$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x7c, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @increfs_done={0x40106308, r1, 0x3}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
r2 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r2, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
keyctl$assume_authority(0x10, 0x0)
r3 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r3, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(0xffffffffffffffff, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x0, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6c8344f9f96ef2c7fe911c01908", 0x5c, 0x0, &(0x7f0000000040)={0x77359400})
r4 = add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0e9467edd", 0x19, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, r4, &(0x7f00000006c0)=[{&(0x7f0000000400)}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r5 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(r0, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x32b, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r5}], 0x1, 0x0)

2018/03/29 19:07:47 executing program 5:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
r1 = mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x7c, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @increfs_done={0x40106308, r1, 0x3}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r2 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r3, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
keyctl$assume_authority(0x10, 0x0)
r4 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r4, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(r4, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x200, 0x1, 0x3}, 0xfff1}, 0x1}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6c834", 0x51, 0x0, &(0x7f0000000040)={0x77359400})
r5 = add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0e9467edd7f398f", 0x1c, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, r5, &(0x7f00000006c0)=[{&(0x7f0000000400)}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r6 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(0xffffffffffffffff, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000080)={0x0, 0x0, &(0x7f000000dff8), 0x0, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r6}], 0x1, 0x0)

2018/03/29 19:07:47 executing program 6:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
r1 = mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x7c, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @increfs_done={0x40106308, r1, 0x3}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r2 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r3, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
keyctl$assume_authority(0x10, 0x0)
r4 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r4, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(r4, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x200, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6c8344f9f96ef2c7fe911c019", 0x5b, 0x0, &(0x7f0000000040)={0x77359400})
add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0e9467edd7f398f", 0x1c, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, 0x0, &(0x7f00000006c0)=[{&(0x7f0000000400)}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r5 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(0xffffffffffffffff, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000080)={0x0, 0x0, &(0x7f000000dff8), 0x0, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r5}], 0x1, 0x0)

[ 1523.555419] binder: 17006:17007 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1523.683011] binder: BINDER_SET_CONTEXT_MGR already set
[ 1523.683018] binder: 17009:17012 ioctl 40046207 0 returned -16
[ 1523.697211] binder: BINDER_SET_CONTEXT_MGR already set
[ 1523.697219] binder: 17010:17013 ioctl 40046207 0 returned -16
[ 1523.700754] binder: BINDER_SET_CONTEXT_MGR already set
[ 1523.700761] binder: 17008:17019 ioctl 40046207 0 returned -16
[ 1523.701613] binder: BINDER_SET_CONTEXT_MGR already set
[ 1523.701620] binder: 17014:17018 ioctl 40046207 0 returned -16
[ 1523.701996] binder: BINDER_SET_CONTEXT_MGR already set
[ 1523.702003] binder: 17017:17021 ioctl 40046207 0 returned -16
[ 1523.706035] binder: BINDER_SET_CONTEXT_MGR already set
[ 1523.706042] binder: 17011:17020 ioctl 40046207 0 returned -16
[ 1523.708931] binder: 17014:17018 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1523.716867] binder: 17011:17020 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1523.773061] binder: BINDER_SET_CONTEXT_MGR already set
[ 1523.773069] binder: 17025:17026 ioctl 40046207 0 returned -16
[ 1523.776608] binder: 17025:17026 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1523.809063] binder: BINDER_SET_CONTEXT_MGR already set
[ 1523.809070] binder: 17027:17028 ioctl 40046207 0 returned -16
[ 1523.829245] binder: 17027:17028 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1524.022948] binder: BINDER_SET_CONTEXT_MGR already set
[ 1524.022956] binder: 17033:17039 ioctl 40046207 0 returned -16
[ 1524.023495] binder: BINDER_SET_CONTEXT_MGR already set
[ 1524.023501] binder: 17032:17037 ioctl 40046207 0 returned -16
[ 1524.026510] binder: BINDER_SET_CONTEXT_MGR already set
2018/03/29 19:07:48 executing program 2:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x70, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @release={0x40046306, 0x1}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r1 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
r2 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r2, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
r3 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r3, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4}}, 0x2e)
sendmsg$nl_crypto(r3, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x200, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6c8344f9f96ef2c7fe911c019080e", 0x5d, 0x0, &(0x7f0000000040)={0x77359400})
r4 = add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0e9467edd7f398f", 0x1c, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, r4, &(0x7f00000006c0)=[{&(0x7f0000000400)="f916b8f72c29a4ed654ec4634d479b3453a0dbdd444019513f1d25ccda2381b9d22363dbeef5a27f13994695211b14422a35c08f7510fa", 0x37}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r5 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(r0, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x32b, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r5}], 0x1, 0x0)

2018/03/29 19:07:48 executing program 5:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
r1 = mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x7c, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @increfs_done={0x40106308, r1, 0x3}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r2 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r3, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
keyctl$assume_authority(0x10, 0x0)
r4 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r4, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(r4, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x200, 0x1, 0x3}, 0xfff1}, 0x1}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6c834", 0x51, 0x0, &(0x7f0000000040)={0x77359400})
r5 = add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0e9467edd7f398f", 0x1c, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, r5, &(0x7f00000006c0)=[{&(0x7f0000000400)}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r6 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(0xffffffffffffffff, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000080)={0x0, 0x0, &(0x7f000000dff8), 0x0, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r6}], 0x1, 0x0)

2018/03/29 19:07:48 executing program 7:
add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={0x73, 0x79, 0x7a}, &(0x7f0000001100)="a1", 0x1, 0xfffffffffffffffb)
sendmmsg(0xffffffffffffffff, &(0x7f0000000200)=[{{&(0x7f0000003000)=@rc={0x1f}, 0x80, &(0x7f0000004fa0), 0x0, &(0x7f0000002d30)}}], 0x1, 0x0)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f00000000c0)={"d202b999cf85000000000088f301e710"})
r0 = syz_open_dev$tun(&(0x7f0000000280)='/dev/net/tun\x00', 0x0, 0x400200)
r1 = socket(0x11, 0x100000802, 0x0)
r2 = syz_open_dev$tun(&(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000000c0)={'ifb0\x00'})
ioctl$TUNSETLINK(r2, 0x400454cd, 0x308)
ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000040)={'ifb0\x00', 0xa201})
r3 = dup2(r0, 0xffffffffffffffff)
ioctl$TUNSETQUEUE(0xffffffffffffffff, 0x400454d9, &(0x7f0000000000)={'vlan0\x00'})
write$cgroup_subtree(r3, &(0x7f00000001c0)={[{0x0, 'cpu', 0x20}, {0x0, 'pids', 0x20}, {0x0, 'cpu', 0x20}, {0x2d, 'pids', 0x20}, {0x2b, 'pids', 0x20}, {0x0, 'memory', 0x20}]}, 0x24)
connect$unix(r1, &(0x7f0000000100)=@abs, 0x6e)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)

2018/03/29 19:07:48 executing program 0:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
r1 = mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x7c, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @increfs_done={0x40106308, r1, 0x3}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
r2 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r2, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
keyctl$assume_authority(0x10, 0x0)
r3 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r3, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(0xffffffffffffffff, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x0, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6c8344f9f96ef2c7fe911c01908", 0x5c, 0x0, &(0x7f0000000040)={0x77359400})
r4 = add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0e9467edd", 0x19, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, r4, &(0x7f00000006c0)=[{&(0x7f0000000400)}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r5 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(r0, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x32b, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r5}], 0x1, 0x0)

2018/03/29 19:07:48 executing program 6:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
r1 = mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x7c, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @increfs_done={0x40106308, r1, 0x3}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r2 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r3, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
keyctl$assume_authority(0x10, 0x0)
r4 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r4, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(r4, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x200, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6c8344f9f96ef2c7fe911c01908", 0x5c, 0x0, &(0x7f0000000040)={0x77359400})
add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0), 0x0, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, 0x0, &(0x7f00000006c0)=[{&(0x7f0000000400)}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r5 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(0xffffffffffffffff, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000080)={0x0, 0x0, &(0x7f000000dff8), 0x0, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r5}], 0x1, 0x0)

2018/03/29 19:07:48 executing program 4:
add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={0x73, 0x79, 0x7a}, &(0x7f0000001100)="a1", 0x1, 0xfffffffffffffffb)
perf_event_open(&(0x7f000025c000)={0x2, 0x78}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
pipe2(&(0x7f0000000180), 0x0)
socket(0x18, 0x0, 0x1)
sendmmsg(0xffffffffffffffff, &(0x7f0000000200)=[{{&(0x7f0000003000)=@rc={0x1f}, 0x80, &(0x7f0000004fa0), 0x0, &(0x7f0000002d30)}}], 0x1, 0x0)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f00000000c0)={"d202b999cf85000000000088f301e710"})
r0 = syz_open_dev$tun(&(0x7f0000000280)='/dev/net/tun\x00', 0x0, 0x400200)
r1 = socket(0x11, 0x100000802, 0x0)
r2 = syz_open_dev$tun(&(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000000c0)={'ifb0\x00', 0x1001})
ioctl$TUNSETLINK(0xffffffffffffffff, 0x400454cd, 0x308)
ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000040)={'ifb0\x00', 0xa201})
r3 = dup2(r0, 0xffffffffffffffff)
ioctl$TUNSETQUEUE(0xffffffffffffffff, 0x400454d9, &(0x7f0000000000)={'vlan0\x00'})
write$cgroup_subtree(r3, &(0x7f00000001c0)={[{0x2d, 'pids', 0x20}, {0x0, 'cpu', 0x20}, {0x2d, 'pids', 0x20}, {0x2b, 'rdma', 0x20}, {0x0, 'pids', 0x20}, {0x0, 'io', 0x20}]}, 0x21)
connect$unix(0xffffffffffffffff, &(0x7f0000000100)=@abs, 0x6e)
ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82)

2018/03/29 19:07:48 executing program 1:
add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={0x73, 0x79, 0x7a}, &(0x7f0000001100)="a1", 0x1, 0xfffffffffffffffb)
perf_event_open(&(0x7f000025c000)={0x0, 0x78}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sendmmsg(0xffffffffffffffff, &(0x7f0000000200)=[{{&(0x7f0000003000)=@rc={0x1f}, 0x80, &(0x7f0000004fa0), 0x0, &(0x7f0000002d30)}}], 0x1, 0x0)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f00000000c0)={"d202b999cf85000000000088f301e710"})
r0 = syz_open_dev$tun(&(0x7f0000000280)='/dev/net/tun\x00', 0x0, 0x400200)
r1 = socket(0x11, 0x100000802, 0x0)
r2 = syz_open_dev$tun(&(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000000c0)={'ifb0\x00', 0x1001})
ioctl$TUNSETLINK(r2, 0x400454cd, 0x308)
ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000040)={'ifb0\x00'})
r3 = dup2(r0, 0xffffffffffffffff)
ioctl$TUNSETQUEUE(0xffffffffffffffff, 0x400454d9, &(0x7f0000000000)={'vlan0\x00'})
write$cgroup_subtree(r3, &(0x7f00000001c0)={[{0x0, 'cpu', 0x20}, {0x0, 'pids', 0x20}, {0x0, 'cpu', 0x20}, {0x2d, 'pids', 0x20}, {0x2b, 'pids', 0x20}, {0x0, 'memory', 0x20}]}, 0x24)
connect$unix(r1, &(0x7f0000000100)=@abs, 0x6e)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)

2018/03/29 19:07:48 executing program 3:
add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={0x73, 0x79, 0x7a}, &(0x7f0000001100)="a1", 0x1, 0xfffffffffffffffb)
perf_event_open(&(0x7f000025c000)={0x2, 0x78}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sendmmsg(0xffffffffffffffff, &(0x7f0000000200), 0x0, 0x0)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f00000000c0)={"d202b999cf85000000000088f301e710"})
r0 = syz_open_dev$tun(&(0x7f0000000280)='/dev/net/tun\x00', 0x0, 0x400200)
r1 = socket(0x11, 0x100000802, 0x0)
r2 = syz_open_dev$tun(&(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000000c0)={'ifb0\x00', 0x1001})
ioctl$TUNSETLINK(r2, 0x400454cd, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000040)={'ifb0\x00', 0xa201})
r3 = dup2(r0, 0xffffffffffffffff)
ioctl$TUNSETQUEUE(0xffffffffffffffff, 0x400454d9, &(0x7f0000000000)={'vlan0\x00'})
write$cgroup_subtree(r3, &(0x7f00000001c0)={[{0x0, 'cpu', 0x20}, {0x0, 'pids', 0x20}, {0x0, 'cpu', 0x20}, {0x2d, 'pids', 0x20}, {0x2b, 'rdma', 0x20}, {0x2b, 'pids', 0x20}, {0x0, 'memory', 0x20}]}, 0x2a)
connect$unix(0xffffffffffffffff, &(0x7f0000000100)=@abs, 0x6e)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)

[ 1524.026516] binder: 17030:17040 ioctl 40046207 0 returned -16
[ 1524.026821] binder: BINDER_SET_CONTEXT_MGR already set
[ 1524.026828] binder: 17034:17038 ioctl 40046207 0 returned -16
[ 1524.030708] binder: BINDER_SET_CONTEXT_MGR already set
[ 1524.030714] binder: 17029:17042 ioctl 40046207 0 returned -16
[ 1524.038689] binder: 17034:17038 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1524.042803] binder: BINDER_SET_CONTEXT_MGR already set
[ 1524.042811] binder: 17031:17041 ioctl 40046207 0 returned -16
[ 1524.043248] binder: 17032:17037 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1524.044692] binder: 17029:17042 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1524.128342] binder: BINDER_SET_CONTEXT_MGR already set
[ 1524.128350] binder: 17048:17056 ioctl 40046207 0 returned -16
[ 1524.130854] binder: BINDER_SET_CONTEXT_MGR already set
2018/03/29 19:07:48 executing program 2:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x70, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @release={0x40046306, 0x1}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r1 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
r2 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r2, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
r3 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r3, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(0xffffffffffffffff, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x200, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6c8344f9f96ef2c7fe911c019080e", 0x5d, 0x0, &(0x7f0000000040)={0x77359400})
r4 = add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0e9467edd7f398f", 0x1c, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, r4, &(0x7f00000006c0)=[{&(0x7f0000000400)="f916b8f72c29a4ed654ec4634d479b3453a0dbdd444019513f1d25ccda2381b9d22363dbeef5a27f13994695211b14422a35c08f7510fa", 0x37}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r5 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(r0, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x32b, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r5}], 0x1, 0x0)

2018/03/29 19:07:48 executing program 0:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
r1 = mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x7c, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @increfs_done={0x40106308, r1, 0x3}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r2 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r2, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
keyctl$assume_authority(0x10, 0x0)
r3 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r3, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(0xffffffffffffffff, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x0, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6c8344f9f96ef2c7fe911c01908", 0x5c, 0x0, &(0x7f0000000040)={0x77359400})
r4 = add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0e9467edd", 0x19, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, r4, &(0x7f00000006c0)=[{&(0x7f0000000400)}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r5 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(r0, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x32b, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r5}], 0x1, 0x0)

2018/03/29 19:07:48 executing program 7:
add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={0x73, 0x79, 0x7a}, &(0x7f0000001100)="a1", 0x1, 0xfffffffffffffffb)
sendmmsg(0xffffffffffffffff, &(0x7f0000000200)=[{{&(0x7f0000003000)=@rc={0x1f}, 0x80, &(0x7f0000004fa0), 0x0, &(0x7f0000002d30)}}], 0x1, 0x0)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f00000000c0)={"d202b999cf85000000000088f301e710"})
r0 = syz_open_dev$tun(&(0x7f0000000280)='/dev/net/tun\x00', 0x0, 0x400200)
r1 = socket(0x11, 0x100000802, 0x0)
r2 = syz_open_dev$tun(&(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000000c0)={'ifb0\x00', 0x1001})
ioctl$TUNSETLINK(0xffffffffffffffff, 0x400454cd, 0x308)
ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000040)={'ifb0\x00', 0xa201})
r3 = dup2(r0, 0xffffffffffffffff)
ioctl$TUNSETQUEUE(0xffffffffffffffff, 0x400454d9, &(0x7f0000000000)={'vlan0\x00'})
write$cgroup_subtree(r3, &(0x7f00000001c0)={[{0x0, 'cpu', 0x20}, {0x0, 'pids', 0x20}, {0x0, 'cpu', 0x20}, {0x2d, 'pids', 0x20}, {0x2b, 'pids', 0x20}, {0x0, 'memory', 0x20}]}, 0x24)
connect$unix(r1, &(0x7f0000000100)=@abs, 0x6e)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)

2018/03/29 19:07:48 executing program 6:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
r1 = mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x7c, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @increfs_done={0x40106308, r1, 0x3}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r2 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r3, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
keyctl$assume_authority(0x10, 0x0)
r4 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r4, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(r4, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x200, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6c8344f9f96ef2c7fe911c01908", 0x5c, 0x0, &(0x7f0000000040)={0x77359400})
add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0), 0x0, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, 0x0, &(0x7f00000006c0)=[{&(0x7f0000000400)}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r5 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(0xffffffffffffffff, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000080)={0x0, 0x0, &(0x7f000000dff8), 0x0, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r5}], 0x1, 0x0)

2018/03/29 19:07:48 executing program 5:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
r1 = mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x7c, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @increfs_done={0x40106308, r1, 0x3}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r2 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r3, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
keyctl$assume_authority(0x10, 0x0)
r4 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r4, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(r4, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x200, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x0)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6c834", 0x51, 0x0, &(0x7f0000000040)={0x77359400})
r5 = add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0e9467edd7f398f", 0x1c, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, r5, &(0x7f00000006c0)=[{&(0x7f0000000400)}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r6 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(0xffffffffffffffff, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000080)={0x0, 0x0, &(0x7f000000dff8), 0x0, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r6}], 0x1, 0x0)

[ 1524.130862] binder: 17046:17053 ioctl 40046207 0 returned -16
[ 1524.131919] binder: BINDER_SET_CONTEXT_MGR already set
[ 1524.131926] binder: 17049:17054 ioctl 40046207 0 returned -16
[ 1524.132211] binder: BINDER_SET_CONTEXT_MGR already set
[ 1524.132218] binder: 17052:17058 ioctl 40046207 0 returned -16
[ 1524.134467] binder: BINDER_SET_CONTEXT_MGR already set
[ 1524.134474] binder: 17051:17055 ioctl 40046207 0 returned -16
[ 1524.135516] binder: 17048:17056 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1524.146244] binder: BINDER_SET_CONTEXT_MGR already set
[ 1524.146251] binder: 17050:17057 ioctl 40046207 0 returned -16
[ 1524.150460] binder: 17051:17055 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1524.151080] binder: 17049:17054 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1524.229274] binder: BINDER_SET_CONTEXT_MGR already set
[ 1524.229281] binder: 17060:17063 ioctl 40046207 0 returned -16
2018/03/29 19:07:48 executing program 6:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
r1 = mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x7c, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @increfs_done={0x40106308, r1, 0x3}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r2 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r3, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
keyctl$assume_authority(0x10, 0x0)
r4 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r4, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(r4, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x200, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6c8344f9f96ef2c7fe911c01908", 0x5c, 0x0, &(0x7f0000000040)={0x77359400})
add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0), 0x0, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, 0x0, &(0x7f00000006c0)=[{&(0x7f0000000400)}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r5 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(0xffffffffffffffff, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000080)={0x0, 0x0, &(0x7f000000dff8), 0x0, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r5}], 0x1, 0x0)

2018/03/29 19:07:48 executing program 5:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
r1 = mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x7c, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @increfs_done={0x40106308, r1, 0x3}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r2 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r3, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
keyctl$assume_authority(0x10, 0x0)
r4 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r4, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(r4, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x200, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x0)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6c834", 0x51, 0x0, &(0x7f0000000040)={0x77359400})
r5 = add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0e9467edd7f398f", 0x1c, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, r5, &(0x7f00000006c0)=[{&(0x7f0000000400)}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r6 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(0xffffffffffffffff, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000080)={0x0, 0x0, &(0x7f000000dff8), 0x0, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r6}], 0x1, 0x0)

2018/03/29 19:07:48 executing program 2:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x70, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @release={0x40046306, 0x1}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r1 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
r2 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r2, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
r3 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r3, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(0xffffffffffffffff, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x200, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6c8344f9f96ef2c7fe911c019080e", 0x5d, 0x0, &(0x7f0000000040)={0x77359400})
r4 = add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0e9467edd7f398f", 0x1c, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, r4, &(0x7f00000006c0)=[{&(0x7f0000000400)="f916b8f72c29a4ed654ec4634d479b3453a0dbdd444019513f1d25ccda2381b9d22363dbeef5a27f13994695211b14422a35c08f7510fa", 0x37}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r5 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(r0, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x32b, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r5}], 0x1, 0x0)

2018/03/29 19:07:48 executing program 0:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
r1 = mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x7c, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @increfs_done={0x40106308, r1, 0x3}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r2 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r2, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
keyctl$assume_authority(0x10, 0x0)
r3 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r3, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(0xffffffffffffffff, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x0, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6c8344f9f96ef2c7fe911c01908", 0x5c, 0x0, &(0x7f0000000040)={0x77359400})
r4 = add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0e9467edd", 0x19, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, r4, &(0x7f00000006c0)=[{&(0x7f0000000400)}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r5 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(r0, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x32b, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r5}], 0x1, 0x0)

[ 1524.232107] binder: BINDER_SET_CONTEXT_MGR already set
[ 1524.232115] binder: 17059:17064 ioctl 40046207 0 returned -16
[ 1524.234218] binder: BINDER_SET_CONTEXT_MGR already set
[ 1524.234224] binder: 17062:17067 ioctl 40046207 0 returned -16
[ 1524.239220] binder: 17062:17067 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1524.242722] binder: BINDER_SET_CONTEXT_MGR already set
[ 1524.242729] binder: 17061:17070 ioctl 40046207 0 returned -16
2018/03/29 19:07:48 executing program 0:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
r1 = mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x7c, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @increfs_done={0x40106308, r1, 0x3}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r2 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r2, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
keyctl$assume_authority(0x10, 0x0)
r3 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r3, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(0xffffffffffffffff, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x0, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6c8344f9f96ef2c7fe911c01908", 0x5c, 0x0, &(0x7f0000000040)={0x77359400})
r4 = add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0e9467edd", 0x19, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, r4, &(0x7f00000006c0)=[{&(0x7f0000000400)}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r5 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(r0, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x32b, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r5}], 0x1, 0x0)

2018/03/29 19:07:48 executing program 5:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
r1 = mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x7c, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @increfs_done={0x40106308, r1, 0x3}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r2 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r3, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
keyctl$assume_authority(0x10, 0x0)
r4 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r4, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(r4, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x200, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x0)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6c834", 0x51, 0x0, &(0x7f0000000040)={0x77359400})
r5 = add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0e9467edd7f398f", 0x1c, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, r5, &(0x7f00000006c0)=[{&(0x7f0000000400)}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r6 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(0xffffffffffffffff, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000080)={0x0, 0x0, &(0x7f000000dff8), 0x0, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r6}], 0x1, 0x0)

2018/03/29 19:07:48 executing program 6:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
r1 = mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x7c, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @increfs_done={0x40106308, r1, 0x3}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r2 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r3, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
keyctl$assume_authority(0x10, 0x0)
r4 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r4, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(r4, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x200, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6c8344f9f96ef2c7fe911c01908", 0x5c, 0x0, &(0x7f0000000040)={0x77359400})
add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180", 0xe, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, 0x0, &(0x7f00000006c0)=[{&(0x7f0000000400)}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r5 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(0xffffffffffffffff, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000080)={0x0, 0x0, &(0x7f000000dff8), 0x0, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r5}], 0x1, 0x0)

[ 1524.247630] binder: BINDER_SET_CONTEXT_MGR already set
[ 1524.247637] binder: 17065:17069 ioctl 40046207 0 returned -16
[ 1524.248227] binder: BINDER_SET_CONTEXT_MGR already set
[ 1524.248233] binder: 17066:17068 ioctl 40046207 0 returned -16
[ 1524.250828] binder: 17061:17070 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1524.255483] binder: 17066:17068 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1524.296363] binder: BINDER_SET_CONTEXT_MGR already set
2018/03/29 19:07:48 executing program 2:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x70, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @release={0x40046306, 0x1}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r1 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
r2 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r2, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
r3 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r3, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(0xffffffffffffffff, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x200, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6c8344f9f96ef2c7fe911c019080e", 0x5d, 0x0, &(0x7f0000000040)={0x77359400})
r4 = add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0e9467edd7f398f", 0x1c, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, r4, &(0x7f00000006c0)=[{&(0x7f0000000400)="f916b8f72c29a4ed654ec4634d479b3453a0dbdd444019513f1d25ccda2381b9d22363dbeef5a27f13994695211b14422a35c08f7510fa", 0x37}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r5 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(r0, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x32b, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r5}], 0x1, 0x0)

[ 1524.296370] binder: 17071:17072 ioctl 40046207 0 returned -16
[ 1524.299790] binder: 17071:17072 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1524.303728] binder: BINDER_SET_CONTEXT_MGR already set
[ 1524.303735] binder: 17073:17074 ioctl 40046207 0 returned -16
[ 1524.374977] binder: BINDER_SET_CONTEXT_MGR already set
[ 1524.374986] binder: 17080:17086 ioctl 40046207 0 returned -16
[ 1524.376594] binder: BINDER_SET_CONTEXT_MGR already set
[ 1524.376601] binder: 17078:17082 ioctl 40046207 0 returned -16
[ 1524.377447] binder: BINDER_SET_CONTEXT_MGR already set
[ 1524.377455] binder: 17077:17084 ioctl 40046207 0 returned -16
[ 1524.383178] binder: 17080:17086 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1524.383431] binder: BINDER_SET_CONTEXT_MGR already set
[ 1524.383438] binder: 17076:17087 ioctl 40046207 0 returned -16
[ 1524.387133] binder: BINDER_SET_CONTEXT_MGR already set
[ 1524.387140] binder: 17079:17088 ioctl 40046207 0 returned -16
[ 1524.390835] binder: 17078:17082 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1524.393847] binder: BINDER_SET_CONTEXT_MGR already set
[ 1524.393854] binder: 17083:17089 ioctl 40046207 0 returned -16
[ 1524.393988] binder: 17077:17084 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1524.440287] binder: BINDER_SET_CONTEXT_MGR already set
[ 1524.440294] binder: 17092:17093 ioctl 40046207 0 returned -16
[ 1524.453148] binder: 17092:17093 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1524.493473] binder: BINDER_SET_CONTEXT_MGR already set
[ 1524.493481] binder: 17096:17098 ioctl 40046207 0 returned -16
[ 1524.495533] binder: BINDER_SET_CONTEXT_MGR already set
[ 1524.495540] binder: 17095:17097 ioctl 40046207 0 returned -16
[ 1524.495913] binder: BINDER_SET_CONTEXT_MGR already set
[ 1524.495919] binder: 17094:17099 ioctl 40046207 0 returned -16
[ 1524.500885] binder: 17094:17099 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1524.503263] binder: 17095:17097 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
2018/03/29 19:07:48 executing program 7:
add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={0x73, 0x79, 0x7a}, &(0x7f0000001100)="a1", 0x1, 0xfffffffffffffffb)
sendmmsg(0xffffffffffffffff, &(0x7f0000000200)=[{{&(0x7f0000003000)=@rc={0x1f}, 0x80, &(0x7f0000004fa0), 0x0, &(0x7f0000002d30)}}], 0x1, 0x0)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f00000000c0)={"d202b999cf85000000000088f301e710"})
r0 = syz_open_dev$tun(&(0x7f0000000280)='/dev/net/tun\x00', 0x0, 0x400200)
r1 = socket(0x11, 0x100000802, 0x0)
r2 = syz_open_dev$tun(&(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000000c0)={'ifb0\x00', 0x1001})
ioctl$TUNSETLINK(0xffffffffffffffff, 0x400454cd, 0x308)
ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000040)={'ifb0\x00', 0xa201})
r3 = dup2(r0, 0xffffffffffffffff)
ioctl$TUNSETQUEUE(0xffffffffffffffff, 0x400454d9, &(0x7f0000000000)={'vlan0\x00'})
write$cgroup_subtree(r3, &(0x7f00000001c0)={[{0x0, 'cpu', 0x20}, {0x0, 'pids', 0x20}, {0x0, 'cpu', 0x20}, {0x2d, 'pids', 0x20}, {0x2b, 'pids', 0x20}, {0x0, 'memory', 0x20}]}, 0x24)
connect$unix(r1, &(0x7f0000000100)=@abs, 0x6e)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)

2018/03/29 19:07:48 executing program 1:
add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={0x73, 0x79, 0x7a}, &(0x7f0000001100)="a1", 0x1, 0xfffffffffffffffb)
perf_event_open(&(0x7f000025c000)={0x0, 0x78}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sendmmsg(0xffffffffffffffff, &(0x7f0000000200)=[{{&(0x7f0000003000)=@rc={0x1f}, 0x80, &(0x7f0000004fa0), 0x0, &(0x7f0000002d30)}}], 0x1, 0x0)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f00000000c0)={"d202b999cf85000000000088f301e710"})
r0 = syz_open_dev$tun(&(0x7f0000000280)='/dev/net/tun\x00', 0x0, 0x400200)
r1 = socket(0x11, 0x100000802, 0x0)
r2 = syz_open_dev$tun(&(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000000c0)={'ifb0\x00', 0x1001})
ioctl$TUNSETLINK(r2, 0x400454cd, 0x308)
ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000040)={'ifb0\x00', 0xa201})
r3 = dup2(0xffffffffffffffff, 0xffffffffffffffff)
ioctl$TUNSETQUEUE(0xffffffffffffffff, 0x400454d9, &(0x7f0000000000)={'vlan0\x00'})
write$cgroup_subtree(r3, &(0x7f00000001c0)={[{0x0, 'cpu', 0x20}, {0x0, 'pids', 0x20}, {0x0, 'cpu', 0x20}, {0x2d, 'pids', 0x20}, {0x2b, 'pids', 0x20}, {0x0, 'memory', 0x20}]}, 0x24)
connect$unix(r1, &(0x7f0000000100)=@abs, 0x6e)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)

2018/03/29 19:07:48 executing program 3:
add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={0x73, 0x79, 0x7a}, &(0x7f0000001100)="a1", 0x1, 0xfffffffffffffffb)
perf_event_open(&(0x7f000025c000)={0x2, 0x78}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sendmmsg(0xffffffffffffffff, &(0x7f0000000200), 0x0, 0x0)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f00000000c0)={"d202b999cf85000000000088f301e710"})
r0 = syz_open_dev$tun(&(0x7f0000000280)='/dev/net/tun\x00', 0x0, 0x400200)
r1 = socket(0x11, 0x100000802, 0x0)
r2 = syz_open_dev$tun(&(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000000c0)={'ifb0\x00', 0x1001})
ioctl$TUNSETLINK(r2, 0x400454cd, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000040)={'ifb0\x00', 0xa201})
r3 = dup2(r0, 0xffffffffffffffff)
ioctl$TUNSETQUEUE(0xffffffffffffffff, 0x400454d9, &(0x7f0000000000)={'vlan0\x00'})
write$cgroup_subtree(r3, &(0x7f00000001c0)={[{0x0, 'cpu', 0x20}, {0x0, 'pids', 0x20}, {0x0, 'cpu', 0x20}, {0x2d, 'pids', 0x20}, {0x2b, 'rdma', 0x20}, {0x2b, 'pids', 0x20}, {0x0, 'memory', 0x20}]}, 0x2a)
connect$unix(0xffffffffffffffff, &(0x7f0000000100)=@abs, 0x6e)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)

2018/03/29 19:07:48 executing program 4:
add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={0x73, 0x79, 0x7a}, &(0x7f0000001100)="a1", 0x1, 0xfffffffffffffffb)
perf_event_open(&(0x7f000025c000)={0x2, 0x78}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
pipe2(&(0x7f0000000180), 0x0)
socket(0x18, 0x0, 0x1)
sendmmsg(0xffffffffffffffff, &(0x7f0000000200)=[{{&(0x7f0000003000)=@rc={0x1f}, 0x80, &(0x7f0000004fa0), 0x0, &(0x7f0000002d30)}}], 0x1, 0x0)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f00000000c0)={"d202b999cf85000000000088f301e710"})
r0 = syz_open_dev$tun(&(0x7f0000000280)='/dev/net/tun\x00', 0x0, 0x400200)
r1 = socket(0x11, 0x100000802, 0x0)
r2 = syz_open_dev$tun(&(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000000c0)={'ifb0\x00', 0x1001})
ioctl$TUNSETLINK(0xffffffffffffffff, 0x400454cd, 0x308)
ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000040)={'ifb0\x00', 0xa201})
r3 = dup2(r0, 0xffffffffffffffff)
ioctl$TUNSETQUEUE(0xffffffffffffffff, 0x400454d9, &(0x7f0000000000)={'vlan0\x00'})
write$cgroup_subtree(r3, &(0x7f00000001c0)={[{0x2d, 'pids', 0x20}, {0x0, 'cpu', 0x20}, {0x2d, 'pids', 0x20}, {0x2b, 'rdma', 0x20}, {0x0, 'pids', 0x20}, {0x0, 'io', 0x20}]}, 0x21)
connect$unix(0xffffffffffffffff, &(0x7f0000000100)=@abs, 0x6e)
ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82)

2018/03/29 19:07:48 executing program 0:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
r1 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
r2 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r2, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
keyctl$assume_authority(0x10, 0x0)
r3 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r3, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(0xffffffffffffffff, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x0, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6c8344f9f96ef2c7fe911c01908", 0x5c, 0x0, &(0x7f0000000040)={0x77359400})
r4 = add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0e9467edd", 0x19, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, r4, &(0x7f00000006c0)=[{&(0x7f0000000400)}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r5 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(r0, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x32b, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r5}], 0x1, 0x0)

2018/03/29 19:07:48 executing program 5:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
r1 = mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x7c, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @increfs_done={0x40106308, r1, 0x3}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r2 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r3, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
keyctl$assume_authority(0x10, 0x0)
r4 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r4, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(r4, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x200, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240), 0x0, 0x0, &(0x7f0000000040)={0x77359400})
r5 = add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0e9467edd7f398f", 0x1c, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, r5, &(0x7f00000006c0)=[{&(0x7f0000000400)}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r6 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(0xffffffffffffffff, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000080)={0x0, 0x0, &(0x7f000000dff8), 0x0, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r6}], 0x1, 0x0)

2018/03/29 19:07:48 executing program 6:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
r1 = mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x7c, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @increfs_done={0x40106308, r1, 0x3}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r2 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r3, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
keyctl$assume_authority(0x10, 0x0)
r4 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r4, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(r4, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x200, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6c8344f9f96ef2c7fe911c01908", 0x5c, 0x0, &(0x7f0000000040)={0x77359400})
add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180", 0xe, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, 0x0, &(0x7f00000006c0)=[{&(0x7f0000000400)}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r5 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(0xffffffffffffffff, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000080)={0x0, 0x0, &(0x7f000000dff8), 0x0, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r5}], 0x1, 0x0)

2018/03/29 19:07:48 executing program 2:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x70, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @release={0x40046306, 0x1}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r1 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
r2 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r2, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
r3 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r3, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(r3, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x0, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6c8344f9f96ef2c7fe911c019080e", 0x5d, 0x0, &(0x7f0000000040)={0x77359400})
r4 = add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0e9467edd7f398f", 0x1c, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, r4, &(0x7f00000006c0)=[{&(0x7f0000000400)="f916b8f72c29a4ed654ec4634d479b3453a0dbdd444019513f1d25ccda2381b9d22363dbeef5a27f13994695211b14422a35c08f7510fa", 0x37}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r5 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(r0, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x32b, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r5}], 0x1, 0x0)

[ 1524.833026] binder: BINDER_SET_CONTEXT_MGR already set
[ 1524.833034] binder: 17104:17108 ioctl 40046207 0 returned -16
[ 1524.833318] binder: BINDER_SET_CONTEXT_MGR already set
[ 1524.833324] binder: 17103:17107 ioctl 40046207 0 returned -16
[ 1524.833828] binder: BINDER_SET_CONTEXT_MGR already set
[ 1524.833835] binder: 17101:17106 ioctl 40046207 0 returned -16
[ 1524.833865] binder: BINDER_SET_CONTEXT_MGR already set
[ 1524.833870] binder: 17100:17110 ioctl 40046207 0 returned -16
[ 1524.836472] binder: BINDER_SET_CONTEXT_MGR already set
2018/03/29 19:07:48 executing program 6:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
r1 = mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x7c, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @increfs_done={0x40106308, r1, 0x3}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r2 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r3, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
keyctl$assume_authority(0x10, 0x0)
r4 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r4, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(r4, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x200, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6c8344f9f96ef2c7fe911c01908", 0x5c, 0x0, &(0x7f0000000040)={0x77359400})
add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180", 0xe, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, 0x0, &(0x7f00000006c0)=[{&(0x7f0000000400)}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r5 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(0xffffffffffffffff, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000080)={0x0, 0x0, &(0x7f000000dff8), 0x0, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r5}], 0x1, 0x0)

2018/03/29 19:07:48 executing program 0:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
r1 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
r2 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r2, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
keyctl$assume_authority(0x10, 0x0)
r3 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r3, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(0xffffffffffffffff, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x0, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6c8344f9f96ef2c7fe911c01908", 0x5c, 0x0, &(0x7f0000000040)={0x77359400})
r4 = add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0e9467edd", 0x19, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, r4, &(0x7f00000006c0)=[{&(0x7f0000000400)}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r5 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(r0, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x32b, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r5}], 0x1, 0x0)

2018/03/29 19:07:48 executing program 2:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x70, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @release={0x40046306, 0x1}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r1 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
r2 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r2, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
r3 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r3, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(r3, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x0, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6c8344f9f96ef2c7fe911c019080e", 0x5d, 0x0, &(0x7f0000000040)={0x77359400})
r4 = add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0e9467edd7f398f", 0x1c, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, r4, &(0x7f00000006c0)=[{&(0x7f0000000400)="f916b8f72c29a4ed654ec4634d479b3453a0dbdd444019513f1d25ccda2381b9d22363dbeef5a27f13994695211b14422a35c08f7510fa", 0x37}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r5 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(r0, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x32b, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r5}], 0x1, 0x0)

[ 1524.836481] binder: 17102:17111 ioctl 40046207 0 returned -16
[ 1524.860036] binder: 17100:17110 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1524.861058] binder: 17102:17111 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1524.871796] binder: 17104:17108 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1525.022646] binder: BINDER_SET_CONTEXT_MGR already set
[ 1525.022653] binder: 17115:17118 ioctl 40046207 0 returned -16
[ 1525.182341] binder: BINDER_SET_CONTEXT_MGR already set
[ 1525.182350] binder: 17123:17130 ioctl 40046207 0 returned -16
[ 1525.184840] binder: BINDER_SET_CONTEXT_MGR already set
[ 1525.184847] binder: 17121:17129 ioctl 40046207 0 returned -16
[ 1525.185884] binder: BINDER_SET_CONTEXT_MGR already set
[ 1525.185891] binder: 17124:17126 ioctl 40046207 0 returned -16
[ 1525.190759] binder: BINDER_SET_CONTEXT_MGR already set
[ 1525.190766] binder: 17119:17132 ioctl 40046207 0 returned -16
[ 1525.191250] binder: 17124:17126 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1525.197816] binder: 17123:17130 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1525.202252] binder: BINDER_SET_CONTEXT_MGR already set
[ 1525.202259] binder: 17122:17133 ioctl 40046207 0 returned -16
[ 1525.206178] binder: 17122:17133 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1525.273349] binder: BINDER_SET_CONTEXT_MGR already set
[ 1525.273356] binder: 17135:17137 ioctl 40046207 0 returned -16
[ 1525.273518] binder: BINDER_SET_CONTEXT_MGR already set
[ 1525.273525] binder: 17136:17138 ioctl 40046207 0 returned -16
[ 1525.282002] binder: 17136:17138 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1525.290204] binder: BINDER_SET_CONTEXT_MGR already set
[ 1525.290212] binder: 17140:17145 ioctl 40046207 0 returned -16
[ 1525.291317] binder: BINDER_SET_CONTEXT_MGR already set
[ 1525.291323] binder: 17143:17144 ioctl 40046207 0 returned -16
[ 1525.293821] binder: BINDER_SET_CONTEXT_MGR already set
[ 1525.293828] binder: 17142:17148 ioctl 40046207 0 returned -16
[ 1525.300786] binder: 17140:17145 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1525.303016] binder: 17142:17148 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1525.346917] binder: BINDER_SET_CONTEXT_MGR already set
[ 1525.346925] binder: 17150:17151 ioctl 40046207 0 returned -16
[ 1525.349135] binder: BINDER_SET_CONTEXT_MGR already set
[ 1525.349141] binder: 17149:17152 ioctl 40046207 0 returned -16
[ 1525.358433] binder: 17150:17151 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1525.541239] binder: BINDER_SET_CONTEXT_MGR already set
[ 1525.541246] binder: 17153:17164 ioctl 40046207 0 returned -16
[ 1525.545372] binder: BINDER_SET_CONTEXT_MGR already set
[ 1525.545379] binder: 17154:17159 ioctl 40046207 0 returned -16
[ 1525.547670] binder: BINDER_SET_CONTEXT_MGR already set
[ 1525.547678] binder: 17156:17166 ioctl 40046207 0 returned -16
[ 1525.548094] binder: BINDER_SET_CONTEXT_MGR already set
[ 1525.548101] binder: 17158:17167 ioctl 40046207 0 returned -16
[ 1525.550957] binder: BINDER_SET_CONTEXT_MGR already set
[ 1525.550965] binder: 17157:17160 ioctl 40046207 0 returned -16
[ 1525.554253] binder: BINDER_SET_CONTEXT_MGR already set
[ 1525.554259] binder: 17155:17161 ioctl 40046207 0 returned -16
[ 1525.561266] binder: 17156:17166 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1525.562601] binder: 17155:17161 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1525.564645] binder: 17158:17167 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1525.641149] binder: BINDER_SET_CONTEXT_MGR already set
[ 1525.641156] binder: 17171:17176 ioctl 40046207 0 returned -16
[ 1525.644397] binder: BINDER_SET_CONTEXT_MGR already set
[ 1525.644404] binder: 17172:17180 ioctl 40046207 0 returned -16
[ 1525.644715] binder: BINDER_SET_CONTEXT_MGR already set
[ 1525.644721] binder: 17173:17177 ioctl 40046207 0 returned -16
[ 1525.652950] binder: BINDER_SET_CONTEXT_MGR already set
[ 1525.652957] binder: 17174:17181 ioctl 40046207 0 returned -16
[ 1525.653479] binder: BINDER_SET_CONTEXT_MGR already set
[ 1525.653486] binder: 17175:17178 ioctl 40046207 0 returned -16
2018/03/29 19:07:49 executing program 5:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
r1 = mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x7c, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @increfs_done={0x40106308, r1, 0x3}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r2 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r3, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
keyctl$assume_authority(0x10, 0x0)
r4 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r4, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(r4, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x200, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240), 0x0, 0x0, &(0x7f0000000040)={0x77359400})
r5 = add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0e9467edd7f398f", 0x1c, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, r5, &(0x7f00000006c0)=[{&(0x7f0000000400)}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r6 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(0xffffffffffffffff, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000080)={0x0, 0x0, &(0x7f000000dff8), 0x0, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r6}], 0x1, 0x0)

2018/03/29 19:07:49 executing program 0:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
r1 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
r2 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r2, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
keyctl$assume_authority(0x10, 0x0)
r3 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r3, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(0xffffffffffffffff, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x0, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6c8344f9f96ef2c7fe911c01908", 0x5c, 0x0, &(0x7f0000000040)={0x77359400})
r4 = add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0e9467edd", 0x19, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, r4, &(0x7f00000006c0)=[{&(0x7f0000000400)}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r5 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(r0, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x32b, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r5}], 0x1, 0x0)

2018/03/29 19:07:49 executing program 4:
add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={0x73, 0x79, 0x7a}, &(0x7f0000001100)="a1", 0x1, 0xfffffffffffffffb)
perf_event_open(&(0x7f000025c000)={0x2, 0x78}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
pipe2(&(0x7f0000000180), 0x0)
socket(0x18, 0x0, 0x1)
sendmmsg(0xffffffffffffffff, &(0x7f0000000200)=[{{&(0x7f0000003000)=@rc={0x1f}, 0x80, &(0x7f0000004fa0), 0x0, &(0x7f0000002d30)}}], 0x1, 0x0)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f00000000c0)={"d202b999cf85000000000088f301e710"})
r0 = syz_open_dev$tun(&(0x7f0000000280)='/dev/net/tun\x00', 0x0, 0x400200)
r1 = socket(0x11, 0x100000802, 0x0)
r2 = syz_open_dev$tun(&(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000000c0)={'ifb0\x00', 0x1001})
ioctl$TUNSETLINK(r2, 0x400454cd, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000040)={'ifb0\x00', 0xa201})
r3 = dup2(r0, 0xffffffffffffffff)
ioctl$TUNSETQUEUE(0xffffffffffffffff, 0x400454d9, &(0x7f0000000000)={'vlan0\x00'})
write$cgroup_subtree(r3, &(0x7f00000001c0)={[{0x2d, 'pids', 0x20}, {0x0, 'cpu', 0x20}, {0x2d, 'pids', 0x20}, {0x2b, 'rdma', 0x20}, {0x0, 'pids', 0x20}, {0x0, 'io', 0x20}]}, 0x21)
connect$unix(0xffffffffffffffff, &(0x7f0000000100)=@abs, 0x6e)
ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82)

2018/03/29 19:07:49 executing program 6:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
r1 = mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x7c, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @increfs_done={0x40106308, r1, 0x3}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r2 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r3, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
keyctl$assume_authority(0x10, 0x0)
r4 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r4, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(r4, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x200, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6c8344f9f96ef2c7fe911c01908", 0x5c, 0x0, &(0x7f0000000040)={0x77359400})
add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0", 0x15, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, 0x0, &(0x7f00000006c0)=[{&(0x7f0000000400)}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r5 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(0xffffffffffffffff, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000080)={0x0, 0x0, &(0x7f000000dff8), 0x0, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r5}], 0x1, 0x0)

2018/03/29 19:07:49 executing program 2:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x70, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @release={0x40046306, 0x1}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r1 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
r2 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r2, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
r3 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r3, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(r3, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x0, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6c8344f9f96ef2c7fe911c019080e", 0x5d, 0x0, &(0x7f0000000040)={0x77359400})
r4 = add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0e9467edd7f398f", 0x1c, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, r4, &(0x7f00000006c0)=[{&(0x7f0000000400)="f916b8f72c29a4ed654ec4634d479b3453a0dbdd444019513f1d25ccda2381b9d22363dbeef5a27f13994695211b14422a35c08f7510fa", 0x37}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r5 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(r0, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x32b, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r5}], 0x1, 0x0)

