197
[  591.894889] binder_alloc: 30571: binder_alloc_buf, no vma
[  591.894926] binder: 30603:30610 transaction failed 29189/-3, size 0-16 line 3134
[  591.898937] binder: BINDER_SET_CONTEXT_MGR already set
[  591.898945] binder: 30607:30612 ioctl 40046207 0 returned -16
[  591.901990] binder_alloc: 30571: binder_alloc_buf, no vma
[  591.902027] binder: 30607:30612 transaction failed 29189/-3, size 40-16 line 3134
[  591.902742] binder: BINDER_SET_CONTEXT_MGR already set
[  591.902750] binder: 30605:30614 ioctl 40046207 0 returned -16
[  591.903925] binder: BINDER_SET_CONTEXT_MGR already set
[  591.903931] binder: 30609:30613 ioctl 40046207 0 returned -16
[  591.904863] binder: undelivered TRANSACTION_ERROR: 29201
[  591.904946] binder: 30605:30614 transaction failed 29189/-22, size 40-16 line 3011
[  591.905064] binder: 30609:30613 transaction failed 29189/-22, size 40-16 line 3011
[  591.905451] binder: undelivered TRANSACTION_ERROR: 29201
[  591.921582] binder: undelivered TRANSACTION_ERROR: 29201
[  591.944641] binder: 30618:30623 got transaction with invalid offset (0, min 24 max 40) or object.
[  591.944728] binder: 30618:30623 transaction failed 29201/-22, size 40-16 line 3197
[  591.956060] binder: undelivered TRANSACTION_ERROR: 29189
[  591.960632] binder: undelivered TRANSACTION_ERROR: 29189
[  591.960829] binder: BINDER_SET_CONTEXT_MGR already set
[  591.960838] binder: 30625:30630 ioctl 40046207 0 returned -16
[  591.967068] binder_alloc: 30618: binder_alloc_buf, no vma
[  591.967116] binder: 30625:30630 transaction failed 29189/-3, size 40-16 line 3134
[  591.968131] binder: undelivered TRANSACTION_ERROR: 29201
[  591.968273] binder: undelivered TRANSACTION_ERROR: 29189
[  591.984115] binder: undelivered TRANSACTION_ERROR: 29189
[  591.987039] binder: 30620:30627 got transaction with invalid offset (0, min 24 max 40) or object.
[  591.987130] binder: 30620:30627 transaction failed 29201/-22, size 40-16 line 3197
[  591.988152] binder: undelivered TRANSACTION_ERROR: 29189
[  591.990251] binder: BINDER_SET_CONTEXT_MGR already set
[  591.990258] binder: 30621:30629 ioctl 40046207 0 returned -16
[  591.991774] binder: 30621:30629 got transaction with invalid offset (0, min 24 max 40) or object.
[  591.991880] binder: 30621:30629 transaction failed 29201/-22, size 40-16 line 3197
[  592.002828] binder: undelivered TRANSACTION_ERROR: 29201
[  592.027338] binder: undelivered TRANSACTION_ERROR: 29201
[  592.059888] binder: BINDER_SET_CONTEXT_MGR already set
[  592.059896] binder: 30635:30640 ioctl 40046207 0 returned -16
[  592.060508] binder: BINDER_SET_CONTEXT_MGR already set
[  592.060515] binder: 30634:30644 ioctl 40046207 0 returned -16
[  592.060970] binder: 30635:30640 got transaction with invalid offset (0, min 24 max 40) or object.
[  592.061063] binder: 30635:30640 transaction failed 29201/-22, size 40-16 line 3197
[  592.063346] binder: 30634:30644 got transaction with invalid offset (0, min 0 max 0) or object.
[  592.063431] binder: 30634:30644 transaction failed 29201/-22, size 0-16 line 3197
[  592.064616] binder: 30633:30641 got transaction with invalid offset (0, min 24 max 40) or object.
[  592.064698] binder: 30633:30641 transaction failed 29201/-22, size 40-16 line 3197
[  592.067058] binder: BINDER_SET_CONTEXT_MGR already set
[  592.067065] binder: 30637:30643 ioctl 40046207 0 returned -16
[  592.070798] binder: 30637:30643 got transaction with invalid offset (0, min 24 max 40) or object.
[  592.070893] binder: 30637:30643 transaction failed 29201/-22, size 40-16 line 3197
[  592.075791] binder: BINDER_SET_CONTEXT_MGR already set
[  592.075800] binder: 30638:30645 ioctl 40046207 0 returned -16
[  592.078528] binder: 30638:30645 got transaction with invalid offset (0, min 24 max 40) or object.
[  592.078621] binder: 30638:30645 transaction failed 29201/-22, size 40-16 line 3197
[  592.078906] binder: BINDER_SET_CONTEXT_MGR already set
[  592.078912] binder: 30639:30647 ioctl 40046207 0 returned -16
[  592.083049] binder: 30639:30647 got transaction with invalid offset (0, min 24 max 40) or object.
[  592.083925] binder: 30639:30647 transaction failed 29201/-22, size 40-16 line 3197
[  592.087677] binder: undelivered TRANSACTION_ERROR: 29201
[  592.095454] binder: BINDER_SET_CONTEXT_MGR already set
[  592.095463] binder: 30636:30646 ioctl 40046207 0 returned -16
[  592.096981] binder: BINDER_SET_CONTEXT_MGR already set
[  592.096989] binder: 30642:30649 ioctl 40046207 0 returned -16
[  592.097243] binder: 30636:30646 got transaction with invalid offset (0, min 24 max 40) or object.
[  592.097334] binder: 30636:30646 transaction failed 29201/-22, size 40-16 line 3197
[  592.099798] binder: 30642:30649 got transaction with invalid offset (0, min 24 max 40) or object.
[  592.099888] binder: 30642:30649 transaction failed 29201/-22, size 40-16 line 3197
[  592.116812] binder: BINDER_SET_CONTEXT_MGR already set
[  592.116821] binder: 30655:30658 ioctl 40046207 0 returned -16
[  592.117776] binder: 30655:30658 got transaction with invalid offset (0, min 24 max 40) or object.
[  592.118335] binder: 30655:30658 transaction failed 29201/-22, size 40-16 line 3197
[  592.124153] binder: undelivered TRANSACTION_ERROR: 29201
[  592.126916] binder: undelivered TRANSACTION_ERROR: 29201
[  592.136507] binder: undelivered TRANSACTION_ERROR: 29201
[  592.138480] binder: undelivered TRANSACTION_ERROR: 29201
[  592.153971] binder: undelivered TRANSACTION_ERROR: 29201
[  592.160333] binder: undelivered TRANSACTION_ERROR: 29201
[  592.174995] binder: undelivered TRANSACTION_ERROR: 29201
[  592.177719] binder: BINDER_SET_CONTEXT_MGR already set
[  592.177727] binder: 30664:30670 ioctl 40046207 0 returned -16
[  592.180485] binder: undelivered TRANSACTION_ERROR: 29201
[  592.185754] binder: BINDER_SET_CONTEXT_MGR already set
[  592.185763] binder: 30660:30668 ioctl 40046207 0 returned -16
[  592.185875] binder: BINDER_SET_CONTEXT_MGR already set
[  592.185881] binder: 30662:30667 ioctl 40046207 0 returned -16
[  592.189151] binder: 30664:30670 got transaction with invalid offset (0, min 24 max 40) or object.
[  592.189178] binder: 30661:30666 got transaction with invalid offset (0, min 24 max 40) or object.
[  592.189228] binder: 30664:30670 transaction failed 29201/-22, size 40-16 line 3197
[  592.189281] binder: 30661:30666 transaction failed 29201/-22, size 40-16 line 3197
[  592.189649] binder: 30662:30667 got transaction with invalid offset (0, min 24 max 40) or object.
[  592.189737] binder: 30662:30667 transaction failed 29201/-22, size 40-16 line 3197
[  592.191037] binder: 30660:30668 got transaction with invalid offset (0, min 0 max 0) or object.
[  592.191094] binder: 30660:30668 transaction failed 29201/-22, size 0-16 line 3197
[  592.195025] binder: BINDER_SET_CONTEXT_MGR already set
[  592.195035] binder: 30669:30671 ioctl 40046207 0 returned -16
[  592.196572] binder: 30669:30671 got transaction with invalid offset (0, min 24 max 40) or object.
[  592.196668] binder: 30669:30671 transaction failed 29201/-22, size 40-16 line 3197
[  592.208998] binder: undelivered TRANSACTION_ERROR: 29201
[  592.223224] binder: undelivered TRANSACTION_ERROR: 29201
[  592.238557] binder: undelivered TRANSACTION_ERROR: 29201
[  592.252074] binder: undelivered TRANSACTION_ERROR: 29201
[  592.256689] binder: undelivered TRANSACTION_ERROR: 29201
[  592.287286] binder: 30679:30684 got transaction with invalid offset (0, min 24 max 40) or object.
[  592.287367] binder: 30679:30684 transaction failed 29201/-22, size 40-16 line 3197
[  592.288297] binder: BINDER_SET_CONTEXT_MGR already set
[  592.288305] binder: 30682:30686 ioctl 40046207 0 returned -16
[  592.292210] binder: 30682:30686 got transaction with invalid offset (0, min 24 max 40) or object.
[  592.292294] binder: 30682:30686 transaction failed 29201/-22, size 40-16 line 3197
[  592.298836] binder: BINDER_SET_CONTEXT_MGR already set
[  592.298844] binder: 30685:30689 ioctl 40046207 0 returned -16
[  592.299580] binder: BINDER_SET_CONTEXT_MGR already set
[  592.299592] binder: 30683:30690 ioctl 40046207 0 returned -16
[  592.302440] binder_alloc: 30679: binder_alloc_buf, no vma
[  592.303528] binder: 30683:30690 transaction failed 29189/-3, size 40-16 line 3134
[  592.304454] binder: BINDER_SET_CONTEXT_MGR already set
[  592.304460] binder: 30688:30693 ioctl 40046207 0 returned -16
[  592.306085] binder_alloc: 30679: binder_alloc_buf, no vma
[  592.306169] binder: 30688:30693 transaction failed 29189/-3, size 40-16 line 3134
[  592.310023] binder_alloc: 30679: binder_alloc_buf, no vma
[  592.310060] binder: 30685:30689 transaction failed 29189/-3, size 40-8 line 3134
[  592.313155] binder: BINDER_SET_CONTEXT_MGR already set
[  592.313162] binder: 30680:30695 ioctl 40046207 0 returned -16
[  592.314358] binder_alloc: 30679: binder_alloc_buf, no vma
[  592.314438] binder: 30680:30695 transaction failed 29189/-3, size 40-16 line 3134
[  592.315496] binder: BINDER_SET_CONTEXT_MGR already set
[  592.315503] binder: 30681:30694 ioctl 40046207 0 returned -16
[  592.316061] binder: undelivered TRANSACTION_ERROR: 29201
[  592.317205] binder: 30687:30691 transaction failed 29189/-22, size 40-16 line 3011
[  592.337969] binder: 30681:30694 transaction failed 29189/-22, size 40-16 line 3011
[  592.340223] binder: undelivered TRANSACTION_ERROR: 29201
[  592.358608] binder: undelivered TRANSACTION_ERROR: 29189
[  592.368833] binder: undelivered TRANSACTION_ERROR: 29189
[  592.376268] binder: 30701:30703 got transaction with invalid offset (0, min 24 max 40) or object.
[  592.376570] binder: 30701:30703 transaction failed 29201/-22, size 40-16 line 3197
[  592.378713] binder: undelivered TRANSACTION_ERROR: 29189
[  592.384263] binder: undelivered TRANSACTION_ERROR: 29189
[  592.407563] binder: BINDER_SET_CONTEXT_MGR already set
[  592.407572] binder: 30707:30710 ioctl 40046207 0 returned -16
[  592.407607] binder: BINDER_SET_CONTEXT_MGR already set
[  592.407614] binder: 30713:30715 ioctl 40046207 0 returned -16
[  592.409591] binder_alloc: 30701: binder_alloc_buf, no vma
[  592.409627] binder: 30707:30710 transaction failed 29189/-3, size 40-16 line 3134
[  592.409918] binder_alloc: 30701: binder_alloc_buf, no vma
[  592.409955] binder: 30713:30715 transaction failed 29189/-3, size 40-16 line 3134
[  592.411464] binder: undelivered TRANSACTION_ERROR: 29201
[  592.415979] binder: 30716:30719 got transaction with invalid offset (0, min 24 max 40) or object.
[  592.416100] binder: 30716:30719 transaction failed 29201/-22, size 40-16 line 3197
[  592.421880] binder: undelivered TRANSACTION_ERROR: 29189
[  592.434823] binder: BINDER_SET_CONTEXT_MGR already set
[  592.434832] binder: 30714:30718 ioctl 40046207 0 returned -16
[  592.440855] binder: undelivered TRANSACTION_ERROR: 29189
[  592.450862] binder: 30711:30724 got transaction with invalid offset (0, min 24 max 40) or object.
[  592.457436] binder: 30711:30724 transaction failed 29201/-22, size 40-16 line 3197
[  592.458705] binder: undelivered TRANSACTION_ERROR: 29189
[  592.459369] binder: BINDER_SET_CONTEXT_MGR already set
[  592.459376] binder: 30723:30726 ioctl 40046207 0 returned -16
[  592.464429] binder: 30723:30726 got transaction with invalid offset (0, min 24 max 40) or object.
[  592.464517] binder: 30723:30726 transaction failed 29201/-22, size 40-16 line 3197
[  592.476940] binder: undelivered TRANSACTION_ERROR: 29201
[  592.476994] binder: send failed reply for transaction 42562 to 30714:30718
[  592.477348] binder: undelivered TRANSACTION_ERROR: 29189
[  592.481751] binder: undelivered TRANSACTION_ERROR: 29201
[  592.498202] binder: undelivered TRANSACTION_COMPLETE
[  592.498220] binder: undelivered TRANSACTION_ERROR: 29189
[  592.498658] binder: 30729:30732 got transaction with invalid offset (0, min 24 max 40) or object.
[  592.498746] binder: 30729:30732 transaction failed 29201/-22, size 40-16 line 3197
[  592.508627] binder: BINDER_SET_CONTEXT_MGR already set
[  592.508634] binder: 30733:30735 ioctl 40046207 0 returned -16
[  592.510425] binder_alloc: 30729: binder_alloc_buf, no vma
[  592.510463] binder: 30733:30735 transaction failed 29189/-3, size 40-16 line 3134
[  592.510815] binder: undelivered TRANSACTION_ERROR: 29201
[  592.511477] binder: undelivered TRANSACTION_ERROR: 29201
[  592.530651] binder: undelivered TRANSACTION_ERROR: 29189
[  592.565946] binder: BINDER_SET_CONTEXT_MGR already set
[  592.565954] binder: 30739:30746 ioctl 40046207 0 returned -16
[  592.565956] binder: BINDER_SET_CONTEXT_MGR already set
[  592.565962] binder: 30740:30745 ioctl 40046207 0 returned -16
[  592.567141] binder: 30740:30745 got transaction with invalid offset (0, min 24 max 40) or object.
[  592.567221] binder: 30740:30745 transaction failed 29201/-22, size 40-16 line 3197
[  592.567335] binder: 30738:30744 got transaction with invalid offset (0, min 24 max 40) or object.
[  592.567403] binder: 30738:30744 transaction failed 29201/-22, size 40-16 line 3197
[  592.573681] binder: BINDER_SET_CONTEXT_MGR already set
[  592.573689] binder: 30742:30747 ioctl 40046207 0 returned -16
[  592.574865] binder: 30742:30747 got transaction with invalid offset (0, min 24 max 40) or object.
[  592.574935] binder: 30742:30747 transaction failed 29201/-22, size 40-16 line 3197
[  592.576790] binder: BINDER_SET_CONTEXT_MGR already set
[  592.576797] binder: 30737:30749 ioctl 40046207 0 returned -16
[  592.579809] binder: 30737:30749 got transaction with invalid offset (0, min 24 max 40) or object.
[  592.579879] binder: 30737:30749 transaction failed 29201/-22, size 40-16 line 3197
[  592.584344] binder: 30741:30750 got transaction with invalid offset (0, min 24 max 40) or object.
[  592.584418] binder: 30741:30750 transaction failed 29201/-22, size 40-16 line 3197
[  592.592864] binder: BINDER_SET_CONTEXT_MGR already set
[  592.592874] binder: 30743:30751 ioctl 40046207 0 returned -16
[  592.594675] binder: 30743:30751 got transaction with invalid offset (0, min 24 max 40) or object.
[  592.594747] binder: 30743:30751 transaction failed 29201/-22, size 40-16 line 3197
[  592.597915] binder: undelivered TRANSACTION_ERROR: 29201
[  592.610602] binder: BINDER_SET_CONTEXT_MGR already set
[  592.610609] binder: 30748:30755 ioctl 40046207 0 returned -16
[  592.615098] binder: 30748:30755 got transaction with invalid offset (0, min 24 max 40) or object.
[  592.615172] binder: 30748:30755 transaction failed 29201/-22, size 40-16 line 3197
[  592.615790] binder: release 30739:30746 transaction 42582 out, still active
[  592.615795] binder: unexpected work type, 4, not freed
[  592.615798] binder: undelivered TRANSACTION_COMPLETE
[  592.636284] binder: undelivered TRANSACTION_ERROR: 29201
[  592.636376] binder: send failed reply for transaction 42582, target dead
[  592.643445] binder: undelivered TRANSACTION_ERROR: 29201
[  592.655946] binder: undelivered TRANSACTION_ERROR: 29201
[  592.662659] binder: undelivered TRANSACTION_ERROR: 29201
[  592.662743] binder: undelivered TRANSACTION_ERROR: 29201
[  592.679814] binder: BINDER_SET_CONTEXT_MGR already set
[  592.679821] binder: 30762:30765 ioctl 40046207 0 returned -16
[  592.680697] binder: 30762:30765 got transaction with invalid offset (0, min 24 max 40) or object.
[  592.680943] binder: 30762:30765 transaction failed 29201/-22, size 40-16 line 3197
[  592.682864] binder: BINDER_SET_CONTEXT_MGR already set
[  592.682872] binder: 30767:30771 ioctl 40046207 0 returned -16
[  592.684610] binder: 30767:30771 got transaction with invalid offset (0, min 24 max 40) or object.
[  592.684690] binder: 30767:30771 transaction failed 29201/-22, size 40-16 line 3197
[  592.687939] binder: undelivered TRANSACTION_ERROR: 29201
[  592.692338] binder: release 30764:30766 transaction 42602 out, still active
[  592.692342] binder: unexpected work type, 4, not freed
[  592.692343] binder: undelivered TRANSACTION_COMPLETE
[  592.692396] binder: send failed reply for transaction 42602, target dead
[  592.699653] binder: 30773:30777 got transaction with invalid offset (0, min 24 max 40) or object.
[  592.699745] binder: 30773:30777 transaction failed 29201/-22, size 40-16 line 3197
[  592.711676] binder: BINDER_SET_CONTEXT_MGR already set
[  592.711685] binder: 30769:30774 ioctl 40046207 0 returned -16
[  592.716191] binder: 30769:30774 got transaction with invalid offset (0, min 24 max 40) or object.
[  592.716284] binder: 30769:30774 transaction failed 29201/-22, size 40-16 line 3197
[  592.717658] binder: undelivered TRANSACTION_ERROR: 29201
[  592.718728] binder: BINDER_SET_CONTEXT_MGR already set
[  592.718735] binder: 30772:30779 ioctl 40046207 0 returned -16
[  592.720712] binder: 30772:30779 got transaction with invalid offset (0, min 24 max 40) or object.
[  592.720803] binder: 30772:30779 transaction failed 29201/-22, size 40-16 line 3197
[  592.725694] binder: BINDER_SET_CONTEXT_MGR already set
[  592.725702] binder: 30775:30782 ioctl 40046207 0 returned -16
[  592.728713] binder: 30775:30782 got transaction with invalid offset (0, min 24 max 40) or object.
[  592.728798] binder: 30775:30782 transaction failed 29201/-22, size 40-16 line 3197
[  592.731035] binder: BINDER_SET_CONTEXT_MGR already set
[  592.731042] binder: 30778:30783 ioctl 40046207 0 returned -16
[  592.737821] binder: undelivered TRANSACTION_ERROR: 29201
[  592.743501] binder: undelivered TRANSACTION_ERROR: 29201
[  592.764023] binder: release 30778:30783 transaction 42624 out, still active
[  592.764028] binder: unexpected work type, 4, not freed
[  592.764030] binder: undelivered TRANSACTION_COMPLETE
[  592.769132] binder: undelivered TRANSACTION_ERROR: 29201
[  592.772386] binder: undelivered TRANSACTION_ERROR: 29201
[  592.772445] binder: send failed reply for transaction 42624, target dead
[  592.788324] binder: undelivered TRANSACTION_ERROR: 29201
[  592.794451] binder: 30784:30789 got transaction with invalid offset (0, min 24 max 40) or object.
[  592.794541] binder: 30784:30789 transaction failed 29201/-22, size 40-16 line 3197
[  592.802129] binder: undelivered TRANSACTION_ERROR: 29201
[  592.839814] binder: BINDER_SET_CONTEXT_MGR already set
[  592.839822] binder: 30792:30798 ioctl 40046207 0 returned -16
[  592.843514] binder: 30792:30798 got transaction with invalid offset (0, min 24 max 40) or object.
[  592.843602] binder: 30792:30798 transaction failed 29201/-22, size 40-16 line 3197
[  592.843652] binder: BINDER_SET_CONTEXT_MGR already set
[  592.843657] binder: 30793:30802 ioctl 40046207 0 returned -16
[  592.844181] binder: BINDER_SET_CONTEXT_MGR already set
[  592.844189] binder: 30794:30803 ioctl 40046207 0 returned -16
[  592.846248] binder: 30793:30802 got transaction with invalid offset (0, min 24 max 40) or object.
[  592.847287] binder: 30794:30803 got transaction with invalid offset (0, min 24 max 40) or object.
[  592.847371] binder: 30794:30803 transaction failed 29201/-22, size 40-16 line 3197
[  592.847535] binder: 30793:30802 transaction failed 29201/-22, size 40-16 line 3197
[  592.849971] binder: BINDER_SET_CONTEXT_MGR already set
[  592.849979] binder: 30797:30799 ioctl 40046207 0 returned -16
[  592.851319] binder: 30797:30799 got transaction with invalid offset (0, min 24 max 40) or object.
[  592.851404] binder: 30797:30799 transaction failed 29201/-22, size 40-16 line 3197
[  592.857607] binder: undelivered TRANSACTION_ERROR: 29201
[  592.858420] binder: BINDER_SET_CONTEXT_MGR already set
[  592.858427] binder: 30800:30806 ioctl 40046207 0 returned -16
[  592.859354] binder: 30800:30806 got transaction with invalid offset (0, min 24 max 40) or object.
[  592.860005] binder: BINDER_SET_CONTEXT_MGR already set
[  592.860012] binder: 30795:30804 ioctl 40046207 0 returned -16
[  592.865646] binder: 30795:30804 got transaction with invalid offset (0, min 24 max 40) or object.
[  592.865734] binder: 30795:30804 transaction failed 29201/-22, size 40-16 line 3197
[  592.875161] binder: 30800:30806 transaction failed 29201/-22, size 40-16 line 3197
[  592.885150] binder: BINDER_SET_CONTEXT_MGR already set
[  592.885159] binder: 30801:30809 ioctl 40046207 0 returned -16
[  592.886240] binder: 30801:30809 got transaction with invalid offset (0, min 24 max 40) or object.
[  592.886340] binder: 30801:30809 transaction failed 29201/-22, size 40-16 line 3197
[  592.896532] binder: undelivered TRANSACTION_ERROR: 29201
[  592.896727] binder: undelivered TRANSACTION_ERROR: 29201
[  592.906307] binder: undelivered TRANSACTION_ERROR: 29201
[  592.906733] binder: release 30791:30796 transaction 42632 out, still active
[  592.906737] binder: unexpected work type, 4, not freed
[  592.906739] binder: undelivered TRANSACTION_COMPLETE
[  592.906804] binder: send failed reply for transaction 42632, target dead
[  592.923098] binder: undelivered TRANSACTION_ERROR: 29201
[  592.932402] binder: undelivered TRANSACTION_ERROR: 29201
[  592.934112] binder: undelivered TRANSACTION_ERROR: 29201
[  592.942345] binder_alloc: 30812: binder_alloc_buf, no vma
[  592.942383] binder: 30812:30816 transaction failed 29189/-3, size 40-16 line 3134
[  592.947811] binder: undelivered TRANSACTION_ERROR: 29189
[  592.980726] binder: BINDER_SET_CONTEXT_MGR already set
[  592.980734] binder: 30818:30823 ioctl 40046207 0 returned -16
[  592.981961] binder: 30818:30823 got transaction with invalid offset (0, min 24 max 40) or object.
[  592.982044] binder: 30818:30823 transaction failed 29201/-22, size 40-16 line 3197
[  592.983342] binder: 30819:30827 got transaction with invalid offset (0, min 24 max 40) or object.
[  592.983432] binder: 30819:30827 transaction failed 29201/-22, size 40-16 line 3197
[  592.991138] binder: BINDER_SET_CONTEXT_MGR already set
[  592.991146] binder: 30820:30830 ioctl 40046207 0 returned -16
[  592.994697] binder: BINDER_SET_CONTEXT_MGR already set
[  592.994705] binder: 30821:30828 ioctl 40046207 0 returned -16
[  592.995583] binder: BINDER_SET_CONTEXT_MGR already set
[  592.995590] binder: 30822:30825 ioctl 40046207 0 returned -16
[  592.995645] binder: 30821:30828 got transaction with invalid offset (0, min 24 max 40) or object.
[  592.995738] binder: 30821:30828 transaction failed 29201/-22, size 40-16 line 3197
[  592.998802] binder: 30822:30825 got transaction with invalid offset (0, min 24 max 40) or object.
[  592.998897] binder: BINDER_SET_CONTEXT_MGR already set
[  592.998903] binder: 30817:30829 ioctl 40046207 0 returned -16
[  592.998940] binder: 30822:30825 transaction failed 29201/-22, size 40-16 line 3197
[  593.000422] binder: 30817:30829 got transaction with invalid offset (0, min 24 max 40) or object.
[  593.000509] binder: 30817:30829 transaction failed 29201/-22, size 40-16 line 3197
[  593.004668] binder: 30820:30830 got transaction with invalid offset (0, min 24 max 40) or object.
[  593.004831] binder: 30820:30830 transaction failed 29201/-22, size 40-16 line 3197
[  593.008631] binder: BINDER_SET_CONTEXT_MGR already set
[  593.008640] binder: 30826:30831 ioctl 40046207 0 returned -16
[  593.009509] binder: 30826:30831 got transaction with invalid offset (0, min 24 max 40) or object.
[  593.009597] binder: 30826:30831 transaction failed 29201/-22, size 40-16 line 3197
[  593.011419] binder: undelivered TRANSACTION_ERROR: 29201
[  593.020677] binder: undelivered TRANSACTION_ERROR: 29201
[  593.041531] binder: 30824:30832 got transaction with invalid offset (0, min 24 max 40) or object.
[  593.044880] binder: 30824:30832 transaction failed 29201/-22, size 40-16 line 3197
[  593.059382] binder: undelivered TRANSACTION_ERROR: 29201
[  593.063398] binder: undelivered TRANSACTION_ERROR: 29201
[  593.069841] binder: BINDER_SET_CONTEXT_MGR already set
[  593.069854] binder: 30839:30846 ioctl 40046207 0 returned -16
[  593.072470] binder: 30839:30846 got transaction with invalid offset (0, min 24 max 40) or object.
[  593.073630] binder: 30839:30846 transaction failed 29201/-22, size 40-16 line 3197
[  593.074551] binder: undelivered TRANSACTION_ERROR: 29201
[  593.077989] binder: undelivered TRANSACTION_ERROR: 29201
[  593.093464] binder: undelivered TRANSACTION_ERROR: 29201
[  593.099997] binder: BINDER_SET_CONTEXT_MGR already set
[  593.100007] binder: 30843:30847 ioctl 40046207 0 returned -16
[  593.102743] binder: BINDER_SET_CONTEXT_MGR already set
[  593.102751] binder: 30848:30851 ioctl 40046207 0 returned -16
[  593.103909] binder: 30843:30847 got transaction with invalid offset (0, min 24 max 40) or object.
[  593.103991] binder: 30843:30847 transaction failed 29201/-22, size 40-16 line 3197
[  593.105682] binder: 30848:30851 got transaction with invalid offset (0, min 24 max 40) or object.
[  593.105770] binder: 30848:30851 transaction failed 29201/-22, size 40-16 line 3197
[  593.108009] binder: BINDER_SET_CONTEXT_MGR already set
[  593.108016] binder: 30850:30853 ioctl 40046207 0 returned -16
[  593.109805] binder: 30850:30853 got transaction with invalid offset (0, min 24 max 40) or object.
[  593.109895] binder: 30850:30853 transaction failed 29201/-22, size 40-16 line 3197
[  593.112583] binder: undelivered TRANSACTION_ERROR: 29201
[  593.118166] binder: undelivered TRANSACTION_ERROR: 29201
[  593.121894] binder: 30852:30854 got transaction with invalid offset (0, min 24 max 40) or object.
[  593.121986] binder: 30852:30854 transaction failed 29201/-22, size 40-16 line 3197
[  593.133596] binder: BINDER_SET_CONTEXT_MGR already set
[  593.133606] binder: 30849:30856 ioctl 40046207 0 returned -16
[  593.134743] binder: 30849:30856 got transaction with invalid offset (0, min 24 max 40) or object.
[  593.134835] binder: 30849:30856 transaction failed 29201/-22, size 40-16 line 3197
[  593.155545] binder: BINDER_SET_CONTEXT_MGR already set
[  593.155555] binder: 30861:30866 ioctl 40046207 0 returned -16
[  593.156462] binder: 30861:30866 got transaction with invalid offset (0, min 24 max 40) or object.
[  593.156551] binder: 30861:30866 transaction failed 29201/-22, size 40-16 line 3197
[  593.161743] binder: undelivered TRANSACTION_ERROR: 29201
[  593.181208] binder: undelivered TRANSACTION_ERROR: 29201
[  593.184942] binder: BINDER_SET_CONTEXT_MGR already set
[  593.184951] binder: 30855:30867 ioctl 40046207 0 returned -16
[  593.186271] binder: undelivered TRANSACTION_ERROR: 29201
[  593.196296] binder: undelivered TRANSACTION_ERROR: 29201
[  593.198493] binder: undelivered TRANSACTION_ERROR: 29201
[  593.202467] binder: undelivered TRANSACTION_ERROR: 29201
[  593.210009] binder: 30871:30875 got transaction with invalid offset (0, min 24 max 40) or object.