2018/03/29 19:07:49 executing program 1:
add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={0x73, 0x79, 0x7a}, &(0x7f0000001100)="a1", 0x1, 0xfffffffffffffffb)
perf_event_open(&(0x7f000025c000)={0x0, 0x78}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sendmmsg(0xffffffffffffffff, &(0x7f0000000200)=[{{&(0x7f0000003000)=@rc={0x1f}, 0x80, &(0x7f0000004fa0), 0x0, &(0x7f0000002d30)}}], 0x1, 0x0)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f00000000c0)={"d202b999cf85000000000088f301e710"})
r0 = syz_open_dev$tun(&(0x7f0000000280)='/dev/net/tun\x00', 0x0, 0x400200)
r1 = socket(0x11, 0x100000802, 0x0)
r2 = syz_open_dev$tun(&(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000000c0)={'ifb0\x00', 0x1001})
ioctl$TUNSETLINK(r2, 0x400454cd, 0x308)
ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000040)={'ifb0\x00', 0xa201})
r3 = dup2(0xffffffffffffffff, 0xffffffffffffffff)
ioctl$TUNSETQUEUE(0xffffffffffffffff, 0x400454d9, &(0x7f0000000000)={'vlan0\x00'})
write$cgroup_subtree(r3, &(0x7f00000001c0)={[{0x0, 'cpu', 0x20}, {0x0, 'pids', 0x20}, {0x0, 'cpu', 0x20}, {0x2d, 'pids', 0x20}, {0x2b, 'pids', 0x20}, {0x0, 'memory', 0x20}]}, 0x24)
connect$unix(r1, &(0x7f0000000100)=@abs, 0x6e)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)

2018/03/29 19:07:49 executing program 7:
add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={0x73, 0x79, 0x7a}, &(0x7f0000001100)="a1", 0x1, 0xfffffffffffffffb)
sendmmsg(0xffffffffffffffff, &(0x7f0000000200)=[{{&(0x7f0000003000)=@rc={0x1f}, 0x80, &(0x7f0000004fa0), 0x0, &(0x7f0000002d30)}}], 0x1, 0x0)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f00000000c0)={"d202b999cf85000000000088f301e710"})
r0 = syz_open_dev$tun(&(0x7f0000000280)='/dev/net/tun\x00', 0x0, 0x400200)
r1 = socket(0x11, 0x100000802, 0x0)
r2 = syz_open_dev$tun(&(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000000c0)={'ifb0\x00', 0x1001})
ioctl$TUNSETLINK(0xffffffffffffffff, 0x400454cd, 0x308)
ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000040)={'ifb0\x00', 0xa201})
r3 = dup2(r0, 0xffffffffffffffff)
ioctl$TUNSETQUEUE(0xffffffffffffffff, 0x400454d9, &(0x7f0000000000)={'vlan0\x00'})
write$cgroup_subtree(r3, &(0x7f00000001c0)={[{0x0, 'cpu', 0x20}, {0x0, 'pids', 0x20}, {0x0, 'cpu', 0x20}, {0x2d, 'pids', 0x20}, {0x2b, 'pids', 0x20}, {0x0, 'memory', 0x20}]}, 0x24)
connect$unix(r1, &(0x7f0000000100)=@abs, 0x6e)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)

2018/03/29 19:07:49 executing program 3:
add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={0x73, 0x79, 0x7a}, &(0x7f0000001100)="a1", 0x1, 0xfffffffffffffffb)
perf_event_open(&(0x7f000025c000)={0x2, 0x78}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sendmmsg(0xffffffffffffffff, &(0x7f0000000200), 0x0, 0x0)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f00000000c0)={"d202b999cf85000000000088f301e710"})
r0 = syz_open_dev$tun(&(0x7f0000000280)='/dev/net/tun\x00', 0x0, 0x400200)
r1 = socket(0x11, 0x100000802, 0x0)
r2 = syz_open_dev$tun(&(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000000c0)={'ifb0\x00', 0x1001})
ioctl$TUNSETLINK(r2, 0x400454cd, 0x308)
ioctl$sock_inet_SIOCSIFFLAGS(0xffffffffffffffff, 0x8914, &(0x7f0000000040)={'ifb0\x00', 0xa201})
r3 = dup2(r0, 0xffffffffffffffff)
ioctl$TUNSETQUEUE(0xffffffffffffffff, 0x400454d9, &(0x7f0000000000)={'vlan0\x00'})
write$cgroup_subtree(r3, &(0x7f00000001c0)={[{0x0, 'cpu', 0x20}, {0x0, 'pids', 0x20}, {0x0, 'cpu', 0x20}, {0x2d, 'pids', 0x20}, {0x2b, 'rdma', 0x20}, {0x2b, 'pids', 0x20}, {0x0, 'memory', 0x20}]}, 0x2a)
connect$unix(0xffffffffffffffff, &(0x7f0000000100)=@abs, 0x6e)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)

[ 1525.656168] binder: 17172:17180 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1525.660929] binder: 17174:17181 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1525.662422] binder: BINDER_SET_CONTEXT_MGR already set
[ 1525.662429] binder: 17170:17179 ioctl 40046207 0 returned -16
[ 1525.663612] binder: 17175:17178 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1525.736524] binder: BINDER_SET_CONTEXT_MGR already set
[ 1525.736531] binder: 17182:17187 ioctl 40046207 0 returned -16
2018/03/29 19:07:49 executing program 2:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x70, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @release={0x40046306, 0x1}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r1 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
r2 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r2, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
r3 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r3, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(r3, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x200, 0x0, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6c8344f9f96ef2c7fe911c019080e", 0x5d, 0x0, &(0x7f0000000040)={0x77359400})
r4 = add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0e9467edd7f398f", 0x1c, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, r4, &(0x7f00000006c0)=[{&(0x7f0000000400)="f916b8f72c29a4ed654ec4634d479b3453a0dbdd444019513f1d25ccda2381b9d22363dbeef5a27f13994695211b14422a35c08f7510fa", 0x37}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r5 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(r0, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x32b, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r5}], 0x1, 0x0)

2018/03/29 19:07:49 executing program 5:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
r1 = mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x7c, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @increfs_done={0x40106308, r1, 0x3}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r2 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r3, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
keyctl$assume_authority(0x10, 0x0)
r4 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r4, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(r4, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x200, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240), 0x0, 0x0, &(0x7f0000000040)={0x77359400})
r5 = add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0e9467edd7f398f", 0x1c, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, r5, &(0x7f00000006c0)=[{&(0x7f0000000400)}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r6 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(0xffffffffffffffff, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000080)={0x0, 0x0, &(0x7f000000dff8), 0x0, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r6}], 0x1, 0x0)

2018/03/29 19:07:49 executing program 0:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
r1 = mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x7c, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @increfs_done={0x40106308, r1, 0x3}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r2 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r3, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
keyctl$assume_authority(0x10, 0x0)
r4 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r4, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(0xffffffffffffffff, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x0, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6c8344f9f96ef2c7fe911c01908", 0x5c, 0x0, &(0x7f0000000040)={0x77359400})
r5 = add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0e9467edd", 0x19, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, r5, &(0x7f00000006c0)=[{&(0x7f0000000400)}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r6 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(r0, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x32b, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r6}], 0x1, 0x0)

2018/03/29 19:07:49 executing program 6:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
r1 = mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x7c, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @increfs_done={0x40106308, r1, 0x3}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r2 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r3, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
keyctl$assume_authority(0x10, 0x0)
r4 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r4, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(r4, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x200, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6c8344f9f96ef2c7fe911c01908", 0x5c, 0x0, &(0x7f0000000040)={0x77359400})
add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0", 0x15, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, 0x0, &(0x7f00000006c0)=[{&(0x7f0000000400)}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r5 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(0xffffffffffffffff, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000080)={0x0, 0x0, &(0x7f000000dff8), 0x0, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r5}], 0x1, 0x0)

[ 1525.739296] binder: BINDER_SET_CONTEXT_MGR already set
[ 1525.739303] binder: 17184:17188 ioctl 40046207 0 returned -16
[ 1525.760509] binder: BINDER_SET_CONTEXT_MGR already set
[ 1525.760516] binder: 17185:17186 ioctl 40046207 0 returned -16
[ 1525.763163] binder: BINDER_SET_CONTEXT_MGR already set
[ 1525.763171] binder: 17183:17189 ioctl 40046207 0 returned -16
2018/03/29 19:07:49 executing program 2:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x70, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @release={0x40046306, 0x1}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r1 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
r2 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r2, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
r3 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r3, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(r3, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x200, 0x0, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6c8344f9f96ef2c7fe911c019080e", 0x5d, 0x0, &(0x7f0000000040)={0x77359400})
r4 = add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0e9467edd7f398f", 0x1c, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, r4, &(0x7f00000006c0)=[{&(0x7f0000000400)="f916b8f72c29a4ed654ec4634d479b3453a0dbdd444019513f1d25ccda2381b9d22363dbeef5a27f13994695211b14422a35c08f7510fa", 0x37}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r5 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(r0, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x32b, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r5}], 0x1, 0x0)

2018/03/29 19:07:49 executing program 6:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
r1 = mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x7c, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @increfs_done={0x40106308, r1, 0x3}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r2 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r3, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
keyctl$assume_authority(0x10, 0x0)
r4 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r4, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(r4, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x200, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6c8344f9f96ef2c7fe911c01908", 0x5c, 0x0, &(0x7f0000000040)={0x77359400})
add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0", 0x15, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, 0x0, &(0x7f00000006c0)=[{&(0x7f0000000400)}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r5 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(0xffffffffffffffff, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000080)={0x0, 0x0, &(0x7f000000dff8), 0x0, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r5}], 0x1, 0x0)

[ 1525.764103] binder: 17185:17186 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1525.776870] binder: 17183:17189 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1525.937062] binder: BINDER_SET_CONTEXT_MGR already set
[ 1525.937069] binder: 17195:17199 ioctl 40046207 0 returned -16
[ 1525.939792] binder: BINDER_SET_CONTEXT_MGR already set
[ 1525.939800] binder: 17196:17200 ioctl 40046207 0 returned -16
[ 1525.943610] binder: BINDER_SET_CONTEXT_MGR already set
[ 1525.943616] binder: 17192:17194 ioctl 40046207 0 returned -16
[ 1525.948238] binder: BINDER_SET_CONTEXT_MGR already set
[ 1525.948244] binder: 17191:17204 ioctl 40046207 0 returned -16
[ 1525.948997] binder: BINDER_SET_CONTEXT_MGR already set
[ 1525.949005] binder: 17193:17201 ioctl 40046207 0 returned -16
[ 1525.951405] binder: BINDER_SET_CONTEXT_MGR already set
[ 1525.951412] binder: 17197:17203 ioctl 40046207 0 returned -16
[ 1525.956534] binder: 17192:17194 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1525.958647] binder: 17193:17201 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1526.029654] binder: BINDER_SET_CONTEXT_MGR already set
[ 1526.029662] binder: 17207:17214 ioctl 40046207 0 returned -16
[ 1526.032685] binder: BINDER_SET_CONTEXT_MGR already set
[ 1526.032693] binder: 17209:17212 ioctl 40046207 0 returned -16
[ 1526.036471] binder: BINDER_SET_CONTEXT_MGR already set
[ 1526.036481] binder: 17208:17213 ioctl 40046207 0 returned -16
[ 1526.041054] binder: BINDER_SET_CONTEXT_MGR already set
[ 1526.041061] binder: 17215:17218 ioctl 40046207 0 returned -16
[ 1526.043785] binder: BINDER_SET_CONTEXT_MGR already set
[ 1526.043791] binder: 17211:17217 ioctl 40046207 0 returned -16
[ 1526.047990] binder: BINDER_SET_CONTEXT_MGR already set
[ 1526.047998] binder: 17216:17219 ioctl 40046207 0 returned -16
[ 1526.049758] binder: 17209:17212 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1526.054738] binder: 17211:17217 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1526.299028] binder: BINDER_SET_CONTEXT_MGR already set
[ 1526.299035] binder: 17224:17231 ioctl 40046207 0 returned -16
[ 1526.301754] binder: BINDER_SET_CONTEXT_MGR already set
[ 1526.301760] binder: 17226:17233 ioctl 40046207 0 returned -16
[ 1526.306050] binder: BINDER_SET_CONTEXT_MGR already set
[ 1526.306057] binder: 17228:17236 ioctl 40046207 0 returned -16
[ 1526.306221] binder: BINDER_SET_CONTEXT_MGR already set
[ 1526.306227] binder: 17223:17232 ioctl 40046207 0 returned -16
[ 1526.309685] binder: BINDER_SET_CONTEXT_MGR already set
[ 1526.309696] binder: 17227:17237 ioctl 40046207 0 returned -16
[ 1526.310509] binder: BINDER_SET_CONTEXT_MGR already set
[ 1526.310516] binder: 17225:17234 ioctl 40046207 0 returned -16
[ 1526.320903] binder: 17226:17233 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1526.396096] binder: BINDER_SET_CONTEXT_MGR already set
[ 1526.396103] binder: 17240:17242 ioctl 40046207 0 returned -16
[ 1526.405787] binder: BINDER_SET_CONTEXT_MGR already set
[ 1526.405794] binder: 17241:17244 ioctl 40046207 0 returned -16
2018/03/29 19:07:49 executing program 0:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
r1 = mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x7c, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @increfs_done={0x40106308, r1, 0x3}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r2 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r3, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
keyctl$assume_authority(0x10, 0x0)
r4 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r4, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(0xffffffffffffffff, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x0, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6c8344f9f96ef2c7fe911c01908", 0x5c, 0x0, &(0x7f0000000040)={0x77359400})
r5 = add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0e9467edd", 0x19, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, r5, &(0x7f00000006c0)=[{&(0x7f0000000400)}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r6 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(r0, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x32b, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r6}], 0x1, 0x0)

2018/03/29 19:07:49 executing program 4:
add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={0x73, 0x79, 0x7a}, &(0x7f0000001100)="a1", 0x1, 0xfffffffffffffffb)
perf_event_open(&(0x7f000025c000)={0x2, 0x78}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
pipe2(&(0x7f0000000180), 0x0)
socket(0x18, 0x0, 0x1)
sendmmsg(0xffffffffffffffff, &(0x7f0000000200)=[{{&(0x7f0000003000)=@rc={0x1f}, 0x80, &(0x7f0000004fa0), 0x0, &(0x7f0000002d30)}}], 0x1, 0x0)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f00000000c0)={"d202b999cf85000000000088f301e710"})
r0 = syz_open_dev$tun(&(0x7f0000000280)='/dev/net/tun\x00', 0x0, 0x400200)
r1 = socket(0x11, 0x100000802, 0x0)
r2 = syz_open_dev$tun(&(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000000c0)={'ifb0\x00', 0x1001})
ioctl$TUNSETLINK(r2, 0x400454cd, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000040)={'ifb0\x00', 0xa201})
r3 = dup2(r0, 0xffffffffffffffff)
ioctl$TUNSETQUEUE(0xffffffffffffffff, 0x400454d9, &(0x7f0000000000)={'vlan0\x00'})
write$cgroup_subtree(r3, &(0x7f00000001c0)={[{0x2d, 'pids', 0x20}, {0x0, 'cpu', 0x20}, {0x2d, 'pids', 0x20}, {0x2b, 'rdma', 0x20}, {0x0, 'pids', 0x20}, {0x0, 'io', 0x20}]}, 0x21)
connect$unix(0xffffffffffffffff, &(0x7f0000000100)=@abs, 0x6e)
ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82)

2018/03/29 19:07:49 executing program 6:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
r1 = mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x7c, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @increfs_done={0x40106308, r1, 0x3}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r2 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r3, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
keyctl$assume_authority(0x10, 0x0)
r4 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r4, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(r4, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x200, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6c8344f9f96ef2c7fe911c01908", 0x5c, 0x0, &(0x7f0000000040)={0x77359400})
add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0e9467edd", 0x19, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, 0x0, &(0x7f00000006c0)=[{&(0x7f0000000400)}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r5 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(0xffffffffffffffff, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000080)={0x0, 0x0, &(0x7f000000dff8), 0x0, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r5}], 0x1, 0x0)

2018/03/29 19:07:49 executing program 5:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
r1 = mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x7c, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @increfs_done={0x40106308, r1, 0x3}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r2 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r3, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
keyctl$assume_authority(0x10, 0x0)
r4 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r4, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(r4, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x200, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b06", 0x29, 0x0, &(0x7f0000000040)={0x77359400})
r5 = add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0e9467edd7f398f", 0x1c, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, r5, &(0x7f00000006c0)=[{&(0x7f0000000400)}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r6 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(0xffffffffffffffff, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000080)={0x0, 0x0, &(0x7f000000dff8), 0x0, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r6}], 0x1, 0x0)

2018/03/29 19:07:49 executing program 2:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x70, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @release={0x40046306, 0x1}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r1 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
r2 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r2, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
r3 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r3, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(r3, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x200, 0x0, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6c8344f9f96ef2c7fe911c019080e", 0x5d, 0x0, &(0x7f0000000040)={0x77359400})
r4 = add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0e9467edd7f398f", 0x1c, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, r4, &(0x7f00000006c0)=[{&(0x7f0000000400)="f916b8f72c29a4ed654ec4634d479b3453a0dbdd444019513f1d25ccda2381b9d22363dbeef5a27f13994695211b14422a35c08f7510fa", 0x37}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r5 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(r0, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x32b, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r5}], 0x1, 0x0)

2018/03/29 19:07:49 executing program 3:
add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={0x73, 0x79, 0x7a}, &(0x7f0000001100)="a1", 0x1, 0xfffffffffffffffb)
perf_event_open(&(0x7f000025c000)={0x2, 0x78}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sendmmsg(0xffffffffffffffff, &(0x7f0000000200), 0x0, 0x0)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f00000000c0)={"d202b999cf85000000000088f301e710"})
r0 = syz_open_dev$tun(&(0x7f0000000280)='/dev/net/tun\x00', 0x0, 0x400200)
r1 = socket(0x11, 0x100000802, 0x0)
r2 = syz_open_dev$tun(&(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000000c0)={'ifb0\x00', 0x1001})
ioctl$TUNSETLINK(r2, 0x400454cd, 0x308)
ioctl$sock_inet_SIOCSIFFLAGS(0xffffffffffffffff, 0x8914, &(0x7f0000000040)={'ifb0\x00', 0xa201})
r3 = dup2(r0, 0xffffffffffffffff)
ioctl$TUNSETQUEUE(0xffffffffffffffff, 0x400454d9, &(0x7f0000000000)={'vlan0\x00'})
write$cgroup_subtree(r3, &(0x7f00000001c0)={[{0x0, 'cpu', 0x20}, {0x0, 'pids', 0x20}, {0x0, 'cpu', 0x20}, {0x2d, 'pids', 0x20}, {0x2b, 'rdma', 0x20}, {0x2b, 'pids', 0x20}, {0x0, 'memory', 0x20}]}, 0x2a)
connect$unix(0xffffffffffffffff, &(0x7f0000000100)=@abs, 0x6e)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)

2018/03/29 19:07:49 executing program 7:
add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={0x73, 0x79, 0x7a}, &(0x7f0000001100)="a1", 0x1, 0xfffffffffffffffb)
sendmmsg(0xffffffffffffffff, &(0x7f0000000200)=[{{&(0x7f0000003000)=@rc={0x1f}, 0x80, &(0x7f0000004fa0), 0x0, &(0x7f0000002d30)}}], 0x1, 0x0)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f00000000c0)={"d202b999cf85000000000088f301e710"})
r0 = syz_open_dev$tun(&(0x7f0000000280)='/dev/net/tun\x00', 0x0, 0x400200)
r1 = socket(0x11, 0x100000802, 0x0)
r2 = syz_open_dev$tun(&(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000000c0)={'ifb0\x00', 0x1001})
ioctl$TUNSETLINK(r2, 0x400454cd, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000040)={'ifb0\x00', 0xa201})
r3 = dup2(r0, 0xffffffffffffffff)
ioctl$TUNSETQUEUE(0xffffffffffffffff, 0x400454d9, &(0x7f0000000000)={'vlan0\x00'})
write$cgroup_subtree(r3, &(0x7f00000001c0)={[{0x0, 'cpu', 0x20}, {0x0, 'pids', 0x20}, {0x0, 'cpu', 0x20}, {0x2d, 'pids', 0x20}, {0x2b, 'pids', 0x20}, {0x0, 'memory', 0x20}]}, 0x24)
connect$unix(r1, &(0x7f0000000100)=@abs, 0x6e)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)

2018/03/29 19:07:49 executing program 1:
add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={0x73, 0x79, 0x7a}, &(0x7f0000001100)="a1", 0x1, 0xfffffffffffffffb)
perf_event_open(&(0x7f000025c000)={0x0, 0x78}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sendmmsg(0xffffffffffffffff, &(0x7f0000000200)=[{{&(0x7f0000003000)=@rc={0x1f}, 0x80, &(0x7f0000004fa0), 0x0, &(0x7f0000002d30)}}], 0x1, 0x0)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f00000000c0)={"d202b999cf85000000000088f301e710"})
r0 = syz_open_dev$tun(&(0x7f0000000280)='/dev/net/tun\x00', 0x0, 0x400200)
r1 = socket(0x11, 0x100000802, 0x0)
r2 = syz_open_dev$tun(&(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000000c0)={'ifb0\x00', 0x1001})
ioctl$TUNSETLINK(r2, 0x400454cd, 0x308)
ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000040)={'ifb0\x00', 0xa201})
r3 = dup2(0xffffffffffffffff, 0xffffffffffffffff)
ioctl$TUNSETQUEUE(0xffffffffffffffff, 0x400454d9, &(0x7f0000000000)={'vlan0\x00'})
write$cgroup_subtree(r3, &(0x7f00000001c0)={[{0x0, 'cpu', 0x20}, {0x0, 'pids', 0x20}, {0x0, 'cpu', 0x20}, {0x2d, 'pids', 0x20}, {0x2b, 'pids', 0x20}, {0x0, 'memory', 0x20}]}, 0x24)
connect$unix(r1, &(0x7f0000000100)=@abs, 0x6e)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)

[ 1526.407568] binder: BINDER_SET_CONTEXT_MGR already set
[ 1526.407575] binder: 17243:17248 ioctl 40046207 0 returned -16
[ 1526.412083] binder: BINDER_SET_CONTEXT_MGR already set
[ 1526.412091] binder: 17247:17251 ioctl 40046207 0 returned -16
[ 1526.413251] binder: 17241:17244 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1526.414882] binder: BINDER_SET_CONTEXT_MGR already set
[ 1526.414890] binder: 17245:17249 ioctl 40046207 0 returned -16
2018/03/29 19:07:49 executing program 6:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
r1 = mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x7c, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @increfs_done={0x40106308, r1, 0x3}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r2 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r3, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
keyctl$assume_authority(0x10, 0x0)
r4 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r4, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(r4, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x200, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6c8344f9f96ef2c7fe911c01908", 0x5c, 0x0, &(0x7f0000000040)={0x77359400})
add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0e9467edd", 0x19, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, 0x0, &(0x7f00000006c0)=[{&(0x7f0000000400)}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r5 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(0xffffffffffffffff, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000080)={0x0, 0x0, &(0x7f000000dff8), 0x0, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r5}], 0x1, 0x0)

2018/03/29 19:07:49 executing program 2:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x70, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @release={0x40046306, 0x1}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r1 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
r2 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r2, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
r3 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r3, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(r3, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x200, 0x1}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6c8344f9f96ef2c7fe911c019080e", 0x5d, 0x0, &(0x7f0000000040)={0x77359400})
r4 = add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0e9467edd7f398f", 0x1c, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, r4, &(0x7f00000006c0)=[{&(0x7f0000000400)="f916b8f72c29a4ed654ec4634d479b3453a0dbdd444019513f1d25ccda2381b9d22363dbeef5a27f13994695211b14422a35c08f7510fa", 0x37}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r5 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(r0, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x32b, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r5}], 0x1, 0x0)

[ 1526.416278] binder: BINDER_SET_CONTEXT_MGR already set
[ 1526.416284] binder: 17246:17250 ioctl 40046207 0 returned -16
[ 1526.495464] binder: BINDER_SET_CONTEXT_MGR already set
[ 1526.495471] binder: 17252:17253 ioctl 40046207 0 returned -16
[ 1526.507235] binder: BINDER_SET_CONTEXT_MGR already set
[ 1526.507242] binder: 17254:17255 ioctl 40046207 0 returned -16
[ 1526.575965] binder: BINDER_SET_CONTEXT_MGR already set
[ 1526.575973] binder: 17256:17259 ioctl 40046207 0 returned -16
2018/03/29 19:07:49 executing program 0:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
r1 = mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x7c, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @increfs_done={0x40106308, r1, 0x3}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r2 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r3, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
keyctl$assume_authority(0x10, 0x0)
r4 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r4, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(0xffffffffffffffff, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x0, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6c8344f9f96ef2c7fe911c01908", 0x5c, 0x0, &(0x7f0000000040)={0x77359400})
r5 = add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0e9467edd", 0x19, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, r5, &(0x7f00000006c0)=[{&(0x7f0000000400)}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r6 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(r0, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x32b, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r6}], 0x1, 0x0)

2018/03/29 19:07:49 executing program 5:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
r1 = mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x7c, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @increfs_done={0x40106308, r1, 0x3}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r2 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r3, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
keyctl$assume_authority(0x10, 0x0)
r4 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r4, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(r4, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x200, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b06", 0x29, 0x0, &(0x7f0000000040)={0x77359400})
r5 = add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0e9467edd7f398f", 0x1c, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, r5, &(0x7f00000006c0)=[{&(0x7f0000000400)}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r6 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(0xffffffffffffffff, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000080)={0x0, 0x0, &(0x7f000000dff8), 0x0, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r6}], 0x1, 0x0)

[ 1526.581940] binder: BINDER_SET_CONTEXT_MGR already set
[ 1526.581948] binder: 17262:17268 ioctl 40046207 0 returned -16
[ 1526.583382] binder: BINDER_SET_CONTEXT_MGR already set
[ 1526.583388] binder: 17258:17260 ioctl 40046207 0 returned -16
2018/03/29 19:07:49 executing program 6:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
r1 = mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x7c, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @increfs_done={0x40106308, r1, 0x3}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r2 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r3, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
keyctl$assume_authority(0x10, 0x0)
r4 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r4, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(r4, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x200, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6c8344f9f96ef2c7fe911c01908", 0x5c, 0x0, &(0x7f0000000040)={0x77359400})
add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0e9467edd", 0x19, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, 0x0, &(0x7f00000006c0)=[{&(0x7f0000000400)}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r5 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(0xffffffffffffffff, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000080)={0x0, 0x0, &(0x7f000000dff8), 0x0, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r5}], 0x1, 0x0)

2018/03/29 19:07:49 executing program 5:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
r1 = mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x7c, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @increfs_done={0x40106308, r1, 0x3}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r2 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r3, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
keyctl$assume_authority(0x10, 0x0)
r4 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r4, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(r4, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x200, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b06", 0x29, 0x0, &(0x7f0000000040)={0x77359400})
r5 = add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0e9467edd7f398f", 0x1c, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, r5, &(0x7f00000006c0)=[{&(0x7f0000000400)}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r6 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(0xffffffffffffffff, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000080)={0x0, 0x0, &(0x7f000000dff8), 0x0, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r6}], 0x1, 0x0)

2018/03/29 19:07:49 executing program 2:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x70, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @release={0x40046306, 0x1}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r1 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
r2 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r2, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
r3 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r3, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(r3, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x200, 0x1}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6c8344f9f96ef2c7fe911c019080e", 0x5d, 0x0, &(0x7f0000000040)={0x77359400})
r4 = add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0e9467edd7f398f", 0x1c, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, r4, &(0x7f00000006c0)=[{&(0x7f0000000400)="f916b8f72c29a4ed654ec4634d479b3453a0dbdd444019513f1d25ccda2381b9d22363dbeef5a27f13994695211b14422a35c08f7510fa", 0x37}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r5 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(r0, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x32b, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r5}], 0x1, 0x0)

[ 1526.583602] binder: BINDER_SET_CONTEXT_MGR already set
[ 1526.583610] binder: 17257:17269 ioctl 40046207 0 returned -16
[ 1526.586612] binder: BINDER_SET_CONTEXT_MGR already set
[ 1526.586620] binder: 17263:17267 ioctl 40046207 0 returned -16
[ 1526.592763] binder: BINDER_SET_CONTEXT_MGR already set
[ 1526.592772] binder: 17264:17266 ioctl 40046207 0 returned -16
[ 1526.593901] binder: 17263:17267 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1526.603326] binder: 17262:17268 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
2018/03/29 19:07:49 executing program 0:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x7c, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r1 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
r2 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r2, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
keyctl$assume_authority(0x10, 0x0)
r3 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r3, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(0xffffffffffffffff, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x0, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6c8344f9f96ef2c7fe911c01908", 0x5c, 0x0, &(0x7f0000000040)={0x77359400})
r4 = add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0e9467edd", 0x19, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, r4, &(0x7f00000006c0)=[{&(0x7f0000000400)}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r5 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(r0, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x32b, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r5}], 0x1, 0x0)

[ 1526.671372] binder: BINDER_SET_CONTEXT_MGR already set
[ 1526.671380] binder: 17273:17274 ioctl 40046207 0 returned -16
[ 1526.674955] binder: 17273:17274 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1526.679960] binder: BINDER_SET_CONTEXT_MGR already set
[ 1526.679967] binder: 17275:17280 ioctl 40046207 0 returned -16
[ 1526.683177] binder: BINDER_SET_CONTEXT_MGR already set
[ 1526.683229] binder: 17277:17283 ioctl 40046207 0 returned -16
[ 1526.688387] binder: BINDER_SET_CONTEXT_MGR already set
[ 1526.688394] binder: 17278:17282 ioctl 40046207 0 returned -16
[ 1526.692587] binder: BINDER_SET_CONTEXT_MGR already set
[ 1526.692594] binder: 17279:17284 ioctl 40046207 0 returned -16
[ 1526.693209] binder: 17277:17283 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1526.697618] binder: BINDER_SET_CONTEXT_MGR already set
[ 1526.697625] binder: 17281:17285 ioctl 40046207 0 returned -16
[ 1526.731303] binder: 17281:17285 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1526.742906] binder: BINDER_SET_CONTEXT_MGR already set
[ 1526.742914] binder: 17286:17287 ioctl 40046207 0 returned -16
[ 1526.773825] binder: BINDER_SET_CONTEXT_MGR already set
[ 1526.773833] binder: 17289:17291 ioctl 40046207 0 returned -16
[ 1526.776213] binder: BINDER_SET_CONTEXT_MGR already set
[ 1526.776220] binder: 17288:17292 ioctl 40046207 0 returned -16
[ 1526.776223] binder: BINDER_SET_CONTEXT_MGR already set
[ 1526.776229] binder: 17290:17293 ioctl 40046207 0 returned -16
[ 1526.780047] binder: 17288:17292 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1526.788889] binder: 17290:17293 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1526.993787] binder: BINDER_SET_CONTEXT_MGR already set
[ 1526.993795] binder: 17296:17301 ioctl 40046207 0 returned -16
[ 1526.994787] binder: BINDER_SET_CONTEXT_MGR already set
[ 1526.994794] binder: 17298:17302 ioctl 40046207 0 returned -16
[ 1526.994862] binder: BINDER_SET_CONTEXT_MGR already set
[ 1526.994870] binder: 17295:17299 ioctl 40046207 0 returned -16
[ 1526.998546] binder: BINDER_SET_CONTEXT_MGR already set
[ 1526.998553] binder: 17300:17303 ioctl 40046207 0 returned -16
[ 1527.001692] binder: 17296:17301 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1527.002933] binder: 17298:17302 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1527.006651] binder: 17300:17303 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1527.007058] binder: BINDER_SET_CONTEXT_MGR already set
[ 1527.007066] binder: 17297:17306 ioctl 40046207 0 returned -16
2018/03/29 19:07:49 executing program 6:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
r1 = mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x7c, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @increfs_done={0x40106308, r1, 0x3}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r2 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r3, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
keyctl$assume_authority(0x10, 0x0)
r4 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r4, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(r4, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x200, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6c8344f9f96ef2c7fe911c01908", 0x5c, 0x0, &(0x7f0000000040)={0x77359400})
add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0e9467edd7f39", 0x1b, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, 0x0, &(0x7f00000006c0)=[{&(0x7f0000000400)}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r5 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(0xffffffffffffffff, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000080)={0x0, 0x0, &(0x7f000000dff8), 0x0, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r5}], 0x1, 0x0)

2018/03/29 19:07:49 executing program 0:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x7c, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r1 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
r2 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r2, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
keyctl$assume_authority(0x10, 0x0)
r3 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r3, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(0xffffffffffffffff, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x0, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6c8344f9f96ef2c7fe911c01908", 0x5c, 0x0, &(0x7f0000000040)={0x77359400})
r4 = add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0e9467edd", 0x19, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, r4, &(0x7f00000006c0)=[{&(0x7f0000000400)}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r5 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(r0, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x32b, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r5}], 0x1, 0x0)

2018/03/29 19:07:49 executing program 5:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
r1 = mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x7c, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @increfs_done={0x40106308, r1, 0x3}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r2 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r3, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
keyctl$assume_authority(0x10, 0x0)
r4 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r4, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(r4, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x200, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e78", 0x3d, 0x0, &(0x7f0000000040)={0x77359400})
r5 = add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0e9467edd7f398f", 0x1c, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, r5, &(0x7f00000006c0)=[{&(0x7f0000000400)}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r6 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(0xffffffffffffffff, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000080)={0x0, 0x0, &(0x7f000000dff8), 0x0, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r6}], 0x1, 0x0)

2018/03/29 19:07:49 executing program 2:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x70, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @release={0x40046306, 0x1}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r1 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
r2 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r2, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
r3 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r3, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(r3, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x200, 0x1}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6c8344f9f96ef2c7fe911c019080e", 0x5d, 0x0, &(0x7f0000000040)={0x77359400})
r4 = add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0e9467edd7f398f", 0x1c, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, r4, &(0x7f00000006c0)=[{&(0x7f0000000400)="f916b8f72c29a4ed654ec4634d479b3453a0dbdd444019513f1d25ccda2381b9d22363dbeef5a27f13994695211b14422a35c08f7510fa", 0x37}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r5 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(r0, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x32b, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r5}], 0x1, 0x0)

2018/03/29 19:07:49 executing program 3:
add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={0x73, 0x79, 0x7a}, &(0x7f0000001100)="a1", 0x1, 0xfffffffffffffffb)
perf_event_open(&(0x7f000025c000)={0x2, 0x78}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sendmmsg(0xffffffffffffffff, &(0x7f0000000200), 0x0, 0x0)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f00000000c0)={"d202b999cf85000000000088f301e710"})
r0 = syz_open_dev$tun(&(0x7f0000000280)='/dev/net/tun\x00', 0x0, 0x400200)
r1 = socket(0x11, 0x100000802, 0x0)
r2 = syz_open_dev$tun(&(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000000c0)={'ifb0\x00', 0x1001})
ioctl$TUNSETLINK(r2, 0x400454cd, 0x308)
ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000040)={'ifb0\x00'})
r3 = dup2(r0, 0xffffffffffffffff)
ioctl$TUNSETQUEUE(0xffffffffffffffff, 0x400454d9, &(0x7f0000000000)={'vlan0\x00'})
write$cgroup_subtree(r3, &(0x7f00000001c0)={[{0x0, 'cpu', 0x20}, {0x0, 'pids', 0x20}, {0x0, 'cpu', 0x20}, {0x2d, 'pids', 0x20}, {0x2b, 'rdma', 0x20}, {0x2b, 'pids', 0x20}, {0x0, 'memory', 0x20}]}, 0x2a)
connect$unix(0xffffffffffffffff, &(0x7f0000000100)=@abs, 0x6e)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)

2018/03/29 19:07:49 executing program 1:
add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={0x73, 0x79, 0x7a}, &(0x7f0000001100)="a1", 0x1, 0xfffffffffffffffb)
perf_event_open(&(0x7f000025c000)={0x0, 0x78}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sendmmsg(0xffffffffffffffff, &(0x7f0000000200)=[{{&(0x7f0000003000)=@rc={0x1f}, 0x80, &(0x7f0000004fa0), 0x0, &(0x7f0000002d30)}}], 0x1, 0x0)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f00000000c0)={"d202b999cf85000000000088f301e710"})
r0 = syz_open_dev$tun(&(0x7f0000000280)='/dev/net/tun\x00', 0x0, 0x400200)
r1 = socket(0x11, 0x100000802, 0x0)
r2 = syz_open_dev$tun(&(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000000c0)={'ifb0\x00', 0x1001})
ioctl$TUNSETLINK(r2, 0x400454cd, 0x308)
ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000040)={'ifb0\x00', 0xa201})
r3 = dup2(r0, 0xffffffffffffffff)
ioctl$TUNSETQUEUE(0xffffffffffffffff, 0x400454d9, &(0x7f0000000000)={'vlan0\x00'})
write$cgroup_subtree(0xffffffffffffffff, &(0x7f00000001c0)={[{0x0, 'cpu', 0x20}, {0x0, 'pids', 0x20}, {0x0, 'cpu', 0x20}, {0x2d, 'pids', 0x20}, {0x2b, 'pids', 0x20}, {0x0, 'memory', 0x20}]}, 0x24)
connect$unix(r1, &(0x7f0000000100)=@abs, 0x6e)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)

2018/03/29 19:07:49 executing program 4:
add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={0x73, 0x79, 0x7a}, &(0x7f0000001100)="a1", 0x1, 0xfffffffffffffffb)
perf_event_open(&(0x7f000025c000)={0x2, 0x78}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
pipe2(&(0x7f0000000180), 0x0)
socket(0x18, 0x0, 0x1)
sendmmsg(0xffffffffffffffff, &(0x7f0000000200)=[{{&(0x7f0000003000)=@rc={0x1f}, 0x80, &(0x7f0000004fa0), 0x0, &(0x7f0000002d30)}}], 0x1, 0x0)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f00000000c0)={"d202b999cf85000000000088f301e710"})
r0 = syz_open_dev$tun(&(0x7f0000000280)='/dev/net/tun\x00', 0x0, 0x400200)
r1 = socket(0x11, 0x100000802, 0x0)
r2 = syz_open_dev$tun(&(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000000c0)={'ifb0\x00', 0x1001})
ioctl$TUNSETLINK(r2, 0x400454cd, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000040)={'ifb0\x00', 0xa201})
r3 = dup2(r0, 0xffffffffffffffff)
ioctl$TUNSETQUEUE(0xffffffffffffffff, 0x400454d9, &(0x7f0000000000)={'vlan0\x00'})
write$cgroup_subtree(r3, &(0x7f00000001c0)={[{0x2d, 'pids', 0x20}, {0x0, 'cpu', 0x20}, {0x2d, 'pids', 0x20}, {0x2b, 'rdma', 0x20}, {0x0, 'pids', 0x20}, {0x0, 'io', 0x20}]}, 0x21)
connect$unix(0xffffffffffffffff, &(0x7f0000000100)=@abs, 0x6e)
ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82)

2018/03/29 19:07:49 executing program 7:
add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={0x73, 0x79, 0x7a}, &(0x7f0000001100)="a1", 0x1, 0xfffffffffffffffb)
sendmmsg(0xffffffffffffffff, &(0x7f0000000200)=[{{&(0x7f0000003000)=@rc={0x1f}, 0x80, &(0x7f0000004fa0), 0x0, &(0x7f0000002d30)}}], 0x1, 0x0)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f00000000c0)={"d202b999cf85000000000088f301e710"})
r0 = syz_open_dev$tun(&(0x7f0000000280)='/dev/net/tun\x00', 0x0, 0x400200)
r1 = socket(0x11, 0x100000802, 0x0)
r2 = syz_open_dev$tun(&(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000000c0)={'ifb0\x00', 0x1001})
ioctl$TUNSETLINK(r2, 0x400454cd, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000040)={'ifb0\x00', 0xa201})
r3 = dup2(r0, 0xffffffffffffffff)
ioctl$TUNSETQUEUE(0xffffffffffffffff, 0x400454d9, &(0x7f0000000000)={'vlan0\x00'})
write$cgroup_subtree(r3, &(0x7f00000001c0)={[{0x0, 'cpu', 0x20}, {0x0, 'pids', 0x20}, {0x0, 'cpu', 0x20}, {0x2d, 'pids', 0x20}, {0x2b, 'pids', 0x20}, {0x0, 'memory', 0x20}]}, 0x24)
connect$unix(r1, &(0x7f0000000100)=@abs, 0x6e)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)

[ 1527.013373] binder: BINDER_SET_CONTEXT_MGR already set
[ 1527.013431] binder: 17294:17307 ioctl 40046207 0 returned -16
[ 1527.079382] binder: BINDER_SET_CONTEXT_MGR already set
[ 1527.079390] binder: 17312:17313 ioctl 40046207 0 returned -16
[ 1527.085291] binder: 17312:17313 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1527.103287] binder: BINDER_SET_CONTEXT_MGR already set
[ 1527.103296] binder: 17310:17311 ioctl 40046207 0 returned -16
[ 1527.106233] binder: BINDER_SET_CONTEXT_MGR already set
[ 1527.106240] binder: 17317:17319 ioctl 40046207 0 returned -16
[ 1527.106760] binder: 17310:17311 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1527.112253] binder: BINDER_SET_CONTEXT_MGR already set
[ 1527.112259] binder: 17315:17321 ioctl 40046207 0 returned -16
[ 1527.114738] binder: BINDER_SET_CONTEXT_MGR already set
2018/03/29 19:07:50 executing program 5:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
r1 = mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x7c, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @increfs_done={0x40106308, r1, 0x3}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r2 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r3, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
keyctl$assume_authority(0x10, 0x0)
r4 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r4, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(r4, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x200, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e78", 0x3d, 0x0, &(0x7f0000000040)={0x77359400})
r5 = add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0e9467edd7f398f", 0x1c, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, r5, &(0x7f00000006c0)=[{&(0x7f0000000400)}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r6 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(0xffffffffffffffff, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000080)={0x0, 0x0, &(0x7f000000dff8), 0x0, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r6}], 0x1, 0x0)

2018/03/29 19:07:50 executing program 0:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x7c, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r1 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
r2 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r2, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
keyctl$assume_authority(0x10, 0x0)
r3 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r3, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(0xffffffffffffffff, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x0, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6c8344f9f96ef2c7fe911c01908", 0x5c, 0x0, &(0x7f0000000040)={0x77359400})
r4 = add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0e9467edd", 0x19, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, r4, &(0x7f00000006c0)=[{&(0x7f0000000400)}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r5 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(r0, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x32b, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r5}], 0x1, 0x0)

2018/03/29 19:07:50 executing program 2:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x70, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @release={0x40046306, 0x1}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r1 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
r2 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r2, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
r3 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r3, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(r3, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x200, 0x1, 0x3}, 0xfff1}, 0x1}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6c8344f9f96ef2c7fe911c019080e", 0x5d, 0x0, &(0x7f0000000040)={0x77359400})
r4 = add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0e9467edd7f398f", 0x1c, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, r4, &(0x7f00000006c0)=[{&(0x7f0000000400)="f916b8f72c29a4ed654ec4634d479b3453a0dbdd444019513f1d25ccda2381b9d22363dbeef5a27f13994695211b14422a35c08f7510fa", 0x37}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r5 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(r0, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x32b, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r5}], 0x1, 0x0)

2018/03/29 19:07:50 executing program 6:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
r1 = mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x7c, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @increfs_done={0x40106308, r1, 0x3}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r2 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r3, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
keyctl$assume_authority(0x10, 0x0)
r4 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r4, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(r4, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x200, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6c8344f9f96ef2c7fe911c01908", 0x5c, 0x0, &(0x7f0000000040)={0x77359400})
add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0e9467edd7f39", 0x1b, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, 0x0, &(0x7f00000006c0)=[{&(0x7f0000000400)}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r5 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(0xffffffffffffffff, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000080)={0x0, 0x0, &(0x7f000000dff8), 0x0, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r5}], 0x1, 0x0)

2018/03/29 19:07:50 executing program 5:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
r1 = mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x7c, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @increfs_done={0x40106308, r1, 0x3}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r2 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r3, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
keyctl$assume_authority(0x10, 0x0)
r4 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r4, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(r4, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x200, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e78", 0x3d, 0x0, &(0x7f0000000040)={0x77359400})
r5 = add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0e9467edd7f398f", 0x1c, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, r5, &(0x7f00000006c0)=[{&(0x7f0000000400)}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r6 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(0xffffffffffffffff, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000080)={0x0, 0x0, &(0x7f000000dff8), 0x0, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r6}], 0x1, 0x0)

[ 1527.114744] binder: 17316:17320 ioctl 40046207 0 returned -16
[ 1527.120298] binder: 17317:17319 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1527.122321] binder: BINDER_SET_CONTEXT_MGR already set
[ 1527.122328] binder: 17318:17322 ioctl 40046207 0 returned -16
2018/03/29 19:07:50 executing program 0:
r0 = mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(0xffffffffffffffff)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x7c, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @increfs_done={0x40106308, r0, 0x3}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r1 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
r2 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r2, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
keyctl$assume_authority(0x10, 0x0)
r3 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r3, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(0xffffffffffffffff, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x0, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6c8344f9f96ef2c7fe911c01908", 0x5c, 0x0, &(0x7f0000000040)={0x77359400})
r4 = add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0e9467edd", 0x19, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, r4, &(0x7f00000006c0)=[{&(0x7f0000000400)}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r5 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(0xffffffffffffffff, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(0xffffffffffffffff, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(0xffffffffffffffff, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x32b, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r5}], 0x1, 0x0)

2018/03/29 19:07:50 executing program 6:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
r1 = mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x7c, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @increfs_done={0x40106308, r1, 0x3}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r2 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r3, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
keyctl$assume_authority(0x10, 0x0)
r4 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r4, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(r4, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x200, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6c8344f9f96ef2c7fe911c01908", 0x5c, 0x0, &(0x7f0000000040)={0x77359400})
add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0e9467edd7f39", 0x1b, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, 0x0, &(0x7f00000006c0)=[{&(0x7f0000000400)}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r5 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(0xffffffffffffffff, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000080)={0x0, 0x0, &(0x7f000000dff8), 0x0, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r5}], 0x1, 0x0)

[ 1527.257706] binder: BINDER_SET_CONTEXT_MGR already set
[ 1527.257714] binder: 17324:17328 ioctl 40046207 0 returned -16
[ 1527.258658] binder: BINDER_SET_CONTEXT_MGR already set
[ 1527.258666] binder: 17325:17329 ioctl 40046207 0 returned -16
[ 1527.262142] binder: BINDER_SET_CONTEXT_MGR already set
[ 1527.262149] binder: 17327:17331 ioctl 40046207 0 returned -16
[ 1527.268745] binder: BINDER_SET_CONTEXT_MGR already set
[ 1527.269237] binder: 17323:17336 ioctl 40046207 0 returned -16
[ 1527.270428] binder: BINDER_SET_CONTEXT_MGR already set
[ 1527.270434] binder: 17326:17335 ioctl 40046207 0 returned -16
[ 1527.274766] binder: BINDER_SET_CONTEXT_MGR already set
[ 1527.274774] binder: 17330:17332 ioctl 40046207 0 returned -16
[ 1527.275376] binder: 17325:17329 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1527.291908] binder: 17323:17336 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1527.293543] binder: 17330:17332 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1527.346325] binder: BINDER_SET_CONTEXT_MGR already set
[ 1527.346333] binder: 17341:17343 ioctl 40046207 0 returned -16
[ 1527.355836] binder: 17341:17343 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1527.367826] binder: BINDER_SET_CONTEXT_MGR already set
[ 1527.367834] binder: 17345:17349 ioctl 40046207 0 returned -16
[ 1527.370458] binder: BINDER_SET_CONTEXT_MGR already set
[ 1527.370464] binder: 17340:17342 ioctl 40046207 0 returned -16
[ 1527.371753] binder: BINDER_SET_CONTEXT_MGR already set
[ 1527.371758] binder: 17346:17351 ioctl 40046207 0 returned -16
[ 1527.379195] binder: BINDER_SET_CONTEXT_MGR already set
[ 1527.379202] binder: 17347:17353 ioctl 40046207 0 returned -16
[ 1527.390128] binder: BINDER_SET_CONTEXT_MGR already set
[ 1527.390134] binder: 17348:17352 ioctl 40046207 0 returned -16
[ 1527.390885] binder: 17345:17349 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1527.395524] binder: 17348:17352 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1527.426331] binder: BINDER_SET_CONTEXT_MGR already set
2018/03/29 19:07:50 executing program 5:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
r1 = mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x7c, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @increfs_done={0x40106308, r1, 0x3}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r2 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r3, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
keyctl$assume_authority(0x10, 0x0)
r4 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r4, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(r4, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x200, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c7", 0x47, 0x0, &(0x7f0000000040)={0x77359400})
r5 = add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0e9467edd7f398f", 0x1c, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, r5, &(0x7f00000006c0)=[{&(0x7f0000000400)}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r6 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(0xffffffffffffffff, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000080)={0x0, 0x0, &(0x7f000000dff8), 0x0, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r6}], 0x1, 0x0)