[  593.210105] binder: 30871:30875 transaction failed 29201/-22, size 40-16 line 3197
[  593.213964] binder: BINDER_SET_CONTEXT_MGR already set
[  593.213972] binder: 30874:30876 ioctl 40046207 0 returned -16
[  593.215731] binder: BINDER_SET_CONTEXT_MGR already set
[  593.215738] binder: 30869:30872 ioctl 40046207 0 returned -16
[  593.217238] binder: 30869:30872 got transaction with invalid offset (0, min 24 max 40) or object.
[  593.217320] binder: 30869:30872 transaction failed 29201/-22, size 40-16 line 3197
[  593.219357] binder: BINDER_SET_CONTEXT_MGR already set
[  593.219364] binder: 30873:30878 ioctl 40046207 0 returned -16
[  593.219376] binder: 30874:30876 got transaction with invalid offset (0, min 24 max 40) or object.
[  593.219465] binder: 30874:30876 transaction failed 29201/-22, size 40-16 line 3197
[  593.221789] binder: 30873:30878 got transaction with invalid offset (0, min 24 max 40) or object.
[  593.221876] binder: 30873:30878 transaction failed 29201/-22, size 40-16 line 3197
[  593.240561] binder: undelivered TRANSACTION_ERROR: 29201
[  593.260161] binder: undelivered TRANSACTION_ERROR: 29201
[  593.267863] binder: undelivered TRANSACTION_ERROR: 29201
[  593.276945] binder: undelivered TRANSACTION_ERROR: 29201
[  593.300116] binder: 30887:30889 got transaction with invalid offset (0, min 24 max 40) or object.
[  593.300208] binder: 30887:30889 transaction failed 29201/-22, size 40-16 line 3197
[  593.309020] binder: BINDER_SET_CONTEXT_MGR already set
[  593.309031] binder: 30885:30890 ioctl 40046207 0 returned -16
[  593.317911] binder: BINDER_SET_CONTEXT_MGR already set
[  593.317918] binder: 30891:30895 ioctl 40046207 0 returned -16
[  593.319818] binder_alloc: 30887: binder_alloc_buf, no vma
[  593.319859] binder: 30885:30890 transaction failed 29189/-3, size 40-16 line 3134
[  593.320748] binder: BINDER_SET_CONTEXT_MGR already set
[  593.320755] binder: 30888:30897 ioctl 40046207 0 returned -16
[  593.322257] binder_alloc: 30887: binder_alloc_buf, no vma
[  593.322293] binder: 30888:30897 transaction failed 29189/-3, size 40-16 line 3134
[  593.323630] binder_alloc: 30887: binder_alloc_buf, no vma
[  593.323669] binder: 30891:30895 transaction failed 29189/-3, size 40-16 line 3134
[  593.329729] binder: undelivered TRANSACTION_ERROR: 29201
[  593.340213] binder: BINDER_SET_CONTEXT_MGR already set
[  593.340221] binder: 30893:30902 ioctl 40046207 0 returned -16
[  593.342136] binder: 30893:30902 got transaction with invalid offset (0, min 24 max 40) or object.
[  593.342226] binder: 30893:30902 transaction failed 29201/-22, size 40-16 line 3197
[  593.362625] binder: BINDER_SET_CONTEXT_MGR already set
[  593.362635] binder: 30894:30899 ioctl 40046207 0 returned -16
[  593.371273] binder: 30894:30899 got transaction with invalid offset (0, min 24 max 40) or object.
[  593.371364] binder: 30894:30899 transaction failed 29201/-22, size 40-16 line 3197
[  593.379500] binder: undelivered TRANSACTION_ERROR: 29189
[  593.379571] binder: undelivered TRANSACTION_ERROR: 29189
[  593.408144] binder: undelivered TRANSACTION_ERROR: 29201
[  593.411641] binder: undelivered TRANSACTION_ERROR: 29189
[  593.412091] binder: BINDER_SET_CONTEXT_MGR already set
[  593.412099] binder: 30915:30917 ioctl 40046207 0 returned -16
[  593.413980] binder_alloc: 30886: binder_alloc_buf, no vma
[  593.414019] binder: 30915:30917 transaction failed 29189/-3, size 40-16 line 3134
[  593.433154] binder: 30904:30912 got transaction with invalid offset (0, min 24 max 40) or object.
[  593.433247] binder: 30904:30912 transaction failed 29201/-22, size 40-16 line 3197
[  593.452643] binder: BINDER_SET_CONTEXT_MGR already set
[  593.452651] binder: 30916:30923 ioctl 40046207 0 returned -16
[  593.454799] binder: undelivered TRANSACTION_ERROR: 29201
[  593.454913] binder: BINDER_SET_CONTEXT_MGR already set
[  593.454921] binder: 30921:30925 ioctl 40046207 0 returned -16
[  593.455668] binder_alloc: 30904: binder_alloc_buf, no vma
[  593.464321] binder: undelivered TRANSACTION_ERROR: 29189
[  593.469978] binder: 30916:30923 transaction failed 29189/-3, size 40-16 line 3134
[  593.473440] binder_alloc: 30904: binder_alloc_buf, no vma
[  593.473481] binder: 30921:30925 transaction failed 29189/-3, size 40-16 line 3134
[  593.473682] binder: undelivered TRANSACTION_ERROR: 29201
[  593.487969] binder: BINDER_SET_CONTEXT_MGR already set
[  593.487977] binder: 30922:30926 ioctl 40046207 0 returned -16
[  593.488835] binder_alloc: 30927: binder_alloc_buf, no vma
[  593.488872] binder: 30922:30926 transaction failed 29189/-3, size 40-16 line 3134
[  593.489411] binder: undelivered TRANSACTION_ERROR: 29189
[  593.523020] binder: undelivered TRANSACTION_ERROR: 29189
[  593.527646] binder: 30931:30934 got transaction with invalid offset (0, min 24 max 40) or object.
[  593.527732] binder: 30931:30934 transaction failed 29201/-22, size 40-16 line 3197
[  593.540080] binder: undelivered TRANSACTION_ERROR: 29201
[  593.551331] binder: undelivered TRANSACTION_ERROR: 29189
[  593.587947] binder: BINDER_SET_CONTEXT_MGR already set
[  593.587955] binder: 30943:30945 ioctl 40046207 0 returned -16
[  593.588480] binder: 30938:30946 got transaction with invalid offset (0, min 24 max 40) or object.
[  593.588575] binder: 30938:30946 transaction failed 29201/-22, size 40-16 line 3197
[  593.590556] binder: 30943:30945 got transaction with invalid offset (0, min 24 max 40) or object.
[  593.590717] binder: BINDER_SET_CONTEXT_MGR already set
[  593.590724] binder: 30937:30948 ioctl 40046207 0 returned -16
[  593.590768] binder: BINDER_SET_CONTEXT_MGR already set
[  593.590773] binder: 30941:30947 ioctl 40046207 0 returned -16
[  593.591760] binder: 30941:30947 got transaction with invalid offset (0, min 24 max 40) or object.
[  593.591841] binder: 30941:30947 transaction failed 29201/-22, size 40-16 line 3197
[  593.594597] binder: BINDER_SET_CONTEXT_MGR already set
[  593.594605] binder: 30940:30949 ioctl 40046207 0 returned -16
[  593.595395] binder: 30943:30945 transaction failed 29201/-22, size 40-16 line 3197
[  593.595889] binder: 30937:30948 got transaction with invalid offset (0, min 24 max 40) or object.
[  593.595976] binder: 30937:30948 transaction failed 29201/-22, size 40-16 line 3197
[  593.597019] binder: 30940:30949 got transaction with invalid offset (0, min 24 max 40) or object.
[  593.597105] binder: 30940:30949 transaction failed 29201/-22, size 40-16 line 3197
[  593.598245] binder: BINDER_SET_CONTEXT_MGR already set
[  593.598253] binder: 30944:30950 ioctl 40046207 0 returned -16
[  593.604225] binder: BINDER_SET_CONTEXT_MGR already set
[  593.604232] binder: 30942:30951 ioctl 40046207 0 returned -16
[  593.606357] binder: 30942:30951 got transaction with invalid offset (0, min 24 max 40) or object.
[  593.606443] binder: 30942:30951 transaction failed 29201/-22, size 40-16 line 3197
[  593.607059] binder: 30944:30950 got transaction with invalid offset (0, min 24 max 40) or object.
[  593.607148] binder: 30944:30950 transaction failed 29201/-22, size 40-16 line 3197
[  593.610820] binder: 30939:30952 got transaction with invalid offset (0, min 24 max 40) or object.
[  593.610905] binder: 30939:30952 transaction failed 29201/-22, size 40-16 line 3197
[  593.620622] binder: undelivered TRANSACTION_ERROR: 29201
[  593.635651] binder: undelivered TRANSACTION_ERROR: 29201
[  593.646388] binder: undelivered TRANSACTION_ERROR: 29201
[  593.650897] binder: undelivered TRANSACTION_ERROR: 29201
[  593.659418] binder: undelivered TRANSACTION_ERROR: 29201
[  593.672326] binder: 30963:30967 got transaction with invalid offset (0, min 24 max 40) or object.
[  593.672417] binder: 30963:30967 transaction failed 29201/-22, size 40-16 line 3197
[  593.677105] binder: undelivered TRANSACTION_ERROR: 29201
[  593.695840] binder: undelivered TRANSACTION_ERROR: 29201
[  593.698985] binder: undelivered TRANSACTION_ERROR: 29201
[  593.701388] binder: undelivered TRANSACTION_ERROR: 29201
[  593.709412] binder: BINDER_SET_CONTEXT_MGR already set
[  593.709421] binder: 30970:30972 ioctl 40046207 0 returned -16
[  593.713402] binder: 30970:30972 got transaction with invalid offset (0, min 24 max 40) or object.
[  593.713491] binder: 30970:30972 transaction failed 29201/-22, size 40-16 line 3197
[  593.716573] binder: 30971:30974 got transaction with invalid offset (0, min 24 max 40) or object.
[  593.716659] binder: 30971:30974 transaction failed 29201/-22, size 40-16 line 3197
[  593.719485] binder: BINDER_SET_CONTEXT_MGR already set
[  593.719492] binder: 30969:30973 ioctl 40046207 0 returned -16
[  593.720671] binder: BINDER_SET_CONTEXT_MGR already set
[  593.720678] binder: 30968:30976 ioctl 40046207 0 returned -16
[  593.721235] binder: 30969:30973 got transaction with invalid offset (0, min 24 max 40) or object.
[  593.721320] binder: 30969:30973 transaction failed 29201/-22, size 40-16 line 3197
[  593.722263] binder: 30968:30976 got transaction with invalid offset (0, min 24 max 40) or object.
[  593.722349] binder: 30968:30976 transaction failed 29201/-22, size 40-16 line 3197
[  593.734749] binder: BINDER_SET_CONTEXT_MGR already set
[  593.734757] binder: 30977:30986 ioctl 40046207 0 returned -16
[  593.735681] binder: 30977:30986 got transaction with invalid offset (0, min 24 max 40) or object.
[  593.735766] binder: 30977:30986 transaction failed 29201/-22, size 40-16 line 3197
[  593.743515] binder: BINDER_SET_CONTEXT_MGR already set
[  593.743523] binder: 30980:30987 ioctl 40046207 0 returned -16
[  593.744373] binder: 30980:30987 got transaction with invalid offset (0, min 24 max 40) or object.
[  593.744462] binder: 30980:30987 transaction failed 29201/-22, size 40-16 line 3197
[  593.762178] binder: 30975:30985 got transaction with invalid offset (0, min 24 max 40) or object.
[  593.762274] binder: 30975:30985 transaction failed 29201/-22, size 40-16 line 3197
[  593.762663] binder: BINDER_SET_CONTEXT_MGR already set
[  593.762671] binder: 30979:30988 ioctl 40046207 0 returned -16
[  593.767286] binder: undelivered TRANSACTION_ERROR: 29201
[  593.773011] binder: 30979:30988 got transaction with invalid offset (0, min 24 max 40) or object.
[  593.773103] binder: 30979:30988 transaction failed 29201/-22, size 40-16 line 3197
[  593.776635] binder: undelivered TRANSACTION_ERROR: 29201
[  593.786625] binder: undelivered TRANSACTION_ERROR: 29201
[  593.786711] binder: undelivered TRANSACTION_ERROR: 29201
[  593.789701] binder: undelivered TRANSACTION_ERROR: 29201
[  593.803404] binder: undelivered TRANSACTION_ERROR: 29201
[  593.804210] binder: undelivered TRANSACTION_ERROR: 29201
[  593.826953] binder: undelivered TRANSACTION_ERROR: 29201
[  593.860247] binder: BINDER_SET_CONTEXT_MGR already set
[  593.860255] binder: 30996:31005 ioctl 40046207 0 returned -16
[  593.863180] binder: 30999:31000 got transaction with invalid offset (0, min 24 max 40) or object.
[  593.863698] binder: 30999:31000 transaction failed 29201/-22, size 40-16 line 3197
[  593.863967] binder: 30996:31005 got transaction with invalid offset (0, min 24 max 40) or object.
[  593.864059] binder: 30996:31005 transaction failed 29201/-22, size 40-16 line 3197
[  593.865327] binder: BINDER_SET_CONTEXT_MGR already set
[  593.865335] binder: 30997:31004 ioctl 40046207 0 returned -16
[  593.866905] binder: 30997:31004 got transaction with invalid offset (0, min 24 max 40) or object.
[  593.866995] binder: 30997:31004 transaction failed 29201/-22, size 40-16 line 3197
[  593.869230] binder: BINDER_SET_CONTEXT_MGR already set
[  593.869237] binder: 30995:31006 ioctl 40046207 0 returned -16
[  593.871305] binder: BINDER_SET_CONTEXT_MGR already set
[  593.871312] binder: 30998:31008 ioctl 40046207 0 returned -16
[  593.874208] binder: 30995:31006 got transaction with invalid offset (0, min 24 max 40) or object.
[  593.875723] binder: 30995:31006 transaction failed 29201/-22, size 40-16 line 3197
[  593.876872] binder: 30998:31008 got transaction with invalid offset (0, min 24 max 40) or object.
[  593.876953] binder: 30998:31008 transaction failed 29201/-22, size 40-16 line 3197
[  593.881239] binder: BINDER_SET_CONTEXT_MGR already set
[  593.881246] binder: 31001:31007 ioctl 40046207 0 returned -16
[  593.882195] binder: 31001:31007 got transaction with invalid offset (0, min 24 max 40) or object.
[  593.882284] binder: 31001:31007 transaction failed 29201/-22, size 40-16 line 3197
[  593.893123] binder: 31002:31009 got transaction with invalid offset (0, min 24 max 40) or object.
[  593.894436] binder: 31002:31009 transaction failed 29201/-22, size 40-16 line 3197
[  593.894750] binder: undelivered TRANSACTION_ERROR: 29201
[  593.909392] binder: BINDER_SET_CONTEXT_MGR already set
[  593.909401] binder: 31003:31012 ioctl 40046207 0 returned -16
[  593.914663] binder: 31003:31012 got transaction with invalid offset (0, min 24 max 40) or object.
[  593.914753] binder: 31003:31012 transaction failed 29201/-22, size 40-16 line 3197
[  593.916565] binder: undelivered TRANSACTION_ERROR: 29201
[  593.934594] binder: undelivered TRANSACTION_ERROR: 29201
[  593.945740] binder: BINDER_SET_CONTEXT_MGR already set
[  593.945749] binder: 31023:31025 ioctl 40046207 0 returned -16
[  593.948449] binder: 31023:31025 got transaction with invalid offset (0, min 24 max 40) or object.
[  593.948539] binder: 31023:31025 transaction failed 29201/-22, size 40-16 line 3197
[  593.959351] binder: undelivered TRANSACTION_ERROR: 29201
[  593.959476] binder: undelivered TRANSACTION_ERROR: 29201
[  593.964796] binder: undelivered TRANSACTION_ERROR: 29201
[  593.976658] binder: undelivered TRANSACTION_ERROR: 29201
[  593.992312] binder: 31020:31029 got transaction with invalid offset (0, min 24 max 40) or object.
[  593.992404] binder: 31020:31029 transaction failed 29201/-22, size 40-16 line 3197
[  594.009062] binder: undelivered TRANSACTION_ERROR: 29201
[  594.009147] binder: undelivered TRANSACTION_ERROR: 29201
[  594.010740] binder: BINDER_SET_CONTEXT_MGR already set
[  594.010748] binder: 31026:31028 ioctl 40046207 0 returned -16
[  594.012800] binder_alloc: 31020: binder_alloc_buf, no vma
[  594.012840] binder: 31026:31028 transaction failed 29189/-3, size 40-16 line 3134
[  594.016552] binder: BINDER_SET_CONTEXT_MGR already set
[  594.016559] binder: 31031:31037 ioctl 40046207 0 returned -16
[  594.017176] binder: BINDER_SET_CONTEXT_MGR already set
[  594.017184] binder: 31034:31035 ioctl 40046207 0 returned -16
[  594.017934] binder_alloc: 31020: binder_alloc_buf, no vma
[  594.017975] binder: 31034:31035 transaction failed 29189/-3, size 40-16 line 3134
[  594.019089] binder_alloc: 31020: binder_alloc_buf, no vma
[  594.019127] binder: 31031:31037 transaction failed 29189/-3, size 40-16 line 3134
[  594.020136] binder: undelivered TRANSACTION_ERROR: 29201
[  594.025488] binder: 31032:31036 got transaction with invalid offset (0, min 24 max 40) or object.
[  594.025579] binder: 31032:31036 transaction failed 29201/-22, size 40-16 line 3197
[  594.037893] binder: undelivered TRANSACTION_ERROR: 29189
[  594.045735] binder: BINDER_SET_CONTEXT_MGR already set
[  594.045742] binder: 31033:31038 ioctl 40046207 0 returned -16
[  594.047378] binder: 31033:31038 got transaction with invalid offset (0, min 24 max 40) or object.
[  594.047650] binder: 31033:31038 transaction failed 29201/-22, size 40-16 line 3197
[  594.070917] binder: BINDER_SET_CONTEXT_MGR already set
[  594.070925] binder: 31045:31049 ioctl 40046207 0 returned -16
[  594.072877] binder: undelivered TRANSACTION_ERROR: 29189
[  594.077499] binder: 31045:31049 got transaction with invalid offset (0, min 24 max 40) or object.
[  594.077572] binder: 31045:31049 transaction failed 29201/-22, size 40-16 line 3197
[  594.081328] binder: undelivered TRANSACTION_ERROR: 29201
[  594.086548] binder: undelivered TRANSACTION_ERROR: 29189
[  594.092101] binder: undelivered TRANSACTION_ERROR: 29201
[  594.098425] binder_alloc: 31044: binder_alloc_buf, no vma
[  594.098462] binder: 31044:31050 transaction failed 29189/-3, size 40-16 line 3134
[  594.104484] binder: undelivered TRANSACTION_ERROR: 29189
[  594.117368] binder: undelivered TRANSACTION_ERROR: 29201
[  594.147420] binder: BINDER_SET_CONTEXT_MGR already set
[  594.147428] binder: 31055:31062 ioctl 40046207 0 returned -16
[  594.149161] binder: 31055:31062 got transaction with invalid offset (0, min 24 max 40) or object.
[  594.149249] binder: 31055:31062 transaction failed 29201/-22, size 40-16 line 3197
[  594.150624] binder: 31056:31063 got transaction with invalid offset (0, min 24 max 40) or object.
[  594.150711] binder: 31056:31063 transaction failed 29201/-22, size 40-16 line 3197
[  594.150958] binder: BINDER_SET_CONTEXT_MGR already set
[  594.150964] binder: 31054:31060 ioctl 40046207 0 returned -16
[  594.152053] binder: 31054:31060 got transaction with invalid offset (0, min 24 max 40) or object.
[  594.152136] binder: 31054:31060 transaction failed 29201/-22, size 40-16 line 3197
[  594.154964] binder: BINDER_SET_CONTEXT_MGR already set
[  594.154971] binder: 31058:31065 ioctl 40046207 0 returned -16
[  594.156943] binder: 31058:31065 got transaction with invalid offset (0, min 24 max 40) or object.
[  594.157036] binder: 31058:31065 transaction failed 29201/-22, size 40-16 line 3197
[  594.158435] binder: BINDER_SET_CONTEXT_MGR already set
[  594.158442] binder: 31057:31064 ioctl 40046207 0 returned -16
[  594.161646] binder: 31057:31064 got transaction with invalid offset (0, min 24 max 40) or object.
[  594.161730] binder: 31057:31064 transaction failed 29201/-22, size 40-16 line 3197
[  594.162786] binder: BINDER_SET_CONTEXT_MGR already set
[  594.162793] binder: 31053:31066 ioctl 40046207 0 returned -16
[  594.165153] binder: 31053:31066 got transaction with invalid offset (0, min 24 max 40) or object.
[  594.165237] binder: 31053:31066 transaction failed 29201/-22, size 40-16 line 3197
[  594.177207] binder: BINDER_SET_CONTEXT_MGR already set
[  594.177215] binder: 31059:31067 ioctl 40046207 0 returned -16
[  594.178062] binder: 31059:31067 got transaction with invalid offset (0, min 24 max 40) or object.
[  594.178149] binder: 31059:31067 transaction failed 29201/-22, size 40-16 line 3197
[  594.198713] binder: undelivered TRANSACTION_ERROR: 29201
[  594.206151] binder: BINDER_SET_CONTEXT_MGR already set
[  594.206162] binder: 31061:31071 ioctl 40046207 0 returned -16
[  594.206277] binder: undelivered TRANSACTION_ERROR: 29201
[  594.212081] binder: undelivered TRANSACTION_ERROR: 29201
[  594.218429] binder: BINDER_SET_CONTEXT_MGR already set
[  594.218438] binder: 31080:31081 ioctl 40046207 0 returned -16
[  594.219352] binder: 31080:31081 got transaction with invalid offset (0, min 24 max 40) or object.
[  594.219436] binder: 31080:31081 transaction failed 29201/-22, size 40-16 line 3197
[  594.223202] binder: undelivered TRANSACTION_ERROR: 29201
[  594.229428] binder: undelivered TRANSACTION_ERROR: 29201
[  594.238189] binder: undelivered TRANSACTION_ERROR: 29201
[  594.240093] binder: undelivered TRANSACTION_ERROR: 29201
[  594.244044] binder: 31061:31071 transaction failed 29189/-22, size 40-16 line 3011
[  594.250478] binder: 31083:31087 got transaction with invalid offset (0, min 24 max 40) or object.
[  594.250573] binder: 31083:31087 transaction failed 29201/-22, size 40-16 line 3197
[  594.255453] binder: BINDER_SET_CONTEXT_MGR already set
[  594.255462] binder: 31084:31088 ioctl 40046207 0 returned -16
[  594.260102] binder: 31084:31088 got transaction with invalid offset (0, min 24 max 40) or object.
[  594.261103] binder: 31084:31088 transaction failed 29201/-22, size 40-16 line 3197
[  594.264381] binder: undelivered TRANSACTION_ERROR: 29201
[  594.271045] binder: BINDER_SET_CONTEXT_MGR already set
[  594.271054] binder: 31082:31085 ioctl 40046207 0 returned -16
[  594.273184] binder: 31082:31085 got transaction with invalid offset (0, min 24 max 40) or object.
[  594.273273] binder: 31082:31085 transaction failed 29201/-22, size 40-16 line 3197
[  594.276531] binder: BINDER_SET_CONTEXT_MGR already set
[  594.276539] binder: 31079:31093 ioctl 40046207 0 returned -16
[  594.279894] binder: 31079:31093 got transaction with invalid offset (0, min 24 max 40) or object.
[  594.279985] binder: 31079:31093 transaction failed 29201/-22, size 40-16 line 3197
[  594.292438] binder: BINDER_SET_CONTEXT_MGR already set
[  594.292446] binder: 31090:31096 ioctl 40046207 0 returned -16
[  594.293615] binder: 31090:31096 got transaction with invalid offset (0, min 24 max 40) or object.
[  594.293701] binder: 31090:31096 transaction failed 29201/-22, size 40-16 line 3197
[  594.293929] binder: BINDER_SET_CONTEXT_MGR already set
[  594.293936] binder: 31094:31100 ioctl 40046207 0 returned -16
[  594.294752] binder: 31094:31100 got transaction with invalid offset (0, min 24 max 40) or object.
[  594.294834] binder: 31094:31100 transaction failed 29201/-22, size 40-16 line 3197
[  594.296973] binder: undelivered TRANSACTION_ERROR: 29189
[  594.307229] binder: undelivered TRANSACTION_ERROR: 29201
[  594.319982] binder: undelivered TRANSACTION_ERROR: 29201
[  594.326965] binder: undelivered TRANSACTION_ERROR: 29201
[  594.329184] binder: undelivered TRANSACTION_ERROR: 29201
[  594.332399] binder_alloc: 31103: binder_alloc_buf, no vma
[  594.332438] binder: 31103:31108 transaction failed 29189/-3, size 40-16 line 3134
[  594.335018] binder: undelivered TRANSACTION_ERROR: 29201
[  594.349660] binder: undelivered TRANSACTION_ERROR: 29189
[  594.351941] binder: undelivered TRANSACTION_ERROR: 29201
[  594.384340] binder: BINDER_SET_CONTEXT_MGR already set
[  594.384347] binder: 31113:31122 ioctl 40046207 0 returned -16
[  594.385271] binder: BINDER_SET_CONTEXT_MGR already set
[  594.385279] binder: 31112:31125 ioctl 40046207 0 returned -16
[  594.385594] binder: 31113:31122 got transaction with invalid offset (0, min 24 max 40) or object.
[  594.385682] binder: 31113:31122 transaction failed 29201/-22, size 40-16 line 3197
[  594.386382] binder: BINDER_SET_CONTEXT_MGR already set
[  594.386389] binder: 31114:31126 ioctl 40046207 0 returned -16
[  594.387618] binder: 31114:31126 got transaction with invalid offset (0, min 24 max 40) or object.
[  594.387696] binder: 31114:31126 transaction failed 29201/-22, size 40-16 line 3197
[  594.387970] binder: 31119:31120 got transaction with invalid offset (0, min 24 max 40) or object.
[  594.388047] binder: 31119:31120 transaction failed 29201/-22, size 40-16 line 3197
[  594.388747] binder: 31112:31125 got transaction with invalid offset (0, min 24 max 40) or object.
[  594.388835] binder: 31112:31125 transaction failed 29201/-22, size 40-16 line 3197
[  594.392177] binder: BINDER_SET_CONTEXT_MGR already set
[  594.392183] binder: 31110:31123 ioctl 40046207 0 returned -16
[  594.394191] binder: BINDER_SET_CONTEXT_MGR already set
[  594.394197] binder: 31116:31127 ioctl 40046207 0 returned -16
[  594.395867] binder: 31110:31123 got transaction with invalid offset (0, min 24 max 40) or object.
[  594.395949] binder: 31110:31123 transaction failed 29201/-22, size 40-16 line 3197
[  594.396698] binder: 31116:31127 got transaction with invalid offset (0, min 24 max 40) or object.
[  594.396787] binder: 31116:31127 transaction failed 29201/-22, size 40-16 line 3197
[  594.403314] binder: BINDER_SET_CONTEXT_MGR already set
[  594.403321] binder: 31111:31128 ioctl 40046207 0 returned -16
[  594.409582] binder: 31111:31128 got transaction with invalid offset (0, min 24 max 40) or object.
[  594.410568] binder: 31111:31128 transaction failed 29201/-22, size 40-16 line 3197
[  594.420745] binder: undelivered TRANSACTION_ERROR: 29201
[  594.438374] binder: undelivered TRANSACTION_ERROR: 29201
[  594.442757] binder: undelivered TRANSACTION_ERROR: 29201
[  594.456403] binder: 31124:31133 got transaction with invalid offset (0, min 24 max 40) or object.
[  594.456492] binder: 31124:31133 transaction failed 29201/-22, size 40-16 line 3197
[  594.457852] binder: BINDER_SET_CONTEXT_MGR already set
[  594.457859] binder: 31142:31143 ioctl 40046207 0 returned -16
[  594.458849] binder: 31142:31143 got transaction with invalid offset (0, min 24 max 40) or object.
[  594.458932] binder: 31142:31143 transaction failed 29201/-22, size 40-16 line 3197
[  594.474491] binder: undelivered TRANSACTION_ERROR: 29201
[  594.474578] binder: undelivered TRANSACTION_ERROR: 29201
[  594.474691] binder: undelivered TRANSACTION_ERROR: 29201
[  594.494971] binder: BINDER_SET_CONTEXT_MGR already set
[  594.494979] binder: 31148:31150 ioctl 40046207 0 returned -16
[  594.499899] binder: BINDER_SET_CONTEXT_MGR already set
[  594.499906] binder: 31145:31152 ioctl 40046207 0 returned -16
[  594.499912] binder_alloc: 31124: binder_alloc_buf, no vma
[  594.499952] binder: 31148:31150 transaction failed 29189/-3, size 40-16 line 3134
[  594.501327] binder: undelivered TRANSACTION_ERROR: 29201
[  594.501801] binder: BINDER_SET_CONTEXT_MGR already set
[  594.501807] binder: 31147:31151 ioctl 40046207 0 returned -16
[  594.503780] binder_alloc: 31124: binder_alloc_buf, no vma
[  594.503821] binder: 31145:31152 transaction failed 29189/-3, size 40-16 line 3134
[  594.505980] binder: undelivered TRANSACTION_ERROR: 29201
[  594.516500] binder: 31147:31151 transaction failed 29189/-22, size 40-16 line 3011
[  594.521641] binder: 31149:31153 got transaction with invalid offset (0, min 24 max 40) or object.
[  594.521791] binder: 31149:31153 transaction failed 29201/-22, size 40-16 line 3197
[  594.525937] binder: BINDER_SET_CONTEXT_MGR already set
[  594.525945] binder: 31146:31154 ioctl 40046207 0 returned -16
[  594.525982] binder: undelivered TRANSACTION_ERROR: 29189
[  594.532682] binder: 31146:31154 got transaction with invalid offset (0, min 24 max 40) or object.
[  594.532912] binder: 31146:31154 transaction failed 29201/-22, size 40-16 line 3197
[  594.536442] binder: undelivered TRANSACTION_ERROR: 29201
[  594.537896] binder: BINDER_SET_CONTEXT_MGR already set
[  594.537903] binder: 31157:31161 ioctl 40046207 0 returned -16
[  594.538834] binder: 31157:31161 got transaction with invalid offset (0, min 24 max 40) or object.
[  594.538906] binder: 31157:31161 transaction failed 29201/-22, size 40-16 line 3197
[  594.559306] binder: undelivered TRANSACTION_ERROR: 29189
[  594.571368] binder: undelivered TRANSACTION_ERROR: 29201
[  594.579953] binder: undelivered TRANSACTION_ERROR: 29201
[  594.585636] binder: undelivered TRANSACTION_ERROR: 29189
[  594.590741] binder: undelivered TRANSACTION_ERROR: 29201
[  594.632036] binder: 31168:31174 got transaction with invalid offset (0, min 24 max 40) or object.
[  594.632126] binder: 31168:31174 transaction failed 29201/-22, size 40-16 line 3197
[  594.632297] binder: BINDER_SET_CONTEXT_MGR already set
[  594.632304] binder: 31171:31175 ioctl 40046207 0 returned -16
[  594.640286] binder: BINDER_SET_CONTEXT_MGR already set
[  594.640294] binder: 31172:31179 ioctl 40046207 0 returned -16
[  594.641688] binder: BINDER_SET_CONTEXT_MGR already set
[  594.641695] binder: 31170:31180 ioctl 40046207 0 returned -16
[  594.642813] binder: 31171:31175 got transaction with invalid offset (0, min 24 max 40) or object.
[  594.642906] binder: 31171:31175 transaction failed 29201/-22, size 40-16 line 3197
[  594.647226] binder: 31172:31179 got transaction with invalid offset (0, min 24 max 40) or object.
[  594.649134] binder: BINDER_SET_CONTEXT_MGR already set
[  594.649141] binder: 31166:31181 ioctl 40046207 0 returned -16
[  594.649674] binder: 31172:31179 transaction failed 29201/-22, size 40-16 line 3197
[  594.649807] binder_alloc: 31168: binder_alloc_buf, no vma
[  594.649842] binder: 31170:31180 transaction failed 29189/-3, size 40-16 line 3134
[  594.650758] binder: BINDER_SET_CONTEXT_MGR already set
[  594.650764] binder: 31169:31176 ioctl 40046207 0 returned -16
[  594.650858] binder: BINDER_SET_CONTEXT_MGR already set
[  594.650864] binder: 31167:31177 ioctl 40046207 0 returned -16
[  594.652100] binder: BINDER_SET_CONTEXT_MGR already set
[  594.652107] binder: 31173:31178 ioctl 40046207 0 returned -16
[  594.652264] binder_alloc: 31168: binder_alloc_buf, no vma
[  594.652303] binder: 31167:31177 transaction failed 29189/-3, size 40-16 line 3134
[  594.653269] binder_alloc: 31168: binder_alloc_buf, no vma
[  594.653305] binder: 31173:31178 transaction failed 29189/-3, size 40-16 line 3134
[  594.656649] binder_alloc: 31168: binder_alloc_buf, no vma
[  594.656763] binder: 31166:31181 transaction failed 29189/-3, size 40-16 line 3134
[  594.657233] binder_alloc: 31168: binder_alloc_buf, no vma
[  594.657272] binder: 31169:31176 transaction failed 29189/-3, size 40-16 line 3134
[  594.664177] binder: undelivered TRANSACTION_ERROR: 29201
[  594.705590] binder: undelivered TRANSACTION_ERROR: 29189
[  594.710284] binder: undelivered TRANSACTION_ERROR: 29201
[  594.714370] binder: undelivered TRANSACTION_ERROR: 29189
[  594.721167] binder: undelivered TRANSACTION_ERROR: 29189
[  594.721270] binder: undelivered TRANSACTION_ERROR: 29189
[  594.741262] binder: 31196:31198 got transaction with invalid offset (0, min 24 max 40) or object.
[  594.741352] binder: 31196:31198 transaction failed 29201/-22, size 40-16 line 3197
[  594.744976] binder: BINDER_SET_CONTEXT_MGR already set
[  594.744991] binder: 31197:31200 ioctl 40046207 0 returned -16
[  594.745906] binder: undelivered TRANSACTION_ERROR: 29201
[  594.746534] binder: 31197:31200 got transaction with invalid offset (0, min 24 max 40) or object.
[  594.746619] binder: 31197:31200 transaction failed 29201/-22, size 40-16 line 3197
[  594.748558] binder: BINDER_SET_CONTEXT_MGR already set
[  594.748565] binder: 31189:31195 ioctl 40046207 0 returned -16
[  594.749657] binder: 31189:31195 got transaction with invalid offset (0, min 24 max 40) or object.
[  594.749740] binder: 31189:31195 transaction failed 29201/-22, size 40-16 line 3197
[  594.758433] binder: undelivered TRANSACTION_ERROR: 29189
[  594.766297] binder: undelivered TRANSACTION_ERROR: 29201
[  594.773476] binder: undelivered TRANSACTION_ERROR: 29201
[  594.787228] binder: 31199:31202 got transaction with invalid offset (0, min 24 max 40) or object.
[  594.787318] binder: 31199:31202 transaction failed 29201/-22, size 40-16 line 3197
[  594.793453] binder: BINDER_SET_CONTEXT_MGR already set
[  594.793463] binder: 31204:31206 ioctl 40046207 0 returned -16
[  594.794701] binder: undelivered TRANSACTION_ERROR: 29201
[  594.795378] binder: 31204:31206 got transaction with invalid offset (0, min 24 max 40) or object.
[  594.795463] binder: 31204:31206 transaction failed 29201/-22, size 40-16 line 3197
[  594.805229] binder: BINDER_SET_CONTEXT_MGR already set
[  594.805237] binder: 31207:31209 ioctl 40046207 0 returned -16
[  594.806859] binder: 31207:31209 got transaction with invalid offset (0, min 24 max 40) or object.
[  594.806946] binder: 31207:31209 transaction failed 29201/-22, size 40-16 line 3197
[  594.807620] binder: BINDER_SET_CONTEXT_MGR already set
[  594.807628] binder: 31210:31215 ioctl 40046207 0 returned -16
[  594.808767] binder: 31210:31215 got transaction with invalid offset (0, min 24 max 40) or object.
[  594.808851] binder: 31210:31215 transaction failed 29201/-22, size 40-16 line 3197
[  594.813712] binder: BINDER_SET_CONTEXT_MGR already set
[  594.813719] binder: 31211:31217 ioctl 40046207 0 returned -16
[  594.815352] binder: 31211:31217 got transaction with invalid offset (0, min 24 max 40) or object.
[  594.815431] binder: 31211:31217 transaction failed 29201/-22, size 40-16 line 3197
[  594.816148] binder: 31213:31218 got transaction with invalid offset (0, min 24 max 40) or object.
[  594.816661] binder: 31213:31218 transaction failed 29201/-22, size 40-16 line 3197
[  594.828460] binder: undelivered TRANSACTION_ERROR: 29201
[  594.838787] binder: 31212:31219 got transaction with invalid offset (0, min 24 max 40) or object.
[  594.840695] binder: undelivered TRANSACTION_ERROR: 29201
[  594.841257] binder: 31212:31219 transaction failed 29201/-22, size 40-16 line 3197
[  594.866146] binder: undelivered TRANSACTION_ERROR: 29201
[  594.870504] binder: undelivered TRANSACTION_ERROR: 29201
[  594.871581] binder: undelivered TRANSACTION_ERROR: 29201
[  594.872149] binder: undelivered TRANSACTION_ERROR: 29201
[  594.890553] binder: undelivered TRANSACTION_ERROR: 29201
[  594.929185] binder: 31229:31233 got transaction with invalid offset (0, min 24 max 40) or object.
[  594.929278] binder: 31229:31233 transaction failed 29201/-22, size 40-16 line 3197
[  594.930706] binder: BINDER_SET_CONTEXT_MGR already set
[  594.930714] binder: 31232:31239 ioctl 40046207 0 returned -16
[  594.932237] binder: 31231:31235 got transaction with invalid offset (0, min 24 max 40) or object.
[  594.932326] binder: 31231:31235 transaction failed 29201/-22, size 40-16 line 3197
[  594.934808] binder: 31232:31239 got transaction with invalid offset (0, min 24 max 40) or object.
[  594.936885] binder: 31232:31239 transaction failed 29201/-22, size 40-16 line 3197
[  594.942198] binder: BINDER_SET_CONTEXT_MGR already set
[  594.942328] binder: 31230:31240 ioctl 40046207 0 returned -16
[  594.943453] binder: BINDER_SET_CONTEXT_MGR already set
[  594.943460] binder: 31237:31241 ioctl 40046207 0 returned -16
[  594.944731] binder: 31230:31240 got transaction with invalid offset (0, min 24 max 40) or object.
[  594.944802] binder: 31230:31240 transaction failed 29201/-22, size 40-16 line 3197
[  594.944966] binder: 31237:31241 got transaction with invalid offset (0, min 24 max 40) or object.
[  594.945062] binder: 31237:31241 transaction failed 29201/-22, size 40-16 line 3197
[  594.954953] binder: BINDER_SET_CONTEXT_MGR already set
[  594.954962] binder: 31236:31243 ioctl 40046207 0 returned -16
[  594.957393] binder: 31236:31243 got transaction with invalid offset (0, min 24 max 40) or object.
[  594.957484] binder: 31236:31243 transaction failed 29201/-22, size 40-16 line 3197
[  594.971248] binder: undelivered TRANSACTION_ERROR: 29201
[  594.973181] binder: undelivered TRANSACTION_ERROR: 29201
[  595.000434] binder: undelivered TRANSACTION_ERROR: 29201
[  595.001683] binder: 31238:31246 got transaction with invalid offset (0, min 24 max 40) or object.
[  595.001780] binder: 31238:31246 transaction failed 29201/-22, size 40-16 line 3197
[  595.017838] binder: undelivered TRANSACTION_ERROR: 29201
[  595.017908] binder: undelivered TRANSACTION_ERROR: 29201
[  595.031641] binder: BINDER_SET_CONTEXT_MGR already set
[  595.031650] binder: 31255:31259 ioctl 40046207 0 returned -16
[  595.033058] binder: 31255:31259 got transaction with invalid offset (0, min 24 max 40) or object.
[  595.033143] binder: 31255:31259 transaction failed 29201/-22, size 40-16 line 3197
[  595.039507] binder: undelivered TRANSACTION_ERROR: 29201
[  595.040527] binder: BINDER_SET_CONTEXT_MGR already set
[  595.040539] binder: 31254:31257 ioctl 40046207 0 returned -16
[  595.042125] binder: 31254:31257 got transaction with invalid offset (0, min 24 max 40) or object.
[  595.042214] binder: 31254:31257 transaction failed 29201/-22, size 40-16 line 3197
[  595.051623] binder: undelivered TRANSACTION_ERROR: 29201
[  595.057038] binder: BINDER_SET_CONTEXT_MGR already set
[  595.057047] binder: 31261:31269 ioctl 40046207 0 returned -16
[  595.060118] binder: 31261:31269 got transaction with invalid offset (0, min 24 max 40) or object.
[  595.060209] binder: 31261:31269 transaction failed 29201/-22, size 40-16 line 3197
[  595.061614] binder: 31258:31260 got transaction with invalid offset (0, min 24 max 40) or object.
[  595.061706] binder: 31258:31260 transaction failed 29201/-22, size 40-16 line 3197
[  595.081438] binder: BINDER_SET_CONTEXT_MGR already set
[  595.081447] binder: 31270:31271 ioctl 40046207 0 returned -16
[  595.084877] binder: 31270:31271 got transaction with invalid offset (0, min 24 max 40) or object.
[  595.089039] binder: undelivered TRANSACTION_ERROR: 29201
[  595.089350] binder: 31270:31271 transaction failed 29201/-22, size 40-16 line 3197
[  595.099259] binder: BINDER_SET_CONTEXT_MGR already set
[  595.099268] binder: 31263:31274 ioctl 40046207 0 returned -16
[  595.101988] binder: 31263:31274 got transaction with invalid offset (0, min 24 max 40) or object.
[  595.102076] binder: 31263:31274 transaction failed 29201/-22, size 40-16 line 3197
[  595.113122] binder: undelivered TRANSACTION_ERROR: 29201
[  595.118166] binder: undelivered TRANSACTION_ERROR: 29201
[  595.121048] binder: undelivered TRANSACTION_ERROR: 29201
[  595.130140] binder: 31272:31278 got transaction with invalid offset (0, min 24 max 40) or object.
[  595.130229] binder: 31272:31278 transaction failed 29201/-22, size 40-16 line 3197
[  595.140042] binder: BINDER_SET_CONTEXT_MGR already set
[  595.140050] binder: 31280:31281 ioctl 40046207 0 returned -16
[  595.141586] binder: 31280:31281 got transaction with invalid offset (0, min 24 max 40) or object.
[  595.141674] binder: 31280:31281 transaction failed 29201/-22, size 40-16 line 3197
[  595.141858] binder: undelivered TRANSACTION_ERROR: 29201
[  595.160442] binder: undelivered TRANSACTION_ERROR: 29201
[  595.176235] binder: undelivered TRANSACTION_ERROR: 29201
[  595.184706] binder: undelivered TRANSACTION_ERROR: 29201
[  595.212999] binder: 31287:31289 got transaction with invalid offset (0, min 24 max 40) or object.
[  595.213090] binder: 31287:31289 transaction failed 29201/-22, size 40-16 line 3197
[  595.219093] binder: BINDER_SET_CONTEXT_MGR already set
[  595.219101] binder: 31291:31296 ioctl 40046207 0 returned -16
[  595.221138] binder_alloc: 31287: binder_alloc_buf, no vma
[  595.221179] binder: 31291:31296 transaction failed 29189/-3, size 40-16 line 3134
[  595.223568] binder: BINDER_SET_CONTEXT_MGR already set
[  595.223577] binder: 31288:31294 ioctl 40046207 0 returned -16
[  595.224218] binder: BINDER_SET_CONTEXT_MGR already set
[  595.224224] binder: 31286:31290 ioctl 40046207 0 returned -16
[  595.225146] binder_alloc: 31287: binder_alloc_buf, no vma
[  595.225185] binder: 31288:31294 transaction failed 29189/-3, size 40-16 line 3134
[  595.229055] binder: BINDER_SET_CONTEXT_MGR already set
[  595.229062] binder: 31285:31299 ioctl 40046207 0 returned -16
[  595.234438] binder_alloc: 31287: binder_alloc_buf, no vma
[  595.234481] binder: 31285:31299 transaction failed 29189/-3, size 40-16 line 3134
[  595.238887] binder: BINDER_SET_CONTEXT_MGR already set
[  595.238895] binder: 31293:31298 ioctl 40046207 0 returned -16
[  595.239912] binder_alloc: 31287: binder_alloc_buf, no vma
[  595.239951] binder: 31293:31298 transaction failed 29189/-3, size 40-16 line 3134
[  595.240485] binder: undelivered TRANSACTION_ERROR: 29201
[  595.240723] binder: 31286:31290 transaction failed 29189/-22, size 40-16 line 3011
[  595.259758] binder: undelivered TRANSACTION_ERROR: 29189
[  595.265761] binder: 31295:31300 got transaction with invalid offset (0, min 24 max 40) or object.
[  595.265842] binder: 31295:31300 transaction failed 29201/-22, size 40-16 line 3197
[  595.271644] binder: undelivered TRANSACTION_ERROR: 29189
[  595.281951] binder: undelivered TRANSACTION_ERROR: 29189
[  595.294659] binder: BINDER_SET_CONTEXT_MGR already set
[  595.294669] binder: 31311:31312 ioctl 40046207 0 returned -16
[  595.296329] binder: BINDER_SET_CONTEXT_MGR already set
[  595.296336] binder: 31304:31308 ioctl 40046207 0 returned -16
[  595.296504] binder: 31311:31312 got transaction with invalid offset (0, min 24 max 40) or object.
[  595.296592] binder: 31311:31312 transaction failed 29201/-22, size 40-16 line 3197
[  595.299040] binder: 31304:31308 got transaction with invalid offset (0, min 24 max 40) or object.
[  595.299135] binder: 31304:31308 transaction failed 29201/-22, size 40-16 line 3197
[  595.307533] binder: undelivered TRANSACTION_ERROR: 29189
[  595.317852] binder: undelivered TRANSACTION_ERROR: 29189
[  595.318733] binder: undelivered TRANSACTION_ERROR: 29201
[  595.324755] binder: BINDER_SET_CONTEXT_MGR already set
[  595.324763] binder: 31314:31316 ioctl 40046207 0 returned -16
[  595.327338] binder: 31314:31316 got transaction with invalid offset (0, min 24 max 40) or object.
[  595.327408] binder: 31314:31316 transaction failed 29201/-22, size 40-16 line 3197
[  595.335007] binder: undelivered TRANSACTION_ERROR: 29201
[  595.337568] binder: 31317:31318 got transaction with invalid offset (0, min 24 max 40) or object.
[  595.337708] binder: 31317:31318 transaction failed 29201/-22, size 40-16 line 3197
[  595.353927] binder: undelivered TRANSACTION_ERROR: 29201
[  595.366545] binder: BINDER_SET_CONTEXT_MGR already set
[  595.366554] binder: 31315:31322 ioctl 40046207 0 returned -16
[  595.369657] binder: 31315:31322 got transaction with invalid offset (0, min 24 max 40) or object.
[  595.369744] binder: 31315:31322 transaction failed 29201/-22, size 40-16 line 3197
[  595.370609] binder: BINDER_SET_CONTEXT_MGR already set
[  595.370619] binder: 31320:31325 ioctl 40046207 0 returned -16
[  595.371611] binder: 31320:31325 got transaction with invalid offset (0, min 24 max 40) or object.
[  595.371766] binder: 31320:31325 transaction failed 29201/-22, size 40-16 line 3197
[  595.372582] binder: BINDER_SET_CONTEXT_MGR already set
[  595.372589] binder: 31324:31327 ioctl 40046207 0 returned -16
[  595.374920] binder: 31324:31327 got transaction with invalid offset (0, min 24 max 40) or object.
[  595.375029] binder: 31324:31327 transaction failed 29201/-22, size 40-16 line 3197
[  595.387745] binder: undelivered TRANSACTION_ERROR: 29201
[  595.387832] binder: undelivered TRANSACTION_ERROR: 29201
[  595.397335] binder: undelivered TRANSACTION_ERROR: 29201
[  595.417836] binder: undelivered TRANSACTION_ERROR: 29201
[  595.422120] binder: undelivered TRANSACTION_ERROR: 29201
[  595.450161] binder: 31332:31336 got transaction with invalid offset (0, min 24 max 40) or object.
[  595.450249] binder: 31332:31336 transaction failed 29201/-22, size 40-16 line 3197
[  595.454260] binder: BINDER_SET_CONTEXT_MGR already set
[  595.454268] binder: 31330:31338 ioctl 40046207 0 returned -16
[  595.457419] binder: 31330:31338 got transaction with invalid offset (0, min 24 max 40) or object.
[  595.457572] binder: BINDER_SET_CONTEXT_MGR already set
[  595.457578] binder: 31334:31339 ioctl 40046207 0 returned -16
[  595.458239] binder: 31330:31338 transaction failed 29201/-22, size 40-16 line 3197
[  595.461336] binder: 31334:31339 got transaction with invalid offset (0, min 24 max 40) or object.
[  595.461424] binder: 31334:31339 transaction failed 29201/-22, size 40-16 line 3197
[  595.462761] binder: BINDER_SET_CONTEXT_MGR already set
[  595.462769] binder: 31331:31341 ioctl 40046207 0 returned -16
[  595.463824] binder: 31331:31341 got transaction with invalid offset (0, min 24 max 40) or object.
[  595.463914] binder: 31331:31341 transaction failed 29201/-22, size 40-16 line 3197
[  595.465340] binder: BINDER_SET_CONTEXT_MGR already set
[  595.465348] binder: 31335:31340 ioctl 40046207 0 returned -16
[  595.467945] binder: 31335:31340 got transaction with invalid offset (0, min 24 max 40) or object.
[  595.468038] binder: 31335:31340 transaction failed 29201/-22, size 40-16 line 3197
[  595.473128] binder: BINDER_SET_CONTEXT_MGR already set
[  595.473139] binder: 31337:31342 ioctl 40046207 0 returned -16
[  595.474072] binder: 31337:31342 got transaction with invalid offset (0, min 24 max 40) or object.
[  595.474244] binder: 31337:31342 transaction failed 29201/-22, size 40-16 line 3197
[  595.479911] binder: BINDER_SET_CONTEXT_MGR already set
[  595.479920] binder: 31333:31344 ioctl 40046207 0 returned -16
[  595.481100] binder: 31333:31344 got transaction with invalid offset (0, min 24 max 40) or object.
[  595.481191] binder: 31333:31344 transaction failed 29201/-22, size 40-16 line 3197
[  595.490807] binder: undelivered TRANSACTION_ERROR: 29201
[  595.499028] binder: undelivered TRANSACTION_ERROR: 29201
[  595.521146] binder: 31343:31351 got transaction with invalid offset (0, min 24 max 40) or object.
[  595.521234] binder: 31343:31351 transaction failed 29201/-22, size 40-16 line 3197
[  595.524201] binder: undelivered TRANSACTION_ERROR: 29201
[  595.535341] binder: undelivered TRANSACTION_ERROR: 29201
[  595.535745] binder: undelivered TRANSACTION_ERROR: 29201
[  595.546415] binder: BINDER_SET_CONTEXT_MGR already set
[  595.546423] binder: 31358:31362 ioctl 40046207 0 returned -16
[  595.547136] binder: undelivered TRANSACTION_ERROR: 29201
[  595.547484] binder: 31358:31362 got transaction with invalid offset (0, min 24 max 40) or object.
[  595.547573] binder: 31358:31362 transaction failed 29201/-22, size 40-16 line 3197
[  595.548002] binder: BINDER_SET_CONTEXT_MGR already set
[  595.548009] binder: 31355:31359 ioctl 40046207 0 returned -16
[  595.554706] binder: 31355:31359 got transaction with invalid offset (0, min 24 max 40) or object.
[  595.554906] binder: 31355:31359 transaction failed 29201/-22, size 40-16 line 3197
[  595.572187] binder: undelivered TRANSACTION_ERROR: 29201
[  595.572412] binder: BINDER_SET_CONTEXT_MGR already set
[  595.572420] binder: 31365:31369 ioctl 40046207 0 returned -16
[  595.576688] binder: BINDER_SET_CONTEXT_MGR already set
[  595.576694] binder: 31363:31368 ioctl 40046207 0 returned -16
[  595.578239] binder: 31363:31368 got transaction with invalid offset (0, min 24 max 40) or object.
[  595.578328] binder: 31363:31368 transaction failed 29201/-22, size 40-16 line 3197
[  595.584123] binder: undelivered TRANSACTION_ERROR: 29201
[  595.588358] binder: BINDER_SET_CONTEXT_MGR already set
[  595.588368] binder: 31364:31366 ioctl 40046207 0 returned -16
[  595.590391] binder_alloc: 31343: binder_alloc_buf, no vma
[  595.590428] binder: 31365:31369 transaction failed 29189/-3, size 40-16 line 3134
[  595.592234] binder: undelivered TRANSACTION_ERROR: 29201
[  595.597488] binder: 31364:31366 transaction failed 29189/-22, size 40-16 line 3011
[  595.608631] binder: undelivered TRANSACTION_ERROR: 29201
[  595.617434] binder: undelivered TRANSACTION_ERROR: 29189
[  595.623915] binder: undelivered TRANSACTION_ERROR: 29201
[  595.635221] binder: undelivered TRANSACTION_ERROR: 29189
[  595.670553] binder: 31377:31383 got transaction with invalid offset (0, min 24 max 40) or object.
[  595.670641] binder: 31377:31383 transaction failed 29201/-22, size 40-16 line 3197
[  595.674319] binder: BINDER_SET_CONTEXT_MGR already set
[  595.674326] binder: 31379:31386 ioctl 40046207 0 returned -16
[  595.676554] binder: BINDER_SET_CONTEXT_MGR already set
[  595.676562] binder: 31380:31385 ioctl 40046207 0 returned -16
[  595.678239] binder: 31379:31386 got transaction with invalid offset (0, min 24 max 40) or object.
[  595.678328] binder: 31379:31386 transaction failed 29201/-22, size 40-16 line 3197
[  595.679168] binder: BINDER_SET_CONTEXT_MGR already set
[  595.679176] binder: 31378:31387 ioctl 40046207 0 returned -16
[  595.679704] binder: 31380:31385 got transaction with invalid offset (0, min 24 max 40) or object.
[  595.681436] binder: 31380:31385 transaction failed 29201/-22, size 40-16 line 3197
[  595.681450] binder: BINDER_SET_CONTEXT_MGR already set
[  595.681456] binder: 31381:31388 ioctl 40046207 0 returned -16
[  595.683144] binder: BINDER_SET_CONTEXT_MGR already set
[  595.683151] binder: 31375:31384 ioctl 40046207 0 returned -16
[  595.683371] binder: 31378:31387 got transaction with invalid offset (0, min 24 max 40) or object.
[  595.684395] binder: 31378:31387 transaction failed 29201/-22, size 40-16 line 3197
[  595.684894] binder: 31375:31384 got transaction with invalid offset (0, min 24 max 40) or object.
[  595.684979] binder: 31375:31384 transaction failed 29201/-22, size 40-16 line 3197
[  595.687992] binder: 31381:31388 got transaction with invalid offset (0, min 24 max 40) or object.
[  595.688762] binder: 31381:31388 transaction failed 29201/-22, size 40-16 line 3197
[  595.697327] binder: BINDER_SET_CONTEXT_MGR already set
[  595.697334] binder: 31382:31390 ioctl 40046207 0 returned -16
[  595.698083] binder_alloc: 31377: binder_alloc_buf, no vma
[  595.698114] binder: 31382:31390 transaction failed 29189/-3, size 40-16 line 3134
[  595.698602] binder: BINDER_SET_CONTEXT_MGR already set
[  595.698609] binder: 31376:31389 ioctl 40046207 0 returned -16
[  595.699539] binder_alloc: 31377: binder_alloc_buf, no vma
[  595.699576] binder: 31376:31389 transaction failed 29189/-3, size 40-16 line 3134
[  595.704522] binder: undelivered TRANSACTION_ERROR: 29201
[  595.740687] binder: undelivered TRANSACTION_ERROR: 29201
[  595.747421] binder: undelivered TRANSACTION_ERROR: 29189
[  595.749600] binder: undelivered TRANSACTION_ERROR: 29201
[  595.755676] binder: undelivered TRANSACTION_ERROR: 29201
[  595.760590] binder: undelivered TRANSACTION_ERROR: 29189
[  595.770785] binder: undelivered TRANSACTION_ERROR: 29201
[  595.777866] binder: undelivered TRANSACTION_ERROR: 29201
[  595.782131] binder: 31401:31403 got transaction with invalid offset (0, min 24 max 40) or object.
[  595.782222] binder: 31401:31403 transaction failed 29201/-22, size 40-16 line 3197
[  595.792436] binder: undelivered TRANSACTION_ERROR: 29201
[  595.811604] binder: BINDER_SET_CONTEXT_MGR already set
[  595.811612] binder: 31406:31411 ioctl 40046207 0 returned -16
[  595.814482] binder: 31406:31411 got transaction with invalid offset (0, min 24 max 40) or object.
[  595.815175] binder: 31406:31411 transaction failed 29201/-22, size 40-16 line 3197
[  595.819352] binder: 31405:31414 got transaction with invalid offset (0, min 24 max 40) or object.
[  595.819433] binder: 31405:31414 transaction failed 29201/-22, size 40-16 line 3197
[  595.819586] binder: BINDER_SET_CONTEXT_MGR already set
[  595.819592] binder: 31408:31415 ioctl 40046207 0 returned -16
[  595.821074] binder: BINDER_SET_CONTEXT_MGR already set
[  595.821082] binder: 31409:31412 ioctl 40046207 0 returned -16
[  595.823796] binder: 31409:31412 got transaction with invalid offset (0, min 24 max 40) or object.
[  595.823876] binder: 31409:31412 transaction failed 29201/-22, size 40-16 line 3197
[  595.824245] binder: 31408:31415 got transaction with invalid offset (0, min 24 max 40) or object.
[  595.824693] binder: 31408:31415 transaction failed 29201/-22, size 40-16 line 3197
[  595.832335] binder: BINDER_SET_CONTEXT_MGR already set
[  595.832343] binder: 31413:31419 ioctl 40046207 0 returned -16
[  595.834213] binder: 31413:31419 got transaction with invalid offset (0, min 24 max 40) or object.
[  595.834303] binder: 31413:31419 transaction failed 29201/-22, size 40-16 line 3197
[  595.847131] binder: undelivered TRANSACTION_ERROR: 29201
[  595.858099] binder: undelivered TRANSACTION_ERROR: 29201
[  595.867910] binder: undelivered TRANSACTION_ERROR: 29201
[  595.875236] binder: 31410:31426 got transaction with invalid offset (0, min 24 max 40) or object.
[  595.875325] binder: 31410:31426 transaction failed 29201/-22, size 40-16 line 3197
[  595.876155] binder: BINDER_SET_CONTEXT_MGR already set
[  595.876162] binder: 31416:31423 ioctl 40046207 0 returned -16
[  595.884535] binder_alloc: 31410: binder_alloc_buf, no vma
[  595.884573] binder: 31416:31423 transaction failed 29189/-3, size 40-16 line 3134
[  595.890525] binder: undelivered TRANSACTION_ERROR: 29201
[  595.896928] binder: undelivered TRANSACTION_ERROR: 29201
[  595.907766] binder: undelivered TRANSACTION_ERROR: 29201
[  595.917894] binder: undelivered TRANSACTION_ERROR: 29189
[  595.951639] binder: 31429:31434 got transaction with invalid offset (0, min 24 max 40) or object.
[  595.951725] binder: 31429:31434 transaction failed 29201/-22, size 40-16 line 3197
[  595.957206] binder: BINDER_SET_CONTEXT_MGR already set
[  595.957215] binder: 31428:31438 ioctl 40046207 0 returned -16
[  595.958081] binder: BINDER_SET_CONTEXT_MGR already set
[  595.958089] binder: 31431:31439 ioctl 40046207 0 returned -16
[  595.961077] binder: 31428:31438 got transaction with invalid offset (0, min 24 max 40) or object.
[  595.961532] binder: 31431:31439 got transaction with invalid offset (0, min 24 max 40) or object.
[  595.961621] binder: 31431:31439 transaction failed 29201/-22, size 40-16 line 3197
[  595.962577] binder: BINDER_SET_CONTEXT_MGR already set
[  595.962585] binder: 31433:31442 ioctl 40046207 0 returned -16
[  595.963042] binder: 31428:31438 transaction failed 29201/-22, size 40-16 line 3197
[  595.963550] binder: 31433:31442 got transaction with invalid offset (0, min 24 max 40) or object.
[  595.963639] binder: 31433:31442 transaction failed 29201/-22, size 40-16 line 3197
[  595.977186] binder: BINDER_SET_CONTEXT_MGR already set
[  595.977196] binder: 31436:31440 ioctl 40046207 0 returned -16
[  595.978951] binder: 31436:31440 got transaction with invalid offset (0, min 24 max 40) or object.
[  595.979037] binder: 31436:31440 transaction failed 29201/-22, size 40-16 line 3197
[  595.979908] binder: BINDER_SET_CONTEXT_MGR already set
[  595.979914] binder: 31432:31441 ioctl 40046207 0 returned -16
[  595.980834] binder: 31432:31441 got transaction with invalid offset (0, min 24 max 40) or object.