2018/03/29 19:07:50 executing program 7:
add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={0x73, 0x79, 0x7a}, &(0x7f0000001100)="a1", 0x1, 0xfffffffffffffffb)
sendmmsg(0xffffffffffffffff, &(0x7f0000000200)=[{{&(0x7f0000003000)=@rc={0x1f}, 0x80, &(0x7f0000004fa0), 0x0, &(0x7f0000002d30)}}], 0x1, 0x0)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f00000000c0)={"d202b999cf85000000000088f301e710"})
r0 = syz_open_dev$tun(&(0x7f0000000280)='/dev/net/tun\x00', 0x0, 0x400200)
r1 = socket(0x11, 0x100000802, 0x0)
r2 = syz_open_dev$tun(&(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000000c0)={'ifb0\x00', 0x1001})
ioctl$TUNSETLINK(r2, 0x400454cd, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000040)={'ifb0\x00', 0xa201})
r3 = dup2(r0, 0xffffffffffffffff)
ioctl$TUNSETQUEUE(0xffffffffffffffff, 0x400454d9, &(0x7f0000000000)={'vlan0\x00'})
write$cgroup_subtree(r3, &(0x7f00000001c0)={[{0x0, 'cpu', 0x20}, {0x0, 'pids', 0x20}, {0x0, 'cpu', 0x20}, {0x2d, 'pids', 0x20}, {0x2b, 'pids', 0x20}, {0x0, 'memory', 0x20}]}, 0x24)
connect$unix(r1, &(0x7f0000000100)=@abs, 0x6e)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)

2018/03/29 19:07:50 executing program 4:
add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={0x73, 0x79, 0x7a}, &(0x7f0000001100)="a1", 0x1, 0xfffffffffffffffb)
perf_event_open(&(0x7f000025c000)={0x2, 0x78}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
pipe2(&(0x7f0000000180), 0x0)
socket(0x18, 0x0, 0x1)
sendmmsg(0xffffffffffffffff, &(0x7f0000000200)=[{{&(0x7f0000003000)=@rc={0x1f}, 0x80, &(0x7f0000004fa0), 0x0, &(0x7f0000002d30)}}], 0x1, 0x0)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f00000000c0)={"d202b999cf85000000000088f301e710"})
r0 = syz_open_dev$tun(&(0x7f0000000280)='/dev/net/tun\x00', 0x0, 0x400200)
r1 = socket(0x11, 0x100000802, 0x0)
r2 = syz_open_dev$tun(&(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000000c0)={'ifb0\x00', 0x1001})
ioctl$TUNSETLINK(r2, 0x400454cd, 0x308)
ioctl$sock_inet_SIOCSIFFLAGS(0xffffffffffffffff, 0x8914, &(0x7f0000000040)={'ifb0\x00', 0xa201})
r3 = dup2(r0, 0xffffffffffffffff)
ioctl$TUNSETQUEUE(0xffffffffffffffff, 0x400454d9, &(0x7f0000000000)={'vlan0\x00'})
write$cgroup_subtree(r3, &(0x7f00000001c0)={[{0x2d, 'pids', 0x20}, {0x0, 'cpu', 0x20}, {0x2d, 'pids', 0x20}, {0x2b, 'rdma', 0x20}, {0x0, 'pids', 0x20}, {0x0, 'io', 0x20}]}, 0x21)
connect$unix(0xffffffffffffffff, &(0x7f0000000100)=@abs, 0x6e)
ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82)

2018/03/29 19:07:50 executing program 1:
add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={0x73, 0x79, 0x7a}, &(0x7f0000001100)="a1", 0x1, 0xfffffffffffffffb)
perf_event_open(&(0x7f000025c000)={0x0, 0x78}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sendmmsg(0xffffffffffffffff, &(0x7f0000000200)=[{{&(0x7f0000003000)=@rc={0x1f}, 0x80, &(0x7f0000004fa0), 0x0, &(0x7f0000002d30)}}], 0x1, 0x0)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f00000000c0)={"d202b999cf85000000000088f301e710"})
r0 = syz_open_dev$tun(&(0x7f0000000280)='/dev/net/tun\x00', 0x0, 0x400200)
r1 = socket(0x11, 0x100000802, 0x0)
r2 = syz_open_dev$tun(&(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000000c0)={'ifb0\x00', 0x1001})
ioctl$TUNSETLINK(r2, 0x400454cd, 0x308)
ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000040)={'ifb0\x00', 0xa201})
r3 = dup2(r0, 0xffffffffffffffff)
ioctl$TUNSETQUEUE(0xffffffffffffffff, 0x400454d9, &(0x7f0000000000)={'vlan0\x00'})
write$cgroup_subtree(0xffffffffffffffff, &(0x7f00000001c0)={[{0x0, 'cpu', 0x20}, {0x0, 'pids', 0x20}, {0x0, 'cpu', 0x20}, {0x2d, 'pids', 0x20}, {0x2b, 'pids', 0x20}, {0x0, 'memory', 0x20}]}, 0x24)
connect$unix(r1, &(0x7f0000000100)=@abs, 0x6e)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)

2018/03/29 19:07:50 executing program 3:
add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={0x73, 0x79, 0x7a}, &(0x7f0000001100)="a1", 0x1, 0xfffffffffffffffb)
perf_event_open(&(0x7f000025c000)={0x2, 0x78}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sendmmsg(0xffffffffffffffff, &(0x7f0000000200), 0x0, 0x0)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f00000000c0)={"d202b999cf85000000000088f301e710"})
r0 = syz_open_dev$tun(&(0x7f0000000280)='/dev/net/tun\x00', 0x0, 0x400200)
r1 = socket(0x11, 0x100000802, 0x0)
r2 = syz_open_dev$tun(&(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000000c0)={'ifb0\x00', 0x1001})
ioctl$TUNSETLINK(r2, 0x400454cd, 0x308)
ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000040)={'ifb0\x00'})
r3 = dup2(r0, 0xffffffffffffffff)
ioctl$TUNSETQUEUE(0xffffffffffffffff, 0x400454d9, &(0x7f0000000000)={'vlan0\x00'})
write$cgroup_subtree(r3, &(0x7f00000001c0)={[{0x0, 'cpu', 0x20}, {0x0, 'pids', 0x20}, {0x0, 'cpu', 0x20}, {0x2d, 'pids', 0x20}, {0x2b, 'rdma', 0x20}, {0x2b, 'pids', 0x20}, {0x0, 'memory', 0x20}]}, 0x2a)
connect$unix(0xffffffffffffffff, &(0x7f0000000100)=@abs, 0x6e)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)

2018/03/29 19:07:50 executing program 2:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x70, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @release={0x40046306, 0x1}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r1 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
r2 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r2, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
r3 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r3, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(r3, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x200, 0x1, 0x3}, 0xfff1}, 0x1}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6c8344f9f96ef2c7fe911c019080e", 0x5d, 0x0, &(0x7f0000000040)={0x77359400})
r4 = add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0e9467edd7f398f", 0x1c, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, r4, &(0x7f00000006c0)=[{&(0x7f0000000400)="f916b8f72c29a4ed654ec4634d479b3453a0dbdd444019513f1d25ccda2381b9d22363dbeef5a27f13994695211b14422a35c08f7510fa", 0x37}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r5 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(r0, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x32b, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r5}], 0x1, 0x0)

2018/03/29 19:07:50 executing program 0:
r0 = mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(0xffffffffffffffff)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x7c, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @increfs_done={0x40106308, r0, 0x3}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r1 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
r2 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r2, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
keyctl$assume_authority(0x10, 0x0)
r3 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r3, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(0xffffffffffffffff, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x0, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6c8344f9f96ef2c7fe911c01908", 0x5c, 0x0, &(0x7f0000000040)={0x77359400})
r4 = add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0e9467edd", 0x19, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, r4, &(0x7f00000006c0)=[{&(0x7f0000000400)}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r5 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(0xffffffffffffffff, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(0xffffffffffffffff, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(0xffffffffffffffff, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x32b, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r5}], 0x1, 0x0)

2018/03/29 19:07:50 executing program 6:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
r1 = mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x7c, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @increfs_done={0x40106308, r1, 0x3}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r2 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r3, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
keyctl$assume_authority(0x10, 0x0)
r4 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r4, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(r4, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x200, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6c8344f9f96ef2c7fe911c01908", 0x5c, 0x0, &(0x7f0000000040)={0x77359400})
add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0e9467edd7f398f", 0x1c, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, 0x0, &(0x7f00000006c0)=[{&(0x7f0000000400)}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r5 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(0xffffffffffffffff, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000080)={0x0, 0x0, &(0x7f000000dff8), 0x0, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r5}], 0x1, 0x0)

[ 1527.426338] binder: 17354:17355 ioctl 40046207 0 returned -16
[ 1527.464150] binder: BINDER_SET_CONTEXT_MGR already set
[ 1527.464157] binder: 17356:17360 ioctl 40046207 0 returned -16
[ 1527.465912] binder: 17354:17355 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1527.471676] binder: BINDER_SET_CONTEXT_MGR already set
[ 1527.471683] binder: 17357:17361 ioctl 40046207 0 returned -16
[ 1527.474887] binder: 17356:17360 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1527.479381] binder: BINDER_SET_CONTEXT_MGR already set
[ 1527.479388] binder: 17358:17362 ioctl 40046207 0 returned -16
[ 1527.482806] binder: BINDER_SET_CONTEXT_MGR already set
[ 1527.482813] binder: 17359:17363 ioctl 40046207 0 returned -16
[ 1527.650355] binder: BINDER_SET_CONTEXT_MGR already set
[ 1527.650363] binder: 17366:17370 ioctl 40046207 0 returned -16
[ 1527.654919] binder: BINDER_SET_CONTEXT_MGR already set
2018/03/29 19:07:50 executing program 2:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x70, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @release={0x40046306, 0x1}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r1 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
r2 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r2, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
r3 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r3, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(r3, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x200, 0x1, 0x3}, 0xfff1}, 0x1}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6c8344f9f96ef2c7fe911c019080e", 0x5d, 0x0, &(0x7f0000000040)={0x77359400})
r4 = add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0e9467edd7f398f", 0x1c, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, r4, &(0x7f00000006c0)=[{&(0x7f0000000400)="f916b8f72c29a4ed654ec4634d479b3453a0dbdd444019513f1d25ccda2381b9d22363dbeef5a27f13994695211b14422a35c08f7510fa", 0x37}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r5 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(r0, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x32b, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r5}], 0x1, 0x0)

2018/03/29 19:07:50 executing program 0:
r0 = mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(0xffffffffffffffff)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x7c, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @increfs_done={0x40106308, r0, 0x3}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r1 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
r2 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r2, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
keyctl$assume_authority(0x10, 0x0)
r3 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r3, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(0xffffffffffffffff, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x0, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6c8344f9f96ef2c7fe911c01908", 0x5c, 0x0, &(0x7f0000000040)={0x77359400})
r4 = add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0e9467edd", 0x19, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, r4, &(0x7f00000006c0)=[{&(0x7f0000000400)}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r5 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(0xffffffffffffffff, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(0xffffffffffffffff, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(0xffffffffffffffff, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x32b, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r5}], 0x1, 0x0)

2018/03/29 19:07:50 executing program 6:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
r1 = mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x7c, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @increfs_done={0x40106308, r1, 0x3}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r2 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r3, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
keyctl$assume_authority(0x10, 0x0)
r4 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r4, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(r4, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x200, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6c8344f9f96ef2c7fe911c01908", 0x5c, 0x0, &(0x7f0000000040)={0x77359400})
add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0e9467edd7f398f", 0x1c, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, 0x0, &(0x7f00000006c0)=[{&(0x7f0000000400)}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r5 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(0xffffffffffffffff, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000080)={0x0, 0x0, &(0x7f000000dff8), 0x0, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r5}], 0x1, 0x0)

2018/03/29 19:07:50 executing program 5:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
r1 = mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x7c, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @increfs_done={0x40106308, r1, 0x3}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r2 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r3, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
keyctl$assume_authority(0x10, 0x0)
r4 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r4, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(r4, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x200, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c7", 0x47, 0x0, &(0x7f0000000040)={0x77359400})
r5 = add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0e9467edd7f398f", 0x1c, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, r5, &(0x7f00000006c0)=[{&(0x7f0000000400)}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r6 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(0xffffffffffffffff, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000080)={0x0, 0x0, &(0x7f000000dff8), 0x0, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r6}], 0x1, 0x0)

[ 1527.654926] binder: 17368:17372 ioctl 40046207 0 returned -16
[ 1527.659719] binder: 17366:17370 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1527.664464] binder: BINDER_SET_CONTEXT_MGR already set
[ 1527.664472] binder: 17367:17377 ioctl 40046207 0 returned -16
[ 1527.665155] binder: BINDER_SET_CONTEXT_MGR already set
[ 1527.665161] binder: 17373:17375 ioctl 40046207 0 returned -16
[ 1527.669462] binder: BINDER_SET_CONTEXT_MGR already set
[ 1527.669469] binder: 17364:17378 ioctl 40046207 0 returned -16
[ 1527.680394] binder: 17364:17378 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1527.743868] binder: BINDER_SET_CONTEXT_MGR already set
[ 1527.743876] binder: 17384:17388 ioctl 40046207 0 returned -16
[ 1527.747072] binder: BINDER_SET_CONTEXT_MGR already set
2018/03/29 19:07:50 executing program 5:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
r1 = mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x7c, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @increfs_done={0x40106308, r1, 0x3}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r2 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r3, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
keyctl$assume_authority(0x10, 0x0)
r4 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r4, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(r4, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x200, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c7", 0x47, 0x0, &(0x7f0000000040)={0x77359400})
r5 = add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0e9467edd7f398f", 0x1c, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, r5, &(0x7f00000006c0)=[{&(0x7f0000000400)}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r6 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(0xffffffffffffffff, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000080)={0x0, 0x0, &(0x7f000000dff8), 0x0, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r6}], 0x1, 0x0)

2018/03/29 19:07:50 executing program 0:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
r1 = mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x7c, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @increfs_done={0x40106308, r1, 0x3}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r2 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r3, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
keyctl$assume_authority(0x10, 0x0)
r4 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r4, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(0xffffffffffffffff, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x0, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6c8344f9f96ef2c7fe911c01908", 0x5c, 0x0, &(0x7f0000000040)={0x77359400})
r5 = add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0e9467edd", 0x19, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, r5, &(0x7f00000006c0)=[{&(0x7f0000000400)}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r6 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(r0, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x32b, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r6}], 0x1, 0x0)

2018/03/29 19:07:50 executing program 6:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
r1 = mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x7c, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @increfs_done={0x40106308, r1, 0x3}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r2 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r3, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
keyctl$assume_authority(0x10, 0x0)
r4 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r4, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(r4, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x200, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6c8344f9f96ef2c7fe911c01908", 0x5c, 0x0, &(0x7f0000000040)={0x77359400})
add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0e9467edd7f398f", 0x1c, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, 0x0, &(0x7f00000006c0)=[{&(0x7f0000000400)}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r5 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(0xffffffffffffffff, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000080)={0x0, 0x0, &(0x7f000000dff8), 0x0, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r5}], 0x1, 0x0)

2018/03/29 19:07:50 executing program 2:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x70, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @release={0x40046306, 0x1}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r1 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
r2 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r2, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
r3 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r3, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(r3, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x200, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x0)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6c8344f9f96ef2c7fe911c019080e", 0x5d, 0x0, &(0x7f0000000040)={0x77359400})
r4 = add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0e9467edd7f398f", 0x1c, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, r4, &(0x7f00000006c0)=[{&(0x7f0000000400)="f916b8f72c29a4ed654ec4634d479b3453a0dbdd444019513f1d25ccda2381b9d22363dbeef5a27f13994695211b14422a35c08f7510fa", 0x37}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r5 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(r0, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x32b, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r5}], 0x1, 0x0)

2018/03/29 19:07:50 executing program 6:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
r1 = mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x7c, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @increfs_done={0x40106308, r1, 0x3}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r2 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r3, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
keyctl$assume_authority(0x10, 0x0)
r4 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r4, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(r4, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x200, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6c8344f9f96ef2c7fe911c01908", 0x5c, 0x0, &(0x7f0000000040)={0x77359400})
add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0e9467edd7f398f", 0x1c, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, 0x0, &(0x7f00000006c0), 0x0, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r5 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(0xffffffffffffffff, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000080)={0x0, 0x0, &(0x7f000000dff8), 0x0, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r5}], 0x1, 0x0)

2018/03/29 19:07:50 executing program 2:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x70, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @release={0x40046306, 0x1}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r1 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
r2 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r2, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
r3 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r3, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(r3, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x200, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x0)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6c8344f9f96ef2c7fe911c019080e", 0x5d, 0x0, &(0x7f0000000040)={0x77359400})
r4 = add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0e9467edd7f398f", 0x1c, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, r4, &(0x7f00000006c0)=[{&(0x7f0000000400)="f916b8f72c29a4ed654ec4634d479b3453a0dbdd444019513f1d25ccda2381b9d22363dbeef5a27f13994695211b14422a35c08f7510fa", 0x37}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r5 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(r0, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x32b, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r5}], 0x1, 0x0)

[ 1527.747080] binder: 17385:17390 ioctl 40046207 0 returned -16
[ 1527.747444] binder: BINDER_SET_CONTEXT_MGR already set
[ 1527.747451] binder: 17386:17389 ioctl 40046207 0 returned -16
[ 1527.749994] binder: BINDER_SET_CONTEXT_MGR already set
[ 1527.750000] binder: 17383:17391 ioctl 40046207 0 returned -16
[ 1527.755229] binder: BINDER_SET_CONTEXT_MGR already set
[ 1527.755236] binder: 17387:17392 ioctl 40046207 0 returned -16
[ 1527.758014] binder: 17385:17390 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1527.765099] binder: 17387:17392 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1527.830532] binder: BINDER_SET_CONTEXT_MGR already set
[ 1527.830539] binder: 17393:17396 ioctl 40046207 0 returned -16
[ 1527.847122] binder: 17393:17396 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1527.852522] binder: BINDER_SET_CONTEXT_MGR already set
[ 1527.852529] binder: 17394:17395 ioctl 40046207 0 returned -16
[ 1527.895785] binder: 17394:17395 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1528.067382] binder: BINDER_SET_CONTEXT_MGR already set
[ 1528.067388] binder: 17399:17410 ioctl 40046207 0 returned -16
[ 1528.067939] binder: BINDER_SET_CONTEXT_MGR already set
[ 1528.067946] binder: 17398:17406 ioctl 40046207 0 returned -16
[ 1528.068058] binder: BINDER_SET_CONTEXT_MGR already set
[ 1528.068069] binder: 17400:17405 ioctl 40046207 0 returned -16
[ 1528.073768] binder: BINDER_SET_CONTEXT_MGR already set
[ 1528.073775] binder: 17397:17411 ioctl 40046207 0 returned -16
[ 1528.075600] binder: 17400:17405 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1528.083711] binder: 17399:17410 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1528.145954] binder: BINDER_SET_CONTEXT_MGR already set
2018/03/29 19:07:50 executing program 0:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
r1 = mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x7c, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @increfs_done={0x40106308, r1, 0x3}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r2 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r3, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
keyctl$assume_authority(0x10, 0x0)
r4 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r4, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(0xffffffffffffffff, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x0, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6c8344f9f96ef2c7fe911c01908", 0x5c, 0x0, &(0x7f0000000040)={0x77359400})
r5 = add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0e9467edd", 0x19, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, r5, &(0x7f00000006c0)=[{&(0x7f0000000400)}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r6 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(r0, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x32b, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r6}], 0x1, 0x0)

2018/03/29 19:07:50 executing program 3:
add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={0x73, 0x79, 0x7a}, &(0x7f0000001100)="a1", 0x1, 0xfffffffffffffffb)
perf_event_open(&(0x7f000025c000)={0x2, 0x78}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sendmmsg(0xffffffffffffffff, &(0x7f0000000200), 0x0, 0x0)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f00000000c0)={"d202b999cf85000000000088f301e710"})
r0 = syz_open_dev$tun(&(0x7f0000000280)='/dev/net/tun\x00', 0x0, 0x400200)
r1 = socket(0x11, 0x100000802, 0x0)
r2 = syz_open_dev$tun(&(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000000c0)={'ifb0\x00', 0x1001})
ioctl$TUNSETLINK(r2, 0x400454cd, 0x308)
ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000040)={'ifb0\x00'})
r3 = dup2(r0, 0xffffffffffffffff)
ioctl$TUNSETQUEUE(0xffffffffffffffff, 0x400454d9, &(0x7f0000000000)={'vlan0\x00'})
write$cgroup_subtree(r3, &(0x7f00000001c0)={[{0x0, 'cpu', 0x20}, {0x0, 'pids', 0x20}, {0x0, 'cpu', 0x20}, {0x2d, 'pids', 0x20}, {0x2b, 'rdma', 0x20}, {0x2b, 'pids', 0x20}, {0x0, 'memory', 0x20}]}, 0x2a)
connect$unix(0xffffffffffffffff, &(0x7f0000000100)=@abs, 0x6e)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)

2018/03/29 19:07:50 executing program 2:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x70, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @release={0x40046306, 0x1}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r1 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
r2 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r2, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
r3 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r3, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(r3, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x200, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x0)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6c8344f9f96ef2c7fe911c019080e", 0x5d, 0x0, &(0x7f0000000040)={0x77359400})
r4 = add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0e9467edd7f398f", 0x1c, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, r4, &(0x7f00000006c0)=[{&(0x7f0000000400)="f916b8f72c29a4ed654ec4634d479b3453a0dbdd444019513f1d25ccda2381b9d22363dbeef5a27f13994695211b14422a35c08f7510fa", 0x37}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r5 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(r0, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x32b, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r5}], 0x1, 0x0)

2018/03/29 19:07:50 executing program 5:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
r1 = mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x7c, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @increfs_done={0x40106308, r1, 0x3}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r2 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r3, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
keyctl$assume_authority(0x10, 0x0)
r4 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r4, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(r4, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x200, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557", 0x4c, 0x0, &(0x7f0000000040)={0x77359400})
r5 = add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0e9467edd7f398f", 0x1c, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, r5, &(0x7f00000006c0)=[{&(0x7f0000000400)}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r6 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(0xffffffffffffffff, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000080)={0x0, 0x0, &(0x7f000000dff8), 0x0, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r6}], 0x1, 0x0)

2018/03/29 19:07:50 executing program 6:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
r1 = mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x7c, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @increfs_done={0x40106308, r1, 0x3}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r2 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r3, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
keyctl$assume_authority(0x10, 0x0)
r4 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r4, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(r4, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x200, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6c8344f9f96ef2c7fe911c01908", 0x5c, 0x0, &(0x7f0000000040)={0x77359400})
add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0e9467edd7f398f", 0x1c, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, 0x0, &(0x7f00000006c0), 0x0, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r5 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(0xffffffffffffffff, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000080)={0x0, 0x0, &(0x7f000000dff8), 0x0, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r5}], 0x1, 0x0)

2018/03/29 19:07:50 executing program 7:
add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={0x73, 0x79, 0x7a}, &(0x7f0000001100)="a1", 0x1, 0xfffffffffffffffb)
sendmmsg(0xffffffffffffffff, &(0x7f0000000200)=[{{&(0x7f0000003000)=@rc={0x1f}, 0x80, &(0x7f0000004fa0), 0x0, &(0x7f0000002d30)}}], 0x1, 0x0)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f00000000c0)={"d202b999cf85000000000088f301e710"})
r0 = syz_open_dev$tun(&(0x7f0000000280)='/dev/net/tun\x00', 0x0, 0x400200)
r1 = socket(0x11, 0x100000802, 0x0)
r2 = syz_open_dev$tun(&(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000000c0)={'ifb0\x00', 0x1001})
ioctl$TUNSETLINK(r2, 0x400454cd, 0x308)
ioctl$sock_inet_SIOCSIFFLAGS(0xffffffffffffffff, 0x8914, &(0x7f0000000040)={'ifb0\x00', 0xa201})
r3 = dup2(r0, 0xffffffffffffffff)
ioctl$TUNSETQUEUE(0xffffffffffffffff, 0x400454d9, &(0x7f0000000000)={'vlan0\x00'})
write$cgroup_subtree(r3, &(0x7f00000001c0)={[{0x0, 'cpu', 0x20}, {0x0, 'pids', 0x20}, {0x0, 'cpu', 0x20}, {0x2d, 'pids', 0x20}, {0x2b, 'pids', 0x20}, {0x0, 'memory', 0x20}]}, 0x24)
connect$unix(r1, &(0x7f0000000100)=@abs, 0x6e)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)

2018/03/29 19:07:50 executing program 4:
add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={0x73, 0x79, 0x7a}, &(0x7f0000001100)="a1", 0x1, 0xfffffffffffffffb)
perf_event_open(&(0x7f000025c000)={0x2, 0x78}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
pipe2(&(0x7f0000000180), 0x0)
socket(0x18, 0x0, 0x1)
sendmmsg(0xffffffffffffffff, &(0x7f0000000200)=[{{&(0x7f0000003000)=@rc={0x1f}, 0x80, &(0x7f0000004fa0), 0x0, &(0x7f0000002d30)}}], 0x1, 0x0)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f00000000c0)={"d202b999cf85000000000088f301e710"})
r0 = syz_open_dev$tun(&(0x7f0000000280)='/dev/net/tun\x00', 0x0, 0x400200)
r1 = socket(0x11, 0x100000802, 0x0)
r2 = syz_open_dev$tun(&(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000000c0)={'ifb0\x00', 0x1001})
ioctl$TUNSETLINK(r2, 0x400454cd, 0x308)
ioctl$sock_inet_SIOCSIFFLAGS(0xffffffffffffffff, 0x8914, &(0x7f0000000040)={'ifb0\x00', 0xa201})
r3 = dup2(r0, 0xffffffffffffffff)
ioctl$TUNSETQUEUE(0xffffffffffffffff, 0x400454d9, &(0x7f0000000000)={'vlan0\x00'})
write$cgroup_subtree(r3, &(0x7f00000001c0)={[{0x2d, 'pids', 0x20}, {0x0, 'cpu', 0x20}, {0x2d, 'pids', 0x20}, {0x2b, 'rdma', 0x20}, {0x0, 'pids', 0x20}, {0x0, 'io', 0x20}]}, 0x21)
connect$unix(0xffffffffffffffff, &(0x7f0000000100)=@abs, 0x6e)
ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82)

2018/03/29 19:07:50 executing program 1:
add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={0x73, 0x79, 0x7a}, &(0x7f0000001100)="a1", 0x1, 0xfffffffffffffffb)
perf_event_open(&(0x7f000025c000)={0x0, 0x78}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sendmmsg(0xffffffffffffffff, &(0x7f0000000200)=[{{&(0x7f0000003000)=@rc={0x1f}, 0x80, &(0x7f0000004fa0), 0x0, &(0x7f0000002d30)}}], 0x1, 0x0)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f00000000c0)={"d202b999cf85000000000088f301e710"})
r0 = syz_open_dev$tun(&(0x7f0000000280)='/dev/net/tun\x00', 0x0, 0x400200)
r1 = socket(0x11, 0x100000802, 0x0)
r2 = syz_open_dev$tun(&(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000000c0)={'ifb0\x00', 0x1001})
ioctl$TUNSETLINK(r2, 0x400454cd, 0x308)
ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000040)={'ifb0\x00', 0xa201})
r3 = dup2(r0, 0xffffffffffffffff)
ioctl$TUNSETQUEUE(0xffffffffffffffff, 0x400454d9, &(0x7f0000000000)={'vlan0\x00'})
write$cgroup_subtree(0xffffffffffffffff, &(0x7f00000001c0)={[{0x0, 'cpu', 0x20}, {0x0, 'pids', 0x20}, {0x0, 'cpu', 0x20}, {0x2d, 'pids', 0x20}, {0x2b, 'pids', 0x20}, {0x0, 'memory', 0x20}]}, 0x24)
connect$unix(r1, &(0x7f0000000100)=@abs, 0x6e)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)

[ 1528.145961] binder: 17416:17418 ioctl 40046207 0 returned -16
[ 1528.149067] binder: BINDER_SET_CONTEXT_MGR already set
[ 1528.149074] binder: 17417:17420 ioctl 40046207 0 returned -16
[ 1528.153115] binder: BINDER_SET_CONTEXT_MGR already set
[ 1528.153127] binder: 17419:17422 ioctl 40046207 0 returned -16
[ 1528.155530] binder: 17417:17420 ioctl c0306201 20000080 returned -14
[ 1528.159531] binder: BINDER_SET_CONTEXT_MGR already set
[ 1528.159537] binder: 17421:17423 ioctl 40046207 0 returned -16
[ 1528.161670] binder: 17419:17422 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1528.189698] binder: BINDER_SET_CONTEXT_MGR already set
[ 1528.189705] binder: 17424:17425 ioctl 40046207 0 returned -16
[ 1528.194838] binder: 17424:17425 ioctl c0306201 20000080 returned -14
[ 1528.562169] binder: BINDER_SET_CONTEXT_MGR already set
2018/03/29 19:07:50 executing program 2:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x70, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @release={0x40046306, 0x1}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r1 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
r2 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r2, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
r3 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r3, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(r3, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x200, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240), 0x0, 0x0, &(0x7f0000000040)={0x77359400})
r4 = add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0e9467edd7f398f", 0x1c, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, r4, &(0x7f00000006c0)=[{&(0x7f0000000400)="f916b8f72c29a4ed654ec4634d479b3453a0dbdd444019513f1d25ccda2381b9d22363dbeef5a27f13994695211b14422a35c08f7510fa", 0x37}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r5 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(r0, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x32b, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r5}], 0x1, 0x0)

2018/03/29 19:07:50 executing program 5:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
r1 = mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x7c, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @increfs_done={0x40106308, r1, 0x3}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r2 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r3, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
keyctl$assume_authority(0x10, 0x0)
r4 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r4, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(r4, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x200, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557", 0x4c, 0x0, &(0x7f0000000040)={0x77359400})
r5 = add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0e9467edd7f398f", 0x1c, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, r5, &(0x7f00000006c0)=[{&(0x7f0000000400)}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r6 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(0xffffffffffffffff, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000080)={0x0, 0x0, &(0x7f000000dff8), 0x0, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r6}], 0x1, 0x0)

2018/03/29 19:07:50 executing program 6:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
r1 = mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x7c, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @increfs_done={0x40106308, r1, 0x3}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r2 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r3, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
keyctl$assume_authority(0x10, 0x0)
r4 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r4, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(r4, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x200, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6c8344f9f96ef2c7fe911c01908", 0x5c, 0x0, &(0x7f0000000040)={0x77359400})
add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0e9467edd7f398f", 0x1c, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, 0x0, &(0x7f00000006c0), 0x0, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r5 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(0xffffffffffffffff, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000080)={0x0, 0x0, &(0x7f000000dff8), 0x0, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r5}], 0x1, 0x0)

2018/03/29 19:07:50 executing program 0:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
r1 = mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x0, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x7c, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @increfs_done={0x40106308, r1, 0x3}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r2 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r3, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
keyctl$assume_authority(0x10, 0x0)
r4 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r4, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(0xffffffffffffffff, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x0, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6c8344f9f96ef2c7fe911c01908", 0x5c, 0x0, &(0x7f0000000040)={0x77359400})
r5 = add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0e9467edd", 0x19, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, r5, &(0x7f00000006c0)=[{&(0x7f0000000400)}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r6 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(r0, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x32b, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r6}], 0x1, 0x0)

[ 1528.562176] binder: 17429:17432 ioctl 40046207 0 returned -16
[ 1528.565164] binder: BINDER_SET_CONTEXT_MGR already set
[ 1528.565171] binder: 17427:17430 ioctl 40046207 0 returned -16
[ 1528.576359] binder: BINDER_SET_CONTEXT_MGR already set
[ 1528.576367] binder: 17426:17438 ioctl 40046207 0 returned -16
[ 1528.580450] binder: BINDER_SET_CONTEXT_MGR already set
2018/03/29 19:07:50 executing program 2:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x70, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @release={0x40046306, 0x1}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r1 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
r2 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r2, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
r3 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r3, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(r3, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x200, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240), 0x0, 0x0, &(0x7f0000000040)={0x77359400})
r4 = add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0e9467edd7f398f", 0x1c, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, r4, &(0x7f00000006c0)=[{&(0x7f0000000400)="f916b8f72c29a4ed654ec4634d479b3453a0dbdd444019513f1d25ccda2381b9d22363dbeef5a27f13994695211b14422a35c08f7510fa", 0x37}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r5 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(r0, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x32b, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r5}], 0x1, 0x0)

[ 1528.580457] binder: 17428:17441 ioctl 40046207 0 returned -16
[ 1528.585591] binder: 17426:17438 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1528.587735] binder: 17428:17441 ioctl c0306201 20000080 returned -14
[ 1528.616726] binder: BINDER_SET_CONTEXT_MGR already set
[ 1528.616734] binder: 17445:17446 ioctl 40046207 0 returned -16
[ 1528.625676] binder: 17445:17446 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1528.642342] binder: BINDER_SET_CONTEXT_MGR already set
[ 1528.642349] binder: 17447:17449 ioctl 40046207 0 returned -16
[ 1528.645590] binder: BINDER_SET_CONTEXT_MGR already set
[ 1528.645597] binder: 17448:17451 ioctl 40046207 0 returned -16
[ 1528.652657] binder: BINDER_SET_CONTEXT_MGR already set
[ 1528.652664] binder: 17450:17452 ioctl 40046207 0 returned -16
[ 1528.664077] binder: 17450:17452 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1528.726133] binder: BINDER_SET_CONTEXT_MGR already set
[ 1528.726141] binder: 17453:17454 ioctl 40046207 0 returned -16
[ 1528.730017] binder: 17453:17454 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1528.741139] binder: BINDER_SET_CONTEXT_MGR already set
[ 1528.741146] binder: 17455:17458 ioctl 40046207 0 returned -16
[ 1528.741664] binder: BINDER_SET_CONTEXT_MGR already set
[ 1528.741669] binder: 17456:17460 ioctl 40046207 0 returned -16
[ 1528.751836] binder: 17455:17458 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1529.031672] binder: BINDER_SET_CONTEXT_MGR already set
[ 1529.031679] binder: 17463:17465 ioctl 40046207 0 returned -16
[ 1529.040535] binder: BINDER_SET_CONTEXT_MGR already set
[ 1529.040543] binder: 17466:17467 ioctl 40046207 0 returned -16
[ 1529.046584] binder: 17466:17467 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1529.046699] binder: 17463:17465 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1529.083500] binder: BINDER_SET_CONTEXT_MGR already set
[ 1529.083508] binder: 17462:17464 ioctl 40046207 0 returned -16
[ 1529.137567] binder: BINDER_SET_CONTEXT_MGR already set
[ 1529.137574] binder: 17483:17485 ioctl 40046207 0 returned -16
2018/03/29 19:07:51 executing program 0:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
r1 = mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(0xffffffffffffffff)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x7c, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @increfs_done={0x40106308, r1, 0x3}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r2 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r3, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
keyctl$assume_authority(0x10, 0x0)
r4 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r4, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(0xffffffffffffffff, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x0, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6c8344f9f96ef2c7fe911c01908", 0x5c, 0x0, &(0x7f0000000040)={0x77359400})
r5 = add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0e9467edd", 0x19, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, r5, &(0x7f00000006c0)=[{&(0x7f0000000400)}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r6 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(r0, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x32b, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r6}], 0x1, 0x0)

2018/03/29 19:07:51 executing program 6:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
r1 = mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x7c, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @increfs_done={0x40106308, r1, 0x3}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r2 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r3, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
keyctl$assume_authority(0x10, 0x0)
r4 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r4, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(r4, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x200, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6c8344f9f96ef2c7fe911c01908", 0x5c, 0x0, &(0x7f0000000040)={0x77359400})
add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0e9467edd7f398f", 0x1c, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, 0x0, &(0x7f00000006c0)=[{&(0x7f0000000400)}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0], 0x1})
r5 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(0xffffffffffffffff, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000080)={0x0, 0x0, &(0x7f000000dff8), 0x0, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r5}], 0x1, 0x0)

2018/03/29 19:07:51 executing program 5:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
r1 = mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x7c, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @increfs_done={0x40106308, r1, 0x3}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r2 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r3, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
keyctl$assume_authority(0x10, 0x0)
r4 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r4, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(r4, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x200, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557", 0x4c, 0x0, &(0x7f0000000040)={0x77359400})
r5 = add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0e9467edd7f398f", 0x1c, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, r5, &(0x7f00000006c0)=[{&(0x7f0000000400)}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r6 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(0xffffffffffffffff, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000080)={0x0, 0x0, &(0x7f000000dff8), 0x0, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r6}], 0x1, 0x0)

2018/03/29 19:07:51 executing program 4:
add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={0x73, 0x79, 0x7a}, &(0x7f0000001100)="a1", 0x1, 0xfffffffffffffffb)
perf_event_open(&(0x7f000025c000)={0x2, 0x78}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
pipe2(&(0x7f0000000180), 0x0)
socket(0x18, 0x0, 0x1)
sendmmsg(0xffffffffffffffff, &(0x7f0000000200)=[{{&(0x7f0000003000)=@rc={0x1f}, 0x80, &(0x7f0000004fa0), 0x0, &(0x7f0000002d30)}}], 0x1, 0x0)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f00000000c0)={"d202b999cf85000000000088f301e710"})
r0 = syz_open_dev$tun(&(0x7f0000000280)='/dev/net/tun\x00', 0x0, 0x400200)
r1 = socket(0x11, 0x100000802, 0x0)
r2 = syz_open_dev$tun(&(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000000c0)={'ifb0\x00', 0x1001})
ioctl$TUNSETLINK(r2, 0x400454cd, 0x308)
ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000040)={'ifb0\x00'})
r3 = dup2(r0, 0xffffffffffffffff)
ioctl$TUNSETQUEUE(0xffffffffffffffff, 0x400454d9, &(0x7f0000000000)={'vlan0\x00'})
write$cgroup_subtree(r3, &(0x7f00000001c0)={[{0x2d, 'pids', 0x20}, {0x0, 'cpu', 0x20}, {0x2d, 'pids', 0x20}, {0x2b, 'rdma', 0x20}, {0x0, 'pids', 0x20}, {0x0, 'io', 0x20}]}, 0x21)
connect$unix(0xffffffffffffffff, &(0x7f0000000100)=@abs, 0x6e)
ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82)

2018/03/29 19:07:51 executing program 3:
add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={0x73, 0x79, 0x7a}, &(0x7f0000001100)="a1", 0x1, 0xfffffffffffffffb)
perf_event_open(&(0x7f000025c000)={0x2, 0x78}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sendmmsg(0xffffffffffffffff, &(0x7f0000000200), 0x0, 0x0)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f00000000c0)={"d202b999cf85000000000088f301e710"})
r0 = syz_open_dev$tun(&(0x7f0000000280)='/dev/net/tun\x00', 0x0, 0x400200)
r1 = socket(0x11, 0x100000802, 0x0)
r2 = syz_open_dev$tun(&(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000000c0)={'ifb0\x00', 0x1001})
ioctl$TUNSETLINK(r2, 0x400454cd, 0x308)
ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000040)={'ifb0\x00', 0xa201})
r3 = dup2(0xffffffffffffffff, 0xffffffffffffffff)
ioctl$TUNSETQUEUE(0xffffffffffffffff, 0x400454d9, &(0x7f0000000000)={'vlan0\x00'})
write$cgroup_subtree(r3, &(0x7f00000001c0)={[{0x0, 'cpu', 0x20}, {0x0, 'pids', 0x20}, {0x0, 'cpu', 0x20}, {0x2d, 'pids', 0x20}, {0x2b, 'rdma', 0x20}, {0x2b, 'pids', 0x20}, {0x0, 'memory', 0x20}]}, 0x2a)
connect$unix(0xffffffffffffffff, &(0x7f0000000100)=@abs, 0x6e)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)

2018/03/29 19:07:51 executing program 2:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x70, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @release={0x40046306, 0x1}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r1 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
r2 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r2, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
r3 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r3, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(r3, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x200, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240), 0x0, 0x0, &(0x7f0000000040)={0x77359400})
r4 = add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0e9467edd7f398f", 0x1c, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, r4, &(0x7f00000006c0)=[{&(0x7f0000000400)="f916b8f72c29a4ed654ec4634d479b3453a0dbdd444019513f1d25ccda2381b9d22363dbeef5a27f13994695211b14422a35c08f7510fa", 0x37}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r5 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(r0, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x32b, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r5}], 0x1, 0x0)

2018/03/29 19:07:51 executing program 7:
add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={0x73, 0x79, 0x7a}, &(0x7f0000001100)="a1", 0x1, 0xfffffffffffffffb)
sendmmsg(0xffffffffffffffff, &(0x7f0000000200)=[{{&(0x7f0000003000)=@rc={0x1f}, 0x80, &(0x7f0000004fa0), 0x0, &(0x7f0000002d30)}}], 0x1, 0x0)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f00000000c0)={"d202b999cf85000000000088f301e710"})
r0 = syz_open_dev$tun(&(0x7f0000000280)='/dev/net/tun\x00', 0x0, 0x400200)
r1 = socket(0x11, 0x100000802, 0x0)
r2 = syz_open_dev$tun(&(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000000c0)={'ifb0\x00', 0x1001})
ioctl$TUNSETLINK(r2, 0x400454cd, 0x308)
ioctl$sock_inet_SIOCSIFFLAGS(0xffffffffffffffff, 0x8914, &(0x7f0000000040)={'ifb0\x00', 0xa201})
r3 = dup2(r0, 0xffffffffffffffff)
ioctl$TUNSETQUEUE(0xffffffffffffffff, 0x400454d9, &(0x7f0000000000)={'vlan0\x00'})
write$cgroup_subtree(r3, &(0x7f00000001c0)={[{0x0, 'cpu', 0x20}, {0x0, 'pids', 0x20}, {0x0, 'cpu', 0x20}, {0x2d, 'pids', 0x20}, {0x2b, 'pids', 0x20}, {0x0, 'memory', 0x20}]}, 0x24)
connect$unix(r1, &(0x7f0000000100)=@abs, 0x6e)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)

2018/03/29 19:07:51 executing program 1:
add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={0x73, 0x79, 0x7a}, &(0x7f0000001100)="a1", 0x1, 0xfffffffffffffffb)
perf_event_open(&(0x7f000025c000)={0x0, 0x78}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sendmmsg(0xffffffffffffffff, &(0x7f0000000200)=[{{&(0x7f0000003000)=@rc={0x1f}, 0x80, &(0x7f0000004fa0), 0x0, &(0x7f0000002d30)}}], 0x1, 0x0)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f00000000c0)={"d202b999cf85000000000088f301e710"})
r0 = syz_open_dev$tun(&(0x7f0000000280)='/dev/net/tun\x00', 0x0, 0x400200)
r1 = socket(0x11, 0x100000802, 0x0)
r2 = syz_open_dev$tun(&(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000000c0)={'ifb0\x00', 0x1001})
ioctl$TUNSETLINK(r2, 0x400454cd, 0x308)
ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000040)={'ifb0\x00', 0xa201})
r3 = dup2(r0, 0xffffffffffffffff)
ioctl$TUNSETQUEUE(0xffffffffffffffff, 0x400454d9, &(0x7f0000000000)={'vlan0\x00'})
write$cgroup_subtree(r3, &(0x7f00000001c0)={[{0x0, 'pids', 0x20}, {0x0, 'cpu', 0x20}, {0x2d, 'pids', 0x20}, {0x2b, 'pids', 0x20}, {0x0, 'memory', 0x20}]}, 0x1f)
connect$unix(r1, &(0x7f0000000100)=@abs, 0x6e)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)

[ 1529.150384] binder: BINDER_SET_CONTEXT_MGR already set
[ 1529.150392] binder: 17482:17488 ioctl 40046207 0 returned -16
[ 1529.153422] binder: 17482:17488 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1529.154313] binder: 17483:17485 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1529.178896] binder: BINDER_SET_CONTEXT_MGR already set
[ 1529.178903] binder: 17487:17489 ioctl 40046207 0 returned -16
[ 1529.179310] binder: BINDER_SET_CONTEXT_MGR already set
[ 1529.179317] binder: 17490:17491 ioctl 40046207 0 returned -16
[ 1529.183268] binder: 17490:17491 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1529.523388] binder: BINDER_SET_CONTEXT_MGR already set
[ 1529.523397] binder: 17494:17503 ioctl 40046207 0 returned -16
[ 1529.524441] binder: BINDER_SET_CONTEXT_MGR already set
[ 1529.524449] binder: 17492:17505 ioctl 40046207 0 returned -16
2018/03/29 19:07:51 executing program 6:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
r1 = mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x7c, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @increfs_done={0x40106308, r1, 0x3}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r2 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r3, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
keyctl$assume_authority(0x10, 0x0)
r4 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r4, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(r4, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x200, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6c8344f9f96ef2c7fe911c01908", 0x5c, 0x0, &(0x7f0000000040)={0x77359400})
add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0e9467edd7f398f", 0x1c, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, 0x0, &(0x7f00000006c0)=[{&(0x7f0000000400)}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0], 0x1})
r5 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(0xffffffffffffffff, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000080)={0x0, 0x0, &(0x7f000000dff8), 0x0, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r5}], 0x1, 0x0)

2018/03/29 19:07:51 executing program 2:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x70, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @release={0x40046306, 0x1}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r1 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
r2 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r2, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
r3 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r3, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(r3, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x200, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500d", 0x2f, 0x0, &(0x7f0000000040)={0x77359400})
r4 = add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0e9467edd7f398f", 0x1c, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, r4, &(0x7f00000006c0)=[{&(0x7f0000000400)="f916b8f72c29a4ed654ec4634d479b3453a0dbdd444019513f1d25ccda2381b9d22363dbeef5a27f13994695211b14422a35c08f7510fa", 0x37}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r5 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(r0, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x32b, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r5}], 0x1, 0x0)

2018/03/29 19:07:51 executing program 0:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
r1 = mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(0xffffffffffffffff)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x7c, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @increfs_done={0x40106308, r1, 0x3}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r2 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r3, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
keyctl$assume_authority(0x10, 0x0)
r4 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r4, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(0xffffffffffffffff, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x0, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6c8344f9f96ef2c7fe911c01908", 0x5c, 0x0, &(0x7f0000000040)={0x77359400})
r5 = add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0e9467edd", 0x19, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, r5, &(0x7f00000006c0)=[{&(0x7f0000000400)}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r6 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(r0, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x32b, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r6}], 0x1, 0x0)