[  595.981124] binder: 31432:31441 transaction failed 29201/-22, size 40-16 line 3197
[  595.994488] binder: BINDER_SET_CONTEXT_MGR already set
[  595.994496] binder: 31437:31444 ioctl 40046207 0 returned -16
[  595.995593] binder: 31437:31444 got transaction with invalid offset (0, min 24 max 40) or object.
[  595.995679] binder: 31437:31444 transaction failed 29201/-22, size 40-16 line 3197
[  595.996967] binder: undelivered TRANSACTION_ERROR: 29201
[  596.010558] binder: undelivered TRANSACTION_ERROR: 29201
[  596.026271] binder: undelivered TRANSACTION_ERROR: 29201
[  596.029361] binder: undelivered TRANSACTION_ERROR: 29201
[  596.044920] binder: undelivered TRANSACTION_ERROR: 29201
[  596.052296] binder: undelivered TRANSACTION_ERROR: 29201
[  596.062725] binder: 31457:31464 got transaction with invalid offset (0, min 24 max 40) or object.
[  596.062814] binder: 31457:31464 transaction failed 29201/-22, size 40-16 line 3197
[  596.064181] binder: undelivered TRANSACTION_ERROR: 29201
[  596.077126] binder: BINDER_SET_CONTEXT_MGR already set
[  596.077134] binder: 31456:31460 ioctl 40046207 0 returned -16
[  596.077962] binder: 31456:31460 got transaction with invalid offset (0, min 24 max 40) or object.
[  596.079223] binder: 31456:31460 transaction failed 29201/-22, size 40-16 line 3197
[  596.088462] binder: undelivered TRANSACTION_ERROR: 29201
[  596.095725] binder: 31462:31467 got transaction with invalid offset (0, min 24 max 40) or object.
[  596.095811] binder: 31462:31467 transaction failed 29201/-22, size 40-16 line 3197
[  596.110834] binder: undelivered TRANSACTION_ERROR: 29201
[  596.112129] binder: BINDER_SET_CONTEXT_MGR already set
[  596.112138] binder: 31461:31469 ioctl 40046207 0 returned -16
[  596.113932] binder: 31461:31469 got transaction with invalid offset (0, min 24 max 40) or object.
[  596.114026] binder: 31461:31469 transaction failed 29201/-22, size 40-16 line 3197
[  596.114079] binder: BINDER_SET_CONTEXT_MGR already set
[  596.114085] binder: 31463:31470 ioctl 40046207 0 returned -16
[  596.114901] binder: 31463:31470 got transaction with invalid offset (0, min 24 max 40) or object.
[  596.114994] binder: 31463:31470 transaction failed 29201/-22, size 40-16 line 3197
[  596.119528] binder: BINDER_SET_CONTEXT_MGR already set
[  596.119537] binder: 31466:31468 ioctl 40046207 0 returned -16
[  596.120497] binder: 31466:31468 got transaction with invalid offset (0, min 24 max 40) or object.
[  596.120585] binder: 31466:31468 transaction failed 29201/-22, size 40-16 line 3197
[  596.128508] binder: BINDER_SET_CONTEXT_MGR already set
[  596.128516] binder: 31471:31473 ioctl 40046207 0 returned -16
[  596.130845] binder: 31471:31473 got transaction with invalid offset (0, min 24 max 40) or object.
[  596.130939] binder: 31471:31473 transaction failed 29201/-22, size 40-16 line 3197
[  596.139795] binder: undelivered TRANSACTION_ERROR: 29201
[  596.152261] binder: undelivered TRANSACTION_ERROR: 29201
[  596.152349] binder: undelivered TRANSACTION_ERROR: 29201
[  596.158697] binder: undelivered TRANSACTION_ERROR: 29201
[  596.167568] binder: undelivered TRANSACTION_ERROR: 29201
[  596.189273] binder: BINDER_SET_CONTEXT_MGR already set
[  596.189281] binder: 31478:31484 ioctl 40046207 0 returned -16
[  596.191005] binder: 31478:31484 got transaction with invalid offset (0, min 24 max 40) or object.
[  596.191090] binder: 31478:31484 transaction failed 29201/-22, size 40-16 line 3197
[  596.196096] binder: BINDER_SET_CONTEXT_MGR already set
[  596.196104] binder: 31483:31487 ioctl 40046207 0 returned -16
[  596.196699] binder: 31480:31485 got transaction with invalid offset (0, min 24 max 40) or object.
[  596.197160] binder: 31483:31487 got transaction with invalid offset (0, min 24 max 40) or object.
[  596.197246] binder: 31483:31487 transaction failed 29201/-22, size 40-16 line 3197
[  596.197525] binder: 31480:31485 transaction failed 29201/-22, size 40-16 line 3197
[  596.199128] binder: BINDER_SET_CONTEXT_MGR already set
[  596.199135] binder: 31482:31486 ioctl 40046207 0 returned -16
[  596.199974] binder: 31482:31486 got transaction with invalid offset (0, min 24 max 40) or object.
[  596.200245] binder: 31482:31486 transaction failed 29201/-22, size 40-16 line 3197
[  596.205933] binder: BINDER_SET_CONTEXT_MGR already set
[  596.205941] binder: 31479:31489 ioctl 40046207 0 returned -16
[  596.207511] binder: BINDER_SET_CONTEXT_MGR already set
[  596.207518] binder: 31481:31490 ioctl 40046207 0 returned -16
[  596.207544] binder: 31479:31489 got transaction with invalid offset (0, min 24 max 40) or object.
[  596.207632] binder: 31479:31489 transaction failed 29201/-22, size 40-16 line 3197
[  596.211451] binder: 31481:31490 got transaction with invalid offset (0, min 24 max 40) or object.
[  596.211539] binder: 31481:31490 transaction failed 29201/-22, size 40-16 line 3197
[  596.225156] binder: undelivered TRANSACTION_ERROR: 29201
[  596.232280] binder: BINDER_SET_CONTEXT_MGR already set
[  596.232289] binder: 31488:31496 ioctl 40046207 0 returned -16
[  596.233516] binder: 31488:31496 got transaction with invalid offset (0, min 24 max 40) or object.
[  596.233607] binder: 31488:31496 transaction failed 29201/-22, size 40-16 line 3197
[  596.240775] binder: BINDER_SET_CONTEXT_MGR already set
[  596.240784] binder: 31491:31500 ioctl 40046207 0 returned -16
[  596.247404] binder: undelivered TRANSACTION_ERROR: 29201
[  596.259166] binder: undelivered TRANSACTION_ERROR: 29201
[  596.266194] binder: 31491:31500 transaction failed 29189/-22, size 40-16 line 3011
[  596.272659] binder: undelivered TRANSACTION_ERROR: 29201
[  596.283707] binder: undelivered TRANSACTION_ERROR: 29201
[  596.288282] binder: 31505:31508 got transaction with invalid offset (0, min 24 max 40) or object.
[  596.288375] binder: 31505:31508 transaction failed 29201/-22, size 40-16 line 3197
[  596.290907] binder: undelivered TRANSACTION_ERROR: 29201
[  596.294286] binder: BINDER_SET_CONTEXT_MGR already set
[  596.294292] binder: 31503:31507 ioctl 40046207 0 returned -16
[  596.295271] binder: 31503:31507 got transaction with invalid offset (0, min 24 max 40) or object.
[  596.295385] binder: 31503:31507 transaction failed 29201/-22, size 40-16 line 3197
[  596.301418] binder: BINDER_SET_CONTEXT_MGR already set
[  596.301426] binder: 31506:31510 ioctl 40046207 0 returned -16
[  596.306265] binder: 31506:31510 got transaction with invalid offset (0, min 24 max 40) or object.
[  596.306367] binder: 31506:31510 transaction failed 29201/-22, size 40-16 line 3197
[  596.318651] binder: undelivered TRANSACTION_ERROR: 29201
[  596.324623] binder: undelivered TRANSACTION_ERROR: 29201
[  596.328738] binder: BINDER_SET_CONTEXT_MGR already set
[  596.328745] binder: 31512:31519 ioctl 40046207 0 returned -16
[  596.329575] binder: 31512:31519 got transaction with invalid offset (0, min 24 max 40) or object.
[  596.329889] binder: 31512:31519 transaction failed 29201/-22, size 40-16 line 3197
[  596.331413] binder: BINDER_SET_CONTEXT_MGR already set
[  596.331421] binder: 31511:31518 ioctl 40046207 0 returned -16
[  596.336755] binder: 31511:31518 got transaction with invalid offset (0, min 24 max 40) or object.
[  596.336841] binder: 31511:31518 transaction failed 29201/-22, size 40-16 line 3197
[  596.346087] binder: undelivered TRANSACTION_ERROR: 29201
[  596.355841] binder: BINDER_SET_CONTEXT_MGR already set
[  596.355848] binder: 31516:31521 ioctl 40046207 0 returned -16
[  596.356442] binder: undelivered TRANSACTION_ERROR: 29201
[  596.360071] binder: undelivered TRANSACTION_ERROR: 29201
[  596.366821] binder: 31516:31521 got transaction with invalid offset (0, min 24 max 40) or object.
[  596.367008] binder: 31516:31521 transaction failed 29201/-22, size 40-16 line 3197
[  596.368295] binder: undelivered TRANSACTION_ERROR: 29189
[  596.377298] binder: undelivered TRANSACTION_ERROR: 29201
[  596.384981] binder: undelivered TRANSACTION_ERROR: 29201
[  596.412735] binder: 31527:31528 got transaction with invalid offset (0, min 24 max 40) or object.
[  596.412826] binder: 31527:31528 transaction failed 29201/-22, size 40-16 line 3197
[  596.425202] binder: BINDER_SET_CONTEXT_MGR already set
[  596.425211] binder: 31533:31540 ioctl 40046207 0 returned -16
[  596.427329] binder: BINDER_SET_CONTEXT_MGR already set
[  596.427336] binder: 31532:31539 ioctl 40046207 0 returned -16
[  596.430566] binder: 31532:31539 got transaction with invalid offset (0, min 24 max 40) or object.
[  596.430651] binder: 31532:31539 transaction failed 29201/-22, size 40-16 line 3197
[  596.430790] binder: BINDER_SET_CONTEXT_MGR already set
[  596.430798] binder: 31531:31534 ioctl 40046207 0 returned -16
[  596.431157] binder: 31533:31540 got transaction with invalid offset (0, min 24 max 40) or object.
[  596.431244] binder: 31533:31540 transaction failed 29201/-22, size 40-16 line 3197
[  596.433357] binder: 31531:31534 got transaction with invalid offset (0, min 24 max 40) or object.
[  596.433451] binder: 31531:31534 transaction failed 29201/-22, size 40-16 line 3197
[  596.436624] binder: BINDER_SET_CONTEXT_MGR already set
[  596.436632] binder: 31530:31541 ioctl 40046207 0 returned -16
[  596.439485] binder: BINDER_SET_CONTEXT_MGR already set
[  596.439494] binder: 31535:31542 ioctl 40046207 0 returned -16
[  596.441051] binder: 31530:31541 got transaction with invalid offset (0, min 24 max 40) or object.
[  596.441141] binder: 31530:31541 transaction failed 29201/-22, size 40-16 line 3197
[  596.441755] binder: BINDER_SET_CONTEXT_MGR already set
[  596.441763] binder: 31529:31536 ioctl 40046207 0 returned -16
[  596.442882] binder: 31529:31536 got transaction with invalid offset (0, min 24 max 40) or object.
[  596.442976] binder: 31529:31536 transaction failed 29201/-22, size 40-16 line 3197
[  596.446468] binder: 31535:31542 got transaction with invalid offset (0, min 24 max 40) or object.
[  596.446559] binder: 31535:31542 transaction failed 29201/-22, size 40-16 line 3197
[  596.459212] binder: BINDER_SET_CONTEXT_MGR already set
[  596.459222] binder: 31537:31543 ioctl 40046207 0 returned -16
[  596.459640] binder: undelivered TRANSACTION_ERROR: 29201
[  596.463736] binder: 31537:31543 got transaction with invalid offset (0, min 24 max 40) or object.
[  596.463817] binder: 31537:31543 transaction failed 29201/-22, size 40-16 line 3197
[  596.473923] binder: undelivered TRANSACTION_ERROR: 29201
[  596.493537] binder: undelivered TRANSACTION_ERROR: 29201
[  596.511581] binder: undelivered TRANSACTION_ERROR: 29201
[  596.518988] binder: undelivered TRANSACTION_ERROR: 29201
[  596.519072] binder: undelivered TRANSACTION_ERROR: 29201
[  596.520246] binder: 31555:31557 got transaction with invalid offset (0, min 24 max 40) or object.
[  596.520339] binder: 31555:31557 transaction failed 29201/-22, size 40-16 line 3197
[  596.532705] binder: undelivered TRANSACTION_ERROR: 29201
[  596.539202] binder: undelivered TRANSACTION_ERROR: 29201
[  596.553041] binder: BINDER_SET_CONTEXT_MGR already set
[  596.553049] binder: 31553:31558 ioctl 40046207 0 returned -16
[  596.557211] binder: 31553:31558 got transaction with invalid offset (0, min 24 max 40) or object.
[  596.557295] binder: 31553:31558 transaction failed 29201/-22, size 40-16 line 3197
[  596.561511] binder: undelivered TRANSACTION_ERROR: 29201
[  596.570504] binder: 31559:31563 got transaction with invalid offset (0, min 24 max 40) or object.
[  596.570593] binder: 31559:31563 transaction failed 29201/-22, size 40-16 line 3197
[  596.580296] binder: BINDER_SET_CONTEXT_MGR already set
[  596.580306] binder: 31564:31570 ioctl 40046207 0 returned -16
[  596.585000] binder: BINDER_SET_CONTEXT_MGR already set
[  596.585008] binder: 31561:31568 ioctl 40046207 0 returned -16
[  596.585609] binder: 31564:31570 got transaction with invalid offset (0, min 24 max 40) or object.
[  596.585771] binder: 31564:31570 transaction failed 29201/-22, size 40-16 line 3197
[  596.587253] binder: BINDER_SET_CONTEXT_MGR already set
[  596.587260] binder: 31565:31569 ioctl 40046207 0 returned -16
[  596.588230] binder: 31565:31569 got transaction with invalid offset (0, min 24 max 40) or object.
[  596.588322] binder: 31565:31569 transaction failed 29201/-22, size 40-16 line 3197
[  596.588352] binder: BINDER_SET_CONTEXT_MGR already set
[  596.588358] binder: 31562:31567 ioctl 40046207 0 returned -16
[  596.589605] binder: 31561:31568 got transaction with invalid offset (0, min 24 max 40) or object.
[  596.589683] binder: 31561:31568 transaction failed 29201/-22, size 40-16 line 3197
[  596.593673] binder: 31562:31567 got transaction with invalid offset (0, min 24 max 40) or object.
[  596.593763] binder: 31562:31567 transaction failed 29201/-22, size 40-16 line 3197
[  596.603418] binder: undelivered TRANSACTION_ERROR: 29201
[  596.609210] binder: BINDER_SET_CONTEXT_MGR already set
[  596.609217] binder: 31571:31575 ioctl 40046207 0 returned -16
[  596.610506] binder: 31571:31575 got transaction with invalid offset (0, min 24 max 40) or object.
[  596.610594] binder: 31571:31575 transaction failed 29201/-22, size 40-16 line 3197
[  596.615739] binder: undelivered TRANSACTION_ERROR: 29201
[  596.648194] binder: undelivered TRANSACTION_ERROR: 29201
[  596.648453] binder: undelivered TRANSACTION_ERROR: 29201
[  596.655383] binder: undelivered TRANSACTION_ERROR: 29201
[  596.655573] binder: 31572:31578 got transaction with invalid offset (0, min 24 max 40) or object.
[  596.655678] binder: 31572:31578 transaction failed 29201/-22, size 40-16 line 3197
[  596.660044] binder: undelivered TRANSACTION_ERROR: 29201
[  596.665751] binder: BINDER_SET_CONTEXT_MGR already set
[  596.665762] binder: 31584:31588 ioctl 40046207 0 returned -16
[  596.667530] binder: 31584:31588 got transaction with invalid offset (0, min 24 max 40) or object.
[  596.667618] binder: 31584:31588 transaction failed 29201/-22, size 40-16 line 3197
[  596.674421] binder: BINDER_SET_CONTEXT_MGR already set
[  596.674431] binder: 31581:31586 ioctl 40046207 0 returned -16
[  596.683595] binder: undelivered TRANSACTION_ERROR: 29201
[  596.695327] binder: 31581:31586 got transaction with invalid offset (0, min 24 max 40) or object.
[  596.695428] binder: 31581:31586 transaction failed 29201/-22, size 40-16 line 3197
[  596.696339] binder: undelivered TRANSACTION_ERROR: 29201
[  596.699035] binder: undelivered TRANSACTION_ERROR: 29201
[  596.708076] binder: 31589:31593 got transaction with invalid offset (0, min 24 max 40) or object.
[  596.708164] binder: 31589:31593 transaction failed 29201/-22, size 40-16 line 3197
[  596.726822] binder: undelivered TRANSACTION_ERROR: 29201
[  596.739108] binder: undelivered TRANSACTION_ERROR: 29201
[  596.768276] binder: 31597:31603 got transaction with invalid offset (0, min 24 max 40) or object.
[  596.768366] binder: 31597:31603 transaction failed 29201/-22, size 40-16 line 3197
[  596.774439] binder: BINDER_SET_CONTEXT_MGR already set
[  596.774447] binder: 31595:31601 ioctl 40046207 0 returned -16
[  596.775443] binder: 31595:31601 got transaction with invalid offset (0, min 24 max 40) or object.
[  596.775529] binder: 31595:31601 transaction failed 29201/-22, size 40-16 line 3197
[  596.777051] binder: BINDER_SET_CONTEXT_MGR already set
[  596.777058] binder: 31600:31605 ioctl 40046207 0 returned -16
[  596.777458] binder: BINDER_SET_CONTEXT_MGR already set
[  596.777464] binder: 31598:31606 ioctl 40046207 0 returned -16
[  596.780196] binder: 31600:31605 got transaction with invalid offset (0, min 24 max 40) or object.
[  596.780289] binder: 31600:31605 transaction failed 29201/-22, size 40-16 line 3197
[  596.781679] binder: 31598:31606 got transaction with invalid offset (0, min 24 max 40) or object.
[  596.784379] binder: BINDER_SET_CONTEXT_MGR already set
[  596.784387] binder: 31602:31611 ioctl 40046207 0 returned -16
[  596.784415] binder: 31598:31606 transaction failed 29201/-22, size 40-16 line 3197
[  596.785391] binder: 31602:31611 got transaction with invalid offset (0, min 24 max 40) or object.
[  596.785485] binder: 31602:31611 transaction failed 29201/-22, size 40-16 line 3197
[  596.785784] binder: BINDER_SET_CONTEXT_MGR already set
[  596.785791] binder: 31604:31610 ioctl 40046207 0 returned -16
[  596.788171] binder: 31604:31610 got transaction with invalid offset (0, min 24 max 40) or object.
[  596.788249] binder: 31604:31610 transaction failed 29201/-22, size 40-16 line 3197
[  596.790454] binder: BINDER_SET_CONTEXT_MGR already set
[  596.790462] binder: 31599:31607 ioctl 40046207 0 returned -16
[  596.794475] binder: BINDER_SET_CONTEXT_MGR already set
[  596.794484] binder: 31596:31608 ioctl 40046207 0 returned -16
[  596.795333] binder: 31596:31608 got transaction with invalid offset (0, min 24 max 40) or object.
[  596.796433] binder: 31599:31607 got transaction with invalid offset (0, min 24 max 40) or object.
[  596.796512] binder: 31599:31607 transaction failed 29201/-22, size 40-16 line 3197
[  596.796673] binder: 31596:31608 transaction failed 29201/-22, size 40-16 line 3197
[  596.834442] binder: undelivered TRANSACTION_ERROR: 29201
[  596.840642] binder: undelivered TRANSACTION_ERROR: 29201
[  596.845779] binder: undelivered TRANSACTION_ERROR: 29201
[  596.854836] binder: undelivered TRANSACTION_ERROR: 29201
[  596.867422] binder: undelivered TRANSACTION_ERROR: 29201
[  596.867530] binder: undelivered TRANSACTION_ERROR: 29201
[  596.867607] binder: undelivered TRANSACTION_ERROR: 29201
[  596.874687] binder: 31624:31626 got transaction with invalid offset (0, min 24 max 40) or object.
[  596.874785] binder: 31624:31626 transaction failed 29201/-22, size 40-16 line 3197
[  596.884481] binder: BINDER_SET_CONTEXT_MGR already set
[  596.884489] binder: 31623:31627 ioctl 40046207 0 returned -16
[  596.886086] binder: 31623:31627 got transaction with invalid offset (0, min 24 max 40) or object.
[  596.886177] binder: 31623:31627 transaction failed 29201/-22, size 40-16 line 3197
[  596.886454] binder: undelivered TRANSACTION_ERROR: 29201
[  596.906082] binder: undelivered TRANSACTION_ERROR: 29201
[  596.915670] binder: undelivered TRANSACTION_ERROR: 29201
[  596.950787] binder: 31630:31639 got transaction with invalid offset (0, min 24 max 40) or object.
[  596.950924] binder: BINDER_SET_CONTEXT_MGR already set
[  596.950930] binder: 31632:31642 ioctl 40046207 0 returned -16
[  596.951087] binder: 31630:31639 transaction failed 29201/-22, size 40-16 line 3197
[  596.951244] binder: BINDER_SET_CONTEXT_MGR already set
[  596.951250] binder: 31634:31638 ioctl 40046207 0 returned -16
[  596.951711] binder: BINDER_SET_CONTEXT_MGR already set
[  596.951718] binder: 31637:31643 ioctl 40046207 0 returned -16
[  596.952064] binder: BINDER_SET_CONTEXT_MGR already set
[  596.952071] binder: 31631:31640 ioctl 40046207 0 returned -16
[  596.952341] binder: 31634:31638 got transaction with invalid offset (0, min 24 max 40) or object.
[  596.952434] binder: 31634:31638 transaction failed 29201/-22, size 40-16 line 3197
[  596.955716] binder: 31632:31642 got transaction with invalid offset (0, min 24 max 40) or object.
[  596.955800] binder: 31632:31642 transaction failed 29201/-22, size 40-16 line 3197
[  596.956994] binder: 31631:31640 got transaction with invalid offset (0, min 24 max 40) or object.
[  596.957077] binder: 31631:31640 transaction failed 29201/-22, size 40-16 line 3197
[  596.961290] binder: BINDER_SET_CONTEXT_MGR already set
[  596.961297] binder: 31636:31645 ioctl 40046207 0 returned -16
[  596.961498] binder: BINDER_SET_CONTEXT_MGR already set
[  596.961505] binder: 31633:31641 ioctl 40046207 0 returned -16
[  596.962821] binder: 31633:31641 got transaction with invalid offset (0, min 24 max 40) or object.
[  596.962915] binder: 31633:31641 transaction failed 29201/-22, size 40-16 line 3197
[  596.963888] binder: 31637:31643 got transaction with invalid offset (0, min 24 max 40) or object.
[  596.963976] binder: 31637:31643 transaction failed 29201/-22, size 40-16 line 3197
[  596.968205] binder: 31636:31645 got transaction with invalid offset (0, min 24 max 40) or object.
[  596.968292] binder: 31636:31645 transaction failed 29201/-22, size 40-16 line 3197
[  596.977504] binder_alloc: 31630: binder_alloc_buf, no vma
[  596.977544] binder: 31635:31644 transaction failed 29189/-3, size 40-16 line 3134
[  596.988351] binder: undelivered TRANSACTION_ERROR: 29201
[  597.018161] binder: undelivered TRANSACTION_ERROR: 29201
[  597.019435] binder: undelivered TRANSACTION_ERROR: 29201
[  597.036001] binder: undelivered TRANSACTION_ERROR: 29201
[  597.036127] binder: undelivered TRANSACTION_ERROR: 29201
[  597.046122] binder: undelivered TRANSACTION_ERROR: 29189
[  597.050379] binder: undelivered TRANSACTION_ERROR: 29201
[  597.057056] binder: 31662:31664 got transaction with invalid offset (0, min 24 max 40) or object.
[  597.057146] binder: 31662:31664 transaction failed 29201/-22, size 40-16 line 3197
[  597.059123] binder: undelivered TRANSACTION_ERROR: 29201
[  597.081596] binder: undelivered TRANSACTION_ERROR: 29201
[  597.091862] binder: BINDER_SET_CONTEXT_MGR already set
[  597.091870] binder: 31660:31661 ioctl 40046207 0 returned -16
[  597.093079] binder: 31665:31666 got transaction with invalid offset (0, min 24 max 40) or object.
[  597.093105] binder: 31660:31661 got transaction with invalid offset (0, min 24 max 40) or object.
[  597.093153] binder: 31665:31666 transaction failed 29201/-22, size 40-16 line 3197
[  597.093209] binder: 31660:31661 transaction failed 29201/-22, size 40-16 line 3197
[  597.096622] binder: BINDER_SET_CONTEXT_MGR already set
[  597.096629] binder: 31657:31663 ioctl 40046207 0 returned -16
[  597.096935] binder: BINDER_SET_CONTEXT_MGR already set
[  597.096942] binder: 31669:31673 ioctl 40046207 0 returned -16
[  597.097469] binder: 31657:31663 got transaction with invalid offset (0, min 24 max 40) or object.
[  597.097558] binder: 31657:31663 transaction failed 29201/-22, size 40-16 line 3197
[  597.099933] binder: 31669:31673 got transaction with invalid offset (0, min 24 max 40) or object.
[  597.100342] binder: 31669:31673 transaction failed 29201/-22, size 40-16 line 3197
[  597.106460] binder: BINDER_SET_CONTEXT_MGR already set
[  597.106468] binder: 31670:31675 ioctl 40046207 0 returned -16
[  597.116804] binder: 31670:31675 got transaction with invalid offset (0, min 24 max 40) or object.
[  597.116891] binder: 31670:31675 transaction failed 29201/-22, size 40-16 line 3197
[  597.126402] binder: undelivered TRANSACTION_ERROR: 29201
[  597.128695] binder: BINDER_SET_CONTEXT_MGR already set
[  597.128701] binder: 31676:31681 ioctl 40046207 0 returned -16
[  597.131993] binder: 31676:31681 got transaction with invalid offset (0, min 24 max 40) or object.
[  597.132079] binder: 31676:31681 transaction failed 29201/-22, size 40-16 line 3197
[  597.151363] binder: undelivered TRANSACTION_ERROR: 29201
[  597.155016] binder: BINDER_SET_CONTEXT_MGR already set
[  597.155026] binder: 31674:31679 ioctl 40046207 0 returned -16
[  597.158027] binder: undelivered TRANSACTION_ERROR: 29201
[  597.158441] binder: 31674:31679 got transaction with invalid offset (0, min 24 max 40) or object.
[  597.158533] binder: 31674:31679 transaction failed 29201/-22, size 40-16 line 3197
[  597.169499] binder: 31672:31682 got transaction with invalid offset (0, min 24 max 40) or object.
[  597.170068] binder: 31672:31682 transaction failed 29201/-22, size 40-16 line 3197
[  597.181845] binder: undelivered TRANSACTION_ERROR: 29201
[  597.181930] binder: undelivered TRANSACTION_ERROR: 29201
[  597.184006] binder: undelivered TRANSACTION_ERROR: 29201
[  597.188967] binder: 31688:31690 got transaction with invalid offset (0, min 24 max 40) or object.
[  597.189058] binder: 31688:31690 transaction failed 29201/-22, size 40-16 line 3197
[  597.200233] binder: BINDER_SET_CONTEXT_MGR already set
[  597.200241] binder: 31686:31691 ioctl 40046207 0 returned -16
[  597.201169] binder: 31686:31691 got transaction with invalid offset (0, min 24 max 40) or object.
[  597.202138] binder: 31686:31691 transaction failed 29201/-22, size 40-16 line 3197
[  597.211478] binder: BINDER_SET_CONTEXT_MGR already set
[  597.211486] binder: 31694:31696 ioctl 40046207 0 returned -16
[  597.215704] binder: 31694:31696 got transaction with invalid offset (0, min 24 max 40) or object.
[  597.216030] binder: 31694:31696 transaction failed 29201/-22, size 40-16 line 3197
[  597.225316] binder: undelivered TRANSACTION_ERROR: 29201
[  597.231751] binder: undelivered TRANSACTION_ERROR: 29201
[  597.233327] binder: undelivered TRANSACTION_ERROR: 29201
[  597.233749] binder: BINDER_SET_CONTEXT_MGR already set
[  597.233756] binder: 31697:31700 ioctl 40046207 0 returned -16
[  597.243073] binder: 31698:31701 got transaction with invalid offset (0, min 24 max 40) or object.
[  597.243161] binder: 31698:31701 transaction failed 29201/-22, size 40-16 line 3197
[  597.249457] binder: undelivered TRANSACTION_ERROR: 29201
[  597.265054] binder: undelivered TRANSACTION_ERROR: 29201
[  597.270356] binder: 31697:31700 transaction failed 29189/-22, size 40-16 line 3011
[  597.284621] binder: undelivered TRANSACTION_ERROR: 29189
[  597.289185] binder: undelivered TRANSACTION_ERROR: 29201
[  597.324692] binder: BINDER_SET_CONTEXT_MGR already set
[  597.324699] binder: 31709:31718 ioctl 40046207 0 returned -16
[  597.325878] binder: BINDER_SET_CONTEXT_MGR already set
[  597.325891] binder: 31712:31717 ioctl 40046207 0 returned -16
[  597.325910] binder: 31710:31713 got transaction with invalid offset (0, min 24 max 40) or object.
[  597.326000] binder: 31710:31713 transaction failed 29201/-22, size 40-16 line 3197
[  597.329924] binder: 31709:31718 got transaction with invalid offset (0, min 24 max 40) or object.
[  597.330011] binder: 31709:31718 transaction failed 29201/-22, size 40-16 line 3197
[  597.330787] binder: BINDER_SET_CONTEXT_MGR already set
[  597.330794] binder: 31708:31716 ioctl 40046207 0 returned -16
[  597.331361] binder: 31712:31717 got transaction with invalid offset (0, min 24 max 40) or object.
[  597.331441] binder: 31712:31717 transaction failed 29201/-22, size 40-16 line 3197
[  597.331833] binder: 31708:31716 got transaction with invalid offset (0, min 24 max 40) or object.
[  597.331922] binder: 31708:31716 transaction failed 29201/-22, size 40-16 line 3197
[  597.332024] binder: BINDER_SET_CONTEXT_MGR already set
[  597.332031] binder: 31706:31719 ioctl 40046207 0 returned -16
[  597.337660] binder: 31706:31719 got transaction with invalid offset (0, min 24 max 40) or object.
[  597.337750] binder: 31706:31719 transaction failed 29201/-22, size 40-16 line 3197
[  597.344197] binder: BINDER_SET_CONTEXT_MGR already set
[  597.344204] binder: 31707:31715 ioctl 40046207 0 returned -16
[  597.346516] binder: 31711:31720 got transaction with invalid offset (0, min 24 max 40) or object.
[  597.347732] binder: 31711:31720 transaction failed 29201/-22, size 40-16 line 3197
[  597.348129] binder: 31707:31715 got transaction with invalid offset (0, min 24 max 40) or object.
[  597.348257] binder: 31707:31715 transaction failed 29201/-22, size 40-16 line 3197
[  597.355117] binder: BINDER_SET_CONTEXT_MGR already set
[  597.355125] binder: 31714:31721 ioctl 40046207 0 returned -16
[  597.356262] binder: 31714:31721 got transaction with invalid offset (0, min 24 max 40) or object.
[  597.356354] binder: 31714:31721 transaction failed 29201/-22, size 40-16 line 3197
[  597.367145] binder: undelivered TRANSACTION_ERROR: 29201
[  597.384752] binder: undelivered TRANSACTION_ERROR: 29201
[  597.410935] binder: undelivered TRANSACTION_ERROR: 29201
[  597.411087] binder: undelivered TRANSACTION_ERROR: 29201
[  597.411220] binder: undelivered TRANSACTION_ERROR: 29201
[  597.412378] binder: undelivered TRANSACTION_ERROR: 29201
[  597.422195] binder: undelivered TRANSACTION_ERROR: 29201
[  597.432314] binder: 31732:31736 got transaction with invalid offset (0, min 24 max 40) or object.
[  597.432401] binder: 31732:31736 transaction failed 29201/-22, size 40-16 line 3197
[  597.433602] binder: BINDER_SET_CONTEXT_MGR already set
[  597.433610] binder: 31735:31738 ioctl 40046207 0 returned -16
[  597.435328] binder: 31735:31738 got transaction with invalid offset (0, min 24 max 40) or object.
[  597.435419] binder: 31735:31738 transaction failed 29201/-22, size 40-16 line 3197
[  597.445625] binder: undelivered TRANSACTION_ERROR: 29201
[  597.449471] binder: BINDER_SET_CONTEXT_MGR already set
[  597.449477] binder: 31737:31745 ioctl 40046207 0 returned -16
[  597.450850] binder_alloc: 31732: binder_alloc_buf, no vma
[  597.450895] binder: 31737:31745 transaction failed 29189/-3, size 40-16 line 3134
[  597.454373] binder: BINDER_SET_CONTEXT_MGR already set
[  597.454380] binder: 31741:31746 ioctl 40046207 0 returned -16
[  597.455207] binder_alloc: 31732: binder_alloc_buf, no vma
[  597.455242] binder: 31741:31746 transaction failed 29189/-3, size 40-16 line 3134
[  597.456236] binder: undelivered TRANSACTION_ERROR: 29201
[  597.463453] binder: 31740:31742 got transaction with invalid offset (0, min 24 max 40) or object.
[  597.463541] binder: 31740:31742 transaction failed 29201/-22, size 40-16 line 3197
[  597.469341] binder: BINDER_SET_CONTEXT_MGR already set
[  597.469348] binder: 31739:31744 ioctl 40046207 0 returned -16
[  597.471246] binder: 31739:31744 got transaction with invalid offset (0, min 24 max 40) or object.
[  597.471337] binder: 31739:31744 transaction failed 29201/-22, size 40-16 line 3197
[  597.479792] binder: undelivered TRANSACTION_ERROR: 29189
[  597.484376] binder: undelivered TRANSACTION_ERROR: 29189
[  597.495326] binder: undelivered TRANSACTION_ERROR: 29201
[  597.495692] binder: undelivered TRANSACTION_ERROR: 29201
[  597.510214] binder: undelivered TRANSACTION_ERROR: 29201
[  597.547148] binder: 31754:31763 got transaction with invalid offset (0, min 24 max 40) or object.
[  597.547241] binder: 31754:31763 transaction failed 29201/-22, size 40-16 line 3197
[  597.549139] binder: BINDER_SET_CONTEXT_MGR already set
[  597.549146] binder: 31756:31761 ioctl 40046207 0 returned -16
[  597.551595] binder: BINDER_SET_CONTEXT_MGR already set
[  597.551734] binder: 31755:31762 ioctl 40046207 0 returned -16
[  597.552624] binder: BINDER_SET_CONTEXT_MGR already set
[  597.552631] binder: 31757:31765 ioctl 40046207 0 returned -16
[  597.552964] binder: 31756:31761 got transaction with invalid offset (0, min 24 max 40) or object.
[  597.553054] binder: 31756:31761 transaction failed 29201/-22, size 40-16 line 3197
[  597.553818] binder: BINDER_SET_CONTEXT_MGR already set
[  597.553825] binder: 31753:31760 ioctl 40046207 0 returned -16
[  597.555669] binder: 31757:31765 got transaction with invalid offset (0, min 24 max 40) or object.
[  597.555840] binder: BINDER_SET_CONTEXT_MGR already set
[  597.555847] binder: 31758:31766 ioctl 40046207 0 returned -16
[  597.557421] binder: 31757:31765 transaction failed 29201/-22, size 40-16 line 3197
[  597.557880] binder: 31758:31766 got transaction with invalid offset (0, min 24 max 40) or object.
[  597.557974] binder: 31758:31766 transaction failed 29201/-22, size 40-16 line 3197
[  597.558479] binder: 31755:31762 got transaction with invalid offset (0, min 24 max 40) or object.
[  597.558564] binder: 31755:31762 transaction failed 29201/-22, size 40-16 line 3197
[  597.558602] binder: 31753:31760 got transaction with invalid offset (0, min 24 max 40) or object.
[  597.558687] binder: 31753:31760 transaction failed 29201/-22, size 40-16 line 3197
[  597.564234] binder: BINDER_SET_CONTEXT_MGR already set
[  597.564241] binder: 31752:31764 ioctl 40046207 0 returned -16
[  597.565100] binder: 31752:31764 got transaction with invalid offset (0, min 24 max 40) or object.
[  597.565188] binder: 31752:31764 transaction failed 29201/-22, size 40-16 line 3197
[  597.569863] binder: BINDER_SET_CONTEXT_MGR already set
[  597.569922] binder: 31759:31767 ioctl 40046207 0 returned -16
[  597.577711] binder: 31759:31767 got transaction with invalid offset (0, min 24 max 40) or object.
[  597.577797] binder: 31759:31767 transaction failed 29201/-22, size 40-16 line 3197
[  597.590376] binder: undelivered TRANSACTION_ERROR: 29201
[  597.591195] binder: undelivered TRANSACTION_ERROR: 29201
[  597.620608] binder: undelivered TRANSACTION_ERROR: 29201
[  597.625882] binder: undelivered TRANSACTION_ERROR: 29201
[  597.633762] binder: BINDER_SET_CONTEXT_MGR already set
[  597.633770] binder: 31777:31781 ioctl 40046207 0 returned -16
[  597.635103] binder: undelivered TRANSACTION_ERROR: 29201
[  597.635145] binder_alloc: 31754: binder_alloc_buf, no vma
[  597.635185] binder: 31777:31781 transaction failed 29189/-3, size 40-16 line 3134
[  597.642109] binder: 31780:31783 got transaction with invalid offset (0, min 24 max 40) or object.
[  597.642200] binder: 31780:31783 transaction failed 29201/-22, size 40-16 line 3197
[  597.654439] binder: undelivered TRANSACTION_ERROR: 29201
[  597.658474] binder: undelivered TRANSACTION_ERROR: 29201
[  597.660490] binder: undelivered TRANSACTION_ERROR: 29201
[  597.666977] binder: BINDER_SET_CONTEXT_MGR already set
[  597.666985] binder: 31784:31785 ioctl 40046207 0 returned -16
[  597.667590] binder: BINDER_SET_CONTEXT_MGR already set
[  597.667598] binder: 31778:31782 ioctl 40046207 0 returned -16
[  597.668099] binder: 31784:31785 got transaction with invalid offset (0, min 24 max 40) or object.
[  597.668179] binder: 31784:31785 transaction failed 29201/-22, size 40-16 line 3197
[  597.668750] binder: 31778:31782 got transaction with invalid offset (0, min 24 max 40) or object.
[  597.668838] binder: 31778:31782 transaction failed 29201/-22, size 40-16 line 3197
[  597.678195] binder: BINDER_SET_CONTEXT_MGR already set
[  597.678204] binder: 31789:31791 ioctl 40046207 0 returned -16
[  597.680045] binder: BINDER_SET_CONTEXT_MGR already set
[  597.680052] binder: 31787:31792 ioctl 40046207 0 returned -16
[  597.680962] binder: 31789:31791 got transaction with invalid offset (0, min 24 max 40) or object.
[  597.681050] binder: 31789:31791 transaction failed 29201/-22, size 40-16 line 3197
[  597.683559] binder: 31787:31792 got transaction with invalid offset (0, min 24 max 40) or object.
[  597.683645] binder: 31787:31792 transaction failed 29201/-22, size 40-16 line 3197
[  597.702445] binder: undelivered TRANSACTION_ERROR: 29201
[  597.712244] binder: undelivered TRANSACTION_ERROR: 29189
[  597.716862] binder: undelivered TRANSACTION_ERROR: 29201
[  597.725759] binder: BINDER_SET_CONTEXT_MGR already set
[  597.725766] binder: 31797:31801 ioctl 40046207 0 returned -16
[  597.726741] binder: 31797:31801 got transaction with invalid offset (0, min 24 max 40) or object.
[  597.726827] binder: 31797:31801 transaction failed 29201/-22, size 40-16 line 3197
[  597.737667] binder: undelivered TRANSACTION_ERROR: 29201
[  597.746028] binder: undelivered TRANSACTION_ERROR: 29201
[  597.761275] binder: undelivered TRANSACTION_ERROR: 29201
[  597.769574] binder_alloc: 31799: binder_alloc_buf, no vma
[  597.769611] binder: 31799:31802 transaction failed 29189/-3, size 40-16 line 3134
[  597.769898] binder: undelivered TRANSACTION_ERROR: 29201
[  597.781177] binder: undelivered TRANSACTION_ERROR: 29189
[  597.804573] binder: 31805:31812 got transaction with invalid offset (0, min 24 max 40) or object.
[  597.804661] binder: 31805:31812 transaction failed 29201/-22, size 40-16 line 3197
[  597.806948] binder: BINDER_SET_CONTEXT_MGR already set
[  597.806956] binder: 31804:31811 ioctl 40046207 0 returned -16
[  597.807995] binder: BINDER_SET_CONTEXT_MGR already set
[  597.808001] binder: 31803:31810 ioctl 40046207 0 returned -16
[  597.808169] binder: BINDER_SET_CONTEXT_MGR already set
[  597.808176] binder: 31807:31814 ioctl 40046207 0 returned -16
[  597.809204] binder: 31803:31810 got transaction with invalid offset (0, min 24 max 40) or object.
[  597.809290] binder: 31803:31810 transaction failed 29201/-22, size 40-16 line 3197
[  597.810524] binder: 31804:31811 got transaction with invalid offset (0, min 24 max 40) or object.
[  597.810606] binder: 31804:31811 transaction failed 29201/-22, size 40-16 line 3197
[  597.813177] binder_alloc: 31805: binder_alloc_buf, no vma
[  597.813214] binder: 31807:31814 transaction failed 29189/-3, size 40-16 line 3134
[  597.816992] binder: BINDER_SET_CONTEXT_MGR already set
[  597.816999] binder: 31806:31817 ioctl 40046207 0 returned -16
[  597.820689] binder: BINDER_SET_CONTEXT_MGR already set
[  597.820696] binder: 31813:31815 ioctl 40046207 0 returned -16
[  597.822972] binder: BINDER_SET_CONTEXT_MGR already set
[  597.822978] binder: 31808:31818 ioctl 40046207 0 returned -16
[  597.827604] binder_alloc: 31805: binder_alloc_buf, no vma
[  597.827642] binder: 31806:31817 transaction failed 29189/-3, size 40-16 line 3134
[  597.827883] binder_alloc: 31805: binder_alloc_buf, no vma
[  597.828217] binder_alloc: 31805: binder_alloc_buf, no vma
[  597.828255] binder: 31808:31818 transaction failed 29189/-3, size 40-16 line 3134
[  597.828437] binder: 31813:31815 transaction failed 29189/-3, size 40-16 line 3134
[  597.832657] binder: undelivered TRANSACTION_ERROR: 29201
[  597.834845] binder: 31809:31816 got transaction with invalid offset (0, min 24 max 40) or object.
[  597.834936] binder: 31809:31816 transaction failed 29201/-22, size 40-16 line 3197
[  597.856444] binder: undelivered TRANSACTION_ERROR: 29201
[  597.868056] binder: undelivered TRANSACTION_ERROR: 29201
[  597.881403] binder: undelivered TRANSACTION_ERROR: 29189
[  597.887726] binder: BINDER_SET_CONTEXT_MGR already set
[  597.887735] binder: 31831:31834 ioctl 40046207 0 returned -16
[  597.888522] binder_alloc: 31809: binder_alloc_buf, no vma
[  597.888607] binder: 31831:31834 transaction failed 29189/-3, size 40-16 line 3134
[  597.898087] binder: undelivered TRANSACTION_ERROR: 29201
[  597.898747] binder: undelivered TRANSACTION_ERROR: 29189
[  597.904908] binder: undelivered TRANSACTION_ERROR: 29189
[  597.911290] binder: BINDER_SET_CONTEXT_MGR already set
[  597.911297] binder: 31827:31832 ioctl 40046207 0 returned -16
[  597.913352] binder: undelivered TRANSACTION_ERROR: 29189
[  597.913769] binder: 31827:31832 got transaction with invalid offset (0, min 24 max 40) or object.
[  597.913911] binder: 31827:31832 transaction failed 29201/-22, size 40-16 line 3197
[  597.919671] binder: 31833:31835 got transaction with invalid offset (0, min 24 max 40) or object.
[  597.919757] binder: 31833:31835 transaction failed 29201/-22, size 40-16 line 3197
[  597.929044] binder: undelivered TRANSACTION_ERROR: 29201
[  597.939976] binder: BINDER_SET_CONTEXT_MGR already set
[  597.940071] binder: 31840:31847 ioctl 40046207 0 returned -16
[  597.943956] binder: 31840:31847 got transaction with invalid offset (0, min 24 max 40) or object.
[  597.944045] binder: 31840:31847 transaction failed 29201/-22, size 40-16 line 3197
[  597.946127] binder: BINDER_SET_CONTEXT_MGR already set
[  597.946135] binder: 31836:31844 ioctl 40046207 0 returned -16
[  597.947996] binder: BINDER_SET_CONTEXT_MGR already set
[  597.948003] binder: 31839:31846 ioctl 40046207 0 returned -16
[  597.949311] binder: BINDER_SET_CONTEXT_MGR already set
[  597.949317] binder: 31841:31845 ioctl 40046207 0 returned -16
[  597.950319] binder: 31839:31846 got transaction with invalid offset (0, min 24 max 40) or object.
[  597.950404] binder: 31839:31846 transaction failed 29201/-22, size 40-16 line 3197
[  597.952651] binder: 31836:31844 got transaction with invalid offset (0, min 24 max 40) or object.
[  597.952733] binder: 31836:31844 transaction failed 29201/-22, size 40-16 line 3197
[  597.954872] binder: 31841:31845 got transaction with invalid offset (0, min 24 max 40) or object.
[  597.954953] binder: 31841:31845 transaction failed 29201/-22, size 40-16 line 3197
[  597.960591] binder: undelivered TRANSACTION_ERROR: 29189
[  597.971611] binder: undelivered TRANSACTION_ERROR: 29201
[  597.978863] binder: undelivered TRANSACTION_ERROR: 29201
[  597.990726] binder: 31848:31853 got transaction with invalid offset (0, min 24 max 40) or object.
[  597.990833] binder: 31848:31853 transaction failed 29201/-22, size 40-16 line 3197
[  598.005390] binder: undelivered TRANSACTION_ERROR: 29201
[  598.010332] binder: undelivered TRANSACTION_ERROR: 29201
[  598.011079] binder: undelivered TRANSACTION_ERROR: 29201
[  598.017912] binder: undelivered TRANSACTION_ERROR: 29201
[  598.055155] binder: BINDER_SET_CONTEXT_MGR already set
[  598.055163] binder: 31858:31866 ioctl 40046207 0 returned -16
[  598.055243] binder: 31861:31865 got transaction with invalid offset (0, min 24 max 40) or object.
[  598.055334] binder: 31861:31865 transaction failed 29201/-22, size 40-16 line 3197
[  598.060722] binder: 31858:31866 got transaction with invalid offset (0, min 24 max 40) or object.
[  598.060812] binder: 31858:31866 transaction failed 29201/-22, size 40-16 line 3197
[  598.062021] binder: BINDER_SET_CONTEXT_MGR already set
[  598.062027] binder: 31860:31870 ioctl 40046207 0 returned -16
[  598.062274] binder: BINDER_SET_CONTEXT_MGR already set
[  598.062280] binder: 31859:31869 ioctl 40046207 0 returned -16
[  598.063187] binder: 31860:31870 got transaction with invalid offset (0, min 24 max 40) or object.
[  598.063278] binder: 31860:31870 transaction failed 29201/-22, size 40-16 line 3197
[  598.066285] binder: 31859:31869 got transaction with invalid offset (0, min 24 max 40) or object.
[  598.066373] binder: 31859:31869 transaction failed 29201/-22, size 40-16 line 3197
[  598.066659] binder: BINDER_SET_CONTEXT_MGR already set
[  598.066666] binder: 31862:31868 ioctl 40046207 0 returned -16
[  598.066819] binder: BINDER_SET_CONTEXT_MGR already set
[  598.066824] binder: 31864:31871 ioctl 40046207 0 returned -16
[  598.069708] binder: 31862:31868 got transaction with invalid offset (0, min 24 max 40) or object.
[  598.069780] binder: 31862:31868 transaction failed 29201/-22, size 40-16 line 3197
[  598.069800] binder: 31864:31871 got transaction with invalid offset (0, min 24 max 40) or object.
[  598.069911] binder: 31864:31871 transaction failed 29201/-22, size 40-16 line 3197
[  598.078244] binder: BINDER_SET_CONTEXT_MGR already set
[  598.078251] binder: 31863:31872 ioctl 40046207 0 returned -16
[  598.086929] binder: undelivered TRANSACTION_ERROR: 29201
[  598.091040] binder: BINDER_SET_CONTEXT_MGR already set
[  598.091053] binder: 31867:31876 ioctl 40046207 0 returned -16
[  598.093149] binder: 31867:31876 got transaction with invalid offset (0, min 24 max 40) or object.
[  598.094590] binder: 31867:31876 transaction failed 29201/-22, size 40-16 line 3197
[  598.097052] binder: 31863:31872 got transaction with invalid offset (0, min 24 max 40) or object.
[  598.097141] binder: 31863:31872 transaction failed 29201/-22, size 40-16 line 3197
[  598.111140] binder: undelivered TRANSACTION_ERROR: 29201
[  598.116599] binder: undelivered TRANSACTION_ERROR: 29201
[  598.135107] binder: undelivered TRANSACTION_ERROR: 29201
[  598.135188] binder: undelivered TRANSACTION_ERROR: 29201
[  598.151002] binder: undelivered TRANSACTION_ERROR: 29201
[  598.157169] binder: 31884:31886 got transaction with invalid offset (0, min 24 max 40) or object.
[  598.157260] binder: 31884:31886 transaction failed 29201/-22, size 40-16 line 3197
[  598.167029] binder: BINDER_SET_CONTEXT_MGR already set
[  598.167036] binder: 31887:31895 ioctl 40046207 0 returned -16
[  598.168675] binder: 31887:31895 got transaction with invalid offset (0, min 24 max 40) or object.
[  598.168855] binder: 31887:31895 transaction failed 29201/-22, size 40-16 line 3197
[  598.168966] binder: undelivered TRANSACTION_ERROR: 29201
[  598.172811] binder: BINDER_SET_CONTEXT_MGR already set
[  598.172817] binder: 31890:31894 ioctl 40046207 0 returned -16
[  598.175937] binder_alloc: 31884: binder_alloc_buf, no vma
[  598.175976] binder: 31890:31894 transaction failed 29189/-3, size 40-16 line 3134
[  598.184460] binder: undelivered TRANSACTION_ERROR: 29201
[  598.191041] binder: 31892:31897 got transaction with invalid offset (0, min 24 max 40) or object.
[  598.191134] binder: 31892:31897 transaction failed 29201/-22, size 40-16 line 3197
[  598.194161] binder: undelivered TRANSACTION_ERROR: 29201
[  598.197740] binder: BINDER_SET_CONTEXT_MGR already set
[  598.197746] binder: 31893:31898 ioctl 40046207 0 returned -16
[  598.199639] binder: 31893:31898 got transaction with invalid offset (0, min 24 max 40) or object.
[  598.199730] binder: 31893:31898 transaction failed 29201/-22, size 40-16 line 3197
[  598.206725] binder: BINDER_SET_CONTEXT_MGR already set
[  598.206733] binder: 31896:31901 ioctl 40046207 0 returned -16
[  598.207923] binder: 31896:31901 got transaction with invalid offset (0, min 24 max 40) or object.
[  598.208014] binder: 31896:31901 transaction failed 29201/-22, size 40-16 line 3197
[  598.226374] binder: undelivered TRANSACTION_ERROR: 29189
[  598.226789] binder: undelivered TRANSACTION_ERROR: 29201
[  598.242039] binder: BINDER_SET_CONTEXT_MGR already set
[  598.242046] binder: 31906:31910 ioctl 40046207 0 returned -16
[  598.243019] binder: 31906:31910 got transaction with invalid offset (0, min 24 max 40) or object.
[  598.243107] binder: 31906:31910 transaction failed 29201/-22, size 40-16 line 3197
[  598.248446] binder: undelivered TRANSACTION_ERROR: 29201
[  598.252784] binder: undelivered TRANSACTION_ERROR: 29201
[  598.265860] binder: undelivered TRANSACTION_ERROR: 29201
[  598.268864] binder: undelivered TRANSACTION_ERROR: 29201
[  598.303132] binder: BINDER_SET_CONTEXT_MGR already set
[  598.303140] binder: 31916:31922 ioctl 40046207 0 returned -16
[  598.305389] binder: 31916:31922 got transaction with invalid offset (0, min 24 max 40) or object.
[  598.307050] binder: 31914:31923 got transaction with invalid offset (0, min 24 max 40) or object.
[  598.307134] binder: 31914:31923 transaction failed 29201/-22, size 40-16 line 3197
[  598.308042] binder: 31916:31922 transaction failed 29201/-22, size 40-16 line 3197
[  598.308511] binder: BINDER_SET_CONTEXT_MGR already set
[  598.308519] binder: 31918:31920 ioctl 40046207 0 returned -16
[  598.311320] binder: 31918:31920 got transaction with invalid offset (0, min 24 max 40) or object.
[  598.311405] binder: 31918:31920 transaction failed 29201/-22, size 40-16 line 3197
[  598.312324] binder: BINDER_SET_CONTEXT_MGR already set
[  598.312331] binder: 31913:31921 ioctl 40046207 0 returned -16
[  598.313907] binder: BINDER_SET_CONTEXT_MGR already set
[  598.313913] binder: 31915:31924 ioctl 40046207 0 returned -16
[  598.314689] binder: BINDER_SET_CONTEXT_MGR already set
[  598.314695] binder: 31912:31925 ioctl 40046207 0 returned -16
[  598.315814] binder: 31912:31925 got transaction with invalid offset (0, min 24 max 40) or object.
[  598.315901] binder: 31912:31925 transaction failed 29201/-22, size 40-16 line 3197
[  598.316571] binder: 31913:31921 got transaction with invalid offset (0, min 24 max 40) or object.
[  598.316654] binder: 31913:31921 transaction failed 29201/-22, size 40-16 line 3197
[  598.317702] binder: 31915:31924 got transaction with invalid offset (0, min 24 max 40) or object.
[  598.317786] binder: 31915:31924 transaction failed 29201/-22, size 40-16 line 3197
[  598.326187] binder: BINDER_SET_CONTEXT_MGR already set
[  598.326195] binder: 31917:31926 ioctl 40046207 0 returned -16
[  598.329304] binder: BINDER_SET_CONTEXT_MGR already set
[  598.329312] binder: 31919:31927 ioctl 40046207 0 returned -16
[  598.330931] binder: 31919:31927 got transaction with invalid offset (0, min 24 max 40) or object.
[  598.331019] binder: 31919:31927 transaction failed 29201/-22, size 40-16 line 3197
[  598.335280] binder: 31917:31926 got transaction with invalid offset (0, min 24 max 40) or object.
[  598.337276] binder: 31917:31926 transaction failed 29201/-22, size 40-16 line 3197
[  598.346254] binder: undelivered TRANSACTION_ERROR: 29201
[  598.358909] binder: undelivered TRANSACTION_ERROR: 29201
[  598.377042] binder: undelivered TRANSACTION_ERROR: 29201
[  598.391973] binder: undelivered TRANSACTION_ERROR: 29201
[  598.397784] binder: undelivered TRANSACTION_ERROR: 29201
[  598.400991] binder: undelivered TRANSACTION_ERROR: 29201
[  598.409538] binder: BINDER_SET_CONTEXT_MGR already set
[  598.409545] binder: 31940:31945 ioctl 40046207 0 returned -16
[  598.410328] binder: BINDER_SET_CONTEXT_MGR already set
[  598.410344] binder: 31937:31943 ioctl 40046207 0 returned -16
[  598.412715] binder: 31942:31944 got transaction with invalid offset (0, min 24 max 40) or object.
[  598.413422] binder: 31942:31944 transaction failed 29201/-22, size 40-16 line 3197
[  598.413728] binder: 31940:31945 got transaction with invalid offset (0, min 24 max 40) or object.
[  598.413810] binder: 31940:31945 transaction failed 29201/-22, size 40-16 line 3197
[  598.416349] binder: undelivered TRANSACTION_ERROR: 29201
[  598.416644] binder: 31937:31943 got transaction with invalid offset (0, min 24 max 40) or object.
[  598.416728] binder: 31937:31943 transaction failed 29201/-22, size 40-16 line 3197
[  598.426645] binder: undelivered TRANSACTION_ERROR: 29201
[  598.450937] binder: undelivered TRANSACTION_ERROR: 29201
[  598.457576] binder: BINDER_SET_CONTEXT_MGR already set
[  598.457589] binder: 31941:31949 ioctl 40046207 0 returned -16
[  598.457830] binder: BINDER_SET_CONTEXT_MGR already set
[  598.457841] binder: 31950:31954 ioctl 40046207 0 returned -16
[  598.458524] binder: BINDER_SET_CONTEXT_MGR already set
[  598.458530] binder: 31946:31953 ioctl 40046207 0 returned -16
[  598.458893] binder: 31950:31954 got transaction with invalid offset (0, min 24 max 40) or object.
[  598.458982] binder: 31950:31954 transaction failed 29201/-22, size 40-16 line 3197
[  598.461246] binder: 31941:31949 got transaction with invalid offset (0, min 24 max 40) or object.
[  598.461332] binder: 31941:31949 transaction failed 29201/-22, size 40-16 line 3197
[  598.462355] binder: 31946:31953 got transaction with invalid offset (0, min 24 max 40) or object.
[  598.462437] binder: 31946:31953 transaction failed 29201/-22, size 40-16 line 3197
[  598.468135] binder: BINDER_SET_CONTEXT_MGR already set
[  598.468142] binder: 31951:31955 ioctl 40046207 0 returned -16
[  598.468922] binder: undelivered TRANSACTION_ERROR: 29201
[  598.470177] binder: undelivered TRANSACTION_ERROR: 29201
[  598.476889] binder: 31951:31955 transaction failed 29189/-22, size 40-16 line 3011
[  598.496762] binder: undelivered TRANSACTION_ERROR: 29201
[  598.504897] binder: undelivered TRANSACTION_ERROR: 29201
[  598.514932] binder: undelivered TRANSACTION_ERROR: 29189
[  598.524868] binder: undelivered TRANSACTION_ERROR: 29201
[  598.564035] binder: 31964:31971 got transaction with invalid offset (0, min 24 max 40) or object.
[  598.564133] binder: 31964:31971 transaction failed 29201/-22, size 40-16 line 3197
[  598.564465] binder: BINDER_SET_CONTEXT_MGR already set
[  598.564472] binder: 31967:31974 ioctl 40046207 0 returned -16
[  598.566584] binder: 31967:31974 got transaction with invalid offset (0, min 24 max 40) or object.
[  598.566667] binder: 31967:31974 transaction failed 29201/-22, size 40-16 line 3197
[  598.567041] binder: BINDER_SET_CONTEXT_MGR already set
[  598.567047] binder: 31966:31972 ioctl 40046207 0 returned -16
[  598.567415] binder: BINDER_SET_CONTEXT_MGR already set
[  598.567422] binder: 31968:31973 ioctl 40046207 0 returned -16
[  598.567592] binder: BINDER_SET_CONTEXT_MGR already set
[  598.567598] binder: 31963:31976 ioctl 40046207 0 returned -16
[  598.567933] binder: BINDER_SET_CONTEXT_MGR already set
[  598.567940] binder: 31969:31975 ioctl 40046207 0 returned -16
[  598.568649] binder: 31963:31976 got transaction with invalid offset (0, min 24 max 40) or object.
[  598.570410] binder: 31963:31976 transaction failed 29201/-22, size 40-16 line 3197
[  598.570888] binder: 31966:31972 got transaction with invalid offset (0, min 24 max 40) or object.
[  598.573322] binder: 31966:31972 transaction failed 29201/-22, size 40-16 line 3197
[  598.573587] binder: 31968:31973 got transaction with invalid offset (0, min 24 max 40) or object.
[  598.573634] binder: 31969:31975 got transaction with invalid offset (0, min 24 max 40) or object.
[  598.573659] binder: 31968:31973 transaction failed 29201/-22, size 40-16 line 3197
[  598.573737] binder: 31969:31975 transaction failed 29201/-22, size 40-16 line 3197
[  598.583305] binder: BINDER_SET_CONTEXT_MGR already set
[  598.583314] binder: 31965:31977 ioctl 40046207 0 returned -16
[  598.584354] binder: 31965:31977 got transaction with invalid offset (0, min 24 max 40) or object.
[  598.584440] binder: 31965:31977 transaction failed 29201/-22, size 40-16 line 3197
[  598.599105] binder: undelivered TRANSACTION_ERROR: 29201
[  598.618938] binder: undelivered TRANSACTION_ERROR: 29201
[  598.641817] binder: undelivered TRANSACTION_ERROR: 29201
[  598.642212] binder: undelivered TRANSACTION_ERROR: 29201
[  598.644211] binder: undelivered TRANSACTION_ERROR: 29201
[  598.644560] binder: undelivered TRANSACTION_ERROR: 29201
[  598.648419] binder: 31989:31990 got transaction with invalid offset (0, min 24 max 40) or object.