2018/03/29 19:07:51 executing program 5:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
r1 = mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x7c, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @increfs_done={0x40106308, r1, 0x3}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r2 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r3, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
keyctl$assume_authority(0x10, 0x0)
r4 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r4, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(r4, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x200, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6", 0x4f, 0x0, &(0x7f0000000040)={0x77359400})
r5 = add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0e9467edd7f398f", 0x1c, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, r5, &(0x7f00000006c0)=[{&(0x7f0000000400)}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r6 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(0xffffffffffffffff, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000080)={0x0, 0x0, &(0x7f000000dff8), 0x0, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r6}], 0x1, 0x0)

[ 1529.525137] binder: BINDER_SET_CONTEXT_MGR already set
[ 1529.525143] binder: 17493:17507 ioctl 40046207 0 returned -16
[ 1529.536673] binder: 17494:17503 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1529.538622] binder: 17492:17505 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
2018/03/29 19:07:51 executing program 6:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
r1 = mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x7c, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @increfs_done={0x40106308, r1, 0x3}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r2 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r3, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
keyctl$assume_authority(0x10, 0x0)
r4 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r4, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(r4, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x200, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6c8344f9f96ef2c7fe911c01908", 0x5c, 0x0, &(0x7f0000000040)={0x77359400})
add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0e9467edd7f398f", 0x1c, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, 0x0, &(0x7f00000006c0)=[{&(0x7f0000000400)}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0], 0x1})
r5 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(0xffffffffffffffff, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000080)={0x0, 0x0, &(0x7f000000dff8), 0x0, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r5}], 0x1, 0x0)

2018/03/29 19:07:51 executing program 5:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
r1 = mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x7c, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @increfs_done={0x40106308, r1, 0x3}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r2 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r3, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
keyctl$assume_authority(0x10, 0x0)
r4 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r4, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(r4, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x200, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6", 0x4f, 0x0, &(0x7f0000000040)={0x77359400})
r5 = add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0e9467edd7f398f", 0x1c, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, r5, &(0x7f00000006c0)=[{&(0x7f0000000400)}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r6 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(0xffffffffffffffff, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000080)={0x0, 0x0, &(0x7f000000dff8), 0x0, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r6}], 0x1, 0x0)

2018/03/29 19:07:51 executing program 0:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
r1 = mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(0xffffffffffffffff)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x7c, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @increfs_done={0x40106308, r1, 0x3}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r2 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r3, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
keyctl$assume_authority(0x10, 0x0)
r4 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r4, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(0xffffffffffffffff, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x0, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6c8344f9f96ef2c7fe911c01908", 0x5c, 0x0, &(0x7f0000000040)={0x77359400})
r5 = add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0e9467edd", 0x19, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, r5, &(0x7f00000006c0)=[{&(0x7f0000000400)}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r6 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(r0, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x32b, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r6}], 0x1, 0x0)

2018/03/29 19:07:51 executing program 2:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x70, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @release={0x40046306, 0x1}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r1 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
r2 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r2, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
r3 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r3, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(r3, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x200, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500d", 0x2f, 0x0, &(0x7f0000000040)={0x77359400})
r4 = add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0e9467edd7f398f", 0x1c, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, r4, &(0x7f00000006c0)=[{&(0x7f0000000400)="f916b8f72c29a4ed654ec4634d479b3453a0dbdd444019513f1d25ccda2381b9d22363dbeef5a27f13994695211b14422a35c08f7510fa", 0x37}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r5 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(r0, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x32b, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r5}], 0x1, 0x0)

[ 1529.571481] binder: BINDER_SET_CONTEXT_MGR already set
[ 1529.571488] binder: 17512:17513 ioctl 40046207 0 returned -16
[ 1529.584659] binder: 17512:17513 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1529.593844] binder: BINDER_SET_CONTEXT_MGR already set
[ 1529.593851] binder: 17514:17515 ioctl 40046207 0 returned -16
[ 1529.630644] binder: BINDER_SET_CONTEXT_MGR already set
2018/03/29 19:07:51 executing program 6:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
r1 = mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x7c, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @increfs_done={0x40106308, r1, 0x3}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r2 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r3, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
keyctl$assume_authority(0x10, 0x0)
r4 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r4, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(r4, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x200, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6c8344f9f96ef2c7fe911c01908", 0x5c, 0x0, &(0x7f0000000040)={0x77359400})
add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0e9467edd7f398f", 0x1c, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, 0x0, &(0x7f00000006c0)=[{&(0x7f0000000400)}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0], 0x1})
r5 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(0xffffffffffffffff, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000080)={0x0, 0x0, &(0x7f000000dff8), 0x0, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r5}], 0x1, 0x0)

[ 1529.630652] binder: 17517:17519 ioctl 40046207 0 returned -16
[ 1529.634414] binder: 17517:17519 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1529.644953] binder: BINDER_SET_CONTEXT_MGR already set
[ 1529.644961] binder: 17520:17521 ioctl 40046207 0 returned -16
[ 1529.654591] binder: BINDER_SET_CONTEXT_MGR already set
[ 1529.654597] binder: 17522:17523 ioctl 40046207 0 returned -16
2018/03/29 19:07:51 executing program 5:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
r1 = mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x7c, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @increfs_done={0x40106308, r1, 0x3}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r2 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r3, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
keyctl$assume_authority(0x10, 0x0)
r4 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r4, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(r4, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x200, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6", 0x4f, 0x0, &(0x7f0000000040)={0x77359400})
r5 = add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0e9467edd7f398f", 0x1c, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, r5, &(0x7f00000006c0)=[{&(0x7f0000000400)}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r6 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(0xffffffffffffffff, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000080)={0x0, 0x0, &(0x7f000000dff8), 0x0, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r6}], 0x1, 0x0)

[ 1529.655472] binder: 17520:17521 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1529.658105] binder: 17522:17523 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1529.677721] binder: BINDER_SET_CONTEXT_MGR already set
[ 1529.677728] binder: 17524:17525 ioctl 40046207 0 returned -16
[ 1529.695472] binder: BINDER_SET_CONTEXT_MGR already set
[ 1529.695480] binder: 17527:17529 ioctl 40046207 0 returned -16
[ 1529.706219] binder: 17527:17529 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1529.727331] binder: BINDER_SET_CONTEXT_MGR already set
[ 1529.727339] binder: 17530:17532 ioctl 40046207 0 returned -16
[ 1529.729910] binder: BINDER_SET_CONTEXT_MGR already set
[ 1529.729917] binder: 17531:17533 ioctl 40046207 0 returned -16
[ 1529.730429] binder: 17530:17532 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1529.734743] binder: 17531:17533 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1529.746460] binder: BINDER_SET_CONTEXT_MGR already set
[ 1529.746467] binder: 17534:17535 ioctl 40046207 0 returned -16
[ 1530.030561] binder: BINDER_SET_CONTEXT_MGR already set
[ 1530.030569] binder: 17537:17543 ioctl 40046207 0 returned -16
[ 1530.031572] binder: BINDER_SET_CONTEXT_MGR already set
[ 1530.031579] binder: 17539:17545 ioctl 40046207 0 returned -16
[ 1530.037529] binder: 17539:17545 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1530.041095] binder: BINDER_SET_CONTEXT_MGR already set
[ 1530.041103] binder: 17538:17546 ioctl 40046207 0 returned -16
2018/03/29 19:07:51 executing program 0:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
r1 = mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x6c, 0x0, &(0x7f0000000140)=[@increfs_done={0x40106308, r1, 0x3}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r2 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r3, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
keyctl$assume_authority(0x10, 0x0)
r4 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r4, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(0xffffffffffffffff, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x0, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6c8344f9f96ef2c7fe911c01908", 0x5c, 0x0, &(0x7f0000000040)={0x77359400})
r5 = add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0e9467edd", 0x19, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, r5, &(0x7f00000006c0)=[{&(0x7f0000000400)}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r6 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(r0, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x32b, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r6}], 0x1, 0x0)

2018/03/29 19:07:51 executing program 2:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x70, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @release={0x40046306, 0x1}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r1 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
r2 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r2, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
r3 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r3, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(r3, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x200, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500d", 0x2f, 0x0, &(0x7f0000000040)={0x77359400})
r4 = add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0e9467edd7f398f", 0x1c, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, r4, &(0x7f00000006c0)=[{&(0x7f0000000400)="f916b8f72c29a4ed654ec4634d479b3453a0dbdd444019513f1d25ccda2381b9d22363dbeef5a27f13994695211b14422a35c08f7510fa", 0x37}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r5 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(r0, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x32b, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r5}], 0x1, 0x0)

2018/03/29 19:07:51 executing program 6:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
r1 = mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x7c, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @increfs_done={0x40106308, r1, 0x3}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r2 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r3, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
keyctl$assume_authority(0x10, 0x0)
r4 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r4, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(r4, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x200, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6c8344f9f96ef2c7fe911c01908", 0x5c, 0x0, &(0x7f0000000040)={0x77359400})
add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0e9467edd7f398f", 0x1c, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, 0x0, &(0x7f00000006c0)=[{&(0x7f0000000400)}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0], 0x1})
r5 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(0xffffffffffffffff, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000080)={0x0, 0x0, &(0x7f000000dff8), 0x0, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r5}], 0x1, 0x0)

2018/03/29 19:07:51 executing program 4:
add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={0x73, 0x79, 0x7a}, &(0x7f0000001100)="a1", 0x1, 0xfffffffffffffffb)
perf_event_open(&(0x7f000025c000)={0x2, 0x78}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
pipe2(&(0x7f0000000180), 0x0)
socket(0x18, 0x0, 0x1)
sendmmsg(0xffffffffffffffff, &(0x7f0000000200)=[{{&(0x7f0000003000)=@rc={0x1f}, 0x80, &(0x7f0000004fa0), 0x0, &(0x7f0000002d30)}}], 0x1, 0x0)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f00000000c0)={"d202b999cf85000000000088f301e710"})
r0 = syz_open_dev$tun(&(0x7f0000000280)='/dev/net/tun\x00', 0x0, 0x400200)
r1 = socket(0x11, 0x100000802, 0x0)
r2 = syz_open_dev$tun(&(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000000c0)={'ifb0\x00', 0x1001})
ioctl$TUNSETLINK(r2, 0x400454cd, 0x308)
ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000040)={'ifb0\x00'})
r3 = dup2(r0, 0xffffffffffffffff)
ioctl$TUNSETQUEUE(0xffffffffffffffff, 0x400454d9, &(0x7f0000000000)={'vlan0\x00'})
write$cgroup_subtree(r3, &(0x7f00000001c0)={[{0x2d, 'pids', 0x20}, {0x0, 'cpu', 0x20}, {0x2d, 'pids', 0x20}, {0x2b, 'rdma', 0x20}, {0x0, 'pids', 0x20}, {0x0, 'io', 0x20}]}, 0x21)
connect$unix(0xffffffffffffffff, &(0x7f0000000100)=@abs, 0x6e)
ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82)

2018/03/29 19:07:51 executing program 5:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
r1 = mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x7c, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @increfs_done={0x40106308, r1, 0x3}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r2 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r3, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
keyctl$assume_authority(0x10, 0x0)
r4 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r4, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(r4, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x200, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6c8", 0x50, 0x0, &(0x7f0000000040)={0x77359400})
r5 = add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0e9467edd7f398f", 0x1c, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, r5, &(0x7f00000006c0)=[{&(0x7f0000000400)}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r6 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(0xffffffffffffffff, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000080)={0x0, 0x0, &(0x7f000000dff8), 0x0, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r6}], 0x1, 0x0)

2018/03/29 19:07:51 executing program 7:
add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={0x73, 0x79, 0x7a}, &(0x7f0000001100)="a1", 0x1, 0xfffffffffffffffb)
sendmmsg(0xffffffffffffffff, &(0x7f0000000200)=[{{&(0x7f0000003000)=@rc={0x1f}, 0x80, &(0x7f0000004fa0), 0x0, &(0x7f0000002d30)}}], 0x1, 0x0)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f00000000c0)={"d202b999cf85000000000088f301e710"})
r0 = syz_open_dev$tun(&(0x7f0000000280)='/dev/net/tun\x00', 0x0, 0x400200)
r1 = socket(0x11, 0x100000802, 0x0)
r2 = syz_open_dev$tun(&(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000000c0)={'ifb0\x00', 0x1001})
ioctl$TUNSETLINK(r2, 0x400454cd, 0x308)
ioctl$sock_inet_SIOCSIFFLAGS(0xffffffffffffffff, 0x8914, &(0x7f0000000040)={'ifb0\x00', 0xa201})
r3 = dup2(r0, 0xffffffffffffffff)
ioctl$TUNSETQUEUE(0xffffffffffffffff, 0x400454d9, &(0x7f0000000000)={'vlan0\x00'})
write$cgroup_subtree(r3, &(0x7f00000001c0)={[{0x0, 'cpu', 0x20}, {0x0, 'pids', 0x20}, {0x0, 'cpu', 0x20}, {0x2d, 'pids', 0x20}, {0x2b, 'pids', 0x20}, {0x0, 'memory', 0x20}]}, 0x24)
connect$unix(r1, &(0x7f0000000100)=@abs, 0x6e)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)

2018/03/29 19:07:51 executing program 3:
add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={0x73, 0x79, 0x7a}, &(0x7f0000001100)="a1", 0x1, 0xfffffffffffffffb)
perf_event_open(&(0x7f000025c000)={0x2, 0x78}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sendmmsg(0xffffffffffffffff, &(0x7f0000000200), 0x0, 0x0)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f00000000c0)={"d202b999cf85000000000088f301e710"})
r0 = syz_open_dev$tun(&(0x7f0000000280)='/dev/net/tun\x00', 0x0, 0x400200)
r1 = socket(0x11, 0x100000802, 0x0)
r2 = syz_open_dev$tun(&(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000000c0)={'ifb0\x00', 0x1001})
ioctl$TUNSETLINK(r2, 0x400454cd, 0x308)
ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000040)={'ifb0\x00', 0xa201})
r3 = dup2(0xffffffffffffffff, 0xffffffffffffffff)
ioctl$TUNSETQUEUE(0xffffffffffffffff, 0x400454d9, &(0x7f0000000000)={'vlan0\x00'})
write$cgroup_subtree(r3, &(0x7f00000001c0)={[{0x0, 'cpu', 0x20}, {0x0, 'pids', 0x20}, {0x0, 'cpu', 0x20}, {0x2d, 'pids', 0x20}, {0x2b, 'rdma', 0x20}, {0x2b, 'pids', 0x20}, {0x0, 'memory', 0x20}]}, 0x2a)
connect$unix(0xffffffffffffffff, &(0x7f0000000100)=@abs, 0x6e)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)

2018/03/29 19:07:51 executing program 1:
add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={0x73, 0x79, 0x7a}, &(0x7f0000001100)="a1", 0x1, 0xfffffffffffffffb)
perf_event_open(&(0x7f000025c000)={0x0, 0x78}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sendmmsg(0xffffffffffffffff, &(0x7f0000000200)=[{{&(0x7f0000003000)=@rc={0x1f}, 0x80, &(0x7f0000004fa0), 0x0, &(0x7f0000002d30)}}], 0x1, 0x0)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f00000000c0)={"d202b999cf85000000000088f301e710"})
r0 = syz_open_dev$tun(&(0x7f0000000280)='/dev/net/tun\x00', 0x0, 0x400200)
r1 = socket(0x11, 0x100000802, 0x0)
r2 = syz_open_dev$tun(&(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000000c0)={'ifb0\x00', 0x1001})
ioctl$TUNSETLINK(r2, 0x400454cd, 0x308)
ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000040)={'ifb0\x00', 0xa201})
r3 = dup2(r0, 0xffffffffffffffff)
ioctl$TUNSETQUEUE(0xffffffffffffffff, 0x400454d9, &(0x7f0000000000)={'vlan0\x00'})
write$cgroup_subtree(r3, &(0x7f00000001c0)={[{0x0, 'pids', 0x20}, {0x0, 'cpu', 0x20}, {0x2d, 'pids', 0x20}, {0x2b, 'pids', 0x20}, {0x0, 'memory', 0x20}]}, 0x1f)
connect$unix(r1, &(0x7f0000000100)=@abs, 0x6e)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)

[ 1530.046621] binder: BINDER_SET_CONTEXT_MGR already set
[ 1530.046628] binder: 17536:17548 ioctl 40046207 0 returned -16
[ 1530.061208] binder: 17536:17548 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1530.083437] binder: BINDER_SET_CONTEXT_MGR already set
[ 1530.083444] binder: 17556:17558 ioctl 40046207 0 returned -16
[ 1530.086863] binder: 17556:17558 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1530.094681] binder: BINDER_SET_CONTEXT_MGR already set
[ 1530.094688] binder: 17552:17557 ioctl 40046207 0 returned -16
[ 1530.097348] binder: 17552:17557 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1530.121146] binder: BINDER_SET_CONTEXT_MGR already set
[ 1530.121154] binder: 17559:17562 ioctl 40046207 0 returned -16
2018/03/29 19:07:51 executing program 0:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
r1 = mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x6c, 0x0, &(0x7f0000000140)=[@increfs_done={0x40106308, r1, 0x3}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r2 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r3, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
keyctl$assume_authority(0x10, 0x0)
r4 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r4, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(0xffffffffffffffff, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x0, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6c8344f9f96ef2c7fe911c01908", 0x5c, 0x0, &(0x7f0000000040)={0x77359400})
r5 = add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0e9467edd", 0x19, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, r5, &(0x7f00000006c0)=[{&(0x7f0000000400)}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r6 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(r0, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x32b, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r6}], 0x1, 0x0)

2018/03/29 19:07:51 executing program 6:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
r1 = mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x7c, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @increfs_done={0x40106308, r1, 0x3}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r2 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r3, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
keyctl$assume_authority(0x10, 0x0)
r4 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r4, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(r4, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x200, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6c8344f9f96ef2c7fe911c01908", 0x5c, 0x0, &(0x7f0000000040)={0x77359400})
add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0e9467edd7f398f", 0x1c, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, 0x0, &(0x7f00000006c0)=[{&(0x7f0000000400)}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0], 0x1})
r5 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(0xffffffffffffffff, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000080)={0x0, 0x0, &(0x7f000000dff8), 0x0, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r5}], 0x1, 0x0)

2018/03/29 19:07:51 executing program 2:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x70, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @release={0x40046306, 0x1}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r1 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
r2 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r2, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
r3 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r3, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(r3, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x200, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24", 0x46, 0x0, &(0x7f0000000040)={0x77359400})
r4 = add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0e9467edd7f398f", 0x1c, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, r4, &(0x7f00000006c0)=[{&(0x7f0000000400)="f916b8f72c29a4ed654ec4634d479b3453a0dbdd444019513f1d25ccda2381b9d22363dbeef5a27f13994695211b14422a35c08f7510fa", 0x37}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r5 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(r0, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x32b, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r5}], 0x1, 0x0)

[ 1530.125533] binder: BINDER_SET_CONTEXT_MGR already set
[ 1530.125540] binder: 17560:17563 ioctl 40046207 0 returned -16
[ 1530.139787] binder: BINDER_SET_CONTEXT_MGR already set
[ 1530.139795] binder: 17561:17564 ioctl 40046207 0 returned -16
[ 1530.146402] binder: 17561:17564 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1530.150337] binder: BINDER_SET_CONTEXT_MGR already set
[ 1530.150344] binder: 17566:17568 ioctl 40046207 0 returned -16
2018/03/29 19:07:51 executing program 5:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
r1 = mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x7c, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @increfs_done={0x40106308, r1, 0x3}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r2 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r3, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
keyctl$assume_authority(0x10, 0x0)
r4 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r4, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(r4, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x200, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6c8", 0x50, 0x0, &(0x7f0000000040)={0x77359400})
r5 = add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0e9467edd7f398f", 0x1c, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, r5, &(0x7f00000006c0)=[{&(0x7f0000000400)}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r6 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(0xffffffffffffffff, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000080)={0x0, 0x0, &(0x7f000000dff8), 0x0, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r6}], 0x1, 0x0)

[ 1530.153743] binder: 17566:17568 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1530.174646] binder: BINDER_SET_CONTEXT_MGR already set
[ 1530.174654] binder: 17569:17571 ioctl 40046207 0 returned -16
[ 1530.179548] binder: 17569:17571 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1530.424678] binder: BINDER_SET_CONTEXT_MGR already set
[ 1530.424686] binder: 17573:17575 ioctl 40046207 0 returned -16
2018/03/29 19:07:51 executing program 0:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
r1 = mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x6c, 0x0, &(0x7f0000000140)=[@increfs_done={0x40106308, r1, 0x3}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r2 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r3, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
keyctl$assume_authority(0x10, 0x0)
r4 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r4, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(0xffffffffffffffff, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x0, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6c8344f9f96ef2c7fe911c01908", 0x5c, 0x0, &(0x7f0000000040)={0x77359400})
r5 = add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0e9467edd", 0x19, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, r5, &(0x7f00000006c0)=[{&(0x7f0000000400)}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r6 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(r0, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x32b, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r6}], 0x1, 0x0)

2018/03/29 19:07:51 executing program 5:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
r1 = mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x7c, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @increfs_done={0x40106308, r1, 0x3}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r2 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r3, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
keyctl$assume_authority(0x10, 0x0)
r4 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r4, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(r4, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x200, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6c8", 0x50, 0x0, &(0x7f0000000040)={0x77359400})
r5 = add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0e9467edd7f398f", 0x1c, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, r5, &(0x7f00000006c0)=[{&(0x7f0000000400)}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r6 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(0xffffffffffffffff, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000080)={0x0, 0x0, &(0x7f000000dff8), 0x0, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r6}], 0x1, 0x0)

2018/03/29 19:07:51 executing program 2:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x70, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @release={0x40046306, 0x1}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r1 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
r2 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r2, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
r3 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r3, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(r3, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x200, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24", 0x46, 0x0, &(0x7f0000000040)={0x77359400})
r4 = add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0e9467edd7f398f", 0x1c, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, r4, &(0x7f00000006c0)=[{&(0x7f0000000400)="f916b8f72c29a4ed654ec4634d479b3453a0dbdd444019513f1d25ccda2381b9d22363dbeef5a27f13994695211b14422a35c08f7510fa", 0x37}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r5 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(r0, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x32b, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r5}], 0x1, 0x0)

2018/03/29 19:07:51 executing program 6:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
r1 = mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x7c, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @increfs_done={0x40106308, r1, 0x3}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r2 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r3, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
keyctl$assume_authority(0x10, 0x0)
r4 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r4, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(r4, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x200, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6c8344f9f96ef2c7fe911c01908", 0x5c, 0x0, &(0x7f0000000040)={0x77359400})
add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0e9467edd7f398f", 0x1c, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, 0x0, &(0x7f00000006c0)=[{&(0x7f0000000400)}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r5 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(0xffffffffffffffff, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(0xffffffffffffffff, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000080)={0x0, 0x0, &(0x7f000000dff8), 0x0, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r5}], 0x1, 0x0)

[ 1530.434182] binder: BINDER_SET_CONTEXT_MGR already set
[ 1530.434188] binder: 17576:17577 ioctl 40046207 0 returned -16
[ 1530.438384] binder: BINDER_SET_CONTEXT_MGR already set
[ 1530.438391] binder: 17572:17583 ioctl 40046207 0 returned -16
[ 1530.440746] binder: BINDER_SET_CONTEXT_MGR already set
[ 1530.440753] binder: 17574:17582 ioctl 40046207 0 returned -16
[ 1530.443124] binder: 17576:17577 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
2018/03/29 19:07:51 executing program 2:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x70, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @release={0x40046306, 0x1}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r1 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
r2 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r2, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
r3 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r3, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(r3, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x200, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24", 0x46, 0x0, &(0x7f0000000040)={0x77359400})
r4 = add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0e9467edd7f398f", 0x1c, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, r4, &(0x7f00000006c0)=[{&(0x7f0000000400)="f916b8f72c29a4ed654ec4634d479b3453a0dbdd444019513f1d25ccda2381b9d22363dbeef5a27f13994695211b14422a35c08f7510fa", 0x37}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r5 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(r0, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x32b, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r5}], 0x1, 0x0)

2018/03/29 19:07:51 executing program 6:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
r1 = mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x7c, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @increfs_done={0x40106308, r1, 0x3}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r2 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r3, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
keyctl$assume_authority(0x10, 0x0)
r4 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r4, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(r4, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x200, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6c8344f9f96ef2c7fe911c01908", 0x5c, 0x0, &(0x7f0000000040)={0x77359400})
add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0e9467edd7f398f", 0x1c, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, 0x0, &(0x7f00000006c0)=[{&(0x7f0000000400)}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r5 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(0xffffffffffffffff, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(0xffffffffffffffff, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000080)={0x0, 0x0, &(0x7f000000dff8), 0x0, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r5}], 0x1, 0x0)

2018/03/29 19:07:51 executing program 5:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
r1 = mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x7c, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @increfs_done={0x40106308, r1, 0x3}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r2 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r3, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
keyctl$assume_authority(0x10, 0x0)
r4 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r4, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(r4, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x200, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6c834", 0x51, 0x0, &(0x7f0000000040)={0x77359400})
r5 = add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0), 0x0, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, r5, &(0x7f00000006c0)=[{&(0x7f0000000400)}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r6 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(0xffffffffffffffff, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000080)={0x0, 0x0, &(0x7f000000dff8), 0x0, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r6}], 0x1, 0x0)

[ 1530.454673] binder: 17574:17582 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1530.521826] binder: BINDER_SET_CONTEXT_MGR already set
[ 1530.521835] binder: 17591:17595 ioctl 40046207 0 returned -16
[ 1530.533364] binder: BINDER_SET_CONTEXT_MGR already set
[ 1530.533373] binder: 17592:17596 ioctl 40046207 0 returned -16
[ 1530.536396] binder: BINDER_SET_CONTEXT_MGR already set
[ 1530.536403] binder: 17593:17597 ioctl 40046207 0 returned -16
[ 1530.541632] binder: BINDER_SET_CONTEXT_MGR already set
[ 1530.541640] binder: 17594:17598 ioctl 40046207 0 returned -16
[ 1530.546004] binder: 17592:17596 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1530.549953] binder: 17594:17598 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1530.603068] binder: BINDER_SET_CONTEXT_MGR already set
[ 1530.603076] binder: 17603:17604 ioctl 40046207 0 returned -16
[ 1530.630928] binder: BINDER_SET_CONTEXT_MGR already set
[ 1530.630935] binder: 17605:17608 ioctl 40046207 0 returned -16
[ 1530.633476] binder: 17605:17608 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1530.637057] binder: BINDER_SET_CONTEXT_MGR already set
[ 1530.637063] binder: 17606:17607 ioctl 40046207 0 returned -16
[ 1530.640742] binder: 17606:17607 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1530.904613] binder: BINDER_SET_CONTEXT_MGR already set
2018/03/29 19:07:51 executing program 0:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x68, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r1 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
r2 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r2, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
keyctl$assume_authority(0x10, 0x0)
r3 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r3, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(0xffffffffffffffff, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x0, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6c8344f9f96ef2c7fe911c01908", 0x5c, 0x0, &(0x7f0000000040)={0x77359400})
r4 = add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0e9467edd", 0x19, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, r4, &(0x7f00000006c0)=[{&(0x7f0000000400)}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r5 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(r0, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x32b, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r5}], 0x1, 0x0)

2018/03/29 19:07:51 executing program 2:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x70, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @release={0x40046306, 0x1}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r1 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
r2 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r2, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
r3 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r3, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(r3, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x200, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6c8344f", 0x52, 0x0, &(0x7f0000000040)={0x77359400})
r4 = add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0e9467edd7f398f", 0x1c, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, r4, &(0x7f00000006c0)=[{&(0x7f0000000400)="f916b8f72c29a4ed654ec4634d479b3453a0dbdd444019513f1d25ccda2381b9d22363dbeef5a27f13994695211b14422a35c08f7510fa", 0x37}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r5 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(r0, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x32b, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r5}], 0x1, 0x0)

2018/03/29 19:07:51 executing program 6:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
r1 = mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x7c, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @increfs_done={0x40106308, r1, 0x3}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r2 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r3, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
keyctl$assume_authority(0x10, 0x0)
r4 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r4, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(r4, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x200, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6c8344f9f96ef2c7fe911c01908", 0x5c, 0x0, &(0x7f0000000040)={0x77359400})
add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0e9467edd7f398f", 0x1c, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, 0x0, &(0x7f00000006c0)=[{&(0x7f0000000400)}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r5 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(0xffffffffffffffff, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(0xffffffffffffffff, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000080)={0x0, 0x0, &(0x7f000000dff8), 0x0, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r5}], 0x1, 0x0)

2018/03/29 19:07:51 executing program 5:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
r1 = mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x7c, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @increfs_done={0x40106308, r1, 0x3}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r2 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r3, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
keyctl$assume_authority(0x10, 0x0)
r4 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r4, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(r4, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x200, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6c834", 0x51, 0x0, &(0x7f0000000040)={0x77359400})
r5 = add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0), 0x0, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, r5, &(0x7f00000006c0)=[{&(0x7f0000000400)}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r6 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(0xffffffffffffffff, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000080)={0x0, 0x0, &(0x7f000000dff8), 0x0, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r6}], 0x1, 0x0)

2018/03/29 19:07:51 executing program 4:
add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={0x73, 0x79, 0x7a}, &(0x7f0000001100)="a1", 0x1, 0xfffffffffffffffb)
perf_event_open(&(0x7f000025c000)={0x2, 0x78}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
pipe2(&(0x7f0000000180), 0x0)
socket(0x18, 0x0, 0x1)
sendmmsg(0xffffffffffffffff, &(0x7f0000000200)=[{{&(0x7f0000003000)=@rc={0x1f}, 0x80, &(0x7f0000004fa0), 0x0, &(0x7f0000002d30)}}], 0x1, 0x0)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f00000000c0)={"d202b999cf85000000000088f301e710"})
r0 = syz_open_dev$tun(&(0x7f0000000280)='/dev/net/tun\x00', 0x0, 0x400200)
r1 = socket(0x11, 0x100000802, 0x0)
r2 = syz_open_dev$tun(&(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000000c0)={'ifb0\x00', 0x1001})
ioctl$TUNSETLINK(r2, 0x400454cd, 0x308)
ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000040)={'ifb0\x00'})
r3 = dup2(r0, 0xffffffffffffffff)
ioctl$TUNSETQUEUE(0xffffffffffffffff, 0x400454d9, &(0x7f0000000000)={'vlan0\x00'})
write$cgroup_subtree(r3, &(0x7f00000001c0)={[{0x2d, 'pids', 0x20}, {0x0, 'cpu', 0x20}, {0x2d, 'pids', 0x20}, {0x2b, 'rdma', 0x20}, {0x0, 'pids', 0x20}, {0x0, 'io', 0x20}]}, 0x21)
connect$unix(0xffffffffffffffff, &(0x7f0000000100)=@abs, 0x6e)
ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82)

2018/03/29 19:07:51 executing program 7:
add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={0x73, 0x79, 0x7a}, &(0x7f0000001100)="a1", 0x1, 0xfffffffffffffffb)
sendmmsg(0xffffffffffffffff, &(0x7f0000000200)=[{{&(0x7f0000003000)=@rc={0x1f}, 0x80, &(0x7f0000004fa0), 0x0, &(0x7f0000002d30)}}], 0x1, 0x0)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f00000000c0)={"d202b999cf85000000000088f301e710"})
r0 = syz_open_dev$tun(&(0x7f0000000280)='/dev/net/tun\x00', 0x0, 0x400200)
r1 = socket(0x11, 0x100000802, 0x0)
r2 = syz_open_dev$tun(&(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000000c0)={'ifb0\x00', 0x1001})
ioctl$TUNSETLINK(r2, 0x400454cd, 0x308)
ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000040)={'ifb0\x00'})
r3 = dup2(r0, 0xffffffffffffffff)
ioctl$TUNSETQUEUE(0xffffffffffffffff, 0x400454d9, &(0x7f0000000000)={'vlan0\x00'})
write$cgroup_subtree(r3, &(0x7f00000001c0)={[{0x0, 'cpu', 0x20}, {0x0, 'pids', 0x20}, {0x0, 'cpu', 0x20}, {0x2d, 'pids', 0x20}, {0x2b, 'pids', 0x20}, {0x0, 'memory', 0x20}]}, 0x24)
connect$unix(r1, &(0x7f0000000100)=@abs, 0x6e)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)

2018/03/29 19:07:51 executing program 3:
add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={0x73, 0x79, 0x7a}, &(0x7f0000001100)="a1", 0x1, 0xfffffffffffffffb)
perf_event_open(&(0x7f000025c000)={0x2, 0x78}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sendmmsg(0xffffffffffffffff, &(0x7f0000000200), 0x0, 0x0)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f00000000c0)={"d202b999cf85000000000088f301e710"})
r0 = syz_open_dev$tun(&(0x7f0000000280)='/dev/net/tun\x00', 0x0, 0x400200)
r1 = socket(0x11, 0x100000802, 0x0)
r2 = syz_open_dev$tun(&(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000000c0)={'ifb0\x00', 0x1001})
ioctl$TUNSETLINK(r2, 0x400454cd, 0x308)
ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000040)={'ifb0\x00', 0xa201})
r3 = dup2(0xffffffffffffffff, 0xffffffffffffffff)
ioctl$TUNSETQUEUE(0xffffffffffffffff, 0x400454d9, &(0x7f0000000000)={'vlan0\x00'})
write$cgroup_subtree(r3, &(0x7f00000001c0)={[{0x0, 'cpu', 0x20}, {0x0, 'pids', 0x20}, {0x0, 'cpu', 0x20}, {0x2d, 'pids', 0x20}, {0x2b, 'rdma', 0x20}, {0x2b, 'pids', 0x20}, {0x0, 'memory', 0x20}]}, 0x2a)
connect$unix(0xffffffffffffffff, &(0x7f0000000100)=@abs, 0x6e)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)

2018/03/29 19:07:51 executing program 1:
add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={0x73, 0x79, 0x7a}, &(0x7f0000001100)="a1", 0x1, 0xfffffffffffffffb)
perf_event_open(&(0x7f000025c000)={0x0, 0x78}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sendmmsg(0xffffffffffffffff, &(0x7f0000000200)=[{{&(0x7f0000003000)=@rc={0x1f}, 0x80, &(0x7f0000004fa0), 0x0, &(0x7f0000002d30)}}], 0x1, 0x0)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f00000000c0)={"d202b999cf85000000000088f301e710"})
r0 = syz_open_dev$tun(&(0x7f0000000280)='/dev/net/tun\x00', 0x0, 0x400200)
r1 = socket(0x11, 0x100000802, 0x0)
r2 = syz_open_dev$tun(&(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000000c0)={'ifb0\x00', 0x1001})
ioctl$TUNSETLINK(r2, 0x400454cd, 0x308)
ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000040)={'ifb0\x00', 0xa201})
r3 = dup2(r0, 0xffffffffffffffff)
ioctl$TUNSETQUEUE(0xffffffffffffffff, 0x400454d9, &(0x7f0000000000)={'vlan0\x00'})
write$cgroup_subtree(r3, &(0x7f00000001c0)={[{0x0, 'pids', 0x20}, {0x0, 'cpu', 0x20}, {0x2d, 'pids', 0x20}, {0x2b, 'pids', 0x20}, {0x0, 'memory', 0x20}]}, 0x1f)
connect$unix(r1, &(0x7f0000000100)=@abs, 0x6e)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)

[ 1530.904621] binder: 17613:17620 ioctl 40046207 0 returned -16
[ 1530.904699] binder: BINDER_SET_CONTEXT_MGR already set
[ 1530.904704] binder: 17611:17621 ioctl 40046207 0 returned -16
[ 1530.905716] binder: BINDER_SET_CONTEXT_MGR already set
[ 1530.905723] binder: 17609:17622 ioctl 40046207 0 returned -16
[ 1530.909163] binder: BINDER_SET_CONTEXT_MGR already set
[ 1530.909170] binder: 17615:17619 ioctl 40046207 0 returned -16
[ 1530.914972] binder: 17615:17619 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
2018/03/29 19:07:52 executing program 5:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
r1 = mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x7c, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @increfs_done={0x40106308, r1, 0x3}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r2 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r3, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
keyctl$assume_authority(0x10, 0x0)
r4 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r4, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(r4, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x200, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6c834", 0x51, 0x0, &(0x7f0000000040)={0x77359400})
r5 = add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0), 0x0, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, r5, &(0x7f00000006c0)=[{&(0x7f0000000400)}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r6 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(0xffffffffffffffff, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000080)={0x0, 0x0, &(0x7f000000dff8), 0x0, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r6}], 0x1, 0x0)

2018/03/29 19:07:52 executing program 6:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
r1 = mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x7c, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @increfs_done={0x40106308, r1, 0x3}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r2 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r3, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
keyctl$assume_authority(0x10, 0x0)
r4 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r4, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(r4, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x200, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6c8344f9f96ef2c7fe911c01908", 0x5c, 0x0, &(0x7f0000000040)={0x77359400})
add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0e9467edd7f398f", 0x1c, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, 0x0, &(0x7f00000006c0)=[{&(0x7f0000000400)}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r5 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(0xffffffffffffffff, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(0xffffffffffffffff, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000080)={0x0, 0x0, &(0x7f000000dff8), 0x0, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r5}], 0x1, 0x0)

2018/03/29 19:07:52 executing program 0:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x68, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r1 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
r2 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r2, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
keyctl$assume_authority(0x10, 0x0)
r3 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r3, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(0xffffffffffffffff, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x0, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6c8344f9f96ef2c7fe911c01908", 0x5c, 0x0, &(0x7f0000000040)={0x77359400})
r4 = add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0e9467edd", 0x19, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, r4, &(0x7f00000006c0)=[{&(0x7f0000000400)}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r5 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(r0, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x32b, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r5}], 0x1, 0x0)

2018/03/29 19:07:52 executing program 2:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x70, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @release={0x40046306, 0x1}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r1 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
r2 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r2, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
r3 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r3, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(r3, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x200, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6c8344f", 0x52, 0x0, &(0x7f0000000040)={0x77359400})
r4 = add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0e9467edd7f398f", 0x1c, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, r4, &(0x7f00000006c0)=[{&(0x7f0000000400)="f916b8f72c29a4ed654ec4634d479b3453a0dbdd444019513f1d25ccda2381b9d22363dbeef5a27f13994695211b14422a35c08f7510fa", 0x37}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r5 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(r0, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x32b, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r5}], 0x1, 0x0)

[ 1530.917552] binder: 17613:17620 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1530.965772] binder: BINDER_SET_CONTEXT_MGR already set
[ 1530.965779] binder: 17628:17629 ioctl 40046207 0 returned -16
[ 1530.989776] binder: BINDER_SET_CONTEXT_MGR already set
[ 1530.989784] binder: 17630:17633 ioctl 40046207 0 returned -16
[ 1530.995431] binder: 17628:17629 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1531.000969] binder: BINDER_SET_CONTEXT_MGR already set
[ 1531.000977] binder: 17631:17634 ioctl 40046207 0 returned -16
[ 1531.003906] binder: 17630:17633 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
2018/03/29 19:07:52 executing program 0:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x68, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r1 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
r2 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r2, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
keyctl$assume_authority(0x10, 0x0)
r3 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r3, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(0xffffffffffffffff, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x0, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6c8344f9f96ef2c7fe911c01908", 0x5c, 0x0, &(0x7f0000000040)={0x77359400})
r4 = add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0e9467edd", 0x19, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, r4, &(0x7f00000006c0)=[{&(0x7f0000000400)}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r5 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(r0, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x32b, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r5}], 0x1, 0x0)

[ 1531.004287] binder: BINDER_SET_CONTEXT_MGR already set
[ 1531.004294] binder: 17632:17636 ioctl 40046207 0 returned -16
[ 1531.046187] binder: BINDER_SET_CONTEXT_MGR already set
[ 1531.046194] binder: 17637:17638 ioctl 40046207 0 returned -16
[ 1531.064878] binder: 17637:17638 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1531.069110] binder: BINDER_SET_CONTEXT_MGR already set
[ 1531.069117] binder: 17639:17640 ioctl 40046207 0 returned -16
[ 1531.271621] binder: BINDER_SET_CONTEXT_MGR already set
[ 1531.271628] binder: 17643:17645 ioctl 40046207 0 returned -16
[ 1531.274783] binder: BINDER_SET_CONTEXT_MGR already set
[ 1531.274789] binder: 17646:17649 ioctl 40046207 0 returned -16
[ 1531.277251] binder: BINDER_SET_CONTEXT_MGR already set
[ 1531.277258] binder: 17641:17644 ioctl 40046207 0 returned -16
[ 1531.279339] binder: 17643:17645 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1531.292955] binder: 17642:17653 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1531.360296] binder: BINDER_SET_CONTEXT_MGR already set
[ 1531.360305] binder: 17659:17660 ioctl 40046207 0 returned -16
[ 1531.363612] binder: 17659:17660 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1531.370475] binder: BINDER_SET_CONTEXT_MGR already set
[ 1531.370482] binder: 17664:17666 ioctl 40046207 0 returned -16
[ 1531.371137] binder: BINDER_SET_CONTEXT_MGR already set
[ 1531.371143] binder: 17665:17667 ioctl 40046207 0 returned -16
[ 1531.375097] binder: 17661:17663 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1531.399314] binder: BINDER_SET_CONTEXT_MGR already set
[ 1531.399321] binder: 17670:17671 ioctl 40046207 0 returned -16
[ 1531.408646] binder: 17670:17671 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1531.465249] binder: BINDER_SET_CONTEXT_MGR already set
[ 1531.465257] binder: 17674:17675 ioctl 40046207 0 returned -16
[ 1531.468380] binder: 17673:17677 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1531.473561] binder: BINDER_SET_CONTEXT_MGR already set
[ 1531.473569] binder: 17676:17678 ioctl 40046207 0 returned -16
2018/03/29 19:07:52 executing program 2:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x70, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @release={0x40046306, 0x1}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r1 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
r2 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r2, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
r3 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r3, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(r3, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x200, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6c8344f", 0x52, 0x0, &(0x7f0000000040)={0x77359400})
r4 = add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0e9467edd7f398f", 0x1c, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, r4, &(0x7f00000006c0)=[{&(0x7f0000000400)="f916b8f72c29a4ed654ec4634d479b3453a0dbdd444019513f1d25ccda2381b9d22363dbeef5a27f13994695211b14422a35c08f7510fa", 0x37}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r5 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(r0, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x32b, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r5}], 0x1, 0x0)

2018/03/29 19:07:52 executing program 0:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
r1 = mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x7c, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r2 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r3, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
keyctl$assume_authority(0x10, 0x0)
r4 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r4, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(0xffffffffffffffff, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x0, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6c8344f9f96ef2c7fe911c01908", 0x5c, 0x0, &(0x7f0000000040)={0x77359400})
r5 = add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0e9467edd", 0x19, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, r5, &(0x7f00000006c0)=[{&(0x7f0000000400)}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r6 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(r0, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x32b, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r6}], 0x1, 0x0)

2018/03/29 19:07:52 executing program 6:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
r1 = mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x7c, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @increfs_done={0x40106308, r1, 0x3}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r2 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r3, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
keyctl$assume_authority(0x10, 0x0)
r4 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r4, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(r4, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x200, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6c8344f9f96ef2c7fe911c01908", 0x5c, 0x0, &(0x7f0000000040)={0x77359400})
add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0e9467edd7f398f", 0x1c, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, 0x0, &(0x7f00000006c0)=[{&(0x7f0000000400)}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r5 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(0xffffffffffffffff, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(0xffffffffffffffff, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000080)={0x0, 0x0, &(0x7f000000dff8), 0x0, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r5}], 0x1, 0x0)

2018/03/29 19:07:52 executing program 5:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
r1 = mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x7c, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @increfs_done={0x40106308, r1, 0x3}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r2 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r3, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
keyctl$assume_authority(0x10, 0x0)
r4 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r4, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(r4, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x200, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6c834", 0x51, 0x0, &(0x7f0000000040)={0x77359400})
r5 = add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180", 0xe, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, r5, &(0x7f00000006c0)=[{&(0x7f0000000400)}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r6 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(0xffffffffffffffff, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000080)={0x0, 0x0, &(0x7f000000dff8), 0x0, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r6}], 0x1, 0x0)

2018/03/29 19:07:52 executing program 1:
add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={0x73, 0x79, 0x7a}, &(0x7f0000001100)="a1", 0x1, 0xfffffffffffffffb)
perf_event_open(&(0x7f000025c000)={0x0, 0x78}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sendmmsg(0xffffffffffffffff, &(0x7f0000000200)=[{{&(0x7f0000003000)=@rc={0x1f}, 0x80, &(0x7f0000004fa0), 0x0, &(0x7f0000002d30)}}], 0x1, 0x0)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f00000000c0)={"d202b999cf85000000000088f301e710"})
r0 = syz_open_dev$tun(&(0x7f0000000280)='/dev/net/tun\x00', 0x0, 0x400200)
r1 = socket(0x11, 0x100000802, 0x0)
r2 = syz_open_dev$tun(&(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000000c0)={'ifb0\x00', 0x1001})
ioctl$TUNSETLINK(r2, 0x400454cd, 0x308)
ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000040)={'ifb0\x00', 0xa201})
r3 = dup2(r0, 0xffffffffffffffff)
ioctl$TUNSETQUEUE(0xffffffffffffffff, 0x400454d9, &(0x7f0000000000)={'vlan0\x00'})
write$cgroup_subtree(r3, &(0x7f00000001c0)={[{0x0, 'cpu', 0x20}, {0x0, 'cpu', 0x20}, {0x2d, 'pids', 0x20}, {0x2b, 'pids', 0x20}, {0x0, 'memory', 0x20}]}, 0x1e)
connect$unix(r1, &(0x7f0000000100)=@abs, 0x6e)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)

2018/03/29 19:07:52 executing program 7:
add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={0x73, 0x79, 0x7a}, &(0x7f0000001100)="a1", 0x1, 0xfffffffffffffffb)
sendmmsg(0xffffffffffffffff, &(0x7f0000000200)=[{{&(0x7f0000003000)=@rc={0x1f}, 0x80, &(0x7f0000004fa0), 0x0, &(0x7f0000002d30)}}], 0x1, 0x0)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f00000000c0)={"d202b999cf85000000000088f301e710"})
r0 = syz_open_dev$tun(&(0x7f0000000280)='/dev/net/tun\x00', 0x0, 0x400200)
r1 = socket(0x11, 0x100000802, 0x0)
r2 = syz_open_dev$tun(&(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000000c0)={'ifb0\x00', 0x1001})
ioctl$TUNSETLINK(r2, 0x400454cd, 0x308)
ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000040)={'ifb0\x00'})
r3 = dup2(r0, 0xffffffffffffffff)
ioctl$TUNSETQUEUE(0xffffffffffffffff, 0x400454d9, &(0x7f0000000000)={'vlan0\x00'})
write$cgroup_subtree(r3, &(0x7f00000001c0)={[{0x0, 'cpu', 0x20}, {0x0, 'pids', 0x20}, {0x0, 'cpu', 0x20}, {0x2d, 'pids', 0x20}, {0x2b, 'pids', 0x20}, {0x0, 'memory', 0x20}]}, 0x24)
connect$unix(r1, &(0x7f0000000100)=@abs, 0x6e)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)