[  598.648514] binder: 31989:31990 transaction failed 29201/-22, size 40-16 line 3197
[  598.674490] binder: BINDER_SET_CONTEXT_MGR already set
[  598.674499] binder: 31991:31992 ioctl 40046207 0 returned -16
[  598.677292] binder_alloc: 31989: binder_alloc_buf, no vma
[  598.677335] binder: 31991:31992 transaction failed 29189/-3, size 40-16 line 3134
[  598.681799] binder: undelivered TRANSACTION_ERROR: 29201
[  598.695748] binder: BINDER_SET_CONTEXT_MGR already set
[  598.695756] binder: 31996:31998 ioctl 40046207 0 returned -16
[  598.696033] binder: BINDER_SET_CONTEXT_MGR already set
[  598.696039] binder: 31995:31999 ioctl 40046207 0 returned -16
[  598.699602] binder: 31996:31998 got transaction with invalid offset (0, min 24 max 40) or object.
[  598.699688] binder: 31996:31998 transaction failed 29201/-22, size 40-16 line 3197
[  598.699899] binder: undelivered TRANSACTION_ERROR: 29201
[  598.703068] binder: 31995:31999 got transaction with invalid offset (0, min 24 max 40) or object.
[  598.703227] binder: 31995:31999 transaction failed 29201/-22, size 40-16 line 3197
[  598.704672] binder: 31994:32002 got transaction with invalid offset (0, min 24 max 40) or object.
[  598.704811] binder: 31994:32002 transaction failed 29201/-22, size 40-16 line 3197
[  598.715855] binder: BINDER_SET_CONTEXT_MGR already set
[  598.715864] binder: 31997:32005 ioctl 40046207 0 returned -16
[  598.717151] binder: 31997:32005 got transaction with invalid offset (0, min 24 max 40) or object.
[  598.717238] binder: 31997:32005 transaction failed 29201/-22, size 40-16 line 3197
[  598.724513] binder: BINDER_SET_CONTEXT_MGR already set
[  598.724522] binder: 32004:32012 ioctl 40046207 0 returned -16
[  598.725672] binder: 32004:32012 got transaction with invalid offset (0, min 24 max 40) or object.
[  598.725756] binder: 32004:32012 transaction failed 29201/-22, size 40-16 line 3197
[  598.735143] binder: undelivered TRANSACTION_ERROR: 29189
[  598.757154] binder: undelivered TRANSACTION_ERROR: 29201
[  598.757508] binder: undelivered TRANSACTION_ERROR: 29201
[  598.760969] binder: undelivered TRANSACTION_ERROR: 29201
[  598.771434] binder: undelivered TRANSACTION_ERROR: 29201
[  598.780748] binder: 32011:32017 got transaction with invalid offset (0, min 24 max 40) or object.
[  598.780836] binder: 32011:32017 transaction failed 29201/-22, size 40-16 line 3197
[  598.798180] binder: undelivered TRANSACTION_ERROR: 29201
[  598.807489] binder: undelivered TRANSACTION_ERROR: 29201
[  598.831683] binder: 32027:32031 got transaction with invalid offset (0, min 24 max 40) or object.
[  598.832316] binder: 32027:32031 transaction failed 29201/-22, size 40-16 line 3197
[  598.832874] binder: BINDER_SET_CONTEXT_MGR already set
[  598.832881] binder: 32024:32029 ioctl 40046207 0 returned -16
[  598.833285] binder: BINDER_SET_CONTEXT_MGR already set
[  598.833292] binder: 32021:32030 ioctl 40046207 0 returned -16
[  598.836480] binder: BINDER_SET_CONTEXT_MGR already set
[  598.836488] binder: 32022:32033 ioctl 40046207 0 returned -16
[  598.837373] binder: 32024:32029 got transaction with invalid offset (0, min 24 max 40) or object.
[  598.837461] binder: 32024:32029 transaction failed 29201/-22, size 40-16 line 3197
[  598.837626] binder: 32022:32033 got transaction with invalid offset (0, min 24 max 40) or object.
[  598.837709] binder: 32022:32033 transaction failed 29201/-22, size 40-16 line 3197
[  598.838798] binder: 32021:32030 got transaction with invalid offset (0, min 24 max 40) or object.
[  598.838886] binder: 32021:32030 transaction failed 29201/-22, size 40-16 line 3197
[  598.841889] binder: BINDER_SET_CONTEXT_MGR already set
[  598.841897] binder: 32025:32034 ioctl 40046207 0 returned -16
[  598.843111] binder: BINDER_SET_CONTEXT_MGR already set
[  598.843119] binder: 32026:32032 ioctl 40046207 0 returned -16
[  598.845136] binder: 32026:32032 got transaction with invalid offset (0, min 24 max 40) or object.
[  598.845225] binder: 32026:32032 transaction failed 29201/-22, size 40-16 line 3197
[  598.846758] binder: 32025:32034 got transaction with invalid offset (0, min 24 max 40) or object.
[  598.846951] binder: 32025:32034 transaction failed 29201/-22, size 40-16 line 3197
[  598.851457] binder: BINDER_SET_CONTEXT_MGR already set
[  598.851464] binder: 32023:32035 ioctl 40046207 0 returned -16
[  598.856477] binder: 32023:32035 got transaction with invalid offset (0, min 24 max 40) or object.
[  598.856570] binder: BINDER_SET_CONTEXT_MGR already set
[  598.856577] binder: 32028:32036 ioctl 40046207 0 returned -16
[  598.857556] binder: 32028:32036 got transaction with invalid offset (0, min 24 max 40) or object.
[  598.859331] binder: 32023:32035 transaction failed 29201/-22, size 40-16 line 3197
[  598.859522] binder: 32028:32036 transaction failed 29201/-22, size 40-16 line 3197
[  598.872851] binder: undelivered TRANSACTION_ERROR: 29201
[  598.913392] binder: undelivered TRANSACTION_ERROR: 29201
[  598.915803] binder: undelivered TRANSACTION_ERROR: 29201
[  598.916243] binder: undelivered TRANSACTION_ERROR: 29201
[  598.917326] binder: undelivered TRANSACTION_ERROR: 29201
[  598.940679] binder: undelivered TRANSACTION_ERROR: 29201
[  598.950129] binder: 32048:32050 got transaction with invalid offset (0, min 24 max 40) or object.
[  598.950220] binder: 32048:32050 transaction failed 29201/-22, size 40-16 line 3197
[  598.950983] binder: BINDER_SET_CONTEXT_MGR already set
[  598.950991] binder: 32052:32057 ioctl 40046207 0 returned -16
[  598.954782] binder: BINDER_SET_CONTEXT_MGR already set
[  598.954789] binder: 32053:32056 ioctl 40046207 0 returned -16
[  598.957044] binder: undelivered TRANSACTION_ERROR: 29201
[  598.957440] binder: 32052:32057 got transaction with invalid offset (0, min 24 max 40) or object.
[  598.957532] binder: 32052:32057 transaction failed 29201/-22, size 40-16 line 3197
[  598.957607] binder: undelivered TRANSACTION_ERROR: 29201
[  598.960848] binder: 32053:32056 got transaction with invalid offset (0, min 24 max 40) or object.
[  598.960937] binder: 32053:32056 transaction failed 29201/-22, size 40-16 line 3197
[  598.967515] binder: BINDER_SET_CONTEXT_MGR already set
[  598.967522] binder: 32054:32059 ioctl 40046207 0 returned -16
[  598.970892] binder: 32054:32059 got transaction with invalid offset (0, min 24 max 40) or object.
[  598.970976] binder: 32054:32059 transaction failed 29201/-22, size 40-16 line 3197
[  598.977368] binder: BINDER_SET_CONTEXT_MGR already set
[  598.977375] binder: 32055:32060 ioctl 40046207 0 returned -16
[  598.980572] binder_alloc: 32048: binder_alloc_buf, no vma
[  598.980613] binder: 32055:32060 transaction failed 29189/-3, size 40-16 line 3134
[  598.987882] binder: undelivered TRANSACTION_ERROR: 29201
[  598.997288] binder: 32061:32065 got transaction with invalid offset (0, min 24 max 40) or object.
[  598.997388] binder: 32061:32065 transaction failed 29201/-22, size 40-16 line 3197
[  599.015257] binder: undelivered TRANSACTION_ERROR: 29201
[  599.016444] binder: BINDER_SET_CONTEXT_MGR already set
[  599.016451] binder: 32067:32073 ioctl 40046207 0 returned -16
[  599.018132] binder: 32067:32073 got transaction with invalid offset (0, min 24 max 40) or object.
[  599.018217] binder: 32067:32073 transaction failed 29201/-22, size 40-16 line 3197
[  599.026449] binder: undelivered TRANSACTION_ERROR: 29201
[  599.043709] binder: undelivered TRANSACTION_ERROR: 29201
[  599.051932] binder: undelivered TRANSACTION_ERROR: 29189
[  599.061676] binder: undelivered TRANSACTION_ERROR: 29201
[  599.073252] binder: 32070:32077 got transaction with invalid offset (0, min 24 max 40) or object.
[  599.073340] binder: 32070:32077 transaction failed 29201/-22, size 40-16 line 3197
[  599.079936] binder: undelivered TRANSACTION_ERROR: 29201
[  599.081148] binder: undelivered TRANSACTION_ERROR: 29201
[  599.125670] binder: 32081:32085 got transaction with invalid offset (0, min 24 max 40) or object.
[  599.125762] binder: 32081:32085 transaction failed 29201/-22, size 40-16 line 3197
[  599.131546] binder: BINDER_SET_CONTEXT_MGR already set
[  599.131554] binder: 32086:32088 ioctl 40046207 0 returned -16
[  599.134350] binder: 32086:32088 got transaction with invalid offset (0, min 24 max 40) or object.
[  599.134662] binder: 32086:32088 transaction failed 29201/-22, size 40-16 line 3197
[  599.138768] binder: BINDER_SET_CONTEXT_MGR already set
[  599.138776] binder: 32082:32087 ioctl 40046207 0 returned -16
[  599.140190] binder: 32082:32087 got transaction with invalid offset (0, min 24 max 40) or object.
[  599.140283] binder: 32082:32087 transaction failed 29201/-22, size 40-16 line 3197
[  599.140433] binder: BINDER_SET_CONTEXT_MGR already set
[  599.140439] binder: 32083:32089 ioctl 40046207 0 returned -16
[  599.141973] binder: 32083:32089 got transaction with invalid offset (0, min 24 max 40) or object.
[  599.142063] binder: 32083:32089 transaction failed 29201/-22, size 40-16 line 3197
[  599.148124] binder: BINDER_SET_CONTEXT_MGR already set
[  599.148132] binder: 32080:32093 ioctl 40046207 0 returned -16
[  599.154570] binder: 32080:32093 got transaction with invalid offset (0, min 24 max 40) or object.
[  599.155550] binder: 32080:32093 transaction failed 29201/-22, size 40-16 line 3197
[  599.160591] binder: BINDER_SET_CONTEXT_MGR already set
[  599.160598] binder: 32084:32091 ioctl 40046207 0 returned -16
[  599.162071] binder: 32084:32091 got transaction with invalid offset (0, min 24 max 40) or object.
[  599.162157] binder: 32084:32091 transaction failed 29201/-22, size 40-16 line 3197
[  599.163377] binder: undelivered TRANSACTION_ERROR: 29201
[  599.166334] binder: undelivered TRANSACTION_ERROR: 29201
[  599.189001] binder: undelivered TRANSACTION_ERROR: 29201
[  599.202460] binder: BINDER_SET_CONTEXT_MGR already set
[  599.202719] binder: 32104:32110 got transaction with invalid offset (0, min 24 max 40) or object.
[  599.202808] binder: 32104:32110 transaction failed 29201/-22, size 40-16 line 3197
[  599.202946] binder: 32103:32109 ioctl 40046207 0 returned -16
[  599.204538] binder: 32103:32109 got transaction with invalid offset (0, min 24 max 40) or object.
[  599.204627] binder: 32103:32109 transaction failed 29201/-22, size 40-16 line 3197
[  599.205618] binder: BINDER_SET_CONTEXT_MGR already set
[  599.205625] binder: 32092:32097 ioctl 40046207 0 returned -16
[  599.207591] binder: BINDER_SET_CONTEXT_MGR already set
[  599.207599] binder: 32090:32098 ioctl 40046207 0 returned -16
[  599.210293] binder: 32092:32097 got transaction with invalid offset (0, min 24 max 40) or object.
[  599.210375] binder: 32092:32097 transaction failed 29201/-22, size 40-16 line 3197
[  599.218344] binder: undelivered TRANSACTION_ERROR: 29201
[  599.218427] binder: undelivered TRANSACTION_ERROR: 29201
[  599.218504] binder: undelivered TRANSACTION_ERROR: 29201
[  599.247072] binder_alloc: 32104: binder_alloc_buf, no vma
[  599.247113] binder: 32090:32098 transaction failed 29189/-3, size 40-16 line 3134
[  599.249795] binder: undelivered TRANSACTION_ERROR: 29201
[  599.255889] binder: undelivered TRANSACTION_ERROR: 29201
[  599.269548] binder: 32111:32116 got transaction with invalid offset (0, min 24 max 40) or object.
[  599.269636] binder: 32111:32116 transaction failed 29201/-22, size 40-16 line 3197
[  599.274982] binder: BINDER_SET_CONTEXT_MGR already set
[  599.274990] binder: 32113:32118 ioctl 40046207 0 returned -16
[  599.275629] binder: BINDER_SET_CONTEXT_MGR already set
[  599.275636] binder: 32114:32119 ioctl 40046207 0 returned -16
[  599.277771] binder: 32113:32118 got transaction with invalid offset (0, min 24 max 40) or object.
[  599.277857] binder: 32113:32118 transaction failed 29201/-22, size 40-16 line 3197
[  599.278851] binder: 32114:32119 got transaction with invalid offset (0, min 24 max 40) or object.
[  599.278935] binder: 32114:32119 transaction failed 29201/-22, size 40-16 line 3197
[  599.280981] binder: undelivered TRANSACTION_ERROR: 29201
[  599.283291] binder: BINDER_SET_CONTEXT_MGR already set
[  599.283298] binder: 32115:32120 ioctl 40046207 0 returned -16
[  599.285126] binder: 32115:32120 got transaction with invalid offset (0, min 24 max 40) or object.
[  599.285264] binder: 32115:32120 transaction failed 29201/-22, size 40-16 line 3197
[  599.300408] binder: undelivered TRANSACTION_ERROR: 29201
[  599.311675] binder: undelivered TRANSACTION_ERROR: 29189
[  599.337327] binder: undelivered TRANSACTION_ERROR: 29201
[  599.344025] binder: undelivered TRANSACTION_ERROR: 29201
[  599.352407] binder: undelivered TRANSACTION_ERROR: 29201
[  599.389289] binder: 32129:32132 got transaction with invalid offset (0, min 24 max 40) or object.
[  599.389376] binder: 32129:32132 transaction failed 29201/-22, size 40-16 line 3197
[  599.390238] binder: BINDER_SET_CONTEXT_MGR already set
[  599.390246] binder: 32131:32137 ioctl 40046207 0 returned -16
[  599.394425] binder: BINDER_SET_CONTEXT_MGR already set
[  599.394433] binder: 32134:32138 ioctl 40046207 0 returned -16
[  599.394661] binder: 32131:32137 got transaction with invalid offset (0, min 24 max 40) or object.
[  599.394749] binder: 32131:32137 transaction failed 29201/-22, size 40-16 line 3197
[  599.394925] binder: BINDER_SET_CONTEXT_MGR already set
[  599.394932] binder: 32130:32135 ioctl 40046207 0 returned -16
[  599.395959] binder: 32130:32135 got transaction with invalid offset (0, min 24 max 40) or object.
[  599.396036] binder: 32130:32135 transaction failed 29201/-22, size 40-16 line 3197
[  599.401558] binder: BINDER_SET_CONTEXT_MGR already set
[  599.401565] binder: 32128:32141 ioctl 40046207 0 returned -16
[  599.404918] binder: 32128:32141 got transaction with invalid offset (0, min 24 max 40) or object.
[  599.405014] binder: 32128:32141 transaction failed 29201/-22, size 40-16 line 3197
[  599.408109] binder: 32134:32138 got transaction with invalid offset (0, min 24 max 40) or object.
[  599.408199] binder: 32134:32138 transaction failed 29201/-22, size 40-16 line 3197
[  599.408253] binder: BINDER_SET_CONTEXT_MGR already set
[  599.408260] binder: 32139:32142 ioctl 40046207 0 returned -16
[  599.408978] binder: BINDER_SET_CONTEXT_MGR already set
[  599.408986] binder: 32136:32140 ioctl 40046207 0 returned -16
[  599.414952] binder: 32136:32140 got transaction with invalid offset (0, min 24 max 40) or object.
[  599.415040] binder: 32136:32140 transaction failed 29201/-22, size 40-16 line 3197
[  599.417158] binder: 32139:32142 got transaction with invalid offset (0, min 24 max 40) or object.
[  599.417260] binder: 32139:32142 transaction failed 29201/-22, size 40-16 line 3197
[  599.431500] binder: BINDER_SET_CONTEXT_MGR already set
[  599.431508] binder: 32133:32143 ioctl 40046207 0 returned -16
[  599.432702] binder: undelivered TRANSACTION_ERROR: 29201
[  599.435646] binder: undelivered TRANSACTION_ERROR: 29201
[  599.457502] binder: 32133:32143 got transaction with invalid offset (0, min 24 max 40) or object.
[  599.457590] binder: 32133:32143 transaction failed 29201/-22, size 40-16 line 3197
[  599.464658] binder: undelivered TRANSACTION_ERROR: 29201
[  599.476123] binder: 32152:32155 got transaction with invalid offset (0, min 24 max 40) or object.
[  599.476219] binder: 32152:32155 transaction failed 29201/-22, size 40-16 line 3197
[  599.476408] binder: BINDER_SET_CONTEXT_MGR already set
[  599.476415] binder: 32153:32156 ioctl 40046207 0 returned -16
[  599.491454] binder: undelivered TRANSACTION_ERROR: 29201
[  599.492921] binder: 32153:32156 got transaction with invalid offset (0, min 24 max 40) or object.
[  599.493013] binder: 32153:32156 transaction failed 29201/-22, size 40-16 line 3197
[  599.505988] binder: undelivered TRANSACTION_ERROR: 29201
[  599.506377] binder: undelivered TRANSACTION_ERROR: 29201
[  599.508588] binder: undelivered TRANSACTION_ERROR: 29201
[  599.515447] binder: undelivered TRANSACTION_ERROR: 29201
[  599.519472] binder_alloc: 32157: binder_alloc_buf, no vma
[  599.519513] binder: 32157:32160 transaction failed 29189/-3, size 40-16 line 3134
[  599.533703] binder: undelivered TRANSACTION_ERROR: 29201
[  599.535972] binder: undelivered TRANSACTION_ERROR: 29189
[  599.560828] binder: 32164:32166 got transaction with invalid offset (0, min 24 max 40) or object.
[  599.560912] binder: 32164:32166 transaction failed 29201/-22, size 40-16 line 3197
[  599.561311] binder: BINDER_SET_CONTEXT_MGR already set
[  599.561318] binder: 32163:32165 ioctl 40046207 0 returned -16
[  599.564469] binder: 32163:32165 got transaction with invalid offset (0, min 24 max 40) or object.
[  599.564546] binder: 32163:32165 transaction failed 29201/-22, size 40-16 line 3197
[  599.566148] binder: BINDER_SET_CONTEXT_MGR already set
[  599.566155] binder: 32162:32168 ioctl 40046207 0 returned -16
[  599.569553] binder_alloc: 32164: binder_alloc_buf, no vma
[  599.569591] binder: 32162:32168 transaction failed 29189/-3, size 40-16 line 3134
[  599.573922] binder: undelivered TRANSACTION_ERROR: 29201
[  599.574911] binder: undelivered TRANSACTION_ERROR: 29201
[  599.580861] binder: 32169:32171 got transaction with invalid offset (0, min 24 max 40) or object.
[  599.580952] binder: 32169:32171 transaction failed 29201/-22, size 40-16 line 3197
[  599.586140] binder: BINDER_SET_CONTEXT_MGR already set
[  599.586149] binder: 32167:32170 ioctl 40046207 0 returned -16
[  599.588150] binder: 32167:32170 got transaction with invalid offset (0, min 24 max 40) or object.
[  599.588283] binder: 32167:32170 transaction failed 29201/-22, size 40-16 line 3197
[  599.611370] binder: undelivered TRANSACTION_ERROR: 29201
[  599.611634] binder: undelivered TRANSACTION_ERROR: 29201
[  599.624340] binder: undelivered TRANSACTION_ERROR: 29189
[  599.630140] binder: undelivered TRANSACTION_ERROR: 29201
[  599.666978] binder: BINDER_SET_CONTEXT_MGR already set
[  599.666987] binder: 32178:32183 ioctl 40046207 0 returned -16
[  599.667698] binder: 32182:32188 got transaction with invalid offset (0, min 24 max 40) or object.
[  599.667786] binder: 32182:32188 transaction failed 29201/-22, size 40-16 line 3197
[  599.667946] binder: BINDER_SET_CONTEXT_MGR already set
[  599.667952] binder: 32181:32185 ioctl 40046207 0 returned -16
[  599.668936] binder: 32178:32183 got transaction with invalid offset (0, min 24 max 40) or object.
[  599.669014] binder: 32178:32183 transaction failed 29201/-22, size 40-16 line 3197
[  599.669893] binder: 32181:32185 got transaction with invalid offset (0, min 24 max 40) or object.
[  599.669986] binder: 32181:32185 transaction failed 29201/-22, size 40-16 line 3197
[  599.673600] binder: BINDER_SET_CONTEXT_MGR already set
[  599.673608] binder: 32177:32187 ioctl 40046207 0 returned -16
[  599.676524] binder: 32177:32187 got transaction with invalid offset (0, min 24 max 40) or object.
[  599.676617] binder: 32177:32187 transaction failed 29201/-22, size 40-16 line 3197
[  599.677952] binder: BINDER_SET_CONTEXT_MGR already set
[  599.677960] binder: 32179:32189 ioctl 40046207 0 returned -16
[  599.679705] binder: BINDER_SET_CONTEXT_MGR already set
[  599.679712] binder: 32180:32191 ioctl 40046207 0 returned -16
[  599.682917] binder: 32179:32189 got transaction with invalid offset (0, min 24 max 40) or object.
[  599.683141] binder: 32179:32189 transaction failed 29201/-22, size 40-16 line 3197
[  599.685301] binder: BINDER_SET_CONTEXT_MGR already set
[  599.685308] binder: 32186:32190 ioctl 40046207 0 returned -16
[  599.686483] binder: 32186:32190 got transaction with invalid offset (0, min 24 max 40) or object.
[  599.686567] binder: 32186:32190 transaction failed 29201/-22, size 40-16 line 3197
[  599.695558] binder_alloc: 32182: binder_alloc_buf, no vma
[  599.695605] binder: 32180:32191 transaction failed 29189/-3, size 40-16 line 3134
[  599.696837] binder: undelivered TRANSACTION_ERROR: 29201
[  599.704750] binder: undelivered TRANSACTION_ERROR: 29201
[  599.711669] binder: 32184:32192 got transaction with invalid offset (0, min 24 max 40) or object.
[  599.711769] binder: 32184:32192 transaction failed 29201/-22, size 40-16 line 3197
[  599.723244] binder: undelivered TRANSACTION_ERROR: 29201
[  599.739780] binder: undelivered TRANSACTION_ERROR: 29201
[  599.749290] binder: undelivered TRANSACTION_ERROR: 29201
[  599.759010] binder: undelivered TRANSACTION_ERROR: 29201
[  599.765023] binder: BINDER_SET_CONTEXT_MGR already set
[  599.765030] binder: 32201:32206 ioctl 40046207 0 returned -16
[  599.765827] binder_alloc: 32184: binder_alloc_buf, no vma
[  599.765864] binder: 32201:32206 transaction failed 29189/-3, size 40-16 line 3134
[  599.767421] binder: BINDER_SET_CONTEXT_MGR already set
[  599.767427] binder: 32203:32207 ioctl 40046207 0 returned -16
[  599.768790] binder_alloc: 32184: binder_alloc_buf, no vma
[  599.768828] binder: 32203:32207 transaction failed 29189/-3, size 40-16 line 3134
[  599.778091] binder: undelivered TRANSACTION_ERROR: 29189
[  599.787207] binder: undelivered TRANSACTION_ERROR: 29189
[  599.788299] binder: BINDER_SET_CONTEXT_MGR already set
[  599.788306] binder: 32212:32213 ioctl 40046207 0 returned -16
[  599.789139] binder_alloc: 32184: binder_alloc_buf, no vma
[  599.789176] binder: 32212:32213 transaction failed 29189/-3, size 40-16 line 3134
[  599.796484] binder: BINDER_SET_CONTEXT_MGR already set
[  599.796493] binder: 32205:32209 ioctl 40046207 0 returned -16
[  599.799843] binder_alloc: 32184: binder_alloc_buf, no vma
[  599.799880] binder: 32205:32209 transaction failed 29189/-3, size 40-16 line 3134
[  599.800247] binder: BINDER_SET_CONTEXT_MGR already set
[  599.800254] binder: 32214:32216 ioctl 40046207 0 returned -16
[  599.802003] binder_alloc: 32184: binder_alloc_buf, no vma
[  599.802040] binder: 32214:32216 transaction failed 29189/-3, size 40-16 line 3134
[  599.804873] binder: undelivered TRANSACTION_ERROR: 29201
[  599.811045] binder: undelivered TRANSACTION_ERROR: 29189
[  599.821769] binder: 32208:32218 got transaction with invalid offset (0, min 24 max 40) or object.
[  599.821863] binder: 32208:32218 transaction failed 29201/-22, size 40-16 line 3197
[  599.823689] binder: BINDER_SET_CONTEXT_MGR already set
[  599.823698] binder: 32210:32220 ioctl 40046207 0 returned -16
[  599.826860] binder: 32210:32220 got transaction with invalid offset (0, min 24 max 40) or object.
[  599.826971] binder: 32210:32220 transaction failed 29201/-22, size 40-16 line 3197
[  599.827119] binder: undelivered TRANSACTION_ERROR: 29189
[  599.829969] binder: BINDER_SET_CONTEXT_MGR already set
[  599.829976] binder: 32217:32221 ioctl 40046207 0 returned -16
[  599.831248] binder: 32217:32221 got transaction with invalid offset (0, min 24 max 40) or object.
[  599.831339] binder: 32217:32221 transaction failed 29201/-22, size 40-16 line 3197
[  599.832607] binder: undelivered TRANSACTION_ERROR: 29189
[  599.853498] binder: undelivered TRANSACTION_ERROR: 29189
[  599.862397] binder: undelivered TRANSACTION_ERROR: 29201
[  599.868497] binder_alloc: 32226: binder_alloc_buf, no vma
[  599.868536] binder: 32226:32230 transaction failed 29189/-3, size 40-16 line 3134
[  599.873526] binder: undelivered TRANSACTION_ERROR: 29201
[  599.878931] binder: undelivered TRANSACTION_ERROR: 29189
[  599.880134] binder: BINDER_SET_CONTEXT_MGR already set
[  599.880142] binder: 32229:32234 ioctl 40046207 0 returned -16
[  599.880457] binder: 32227:32232 got transaction with invalid offset (0, min 24 max 40) or object.
[  599.880544] binder: 32227:32232 transaction failed 29201/-22, size 40-16 line 3197
[  599.881595] binder: BINDER_SET_CONTEXT_MGR already set
[  599.881601] binder: 32225:32235 ioctl 40046207 0 returned -16
[  599.885184] binder: 32229:32234 got transaction with invalid offset (0, min 24 max 40) or object.
[  599.885269] binder: 32229:32234 transaction failed 29201/-22, size 40-16 line 3197
[  599.895220] binder: undelivered TRANSACTION_ERROR: 29201
[  599.898718] binder: 32225:32235 got transaction with invalid offset (0, min 24 max 40) or object.
[  599.898809] binder: 32225:32235 transaction failed 29201/-22, size 40-16 line 3197
[  599.906422] binder: undelivered TRANSACTION_ERROR: 29201
[  599.917898] binder: undelivered TRANSACTION_ERROR: 29201
[  599.933426] binder: undelivered TRANSACTION_ERROR: 29201
[  599.965803] binder: 32240:32245 got transaction with invalid offset (0, min 24 max 40) or object.
[  599.965897] binder: 32240:32245 transaction failed 29201/-22, size 40-16 line 3197
[  599.966117] binder: BINDER_SET_CONTEXT_MGR already set
[  599.966125] binder: 32242:32247 ioctl 40046207 0 returned -16
[  599.967242] binder: 32242:32247 got transaction with invalid offset (0, min 24 max 40) or object.
[  599.967330] binder: 32242:32247 transaction failed 29201/-22, size 40-16 line 3197
[  599.968120] binder: BINDER_SET_CONTEXT_MGR already set
[  599.968128] binder: 32241:32248 ioctl 40046207 0 returned -16
[  599.969787] binder: 32241:32248 got transaction with invalid offset (0, min 24 max 40) or object.
[  599.969866] binder: 32241:32248 transaction failed 29201/-22, size 40-16 line 3197
[  599.970148] binder: BINDER_SET_CONTEXT_MGR already set
[  599.970156] binder: 32239:32250 ioctl 40046207 0 returned -16
[  599.972409] binder: BINDER_SET_CONTEXT_MGR already set
[  599.972417] binder: 32243:32251 ioctl 40046207 0 returned -16
[  599.973256] binder: BINDER_SET_CONTEXT_MGR already set
[  599.973263] binder: 32238:32249 ioctl 40046207 0 returned -16
[  599.974772] binder: 32239:32250 got transaction with invalid offset (0, min 24 max 40) or object.
[  599.974859] binder: 32239:32250 transaction failed 29201/-22, size 40-16 line 3197
[  599.976316] binder: 32238:32249 got transaction with invalid offset (0, min 24 max 40) or object.
[  599.976447] binder: 32238:32249 transaction failed 29201/-22, size 40-16 line 3197
[  599.976861] binder: 32243:32251 got transaction with invalid offset (0, min 24 max 40) or object.
[  599.976942] binder: 32243:32251 transaction failed 29201/-22, size 40-16 line 3197
[  599.979416] binder: BINDER_SET_CONTEXT_MGR already set
[  599.979423] binder: 32244:32252 ioctl 40046207 0 returned -16
[  599.980644] binder: 32244:32252 got transaction with invalid offset (0, min 24 max 40) or object.
[  599.980730] binder: 32244:32252 transaction failed 29201/-22, size 40-16 line 3197
[  599.989942] binder: BINDER_SET_CONTEXT_MGR already set
[  599.989951] binder: 32246:32253 ioctl 40046207 0 returned -16
[  599.991618] binder: undelivered TRANSACTION_ERROR: 29201
[  599.997147] binder: 32246:32253 got transaction with invalid offset (0, min 24 max 40) or object.
[  599.997233] binder: 32246:32253 transaction failed 29201/-22, size 40-16 line 3197
[  600.007659] binder: undelivered TRANSACTION_ERROR: 29201
[  600.028476] binder: undelivered TRANSACTION_ERROR: 29201
[  600.039201] binder: undelivered TRANSACTION_ERROR: 29201
[  600.041757] binder: 32262:32265 transaction failed 29189/-22, size 40-16 line 3011
[  600.047474] binder: undelivered TRANSACTION_ERROR: 29201
[  600.058778] binder: undelivered TRANSACTION_ERROR: 29201
[  600.061753] binder: undelivered TRANSACTION_ERROR: 29201
[  600.071899] binder: undelivered TRANSACTION_ERROR: 29201
[  600.074561] binder: 32264:32270 got transaction with invalid offset (0, min 24 max 40) or object.
[  600.074653] binder: 32264:32270 transaction failed 29201/-22, size 40-16 line 3197
[  600.084730] binder: BINDER_SET_CONTEXT_MGR already set
[  600.084737] binder: 32266:32274 ioctl 40046207 0 returned -16
[  600.086108] binder_alloc: 32264: binder_alloc_buf, no vma
[  600.086149] binder: 32266:32274 transaction failed 29189/-3, size 40-16 line 3134
[  600.088683] binder: BINDER_SET_CONTEXT_MGR already set
[  600.088690] binder: 32267:32272 ioctl 40046207 0 returned -16
[  600.093436] binder_alloc: 32264: binder_alloc_buf, no vma
[  600.093474] binder: 32267:32272 transaction failed 29189/-3, size 40-16 line 3134
[  600.096242] binder: undelivered TRANSACTION_ERROR: 29201
[  600.098019] binder: undelivered TRANSACTION_ERROR: 29189
[  600.109136] binder: undelivered TRANSACTION_ERROR: 29189
[  600.115714] binder: 32269:32273 got transaction with invalid offset (0, min 24 max 40) or object.
[  600.115886] binder: 32269:32273 transaction failed 29201/-22, size 40-16 line 3197
[  600.134633] binder: undelivered TRANSACTION_ERROR: 29201
[  600.136633] binder: undelivered TRANSACTION_ERROR: 29189
[  600.170855] binder: 32279:32282 got transaction with invalid offset (0, min 24 max 40) or object.
[  600.170946] binder: 32279:32282 transaction failed 29201/-22, size 40-16 line 3197
[  600.175501] binder: BINDER_SET_CONTEXT_MGR already set
[  600.175510] binder: 32281:32289 ioctl 40046207 0 returned -16
[  600.176751] binder: 32281:32289 got transaction with invalid offset (0, min 24 max 40) or object.
[  600.176843] binder: 32281:32289 transaction failed 29201/-22, size 40-16 line 3197
[  600.181557] binder: 32280:32286 got transaction with invalid offset (0, min 24 max 40) or object.
[  600.181617] binder: BINDER_SET_CONTEXT_MGR already set
[  600.181624] binder: 32287:32290 ioctl 40046207 0 returned -16
[  600.181931] binder: 32280:32286 transaction failed 29201/-22, size 40-16 line 3197
[  600.183364] binder: 32287:32290 got transaction with invalid offset (0, min 24 max 40) or object.
[  600.183453] binder: 32287:32290 transaction failed 29201/-22, size 40-16 line 3197
[  600.187464] binder: BINDER_SET_CONTEXT_MGR already set
[  600.187473] binder: 32284:32291 ioctl 40046207 0 returned -16
[  600.190433] binder: BINDER_SET_CONTEXT_MGR already set
[  600.190440] binder: 32285:32294 ioctl 40046207 0 returned -16
[  600.194122] binder: BINDER_SET_CONTEXT_MGR already set
[  600.194131] binder: 32288:32295 ioctl 40046207 0 returned -16
[  600.194411] binder: 32285:32294 got transaction with invalid offset (0, min 24 max 40) or object.
[  600.194497] binder: 32285:32294 transaction failed 29201/-22, size 40-16 line 3197
[  600.198262] binder: 32288:32295 got transaction with invalid offset (0, min 24 max 40) or object.
[  600.198352] binder: 32288:32295 transaction failed 29201/-22, size 40-16 line 3197
[  600.199853] binder: 32284:32291 got transaction with invalid offset (0, min 24 max 40) or object.
[  600.199943] binder: 32284:32291 transaction failed 29201/-22, size 40-16 line 3197
[  600.206440] binder: BINDER_SET_CONTEXT_MGR already set
[  600.206449] binder: 32283:32293 ioctl 40046207 0 returned -16
[  600.211974] binder: 32283:32293 got transaction with invalid offset (0, min 24 max 40) or object.
[  600.212061] binder: 32283:32293 transaction failed 29201/-22, size 40-16 line 3197
[  600.216975] binder: undelivered TRANSACTION_ERROR: 29201
[  600.218300] binder: undelivered TRANSACTION_ERROR: 29201
[  600.241792] binder: undelivered TRANSACTION_ERROR: 29201
[  600.250669] binder: undelivered TRANSACTION_ERROR: 29201
[  600.261256] binder: undelivered TRANSACTION_ERROR: 29201
[  600.267909] binder: undelivered TRANSACTION_ERROR: 29201
[  600.274905] binder: undelivered TRANSACTION_ERROR: 29201
[  600.286323] binder: 32306:32313 got transaction with invalid offset (0, min 24 max 40) or object.
[  600.286409] binder: 32306:32313 transaction failed 29201/-22, size 40-16 line 3197
[  600.288331] binder: BINDER_SET_CONTEXT_MGR already set
[  600.288338] binder: 32307:32311 ioctl 40046207 0 returned -16
[  600.289357] binder: 32307:32311 got transaction with invalid offset (0, min 24 max 40) or object.
[  600.289445] binder: 32307:32311 transaction failed 29201/-22, size 40-16 line 3197
[  600.291970] binder: undelivered TRANSACTION_ERROR: 29201
[  600.303972] binder: BINDER_SET_CONTEXT_MGR already set
[  600.303980] binder: 32309:32316 ioctl 40046207 0 returned -16
[  600.304829] binder: 32309:32316 got transaction with invalid offset (0, min 24 max 40) or object.
[  600.306145] binder: 32309:32316 transaction failed 29201/-22, size 40-16 line 3197
[  600.311972] binder: BINDER_SET_CONTEXT_MGR already set
[  600.311981] binder: 32310:32317 ioctl 40046207 0 returned -16
[  600.316081] binder: BINDER_SET_CONTEXT_MGR already set
[  600.316088] binder: 32315:32320 ioctl 40046207 0 returned -16
[  600.316808] binder: BINDER_SET_CONTEXT_MGR already set
[  600.316815] binder: 32314:32321 ioctl 40046207 0 returned -16
[  600.317874] binder: 32312:32318 got transaction with invalid offset (0, min 24 max 40) or object.
[  600.317955] binder: 32312:32318 transaction failed 29201/-22, size 40-16 line 3197
[  600.318175] binder: 32310:32317 got transaction with invalid offset (0, min 24 max 40) or object.
[  600.318252] binder: 32310:32317 transaction failed 29201/-22, size 40-16 line 3197
[  600.318411] binder: 32315:32320 got transaction with invalid offset (0, min 24 max 40) or object.
[  600.318493] binder: 32315:32320 transaction failed 29201/-22, size 40-16 line 3197
[  600.319712] binder: 32314:32321 got transaction with invalid offset (0, min 24 max 40) or object.
[  600.319799] binder: 32314:32321 transaction failed 29201/-22, size 40-16 line 3197
[  600.338970] binder: undelivered TRANSACTION_ERROR: 29201
[  600.345418] binder: undelivered TRANSACTION_ERROR: 29201
[  600.350733] binder: undelivered TRANSACTION_ERROR: 29201
[  600.367292] binder: undelivered TRANSACTION_ERROR: 29201
[  600.371001] binder: undelivered TRANSACTION_ERROR: 29201
[  600.381452] binder: undelivered TRANSACTION_ERROR: 29201
[  600.382110] binder: undelivered TRANSACTION_ERROR: 29201
[  600.395221] binder: 32332:32336 got transaction with invalid offset (0, min 24 max 40) or object.
[  600.395472] binder: BINDER_SET_CONTEXT_MGR already set
[  600.395480] binder: 32328:32335 ioctl 40046207 0 returned -16
[  600.395574] binder: 32332:32336 transaction failed 29201/-22, size 40-16 line 3197
[  600.396649] binder: BINDER_SET_CONTEXT_MGR already set
[  600.396655] binder: 32333:32337 ioctl 40046207 0 returned -16
[  600.397526] binder: 32333:32337 got transaction with invalid offset (0, min 24 max 40) or object.
[  600.397615] binder: 32333:32337 transaction failed 29201/-22, size 40-16 line 3197
[  600.401050] binder: 32328:32335 got transaction with invalid offset (0, min 24 max 40) or object.
[  600.401136] binder: 32328:32335 transaction failed 29201/-22, size 40-16 line 3197
[  600.412529] binder: undelivered TRANSACTION_ERROR: 29201
[  600.416642] binder: 32334:32338 got transaction with invalid offset (0, min 24 max 40) or object.
[  600.416733] binder: 32334:32338 transaction failed 29201/-22, size 40-16 line 3197
[  600.428404] binder: undelivered TRANSACTION_ERROR: 29201
[  600.435788] binder: undelivered TRANSACTION_ERROR: 29201
[  600.450847] binder: undelivered TRANSACTION_ERROR: 29201
[  600.489282] binder: 32345:32349 got transaction with invalid offset (0, min 24 max 40) or object.
[  600.489368] binder: 32345:32349 transaction failed 29201/-22, size 40-16 line 3197
[  600.489873] binder: BINDER_SET_CONTEXT_MGR already set
[  600.489881] binder: 32346:32350 ioctl 40046207 0 returned -16
[  600.490724] binder: 32346:32350 got transaction with invalid offset (0, min 24 max 40) or object.
[  600.491291] binder: 32346:32350 transaction failed 29201/-22, size 40-16 line 3197
[  600.496842] binder: BINDER_SET_CONTEXT_MGR already set
[  600.496850] binder: 32344:32351 ioctl 40046207 0 returned -16
[  600.498265] binder: BINDER_SET_CONTEXT_MGR already set
[  600.498271] binder: 32343:32356 ioctl 40046207 0 returned -16
[  600.498632] binder: 32344:32351 got transaction with invalid offset (0, min 24 max 40) or object.
[  600.498725] binder: 32344:32351 transaction failed 29201/-22, size 40-16 line 3197
[  600.498784] binder: BINDER_SET_CONTEXT_MGR already set
[  600.498791] binder: 32347:32354 ioctl 40046207 0 returned -16
[  600.501025] binder: BINDER_SET_CONTEXT_MGR already set
[  600.501033] binder: 32348:32355 ioctl 40046207 0 returned -16
[  600.502088] binder: 32348:32355 got transaction with invalid offset (0, min 24 max 40) or object.
[  600.502170] binder: 32348:32355 transaction failed 29201/-22, size 40-16 line 3197
[  600.503630] binder: 32347:32354 got transaction with invalid offset (0, min 24 max 40) or object.
[  600.503713] binder: 32347:32354 transaction failed 29201/-22, size 40-16 line 3197
[  600.505064] binder: 32343:32356 got transaction with invalid offset (0, min 24 max 40) or object.
[  600.505147] binder: 32343:32356 transaction failed 29201/-22, size 40-16 line 3197
[  600.510940] binder: BINDER_SET_CONTEXT_MGR already set
[  600.510947] binder: 32353:32357 ioctl 40046207 0 returned -16
[  600.515851] binder: 32353:32357 got transaction with invalid offset (0, min 24 max 40) or object.
[  600.515931] binder: 32353:32357 transaction failed 29201/-22, size 40-16 line 3197
[  600.517617] binder: BINDER_SET_CONTEXT_MGR already set
[  600.517624] binder: 32352:32358 ioctl 40046207 0 returned -16
[  600.519183] binder: 32352:32358 got transaction with invalid offset (0, min 24 max 40) or object.
[  600.519274] binder: 32352:32358 transaction failed 29201/-22, size 40-16 line 3197
[  600.527435] binder: undelivered TRANSACTION_ERROR: 29201
[  600.545825] binder: undelivered TRANSACTION_ERROR: 29201
[  600.561928] binder: undelivered TRANSACTION_ERROR: 29201
[  600.564224] binder: undelivered TRANSACTION_ERROR: 29201
[  600.565423] binder: undelivered TRANSACTION_ERROR: 29201
[  600.578519] binder: undelivered TRANSACTION_ERROR: 29201
[  600.584397] binder: 32374:32375 got transaction with invalid offset (0, min 24 max 40) or object.
[  600.584486] binder: 32374:32375 transaction failed 29201/-22, size 40-16 line 3197
[  600.606835] binder: undelivered TRANSACTION_ERROR: 29201
[  600.606948] binder: undelivered TRANSACTION_ERROR: 29201
[  600.622980] binder: 32377:32379 got transaction with invalid offset (0, min 24 max 40) or object.
[  600.623069] binder: 32377:32379 transaction failed 29201/-22, size 40-16 line 3197
[  600.624811] binder: BINDER_SET_CONTEXT_MGR already set
[  600.624818] binder: 32369:32373 ioctl 40046207 0 returned -16
[  600.625715] binder: 32369:32373 got transaction with invalid offset (0, min 24 max 40) or object.
[  600.625797] binder: 32369:32373 transaction failed 29201/-22, size 40-16 line 3197
[  600.626745] binder: BINDER_SET_CONTEXT_MGR already set
[  600.626758] binder: 32372:32381 ioctl 40046207 0 returned -16
[  600.628254] binder: 32372:32381 got transaction with invalid offset (0, min 24 max 40) or object.
[  600.628359] binder: 32372:32381 transaction failed 29201/-22, size 40-16 line 3197
[  600.643796] binder: undelivered TRANSACTION_ERROR: 29201
[  600.643884] binder: undelivered TRANSACTION_ERROR: 29201
[  600.650822] binder: BINDER_SET_CONTEXT_MGR already set
[  600.650829] binder: 32380:32384 ioctl 40046207 0 returned -16
[  600.652210] binder: 32380:32384 got transaction with invalid offset (0, min 24 max 40) or object.
[  600.652299] binder: 32380:32384 transaction failed 29201/-22, size 40-16 line 3197
[  600.657190] binder: undelivered TRANSACTION_ERROR: 29201
[  600.661715] binder: undelivered TRANSACTION_ERROR: 29201
[  600.672062] binder: undelivered TRANSACTION_ERROR: 29201
[  600.700627] binder: 32387:32393 got transaction with invalid offset (0, min 24 max 40) or object.
[  600.700709] binder: 32387:32393 transaction failed 29201/-22, size 40-16 line 3197
[  600.704487] binder: BINDER_SET_CONTEXT_MGR already set
[  600.704496] binder: 32390:32396 ioctl 40046207 0 returned -16
[  600.708011] binder: 32390:32396 got transaction with invalid offset (0, min 24 max 40) or object.
[  600.708100] binder: 32390:32396 transaction failed 29201/-22, size 40-16 line 3197
[  600.708345] binder: BINDER_SET_CONTEXT_MGR already set
[  600.708352] binder: 32389:32395 ioctl 40046207 0 returned -16
[  600.709182] binder: BINDER_SET_CONTEXT_MGR already set
[  600.709189] binder: 32386:32397 ioctl 40046207 0 returned -16
[  600.709284] binder: 32389:32395 got transaction with invalid offset (0, min 24 max 40) or object.
[  600.709365] binder: 32389:32395 transaction failed 29201/-22, size 40-16 line 3197
[  600.710186] binder: 32386:32397 got transaction with invalid offset (0, min 24 max 40) or object.
[  600.710278] binder: 32386:32397 transaction failed 29201/-22, size 40-16 line 3197
[  600.713706] binder: BINDER_SET_CONTEXT_MGR already set
[  600.713714] binder: 32391:32400 ioctl 40046207 0 returned -16
[  600.715203] binder: BINDER_SET_CONTEXT_MGR already set
[  600.715209] binder: 32394:32401 ioctl 40046207 0 returned -16
[  600.716358] binder: 32391:32400 got transaction with invalid offset (0, min 24 max 40) or object.
[  600.716437] binder: 32391:32400 transaction failed 29201/-22, size 40-16 line 3197
[  600.719071] binder: BINDER_SET_CONTEXT_MGR already set
[  600.719078] binder: 32388:32399 ioctl 40046207 0 returned -16
[  600.720537] binder: 32388:32399 got transaction with invalid offset (0, min 24 max 40) or object.
[  600.720622] binder: 32388:32399 transaction failed 29201/-22, size 40-16 line 3197
[  600.724450] binder: BINDER_SET_CONTEXT_MGR already set
[  600.724457] binder: 32392:32398 ioctl 40046207 0 returned -16
[  600.727797] binder: 32394:32401 got transaction with invalid offset (0, min 24 max 40) or object.
[  600.727885] binder: 32394:32401 transaction failed 29201/-22, size 40-16 line 3197
[  600.730763] binder: 32392:32398 got transaction with invalid offset (0, min 24 max 40) or object.
[  600.730847] binder: 32392:32398 transaction failed 29201/-22, size 40-16 line 3197
[  600.752558] binder: undelivered TRANSACTION_ERROR: 29201
[  600.752734] binder: undelivered TRANSACTION_ERROR: 29201
[  600.773934] binder: undelivered TRANSACTION_ERROR: 29201
[  600.775251] binder: undelivered TRANSACTION_ERROR: 29201
[  600.790019] binder: undelivered TRANSACTION_ERROR: 29201
[  600.796790] binder: undelivered TRANSACTION_ERROR: 29201
[  600.804475] binder: undelivered TRANSACTION_ERROR: 29201
[  600.811139] binder: 32414:32417 got transaction with invalid offset (0, min 24 max 40) or object.
[  600.811226] binder: 32414:32417 transaction failed 29201/-22, size 40-16 line 3197
[  600.818645] binder: BINDER_SET_CONTEXT_MGR already set
[  600.818652] binder: 32413:32418 ioctl 40046207 0 returned -16
[  600.819603] binder: 32413:32418 got transaction with invalid offset (0, min 24 max 40) or object.
[  600.819719] binder: 32413:32418 transaction failed 29201/-22, size 40-16 line 3197
[  600.820626] binder: BINDER_SET_CONTEXT_MGR already set
[  600.820633] binder: 32421:32423 ioctl 40046207 0 returned -16
[  600.822835] binder: 32421:32423 got transaction with invalid offset (0, min 24 max 40) or object.
[  600.822918] binder: 32421:32423 transaction failed 29201/-22, size 40-16 line 3197
[  600.825422] binder: BINDER_SET_CONTEXT_MGR already set
[  600.825430] binder: 32416:32420 ioctl 40046207 0 returned -16
[  600.827736] binder: 32416:32420 got transaction with invalid offset (0, min 24 max 40) or object.
[  600.827817] binder: 32416:32420 transaction failed 29201/-22, size 40-16 line 3197
[  600.830779] binder: BINDER_SET_CONTEXT_MGR already set
[  600.830786] binder: 32422:32425 ioctl 40046207 0 returned -16
[  600.831614] binder: 32422:32425 got transaction with invalid offset (0, min 24 max 40) or object.
[  600.831817] binder: 32422:32425 transaction failed 29201/-22, size 40-16 line 3197
[  600.835448] binder: undelivered TRANSACTION_ERROR: 29201
[  600.840524] binder: undelivered TRANSACTION_ERROR: 29201
[  600.864190] binder_alloc: 32414: binder_alloc_buf, no vma
[  600.864608] binder: 32419:32428 transaction failed 29189/-3, size 40-16 line 3134
[  600.868695] binder: BINDER_SET_CONTEXT_MGR already set
[  600.868703] binder: 32426:32429 ioctl 40046207 0 returned -16
[  600.870127] binder_alloc: 32414: binder_alloc_buf, no vma
[  600.870166] binder: 32426:32429 transaction failed 29189/-3, size 40-16 line 3134
[  600.872786] binder: undelivered TRANSACTION_ERROR: 29201
[  600.886101] binder: undelivered TRANSACTION_ERROR: 29201
[  600.886278] binder: undelivered TRANSACTION_ERROR: 29201
[  600.894226] binder: undelivered TRANSACTION_ERROR: 29201
[  600.896100] binder: 32433:32440 got transaction with invalid offset (0, min 24 max 40) or object.
[  600.896188] binder: 32433:32440 transaction failed 29201/-22, size 40-16 line 3197
[  600.901276] binder: undelivered TRANSACTION_ERROR: 29189
[  600.903357] binder: BINDER_SET_CONTEXT_MGR already set
[  600.903363] binder: 32438:32441 ioctl 40046207 0 returned -16
[  600.906008] binder: 32438:32441 got transaction with invalid offset (0, min 24 max 40) or object.
[  600.906079] binder: 32438:32441 transaction failed 29201/-22, size 40-16 line 3197
[  600.906792] binder: undelivered TRANSACTION_ERROR: 29189
[  600.918942] binder: undelivered TRANSACTION_ERROR: 29201
[  600.919741] binder: undelivered TRANSACTION_ERROR: 29201
[  600.957928] binder: BINDER_SET_CONTEXT_MGR already set
[  600.957937] binder: 32446:32448 ioctl 40046207 0 returned -16
[  600.958965] binder: 32446:32448 got transaction with invalid offset (0, min 24 max 40) or object.
[  600.959026] binder: 32444:32451 got transaction with invalid offset (0, min 24 max 40) or object.
[  600.959040] binder: 32446:32448 transaction failed 29201/-22, size 40-16 line 3197
[  600.959129] binder: 32444:32451 transaction failed 29201/-22, size 40-16 line 3197
[  600.963293] binder: BINDER_SET_CONTEXT_MGR already set
[  600.963301] binder: 32447:32453 ioctl 40046207 0 returned -16
[  600.965539] binder: 32447:32453 got transaction with invalid offset (0, min 24 max 40) or object.
[  600.965621] binder: 32447:32453 transaction failed 29201/-22, size 40-16 line 3197
[  600.971994] binder: BINDER_SET_CONTEXT_MGR already set
[  600.972002] binder: 32450:32455 ioctl 40046207 0 returned -16
[  600.973021] binder: BINDER_SET_CONTEXT_MGR already set
[  600.973028] binder: 32445:32456 ioctl 40046207 0 returned -16
[  600.973161] binder: BINDER_SET_CONTEXT_MGR already set
[  600.973167] binder: 32443:32454 ioctl 40046207 0 returned -16
[  600.973388] binder: 32450:32455 got transaction with invalid offset (0, min 24 max 40) or object.
[  600.973473] binder: 32450:32455 transaction failed 29201/-22, size 40-16 line 3197
[  600.977853] binder: 32443:32454 got transaction with invalid offset (0, min 24 max 40) or object.
[  600.977938] binder: 32443:32454 transaction failed 29201/-22, size 40-16 line 3197
[  600.979686] binder: 32445:32456 got transaction with invalid offset (0, min 24 max 40) or object.
[  600.979767] binder: 32445:32456 transaction failed 29201/-22, size 40-16 line 3197
[  600.984578] binder: 32449:32457 got transaction with invalid offset (0, min 24 max 40) or object.
[  600.984662] binder: 32449:32457 transaction failed 29201/-22, size 40-16 line 3197
[  601.011818] binder: undelivered TRANSACTION_ERROR: 29201
[  601.018371] binder: undelivered TRANSACTION_ERROR: 29201
[  601.020640] binder: undelivered TRANSACTION_ERROR: 29201
[  601.038229] binder: 32452:32461 got transaction with invalid offset (0, min 24 max 40) or object.
[  601.038326] binder: 32452:32461 transaction failed 29201/-22, size 40-16 line 3197
[  601.043851] binder: undelivered TRANSACTION_ERROR: 29201
[  601.044759] binder: BINDER_SET_CONTEXT_MGR already set
[  601.044766] binder: 32469:32470 ioctl 40046207 0 returned -16
[  601.047255] binder: 32469:32470 got transaction with invalid offset (0, min 24 max 40) or object.
[  601.047345] binder: 32469:32470 transaction failed 29201/-22, size 40-16 line 3197
[  601.056798] binder: undelivered TRANSACTION_ERROR: 29201
[  601.066280] binder: undelivered TRANSACTION_ERROR: 29201
[  601.070650] binder: BINDER_SET_CONTEXT_MGR already set
[  601.070658] binder: 32472:32477 ioctl 40046207 0 returned -16
[  601.071850] binder: 32472:32477 got transaction with invalid offset (0, min 24 max 40) or object.
[  601.071935] binder: 32472:32477 transaction failed 29201/-22, size 40-16 line 3197
[  601.074013] binder: BINDER_SET_CONTEXT_MGR already set
[  601.074021] binder: 32471:32474 ioctl 40046207 0 returned -16
[  601.078289] binder: 32471:32474 got transaction with invalid offset (0, min 24 max 40) or object.
[  601.078864] binder: 32471:32474 transaction failed 29201/-22, size 40-16 line 3197
[  601.082840] binder: BINDER_SET_CONTEXT_MGR already set
[  601.082848] binder: 32476:32478 ioctl 40046207 0 returned -16
[  601.085072] binder: 32476:32478 got transaction with invalid offset (0, min 24 max 40) or object.
[  601.085155] binder: 32476:32478 transaction failed 29201/-22, size 40-16 line 3197
[  601.089426] binder: undelivered TRANSACTION_ERROR: 29201
[  601.096086] binder: BINDER_SET_CONTEXT_MGR already set
[  601.096093] binder: 32480:32483 ioctl 40046207 0 returned -16
[  601.099316] binder: undelivered TRANSACTION_ERROR: 29201
[  601.100165] binder: 32480:32483 got transaction with invalid offset (0, min 24 max 40) or object.
[  601.100258] binder: 32480:32483 transaction failed 29201/-22, size 40-16 line 3197
[  601.113793] binder: undelivered TRANSACTION_ERROR: 29201
[  601.123161] binder: BINDER_SET_CONTEXT_MGR already set
[  601.123168] binder: 32475:32486 ioctl 40046207 0 returned -16
[  601.124084] binder: 32475:32486 got transaction with invalid offset (0, min 24 max 40) or object.
[  601.124168] binder: 32475:32486 transaction failed 29201/-22, size 40-16 line 3197
[  601.127099] binder: undelivered TRANSACTION_ERROR: 29201
[  601.134768] binder: undelivered TRANSACTION_ERROR: 29201
[  601.140440] binder: BINDER_SET_CONTEXT_MGR already set
[  601.140448] binder: 32487:32492 ioctl 40046207 0 returned -16
[  601.141463] binder: 32487:32492 got transaction with invalid offset (0, min 24 max 40) or object.
[  601.141550] binder: 32487:32492 transaction failed 29201/-22, size 40-16 line 3197
[  601.145778] binder: undelivered TRANSACTION_ERROR: 29201
[  601.149344] binder: undelivered TRANSACTION_ERROR: 29201
[  601.151187] binder: 32491:32495 transaction failed 29189/-22, size 40-16 line 3011
[  601.164959] binder: undelivered TRANSACTION_ERROR: 29189
[  601.175100] binder: undelivered TRANSACTION_ERROR: 29201
[  601.187359] binder: undelivered TRANSACTION_ERROR: 29201
[  601.334756] binder: BINDER_SET_CONTEXT_MGR already set
[  601.334765] binder: 32502:32507 ioctl 40046207 0 returned -16
[  601.335743] binder: 32503:32504 got transaction with invalid offset (0, min 24 max 40) or object.
[  601.335837] binder: 32503:32504 transaction failed 29201/-22, size 40-16 line 3197
[  601.336685] binder: BINDER_SET_CONTEXT_MGR already set
[  601.336691] binder: 32497:32506 ioctl 40046207 0 returned -16
[  601.338928] binder: 32497:32506 got transaction with invalid offset (0, min 24 max 40) or object.
[  601.339018] binder: 32497:32506 transaction failed 29201/-22, size 40-16 line 3197
[  601.350419] binder: BINDER_SET_CONTEXT_MGR already set
[  601.350427] binder: 32498:32509 ioctl 40046207 0 returned -16
[  601.352025] binder_alloc: 32503: binder_alloc_buf, no vma
[  601.352064] binder: 32498:32509 transaction failed 29189/-3, size 40-16 line 3134
[  601.360114] binder: BINDER_SET_CONTEXT_MGR already set
[  601.360123] binder: 32499:32505 ioctl 40046207 0 returned -16
[  601.360727] binder: undelivered TRANSACTION_ERROR: 29201
[  601.365682] binder: 32500:32510 got transaction with invalid offset (0, min 24 max 40) or object.
[  601.365768] binder: 32500:32510 transaction failed 29201/-22, size 40-16 line 3197
[  601.367990] binder: BINDER_SET_CONTEXT_MGR already set
[  601.367998] binder: 32501:32508 ioctl 40046207 0 returned -16
[  601.369479] binder: 32501:32508 got transaction with invalid offset (0, min 24 max 40) or object.
[  601.369566] binder: 32501:32508 transaction failed 29201/-22, size 40-16 line 3197
[  601.387258] binder: 32499:32505 got transaction with invalid offset (0, min 24 max 40) or object.
[  601.387351] binder: 32499:32505 transaction failed 29201/-22, size 40-16 line 3197
[  601.400852] binder: undelivered TRANSACTION_ERROR: 29201
[  601.430950] binder: undelivered TRANSACTION_ERROR: 29189
[  601.432920] binder: BINDER_SET_CONTEXT_MGR already set
[  601.432927] binder: 32515:32522 ioctl 40046207 0 returned -16
[  601.440835] binder: 32515:32522 got transaction with invalid offset (0, min 24 max 40) or object.
[  601.440929] binder: 32515:32522 transaction failed 29201/-22, size 40-16 line 3197
[  601.443439] binder: BINDER_SET_CONTEXT_MGR already set
[  601.443447] binder: 32526:32528 ioctl 40046207 0 returned -16
[  601.446206] binder: 32526:32528 got transaction with invalid offset (0, min 24 max 40) or object.
[  601.446391] binder: 32526:32528 transaction failed 29201/-22, size 40-16 line 3197
[  601.460770] binder: BINDER_SET_CONTEXT_MGR already set
[  601.460778] binder: 32527:32529 ioctl 40046207 0 returned -16
[  601.462281] binder: BINDER_SET_CONTEXT_MGR already set
[  601.462288] binder: 32517:32530 ioctl 40046207 0 returned -16
[  601.464784] binder: 32517:32530 got transaction with invalid offset (0, min 24 max 40) or object.