2018/03/29 19:07:52 executing program 3:
add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={0x73, 0x79, 0x7a}, &(0x7f0000001100)="a1", 0x1, 0xfffffffffffffffb)
perf_event_open(&(0x7f000025c000)={0x2, 0x78}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sendmmsg(0xffffffffffffffff, &(0x7f0000000200), 0x0, 0x0)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f00000000c0)={"d202b999cf85000000000088f301e710"})
r0 = syz_open_dev$tun(&(0x7f0000000280)='/dev/net/tun\x00', 0x0, 0x400200)
r1 = socket(0x11, 0x100000802, 0x0)
r2 = syz_open_dev$tun(&(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000000c0)={'ifb0\x00', 0x1001})
ioctl$TUNSETLINK(r2, 0x400454cd, 0x308)
ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000040)={'ifb0\x00', 0xa201})
r3 = dup2(r0, 0xffffffffffffffff)
ioctl$TUNSETQUEUE(0xffffffffffffffff, 0x400454d9, &(0x7f0000000000)={'vlan0\x00'})
write$cgroup_subtree(0xffffffffffffffff, &(0x7f00000001c0)={[{0x0, 'cpu', 0x20}, {0x0, 'pids', 0x20}, {0x0, 'cpu', 0x20}, {0x2d, 'pids', 0x20}, {0x2b, 'rdma', 0x20}, {0x2b, 'pids', 0x20}, {0x0, 'memory', 0x20}]}, 0x2a)
connect$unix(0xffffffffffffffff, &(0x7f0000000100)=@abs, 0x6e)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)

2018/03/29 19:07:52 executing program 4:
add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={0x73, 0x79, 0x7a}, &(0x7f0000001100)="a1", 0x1, 0xfffffffffffffffb)
perf_event_open(&(0x7f000025c000)={0x2, 0x78}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
pipe2(&(0x7f0000000180), 0x0)
socket(0x18, 0x0, 0x1)
sendmmsg(0xffffffffffffffff, &(0x7f0000000200)=[{{&(0x7f0000003000)=@rc={0x1f}, 0x80, &(0x7f0000004fa0), 0x0, &(0x7f0000002d30)}}], 0x1, 0x0)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f00000000c0)={"d202b999cf85000000000088f301e710"})
r0 = syz_open_dev$tun(&(0x7f0000000280)='/dev/net/tun\x00', 0x0, 0x400200)
r1 = socket(0x11, 0x100000802, 0x0)
r2 = syz_open_dev$tun(&(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000000c0)={'ifb0\x00', 0x1001})
ioctl$TUNSETLINK(r2, 0x400454cd, 0x308)
ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000040)={'ifb0\x00', 0xa201})
r3 = dup2(0xffffffffffffffff, 0xffffffffffffffff)
ioctl$TUNSETQUEUE(0xffffffffffffffff, 0x400454d9, &(0x7f0000000000)={'vlan0\x00'})
write$cgroup_subtree(r3, &(0x7f00000001c0)={[{0x2d, 'pids', 0x20}, {0x0, 'cpu', 0x20}, {0x2d, 'pids', 0x20}, {0x2b, 'rdma', 0x20}, {0x0, 'pids', 0x20}, {0x0, 'io', 0x20}]}, 0x21)
connect$unix(0xffffffffffffffff, &(0x7f0000000100)=@abs, 0x6e)
ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82)

[ 1531.497788] binder: BINDER_SET_CONTEXT_MGR already set
[ 1531.497794] binder: 17679:17680 ioctl 40046207 0 returned -16
[ 1531.512548] binder: 17679:17680 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1531.679646] binder: BINDER_SET_CONTEXT_MGR already set
[ 1531.679656] binder: 17682:17686 ioctl 40046207 0 returned -16
[ 1531.684521] binder: BINDER_SET_CONTEXT_MGR already set
[ 1531.684528] binder: 17684:17687 ioctl 40046207 0 returned -16
[ 1531.684702] binder: BINDER_SET_CONTEXT_MGR already set
[ 1531.684708] binder: 17683:17691 ioctl 40046207 0 returned -16
[ 1531.687825] binder: 17682:17686 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1531.701285] binder: 17681:17692 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1531.764401] binder: BINDER_SET_CONTEXT_MGR already set
[ 1531.764408] binder: 17700:17704 ioctl 40046207 0 returned -16
[ 1531.781601] binder: BINDER_SET_CONTEXT_MGR already set
2018/03/29 19:07:52 executing program 6:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
r1 = mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x7c, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @increfs_done={0x40106308, r1, 0x3}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r2 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r3, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
keyctl$assume_authority(0x10, 0x0)
r4 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r4, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(r4, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x200, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6c8344f9f96ef2c7fe911c01908", 0x5c, 0x0, &(0x7f0000000040)={0x77359400})
add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0e9467edd7f398f", 0x1c, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, 0x0, &(0x7f00000006c0)=[{&(0x7f0000000400)}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r5 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(0xffffffffffffffff, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(0xffffffffffffffff, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000080)={0x0, 0x0, &(0x7f000000dff8), 0x0, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r5}], 0x1, 0x0)

2018/03/29 19:07:52 executing program 5:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
r1 = mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x7c, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @increfs_done={0x40106308, r1, 0x3}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r2 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r3, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
keyctl$assume_authority(0x10, 0x0)
r4 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r4, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(r4, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x200, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6c834", 0x51, 0x0, &(0x7f0000000040)={0x77359400})
r5 = add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180", 0xe, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, r5, &(0x7f00000006c0)=[{&(0x7f0000000400)}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r6 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(0xffffffffffffffff, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000080)={0x0, 0x0, &(0x7f000000dff8), 0x0, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r6}], 0x1, 0x0)

2018/03/29 19:07:52 executing program 2:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x70, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @release={0x40046306, 0x1}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r1 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
r2 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r2, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
r3 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r3, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(r3, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x200, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6c8344f9f96ef2c7fe9", 0x58, 0x0, &(0x7f0000000040)={0x77359400})
r4 = add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0e9467edd7f398f", 0x1c, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, r4, &(0x7f00000006c0)=[{&(0x7f0000000400)="f916b8f72c29a4ed654ec4634d479b3453a0dbdd444019513f1d25ccda2381b9d22363dbeef5a27f13994695211b14422a35c08f7510fa", 0x37}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r5 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(r0, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x32b, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r5}], 0x1, 0x0)

2018/03/29 19:07:52 executing program 0:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
r1 = mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x7c, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r2 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r3, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
keyctl$assume_authority(0x10, 0x0)
r4 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r4, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(0xffffffffffffffff, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x0, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6c8344f9f96ef2c7fe911c01908", 0x5c, 0x0, &(0x7f0000000040)={0x77359400})
r5 = add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0e9467edd", 0x19, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, r5, &(0x7f00000006c0)=[{&(0x7f0000000400)}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r6 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(r0, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x32b, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r6}], 0x1, 0x0)

[ 1531.781609] binder: 17706:17708 ioctl 40046207 0 returned -16
[ 1531.781973] binder: BINDER_SET_CONTEXT_MGR already set
[ 1531.782056] binder: 17705:17707 ioctl 40046207 0 returned -16
[ 1531.786964] binder: 17701:17703 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1531.790007] binder: 17705:17707 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
2018/03/29 19:07:52 executing program 6:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
r1 = mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x7c, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @increfs_done={0x40106308, r1, 0x3}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r2 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r3, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
keyctl$assume_authority(0x10, 0x0)
r4 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r4, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(r4, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x200, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6c8344f9f96ef2c7fe911c01908", 0x5c, 0x0, &(0x7f0000000040)={0x77359400})
add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0e9467edd7f398f", 0x1c, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, 0x0, &(0x7f00000006c0)=[{&(0x7f0000000400)}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r5 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00'})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(0xffffffffffffffff, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000080)={0x0, 0x0, &(0x7f000000dff8), 0x0, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r5}], 0x1, 0x0)

2018/03/29 19:07:52 executing program 0:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
r1 = mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x7c, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @increfs_done={0x40106308, 0x0, 0x3}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r2 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r3, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
keyctl$assume_authority(0x10, 0x0)
r4 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r4, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(0xffffffffffffffff, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x0, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6c8344f9f96ef2c7fe911c01908", 0x5c, 0x0, &(0x7f0000000040)={0x77359400})
r5 = add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0e9467edd", 0x19, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, r5, &(0x7f00000006c0)=[{&(0x7f0000000400)}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r6 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(r0, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x32b, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r6}], 0x1, 0x0)

2018/03/29 19:07:52 executing program 5:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
r1 = mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x7c, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @increfs_done={0x40106308, r1, 0x3}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r2 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r3, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
keyctl$assume_authority(0x10, 0x0)
r4 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r4, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(r4, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x200, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6c834", 0x51, 0x0, &(0x7f0000000040)={0x77359400})
r5 = add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180", 0xe, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, r5, &(0x7f00000006c0)=[{&(0x7f0000000400)}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r6 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(0xffffffffffffffff, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000080)={0x0, 0x0, &(0x7f000000dff8), 0x0, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r6}], 0x1, 0x0)

[ 1531.852671] binder: BINDER_SET_CONTEXT_MGR already set
[ 1531.852679] binder: 17709:17715 ioctl 40046207 0 returned -16
[ 1531.852915] binder: BINDER_SET_CONTEXT_MGR already set
[ 1531.852921] binder: 17711:17713 ioctl 40046207 0 returned -16
[ 1531.860895] binder: BINDER_SET_CONTEXT_MGR already set
[ 1531.860903] binder: 17712:17716 ioctl 40046207 0 returned -16
[ 1531.862672] binder: 17710:17714 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
2018/03/29 19:07:52 executing program 2:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x70, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @release={0x40046306, 0x1}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r1 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
r2 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r2, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
r3 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r3, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(r3, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x200, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6c8344f9f96ef2c7fe9", 0x58, 0x0, &(0x7f0000000040)={0x77359400})
r4 = add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0e9467edd7f398f", 0x1c, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, r4, &(0x7f00000006c0)=[{&(0x7f0000000400)="f916b8f72c29a4ed654ec4634d479b3453a0dbdd444019513f1d25ccda2381b9d22363dbeef5a27f13994695211b14422a35c08f7510fa", 0x37}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r5 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(r0, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x32b, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r5}], 0x1, 0x0)

[ 1531.869472] binder: 17712:17716 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1532.205463] binder: BINDER_SET_CONTEXT_MGR already set
[ 1532.205470] binder: 17718:17721 ioctl 40046207 0 returned -16
[ 1532.207256] binder: BINDER_SET_CONTEXT_MGR already set
[ 1532.207263] binder: 17720:17722 ioctl 40046207 0 returned -16
[ 1532.210351] binder: BINDER_SET_CONTEXT_MGR already set
[ 1532.210360] binder: 17719:17727 ioctl 40046207 0 returned -16
[ 1532.216593] binder: BINDER_SET_CONTEXT_MGR already set
[ 1532.216600] binder: 17717:17728 ioctl 40046207 0 returned -16
[ 1532.218285] binder: 17720:17722 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1532.226240] binder: 17719:17727 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1532.311296] binder: BINDER_SET_CONTEXT_MGR already set
[ 1532.311304] binder: 17736:17737 ioctl 40046207 0 returned -16
[ 1532.312145] binder: BINDER_SET_CONTEXT_MGR already set
[ 1532.312151] binder: 17740:17742 ioctl 40046207 0 returned -16
[ 1532.314632] binder: 17736:17737 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1532.317650] binder: BINDER_SET_CONTEXT_MGR already set
[ 1532.317657] binder: 17741:17744 ioctl 40046207 0 returned -16
[ 1532.320197] binder: BINDER_SET_CONTEXT_MGR already set
[ 1532.320203] binder: 17739:17743 ioctl 40046207 0 returned -16
[ 1532.328878] binder: 17741:17744 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1532.384365] binder: BINDER_SET_CONTEXT_MGR already set
[ 1532.384373] binder: 17745:17746 ioctl 40046207 0 returned -16
[ 1532.384794] binder: BINDER_SET_CONTEXT_MGR already set
[ 1532.384801] binder: 17747:17749 ioctl 40046207 0 returned -16
[ 1532.386959] binder: BINDER_SET_CONTEXT_MGR already set
[ 1532.386966] binder: 17748:17750 ioctl 40046207 0 returned -16
[ 1532.389494] binder: 17745:17746 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
2018/03/29 19:07:52 executing program 6:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
r1 = mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x7c, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @increfs_done={0x40106308, r1, 0x3}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r2 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r3, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
keyctl$assume_authority(0x10, 0x0)
r4 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r4, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(r4, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x200, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6c8344f9f96ef2c7fe911c01908", 0x5c, 0x0, &(0x7f0000000040)={0x77359400})
add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0e9467edd7f398f", 0x1c, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, 0x0, &(0x7f00000006c0)=[{&(0x7f0000000400)}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r5 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00'})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(0xffffffffffffffff, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000080)={0x0, 0x0, &(0x7f000000dff8), 0x0, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r5}], 0x1, 0x0)

2018/03/29 19:07:52 executing program 5:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
r1 = mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x7c, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @increfs_done={0x40106308, r1, 0x3}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r2 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r3, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
keyctl$assume_authority(0x10, 0x0)
r4 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r4, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(r4, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x200, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6c834", 0x51, 0x0, &(0x7f0000000040)={0x77359400})
r5 = add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0", 0x15, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, r5, &(0x7f00000006c0)=[{&(0x7f0000000400)}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r6 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(0xffffffffffffffff, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000080)={0x0, 0x0, &(0x7f000000dff8), 0x0, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r6}], 0x1, 0x0)

2018/03/29 19:07:52 executing program 0:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
r1 = mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x7c, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @increfs_done={0x40106308, r1}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r2 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r3, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
keyctl$assume_authority(0x10, 0x0)
r4 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r4, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(0xffffffffffffffff, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x0, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6c8344f9f96ef2c7fe911c01908", 0x5c, 0x0, &(0x7f0000000040)={0x77359400})
r5 = add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0e9467edd", 0x19, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, r5, &(0x7f00000006c0)=[{&(0x7f0000000400)}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r6 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(r0, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x32b, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r6}], 0x1, 0x0)

2018/03/29 19:07:52 executing program 7:
add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={0x73, 0x79, 0x7a}, &(0x7f0000001100)="a1", 0x1, 0xfffffffffffffffb)
sendmmsg(0xffffffffffffffff, &(0x7f0000000200)=[{{&(0x7f0000003000)=@rc={0x1f}, 0x80, &(0x7f0000004fa0), 0x0, &(0x7f0000002d30)}}], 0x1, 0x0)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f00000000c0)={"d202b999cf85000000000088f301e710"})
r0 = syz_open_dev$tun(&(0x7f0000000280)='/dev/net/tun\x00', 0x0, 0x400200)
r1 = socket(0x11, 0x100000802, 0x0)
r2 = syz_open_dev$tun(&(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000000c0)={'ifb0\x00', 0x1001})
ioctl$TUNSETLINK(r2, 0x400454cd, 0x308)
ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000040)={'ifb0\x00'})
r3 = dup2(r0, 0xffffffffffffffff)
ioctl$TUNSETQUEUE(0xffffffffffffffff, 0x400454d9, &(0x7f0000000000)={'vlan0\x00'})
write$cgroup_subtree(r3, &(0x7f00000001c0)={[{0x0, 'cpu', 0x20}, {0x0, 'pids', 0x20}, {0x0, 'cpu', 0x20}, {0x2d, 'pids', 0x20}, {0x2b, 'pids', 0x20}, {0x0, 'memory', 0x20}]}, 0x24)
connect$unix(r1, &(0x7f0000000100)=@abs, 0x6e)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)

2018/03/29 19:07:52 executing program 2:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x70, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @release={0x40046306, 0x1}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r1 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
r2 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r2, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
r3 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r3, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(r3, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x200, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6c8344f9f96ef2c7fe9", 0x58, 0x0, &(0x7f0000000040)={0x77359400})
r4 = add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0e9467edd7f398f", 0x1c, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, r4, &(0x7f00000006c0)=[{&(0x7f0000000400)="f916b8f72c29a4ed654ec4634d479b3453a0dbdd444019513f1d25ccda2381b9d22363dbeef5a27f13994695211b14422a35c08f7510fa", 0x37}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r5 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(r0, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x32b, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r5}], 0x1, 0x0)

2018/03/29 19:07:52 executing program 4:
add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={0x73, 0x79, 0x7a}, &(0x7f0000001100)="a1", 0x1, 0xfffffffffffffffb)
perf_event_open(&(0x7f000025c000)={0x2, 0x78}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
pipe2(&(0x7f0000000180), 0x0)
socket(0x18, 0x0, 0x1)
sendmmsg(0xffffffffffffffff, &(0x7f0000000200)=[{{&(0x7f0000003000)=@rc={0x1f}, 0x80, &(0x7f0000004fa0), 0x0, &(0x7f0000002d30)}}], 0x1, 0x0)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f00000000c0)={"d202b999cf85000000000088f301e710"})
r0 = syz_open_dev$tun(&(0x7f0000000280)='/dev/net/tun\x00', 0x0, 0x400200)
r1 = socket(0x11, 0x100000802, 0x0)
r2 = syz_open_dev$tun(&(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000000c0)={'ifb0\x00', 0x1001})
ioctl$TUNSETLINK(r2, 0x400454cd, 0x308)
ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000040)={'ifb0\x00', 0xa201})
r3 = dup2(0xffffffffffffffff, 0xffffffffffffffff)
ioctl$TUNSETQUEUE(0xffffffffffffffff, 0x400454d9, &(0x7f0000000000)={'vlan0\x00'})
write$cgroup_subtree(r3, &(0x7f00000001c0)={[{0x2d, 'pids', 0x20}, {0x0, 'cpu', 0x20}, {0x2d, 'pids', 0x20}, {0x2b, 'rdma', 0x20}, {0x0, 'pids', 0x20}, {0x0, 'io', 0x20}]}, 0x21)
connect$unix(0xffffffffffffffff, &(0x7f0000000100)=@abs, 0x6e)
ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82)

2018/03/29 19:07:52 executing program 3:
add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={0x73, 0x79, 0x7a}, &(0x7f0000001100)="a1", 0x1, 0xfffffffffffffffb)
perf_event_open(&(0x7f000025c000)={0x2, 0x78}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sendmmsg(0xffffffffffffffff, &(0x7f0000000200), 0x0, 0x0)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f00000000c0)={"d202b999cf85000000000088f301e710"})
r0 = syz_open_dev$tun(&(0x7f0000000280)='/dev/net/tun\x00', 0x0, 0x400200)
r1 = socket(0x11, 0x100000802, 0x0)
r2 = syz_open_dev$tun(&(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000000c0)={'ifb0\x00', 0x1001})
ioctl$TUNSETLINK(r2, 0x400454cd, 0x308)
ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000040)={'ifb0\x00', 0xa201})
r3 = dup2(r0, 0xffffffffffffffff)
ioctl$TUNSETQUEUE(0xffffffffffffffff, 0x400454d9, &(0x7f0000000000)={'vlan0\x00'})
write$cgroup_subtree(0xffffffffffffffff, &(0x7f00000001c0)={[{0x0, 'cpu', 0x20}, {0x0, 'pids', 0x20}, {0x0, 'cpu', 0x20}, {0x2d, 'pids', 0x20}, {0x2b, 'rdma', 0x20}, {0x2b, 'pids', 0x20}, {0x0, 'memory', 0x20}]}, 0x2a)
connect$unix(0xffffffffffffffff, &(0x7f0000000100)=@abs, 0x6e)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)

2018/03/29 19:07:52 executing program 1:
add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={0x73, 0x79, 0x7a}, &(0x7f0000001100)="a1", 0x1, 0xfffffffffffffffb)
perf_event_open(&(0x7f000025c000)={0x0, 0x78}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sendmmsg(0xffffffffffffffff, &(0x7f0000000200)=[{{&(0x7f0000003000)=@rc={0x1f}, 0x80, &(0x7f0000004fa0), 0x0, &(0x7f0000002d30)}}], 0x1, 0x0)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f00000000c0)={"d202b999cf85000000000088f301e710"})
r0 = syz_open_dev$tun(&(0x7f0000000280)='/dev/net/tun\x00', 0x0, 0x400200)
r1 = socket(0x11, 0x100000802, 0x0)
r2 = syz_open_dev$tun(&(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000000c0)={'ifb0\x00', 0x1001})
ioctl$TUNSETLINK(r2, 0x400454cd, 0x308)
ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000040)={'ifb0\x00', 0xa201})
r3 = dup2(r0, 0xffffffffffffffff)
ioctl$TUNSETQUEUE(0xffffffffffffffff, 0x400454d9, &(0x7f0000000000)={'vlan0\x00'})
write$cgroup_subtree(r3, &(0x7f00000001c0)={[{0x0, 'cpu', 0x20}, {0x0, 'cpu', 0x20}, {0x2d, 'pids', 0x20}, {0x2b, 'pids', 0x20}, {0x0, 'memory', 0x20}]}, 0x1e)
connect$unix(r1, &(0x7f0000000100)=@abs, 0x6e)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)

[ 1532.411307] binder: BINDER_SET_CONTEXT_MGR already set
[ 1532.411314] binder: 17751:17752 ioctl 40046207 0 returned -16
[ 1532.415340] binder: 17751:17752 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1532.674983] binder: BINDER_SET_CONTEXT_MGR already set
[ 1532.674992] binder: 17755:17763 ioctl 40046207 0 returned -16
[ 1532.676855] binder: BINDER_SET_CONTEXT_MGR already set
[ 1532.676861] binder: 17754:17756 ioctl 40046207 0 returned -16
[ 1532.683006] binder: BINDER_SET_CONTEXT_MGR already set
[ 1532.683013] binder: 17758:17766 ioctl 40046207 0 returned -16
[ 1532.687225] binder: BINDER_SET_CONTEXT_MGR already set
[ 1532.687233] binder: 17753:17765 ioctl 40046207 0 returned -16
[ 1532.691010] binder: 17754:17756 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1532.695682] binder: 17758:17766 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
2018/03/29 19:07:52 executing program 6:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
r1 = mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x7c, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @increfs_done={0x40106308, r1, 0x3}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r2 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r3, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
keyctl$assume_authority(0x10, 0x0)
r4 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r4, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(r4, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x200, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6c8344f9f96ef2c7fe911c01908", 0x5c, 0x0, &(0x7f0000000040)={0x77359400})
add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0e9467edd7f398f", 0x1c, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, 0x0, &(0x7f00000006c0)=[{&(0x7f0000000400)}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r5 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00'})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(0xffffffffffffffff, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000080)={0x0, 0x0, &(0x7f000000dff8), 0x0, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r5}], 0x1, 0x0)

2018/03/29 19:07:52 executing program 5:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
r1 = mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x7c, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @increfs_done={0x40106308, r1, 0x3}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r2 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r3, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
keyctl$assume_authority(0x10, 0x0)
r4 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r4, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(r4, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x200, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6c834", 0x51, 0x0, &(0x7f0000000040)={0x77359400})
r5 = add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0", 0x15, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, r5, &(0x7f00000006c0)=[{&(0x7f0000000400)}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r6 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(0xffffffffffffffff, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000080)={0x0, 0x0, &(0x7f000000dff8), 0x0, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r6}], 0x1, 0x0)

2018/03/29 19:07:52 executing program 0:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
r1 = mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x7c, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @increfs_done={0x40106308, r1}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r2 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r3, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
keyctl$assume_authority(0x10, 0x0)
r4 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r4, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(0xffffffffffffffff, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x0, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6c8344f9f96ef2c7fe911c01908", 0x5c, 0x0, &(0x7f0000000040)={0x77359400})
r5 = add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0e9467edd", 0x19, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, r5, &(0x7f00000006c0)=[{&(0x7f0000000400)}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r6 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(r0, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x32b, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r6}], 0x1, 0x0)

2018/03/29 19:07:52 executing program 2:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x70, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @release={0x40046306, 0x1}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r1 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
r2 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r2, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
r3 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r3, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(r3, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x200, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6c8344f9f96ef2c7fe911c019", 0x5b, 0x0, &(0x7f0000000040)={0x77359400})
r4 = add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0e9467edd7f398f", 0x1c, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, r4, &(0x7f00000006c0)=[{&(0x7f0000000400)="f916b8f72c29a4ed654ec4634d479b3453a0dbdd444019513f1d25ccda2381b9d22363dbeef5a27f13994695211b14422a35c08f7510fa", 0x37}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r5 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(r0, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x32b, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r5}], 0x1, 0x0)

[ 1532.764666] binder: BINDER_SET_CONTEXT_MGR already set
[ 1532.764673] binder: 17772:17776 ioctl 40046207 0 returned -16
[ 1532.769167] binder: 17772:17776 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1532.770437] binder: BINDER_SET_CONTEXT_MGR already set
[ 1532.770444] binder: 17773:17777 ioctl 40046207 0 returned -16
2018/03/29 19:07:52 executing program 6:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
r1 = mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x7c, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @increfs_done={0x40106308, r1, 0x3}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r2 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r3, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
keyctl$assume_authority(0x10, 0x0)
r4 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r4, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(r4, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x200, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6c8344f9f96ef2c7fe911c01908", 0x5c, 0x0, &(0x7f0000000040)={0x77359400})
add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0e9467edd7f398f", 0x1c, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, 0x0, &(0x7f00000006c0)=[{&(0x7f0000000400)}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r5 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(0xffffffffffffffff, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000080)={0x0, 0x0, &(0x7f000000dff8), 0x0, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r5}], 0x1, 0x0)

2018/03/29 19:07:52 executing program 0:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
r1 = mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x7c, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @increfs_done={0x40106308, r1}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r2 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r3, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
keyctl$assume_authority(0x10, 0x0)
r4 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r4, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(0xffffffffffffffff, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x0, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6c8344f9f96ef2c7fe911c01908", 0x5c, 0x0, &(0x7f0000000040)={0x77359400})
r5 = add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0e9467edd", 0x19, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, r5, &(0x7f00000006c0)=[{&(0x7f0000000400)}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r6 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(r0, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x32b, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r6}], 0x1, 0x0)

2018/03/29 19:07:52 executing program 5:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
r1 = mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x7c, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @increfs_done={0x40106308, r1, 0x3}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r2 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r3, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
keyctl$assume_authority(0x10, 0x0)
r4 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r4, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(r4, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x200, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6c834", 0x51, 0x0, &(0x7f0000000040)={0x77359400})
r5 = add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0", 0x15, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, r5, &(0x7f00000006c0)=[{&(0x7f0000000400)}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r6 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(0xffffffffffffffff, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000080)={0x0, 0x0, &(0x7f000000dff8), 0x0, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r6}], 0x1, 0x0)

2018/03/29 19:07:52 executing program 2:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x70, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @release={0x40046306, 0x1}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r1 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
r2 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r2, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
r3 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r3, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(r3, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x200, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6c8344f9f96ef2c7fe911c019", 0x5b, 0x0, &(0x7f0000000040)={0x77359400})
r4 = add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0e9467edd7f398f", 0x1c, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, r4, &(0x7f00000006c0)=[{&(0x7f0000000400)="f916b8f72c29a4ed654ec4634d479b3453a0dbdd444019513f1d25ccda2381b9d22363dbeef5a27f13994695211b14422a35c08f7510fa", 0x37}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r5 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(r0, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x32b, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r5}], 0x1, 0x0)

[ 1532.779969] binder: BINDER_SET_CONTEXT_MGR already set
[ 1532.779975] binder: 17775:17778 ioctl 40046207 0 returned -16
[ 1532.783337] binder: 17775:17778 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1532.783538] binder: BINDER_SET_CONTEXT_MGR already set
[ 1532.783547] binder: 17774:17779 ioctl 40046207 0 returned -16
[ 1532.852338] binder: BINDER_SET_CONTEXT_MGR already set
[ 1532.852346] binder: 17781:17782 ioctl 40046207 0 returned -16
[ 1532.871272] binder: BINDER_SET_CONTEXT_MGR already set
[ 1532.871279] binder: 17785:17787 ioctl 40046207 0 returned -16
[ 1532.887408] binder: BINDER_SET_CONTEXT_MGR already set
[ 1532.887416] binder: 17784:17786 ioctl 40046207 0 returned -16
[ 1532.892019] binder: 17784:17786 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1532.899617] binder: BINDER_SET_CONTEXT_MGR already set
[ 1532.899623] binder: 17783:17788 ioctl 40046207 0 returned -16
[ 1532.925239] binder: 17783:17788 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1533.181060] binder: BINDER_SET_CONTEXT_MGR already set
[ 1533.181068] binder: 17794:17796 ioctl 40046207 0 returned -16
[ 1533.184646] binder: BINDER_SET_CONTEXT_MGR already set
[ 1533.184654] binder: 17789:17799 ioctl 40046207 0 returned -16
[ 1533.186202] binder: BINDER_SET_CONTEXT_MGR already set
[ 1533.186208] binder: 17797:17802 ioctl 40046207 0 returned -16
[ 1533.191362] binder: 17794:17796 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1533.195090] binder: BINDER_SET_CONTEXT_MGR already set
[ 1533.195097] binder: 17795:17801 ioctl 40046207 0 returned -16
[ 1533.200416] binder: 17797:17802 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1533.264276] binder: BINDER_SET_CONTEXT_MGR already set
2018/03/29 19:07:53 executing program 6:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
r1 = mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x7c, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @increfs_done={0x40106308, r1, 0x3}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r2 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r3, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
keyctl$assume_authority(0x10, 0x0)
r4 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r4, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(r4, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x200, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6c8344f9f96ef2c7fe911c01908", 0x5c, 0x0, &(0x7f0000000040)={0x77359400})
add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0e9467edd7f398f", 0x1c, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, 0x0, &(0x7f00000006c0)=[{&(0x7f0000000400)}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r5 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(0xffffffffffffffff, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000080)={0x0, 0x0, &(0x7f000000dff8), 0x0, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r5}], 0x1, 0x0)

2018/03/29 19:07:53 executing program 5:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
r1 = mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x7c, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @increfs_done={0x40106308, r1, 0x3}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r2 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r3, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
keyctl$assume_authority(0x10, 0x0)
r4 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r4, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(r4, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x200, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6c834", 0x51, 0x0, &(0x7f0000000040)={0x77359400})
r5 = add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0e9467edd", 0x19, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, r5, &(0x7f00000006c0)=[{&(0x7f0000000400)}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r6 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(0xffffffffffffffff, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000080)={0x0, 0x0, &(0x7f000000dff8), 0x0, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r6}], 0x1, 0x0)

2018/03/29 19:07:53 executing program 0:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
r1 = mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x74, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @increfs_done={0x40106308, r1, 0x3}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r2 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r3, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
keyctl$assume_authority(0x10, 0x0)
r4 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r4, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(0xffffffffffffffff, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x0, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6c8344f9f96ef2c7fe911c01908", 0x5c, 0x0, &(0x7f0000000040)={0x77359400})
r5 = add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0e9467edd", 0x19, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, r5, &(0x7f00000006c0)=[{&(0x7f0000000400)}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r6 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(r0, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x32b, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r6}], 0x1, 0x0)

2018/03/29 19:07:53 executing program 3:
add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={0x73, 0x79, 0x7a}, &(0x7f0000001100)="a1", 0x1, 0xfffffffffffffffb)
perf_event_open(&(0x7f000025c000)={0x2, 0x78}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sendmmsg(0xffffffffffffffff, &(0x7f0000000200), 0x0, 0x0)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f00000000c0)={"d202b999cf85000000000088f301e710"})
r0 = syz_open_dev$tun(&(0x7f0000000280)='/dev/net/tun\x00', 0x0, 0x400200)
r1 = socket(0x11, 0x100000802, 0x0)
r2 = syz_open_dev$tun(&(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000000c0)={'ifb0\x00', 0x1001})
ioctl$TUNSETLINK(r2, 0x400454cd, 0x308)
ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000040)={'ifb0\x00', 0xa201})
r3 = dup2(r0, 0xffffffffffffffff)
ioctl$TUNSETQUEUE(0xffffffffffffffff, 0x400454d9, &(0x7f0000000000)={'vlan0\x00'})
write$cgroup_subtree(0xffffffffffffffff, &(0x7f00000001c0)={[{0x0, 'cpu', 0x20}, {0x0, 'pids', 0x20}, {0x0, 'cpu', 0x20}, {0x2d, 'pids', 0x20}, {0x2b, 'rdma', 0x20}, {0x2b, 'pids', 0x20}, {0x0, 'memory', 0x20}]}, 0x2a)
connect$unix(0xffffffffffffffff, &(0x7f0000000100)=@abs, 0x6e)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)

2018/03/29 19:07:53 executing program 7:
add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={0x73, 0x79, 0x7a}, &(0x7f0000001100)="a1", 0x1, 0xfffffffffffffffb)
sendmmsg(0xffffffffffffffff, &(0x7f0000000200)=[{{&(0x7f0000003000)=@rc={0x1f}, 0x80, &(0x7f0000004fa0), 0x0, &(0x7f0000002d30)}}], 0x1, 0x0)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f00000000c0)={"d202b999cf85000000000088f301e710"})
r0 = syz_open_dev$tun(&(0x7f0000000280)='/dev/net/tun\x00', 0x0, 0x400200)
r1 = socket(0x11, 0x100000802, 0x0)
r2 = syz_open_dev$tun(&(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000000c0)={'ifb0\x00', 0x1001})
ioctl$TUNSETLINK(r2, 0x400454cd, 0x308)
ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000040)={'ifb0\x00', 0xa201})
r3 = dup2(0xffffffffffffffff, 0xffffffffffffffff)
ioctl$TUNSETQUEUE(0xffffffffffffffff, 0x400454d9, &(0x7f0000000000)={'vlan0\x00'})
write$cgroup_subtree(r3, &(0x7f00000001c0)={[{0x0, 'cpu', 0x20}, {0x0, 'pids', 0x20}, {0x0, 'cpu', 0x20}, {0x2d, 'pids', 0x20}, {0x2b, 'pids', 0x20}, {0x0, 'memory', 0x20}]}, 0x24)
connect$unix(r1, &(0x7f0000000100)=@abs, 0x6e)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)

2018/03/29 19:07:53 executing program 2:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x70, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @release={0x40046306, 0x1}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r1 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
r2 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r2, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
r3 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r3, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(r3, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x200, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6c8344f9f96ef2c7fe911c019", 0x5b, 0x0, &(0x7f0000000040)={0x77359400})
r4 = add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0e9467edd7f398f", 0x1c, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, r4, &(0x7f00000006c0)=[{&(0x7f0000000400)="f916b8f72c29a4ed654ec4634d479b3453a0dbdd444019513f1d25ccda2381b9d22363dbeef5a27f13994695211b14422a35c08f7510fa", 0x37}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r5 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(r0, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x32b, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r5}], 0x1, 0x0)

2018/03/29 19:07:53 executing program 1:
add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={0x73, 0x79, 0x7a}, &(0x7f0000001100)="a1", 0x1, 0xfffffffffffffffb)
perf_event_open(&(0x7f000025c000)={0x0, 0x78}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sendmmsg(0xffffffffffffffff, &(0x7f0000000200)=[{{&(0x7f0000003000)=@rc={0x1f}, 0x80, &(0x7f0000004fa0), 0x0, &(0x7f0000002d30)}}], 0x1, 0x0)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f00000000c0)={"d202b999cf85000000000088f301e710"})
r0 = syz_open_dev$tun(&(0x7f0000000280)='/dev/net/tun\x00', 0x0, 0x400200)
r1 = socket(0x11, 0x100000802, 0x0)
r2 = syz_open_dev$tun(&(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000000c0)={'ifb0\x00', 0x1001})
ioctl$TUNSETLINK(r2, 0x400454cd, 0x308)
ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000040)={'ifb0\x00', 0xa201})
r3 = dup2(r0, 0xffffffffffffffff)
ioctl$TUNSETQUEUE(0xffffffffffffffff, 0x400454d9, &(0x7f0000000000)={'vlan0\x00'})
write$cgroup_subtree(r3, &(0x7f00000001c0)={[{0x0, 'cpu', 0x20}, {0x0, 'cpu', 0x20}, {0x2d, 'pids', 0x20}, {0x2b, 'pids', 0x20}, {0x0, 'memory', 0x20}]}, 0x1e)
connect$unix(r1, &(0x7f0000000100)=@abs, 0x6e)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)

2018/03/29 19:07:53 executing program 4:
add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={0x73, 0x79, 0x7a}, &(0x7f0000001100)="a1", 0x1, 0xfffffffffffffffb)
perf_event_open(&(0x7f000025c000)={0x2, 0x78}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
pipe2(&(0x7f0000000180), 0x0)
socket(0x18, 0x0, 0x1)
sendmmsg(0xffffffffffffffff, &(0x7f0000000200)=[{{&(0x7f0000003000)=@rc={0x1f}, 0x80, &(0x7f0000004fa0), 0x0, &(0x7f0000002d30)}}], 0x1, 0x0)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f00000000c0)={"d202b999cf85000000000088f301e710"})
r0 = syz_open_dev$tun(&(0x7f0000000280)='/dev/net/tun\x00', 0x0, 0x400200)
r1 = socket(0x11, 0x100000802, 0x0)
r2 = syz_open_dev$tun(&(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000000c0)={'ifb0\x00', 0x1001})
ioctl$TUNSETLINK(r2, 0x400454cd, 0x308)
ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000040)={'ifb0\x00', 0xa201})
r3 = dup2(0xffffffffffffffff, 0xffffffffffffffff)
ioctl$TUNSETQUEUE(0xffffffffffffffff, 0x400454d9, &(0x7f0000000000)={'vlan0\x00'})
write$cgroup_subtree(r3, &(0x7f00000001c0)={[{0x2d, 'pids', 0x20}, {0x0, 'cpu', 0x20}, {0x2d, 'pids', 0x20}, {0x2b, 'rdma', 0x20}, {0x0, 'pids', 0x20}, {0x0, 'io', 0x20}]}, 0x21)
connect$unix(0xffffffffffffffff, &(0x7f0000000100)=@abs, 0x6e)
ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82)

[ 1533.264283] binder: 17806:17808 ioctl 40046207 0 returned -16
[ 1533.266633] binder: BINDER_SET_CONTEXT_MGR already set
[ 1533.266640] binder: 17807:17812 ioctl 40046207 0 returned -16
[ 1533.273205] binder: 17806:17808 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1533.275152] binder: BINDER_SET_CONTEXT_MGR already set
[ 1533.275159] binder: 17810:17811 ioctl 40046207 0 returned -16
[ 1533.279736] binder: 17810:17811 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1533.314186] binder: BINDER_SET_CONTEXT_MGR already set
[ 1533.314193] binder: 17814:17816 ioctl 40046207 0 returned -16
[ 1533.329000] binder: BINDER_SET_CONTEXT_MGR already set
[ 1533.329007] binder: 17817:17819 ioctl 40046207 0 returned -16
[ 1533.332389] binder: BINDER_SET_CONTEXT_MGR already set
[ 1533.332396] binder: 17818:17820 ioctl 40046207 0 returned -16
2018/03/29 19:07:53 executing program 5:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
r1 = mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x7c, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @increfs_done={0x40106308, r1, 0x3}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r2 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r3, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
keyctl$assume_authority(0x10, 0x0)
r4 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r4, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(r4, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x200, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6c834", 0x51, 0x0, &(0x7f0000000040)={0x77359400})
r5 = add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0e9467edd", 0x19, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, r5, &(0x7f00000006c0)=[{&(0x7f0000000400)}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r6 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(0xffffffffffffffff, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000080)={0x0, 0x0, &(0x7f000000dff8), 0x0, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r6}], 0x1, 0x0)

2018/03/29 19:07:53 executing program 2:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x70, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @release={0x40046306, 0x1}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r1 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
r2 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r2, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
r3 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r3, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(r3, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x200, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6c8344f9f96ef2c7fe911c01908", 0x5c, 0x0, &(0x7f0000000040)={0x77359400})
r4 = add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0e9467edd7f398f", 0x1c, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, r4, &(0x7f00000006c0)=[{&(0x7f0000000400)="f916b8f72c29a4ed654ec4634d479b3453a0dbdd444019513f1d25ccda2381b9d22363dbeef5a27f13994695211b14422a35c08f7510fa", 0x37}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r5 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(r0, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x32b, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r5}], 0x1, 0x0)

2018/03/29 19:07:53 executing program 6:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
r1 = mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x7c, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @increfs_done={0x40106308, r1, 0x3}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r2 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r3, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
keyctl$assume_authority(0x10, 0x0)
r4 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r4, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(r4, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x200, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6c8344f9f96ef2c7fe911c01908", 0x5c, 0x0, &(0x7f0000000040)={0x77359400})
add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0e9467edd7f398f", 0x1c, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, 0x0, &(0x7f00000006c0)=[{&(0x7f0000000400)}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r5 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(0xffffffffffffffff, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000080)={0x0, 0x0, &(0x7f000000dff8), 0x0, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r5}], 0x1, 0x0)

2018/03/29 19:07:53 executing program 0:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
r1 = mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x74, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @increfs_done={0x40106308, r1, 0x3}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r2 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r3, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
keyctl$assume_authority(0x10, 0x0)
r4 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r4, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(0xffffffffffffffff, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x0, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6c8344f9f96ef2c7fe911c01908", 0x5c, 0x0, &(0x7f0000000040)={0x77359400})
r5 = add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0e9467edd", 0x19, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, r5, &(0x7f00000006c0)=[{&(0x7f0000000400)}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r6 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(r0, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x32b, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r6}], 0x1, 0x0)

[ 1533.336647] binder: 17818:17820 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1533.347321] binder: 17817:17819 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1533.382825] binder: BINDER_SET_CONTEXT_MGR already set
[ 1533.382832] binder: 17821:17822 ioctl 40046207 0 returned -16
[ 1533.594033] binder: BINDER_SET_CONTEXT_MGR already set
[ 1533.594041] binder: 17824:17831 ioctl 40046207 0 returned -16
[ 1533.596710] binder: BINDER_SET_CONTEXT_MGR already set
[ 1533.596717] binder: 17825:17832 ioctl 40046207 0 returned -16
[ 1533.601299] binder: BINDER_SET_CONTEXT_MGR already set
[ 1533.601310] binder: 17826:17833 ioctl 40046207 0 returned -16
[ 1533.605142] binder: 17825:17832 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1533.605225] binder: BINDER_SET_CONTEXT_MGR already set
[ 1533.605232] binder: 17823:17835 ioctl 40046207 0 returned -16
2018/03/29 19:07:53 executing program 0:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
r1 = mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x74, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @increfs_done={0x40106308, r1, 0x3}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r2 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r3, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
keyctl$assume_authority(0x10, 0x0)
r4 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r4, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(0xffffffffffffffff, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x0, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6c8344f9f96ef2c7fe911c01908", 0x5c, 0x0, &(0x7f0000000040)={0x77359400})
r5 = add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0e9467edd", 0x19, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, r5, &(0x7f00000006c0)=[{&(0x7f0000000400)}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r6 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(r0, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x32b, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r6}], 0x1, 0x0)

2018/03/29 19:07:53 executing program 2:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x70, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @release={0x40046306, 0x1}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r1 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
r2 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r2, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
r3 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r3, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(r3, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x200, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6c8344f9f96ef2c7fe911c01908", 0x5c, 0x0, &(0x7f0000000040)={0x77359400})
r4 = add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0e9467edd7f398f", 0x1c, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, r4, &(0x7f00000006c0)=[{&(0x7f0000000400)="f916b8f72c29a4ed654ec4634d479b3453a0dbdd444019513f1d25ccda2381b9d22363dbeef5a27f13994695211b14422a35c08f7510fa", 0x37}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r5 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(r0, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x32b, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r5}], 0x1, 0x0)

2018/03/29 19:07:53 executing program 5:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
r1 = mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x7c, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @increfs_done={0x40106308, r1, 0x3}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r2 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r3, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
keyctl$assume_authority(0x10, 0x0)
r4 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r4, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(r4, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x200, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6c834", 0x51, 0x0, &(0x7f0000000040)={0x77359400})
r5 = add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0e9467edd", 0x19, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, r5, &(0x7f00000006c0)=[{&(0x7f0000000400)}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r6 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(0xffffffffffffffff, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000080)={0x0, 0x0, &(0x7f000000dff8), 0x0, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r6}], 0x1, 0x0)

[ 1533.614906] binder: 17826:17833 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1533.685282] binder: BINDER_SET_CONTEXT_MGR already set
[ 1533.685290] binder: 17843:17847 ioctl 40046207 0 returned -16
[ 1533.690098] binder: BINDER_SET_CONTEXT_MGR already set
[ 1533.690105] binder: 17842:17846 ioctl 40046207 0 returned -16
[ 1533.690991] binder: BINDER_SET_CONTEXT_MGR already set
[ 1533.690997] binder: 17844:17850 ioctl 40046207 0 returned -16
[ 1533.694632] binder: BINDER_SET_CONTEXT_MGR already set
[ 1533.694639] binder: 17845:17848 ioctl 40046207 0 returned -16
[ 1533.699797] binder: 17845:17848 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1533.701703] binder: 17843:17847 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1533.772473] binder: BINDER_SET_CONTEXT_MGR already set
[ 1533.772480] binder: 17855:17856 ioctl 40046207 0 returned -16
[ 1533.785306] binder: 17855:17856 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1534.006646] binder: BINDER_SET_CONTEXT_MGR already set
[ 1534.006654] binder: 17857:17864 ioctl 40046207 0 returned -16
[ 1534.007748] binder: BINDER_SET_CONTEXT_MGR already set
[ 1534.007755] binder: 17860:17863 ioctl 40046207 0 returned -16
[ 1534.013678] binder: BINDER_SET_CONTEXT_MGR already set
[ 1534.013685] binder: 17858:17868 ioctl 40046207 0 returned -16
[ 1534.016040] binder: BINDER_SET_CONTEXT_MGR already set
[ 1534.016047] binder: 17859:17865 ioctl 40046207 0 returned -16
[ 1534.018737] binder: 17857:17864 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1534.025996] binder: 17859:17865 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1534.091006] binder: BINDER_SET_CONTEXT_MGR already set
[ 1534.091013] binder: 17877:17881 ioctl 40046207 0 returned -16
[ 1534.094910] binder: BINDER_SET_CONTEXT_MGR already set
[ 1534.094917] binder: 17876:17878 ioctl 40046207 0 returned -16
[ 1534.100166] binder: BINDER_SET_CONTEXT_MGR already set
[ 1534.100173] binder: 17880:17883 ioctl 40046207 0 returned -16
[ 1534.101512] binder: BINDER_SET_CONTEXT_MGR already set
[ 1534.101518] binder: 17879:17882 ioctl 40046207 0 returned -16
[ 1534.103489] binder: 17876:17878 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1534.109213] binder: 17879:17882 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1534.180269] binder: BINDER_SET_CONTEXT_MGR already set
[ 1534.180277] binder: 17884:17888 ioctl 40046207 0 returned -16
[ 1534.182190] binder: BINDER_SET_CONTEXT_MGR already set
[ 1534.182198] binder: 17887:17890 ioctl 40046207 0 returned -16
[ 1534.184301] binder: BINDER_SET_CONTEXT_MGR already set
[ 1534.184307] binder: 17886:17889 ioctl 40046207 0 returned -16
[ 1534.184708] binder: BINDER_SET_CONTEXT_MGR already set
[ 1534.184715] binder: 17885:17891 ioctl 40046207 0 returned -16
[ 1534.190157] binder: 17886:17889 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1534.197146] binder: 17887:17890 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1534.490291] binder: BINDER_SET_CONTEXT_MGR already set
[ 1534.490299] binder: 17893:17894 ioctl 40046207 0 returned -16
[ 1534.497380] binder: BINDER_SET_CONTEXT_MGR already set
[ 1534.497414] binder: 17897:17898 ioctl 40046207 0 returned -16
[ 1534.499012] binder: BINDER_SET_CONTEXT_MGR already set
[ 1534.499018] binder: 17892:17903 ioctl 40046207 0 returned -16
[ 1534.507056] binder: BINDER_SET_CONTEXT_MGR already set
[ 1534.507065] binder: 17895:17899 ioctl 40046207 0 returned -16
[ 1534.507522] binder: 17893:17894 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1534.534034] binder: 17895:17899 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1534.591273] binder: BINDER_SET_CONTEXT_MGR already set
[ 1534.591282] binder: 17909:17910 ioctl 40046207 0 returned -16
[ 1534.592275] binder: BINDER_SET_CONTEXT_MGR already set
[ 1534.592281] binder: 17914:17915 ioctl 40046207 0 returned -16
2018/03/29 19:07:53 executing program 0:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
r1 = mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x38, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @increfs_done={0x40106308, r1, 0x3}, @increfs={0x40046304}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r2 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r3, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
keyctl$assume_authority(0x10, 0x0)
r4 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r4, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(0xffffffffffffffff, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x0, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6c8344f9f96ef2c7fe911c01908", 0x5c, 0x0, &(0x7f0000000040)={0x77359400})
r5 = add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0e9467edd", 0x19, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, r5, &(0x7f00000006c0)=[{&(0x7f0000000400)}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r6 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(r0, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x32b, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r6}], 0x1, 0x0)

2018/03/29 19:07:53 executing program 6:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
r1 = mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x7c, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @increfs_done={0x40106308, r1, 0x3}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r2 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r3, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
keyctl$assume_authority(0x10, 0x0)
r4 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r4, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(r4, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x200, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6c8344f9f96ef2c7fe911c01908", 0x5c, 0x0, &(0x7f0000000040)={0x77359400})
add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0e9467edd7f398f", 0x1c, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, 0x0, &(0x7f00000006c0)=[{&(0x7f0000000400)}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r5 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(0xffffffffffffffff, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000080)={0x0, 0x0, &(0x7f000000dff8), 0x0, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000), 0x0, 0x0)

2018/03/29 19:07:53 executing program 5:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
r1 = mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x7c, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @increfs_done={0x40106308, r1, 0x3}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r2 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r3, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
keyctl$assume_authority(0x10, 0x0)
r4 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r4, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(r4, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x200, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6c834", 0x51, 0x0, &(0x7f0000000040)={0x77359400})
r5 = add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0e9467edd7f39", 0x1b, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, r5, &(0x7f00000006c0)=[{&(0x7f0000000400)}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r6 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(0xffffffffffffffff, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000080)={0x0, 0x0, &(0x7f000000dff8), 0x0, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r6}], 0x1, 0x0)

2018/03/29 19:07:53 executing program 3:
add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={0x73, 0x79, 0x7a}, &(0x7f0000001100)="a1", 0x1, 0xfffffffffffffffb)
perf_event_open(&(0x7f000025c000)={0x2, 0x78}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sendmmsg(0xffffffffffffffff, &(0x7f0000000200), 0x0, 0x0)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f00000000c0)={"d202b999cf85000000000088f301e710"})
r0 = syz_open_dev$tun(&(0x7f0000000280)='/dev/net/tun\x00', 0x0, 0x400200)
r1 = socket(0x11, 0x100000802, 0x0)
r2 = syz_open_dev$tun(&(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000000c0)={'ifb0\x00', 0x1001})
ioctl$TUNSETLINK(r2, 0x400454cd, 0x308)
ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000040)={'ifb0\x00', 0xa201})
r3 = dup2(r0, 0xffffffffffffffff)
ioctl$TUNSETQUEUE(0xffffffffffffffff, 0x400454d9, &(0x7f0000000000)={'vlan0\x00'})
write$cgroup_subtree(r3, &(0x7f00000001c0)={[{0x0, 'pids', 0x20}, {0x0, 'cpu', 0x20}, {0x2d, 'pids', 0x20}, {0x2b, 'rdma', 0x20}, {0x2b, 'pids', 0x20}, {0x0, 'memory', 0x20}]}, 0x25)
connect$unix(0xffffffffffffffff, &(0x7f0000000100)=@abs, 0x6e)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)

2018/03/29 19:07:53 executing program 7:
add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={0x73, 0x79, 0x7a}, &(0x7f0000001100)="a1", 0x1, 0xfffffffffffffffb)
sendmmsg(0xffffffffffffffff, &(0x7f0000000200)=[{{&(0x7f0000003000)=@rc={0x1f}, 0x80, &(0x7f0000004fa0), 0x0, &(0x7f0000002d30)}}], 0x1, 0x0)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f00000000c0)={"d202b999cf85000000000088f301e710"})
r0 = syz_open_dev$tun(&(0x7f0000000280)='/dev/net/tun\x00', 0x0, 0x400200)
r1 = socket(0x11, 0x100000802, 0x0)
r2 = syz_open_dev$tun(&(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000000c0)={'ifb0\x00', 0x1001})
ioctl$TUNSETLINK(r2, 0x400454cd, 0x308)
ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000040)={'ifb0\x00', 0xa201})
r3 = dup2(0xffffffffffffffff, 0xffffffffffffffff)
ioctl$TUNSETQUEUE(0xffffffffffffffff, 0x400454d9, &(0x7f0000000000)={'vlan0\x00'})
write$cgroup_subtree(r3, &(0x7f00000001c0)={[{0x0, 'cpu', 0x20}, {0x0, 'pids', 0x20}, {0x0, 'cpu', 0x20}, {0x2d, 'pids', 0x20}, {0x2b, 'pids', 0x20}, {0x0, 'memory', 0x20}]}, 0x24)
connect$unix(r1, &(0x7f0000000100)=@abs, 0x6e)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)

2018/03/29 19:07:53 executing program 4:
add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={0x73, 0x79, 0x7a}, &(0x7f0000001100)="a1", 0x1, 0xfffffffffffffffb)
perf_event_open(&(0x7f000025c000)={0x2, 0x78}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
pipe2(&(0x7f0000000180), 0x0)
socket(0x18, 0x0, 0x1)
sendmmsg(0xffffffffffffffff, &(0x7f0000000200)=[{{&(0x7f0000003000)=@rc={0x1f}, 0x80, &(0x7f0000004fa0), 0x0, &(0x7f0000002d30)}}], 0x1, 0x0)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f00000000c0)={"d202b999cf85000000000088f301e710"})
r0 = syz_open_dev$tun(&(0x7f0000000280)='/dev/net/tun\x00', 0x0, 0x400200)
r1 = socket(0x11, 0x100000802, 0x0)
r2 = syz_open_dev$tun(&(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000000c0)={'ifb0\x00', 0x1001})
ioctl$TUNSETLINK(r2, 0x400454cd, 0x308)
ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000040)={'ifb0\x00', 0xa201})
r3 = dup2(r0, 0xffffffffffffffff)
ioctl$TUNSETQUEUE(0xffffffffffffffff, 0x400454d9, &(0x7f0000000000)={'vlan0\x00'})
write$cgroup_subtree(0xffffffffffffffff, &(0x7f00000001c0)={[{0x2d, 'pids', 0x20}, {0x0, 'cpu', 0x20}, {0x2d, 'pids', 0x20}, {0x2b, 'rdma', 0x20}, {0x0, 'pids', 0x20}, {0x0, 'io', 0x20}]}, 0x21)
connect$unix(0xffffffffffffffff, &(0x7f0000000100)=@abs, 0x6e)
ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82)

2018/03/29 19:07:53 executing program 1:
add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={0x73, 0x79, 0x7a}, &(0x7f0000001100)="a1", 0x1, 0xfffffffffffffffb)
perf_event_open(&(0x7f000025c000)={0x0, 0x78}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sendmmsg(0xffffffffffffffff, &(0x7f0000000200)=[{{&(0x7f0000003000)=@rc={0x1f}, 0x80, &(0x7f0000004fa0), 0x0, &(0x7f0000002d30)}}], 0x1, 0x0)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f00000000c0)={"d202b999cf85000000000088f301e710"})
r0 = syz_open_dev$tun(&(0x7f0000000280)='/dev/net/tun\x00', 0x0, 0x400200)
r1 = socket(0x11, 0x100000802, 0x0)
r2 = syz_open_dev$tun(&(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000000c0)={'ifb0\x00', 0x1001})
ioctl$TUNSETLINK(r2, 0x400454cd, 0x308)
ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000040)={'ifb0\x00', 0xa201})
r3 = dup2(r0, 0xffffffffffffffff)
ioctl$TUNSETQUEUE(0xffffffffffffffff, 0x400454d9, &(0x7f0000000000)={'vlan0\x00'})
write$cgroup_subtree(r3, &(0x7f00000001c0)={[{0x0, 'cpu', 0x20}, {0x0, 'pids', 0x20}, {0x2d, 'pids', 0x20}, {0x2b, 'pids', 0x20}, {0x0, 'memory', 0x20}]}, 0x1f)
connect$unix(r1, &(0x7f0000000100)=@abs, 0x6e)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)

[ 1534.596427] binder: BINDER_SET_CONTEXT_MGR already set
[ 1534.596434] binder: 17911:17917 ioctl 40046207 0 returned -16
[ 1534.596577] binder: BINDER_SET_CONTEXT_MGR already set
[ 1534.596582] binder: 17913:17916 ioctl 40046207 0 returned -16
[ 1534.601518] binder: 17911:17917 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1534.605799] binder: 17914:17915 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1534.662561] binder: BINDER_SET_CONTEXT_MGR already set
[ 1534.662569] binder: 17918:17922 ioctl 40046207 0 returned -16
2018/03/29 19:07:53 executing program 2:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x70, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @release={0x40046306, 0x1}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r1 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
r2 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r2, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
r3 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r3, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(r3, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x200, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6c8344f9f96ef2c7fe911c01908", 0x5c, 0x0, &(0x7f0000000040)={0x77359400})
r4 = add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0e9467edd7f398f", 0x1c, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, r4, &(0x7f00000006c0)=[{&(0x7f0000000400)="f916b8f72c29a4ed654ec4634d479b3453a0dbdd444019513f1d25ccda2381b9d22363dbeef5a27f13994695211b14422a35c08f7510fa", 0x37}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r5 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(r0, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x32b, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r5}], 0x1, 0x0)

[ 1534.671985] binder: BINDER_SET_CONTEXT_MGR already set
[ 1534.671992] binder: 17920:17923 ioctl 40046207 0 returned -16
[ 1534.672232] binder: 17918:17922 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1534.675190] binder: BINDER_SET_CONTEXT_MGR already set
2018/03/29 19:07:53 executing program 6:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
r1 = mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x7c, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @increfs_done={0x40106308, r1, 0x3}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r2 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r3, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
keyctl$assume_authority(0x10, 0x0)
r4 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r4, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(r4, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x200, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6c8344f9f96ef2c7fe911c01908", 0x5c, 0x0, &(0x7f0000000040)={0x77359400})
add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0e9467edd7f398f", 0x1c, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, 0x0, &(0x7f00000006c0)=[{&(0x7f0000000400)}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r5 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(0xffffffffffffffff, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000080)={0x0, 0x0, &(0x7f000000dff8), 0x0, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000), 0x0, 0x0)

2018/03/29 19:07:53 executing program 2:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x70, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @release={0x40046306, 0x1}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r1 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
r2 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r2, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
r3 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r3, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(r3, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x200, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6c8344f9f96ef2c7fe911c019080e", 0x5d, 0x0, &(0x7f0000000040)={0x77359400})
r4 = add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0), 0x0, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, r4, &(0x7f00000006c0)=[{&(0x7f0000000400)="f916b8f72c29a4ed654ec4634d479b3453a0dbdd444019513f1d25ccda2381b9d22363dbeef5a27f13994695211b14422a35c08f7510fa", 0x37}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r5 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(r0, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x32b, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r5}], 0x1, 0x0)

2018/03/29 19:07:53 executing program 5:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
r1 = mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x7c, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @increfs_done={0x40106308, r1, 0x3}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r2 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r3, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
keyctl$assume_authority(0x10, 0x0)
r4 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r4, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(r4, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x200, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6c834", 0x51, 0x0, &(0x7f0000000040)={0x77359400})
r5 = add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0e9467edd7f39", 0x1b, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, r5, &(0x7f00000006c0)=[{&(0x7f0000000400)}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r6 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(0xffffffffffffffff, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000080)={0x0, 0x0, &(0x7f000000dff8), 0x0, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r6}], 0x1, 0x0)

2018/03/29 19:07:53 executing program 0:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
r1 = mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x38, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @increfs_done={0x40106308, r1, 0x3}, @increfs={0x40046304}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r2 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r3, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
keyctl$assume_authority(0x10, 0x0)
r4 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r4, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(0xffffffffffffffff, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x0, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6c8344f9f96ef2c7fe911c01908", 0x5c, 0x0, &(0x7f0000000040)={0x77359400})
r5 = add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0e9467edd", 0x19, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, r5, &(0x7f00000006c0)=[{&(0x7f0000000400)}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r6 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(r0, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x32b, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r6}], 0x1, 0x0)

[ 1534.675196] binder: 17919:17924 ioctl 40046207 0 returned -16
[ 1534.678931] binder: 17919:17924 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1534.680015] binder: BINDER_SET_CONTEXT_MGR already set
[ 1534.680022] binder: 17921:17925 ioctl 40046207 0 returned -16
[ 1534.742857] binder: BINDER_SET_CONTEXT_MGR already set
[ 1534.742864] binder: 17926:17929 ioctl 40046207 0 returned -16
[ 1534.745347] binder: BINDER_SET_CONTEXT_MGR already set
[ 1534.745354] binder: 17927:17930 ioctl 40046207 0 returned -16
[ 1534.747113] binder: 17926:17929 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1534.754826] binder: BINDER_SET_CONTEXT_MGR already set
[ 1534.754833] binder: 17928:17931 ioctl 40046207 0 returned -16
2018/03/29 19:07:53 executing program 6:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
r1 = mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x7c, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @increfs_done={0x40106308, r1, 0x3}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r2 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r3, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
keyctl$assume_authority(0x10, 0x0)
r4 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r4, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(r4, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x200, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6c8344f9f96ef2c7fe911c01908", 0x5c, 0x0, &(0x7f0000000040)={0x77359400})
add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0e9467edd7f398f", 0x1c, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, 0x0, &(0x7f00000006c0)=[{&(0x7f0000000400)}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r5 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(0xffffffffffffffff, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000080)={0x0, 0x0, &(0x7f000000dff8), 0x0, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000), 0x0, 0x0)

2018/03/29 19:07:53 executing program 2:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x70, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @release={0x40046306, 0x1}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r1 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
r2 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r2, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
r3 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r3, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(r3, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x200, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6c8344f9f96ef2c7fe911c019080e", 0x5d, 0x0, &(0x7f0000000040)={0x77359400})
r4 = add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0), 0x0, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, r4, &(0x7f00000006c0)=[{&(0x7f0000000400)="f916b8f72c29a4ed654ec4634d479b3453a0dbdd444019513f1d25ccda2381b9d22363dbeef5a27f13994695211b14422a35c08f7510fa", 0x37}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r5 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(r0, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x32b, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r5}], 0x1, 0x0)

2018/03/29 19:07:53 executing program 0:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
r1 = mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x38, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @increfs_done={0x40106308, r1, 0x3}, @increfs={0x40046304}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r2 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r3, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
keyctl$assume_authority(0x10, 0x0)
r4 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r4, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(0xffffffffffffffff, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x0, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6c8344f9f96ef2c7fe911c01908", 0x5c, 0x0, &(0x7f0000000040)={0x77359400})
r5 = add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0e9467edd", 0x19, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, r5, &(0x7f00000006c0)=[{&(0x7f0000000400)}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r6 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(r0, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x32b, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r6}], 0x1, 0x0)

2018/03/29 19:07:53 executing program 5:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
r1 = mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x7c, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @increfs_done={0x40106308, r1, 0x3}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r2 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r3, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
keyctl$assume_authority(0x10, 0x0)
r4 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r4, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(r4, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x200, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6c834", 0x51, 0x0, &(0x7f0000000040)={0x77359400})
r5 = add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0e9467edd7f39", 0x1b, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, r5, &(0x7f00000006c0)=[{&(0x7f0000000400)}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r6 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(0xffffffffffffffff, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000080)={0x0, 0x0, &(0x7f000000dff8), 0x0, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r6}], 0x1, 0x0)

[ 1534.932013] binder: BINDER_SET_CONTEXT_MGR already set
[ 1534.932022] binder: 17934:17936 ioctl 40046207 0 returned -16
[ 1534.940109] binder: BINDER_SET_CONTEXT_MGR already set
[ 1534.940117] binder: 17932:17935 ioctl 40046207 0 returned -16
[ 1534.945709] binder: BINDER_SET_CONTEXT_MGR already set
2018/03/29 19:07:53 executing program 6:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
r1 = mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x7c, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @increfs_done={0x40106308, r1, 0x3}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r2 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r3, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
keyctl$assume_authority(0x10, 0x0)
r4 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r4, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(r4, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x200, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6c8344f9f96ef2c7fe911c01908", 0x5c, 0x0, &(0x7f0000000040)={0x77359400})
add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0e9467edd7f398f", 0x1c, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, 0x0, &(0x7f00000006c0)=[{&(0x7f0000000400)}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r5 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(0xffffffffffffffff, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000080)={0x0, 0x0, &(0x7f000000dff8), 0x0, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{}], 0x1, 0x0)

[ 1534.945716] binder: 17939:17944 ioctl 40046207 0 returned -16
[ 1534.946081] binder: BINDER_SET_CONTEXT_MGR already set
[ 1534.946087] binder: 17933:17943 ioctl 40046207 0 returned -16
[ 1534.950272] binder: 17932:17935 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1534.960368] binder: 17933:17943 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1535.014822] binder: BINDER_SET_CONTEXT_MGR already set
[ 1535.014831] binder: 17952:17954 ioctl 40046207 0 returned -16
[ 1535.029881] binder: BINDER_SET_CONTEXT_MGR already set
[ 1535.029888] binder: 17951:17956 ioctl 40046207 0 returned -16
[ 1535.039903] binder: 17951:17956 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1535.043010] binder: BINDER_SET_CONTEXT_MGR already set
[ 1535.043017] binder: 17955:17957 ioctl 40046207 0 returned -16
[ 1535.046698] binder: 17955:17957 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1535.074331] binder: BINDER_SET_CONTEXT_MGR already set
[ 1535.074339] binder: 17958:17959 ioctl 40046207 0 returned -16
[ 1535.119746] binder: BINDER_SET_CONTEXT_MGR already set
[ 1535.119754] binder: 17960:17961 ioctl 40046207 0 returned -16
[ 1535.124563] binder: BINDER_SET_CONTEXT_MGR already set
[ 1535.124570] binder: 17963:17965 ioctl 40046207 0 returned -16
[ 1535.129084] binder: 17963:17965 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1535.133014] binder: BINDER_SET_CONTEXT_MGR already set
[ 1535.133021] binder: 17962:17964 ioctl 40046207 0 returned -16
[ 1535.137096] binder: 17962:17964 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1535.430535] binder: BINDER_SET_CONTEXT_MGR already set
[ 1535.430542] binder: 17971:17974 ioctl 40046207 0 returned -16
[ 1535.434424] binder: BINDER_SET_CONTEXT_MGR already set
[ 1535.434432] binder: 17967:17968 ioctl 40046207 0 returned -16
[ 1535.439536] binder: BINDER_SET_CONTEXT_MGR already set
[ 1535.439545] binder: 17969:17978 ioctl 40046207 0 returned -16
[ 1535.439823] binder: BINDER_SET_CONTEXT_MGR already set
[ 1535.439830] binder: 17966:17975 ioctl 40046207 0 returned -16
[ 1535.446955] binder: 17971:17974 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1535.447669] binder: 17969:17978 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1535.520867] binder: BINDER_SET_CONTEXT_MGR already set
[ 1535.520874] binder: 17991:17995 ioctl 40046207 0 returned -16
[ 1535.522965] binder: BINDER_SET_CONTEXT_MGR already set
[ 1535.522972] binder: 17988:17992 ioctl 40046207 0 returned -16
[ 1535.526773] binder: BINDER_SET_CONTEXT_MGR already set
[ 1535.526780] binder: 17990:17993 ioctl 40046207 0 returned -16
2018/03/29 19:07:54 executing program 2:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x70, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @release={0x40046306, 0x1}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r1 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
r2 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r2, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
r3 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r3, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(r3, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x200, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6c8344f9f96ef2c7fe911c019080e", 0x5d, 0x0, &(0x7f0000000040)={0x77359400})
r4 = add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0), 0x0, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, r4, &(0x7f00000006c0)=[{&(0x7f0000000400)="f916b8f72c29a4ed654ec4634d479b3453a0dbdd444019513f1d25ccda2381b9d22363dbeef5a27f13994695211b14422a35c08f7510fa", 0x37}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r5 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(r0, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x32b, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r5}], 0x1, 0x0)

2018/03/29 19:07:54 executing program 0:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
r1 = mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x7c, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @increfs_done={0x40106308, r1, 0x3}, @increfs={0x40046304}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r2 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r3, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
keyctl$assume_authority(0x10, 0x0)
r4 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r4, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(0xffffffffffffffff, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x0, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6c8344f9f96ef2c7fe911c01908", 0x5c, 0x0, &(0x7f0000000040)={0x77359400})
r5 = add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0e9467edd", 0x19, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, r5, &(0x7f00000006c0)=[{&(0x7f0000000400)}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r6 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(r0, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x32b, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r6}], 0x1, 0x0)

2018/03/29 19:07:54 executing program 5:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
r1 = mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x7c, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @increfs_done={0x40106308, r1, 0x3}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r2 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r3, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
keyctl$assume_authority(0x10, 0x0)
r4 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r4, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(r4, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x200, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6c834", 0x51, 0x0, &(0x7f0000000040)={0x77359400})
r5 = add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0e9467edd7f398f", 0x1c, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, r5, &(0x7f00000006c0)=[{&(0x7f0000000400)}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r6 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(0xffffffffffffffff, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000080)={0x0, 0x0, &(0x7f000000dff8), 0x0, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r6}], 0x1, 0x0)

2018/03/29 19:07:54 executing program 1:
add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={0x73, 0x79, 0x7a}, &(0x7f0000001100)="a1", 0x1, 0xfffffffffffffffb)
perf_event_open(&(0x7f000025c000)={0x0, 0x78}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sendmmsg(0xffffffffffffffff, &(0x7f0000000200)=[{{&(0x7f0000003000)=@rc={0x1f}, 0x80, &(0x7f0000004fa0), 0x0, &(0x7f0000002d30)}}], 0x1, 0x0)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f00000000c0)={"d202b999cf85000000000088f301e710"})
r0 = syz_open_dev$tun(&(0x7f0000000280)='/dev/net/tun\x00', 0x0, 0x400200)
r1 = socket(0x11, 0x100000802, 0x0)
r2 = syz_open_dev$tun(&(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000000c0)={'ifb0\x00', 0x1001})
ioctl$TUNSETLINK(r2, 0x400454cd, 0x308)
ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000040)={'ifb0\x00', 0xa201})
r3 = dup2(r0, 0xffffffffffffffff)
ioctl$TUNSETQUEUE(0xffffffffffffffff, 0x400454d9, &(0x7f0000000000)={'vlan0\x00'})
write$cgroup_subtree(r3, &(0x7f00000001c0)={[{0x0, 'cpu', 0x20}, {0x0, 'pids', 0x20}, {0x2d, 'pids', 0x20}, {0x2b, 'pids', 0x20}, {0x0, 'memory', 0x20}]}, 0x1f)
connect$unix(r1, &(0x7f0000000100)=@abs, 0x6e)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)

2018/03/29 19:07:54 executing program 6:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
r1 = mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x7c, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @increfs_done={0x40106308, r1, 0x3}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r2 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r3, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
keyctl$assume_authority(0x10, 0x0)
r4 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r4, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(r4, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x200, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6c8344f9f96ef2c7fe911c01908", 0x5c, 0x0, &(0x7f0000000040)={0x77359400})
add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0e9467edd7f398f", 0x1c, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, 0x0, &(0x7f00000006c0)=[{&(0x7f0000000400)}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r5 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(0xffffffffffffffff, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000080)={0x0, 0x0, &(0x7f000000dff8), 0x0, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{}], 0x1, 0x0)

[ 1535.530411] binder: 17991:17995 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1535.532749] binder: BINDER_SET_CONTEXT_MGR already set
[ 1535.532757] binder: 17989:17994 ioctl 40046207 0 returned -16
[ 1535.543003] binder: 17989:17994 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1535.604577] binder: BINDER_SET_CONTEXT_MGR already set
[ 1535.604584] binder: 17999:18000 ioctl 40046207 0 returned -16
[ 1535.615816] binder: BINDER_SET_CONTEXT_MGR already set
[ 1535.615823] binder: 18002:18005 ioctl 40046207 0 returned -16
2018/03/29 19:07:54 executing program 4:
add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={0x73, 0x79, 0x7a}, &(0x7f0000001100)="a1", 0x1, 0xfffffffffffffffb)
perf_event_open(&(0x7f000025c000)={0x2, 0x78}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
pipe2(&(0x7f0000000180), 0x0)
socket(0x18, 0x0, 0x1)
sendmmsg(0xffffffffffffffff, &(0x7f0000000200)=[{{&(0x7f0000003000)=@rc={0x1f}, 0x80, &(0x7f0000004fa0), 0x0, &(0x7f0000002d30)}}], 0x1, 0x0)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f00000000c0)={"d202b999cf85000000000088f301e710"})
r0 = syz_open_dev$tun(&(0x7f0000000280)='/dev/net/tun\x00', 0x0, 0x400200)
r1 = socket(0x11, 0x100000802, 0x0)
r2 = syz_open_dev$tun(&(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000000c0)={'ifb0\x00', 0x1001})
ioctl$TUNSETLINK(r2, 0x400454cd, 0x308)
ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000040)={'ifb0\x00', 0xa201})
r3 = dup2(r0, 0xffffffffffffffff)
ioctl$TUNSETQUEUE(0xffffffffffffffff, 0x400454d9, &(0x7f0000000000)={'vlan0\x00'})
write$cgroup_subtree(0xffffffffffffffff, &(0x7f00000001c0)={[{0x2d, 'pids', 0x20}, {0x0, 'cpu', 0x20}, {0x2d, 'pids', 0x20}, {0x2b, 'rdma', 0x20}, {0x0, 'pids', 0x20}, {0x0, 'io', 0x20}]}, 0x21)
connect$unix(0xffffffffffffffff, &(0x7f0000000100)=@abs, 0x6e)
ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82)

2018/03/29 19:07:54 executing program 3:
add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={0x73, 0x79, 0x7a}, &(0x7f0000001100)="a1", 0x1, 0xfffffffffffffffb)
perf_event_open(&(0x7f000025c000)={0x2, 0x78}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sendmmsg(0xffffffffffffffff, &(0x7f0000000200), 0x0, 0x0)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f00000000c0)={"d202b999cf85000000000088f301e710"})
r0 = syz_open_dev$tun(&(0x7f0000000280)='/dev/net/tun\x00', 0x0, 0x400200)
r1 = socket(0x11, 0x100000802, 0x0)
r2 = syz_open_dev$tun(&(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000000c0)={'ifb0\x00', 0x1001})
ioctl$TUNSETLINK(r2, 0x400454cd, 0x308)
ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000040)={'ifb0\x00', 0xa201})
r3 = dup2(r0, 0xffffffffffffffff)
ioctl$TUNSETQUEUE(0xffffffffffffffff, 0x400454d9, &(0x7f0000000000)={'vlan0\x00'})
write$cgroup_subtree(r3, &(0x7f00000001c0)={[{0x0, 'pids', 0x20}, {0x0, 'cpu', 0x20}, {0x2d, 'pids', 0x20}, {0x2b, 'rdma', 0x20}, {0x2b, 'pids', 0x20}, {0x0, 'memory', 0x20}]}, 0x25)
connect$unix(0xffffffffffffffff, &(0x7f0000000100)=@abs, 0x6e)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)

2018/03/29 19:07:54 executing program 7:
add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={0x73, 0x79, 0x7a}, &(0x7f0000001100)="a1", 0x1, 0xfffffffffffffffb)
sendmmsg(0xffffffffffffffff, &(0x7f0000000200)=[{{&(0x7f0000003000)=@rc={0x1f}, 0x80, &(0x7f0000004fa0), 0x0, &(0x7f0000002d30)}}], 0x1, 0x0)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f00000000c0)={"d202b999cf85000000000088f301e710"})
r0 = syz_open_dev$tun(&(0x7f0000000280)='/dev/net/tun\x00', 0x0, 0x400200)
r1 = socket(0x11, 0x100000802, 0x0)
r2 = syz_open_dev$tun(&(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000000c0)={'ifb0\x00', 0x1001})
ioctl$TUNSETLINK(r2, 0x400454cd, 0x308)
ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000040)={'ifb0\x00', 0xa201})
r3 = dup2(0xffffffffffffffff, 0xffffffffffffffff)
ioctl$TUNSETQUEUE(0xffffffffffffffff, 0x400454d9, &(0x7f0000000000)={'vlan0\x00'})
write$cgroup_subtree(r3, &(0x7f00000001c0)={[{0x0, 'cpu', 0x20}, {0x0, 'pids', 0x20}, {0x0, 'cpu', 0x20}, {0x2d, 'pids', 0x20}, {0x2b, 'pids', 0x20}, {0x0, 'memory', 0x20}]}, 0x24)
connect$unix(r1, &(0x7f0000000100)=@abs, 0x6e)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)

[ 1535.616583] binder: 17999:18000 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1535.619964] binder: 18002:18005 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1535.630377] binder: BINDER_SET_CONTEXT_MGR already set
[ 1535.630383] binder: 18001:18004 ioctl 40046207 0 returned -16
[ 1535.637135] binder: BINDER_SET_CONTEXT_MGR already set
2018/03/29 19:07:54 executing program 0:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
r1 = mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x7c, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @increfs_done={0x40106308, r1, 0x3}, @increfs={0x40046304}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r2 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r3, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
keyctl$assume_authority(0x10, 0x0)
r4 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r4, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(0xffffffffffffffff, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x0, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6c8344f9f96ef2c7fe911c01908", 0x5c, 0x0, &(0x7f0000000040)={0x77359400})
r5 = add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0e9467edd", 0x19, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, r5, &(0x7f00000006c0)=[{&(0x7f0000000400)}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r6 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(r0, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x32b, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r6}], 0x1, 0x0)

2018/03/29 19:07:54 executing program 2:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x70, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @release={0x40046306, 0x1}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r1 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
r2 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r2, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
r3 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r3, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(r3, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x200, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6c8344f9f96ef2c7fe911c019080e", 0x5d, 0x0, &(0x7f0000000040)={0x77359400})
r4 = add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180", 0xe, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, r4, &(0x7f00000006c0)=[{&(0x7f0000000400)="f916b8f72c29a4ed654ec4634d479b3453a0dbdd444019513f1d25ccda2381b9d22363dbeef5a27f13994695211b14422a35c08f7510fa", 0x37}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r5 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(r0, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x32b, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r5}], 0x1, 0x0)

[ 1535.637142] binder: 18003:18006 ioctl 40046207 0 returned -16
[ 1535.688679] binder: BINDER_SET_CONTEXT_MGR already set
[ 1535.688686] binder: 18007:18008 ioctl 40046207 0 returned -16
[ 1535.695937] binder: 18007:18008 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1535.698825] binder: BINDER_SET_CONTEXT_MGR already set
[ 1535.698832] binder: 18009:18010 ioctl 40046207 0 returned -16
[ 1535.959673] binder: BINDER_SET_CONTEXT_MGR already set
[ 1535.959682] binder: 18014:18018 ioctl 40046207 0 returned -16
2018/03/29 19:07:54 executing program 5:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
r1 = mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x7c, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @increfs_done={0x40106308, r1, 0x3}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r2 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r3, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
keyctl$assume_authority(0x10, 0x0)
r4 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r4, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(r4, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x200, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6c834", 0x51, 0x0, &(0x7f0000000040)={0x77359400})
r5 = add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0e9467edd7f398f", 0x1c, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, r5, &(0x7f00000006c0)=[{&(0x7f0000000400)}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r6 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(0xffffffffffffffff, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000080)={0x0, 0x0, &(0x7f000000dff8), 0x0, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r6}], 0x1, 0x0)

2018/03/29 19:07:54 executing program 6:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
r1 = mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x7c, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @increfs_done={0x40106308, r1, 0x3}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r2 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r3, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
keyctl$assume_authority(0x10, 0x0)
r4 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r4, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(r4, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x200, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6c8344f9f96ef2c7fe911c01908", 0x5c, 0x0, &(0x7f0000000040)={0x77359400})
add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0e9467edd7f398f", 0x1c, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, 0x0, &(0x7f00000006c0)=[{&(0x7f0000000400)}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r5 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(0xffffffffffffffff, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000080)={0x0, 0x0, &(0x7f000000dff8), 0x0, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{}], 0x1, 0x0)

2018/03/29 19:07:54 executing program 2:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x70, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @release={0x40046306, 0x1}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r1 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
r2 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r2, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
r3 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r3, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(r3, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x200, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6c8344f9f96ef2c7fe911c019080e", 0x5d, 0x0, &(0x7f0000000040)={0x77359400})
r4 = add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180", 0xe, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, r4, &(0x7f00000006c0)=[{&(0x7f0000000400)="f916b8f72c29a4ed654ec4634d479b3453a0dbdd444019513f1d25ccda2381b9d22363dbeef5a27f13994695211b14422a35c08f7510fa", 0x37}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r5 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(r0, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x32b, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r5}], 0x1, 0x0)

[ 1535.962802] binder: BINDER_SET_CONTEXT_MGR already set
[ 1535.962810] binder: 18012:18019 ioctl 40046207 0 returned -16
[ 1535.970365] binder: BINDER_SET_CONTEXT_MGR already set
[ 1535.970371] binder: 18011:18024 ioctl 40046207 0 returned -16
[ 1535.974727] binder: 18012:18019 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
2018/03/29 19:07:54 executing program 5:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
r1 = mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x7c, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @increfs_done={0x40106308, r1, 0x3}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r2 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r3, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
keyctl$assume_authority(0x10, 0x0)
r4 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r4, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(r4, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x200, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6c834", 0x51, 0x0, &(0x7f0000000040)={0x77359400})
r5 = add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0e9467edd7f398f", 0x1c, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, r5, &(0x7f00000006c0)=[{&(0x7f0000000400)}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r6 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(0xffffffffffffffff, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000080)={0x0, 0x0, &(0x7f000000dff8), 0x0, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r6}], 0x1, 0x0)

2018/03/29 19:07:54 executing program 0:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
r1 = mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x7c, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @increfs_done={0x40106308, r1, 0x3}, @increfs={0x40046304}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r2 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r3, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
keyctl$assume_authority(0x10, 0x0)
r4 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r4, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(0xffffffffffffffff, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x0, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6c8344f9f96ef2c7fe911c01908", 0x5c, 0x0, &(0x7f0000000040)={0x77359400})
r5 = add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0e9467edd", 0x19, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, r5, &(0x7f00000006c0)=[{&(0x7f0000000400)}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r6 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(r0, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x32b, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r6}], 0x1, 0x0)

2018/03/29 19:07:54 executing program 6:
add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={0x73, 0x79, 0x7a}, &(0x7f0000001100)="a1", 0x1, 0xfffffffffffffffb)
sendmmsg(0xffffffffffffffff, &(0x7f0000000200)=[{{&(0x7f0000003000)=@rc={0x1f}, 0x80, &(0x7f0000004fa0), 0x0, &(0x7f0000002d30)}}], 0x1, 0x0)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f00000000c0)={"d202b999cf85000000000088f301e710"})
syz_open_dev$tun(&(0x7f0000000280)='/dev/net/tun\x00', 0x0, 0x400200)
r0 = socket(0x11, 0x100000802, 0x0)
r1 = syz_open_dev$tun(&(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'ifb0\x00', 0x1001})
ioctl$TUNSETLINK(r1, 0x400454cd, 0x308)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000040)={'ifb0\x00', 0xa201})
r2 = dup2(0xffffffffffffffff, 0xffffffffffffffff)
ioctl$TUNSETQUEUE(0xffffffffffffffff, 0x400454d9, &(0x7f0000000000)={'vlan0\x00'})
write$cgroup_subtree(r2, &(0x7f00000001c0)={[{0x0, 'cpu', 0x20}, {0x0, 'pids', 0x20}, {0x0, 'cpu', 0x20}, {0x2d, 'pids', 0x20}, {0x2b, 'pids', 0x20}, {0x0, 'memory', 0x20}]}, 0x24)
connect$unix(r0, &(0x7f0000000100)=@abs, 0x6e)
ioctl$LOOP_CTL_GET_FREE(r2, 0x4c82)

[ 1535.976163] binder: 18014:18018 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1535.977183] binder: BINDER_SET_CONTEXT_MGR already set
[ 1535.977190] binder: 18015:18022 ioctl 40046207 0 returned -16
[ 1536.054521] binder: BINDER_SET_CONTEXT_MGR already set
[ 1536.054529] binder: 18032:18035 ioctl 40046207 0 returned -16
[ 1536.058024] binder: 18032:18035 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1536.059795] binder: BINDER_SET_CONTEXT_MGR already set
[ 1536.059803] binder: 18030:18033 ioctl 40046207 0 returned -16
[ 1536.061195] binder: BINDER_SET_CONTEXT_MGR already set
[ 1536.061201] binder: 18034:18036 ioctl 40046207 0 returned -16
[ 1536.063082] binder: BINDER_SET_CONTEXT_MGR already set
[ 1536.063088] binder: 18031:18037 ioctl 40046207 0 returned -16
[ 1536.072839] binder: 18031:18037 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1536.370075] binder: BINDER_SET_CONTEXT_MGR already set
[ 1536.370084] binder: 18040:18046 ioctl 40046207 0 returned -16
[ 1536.373254] binder: BINDER_SET_CONTEXT_MGR already set
[ 1536.373262] binder: 18038:18047 ioctl 40046207 0 returned -16
[ 1536.374038] binder: BINDER_SET_CONTEXT_MGR already set
[ 1536.374046] binder: 18039:18050 ioctl 40046207 0 returned -16
[ 1536.376599] binder: BINDER_SET_CONTEXT_MGR already set
[ 1536.376606] binder: 18041:18052 ioctl 40046207 0 returned -16
[ 1536.382956] binder: 18040:18046 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1536.392424] binder: 18039:18050 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1536.447167] binder: BINDER_SET_CONTEXT_MGR already set
[ 1536.447174] binder: 18059:18060 ioctl 40046207 0 returned -16
[ 1536.451235] binder: 18059:18060 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1536.453156] binder: BINDER_SET_CONTEXT_MGR already set
[ 1536.453163] binder: 18058:18061 ioctl 40046207 0 returned -16
[ 1536.462219] binder: BINDER_SET_CONTEXT_MGR already set
[ 1536.462226] binder: 18063:18064 ioctl 40046207 0 returned -16
[ 1536.484484] binder: BINDER_SET_CONTEXT_MGR already set
[ 1536.484492] binder: 18062:18065 ioctl 40046207 0 returned -16
[ 1536.488866] binder: 18062:18065 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1536.496435] binder: BINDER_SET_CONTEXT_MGR already set
[ 1536.496442] binder: 18067:18068 ioctl 40046207 0 returned -16
[ 1536.499250] binder: BINDER_SET_CONTEXT_MGR already set
[ 1536.499257] binder: 18066:18069 ioctl 40046207 0 returned -16
[ 1536.500332] binder: 18067:18068 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1536.547595] binder: BINDER_SET_CONTEXT_MGR already set
[ 1536.547603] binder: 18070:18071 ioctl 40046207 0 returned -16
[ 1536.547832] binder: BINDER_SET_CONTEXT_MGR already set
[ 1536.547838] binder: 18073:18075 ioctl 40046207 0 returned -16
[ 1536.549108] binder: BINDER_SET_CONTEXT_MGR already set
[ 1536.549115] binder: 18072:18074 ioctl 40046207 0 returned -16
[ 1536.557265] binder: 18072:18074 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1536.824674] binder: BINDER_SET_CONTEXT_MGR already set
[ 1536.824682] binder: 18076:18089 ioctl 40046207 0 returned -16
[ 1536.824976] binder: BINDER_SET_CONTEXT_MGR already set
[ 1536.824983] binder: 18077:18083 ioctl 40046207 0 returned -16
[ 1536.828374] binder: BINDER_SET_CONTEXT_MGR already set
[ 1536.828382] binder: 18080:18088 ioctl 40046207 0 returned -16
[ 1536.832117] binder: BINDER_SET_CONTEXT_MGR already set
[ 1536.832124] binder: 18078:18090 ioctl 40046207 0 returned -16
[ 1536.846004] binder: 18080:18088 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1536.846129] binder: 18078:18090 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1536.897974] binder: BINDER_SET_CONTEXT_MGR already set
[ 1536.897984] binder: 18096:18097 ioctl 40046207 0 returned -16
[ 1536.927445] binder: BINDER_SET_CONTEXT_MGR already set
[ 1536.927452] binder: 18099:18100 ioctl 40046207 0 returned -16
[ 1536.935186] binder: 18099:18100 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1536.936607] binder: BINDER_SET_CONTEXT_MGR already set
[ 1536.936614] binder: 18098:18102 ioctl 40046207 0 returned -16
[ 1536.947274] binder: BINDER_SET_CONTEXT_MGR already set
[ 1536.947281] binder: 18101:18103 ioctl 40046207 0 returned -16
[ 1536.958568] binder: 18101:18103 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1536.963521] binder: BINDER_SET_CONTEXT_MGR already set
[ 1536.963527] binder: 18104:18105 ioctl 40046207 0 returned -16
[ 1536.998304] binder: BINDER_SET_CONTEXT_MGR already set
[ 1536.998312] binder: 18106:18107 ioctl 40046207 0 returned -16
[ 1537.002232] binder: 18106:18107 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1537.023237] binder: BINDER_SET_CONTEXT_MGR already set
[ 1537.023245] binder: 18108:18109 ioctl 40046207 0 returned -16
[ 1537.034439] binder: BINDER_SET_CONTEXT_MGR already set
[ 1537.034446] binder: 18110:18112 ioctl 40046207 0 returned -16
2018/03/29 19:07:54 executing program 2:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x70, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @release={0x40046306, 0x1}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r1 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
r2 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r2, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
r3 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r3, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(r3, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x200, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6c8344f9f96ef2c7fe911c019080e", 0x5d, 0x0, &(0x7f0000000040)={0x77359400})
r4 = add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180", 0xe, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, r4, &(0x7f00000006c0)=[{&(0x7f0000000400)="f916b8f72c29a4ed654ec4634d479b3453a0dbdd444019513f1d25ccda2381b9d22363dbeef5a27f13994695211b14422a35c08f7510fa", 0x37}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r5 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(r0, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x32b, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r5}], 0x1, 0x0)

2018/03/29 19:07:54 executing program 3:
add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={0x73, 0x79, 0x7a}, &(0x7f0000001100)="a1", 0x1, 0xfffffffffffffffb)
perf_event_open(&(0x7f000025c000)={0x2, 0x78}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sendmmsg(0xffffffffffffffff, &(0x7f0000000200), 0x0, 0x0)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f00000000c0)={"d202b999cf85000000000088f301e710"})
r0 = syz_open_dev$tun(&(0x7f0000000280)='/dev/net/tun\x00', 0x0, 0x400200)
r1 = socket(0x11, 0x100000802, 0x0)
r2 = syz_open_dev$tun(&(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000000c0)={'ifb0\x00', 0x1001})
ioctl$TUNSETLINK(r2, 0x400454cd, 0x308)
ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000040)={'ifb0\x00', 0xa201})
r3 = dup2(r0, 0xffffffffffffffff)
ioctl$TUNSETQUEUE(0xffffffffffffffff, 0x400454d9, &(0x7f0000000000)={'vlan0\x00'})
write$cgroup_subtree(r3, &(0x7f00000001c0)={[{0x0, 'pids', 0x20}, {0x0, 'cpu', 0x20}, {0x2d, 'pids', 0x20}, {0x2b, 'rdma', 0x20}, {0x2b, 'pids', 0x20}, {0x0, 'memory', 0x20}]}, 0x25)
connect$unix(0xffffffffffffffff, &(0x7f0000000100)=@abs, 0x6e)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)

2018/03/29 19:07:54 executing program 0:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
r1 = mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x7c, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @increfs_done={0x40106308, r1, 0x3}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r2 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r3, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
keyctl$assume_authority(0x10, 0x0)
r4 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r4, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(0xffffffffffffffff, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x0, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6c8344f9f96ef2c7fe911c01908", 0x5c, 0x0, &(0x7f0000000040)={0x77359400})
r5 = add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0e9467edd", 0x19, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, r5, &(0x7f00000006c0)=[{&(0x7f0000000400)}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r6 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(r0, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x32b, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r6}], 0x1, 0x0)

2018/03/29 19:07:54 executing program 5:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
r1 = mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x7c, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @increfs_done={0x40106308, r1, 0x3}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r2 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r3, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
keyctl$assume_authority(0x10, 0x0)
r4 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r4, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(r4, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x200, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6c834", 0x51, 0x0, &(0x7f0000000040)={0x77359400})
r5 = add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0e9467edd7f398f", 0x1c, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, 0x0, &(0x7f00000006c0)=[{&(0x7f0000000400)}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r6 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(0xffffffffffffffff, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000080)={0x0, 0x0, &(0x7f000000dff8), 0x0, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r6}], 0x1, 0x0)

2018/03/29 19:07:54 executing program 7:
add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={0x73, 0x79, 0x7a}, &(0x7f0000001100)="a1", 0x1, 0xfffffffffffffffb)
sendmmsg(0xffffffffffffffff, &(0x7f0000000200)=[{{&(0x7f0000003000)=@rc={0x1f}, 0x80, &(0x7f0000004fa0), 0x0, &(0x7f0000002d30)}}], 0x1, 0x0)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f00000000c0)={"d202b999cf85000000000088f301e710"})
r0 = syz_open_dev$tun(&(0x7f0000000280)='/dev/net/tun\x00', 0x0, 0x400200)
r1 = socket(0x11, 0x100000802, 0x0)
r2 = syz_open_dev$tun(&(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000000c0)={'ifb0\x00', 0x1001})
ioctl$TUNSETLINK(r2, 0x400454cd, 0x308)
ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000040)={'ifb0\x00', 0xa201})
r3 = dup2(r0, 0xffffffffffffffff)
ioctl$TUNSETQUEUE(0xffffffffffffffff, 0x400454d9, &(0x7f0000000000)={'vlan0\x00'})
write$cgroup_subtree(0xffffffffffffffff, &(0x7f00000001c0)={[{0x0, 'cpu', 0x20}, {0x0, 'pids', 0x20}, {0x0, 'cpu', 0x20}, {0x2d, 'pids', 0x20}, {0x2b, 'pids', 0x20}, {0x0, 'memory', 0x20}]}, 0x24)
connect$unix(r1, &(0x7f0000000100)=@abs, 0x6e)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)