[  601.464873] binder: 32517:32530 transaction failed 29201/-22, size 40-16 line 3197
[  601.486351] binder: undelivered TRANSACTION_ERROR: 29201
[  601.495816] binder: undelivered TRANSACTION_ERROR: 29201
[  601.501798] binder: undelivered TRANSACTION_ERROR: 29201
[  601.502052] binder: undelivered TRANSACTION_ERROR: 29201
[  601.517820] binder: BINDER_SET_CONTEXT_MGR already set
[  601.517829] binder: 32531:32533 ioctl 40046207 0 returned -16
[  601.519941] binder: 32531:32533 got transaction with invalid offset (0, min 24 max 40) or object.
[  601.520030] binder: 32531:32533 transaction failed 29201/-22, size 40-16 line 3197
[  601.533681] binder: undelivered TRANSACTION_ERROR: 29201
[  601.539258] binder: undelivered TRANSACTION_ERROR: 29201
[  601.568721] binder: undelivered TRANSACTION_ERROR: 29201
[  601.601235] binder: 32539:32541 got transaction with invalid offset (0, min 24 max 40) or object.
[  601.601325] binder: 32539:32541 transaction failed 29201/-22, size 40-16 line 3197
[  601.614022] binder: BINDER_SET_CONTEXT_MGR already set
[  601.614029] binder: 32545:32549 ioctl 40046207 0 returned -16
[  601.615579] binder: 32545:32549 got transaction with invalid offset (0, min 24 max 40) or object.
[  601.616881] binder: BINDER_SET_CONTEXT_MGR already set
[  601.616888] binder: 32542:32546 ioctl 40046207 0 returned -16
[  601.617030] binder: 32545:32549 transaction failed 29201/-22, size 40-16 line 3197
[  601.618571] binder: BINDER_SET_CONTEXT_MGR already set
[  601.618578] binder: 32544:32550 ioctl 40046207 0 returned -16
[  601.620201] binder: BINDER_SET_CONTEXT_MGR already set
[  601.620208] binder: 32538:32551 ioctl 40046207 0 returned -16
[  601.620550] binder: BINDER_SET_CONTEXT_MGR already set
[  601.620557] binder: 32543:32548 ioctl 40046207 0 returned -16
[  601.620590] binder: BINDER_SET_CONTEXT_MGR already set
[  601.620595] binder: 32540:32552 ioctl 40046207 0 returned -16
[  601.621414] binder: 32544:32550 got transaction with invalid offset (0, min 24 max 40) or object.
[  601.621504] binder: 32544:32550 transaction failed 29201/-22, size 40-16 line 3197
[  601.621785] binder: 32543:32548 got transaction with invalid offset (0, min 24 max 40) or object.
[  601.621872] binder: 32543:32548 transaction failed 29201/-22, size 40-16 line 3197
[  601.622851] binder: 32542:32546 got transaction with invalid offset (0, min 24 max 40) or object.
[  601.622928] binder: 32542:32546 transaction failed 29201/-22, size 40-16 line 3197
[  601.624461] binder: 32540:32552 got transaction with invalid offset (0, min 24 max 40) or object.
[  601.626662] binder: 32540:32552 transaction failed 29201/-22, size 40-16 line 3197
[  601.627408] binder: 32538:32551 got transaction with invalid offset (0, min 24 max 40) or object.
[  601.627497] binder: 32538:32551 transaction failed 29201/-22, size 40-16 line 3197
[  601.640034] binder: undelivered TRANSACTION_ERROR: 29201
[  601.652875] binder: undelivered TRANSACTION_ERROR: 29201
[  601.682187] binder: undelivered TRANSACTION_ERROR: 29201
[  601.682468] binder: undelivered TRANSACTION_ERROR: 29201
[  601.692188] binder: undelivered TRANSACTION_ERROR: 29201
[  601.705829] binder: BINDER_SET_CONTEXT_MGR already set
[  601.705837] binder: 32567:32568 ioctl 40046207 0 returned -16
[  601.706588] binder_alloc: 32547: binder_alloc_buf, no vma
[  601.706629] binder: 32567:32568 transaction failed 29189/-3, size 40-16 line 3134
[  601.706957] binder: undelivered TRANSACTION_ERROR: 29201
[  601.710890] binder: undelivered TRANSACTION_ERROR: 29201
[  601.718706] binder: undelivered TRANSACTION_ERROR: 29189
[  601.721371] binder: BINDER_SET_CONTEXT_MGR already set
[  601.721379] binder: 32572:32573 ioctl 40046207 0 returned -16
[  601.723813] binder_alloc: 32547: binder_alloc_buf, no vma
[  601.723852] binder: 32572:32573 transaction failed 29189/-3, size 40-16 line 3134
[  601.727766] binder: BINDER_SET_CONTEXT_MGR already set
[  601.727774] binder: 32570:32574 ioctl 40046207 0 returned -16
[  601.729780] binder_alloc: 32547: binder_alloc_buf, no vma
[  601.729817] binder: 32570:32574 transaction failed 29189/-3, size 40-16 line 3134
[  601.731839] binder: BINDER_SET_CONTEXT_MGR already set
[  601.731848] binder: 32561:32569 ioctl 40046207 0 returned -16
[  601.733884] binder_alloc: 32547: binder_alloc_buf, no vma
[  601.733923] binder: 32561:32569 transaction failed 29189/-3, size 40-16 line 3134
[  601.759031] binder: undelivered TRANSACTION_ERROR: 29189
[  601.760231] binder: undelivered TRANSACTION_ERROR: 29189
[  601.763980] binder: BINDER_SET_CONTEXT_MGR already set
[  601.763988] binder: 32576:32585 ioctl 40046207 0 returned -16
[  601.764713] binder_alloc: 32547: binder_alloc_buf, no vma
[  601.764753] binder: 32576:32585 transaction failed 29189/-3, size 40-16 line 3134
[  601.786836] binder: 32571:32582 got transaction with invalid offset (0, min 24 max 40) or object.
[  601.786922] binder: 32571:32582 transaction failed 29201/-22, size 40-16 line 3197
[  601.796055] binder: undelivered TRANSACTION_ERROR: 29189
[  601.801296] binder: BINDER_SET_CONTEXT_MGR already set
[  601.801304] binder: 32581:32590 ioctl 40046207 0 returned -16
[  601.802557] binder: undelivered TRANSACTION_ERROR: 29189
[  601.804768] binder: 32581:32590 got transaction with invalid offset (0, min 24 max 40) or object.
[  601.804770] binder: BINDER_SET_CONTEXT_MGR already set
[  601.804776] binder: 32580:32583 ioctl 40046207 0 returned -16
[  601.804860] binder: 32581:32590 transaction failed 29201/-22, size 40-16 line 3197
[  601.805617] binder: 32580:32583 got transaction with invalid offset (0, min 24 max 40) or object.
[  601.805707] binder: 32580:32583 transaction failed 29201/-22, size 40-16 line 3197
[  601.813372] binder: undelivered TRANSACTION_ERROR: 29201
[  601.827129] binder: BINDER_SET_CONTEXT_MGR already set
[  601.827136] binder: 32588:32594 ioctl 40046207 0 returned -16
[  601.830120] binder: 32588:32594 got transaction with invalid offset (0, min 24 max 40) or object.
[  601.830208] binder: 32588:32594 transaction failed 29201/-22, size 40-16 line 3197
[  601.832785] binder: BINDER_SET_CONTEXT_MGR already set
[  601.832794] binder: 32587:32595 ioctl 40046207 0 returned -16
[  601.833408] binder: BINDER_SET_CONTEXT_MGR already set
[  601.833414] binder: 32591:32593 ioctl 40046207 0 returned -16
[  601.834603] binder: 32587:32595 got transaction with invalid offset (0, min 24 max 40) or object.
[  601.834694] binder: 32587:32595 transaction failed 29201/-22, size 40-16 line 3197
[  601.855439] binder: undelivered TRANSACTION_ERROR: 29201
[  601.864804] binder: undelivered TRANSACTION_ERROR: 29201
[  601.873648] binder: undelivered TRANSACTION_ERROR: 29201
[  601.888778] binder: undelivered TRANSACTION_ERROR: 29201
[  601.922761] binder: BINDER_SET_CONTEXT_MGR already set
[  601.922769] binder: 32604:32607 ioctl 40046207 0 returned -16
[  601.922840] binder: 32601:32605 got transaction with invalid offset (0, min 24 max 40) or object.
[  601.922931] binder: 32601:32605 transaction failed 29201/-22, size 40-16 line 3197
[  601.924980] binder: 32604:32607 got transaction with invalid offset (0, min 24 max 40) or object.
[  601.925065] binder: 32604:32607 transaction failed 29201/-22, size 40-16 line 3197
[  601.928279] binder: BINDER_SET_CONTEXT_MGR already set
[  601.928287] binder: 32603:32612 ioctl 40046207 0 returned -16
[  601.928449] binder: BINDER_SET_CONTEXT_MGR already set
[  601.928455] binder: 32602:32608 ioctl 40046207 0 returned -16
[  601.929395] binder: 32602:32608 got transaction with invalid offset (0, min 24 max 40) or object.
[  601.929483] binder: 32602:32608 transaction failed 29201/-22, size 40-16 line 3197
[  601.929552] binder: 32603:32612 got transaction with invalid offset (0, min 24 max 40) or object.
[  601.929640] binder: 32603:32612 transaction failed 29201/-22, size 40-16 line 3197
[  601.937325] binder: BINDER_SET_CONTEXT_MGR already set
[  601.937333] binder: 32610:32613 ioctl 40046207 0 returned -16
[  601.940695] binder: 32610:32613 got transaction with invalid offset (0, min 24 max 40) or object.
[  601.940787] binder: 32610:32613 transaction failed 29201/-22, size 40-16 line 3197
[  601.942553] binder: BINDER_SET_CONTEXT_MGR already set
[  601.942561] binder: 32606:32615 ioctl 40046207 0 returned -16
[  601.944052] binder: 32606:32615 got transaction with invalid offset (0, min 24 max 40) or object.
[  601.944140] binder: 32606:32615 transaction failed 29201/-22, size 40-16 line 3197
[  601.944174] binder: BINDER_SET_CONTEXT_MGR already set
[  601.944181] binder: 32609:32614 ioctl 40046207 0 returned -16
[  601.952247] binder: 32609:32614 got transaction with invalid offset (0, min 24 max 40) or object.
[  601.955482] binder: undelivered TRANSACTION_ERROR: 29201
[  601.962956] binder: 32609:32614 transaction failed 29201/-22, size 40-16 line 3197
[  601.973131] binder: undelivered TRANSACTION_ERROR: 29201
[  601.976297] binder: undelivered TRANSACTION_ERROR: 29201
[  601.980406] binder: BINDER_SET_CONTEXT_MGR already set
[  601.980414] binder: 32623:32627 ioctl 40046207 0 returned -16
[  601.981949] binder: 32623:32627 got transaction with invalid offset (0, min 24 max 40) or object.
[  601.982039] binder: 32623:32627 transaction failed 29201/-22, size 40-16 line 3197
[  601.994734] binder: BINDER_SET_CONTEXT_MGR already set
[  601.994744] binder: 32611:32619 ioctl 40046207 0 returned -16
[  602.001148] binder: undelivered TRANSACTION_ERROR: 29201
[  602.015659] binder: undelivered TRANSACTION_ERROR: 29201
[  602.025710] binder: 32630:32632 got transaction with invalid offset (0, min 24 max 40) or object.
[  602.025801] binder: 32630:32632 transaction failed 29201/-22, size 40-16 line 3197
[  602.029509] binder: undelivered TRANSACTION_ERROR: 29201
[  602.040909] binder: BINDER_SET_CONTEXT_MGR already set
[  602.040917] binder: 32636:32638 ioctl 40046207 0 returned -16
[  602.043358] binder: undelivered TRANSACTION_ERROR: 29201
[  602.044742] binder: BINDER_SET_CONTEXT_MGR already set
[  602.044750] binder: 32629:32635 ioctl 40046207 0 returned -16
[  602.045702] binder: 32629:32635 got transaction with invalid offset (0, min 24 max 40) or object.
[  602.045790] binder: 32629:32635 transaction failed 29201/-22, size 40-16 line 3197
[  602.065409] binder: BINDER_SET_CONTEXT_MGR already set
[  602.065416] binder: 32634:32640 ioctl 40046207 0 returned -16
[  602.068380] binder: 32634:32640 got transaction with invalid offset (0, min 24 max 40) or object.
[  602.068473] binder: 32634:32640 transaction failed 29201/-22, size 40-16 line 3197
[  602.070317] binder: undelivered TRANSACTION_ERROR: 29201
[  602.073629] binder: undelivered TRANSACTION_ERROR: 29201
[  602.080766] binder: undelivered TRANSACTION_ERROR: 29201
[  602.087727] binder: BINDER_SET_CONTEXT_MGR already set
[  602.087736] binder: 32642:32644 ioctl 40046207 0 returned -16
[  602.088083] binder: 32639:32645 got transaction with invalid offset (0, min 24 max 40) or object.
[  602.088574] binder: 32639:32645 transaction failed 29201/-22, size 40-16 line 3197
[  602.089656] binder: 32642:32644 got transaction with invalid offset (0, min 24 max 40) or object.
[  602.089742] binder: 32642:32644 transaction failed 29201/-22, size 40-16 line 3197
[  602.101709] binder: undelivered TRANSACTION_ERROR: 29201
[  602.110632] binder: undelivered TRANSACTION_ERROR: 29201
[  602.136882] binder: undelivered TRANSACTION_ERROR: 29201
[  602.170221] binder: BINDER_SET_CONTEXT_MGR already set
[  602.170228] binder: 32657:32662 ioctl 40046207 0 returned -16
[  602.173791] binder: 32655:32658 got transaction with invalid offset (0, min 24 max 40) or object.
[  602.174633] binder: 32655:32658 transaction failed 29201/-22, size 40-16 line 3197
[  602.175683] binder: BINDER_SET_CONTEXT_MGR already set
[  602.175690] binder: 32653:32664 ioctl 40046207 0 returned -16
[  602.176566] binder: 32653:32664 got transaction with invalid offset (0, min 24 max 40) or object.
[  602.176725] binder: 32653:32664 transaction failed 29201/-22, size 40-16 line 3197
[  602.177377] binder: BINDER_SET_CONTEXT_MGR already set
[  602.177383] binder: 32652:32660 ioctl 40046207 0 returned -16
[  602.178215] binder: 32652:32660 got transaction with invalid offset (0, min 24 max 40) or object.
[  602.178516] binder: 32652:32660 transaction failed 29201/-22, size 40-16 line 3197
[  602.186050] binder: BINDER_SET_CONTEXT_MGR already set
[  602.186057] binder: 32661:32667 ioctl 40046207 0 returned -16
[  602.190784] binder: 32661:32667 got transaction with invalid offset (0, min 24 max 40) or object.
[  602.190864] binder: 32661:32667 transaction failed 29201/-22, size 40-16 line 3197
[  602.192990] binder: BINDER_SET_CONTEXT_MGR already set
[  602.192998] binder: 32654:32663 ioctl 40046207 0 returned -16
[  602.194887] binder: BINDER_SET_CONTEXT_MGR already set
[  602.194895] binder: 32659:32665 ioctl 40046207 0 returned -16
[  602.194992] binder: 32654:32663 got transaction with invalid offset (0, min 24 max 40) or object.
[  602.195219] binder: 32654:32663 transaction failed 29201/-22, size 40-16 line 3197
[  602.201229] binder: 32659:32665 got transaction with invalid offset (0, min 24 max 40) or object.
[  602.201309] binder: 32659:32665 transaction failed 29201/-22, size 40-16 line 3197
[  602.203080] binder: BINDER_SET_CONTEXT_MGR already set
[  602.203088] binder: 32656:32666 ioctl 40046207 0 returned -16
[  602.203433] binder: 32656:32666 got transaction with invalid offset (0, min 0 max 0) or object.
[  602.203485] binder: 32656:32666 transaction failed 29201/-22, size 0-16 line 3197
[  602.203731] binder: undelivered TRANSACTION_ERROR: 29201
[  602.222794] binder: undelivered TRANSACTION_ERROR: 29201
[  602.239113] binder: undelivered TRANSACTION_ERROR: 29201
[  602.245962] binder: undelivered TRANSACTION_ERROR: 29201
[  602.259371] binder: undelivered TRANSACTION_ERROR: 29201
[  602.259748] binder: undelivered TRANSACTION_ERROR: 29201
[  602.271150] binder: 32676:32682 got transaction with invalid offset (0, min 24 max 40) or object.
[  602.271245] binder: 32676:32682 transaction failed 29201/-22, size 40-16 line 3197
[  602.276785] binder: BINDER_SET_CONTEXT_MGR already set
[  602.276792] binder: 32678:32685 ioctl 40046207 0 returned -16
[  602.278394] binder: 32678:32685 got transaction with invalid offset (0, min 24 max 40) or object.
[  602.278481] binder: 32678:32685 transaction failed 29201/-22, size 40-16 line 3197
[  602.288887] binder: BINDER_SET_CONTEXT_MGR already set
[  602.288896] binder: 32681:32687 ioctl 40046207 0 returned -16
[  602.289597] binder: BINDER_SET_CONTEXT_MGR already set
[  602.289604] binder: 32680:32688 ioctl 40046207 0 returned -16
[  602.289953] binder_alloc: 32676: binder_alloc_buf, no vma
[  602.289991] binder: 32681:32687 transaction failed 29189/-3, size 40-16 line 3134
[  602.290579] binder: undelivered TRANSACTION_ERROR: 29201
[  602.293829] binder: 32684:32689 got transaction with invalid offset (0, min 24 max 40) or object.
[  602.293955] binder: 32684:32689 transaction failed 29201/-22, size 40-16 line 3197
[  602.297691] binder: undelivered TRANSACTION_ERROR: 29201
[  602.304430] binder: undelivered TRANSACTION_ERROR: 29201
[  602.321227] binder: BINDER_SET_CONTEXT_MGR already set
[  602.321234] binder: 32686:32695 ioctl 40046207 0 returned -16
[  602.324764] binder: 32686:32695 got transaction with invalid offset (0, min 24 max 40) or object.
[  602.324849] binder: 32686:32695 transaction failed 29201/-22, size 40-16 line 3197
[  602.331365] binder: undelivered TRANSACTION_ERROR: 29189
[  602.331569] binder: BINDER_SET_CONTEXT_MGR already set
[  602.331576] binder: 32690:32692 ioctl 40046207 0 returned -16
[  602.332374] binder: 32690:32692 got transaction with invalid offset (0, min 0 max 0) or object.
[  602.332430] binder: 32690:32692 transaction failed 29201/-22, size 0-16 line 3197
[  602.337860] binder: BINDER_SET_CONTEXT_MGR already set
[  602.337868] binder: 32693:32698 ioctl 40046207 0 returned -16
[  602.338875] binder: 32693:32698 got transaction with invalid offset (0, min 24 max 40) or object.
[  602.338964] binder: 32693:32698 transaction failed 29201/-22, size 40-16 line 3197
[  602.358780] binder: BINDER_SET_CONTEXT_MGR already set
[  602.358788] binder: 32697:32701 ioctl 40046207 0 returned -16
[  602.364556] binder: undelivered TRANSACTION_ERROR: 29201
[  602.364688] binder: undelivered TRANSACTION_ERROR: 29201
[  602.367089] binder: undelivered TRANSACTION_ERROR: 29201
[  602.368814] binder: 32697:32701 transaction failed 29189/-22, size 40-16 line 3011
[  602.381177] binder: undelivered TRANSACTION_ERROR: 29189
[  602.382606] INFO: task init:31101 blocked for more than 120 seconds.
[  602.382611]       Not tainted 4.4.125-g38f41ec #63
[  602.382612] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
[  602.382631] init            D ffff8801d2a97718 29272 31101      1 0x00000000
[  602.382639]  ffff8801d2a97718 ffff8800b65ec800 0000000000000000 0000000000000007
[  602.382645]  ffff8800b65ec800 ffff8801db21fdb8 ffff8801db21fde0 ffff8801db21f4d8
[  602.382650]  ffff8801db21f4c0 ffff8800b65ee000 ffff8800b65ec800 0000000000000000
[  602.382651] Call Trace:
[  602.382665]  [<ffffffff8376b82a>] schedule+0x7a/0x1b0
[  602.382670]  [<ffffffff8376c023>] schedule_preempt_disabled+0x13/0x20
[  602.382675]  [<ffffffff837705e6>] mutex_lock_nested+0x306/0x850
[  602.382683]  [<ffffffff81f4f7ea>] ? tty_open+0x4ca/0xee0
[  602.382688]  [<ffffffff837702e0>] ? __ww_mutex_lock+0x14f0/0x14f0
[  602.382693]  [<ffffffff81f4f478>] ? tty_open+0x158/0xee0
[  602.382700]  [<ffffffff814f9d40>] ? kmem_cache_alloc_trace+0x100/0x2b0
[  602.382705]  [<ffffffff81f4f7ea>] tty_open+0x4ca/0xee0
[  602.382710]  [<ffffffff81f4f320>] ? tty_init_dev+0x430/0x430
[  602.382716]  [<ffffffff8152a507>] ? chrdev_open+0xc7/0x4c0
[  602.382721]  [<ffffffff81f4f320>] ? tty_init_dev+0x430/0x430
[  602.382726]  [<ffffffff8152a66b>] chrdev_open+0x22b/0x4c0
[  602.382730]  [<ffffffff8152a440>] ? cdev_put.part.0+0x50/0x50
[  602.382736]  [<ffffffff8151881b>] do_dentry_open+0x59b/0xba0
[  602.382741]  [<ffffffff8153cfab>] ? __inode_permission2+0x9b/0x240
[  602.382746]  [<ffffffff8152a440>] ? cdev_put.part.0+0x50/0x50
[  602.382751]  [<ffffffff8151c0e0>] vfs_open+0x110/0x210
[  602.382755]  [<ffffffff8153d59e>] ? may_open+0x1ae/0x280
[  602.382759]  [<ffffffff8154d373>] path_openat+0x923/0x3940
[  602.382766]  [<ffffffff81daf873>] ? depot_save_stack+0x1c3/0x640
[  602.382771]  [<ffffffff8154ca50>] ? path_mountpoint+0x830/0x830
[  602.382775]  [<ffffffff815508cb>] ? getname_flags+0xcb/0x580
[  602.382779]  [<ffffffff81550d99>] ? getname+0x19/0x20
[  602.382783]  [<ffffffff8151c96f>] ? do_sys_open+0x21f/0x660
[  602.382788]  [<ffffffff8151cddd>] ? SyS_open+0x2d/0x40
[  602.382794]  [<ffffffff83779965>] ? entry_SYSCALL_64_fastpath+0x22/0x9e
[  602.382801]  [<ffffffff812378f0>] ? debug_check_no_locks_freed+0x2c0/0x2c0
[  602.382806]  [<ffffffff81230631>] ? __lock_is_held+0xa1/0xf0
[  602.382811]  [<ffffffff81553017>] do_filp_open+0x197/0x290
[  602.382815]  [<ffffffff81552e80>] ? user_path_mountpoint_at+0x40/0x40
[  602.382820]  [<ffffffff83778e2c>] ? _raw_spin_unlock+0x2c/0x50
[  602.382826]  [<ffffffff8157a573>] ? __alloc_fd+0x1e3/0x500
[  602.382831]  [<ffffffff8151cab9>] do_sys_open+0x369/0x660
[  602.382836]  [<ffffffff8151c750>] ? filp_open+0x70/0x70
[  602.382841]  [<ffffffff81f4a2b9>] ? proc_clear_tty+0xd9/0x140
[  602.382846]  [<ffffffff83779457>] ? _raw_write_unlock_irq+0x27/0x50
[  602.382851]  [<ffffffff8151cddd>] SyS_open+0x2d/0x40
[  602.382856]  [<ffffffff83779965>] entry_SYSCALL_64_fastpath+0x22/0x9e
[  602.382860] 1 lock held by init/31101:
[  602.382875]  #0:  (tty_mutex){+.+.+.}, at: [<ffffffff81f4f7ea>] tty_open+0x4ca/0xee0
[  602.382878] Sending NMI to all CPUs:
[  602.383062] NMI backtrace for cpu 0
[  602.383065] CPU: 0 PID: 10148 Comm: syz-fuzzer Not tainted 4.4.125-g38f41ec #63
[  602.383067] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[  602.383069] task: ffff8801d9931800 task.stack: ffff8800ac6f0000
[  602.383071] RIP: 0033:[<000000000040b55d>]  [<000000000040b55d>] 0x40b55d
[  602.383073] RSP: 002b:000000c45686f420  EFLAGS: 00000293
[  602.383075] RAX: 000000c47c1f2860 RBX: 0000000098e2750f RCX: 0000000000000000
[  602.383077] RDX: 000000c47c1f2860 RSI: 000000000000ffff RDI: 0000000000000000
[  602.383079] RBP: 000000c45686f438 R08: 0000000000000000 R09: 0000000000000000
[  602.383081] R10: 00000000009386c4 R11: 0000000000000004 R12: 0000000000000000
[  602.383083] R13: 0000000000000020 R14: 0000000000000013 R15: 000000000000000e
[  602.383085] FS:  000000c4845eb8e8(0000) GS:ffff8801db200000(0000) knlGS:0000000000000000
[  602.383087] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  602.383090] CR2: 0000000000a3f1c8 CR3: 00000001d3496000 CR4: 0000000000160670
[  602.383092] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[  602.383095] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[  602.383096] 
[  602.383097] NMI backtrace for cpu 1
[  602.383100] CPU: 1 PID: 486 Comm: khungtaskd Not tainted 4.4.125-g38f41ec #63
[  602.383103] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[  602.383105] task: ffff8800bac6c800 task.stack: ffff8800bb370000
[  602.383108] RIP: 0010:[<ffffffff810c3f87>]  [<ffffffff810c3f87>] flat_send_IPI_mask+0xf7/0x1a0
[  602.383110] RSP: 0018:ffff8800bb377cb8  EFLAGS: 00000046
[  602.383112] RAX: 0000000003000000 RBX: 0000000000000c00 RCX: 0000000000000000
[  602.383114] RDX: 0000000000000c00 RSI: 0000000000000000 RDI: ffffffffff5fb300
[  602.383116] RBP: ffff8800bb377ce0 R08: 0000000000000001 R09: 0000000000000000
[  602.383119] R10: 0000000000000000 R11: 0000000000000001 R12: 0000000000000246
[  602.383121] R13: 0000000000000003 R14: ffffffff8426f5a0 R15: 0000000000000002
[  602.383124] FS:  0000000000000000(0000) GS:ffff8801db300000(0000) knlGS:0000000000000000
[  602.383126] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  602.383128] CR2: 00000000200004c8 CR3: 000000000420c000 CR4: 0000000000160670
[  602.383130] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[  602.383133] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[  602.383134] Stack:
[  602.383136]  ffffffff8426f5a0 ffffffff847f0b40 fffffbfff08fdc1c dffffc0000000000
[  602.383139]  ffff8801db31bca0 ffff8800bb377d00 ffffffff810b9abb ffffffff839f6dc0
[  602.383141]  0000000000000003 ffff8800bb377d60 ffffffff81d11764 ffffffff8141b993
[  602.383142] Call Trace:
[  602.383144]  [<ffffffff810b9abb>] nmi_raise_cpu_backtrace+0x5b/0x70
[  602.383146]  [<ffffffff81d11764>] nmi_trigger_all_cpu_backtrace+0x4a4/0x550
[  602.383148]  [<ffffffff8141b993>] ? print_lock+0xab/0xae
[  602.383150]  [<ffffffff810b9a60>] ? irq_force_complete_move+0x3b0/0x3b0
[  602.383152]  [<ffffffff810b9b54>] arch_trigger_all_cpu_backtrace+0x14/0x20
[  602.383154]  [<ffffffff813695ca>] watchdog+0x6fa/0xae0
[  602.383156]  [<ffffffff81368f93>] ? watchdog+0xc3/0xae0
[  602.383158]  [<ffffffff81190b48>] kthread+0x268/0x300
[  602.383160]  [<ffffffff81368ed0>] ? reset_hung_task_detector+0x20/0x20
[  602.383162]  [<ffffffff811908e0>] ? kthread_create_on_node+0x400/0x400
[  602.383163]  [<ffffffff811908e0>] ? kthread_create_on_node+0x400/0x400
[  602.383165]  [<ffffffff83779d95>] ret_from_fork+0x55/0x80
[  602.383167]  [<ffffffff811908e0>] ? kthread_create_on_node+0x400/0x400
[  602.383172] Code: b3 5f ff f6 c4 10 75 e1 44 89 e8 c1 e0 18 89 04 25 10 b3 5f ff 44 89 fa 09 da 80 cf 04 41 83 ff 02 0f 44 d3 89 14 25 00 b3 5f ff <41> f7 c4 00 02 00 00 74 1a e8 2b 33 17 00 4c 89 e7 57 9d 0f 1f 
[  602.383332] Kernel panic - not syncing: hung_task: blocked tasks
[  602.383337] CPU: 1 PID: 486 Comm: khungtaskd Not tainted 4.4.125-g38f41ec #63
[  602.383340] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[  602.383347]  0000000000000000 220190a556df05c1 ffff8800bb377ca8 ffffffff81d067bd
[  602.383355]  ffffffff838831a0 ffff8800bb377d80 dffffc0000000000 7fffffffffffffff
[  602.383362]  ffff8800b65ecc48 ffff8800bb377d70 ffffffff8141b46a 0000000041b58ab3
[  602.383363] Call Trace:
[  602.383371]  [<ffffffff81d067bd>] dump_stack+0xc1/0x124
[  602.383378]  [<ffffffff8141b46a>] panic+0x1aa/0x388
[  602.383384]  [<ffffffff8141b2c0>] ? percpu_up_read.constprop.45+0xe1/0xe1
[  602.383391]  [<ffffffff81d116b8>] ? nmi_trigger_all_cpu_backtrace+0x3f8/0x550
[  602.383397]  [<ffffffff81d116b8>] ? nmi_trigger_all_cpu_backtrace+0x3f8/0x550
[  602.383403]  [<ffffffff813695db>] watchdog+0x70b/0xae0
[  602.383407]  [<ffffffff81368f93>] ? watchdog+0xc3/0xae0
[  602.383414]  [<ffffffff81190b48>] kthread+0x268/0x300
[  602.383420]  [<ffffffff81368ed0>] ? reset_hung_task_detector+0x20/0x20
[  602.383426]  [<ffffffff811908e0>] ? kthread_create_on_node+0x400/0x400
[  602.383434]  [<ffffffff811908e0>] ? kthread_create_on_node+0x400/0x400
[  602.383440]  [<ffffffff83779d95>] ret_from_fork+0x55/0x80
[  602.383446]  [<ffffffff811908e0>] ? kthread_create_on_node+0x400/0x400
[  602.383935] Dumping ftrace buffer:
[  602.383967]    (ftrace buffer empty)
[  602.383969] Kernel Offset: disabled
[  625.338170] Rebooting in 86400 seconds..