2018/03/29 19:07:54 executing program 4:
add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={0x73, 0x79, 0x7a}, &(0x7f0000001100)="a1", 0x1, 0xfffffffffffffffb)
perf_event_open(&(0x7f000025c000)={0x2, 0x78}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
pipe2(&(0x7f0000000180), 0x0)
socket(0x18, 0x0, 0x1)
sendmmsg(0xffffffffffffffff, &(0x7f0000000200)=[{{&(0x7f0000003000)=@rc={0x1f}, 0x80, &(0x7f0000004fa0), 0x0, &(0x7f0000002d30)}}], 0x1, 0x0)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f00000000c0)={"d202b999cf85000000000088f301e710"})
r0 = syz_open_dev$tun(&(0x7f0000000280)='/dev/net/tun\x00', 0x0, 0x400200)
r1 = socket(0x11, 0x100000802, 0x0)
r2 = syz_open_dev$tun(&(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000000c0)={'ifb0\x00', 0x1001})
ioctl$TUNSETLINK(r2, 0x400454cd, 0x308)
ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000040)={'ifb0\x00', 0xa201})
r3 = dup2(r0, 0xffffffffffffffff)
ioctl$TUNSETQUEUE(0xffffffffffffffff, 0x400454d9, &(0x7f0000000000)={'vlan0\x00'})
write$cgroup_subtree(0xffffffffffffffff, &(0x7f00000001c0)={[{0x2d, 'pids', 0x20}, {0x0, 'cpu', 0x20}, {0x2d, 'pids', 0x20}, {0x2b, 'rdma', 0x20}, {0x0, 'pids', 0x20}, {0x0, 'io', 0x20}]}, 0x21)
connect$unix(0xffffffffffffffff, &(0x7f0000000100)=@abs, 0x6e)
ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82)

2018/03/29 19:07:54 executing program 6:
add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={0x73, 0x79, 0x7a}, &(0x7f0000001100)="a1", 0x1, 0xfffffffffffffffb)
sendmmsg(0xffffffffffffffff, &(0x7f0000000200)=[{{&(0x7f0000003000)=@rc={0x1f}, 0x80, &(0x7f0000004fa0), 0x0, &(0x7f0000002d30)}}], 0x1, 0x0)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f00000000c0)={"d202b999cf85000000000088f301e710"})
syz_open_dev$tun(&(0x7f0000000280)='/dev/net/tun\x00', 0x0, 0x400200)
r0 = socket(0x11, 0x100000802, 0x0)
r1 = syz_open_dev$tun(&(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'ifb0\x00', 0x1001})
ioctl$TUNSETLINK(r1, 0x400454cd, 0x308)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000040)={'ifb0\x00', 0xa201})
r2 = dup2(0xffffffffffffffff, 0xffffffffffffffff)
ioctl$TUNSETQUEUE(0xffffffffffffffff, 0x400454d9, &(0x7f0000000000)={'vlan0\x00'})
write$cgroup_subtree(r2, &(0x7f00000001c0)={[{0x0, 'cpu', 0x20}, {0x0, 'pids', 0x20}, {0x0, 'cpu', 0x20}, {0x2d, 'pids', 0x20}, {0x2b, 'pids', 0x20}, {0x0, 'memory', 0x20}]}, 0x24)
connect$unix(r0, &(0x7f0000000100)=@abs, 0x6e)
ioctl$LOOP_CTL_GET_FREE(r2, 0x4c82)

2018/03/29 19:07:54 executing program 1:
add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={0x73, 0x79, 0x7a}, &(0x7f0000001100)="a1", 0x1, 0xfffffffffffffffb)
perf_event_open(&(0x7f000025c000)={0x0, 0x78}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sendmmsg(0xffffffffffffffff, &(0x7f0000000200)=[{{&(0x7f0000003000)=@rc={0x1f}, 0x80, &(0x7f0000004fa0), 0x0, &(0x7f0000002d30)}}], 0x1, 0x0)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f00000000c0)={"d202b999cf85000000000088f301e710"})
r0 = syz_open_dev$tun(&(0x7f0000000280)='/dev/net/tun\x00', 0x0, 0x400200)
r1 = socket(0x11, 0x100000802, 0x0)
r2 = syz_open_dev$tun(&(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000000c0)={'ifb0\x00', 0x1001})
ioctl$TUNSETLINK(r2, 0x400454cd, 0x308)
ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000040)={'ifb0\x00', 0xa201})
r3 = dup2(r0, 0xffffffffffffffff)
ioctl$TUNSETQUEUE(0xffffffffffffffff, 0x400454d9, &(0x7f0000000000)={'vlan0\x00'})
write$cgroup_subtree(r3, &(0x7f00000001c0)={[{0x0, 'cpu', 0x20}, {0x0, 'pids', 0x20}, {0x2d, 'pids', 0x20}, {0x2b, 'pids', 0x20}, {0x0, 'memory', 0x20}]}, 0x1f)
connect$unix(r1, &(0x7f0000000100)=@abs, 0x6e)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)

[ 1537.046649] binder: BINDER_SET_CONTEXT_MGR already set
[ 1537.046656] binder: 18111:18113 ioctl 40046207 0 returned -16
[ 1537.050030] binder: 18111:18113 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1537.226169] binder: BINDER_SET_CONTEXT_MGR already set
[ 1537.226178] binder: 18115:18117 ioctl 40046207 0 returned -16
[ 1537.226927] binder: BINDER_SET_CONTEXT_MGR already set
[ 1537.226933] binder: 18116:18118 ioctl 40046207 0 returned -16
[ 1537.235704] binder: BINDER_SET_CONTEXT_MGR already set
[ 1537.235711] binder: 18121:18126 ioctl 40046207 0 returned -16
[ 1537.236020] binder: BINDER_SET_CONTEXT_MGR already set
[ 1537.236026] binder: 18114:18127 ioctl 40046207 0 returned -16
[ 1537.252170] binder: 18114:18127 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
2018/03/29 19:07:54 executing program 0:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
r1 = mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x7c, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @increfs_done={0x40106308, r1, 0x3}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r2 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r3, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
keyctl$assume_authority(0x10, 0x0)
r4 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r4, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(0xffffffffffffffff, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x0, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6c8344f9f96ef2c7fe911c01908", 0x5c, 0x0, &(0x7f0000000040)={0x77359400})
r5 = add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0e9467edd", 0x19, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, r5, &(0x7f00000006c0)=[{&(0x7f0000000400)}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r6 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(r0, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x32b, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r6}], 0x1, 0x0)

2018/03/29 19:07:54 executing program 5:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
r1 = mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x7c, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @increfs_done={0x40106308, r1, 0x3}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r2 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r3, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
keyctl$assume_authority(0x10, 0x0)
r4 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r4, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(r4, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x200, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6c834", 0x51, 0x0, &(0x7f0000000040)={0x77359400})
r5 = add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0e9467edd7f398f", 0x1c, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, 0x0, &(0x7f00000006c0)=[{&(0x7f0000000400)}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r6 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(0xffffffffffffffff, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000080)={0x0, 0x0, &(0x7f000000dff8), 0x0, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r6}], 0x1, 0x0)

2018/03/29 19:07:54 executing program 2:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x70, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @release={0x40046306, 0x1}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r1 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
r2 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r2, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
r3 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r3, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(r3, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x200, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6c8344f9f96ef2c7fe911c019080e", 0x5d, 0x0, &(0x7f0000000040)={0x77359400})
r4 = add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0", 0x15, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, r4, &(0x7f00000006c0)=[{&(0x7f0000000400)="f916b8f72c29a4ed654ec4634d479b3453a0dbdd444019513f1d25ccda2381b9d22363dbeef5a27f13994695211b14422a35c08f7510fa", 0x37}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r5 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(r0, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x32b, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r5}], 0x1, 0x0)

[ 1537.254367] binder: 18121:18126 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1537.293206] binder: BINDER_SET_CONTEXT_MGR already set
[ 1537.293213] binder: 18132:18133 ioctl 40046207 0 returned -16
[ 1537.322866] binder: BINDER_SET_CONTEXT_MGR already set
[ 1537.322873] binder: 18135:18139 ioctl 40046207 0 returned -16
[ 1537.325672] binder: BINDER_SET_CONTEXT_MGR already set
2018/03/29 19:07:55 executing program 0:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
r1 = mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x7c, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @increfs_done={0x40106308, r1, 0x3}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r2 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r3, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
keyctl$assume_authority(0x10, 0x0)
r4 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r4, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(0xffffffffffffffff, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x0, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6c8344f9f96ef2c7fe911c01908", 0x5c, 0x0, &(0x7f0000000040)={0x77359400})
r5 = add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0e9467edd", 0x19, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, r5, &(0x7f00000006c0)=[{&(0x7f0000000400)}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r6 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(r0, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x32b, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r6}], 0x1, 0x0)

2018/03/29 19:07:55 executing program 2:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x70, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @release={0x40046306, 0x1}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r1 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
r2 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r2, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
r3 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r3, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(r3, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x200, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6c8344f9f96ef2c7fe911c019080e", 0x5d, 0x0, &(0x7f0000000040)={0x77359400})
r4 = add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0", 0x15, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, r4, &(0x7f00000006c0)=[{&(0x7f0000000400)="f916b8f72c29a4ed654ec4634d479b3453a0dbdd444019513f1d25ccda2381b9d22363dbeef5a27f13994695211b14422a35c08f7510fa", 0x37}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r5 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(r0, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x32b, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r5}], 0x1, 0x0)

[ 1537.325678] binder: 18137:18140 ioctl 40046207 0 returned -16
[ 1537.332988] binder: BINDER_SET_CONTEXT_MGR already set
[ 1537.332995] binder: 18136:18138 ioctl 40046207 0 returned -16
[ 1537.334288] binder: 18135:18139 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1537.337067] binder: 18136:18138 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1537.350069] binder: BINDER_SET_CONTEXT_MGR already set
2018/03/29 19:07:55 executing program 5:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
r1 = mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x7c, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @increfs_done={0x40106308, r1, 0x3}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r2 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r3, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
keyctl$assume_authority(0x10, 0x0)
r4 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r4, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(r4, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x200, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6c834", 0x51, 0x0, &(0x7f0000000040)={0x77359400})
r5 = add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0e9467edd7f398f", 0x1c, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, 0x0, &(0x7f00000006c0)=[{&(0x7f0000000400)}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r6 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(0xffffffffffffffff, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000080)={0x0, 0x0, &(0x7f000000dff8), 0x0, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r6}], 0x1, 0x0)

2018/03/29 19:07:55 executing program 0:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
r1 = mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x7c, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @increfs_done={0x40106308, r1, 0x3}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x10, &(0x7f00000000c0), &(0x7f0000000100)=[0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r2 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r3, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
keyctl$assume_authority(0x10, 0x0)
r4 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r4, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(0xffffffffffffffff, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x0, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6c8344f9f96ef2c7fe911c01908", 0x5c, 0x0, &(0x7f0000000040)={0x77359400})
r5 = add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0e9467edd", 0x19, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, r5, &(0x7f00000006c0)=[{&(0x7f0000000400)}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r6 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(r0, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x32b, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r6}], 0x1, 0x0)

[ 1537.350076] binder: 18142:18143 ioctl 40046207 0 returned -16
[ 1537.425067] binder: BINDER_SET_CONTEXT_MGR already set
[ 1537.425075] binder: 18144:18145 ioctl 40046207 0 returned -16
[ 1537.426463] binder: BINDER_SET_CONTEXT_MGR already set
[ 1537.426469] binder: 18147:18148 ioctl 40046207 0 returned -16
[ 1537.428841] binder: 18144:18145 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1537.451470] binder: 18147:18148 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
2018/03/29 19:07:55 executing program 5:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
r1 = mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x7c, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @increfs_done={0x40106308, r1, 0x3}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r2 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r3, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
keyctl$assume_authority(0x10, 0x0)
r4 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r4, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(r4, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x200, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6c834", 0x51, 0x0, &(0x7f0000000040)={0x77359400})
r5 = add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0e9467edd7f398f", 0x1c, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, r5, &(0x7f00000006c0), 0x0, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r6 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(0xffffffffffffffff, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000080)={0x0, 0x0, &(0x7f000000dff8), 0x0, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r6}], 0x1, 0x0)

[ 1537.634455] binder: BINDER_SET_CONTEXT_MGR already set
[ 1537.634463] binder: 18152:18156 ioctl 40046207 0 returned -16
[ 1537.635317] binder: BINDER_SET_CONTEXT_MGR already set
[ 1537.635325] binder: 18153:18158 ioctl 40046207 0 returned -16
[ 1537.639114] binder: BINDER_SET_CONTEXT_MGR already set
[ 1537.639121] binder: 18154:18163 ioctl 40046207 0 returned -16
[ 1537.642473] binder: BINDER_SET_CONTEXT_MGR already set
[ 1537.642480] binder: 18151:18162 ioctl 40046207 0 returned -16
[ 1537.643881] binder: 18152:18156 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1537.651487] binder: 18154:18163 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1537.720816] binder: BINDER_SET_CONTEXT_MGR already set
[ 1537.720823] binder: 18172:18173 ioctl 40046207 0 returned -16
[ 1537.730292] binder: 18172:18173 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1537.732535] binder: BINDER_SET_CONTEXT_MGR already set
[ 1537.732542] binder: 18174:18177 ioctl 40046207 0 returned -16
[ 1537.732587] binder: BINDER_SET_CONTEXT_MGR already set
[ 1537.732593] binder: 18175:18179 ioctl 40046207 0 returned -16
[ 1537.734826] binder: BINDER_SET_CONTEXT_MGR already set
[ 1537.734833] binder: 18176:18178 ioctl 40046207 0 returned -16
[ 1537.740004] binder: 18176:18178 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1537.792079] binder: BINDER_SET_CONTEXT_MGR already set
[ 1537.792087] binder: 18180:18181 ioctl 40046207 0 returned -16
[ 1537.796318] binder: 18180:18181 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1538.000030] binder: BINDER_SET_CONTEXT_MGR already set
[ 1538.000038] binder: 18185:18189 ioctl 40046207 0 returned -16
[ 1538.005407] binder: BINDER_SET_CONTEXT_MGR already set
[ 1538.005414] binder: 18183:18191 ioctl 40046207 0 returned -16
[ 1538.010271] binder: BINDER_SET_CONTEXT_MGR already set
[ 1538.010278] binder: 18182:18195 ioctl 40046207 0 returned -16
[ 1538.012625] binder: BINDER_SET_CONTEXT_MGR already set
[ 1538.012632] binder: 18184:18192 ioctl 40046207 0 returned -16
[ 1538.016543] binder: 18184:18192 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1538.022186] binder: 18183:18191 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1538.097091] binder: BINDER_SET_CONTEXT_MGR already set
[ 1538.097098] binder: 18203:18206 ioctl 40046207 0 returned -16
[ 1538.100957] binder: BINDER_SET_CONTEXT_MGR already set
[ 1538.100964] binder: 18202:18209 ioctl 40046207 0 returned -16
[ 1538.102795] binder: BINDER_SET_CONTEXT_MGR already set
[ 1538.102802] binder: 18205:18207 ioctl 40046207 0 returned -16
[ 1538.105455] binder: BINDER_SET_CONTEXT_MGR already set
[ 1538.105461] binder: 18204:18208 ioctl 40046207 0 returned -16
[ 1538.110369] binder: 18203:18206 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1538.119688] binder: 18204:18208 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1538.166860] binder: BINDER_SET_CONTEXT_MGR already set
[ 1538.166868] binder: 18211:18213 ioctl 40046207 0 returned -16
[ 1538.167527] binder: BINDER_SET_CONTEXT_MGR already set
[ 1538.167533] binder: 18210:18214 ioctl 40046207 0 returned -16
2018/03/29 19:07:55 executing program 2:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x70, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @release={0x40046306, 0x1}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r1 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
r2 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r2, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
r3 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r3, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(r3, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x200, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6c8344f9f96ef2c7fe911c019080e", 0x5d, 0x0, &(0x7f0000000040)={0x77359400})
r4 = add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0", 0x15, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, r4, &(0x7f00000006c0)=[{&(0x7f0000000400)="f916b8f72c29a4ed654ec4634d479b3453a0dbdd444019513f1d25ccda2381b9d22363dbeef5a27f13994695211b14422a35c08f7510fa", 0x37}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r5 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(r0, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x32b, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r5}], 0x1, 0x0)

2018/03/29 19:07:55 executing program 0:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
r1 = mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x7c, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @increfs_done={0x40106308, r1, 0x3}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x10, &(0x7f00000000c0), &(0x7f0000000100)=[0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r2 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r3, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
keyctl$assume_authority(0x10, 0x0)
r4 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r4, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(0xffffffffffffffff, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x0, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6c8344f9f96ef2c7fe911c01908", 0x5c, 0x0, &(0x7f0000000040)={0x77359400})
r5 = add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0e9467edd", 0x19, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, r5, &(0x7f00000006c0)=[{&(0x7f0000000400)}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r6 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(r0, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x32b, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r6}], 0x1, 0x0)

2018/03/29 19:07:55 executing program 5:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
r1 = mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x7c, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @increfs_done={0x40106308, r1, 0x3}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r2 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r3, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
keyctl$assume_authority(0x10, 0x0)
r4 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r4, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(r4, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x200, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6c834", 0x51, 0x0, &(0x7f0000000040)={0x77359400})
r5 = add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0e9467edd7f398f", 0x1c, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, r5, &(0x7f00000006c0), 0x0, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r6 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(0xffffffffffffffff, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000080)={0x0, 0x0, &(0x7f000000dff8), 0x0, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r6}], 0x1, 0x0)

2018/03/29 19:07:55 executing program 1:
add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={0x73, 0x79, 0x7a}, &(0x7f0000001100)="a1", 0x1, 0xfffffffffffffffb)
perf_event_open(&(0x7f000025c000)={0x0, 0x78}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sendmmsg(0xffffffffffffffff, &(0x7f0000000200)=[{{&(0x7f0000003000)=@rc={0x1f}, 0x80, &(0x7f0000004fa0), 0x0, &(0x7f0000002d30)}}], 0x1, 0x0)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f00000000c0)={"d202b999cf85000000000088f301e710"})
r0 = syz_open_dev$tun(&(0x7f0000000280)='/dev/net/tun\x00', 0x0, 0x400200)
r1 = socket(0x11, 0x100000802, 0x0)
r2 = syz_open_dev$tun(&(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000000c0)={'ifb0\x00', 0x1001})
ioctl$TUNSETLINK(r2, 0x400454cd, 0x308)
ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000040)={'ifb0\x00', 0xa201})
r3 = dup2(r0, 0xffffffffffffffff)
ioctl$TUNSETQUEUE(0xffffffffffffffff, 0x400454d9, &(0x7f0000000000)={'vlan0\x00'})
write$cgroup_subtree(r3, &(0x7f00000001c0)={[{0x0, 'cpu', 0x20}, {0x0, 'pids', 0x20}, {0x0, 'cpu', 0x20}, {0x2b, 'pids', 0x20}, {0x0, 'memory', 0x20}]}, 0x1e)
connect$unix(r1, &(0x7f0000000100)=@abs, 0x6e)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)

2018/03/29 19:07:55 executing program 7:
add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={0x73, 0x79, 0x7a}, &(0x7f0000001100)="a1", 0x1, 0xfffffffffffffffb)
sendmmsg(0xffffffffffffffff, &(0x7f0000000200)=[{{&(0x7f0000003000)=@rc={0x1f}, 0x80, &(0x7f0000004fa0), 0x0, &(0x7f0000002d30)}}], 0x1, 0x0)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f00000000c0)={"d202b999cf85000000000088f301e710"})
r0 = syz_open_dev$tun(&(0x7f0000000280)='/dev/net/tun\x00', 0x0, 0x400200)
r1 = socket(0x11, 0x100000802, 0x0)
r2 = syz_open_dev$tun(&(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000000c0)={'ifb0\x00', 0x1001})
ioctl$TUNSETLINK(r2, 0x400454cd, 0x308)
ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000040)={'ifb0\x00', 0xa201})
r3 = dup2(r0, 0xffffffffffffffff)
ioctl$TUNSETQUEUE(0xffffffffffffffff, 0x400454d9, &(0x7f0000000000)={'vlan0\x00'})
write$cgroup_subtree(0xffffffffffffffff, &(0x7f00000001c0)={[{0x0, 'cpu', 0x20}, {0x0, 'pids', 0x20}, {0x0, 'cpu', 0x20}, {0x2d, 'pids', 0x20}, {0x2b, 'pids', 0x20}, {0x0, 'memory', 0x20}]}, 0x24)
connect$unix(r1, &(0x7f0000000100)=@abs, 0x6e)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)

2018/03/29 19:07:55 executing program 3:
add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={0x73, 0x79, 0x7a}, &(0x7f0000001100)="a1", 0x1, 0xfffffffffffffffb)
perf_event_open(&(0x7f000025c000)={0x2, 0x78}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sendmmsg(0xffffffffffffffff, &(0x7f0000000200), 0x0, 0x0)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f00000000c0)={"d202b999cf85000000000088f301e710"})
r0 = syz_open_dev$tun(&(0x7f0000000280)='/dev/net/tun\x00', 0x0, 0x400200)
r1 = socket(0x11, 0x100000802, 0x0)
r2 = syz_open_dev$tun(&(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000000c0)={'ifb0\x00', 0x1001})
ioctl$TUNSETLINK(r2, 0x400454cd, 0x308)
ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000040)={'ifb0\x00', 0xa201})
r3 = dup2(r0, 0xffffffffffffffff)
ioctl$TUNSETQUEUE(0xffffffffffffffff, 0x400454d9, &(0x7f0000000000)={'vlan0\x00'})
write$cgroup_subtree(r3, &(0x7f00000001c0)={[{0x0, 'cpu', 0x20}, {0x0, 'cpu', 0x20}, {0x2d, 'pids', 0x20}, {0x2b, 'rdma', 0x20}, {0x2b, 'pids', 0x20}, {0x0, 'memory', 0x20}]}, 0x24)
connect$unix(0xffffffffffffffff, &(0x7f0000000100)=@abs, 0x6e)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)

2018/03/29 19:07:55 executing program 4:
add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={0x73, 0x79, 0x7a}, &(0x7f0000001100)="a1", 0x1, 0xfffffffffffffffb)
perf_event_open(&(0x7f000025c000)={0x2, 0x78}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
pipe2(&(0x7f0000000180), 0x0)
socket(0x18, 0x0, 0x1)
sendmmsg(0xffffffffffffffff, &(0x7f0000000200)=[{{&(0x7f0000003000)=@rc={0x1f}, 0x80, &(0x7f0000004fa0), 0x0, &(0x7f0000002d30)}}], 0x1, 0x0)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f00000000c0)={"d202b999cf85000000000088f301e710"})
r0 = syz_open_dev$tun(&(0x7f0000000280)='/dev/net/tun\x00', 0x0, 0x400200)
r1 = socket(0x11, 0x100000802, 0x0)
r2 = syz_open_dev$tun(&(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000000c0)={'ifb0\x00', 0x1001})
ioctl$TUNSETLINK(r2, 0x400454cd, 0x308)
ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000040)={'ifb0\x00', 0xa201})
r3 = dup2(r0, 0xffffffffffffffff)
ioctl$TUNSETQUEUE(0xffffffffffffffff, 0x400454d9, &(0x7f0000000000)={'vlan0\x00'})
write$cgroup_subtree(r3, &(0x7f00000001c0)={[{0x0, 'cpu', 0x20}, {0x2d, 'pids', 0x20}, {0x2b, 'rdma', 0x20}, {0x0, 'pids', 0x20}, {0x0, 'io', 0x20}]}, 0x1b)
connect$unix(0xffffffffffffffff, &(0x7f0000000100)=@abs, 0x6e)
ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82)

2018/03/29 19:07:55 executing program 6:
add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={0x73, 0x79, 0x7a}, &(0x7f0000001100)="a1", 0x1, 0xfffffffffffffffb)
sendmmsg(0xffffffffffffffff, &(0x7f0000000200)=[{{&(0x7f0000003000)=@rc={0x1f}, 0x80, &(0x7f0000004fa0), 0x0, &(0x7f0000002d30)}}], 0x1, 0x0)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f00000000c0)={"d202b999cf85000000000088f301e710"})
syz_open_dev$tun(&(0x7f0000000280)='/dev/net/tun\x00', 0x0, 0x400200)
r0 = socket(0x11, 0x100000802, 0x0)
r1 = syz_open_dev$tun(&(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'ifb0\x00', 0x1001})
ioctl$TUNSETLINK(r1, 0x400454cd, 0x308)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000040)={'ifb0\x00', 0xa201})
r2 = dup2(0xffffffffffffffff, 0xffffffffffffffff)
ioctl$TUNSETQUEUE(0xffffffffffffffff, 0x400454d9, &(0x7f0000000000)={'vlan0\x00'})
write$cgroup_subtree(r2, &(0x7f00000001c0)={[{0x0, 'cpu', 0x20}, {0x0, 'pids', 0x20}, {0x0, 'cpu', 0x20}, {0x2d, 'pids', 0x20}, {0x2b, 'pids', 0x20}, {0x0, 'memory', 0x20}]}, 0x24)
connect$unix(r0, &(0x7f0000000100)=@abs, 0x6e)
ioctl$LOOP_CTL_GET_FREE(r2, 0x4c82)

[ 1538.171406] binder: 18210:18214 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1538.173405] binder: 18211:18213 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1538.181252] binder: BINDER_SET_CONTEXT_MGR already set
[ 1538.181259] binder: 18212:18216 ioctl 40046207 0 returned -16
[ 1538.183357] binder: BINDER_SET_CONTEXT_MGR already set
[ 1538.183364] binder: 18215:18217 ioctl 40046207 0 returned -16
[ 1538.224482] binder: BINDER_SET_CONTEXT_MGR already set
[ 1538.224489] binder: 18218:18219 ioctl 40046207 0 returned -16
[ 1538.229457] binder: 18218:18219 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1538.233066] binder: BINDER_SET_CONTEXT_MGR already set
[ 1538.233072] binder: 18220:18221 ioctl 40046207 0 returned -16
[ 1538.236650] binder: 18220:18221 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1538.441296] binder: BINDER_SET_CONTEXT_MGR already set
[ 1538.441304] binder: 18223:18226 ioctl 40046207 0 returned -16
2018/03/29 19:07:55 executing program 2:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x70, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @release={0x40046306, 0x1}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r1 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
r2 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r2, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
r3 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r3, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(r3, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x200, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6c8344f9f96ef2c7fe911c019080e", 0x5d, 0x0, &(0x7f0000000040)={0x77359400})
r4 = add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0e9467edd", 0x19, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, r4, &(0x7f00000006c0)=[{&(0x7f0000000400)="f916b8f72c29a4ed654ec4634d479b3453a0dbdd444019513f1d25ccda2381b9d22363dbeef5a27f13994695211b14422a35c08f7510fa", 0x37}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r5 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(r0, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x32b, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r5}], 0x1, 0x0)

2018/03/29 19:07:55 executing program 5:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
r1 = mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x7c, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @increfs_done={0x40106308, r1, 0x3}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r2 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r3, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
keyctl$assume_authority(0x10, 0x0)
r4 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r4, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(r4, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x200, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6c834", 0x51, 0x0, &(0x7f0000000040)={0x77359400})
r5 = add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0e9467edd7f398f", 0x1c, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, r5, &(0x7f00000006c0), 0x0, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r6 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(0xffffffffffffffff, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000080)={0x0, 0x0, &(0x7f000000dff8), 0x0, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r6}], 0x1, 0x0)

2018/03/29 19:07:55 executing program 0:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
r1 = mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x7c, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @increfs_done={0x40106308, r1, 0x3}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x10, &(0x7f00000000c0), &(0x7f0000000100)=[0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r2 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r3, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
keyctl$assume_authority(0x10, 0x0)
r4 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r4, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(0xffffffffffffffff, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x0, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6c8344f9f96ef2c7fe911c01908", 0x5c, 0x0, &(0x7f0000000040)={0x77359400})
r5 = add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0e9467edd", 0x19, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, r5, &(0x7f00000006c0)=[{&(0x7f0000000400)}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r6 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(r0, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x32b, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r6}], 0x1, 0x0)

[ 1538.445326] binder: 18223:18226 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1538.447411] binder: BINDER_SET_CONTEXT_MGR already set
[ 1538.447418] binder: 18222:18231 ioctl 40046207 0 returned -16
[ 1538.448731] binder: BINDER_SET_CONTEXT_MGR already set
2018/03/29 19:07:55 executing program 0:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
r1 = mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x7c, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @increfs_done={0x40106308, r1, 0x3}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x0, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r2 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r3, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
keyctl$assume_authority(0x10, 0x0)
r4 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r4, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(0xffffffffffffffff, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x0, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6c8344f9f96ef2c7fe911c01908", 0x5c, 0x0, &(0x7f0000000040)={0x77359400})
r5 = add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0e9467edd", 0x19, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, r5, &(0x7f00000006c0)=[{&(0x7f0000000400)}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r6 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(r0, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x32b, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r6}], 0x1, 0x0)

2018/03/29 19:07:55 executing program 2:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x70, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @release={0x40046306, 0x1}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r1 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
r2 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r2, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
r3 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r3, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(r3, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x200, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6c8344f9f96ef2c7fe911c019080e", 0x5d, 0x0, &(0x7f0000000040)={0x77359400})
r4 = add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0e9467edd", 0x19, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, r4, &(0x7f00000006c0)=[{&(0x7f0000000400)="f916b8f72c29a4ed654ec4634d479b3453a0dbdd444019513f1d25ccda2381b9d22363dbeef5a27f13994695211b14422a35c08f7510fa", 0x37}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r5 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(r0, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x32b, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r5}], 0x1, 0x0)

2018/03/29 19:07:55 executing program 5:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
r1 = mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x7c, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @increfs_done={0x40106308, r1, 0x3}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r2 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r3, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
keyctl$assume_authority(0x10, 0x0)
r4 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r4, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(r4, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x200, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6c834", 0x51, 0x0, &(0x7f0000000040)={0x77359400})
r5 = add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0e9467edd7f398f", 0x1c, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, r5, &(0x7f00000006c0)=[{&(0x7f0000000400)}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0], 0x1})
r6 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(0xffffffffffffffff, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000080)={0x0, 0x0, &(0x7f000000dff8), 0x0, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r6}], 0x1, 0x0)

[ 1538.448743] binder: 18224:18227 ioctl 40046207 0 returned -16
[ 1538.452974] binder: BINDER_SET_CONTEXT_MGR already set
[ 1538.452981] binder: 18225:18232 ioctl 40046207 0 returned -16
[ 1538.459393] binder: 18222:18231 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1538.528613] binder: BINDER_SET_CONTEXT_MGR already set
[ 1538.528621] binder: 18243:18244 ioctl 40046207 0 returned -16
[ 1538.531712] binder: BINDER_SET_CONTEXT_MGR already set
[ 1538.531719] binder: 18242:18245 ioctl 40046207 0 returned -16
[ 1538.550127] binder: BINDER_SET_CONTEXT_MGR already set
[ 1538.550134] binder: 18246:18250 ioctl 40046207 0 returned -16
[ 1538.553625] binder: 18246:18250 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1538.563073] binder: BINDER_SET_CONTEXT_MGR already set
[ 1538.563080] binder: 18247:18249 ioctl 40046207 0 returned -16
[ 1538.578966] binder: 18247:18249 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
2018/03/29 19:07:55 executing program 0:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
r1 = mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x7c, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @increfs_done={0x40106308, r1, 0x3}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x0, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r2 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r3, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
keyctl$assume_authority(0x10, 0x0)
r4 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r4, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(0xffffffffffffffff, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x0, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6c8344f9f96ef2c7fe911c01908", 0x5c, 0x0, &(0x7f0000000040)={0x77359400})
r5 = add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0e9467edd", 0x19, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, r5, &(0x7f00000006c0)=[{&(0x7f0000000400)}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r6 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(r0, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x32b, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r6}], 0x1, 0x0)

[ 1538.588098] binder: BINDER_SET_CONTEXT_MGR already set
[ 1538.588105] binder: 18252:18254 ioctl 40046207 0 returned -16
[ 1538.594015] binder: BINDER_SET_CONTEXT_MGR already set
[ 1538.594022] binder: 18253:18255 ioctl 40046207 0 returned -16
[ 1538.898919] binder: BINDER_SET_CONTEXT_MGR already set
[ 1538.898928] binder: 18258:18268 ioctl 40046207 0 returned -16
[ 1538.901228] binder: BINDER_SET_CONTEXT_MGR already set
[ 1538.901235] binder: 18256:18265 ioctl 40046207 0 returned -16
[ 1538.903250] binder: BINDER_SET_CONTEXT_MGR already set
[ 1538.903257] binder: 18259:18266 ioctl 40046207 0 returned -16
[ 1538.911871] binder: 18258:18268 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1538.916760] binder: 18259:18266 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1538.999884] binder: BINDER_SET_CONTEXT_MGR already set
[ 1538.999890] binder: 18273:18274 ioctl 40046207 0 returned -16
[ 1539.003815] binder: BINDER_SET_CONTEXT_MGR already set
[ 1539.003822] binder: 18277:18280 ioctl 40046207 0 returned -16
[ 1539.005711] binder: 18273:18274 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1539.014746] binder: BINDER_SET_CONTEXT_MGR already set
[ 1539.014753] binder: 18279:18283 ioctl 40046207 0 returned -16
[ 1539.019623] binder: 18279:18283 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1539.048379] binder: BINDER_SET_CONTEXT_MGR already set
[ 1539.048386] binder: 18285:18286 ioctl 40046207 0 returned -16
[ 1539.058130] binder: 18285:18286 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1539.104910] binder: BINDER_SET_CONTEXT_MGR already set
[ 1539.104917] binder: 18291:18293 ioctl 40046207 0 returned -16
[ 1539.110528] binder: BINDER_SET_CONTEXT_MGR already set
[ 1539.110534] binder: 18290:18292 ioctl 40046207 0 returned -16
[ 1539.117166] binder: 18291:18293 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1539.257677] binder: BINDER_SET_CONTEXT_MGR already set
[ 1539.257684] binder: 18299:18306 ioctl 40046207 0 returned -16
[ 1539.260540] binder: BINDER_SET_CONTEXT_MGR already set
[ 1539.260546] binder: 18295:18302 ioctl 40046207 0 returned -16
[ 1539.261640] binder: BINDER_SET_CONTEXT_MGR already set
[ 1539.261646] binder: 18294:18304 ioctl 40046207 0 returned -16
[ 1539.266480] binder: BINDER_SET_CONTEXT_MGR already set
[ 1539.266487] binder: 18296:18307 ioctl 40046207 0 returned -16
[ 1539.272594] binder: 18299:18306 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1539.292526] binder: 18295:18302 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1539.330158] binder: BINDER_SET_CONTEXT_MGR already set
[ 1539.330165] binder: 18314:18317 ioctl 40046207 0 returned -16
[ 1539.347057] binder: BINDER_SET_CONTEXT_MGR already set
[ 1539.347064] binder: 18315:18319 ioctl 40046207 0 returned -16
[ 1539.347993] binder: BINDER_SET_CONTEXT_MGR already set
[ 1539.347999] binder: 18318:18320 ioctl 40046207 0 returned -16
[ 1539.358439] binder: BINDER_SET_CONTEXT_MGR already set
[ 1539.358447] binder: 18316:18321 ioctl 40046207 0 returned -16
[ 1539.359601] binder: 18318:18320 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1539.362865] binder: 18316:18321 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1539.406250] binder: BINDER_SET_CONTEXT_MGR already set
[ 1539.406257] binder: 18322:18323 ioctl 40046207 0 returned -16
[ 1539.416267] binder: BINDER_SET_CONTEXT_MGR already set
[ 1539.416274] binder: 18327:18328 ioctl 40046207 0 returned -16
[ 1539.416698] binder: BINDER_SET_CONTEXT_MGR already set
[ 1539.416714] binder: 18325:18326 ioctl 40046207 0 returned -16
[ 1539.420610] binder: 18327:18328 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1539.423120] binder: 18325:18326 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1539.430767] binder: BINDER_SET_CONTEXT_MGR already set
2018/03/29 19:07:55 executing program 5:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
r1 = mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x7c, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @increfs_done={0x40106308, r1, 0x3}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r2 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r3, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
keyctl$assume_authority(0x10, 0x0)
r4 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r4, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(r4, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x200, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6c834", 0x51, 0x0, &(0x7f0000000040)={0x77359400})
r5 = add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0e9467edd7f398f", 0x1c, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, r5, &(0x7f00000006c0)=[{&(0x7f0000000400)}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0], 0x1})
r6 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(0xffffffffffffffff, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000080)={0x0, 0x0, &(0x7f000000dff8), 0x0, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r6}], 0x1, 0x0)

2018/03/29 19:07:55 executing program 1:
add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={0x73, 0x79, 0x7a}, &(0x7f0000001100)="a1", 0x1, 0xfffffffffffffffb)
perf_event_open(&(0x7f000025c000)={0x0, 0x78}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sendmmsg(0xffffffffffffffff, &(0x7f0000000200)=[{{&(0x7f0000003000)=@rc={0x1f}, 0x80, &(0x7f0000004fa0), 0x0, &(0x7f0000002d30)}}], 0x1, 0x0)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f00000000c0)={"d202b999cf85000000000088f301e710"})
r0 = syz_open_dev$tun(&(0x7f0000000280)='/dev/net/tun\x00', 0x0, 0x400200)
r1 = socket(0x11, 0x100000802, 0x0)
r2 = syz_open_dev$tun(&(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000000c0)={'ifb0\x00', 0x1001})
ioctl$TUNSETLINK(r2, 0x400454cd, 0x308)
ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000040)={'ifb0\x00', 0xa201})
r3 = dup2(r0, 0xffffffffffffffff)
ioctl$TUNSETQUEUE(0xffffffffffffffff, 0x400454d9, &(0x7f0000000000)={'vlan0\x00'})
write$cgroup_subtree(r3, &(0x7f00000001c0)={[{0x0, 'cpu', 0x20}, {0x0, 'pids', 0x20}, {0x0, 'cpu', 0x20}, {0x2b, 'pids', 0x20}, {0x0, 'memory', 0x20}]}, 0x1e)
connect$unix(r1, &(0x7f0000000100)=@abs, 0x6e)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)

2018/03/29 19:07:55 executing program 2:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x70, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @release={0x40046306, 0x1}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r1 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
r2 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r2, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
r3 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r3, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(r3, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x200, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6c8344f9f96ef2c7fe911c019080e", 0x5d, 0x0, &(0x7f0000000040)={0x77359400})
r4 = add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0e9467edd", 0x19, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, r4, &(0x7f00000006c0)=[{&(0x7f0000000400)="f916b8f72c29a4ed654ec4634d479b3453a0dbdd444019513f1d25ccda2381b9d22363dbeef5a27f13994695211b14422a35c08f7510fa", 0x37}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r5 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(r0, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x32b, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r5}], 0x1, 0x0)

2018/03/29 19:07:55 executing program 0:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
r1 = mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x7c, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @increfs_done={0x40106308, r1, 0x3}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x0, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r2 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r3, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
keyctl$assume_authority(0x10, 0x0)
r4 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r4, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(0xffffffffffffffff, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x0, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6c8344f9f96ef2c7fe911c01908", 0x5c, 0x0, &(0x7f0000000040)={0x77359400})
r5 = add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0e9467edd", 0x19, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, r5, &(0x7f00000006c0)=[{&(0x7f0000000400)}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r6 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(r0, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x32b, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r6}], 0x1, 0x0)

2018/03/29 19:07:56 executing program 7:
add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={0x73, 0x79, 0x7a}, &(0x7f0000001100)="a1", 0x1, 0xfffffffffffffffb)
sendmmsg(0xffffffffffffffff, &(0x7f0000000200)=[{{&(0x7f0000003000)=@rc={0x1f}, 0x80, &(0x7f0000004fa0), 0x0, &(0x7f0000002d30)}}], 0x1, 0x0)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f00000000c0)={"d202b999cf85000000000088f301e710"})
r0 = syz_open_dev$tun(&(0x7f0000000280)='/dev/net/tun\x00', 0x0, 0x400200)
r1 = socket(0x11, 0x100000802, 0x0)
r2 = syz_open_dev$tun(&(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000000c0)={'ifb0\x00', 0x1001})
ioctl$TUNSETLINK(r2, 0x400454cd, 0x308)
ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000040)={'ifb0\x00', 0xa201})
r3 = dup2(r0, 0xffffffffffffffff)
ioctl$TUNSETQUEUE(0xffffffffffffffff, 0x400454d9, &(0x7f0000000000)={'vlan0\x00'})
write$cgroup_subtree(0xffffffffffffffff, &(0x7f00000001c0)={[{0x0, 'cpu', 0x20}, {0x0, 'pids', 0x20}, {0x0, 'cpu', 0x20}, {0x2d, 'pids', 0x20}, {0x2b, 'pids', 0x20}, {0x0, 'memory', 0x20}]}, 0x24)
connect$unix(r1, &(0x7f0000000100)=@abs, 0x6e)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)

2018/03/29 19:07:56 executing program 3:
add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={0x73, 0x79, 0x7a}, &(0x7f0000001100)="a1", 0x1, 0xfffffffffffffffb)
perf_event_open(&(0x7f000025c000)={0x2, 0x78}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sendmmsg(0xffffffffffffffff, &(0x7f0000000200), 0x0, 0x0)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f00000000c0)={"d202b999cf85000000000088f301e710"})
r0 = syz_open_dev$tun(&(0x7f0000000280)='/dev/net/tun\x00', 0x0, 0x400200)
r1 = socket(0x11, 0x100000802, 0x0)
r2 = syz_open_dev$tun(&(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000000c0)={'ifb0\x00', 0x1001})
ioctl$TUNSETLINK(r2, 0x400454cd, 0x308)
ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000040)={'ifb0\x00', 0xa201})
r3 = dup2(r0, 0xffffffffffffffff)
ioctl$TUNSETQUEUE(0xffffffffffffffff, 0x400454d9, &(0x7f0000000000)={'vlan0\x00'})
write$cgroup_subtree(r3, &(0x7f00000001c0)={[{0x0, 'cpu', 0x20}, {0x0, 'cpu', 0x20}, {0x2d, 'pids', 0x20}, {0x2b, 'rdma', 0x20}, {0x2b, 'pids', 0x20}, {0x0, 'memory', 0x20}]}, 0x24)
connect$unix(0xffffffffffffffff, &(0x7f0000000100)=@abs, 0x6e)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)

2018/03/29 19:07:56 executing program 4:
add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={0x73, 0x79, 0x7a}, &(0x7f0000001100)="a1", 0x1, 0xfffffffffffffffb)
perf_event_open(&(0x7f000025c000)={0x2, 0x78}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
pipe2(&(0x7f0000000180), 0x0)
socket(0x18, 0x0, 0x1)
sendmmsg(0xffffffffffffffff, &(0x7f0000000200)=[{{&(0x7f0000003000)=@rc={0x1f}, 0x80, &(0x7f0000004fa0), 0x0, &(0x7f0000002d30)}}], 0x1, 0x0)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f00000000c0)={"d202b999cf85000000000088f301e710"})
r0 = syz_open_dev$tun(&(0x7f0000000280)='/dev/net/tun\x00', 0x0, 0x400200)
r1 = socket(0x11, 0x100000802, 0x0)
r2 = syz_open_dev$tun(&(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000000c0)={'ifb0\x00', 0x1001})
ioctl$TUNSETLINK(r2, 0x400454cd, 0x308)
ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000040)={'ifb0\x00', 0xa201})
r3 = dup2(r0, 0xffffffffffffffff)
ioctl$TUNSETQUEUE(0xffffffffffffffff, 0x400454d9, &(0x7f0000000000)={'vlan0\x00'})
write$cgroup_subtree(r3, &(0x7f00000001c0)={[{0x0, 'cpu', 0x20}, {0x2d, 'pids', 0x20}, {0x2b, 'rdma', 0x20}, {0x0, 'pids', 0x20}, {0x0, 'io', 0x20}]}, 0x1b)
connect$unix(0xffffffffffffffff, &(0x7f0000000100)=@abs, 0x6e)
ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82)

2018/03/29 19:07:56 executing program 6:
add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={0x73, 0x79, 0x7a}, &(0x7f0000001100)="a1", 0x1, 0xfffffffffffffffb)
sendmmsg(0xffffffffffffffff, &(0x7f0000000200)=[{{&(0x7f0000003000)=@rc={0x1f}, 0x80, &(0x7f0000004fa0), 0x0, &(0x7f0000002d30)}}], 0x1, 0x0)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f00000000c0)={"d202b999cf85000000000088f301e710"})
syz_open_dev$tun(&(0x7f0000000280)='/dev/net/tun\x00', 0x0, 0x400200)
r0 = socket(0x11, 0x100000802, 0x0)
r1 = syz_open_dev$tun(&(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'ifb0\x00', 0x1001})
ioctl$TUNSETLINK(r1, 0x400454cd, 0x308)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000040)={'ifb0\x00', 0xa201})
r2 = dup2(0xffffffffffffffff, 0xffffffffffffffff)
ioctl$TUNSETQUEUE(0xffffffffffffffff, 0x400454d9, &(0x7f0000000000)={'vlan0\x00'})
write$cgroup_subtree(r2, &(0x7f00000001c0)={[{0x0, 'cpu', 0x20}, {0x0, 'pids', 0x20}, {0x0, 'cpu', 0x20}, {0x2d, 'pids', 0x20}, {0x2b, 'pids', 0x20}, {0x0, 'memory', 0x20}]}, 0x24)
connect$unix(r0, &(0x7f0000000100)=@abs, 0x6e)

[ 1539.430773] binder: 18324:18329 ioctl 40046207 0 returned -16
[ 1539.688051] binder: BINDER_SET_CONTEXT_MGR already set
[ 1539.688059] binder: 18331:18334 ioctl 40046207 0 returned -16
[ 1539.712375] binder: BINDER_SET_CONTEXT_MGR already set
[ 1539.712381] binder: 18332:18340 ioctl 40046207 0 returned -16
[ 1539.714585] binder: BINDER_SET_CONTEXT_MGR already set
[ 1539.714592] binder: 18333:18339 ioctl 40046207 0 returned -16
2018/03/29 19:07:56 executing program 5:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
r1 = mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x7c, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @increfs_done={0x40106308, r1, 0x3}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r2 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r3, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
keyctl$assume_authority(0x10, 0x0)
r4 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r4, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(r4, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x200, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6c834", 0x51, 0x0, &(0x7f0000000040)={0x77359400})
r5 = add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0e9467edd7f398f", 0x1c, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, r5, &(0x7f00000006c0)=[{&(0x7f0000000400)}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0], 0x1})
r6 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(0xffffffffffffffff, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000080)={0x0, 0x0, &(0x7f000000dff8), 0x0, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r6}], 0x1, 0x0)

[ 1539.715100] binder: BINDER_SET_CONTEXT_MGR already set
[ 1539.715107] binder: 18330:18341 ioctl 40046207 0 returned -16
[ 1539.715899] binder: 18332:18340 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1539.721952] binder: 18333:18339 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1539.771557] binder: BINDER_SET_CONTEXT_MGR already set
[ 1539.771564] binder: 18350:18352 ioctl 40046207 0 returned -16
[ 1539.781227] binder: BINDER_SET_CONTEXT_MGR already set
2018/03/29 19:07:56 executing program 2:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x70, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @release={0x40046306, 0x1}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r1 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
r2 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r2, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
r3 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r3, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(r3, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x200, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6c8344f9f96ef2c7fe911c019080e", 0x5d, 0x0, &(0x7f0000000040)={0x77359400})
r4 = add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0e9467edd7f39", 0x1b, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, r4, &(0x7f00000006c0)=[{&(0x7f0000000400)="f916b8f72c29a4ed654ec4634d479b3453a0dbdd444019513f1d25ccda2381b9d22363dbeef5a27f13994695211b14422a35c08f7510fa", 0x37}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r5 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(r0, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x32b, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r5}], 0x1, 0x0)

2018/03/29 19:07:56 executing program 0:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
r1 = mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x7c, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @increfs_done={0x40106308, r1, 0x3}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x10, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r2 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r3, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
keyctl$assume_authority(0x10, 0x0)
r4 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r4, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(0xffffffffffffffff, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x0, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6c8344f9f96ef2c7fe911c01908", 0x5c, 0x0, &(0x7f0000000040)={0x77359400})
r5 = add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0e9467edd", 0x19, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, r5, &(0x7f00000006c0)=[{&(0x7f0000000400)}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r6 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(r0, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x32b, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r6}], 0x1, 0x0)

[ 1539.781234] binder: 18351:18353 ioctl 40046207 0 returned -16
[ 1539.785376] binder: 18350:18352 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1539.803082] binder: BINDER_SET_CONTEXT_MGR already set
[ 1539.803089] binder: 18355:18357 ioctl 40046207 0 returned -16
2018/03/29 19:07:56 executing program 0:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
r1 = mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x7c, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @increfs_done={0x40106308, r1, 0x3}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x10, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r2 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r3, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
keyctl$assume_authority(0x10, 0x0)
r4 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r4, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(0xffffffffffffffff, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x0, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6c8344f9f96ef2c7fe911c01908", 0x5c, 0x0, &(0x7f0000000040)={0x77359400})
r5 = add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0e9467edd", 0x19, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, r5, &(0x7f00000006c0)=[{&(0x7f0000000400)}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r6 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(r0, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x32b, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r6}], 0x1, 0x0)

[ 1539.818906] binder: BINDER_SET_CONTEXT_MGR already set
[ 1539.818912] binder: 18359:18360 ioctl 40046207 0 returned -16
[ 1539.834131] binder: BINDER_SET_CONTEXT_MGR already set
[ 1539.834137] binder: 18356:18358 ioctl 40046207 0 returned -16
[ 1539.843893] binder: 18356:18358 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1539.882849] binder: BINDER_SET_CONTEXT_MGR already set
[ 1539.882857] binder: 18361:18362 ioctl 40046207 0 returned -16
[ 1539.886414] binder: 18361:18362 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
2018/03/29 19:07:56 executing program 2:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x70, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @release={0x40046306, 0x1}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r1 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
r2 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r2, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
r3 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r3, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(r3, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x200, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6c8344f9f96ef2c7fe911c019080e", 0x5d, 0x0, &(0x7f0000000040)={0x77359400})
r4 = add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0e9467edd7f39", 0x1b, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, r4, &(0x7f00000006c0)=[{&(0x7f0000000400)="f916b8f72c29a4ed654ec4634d479b3453a0dbdd444019513f1d25ccda2381b9d22363dbeef5a27f13994695211b14422a35c08f7510fa", 0x37}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r5 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(r0, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x32b, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r5}], 0x1, 0x0)

2018/03/29 19:07:56 executing program 5:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
r1 = mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x7c, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @increfs_done={0x40106308, r1, 0x3}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r2 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r3, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
keyctl$assume_authority(0x10, 0x0)
r4 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r4, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(r4, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x200, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6c834", 0x51, 0x0, &(0x7f0000000040)={0x77359400})
r5 = add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0e9467edd7f398f", 0x1c, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, r5, &(0x7f00000006c0)=[{&(0x7f0000000400)}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0], 0x1})
r6 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(0xffffffffffffffff, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000080)={0x0, 0x0, &(0x7f000000dff8), 0x0, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r6}], 0x1, 0x0)

2018/03/29 19:07:56 executing program 2:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x70, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @release={0x40046306, 0x1}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r1 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
r2 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r2, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
r3 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r3, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(r3, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x200, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6c8344f9f96ef2c7fe911c019080e", 0x5d, 0x0, &(0x7f0000000040)={0x77359400})
r4 = add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0e9467edd7f39", 0x1b, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, r4, &(0x7f00000006c0)=[{&(0x7f0000000400)="f916b8f72c29a4ed654ec4634d479b3453a0dbdd444019513f1d25ccda2381b9d22363dbeef5a27f13994695211b14422a35c08f7510fa", 0x37}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r5 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(r0, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x32b, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r5}], 0x1, 0x0)

[ 1540.135036] binder: BINDER_SET_CONTEXT_MGR already set
[ 1540.135043] binder: 18366:18371 ioctl 40046207 0 returned -16
[ 1540.138699] binder: BINDER_SET_CONTEXT_MGR already set
[ 1540.138705] binder: 18364:18375 ioctl 40046207 0 returned -16
[ 1540.143646] binder: 18366:18371 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1540.144155] binder: BINDER_SET_CONTEXT_MGR already set
2018/03/29 19:07:56 executing program 0:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
r1 = mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x7c, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @increfs_done={0x40106308, r1, 0x3}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x10, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r2 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r3, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
keyctl$assume_authority(0x10, 0x0)
r4 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r4, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(0xffffffffffffffff, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x0, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6c8344f9f96ef2c7fe911c01908", 0x5c, 0x0, &(0x7f0000000040)={0x77359400})
r5 = add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0e9467edd", 0x19, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, r5, &(0x7f00000006c0)=[{&(0x7f0000000400)}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r6 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(r0, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x32b, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r6}], 0x1, 0x0)

[ 1540.144161] binder: 18363:18377 ioctl 40046207 0 returned -16
[ 1540.145803] binder: BINDER_SET_CONTEXT_MGR already set
[ 1540.145810] binder: 18370:18376 ioctl 40046207 0 returned -16
[ 1540.149670] binder: 18364:18375 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1540.205709] binder: BINDER_SET_CONTEXT_MGR already set
[ 1540.205716] binder: 18381:18382 ioctl 40046207 0 returned -16
[ 1540.219992] binder: 18381:18382 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1540.223839] binder: BINDER_SET_CONTEXT_MGR already set
[ 1540.223846] binder: 18383:18388 ioctl 40046207 0 returned -16
[ 1540.224106] binder: BINDER_SET_CONTEXT_MGR already set
[ 1540.224193] binder: 18386:18387 ioctl 40046207 0 returned -16
[ 1540.227903] binder: 18383:18388 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1540.245752] binder: BINDER_SET_CONTEXT_MGR already set
[ 1540.245760] binder: 18384:18389 ioctl 40046207 0 returned -16
[ 1540.265870] binder: BINDER_SET_CONTEXT_MGR already set
[ 1540.265877] binder: 18391:18392 ioctl 40046207 0 returned -16
[ 1540.269582] binder: 18391:18392 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1540.287632] binder: BINDER_SET_CONTEXT_MGR already set
[ 1540.287639] binder: 18393:18395 ioctl 40046207 0 returned -16
[ 1540.302802] binder: BINDER_SET_CONTEXT_MGR already set
[ 1540.302809] binder: 18396:18398 ioctl 40046207 0 returned -16
[ 1540.307612] binder: BINDER_SET_CONTEXT_MGR already set
[ 1540.307619] binder: 18394:18397 ioctl 40046207 0 returned -16
[ 1540.314055] binder: 18394:18397 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1540.318517] binder: BINDER_SET_CONTEXT_MGR already set
[ 1540.318524] binder: 18399:18400 ioctl 40046207 0 returned -16
[ 1540.321984] binder: 18399:18400 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1540.355418] binder: BINDER_SET_CONTEXT_MGR already set
[ 1540.355424] binder: 18401:18402 ioctl 40046207 0 returned -16
[ 1540.617307] binder: BINDER_SET_CONTEXT_MGR already set
[ 1540.617314] binder: 18405:18410 ioctl 40046207 0 returned -16
[ 1540.622342] binder: BINDER_SET_CONTEXT_MGR already set
[ 1540.622349] binder: 18406:18414 ioctl 40046207 0 returned -16
[ 1540.625003] binder: BINDER_SET_CONTEXT_MGR already set
[ 1540.625009] binder: 18403:18412 ioctl 40046207 0 returned -16
[ 1540.629725] binder: BINDER_SET_CONTEXT_MGR already set
[ 1540.629732] binder: 18404:18415 ioctl 40046207 0 returned -16
[ 1540.631558] binder: 18406:18414 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1540.633491] binder: 18403:18412 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1540.708330] binder: BINDER_SET_CONTEXT_MGR already set
[ 1540.708338] binder: 18420:18426 ioctl 40046207 0 returned -16
[ 1540.710075] binder: BINDER_SET_CONTEXT_MGR already set
[ 1540.710082] binder: 18424:18427 ioctl 40046207 0 returned -16
[ 1540.710609] binder: BINDER_SET_CONTEXT_MGR already set
[ 1540.710615] binder: 18422:18425 ioctl 40046207 0 returned -16
[ 1540.712768] binder: BINDER_SET_CONTEXT_MGR already set
[ 1540.712775] binder: 18423:18428 ioctl 40046207 0 returned -16
[ 1540.719465] binder: 18423:18428 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1540.721172] binder: 18424:18427 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1540.767401] binder: BINDER_SET_CONTEXT_MGR already set
[ 1540.767408] binder: 18432:18433 ioctl 40046207 0 returned -16
[ 1540.771903] binder: BINDER_SET_CONTEXT_MGR already set
[ 1540.771911] binder: 18431:18434 ioctl 40046207 0 returned -16
[ 1540.795881] binder: BINDER_SET_CONTEXT_MGR already set
[ 1540.795888] binder: 18435:18437 ioctl 40046207 0 returned -16
[ 1540.800815] binder: 18435:18437 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1540.802507] binder: BINDER_SET_CONTEXT_MGR already set
[ 1540.802513] binder: 18436:18438 ioctl 40046207 0 returned -16
[ 1540.807338] binder: 18436:18438 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1541.083402] binder: BINDER_SET_CONTEXT_MGR already set
[ 1541.083409] binder: 18441:18443 ioctl 40046207 0 returned -16
[ 1541.084159] binder: BINDER_SET_CONTEXT_MGR already set
[ 1541.084166] binder: 18440:18444 ioctl 40046207 0 returned -16
[ 1541.092745] binder: 18441:18443 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1541.093309] binder: BINDER_SET_CONTEXT_MGR already set
[ 1541.093319] binder: 18442:18450 ioctl 40046207 0 returned -16
[ 1541.093921] binder: BINDER_SET_CONTEXT_MGR already set
2018/03/29 19:07:56 executing program 5:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
r1 = mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x7c, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @increfs_done={0x40106308, r1, 0x3}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r2 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r3, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
keyctl$assume_authority(0x10, 0x0)
r4 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r4, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(r4, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x200, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6c834", 0x51, 0x0, &(0x7f0000000040)={0x77359400})
r5 = add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0e9467edd7f398f", 0x1c, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, r5, &(0x7f00000006c0)=[{&(0x7f0000000400)}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0], 0x1})
r6 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(0xffffffffffffffff, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000080)={0x0, 0x0, &(0x7f000000dff8), 0x0, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r6}], 0x1, 0x0)

2018/03/29 19:07:56 executing program 2:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x70, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @release={0x40046306, 0x1}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r1 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
r2 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r2, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
r3 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r3, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(r3, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x200, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6c8344f9f96ef2c7fe911c019080e", 0x5d, 0x0, &(0x7f0000000040)={0x77359400})
r4 = add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0e9467edd7f398f", 0x1c, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, r4, &(0x7f00000006c0)=[{&(0x7f0000000400)="f916b8f72c29a4ed654ec4634d479b3453a0dbdd444019513f1d25ccda2381b9d22363dbeef5a27f13994695211b14422a35c08f7510fa", 0x37}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r5 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(r0, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x32b, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r5}], 0x1, 0x0)

2018/03/29 19:07:56 executing program 0:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
r1 = mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x7c, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @increfs_done={0x40106308, r1, 0x3}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x10, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r2 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r3, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
keyctl$assume_authority(0x10, 0x0)
r4 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r4, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(0xffffffffffffffff, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x0, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6c8344f9f96ef2c7fe911c01908", 0x5c, 0x0, &(0x7f0000000040)={0x77359400})
r5 = add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0e9467edd", 0x19, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, r5, &(0x7f00000006c0)=[{&(0x7f0000000400)}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r6 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(r0, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x32b, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r6}], 0x1, 0x0)

2018/03/29 19:07:56 executing program 1:
add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={0x73, 0x79, 0x7a}, &(0x7f0000001100)="a1", 0x1, 0xfffffffffffffffb)
perf_event_open(&(0x7f000025c000)={0x0, 0x78}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sendmmsg(0xffffffffffffffff, &(0x7f0000000200)=[{{&(0x7f0000003000)=@rc={0x1f}, 0x80, &(0x7f0000004fa0), 0x0, &(0x7f0000002d30)}}], 0x1, 0x0)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f00000000c0)={"d202b999cf85000000000088f301e710"})
r0 = syz_open_dev$tun(&(0x7f0000000280)='/dev/net/tun\x00', 0x0, 0x400200)
r1 = socket(0x11, 0x100000802, 0x0)
r2 = syz_open_dev$tun(&(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000000c0)={'ifb0\x00', 0x1001})
ioctl$TUNSETLINK(r2, 0x400454cd, 0x308)
ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000040)={'ifb0\x00', 0xa201})
r3 = dup2(r0, 0xffffffffffffffff)
ioctl$TUNSETQUEUE(0xffffffffffffffff, 0x400454d9, &(0x7f0000000000)={'vlan0\x00'})
write$cgroup_subtree(r3, &(0x7f00000001c0)={[{0x0, 'cpu', 0x20}, {0x0, 'pids', 0x20}, {0x0, 'cpu', 0x20}, {0x2b, 'pids', 0x20}, {0x0, 'memory', 0x20}]}, 0x1e)
connect$unix(r1, &(0x7f0000000100)=@abs, 0x6e)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)

2018/03/29 19:07:56 executing program 7:
add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={0x73, 0x79, 0x7a}, &(0x7f0000001100)="a1", 0x1, 0xfffffffffffffffb)
sendmmsg(0xffffffffffffffff, &(0x7f0000000200)=[{{&(0x7f0000003000)=@rc={0x1f}, 0x80, &(0x7f0000004fa0), 0x0, &(0x7f0000002d30)}}], 0x1, 0x0)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f00000000c0)={"d202b999cf85000000000088f301e710"})
r0 = syz_open_dev$tun(&(0x7f0000000280)='/dev/net/tun\x00', 0x0, 0x400200)
r1 = socket(0x11, 0x100000802, 0x0)
r2 = syz_open_dev$tun(&(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000000c0)={'ifb0\x00', 0x1001})
ioctl$TUNSETLINK(r2, 0x400454cd, 0x308)
ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000040)={'ifb0\x00', 0xa201})
r3 = dup2(r0, 0xffffffffffffffff)
ioctl$TUNSETQUEUE(0xffffffffffffffff, 0x400454d9, &(0x7f0000000000)={'vlan0\x00'})
write$cgroup_subtree(r3, &(0x7f00000001c0)={[{0x0, 'pids', 0x20}, {0x0, 'cpu', 0x20}, {0x2d, 'pids', 0x20}, {0x2b, 'pids', 0x20}, {0x0, 'memory', 0x20}]}, 0x1f)
connect$unix(r1, &(0x7f0000000100)=@abs, 0x6e)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)

2018/03/29 19:07:56 executing program 3:
add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={0x73, 0x79, 0x7a}, &(0x7f0000001100)="a1", 0x1, 0xfffffffffffffffb)
perf_event_open(&(0x7f000025c000)={0x2, 0x78}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sendmmsg(0xffffffffffffffff, &(0x7f0000000200), 0x0, 0x0)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f00000000c0)={"d202b999cf85000000000088f301e710"})
r0 = syz_open_dev$tun(&(0x7f0000000280)='/dev/net/tun\x00', 0x0, 0x400200)
r1 = socket(0x11, 0x100000802, 0x0)
r2 = syz_open_dev$tun(&(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000000c0)={'ifb0\x00', 0x1001})
ioctl$TUNSETLINK(r2, 0x400454cd, 0x308)
ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000040)={'ifb0\x00', 0xa201})
r3 = dup2(r0, 0xffffffffffffffff)
ioctl$TUNSETQUEUE(0xffffffffffffffff, 0x400454d9, &(0x7f0000000000)={'vlan0\x00'})
write$cgroup_subtree(r3, &(0x7f00000001c0)={[{0x0, 'cpu', 0x20}, {0x0, 'cpu', 0x20}, {0x2d, 'pids', 0x20}, {0x2b, 'rdma', 0x20}, {0x2b, 'pids', 0x20}, {0x0, 'memory', 0x20}]}, 0x24)
connect$unix(0xffffffffffffffff, &(0x7f0000000100)=@abs, 0x6e)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)

2018/03/29 19:07:56 executing program 4:
add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={0x73, 0x79, 0x7a}, &(0x7f0000001100)="a1", 0x1, 0xfffffffffffffffb)
perf_event_open(&(0x7f000025c000)={0x2, 0x78}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
pipe2(&(0x7f0000000180), 0x0)
socket(0x18, 0x0, 0x1)
sendmmsg(0xffffffffffffffff, &(0x7f0000000200)=[{{&(0x7f0000003000)=@rc={0x1f}, 0x80, &(0x7f0000004fa0), 0x0, &(0x7f0000002d30)}}], 0x1, 0x0)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f00000000c0)={"d202b999cf85000000000088f301e710"})
r0 = syz_open_dev$tun(&(0x7f0000000280)='/dev/net/tun\x00', 0x0, 0x400200)
r1 = socket(0x11, 0x100000802, 0x0)
r2 = syz_open_dev$tun(&(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000000c0)={'ifb0\x00', 0x1001})
ioctl$TUNSETLINK(r2, 0x400454cd, 0x308)
ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000040)={'ifb0\x00', 0xa201})
r3 = dup2(r0, 0xffffffffffffffff)
ioctl$TUNSETQUEUE(0xffffffffffffffff, 0x400454d9, &(0x7f0000000000)={'vlan0\x00'})
write$cgroup_subtree(r3, &(0x7f00000001c0)={[{0x0, 'cpu', 0x20}, {0x2d, 'pids', 0x20}, {0x2b, 'rdma', 0x20}, {0x0, 'pids', 0x20}, {0x0, 'io', 0x20}]}, 0x1b)
connect$unix(0xffffffffffffffff, &(0x7f0000000100)=@abs, 0x6e)
ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82)

2018/03/29 19:07:56 executing program 6:
add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={0x73, 0x79, 0x7a}, &(0x7f0000001100)="a1", 0x1, 0xfffffffffffffffb)
sendmmsg(0xffffffffffffffff, &(0x7f0000000200)=[{{&(0x7f0000003000)=@rc={0x1f}, 0x80, &(0x7f0000004fa0), 0x0, &(0x7f0000002d30)}}], 0x1, 0x0)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f00000000c0)={"d202b999cf85000000000088f301e710"})
syz_open_dev$tun(&(0x7f0000000280)='/dev/net/tun\x00', 0x0, 0x400200)
r0 = socket(0x11, 0x100000802, 0x0)
r1 = syz_open_dev$tun(&(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'ifb0\x00', 0x1001})
ioctl$TUNSETLINK(r1, 0x400454cd, 0x308)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000040)={'ifb0\x00', 0xa201})
r2 = dup2(0xffffffffffffffff, 0xffffffffffffffff)
ioctl$TUNSETQUEUE(0xffffffffffffffff, 0x400454d9, &(0x7f0000000000)={'vlan0\x00'})
write$cgroup_subtree(r2, &(0x7f00000001c0)={[{0x0, 'cpu', 0x20}, {0x0, 'pids', 0x20}, {0x0, 'cpu', 0x20}, {0x2d, 'pids', 0x20}, {0x2b, 'pids', 0x20}, {0x0, 'memory', 0x20}]}, 0x24)
connect$unix(r0, &(0x7f0000000100)=@abs, 0x6e)

[ 1541.093928] binder: 18439:18452 ioctl 40046207 0 returned -16
[ 1541.102130] binder: 18442:18450 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1541.169588] binder: BINDER_SET_CONTEXT_MGR already set
[ 1541.169596] binder: 18459:18461 ioctl 40046207 0 returned -16
2018/03/29 19:07:56 executing program 2:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x70, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @release={0x40046306, 0x1}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r1 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
r2 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r2, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
r3 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r3, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(r3, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x200, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6c8344f9f96ef2c7fe911c019080e", 0x5d, 0x0, &(0x7f0000000040)={0x77359400})
r4 = add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0e9467edd7f398f", 0x1c, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, r4, &(0x7f00000006c0)=[{&(0x7f0000000400)="f916b8f72c29a4ed654ec4634d479b3453a0dbdd444019513f1d25ccda2381b9d22363dbeef5a27f13994695211b14422a35c08f7510fa", 0x37}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r5 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(r0, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x32b, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r5}], 0x1, 0x0)

2018/03/29 19:07:56 executing program 5:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
r1 = mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x7c, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @increfs_done={0x40106308, r1, 0x3}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r2 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r3, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
keyctl$assume_authority(0x10, 0x0)
r4 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r4, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(r4, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x200, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6c834", 0x51, 0x0, &(0x7f0000000040)={0x77359400})
r5 = add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0e9467edd7f398f", 0x1c, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, r5, &(0x7f00000006c0)=[{&(0x7f0000000400)}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0], 0x1})
r6 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(0xffffffffffffffff, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000080)={0x0, 0x0, &(0x7f000000dff8), 0x0, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r6}], 0x1, 0x0)

2018/03/29 19:07:56 executing program 0:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
r1 = mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x7c, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @increfs_done={0x40106308, r1, 0x3}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x10, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r2 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r3, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
keyctl$assume_authority(0x10, 0x0)
r4 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r4, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(0xffffffffffffffff, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x0, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6c8344f9f96ef2c7fe911c01908", 0x5c, 0x0, &(0x7f0000000040)={0x77359400})
r5 = add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0e9467edd", 0x19, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, r5, &(0x7f00000006c0)=[{&(0x7f0000000400)}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r6 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(r0, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x32b, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r6}], 0x1, 0x0)

[ 1541.181197] binder: 18459:18461 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1541.185232] binder: BINDER_SET_CONTEXT_MGR already set
[ 1541.185239] binder: 18464:18466 ioctl 40046207 0 returned -16
[ 1541.187725] binder: BINDER_SET_CONTEXT_MGR already set
[ 1541.187731] binder: 18460:18463 ioctl 40046207 0 returned -16
[ 1541.187775] binder: BINDER_SET_CONTEXT_MGR already set
[ 1541.187780] binder: 18462:18465 ioctl 40046207 0 returned -16
[ 1541.197142] binder: 18464:18466 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1541.249857] binder: BINDER_SET_CONTEXT_MGR already set
[ 1541.249864] binder: 18467:18469 ioctl 40046207 0 returned -16
[ 1541.257285] binder: 18467:18469 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1541.269887] binder: BINDER_SET_CONTEXT_MGR already set
[ 1541.269894] binder: 18468:18471 ioctl 40046207 0 returned -16
2018/03/29 19:07:56 executing program 0:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
r1 = mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x7c, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @increfs_done={0x40106308, r1, 0x3}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x10, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r2 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r3, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
keyctl$assume_authority(0x10, 0x0)
r4 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r4, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(0xffffffffffffffff, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x0, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6c8344f9f96ef2c7fe911c01908", 0x5c, 0x0, &(0x7f0000000040)={0x77359400})
r5 = add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0e9467edd", 0x19, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, r5, &(0x7f00000006c0)=[{&(0x7f0000000400)}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r6 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(r0, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x32b, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r6}], 0x1, 0x0)

2018/03/29 19:07:56 executing program 2:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x70, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @release={0x40046306, 0x1}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r1 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
r2 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r2, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
r3 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r3, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(r3, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x200, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6c8344f9f96ef2c7fe911c019080e", 0x5d, 0x0, &(0x7f0000000040)={0x77359400})
r4 = add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0e9467edd7f398f", 0x1c, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, r4, &(0x7f00000006c0)=[{&(0x7f0000000400)="f916b8f72c29a4ed654ec4634d479b3453a0dbdd444019513f1d25ccda2381b9d22363dbeef5a27f13994695211b14422a35c08f7510fa", 0x37}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r5 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(r0, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x32b, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r5}], 0x1, 0x0)

2018/03/29 19:07:56 executing program 5:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
r1 = mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x7c, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @increfs_done={0x40106308, r1, 0x3}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r2 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r3, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
keyctl$assume_authority(0x10, 0x0)
r4 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r4, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(r4, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x200, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6c834", 0x51, 0x0, &(0x7f0000000040)={0x77359400})
r5 = add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0e9467edd7f398f", 0x1c, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, r5, &(0x7f00000006c0)=[{&(0x7f0000000400)}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r6 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(0xffffffffffffffff, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(0xffffffffffffffff, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000080)={0x0, 0x0, &(0x7f000000dff8), 0x0, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r6}], 0x1, 0x0)

[ 1541.277231] binder: BINDER_SET_CONTEXT_MGR already set
[ 1541.277238] binder: 18470:18472 ioctl 40046207 0 returned -16
[ 1541.281654] binder: 18470:18472 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1541.299192] binder: BINDER_SET_CONTEXT_MGR already set
[ 1541.299200] binder: 18473:18474 ioctl 40046207 0 returned -16
[ 1541.582106] binder: BINDER_SET_CONTEXT_MGR already set
[ 1541.582116] binder: 18478:18484 ioctl 40046207 0 returned -16
[ 1541.584789] binder: BINDER_SET_CONTEXT_MGR already set
2018/03/29 19:07:56 executing program 0:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
r1 = mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x7c, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @increfs_done={0x40106308, r1, 0x3}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x0]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r2 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r3, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
keyctl$assume_authority(0x10, 0x0)
r4 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r4, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(0xffffffffffffffff, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x0, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6c8344f9f96ef2c7fe911c01908", 0x5c, 0x0, &(0x7f0000000040)={0x77359400})
r5 = add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0e9467edd", 0x19, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, r5, &(0x7f00000006c0)=[{&(0x7f0000000400)}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r6 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(r0, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x32b, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r6}], 0x1, 0x0)

[ 1541.584797] binder: 18475:18483 ioctl 40046207 0 returned -16
[ 1541.586966] binder: BINDER_SET_CONTEXT_MGR already set
[ 1541.586974] binder: 18476:18485 ioctl 40046207 0 returned -16
[ 1541.593370] binder: 18478:18484 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1541.599355] binder: 18476:18485 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1541.604213] binder: BINDER_SET_CONTEXT_MGR already set
[ 1541.604219] binder: 18477:18488 ioctl 40046207 0 returned -16
2018/03/29 19:07:56 executing program 2:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x70, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @release={0x40046306, 0x1}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r1 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
r2 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r2, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
r3 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r3, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(r3, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x200, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6c8344f9f96ef2c7fe911c019080e", 0x5d, 0x0, &(0x7f0000000040)={0x77359400})
r4 = add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0e9467edd7f398f", 0x1c, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, 0x0, &(0x7f00000006c0)=[{&(0x7f0000000400)="f916b8f72c29a4ed654ec4634d479b3453a0dbdd444019513f1d25ccda2381b9d22363dbeef5a27f13994695211b14422a35c08f7510fa", 0x37}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r5 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(r0, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x32b, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r5}], 0x1, 0x0)

[ 1541.656436] binder: BINDER_SET_CONTEXT_MGR already set
[ 1541.656444] binder: 18495:18497 ioctl 40046207 0 returned -16
[ 1541.659930] binder: 18495:18497 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1541.666971] binder: BINDER_SET_CONTEXT_MGR already set
[ 1541.666978] binder: 18494:18498 ioctl 40046207 0 returned -16
[ 1541.667132] binder: BINDER_SET_CONTEXT_MGR already set
[ 1541.667138] binder: 18493:18496 ioctl 40046207 0 returned -16
[ 1541.678377] binder: BINDER_SET_CONTEXT_MGR already set
[ 1541.678385] binder: 18499:18501 ioctl 40046207 0 returned -16
[ 1541.679854] binder: 18494:18498 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1541.710794] binder: BINDER_SET_CONTEXT_MGR already set
[ 1541.710801] binder: 18502:18504 ioctl 40046207 0 returned -16
[ 1541.724849] binder: BINDER_SET_CONTEXT_MGR already set
[ 1541.724856] binder: 18503:18505 ioctl 40046207 0 returned -16
[ 1541.727719] binder: BINDER_SET_CONTEXT_MGR already set
[ 1541.727726] binder: 18506:18507 ioctl 40046207 0 returned -16
[ 1541.733107] binder: 18506:18507 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1541.740614] binder: BINDER_SET_CONTEXT_MGR already set
[ 1541.740621] binder: 18508:18509 ioctl 40046207 0 returned -16
[ 1541.797655] binder: BINDER_SET_CONTEXT_MGR already set
[ 1541.797662] binder: 18510:18511 ioctl 40046207 0 returned -16
[ 1542.085945] binder: BINDER_SET_CONTEXT_MGR already set
[ 1542.085954] binder: 18513:18515 ioctl 40046207 0 returned -16
[ 1542.089943] binder: BINDER_SET_CONTEXT_MGR already set
[ 1542.089951] binder: 18514:18525 ioctl 40046207 0 returned -16
[ 1542.091688] binder: BINDER_SET_CONTEXT_MGR already set
[ 1542.091695] binder: 18512:18521 ioctl 40046207 0 returned -16
[ 1542.098102] binder: 18514:18525 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1542.098239] binder: BINDER_SET_CONTEXT_MGR already set
[ 1542.098246] binder: 18517:18527 ioctl 40046207 0 returned -16
[ 1542.155404] binder: BINDER_SET_CONTEXT_MGR already set
[ 1542.155412] binder: 18531:18533 ioctl 40046207 0 returned -16
[ 1542.173795] binder: 18531:18533 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1542.178073] binder: BINDER_SET_CONTEXT_MGR already set
[ 1542.178080] binder: 18532:18534 ioctl 40046207 0 returned -16
[ 1542.186497] binder: BINDER_SET_CONTEXT_MGR already set
[ 1542.186505] binder: 18537:18541 ioctl 40046207 0 returned -16
[ 1542.188364] binder: BINDER_SET_CONTEXT_MGR already set
[ 1542.188371] binder: 18536:18539 ioctl 40046207 0 returned -16
[ 1542.234965] binder: BINDER_SET_CONTEXT_MGR already set
[ 1542.234974] binder: 18542:18545 ioctl 40046207 0 returned -16
[ 1542.238914] binder: BINDER_SET_CONTEXT_MGR already set
[ 1542.238920] binder: 18543:18544 ioctl 40046207 0 returned -16
[ 1542.246921] binder: BINDER_SET_CONTEXT_MGR already set
[ 1542.246928] binder: 18546:18547 ioctl 40046207 0 returned -16
[ 1542.252696] binder: 18542:18545 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1542.557471] binder: BINDER_SET_CONTEXT_MGR already set
[ 1542.557479] binder: 18550:18552 ioctl 40046207 0 returned -16
[ 1542.559539] binder: BINDER_SET_CONTEXT_MGR already set
[ 1542.559546] binder: 18549:18551 ioctl 40046207 0 returned -16
[ 1542.561281] binder: BINDER_SET_CONTEXT_MGR already set
[ 1542.561288] binder: 18548:18559 ioctl 40046207 0 returned -16
[ 1542.567634] binder: BINDER_SET_CONTEXT_MGR already set
[ 1542.567641] binder: 18556:18560 ioctl 40046207 0 returned -16
[ 1542.574170] binder: 18549:18551 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1542.634858] binder: BINDER_SET_CONTEXT_MGR already set
[ 1542.634867] binder: 18567:18568 ioctl 40046207 0 returned -16
[ 1542.651725] binder: BINDER_SET_CONTEXT_MGR already set
[ 1542.651733] binder: 18571:18572 ioctl 40046207 0 returned -16
2018/03/29 19:07:57 executing program 5:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
r1 = mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x7c, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @increfs_done={0x40106308, r1, 0x3}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r2 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r3, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
keyctl$assume_authority(0x10, 0x0)
r4 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r4, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(r4, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x200, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6c834", 0x51, 0x0, &(0x7f0000000040)={0x77359400})
r5 = add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0e9467edd7f398f", 0x1c, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, r5, &(0x7f00000006c0)=[{&(0x7f0000000400)}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r6 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(0xffffffffffffffff, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(0xffffffffffffffff, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000080)={0x0, 0x0, &(0x7f000000dff8), 0x0, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r6}], 0x1, 0x0)

2018/03/29 19:07:57 executing program 6:
add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={0x73, 0x79, 0x7a}, &(0x7f0000001100)="a1", 0x1, 0xfffffffffffffffb)
sendmmsg(0xffffffffffffffff, &(0x7f0000000200)=[{{&(0x7f0000003000)=@rc={0x1f}, 0x80, &(0x7f0000004fa0), 0x0, &(0x7f0000002d30)}}], 0x1, 0x0)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f00000000c0)={"d202b999cf85000000000088f301e710"})
syz_open_dev$tun(&(0x7f0000000280)='/dev/net/tun\x00', 0x0, 0x400200)
r0 = socket(0x11, 0x100000802, 0x0)
r1 = syz_open_dev$tun(&(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'ifb0\x00', 0x1001})
ioctl$TUNSETLINK(r1, 0x400454cd, 0x308)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000040)={'ifb0\x00', 0xa201})
r2 = dup2(0xffffffffffffffff, 0xffffffffffffffff)
ioctl$TUNSETQUEUE(0xffffffffffffffff, 0x400454d9, &(0x7f0000000000)={'vlan0\x00'})
write$cgroup_subtree(r2, &(0x7f00000001c0)={[{0x0, 'cpu', 0x20}, {0x0, 'pids', 0x20}, {0x0, 'cpu', 0x20}, {0x2d, 'pids', 0x20}, {0x2b, 'pids', 0x20}, {0x0, 'memory', 0x20}]}, 0x24)
connect$unix(r0, &(0x7f0000000100)=@abs, 0x6e)

2018/03/29 19:07:57 executing program 0:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
r1 = mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x7c, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @increfs_done={0x40106308, r1, 0x3}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x0]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r2 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r3, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
keyctl$assume_authority(0x10, 0x0)
r4 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r4, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(0xffffffffffffffff, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x0, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6c8344f9f96ef2c7fe911c01908", 0x5c, 0x0, &(0x7f0000000040)={0x77359400})
r5 = add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0e9467edd", 0x19, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, r5, &(0x7f00000006c0)=[{&(0x7f0000000400)}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r6 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(r0, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x32b, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r6}], 0x1, 0x0)

2018/03/29 19:07:57 executing program 2:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x70, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @release={0x40046306, 0x1}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r1 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
r2 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r2, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
r3 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r3, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(r3, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x200, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6c8344f9f96ef2c7fe911c019080e", 0x5d, 0x0, &(0x7f0000000040)={0x77359400})
r4 = add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0e9467edd7f398f", 0x1c, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, 0x0, &(0x7f00000006c0)=[{&(0x7f0000000400)="f916b8f72c29a4ed654ec4634d479b3453a0dbdd444019513f1d25ccda2381b9d22363dbeef5a27f13994695211b14422a35c08f7510fa", 0x37}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r5 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(r0, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x32b, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r5}], 0x1, 0x0)

2018/03/29 19:07:57 executing program 1:
add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={0x73, 0x79, 0x7a}, &(0x7f0000001100)="a1", 0x1, 0xfffffffffffffffb)
perf_event_open(&(0x7f000025c000)={0x0, 0x78}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sendmmsg(0xffffffffffffffff, &(0x7f0000000200)=[{{&(0x7f0000003000)=@rc={0x1f}, 0x80, &(0x7f0000004fa0), 0x0, &(0x7f0000002d30)}}], 0x1, 0x0)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f00000000c0)={"d202b999cf85000000000088f301e710"})
r0 = syz_open_dev$tun(&(0x7f0000000280)='/dev/net/tun\x00', 0x0, 0x400200)
r1 = socket(0x11, 0x100000802, 0x0)
r2 = syz_open_dev$tun(&(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000000c0)={'ifb0\x00', 0x1001})
ioctl$TUNSETLINK(r2, 0x400454cd, 0x308)
ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000040)={'ifb0\x00', 0xa201})
r3 = dup2(r0, 0xffffffffffffffff)
ioctl$TUNSETQUEUE(0xffffffffffffffff, 0x400454d9, &(0x7f0000000000)={'vlan0\x00'})
write$cgroup_subtree(r3, &(0x7f00000001c0)={[{0x0, 'cpu', 0x20}, {0x0, 'pids', 0x20}, {0x0, 'cpu', 0x20}, {0x0, 'pids', 0x20}, {0x2b, 'pids', 0x20}, {0x0, 'memory', 0x20}]}, 0x24)
connect$unix(r1, &(0x7f0000000100)=@abs, 0x6e)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)

2018/03/29 19:07:57 executing program 7:
add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={0x73, 0x79, 0x7a}, &(0x7f0000001100)="a1", 0x1, 0xfffffffffffffffb)
sendmmsg(0xffffffffffffffff, &(0x7f0000000200)=[{{&(0x7f0000003000)=@rc={0x1f}, 0x80, &(0x7f0000004fa0), 0x0, &(0x7f0000002d30)}}], 0x1, 0x0)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f00000000c0)={"d202b999cf85000000000088f301e710"})
r0 = syz_open_dev$tun(&(0x7f0000000280)='/dev/net/tun\x00', 0x0, 0x400200)
r1 = socket(0x11, 0x100000802, 0x0)
r2 = syz_open_dev$tun(&(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000000c0)={'ifb0\x00', 0x1001})
ioctl$TUNSETLINK(r2, 0x400454cd, 0x308)
ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000040)={'ifb0\x00', 0xa201})
r3 = dup2(r0, 0xffffffffffffffff)
ioctl$TUNSETQUEUE(0xffffffffffffffff, 0x400454d9, &(0x7f0000000000)={'vlan0\x00'})
write$cgroup_subtree(r3, &(0x7f00000001c0)={[{0x0, 'pids', 0x20}, {0x0, 'cpu', 0x20}, {0x2d, 'pids', 0x20}, {0x2b, 'pids', 0x20}, {0x0, 'memory', 0x20}]}, 0x1f)
connect$unix(r1, &(0x7f0000000100)=@abs, 0x6e)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)

2018/03/29 19:07:57 executing program 4:
add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={0x73, 0x79, 0x7a}, &(0x7f0000001100)="a1", 0x1, 0xfffffffffffffffb)
perf_event_open(&(0x7f000025c000)={0x2, 0x78}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
pipe2(&(0x7f0000000180), 0x0)
socket(0x18, 0x0, 0x1)
sendmmsg(0xffffffffffffffff, &(0x7f0000000200)=[{{&(0x7f0000003000)=@rc={0x1f}, 0x80, &(0x7f0000004fa0), 0x0, &(0x7f0000002d30)}}], 0x1, 0x0)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f00000000c0)={"d202b999cf85000000000088f301e710"})
r0 = syz_open_dev$tun(&(0x7f0000000280)='/dev/net/tun\x00', 0x0, 0x400200)
r1 = socket(0x11, 0x100000802, 0x0)
r2 = syz_open_dev$tun(&(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000000c0)={'ifb0\x00', 0x1001})
ioctl$TUNSETLINK(r2, 0x400454cd, 0x308)
ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000040)={'ifb0\x00', 0xa201})
r3 = dup2(r0, 0xffffffffffffffff)
ioctl$TUNSETQUEUE(0xffffffffffffffff, 0x400454d9, &(0x7f0000000000)={'vlan0\x00'})
write$cgroup_subtree(r3, &(0x7f00000001c0)={[{0x0, 'pids', 0x20}, {0x0, 'cpu', 0x20}, {0x2d, 'pids', 0x20}, {0x2b, 'rdma', 0x20}, {0x0, 'pids', 0x20}, {0x0, 'io', 0x20}]}, 0x21)
connect$unix(0xffffffffffffffff, &(0x7f0000000100)=@abs, 0x6e)
ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82)

[ 1542.657399] binder: 18571:18572 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1542.662395] binder: BINDER_SET_CONTEXT_MGR already set
[ 1542.662401] binder: 18570:18573 ioctl 40046207 0 returned -16
[ 1542.670139] binder: BINDER_SET_CONTEXT_MGR already set
[ 1542.670145] binder: 18574:18575 ioctl 40046207 0 returned -16
[ 1542.679387] binder: 18574:18575 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1542.707664] binder: BINDER_SET_CONTEXT_MGR already set
[ 1542.707671] binder: 18576:18577 ioctl 40046207 0 returned -16
[ 1542.753601] binder: BINDER_SET_CONTEXT_MGR already set
2018/03/29 19:07:57 executing program 3:
add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={0x73, 0x79, 0x7a}, &(0x7f0000001100)="a1", 0x1, 0xfffffffffffffffb)
perf_event_open(&(0x7f000025c000)={0x2, 0x78}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sendmmsg(0xffffffffffffffff, &(0x7f0000000200), 0x0, 0x0)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f00000000c0)={"d202b999cf85000000000088f301e710"})
r0 = syz_open_dev$tun(&(0x7f0000000280)='/dev/net/tun\x00', 0x0, 0x400200)
r1 = socket(0x11, 0x100000802, 0x0)
r2 = syz_open_dev$tun(&(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000000c0)={'ifb0\x00', 0x1001})
ioctl$TUNSETLINK(r2, 0x400454cd, 0x308)
ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000040)={'ifb0\x00', 0xa201})
r3 = dup2(r0, 0xffffffffffffffff)
ioctl$TUNSETQUEUE(0xffffffffffffffff, 0x400454d9, &(0x7f0000000000)={'vlan0\x00'})
write$cgroup_subtree(r3, &(0x7f00000001c0)={[{0x0, 'cpu', 0x20}, {0x0, 'pids', 0x20}, {0x2d, 'pids', 0x20}, {0x2b, 'rdma', 0x20}, {0x2b, 'pids', 0x20}, {0x0, 'memory', 0x20}]}, 0x25)
connect$unix(0xffffffffffffffff, &(0x7f0000000100)=@abs, 0x6e)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)

[ 1542.753609] binder: 18580:18583 ioctl 40046207 0 returned -16
[ 1542.753830] binder: BINDER_SET_CONTEXT_MGR already set
[ 1542.753838] binder: 18579:18581 ioctl 40046207 0 returned -16
[ 1542.754887] binder: BINDER_SET_CONTEXT_MGR already set
[ 1542.754894] binder: 18578:18582 ioctl 40046207 0 returned -16
2018/03/29 19:07:57 executing program 0:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
r1 = mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x7c, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @increfs_done={0x40106308, r1, 0x3}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x0]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r2 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r3, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
keyctl$assume_authority(0x10, 0x0)
r4 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r4, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(0xffffffffffffffff, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x0, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6c8344f9f96ef2c7fe911c01908", 0x5c, 0x0, &(0x7f0000000040)={0x77359400})
r5 = add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0e9467edd", 0x19, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, r5, &(0x7f00000006c0)=[{&(0x7f0000000400)}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r6 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(r0, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x32b, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r6}], 0x1, 0x0)

2018/03/29 19:07:57 executing program 5:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
r1 = mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x7c, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @increfs_done={0x40106308, r1, 0x3}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r2 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r3, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
keyctl$assume_authority(0x10, 0x0)
r4 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r4, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(r4, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x200, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6c834", 0x51, 0x0, &(0x7f0000000040)={0x77359400})
r5 = add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0e9467edd7f398f", 0x1c, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, r5, &(0x7f00000006c0)=[{&(0x7f0000000400)}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r6 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(0xffffffffffffffff, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(0xffffffffffffffff, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000080)={0x0, 0x0, &(0x7f000000dff8), 0x0, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r6}], 0x1, 0x0)

2018/03/29 19:07:57 executing program 2:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x70, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @release={0x40046306, 0x1}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r1 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
r2 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r2, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
r3 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r3, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(r3, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x200, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6c8344f9f96ef2c7fe911c019080e", 0x5d, 0x0, &(0x7f0000000040)={0x77359400})
r4 = add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0e9467edd7f398f", 0x1c, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, 0x0, &(0x7f00000006c0)=[{&(0x7f0000000400)="f916b8f72c29a4ed654ec4634d479b3453a0dbdd444019513f1d25ccda2381b9d22363dbeef5a27f13994695211b14422a35c08f7510fa", 0x37}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r5 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(r0, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x32b, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r5}], 0x1, 0x0)

[ 1542.763707] binder: 18579:18581 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1542.772501] binder: 18578:18582 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1543.090145] binder: BINDER_SET_CONTEXT_MGR already set
[ 1543.090153] binder: 18585:18589 ioctl 40046207 0 returned -16
[ 1543.099814] binder: BINDER_SET_CONTEXT_MGR already set
[ 1543.099822] binder: 18587:18596 ioctl 40046207 0 returned -16
2018/03/29 19:07:57 executing program 5:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
r1 = mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x7c, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @increfs_done={0x40106308, r1, 0x3}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r2 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r3, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
keyctl$assume_authority(0x10, 0x0)
r4 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r4, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(r4, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x200, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6c834", 0x51, 0x0, &(0x7f0000000040)={0x77359400})
r5 = add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0e9467edd7f398f", 0x1c, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, r5, &(0x7f00000006c0)=[{&(0x7f0000000400)}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r6 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(0xffffffffffffffff, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(0xffffffffffffffff, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000080)={0x0, 0x0, &(0x7f000000dff8), 0x0, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r6}], 0x1, 0x0)

2018/03/29 19:07:57 executing program 0:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
r1 = mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x70, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @increfs_done={0x40106308, r1, 0x3}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r2 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r3, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
keyctl$assume_authority(0x10, 0x0)
r4 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r4, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(0xffffffffffffffff, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x0, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6c8344f9f96ef2c7fe911c01908", 0x5c, 0x0, &(0x7f0000000040)={0x77359400})
r5 = add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0e9467edd", 0x19, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, r5, &(0x7f00000006c0)=[{&(0x7f0000000400)}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r6 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(r0, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x32b, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r6}], 0x1, 0x0)

[ 1543.101519] binder: BINDER_SET_CONTEXT_MGR already set
[ 1543.101526] binder: 18586:18590 ioctl 40046207 0 returned -16
[ 1543.105483] binder: BINDER_SET_CONTEXT_MGR already set
[ 1543.105490] binder: 18584:18594 ioctl 40046207 0 returned -16
[ 1543.110581] binder: 18586:18590 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1543.112239] binder: 18584:18594 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1543.174087] binder: BINDER_SET_CONTEXT_MGR already set
[ 1543.174095] binder: 18604:18606 ioctl 40046207 0 returned -16
2018/03/29 19:07:57 executing program 2:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x70, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @release={0x40046306, 0x1}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r1 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
r2 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r2, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
r3 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r3, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(r3, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x200, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6c8344f9f96ef2c7fe911c019080e", 0x5d, 0x0, &(0x7f0000000040)={0x77359400})
r4 = add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0e9467edd7f398f", 0x1c, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, r4, &(0x7f00000006c0), 0x0, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r5 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(r0, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x32b, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r5}], 0x1, 0x0)

[ 1543.187019] binder: BINDER_SET_CONTEXT_MGR already set
[ 1543.187027] binder: 18605:18607 ioctl 40046207 0 returned -16
[ 1543.195351] binder: BINDER_SET_CONTEXT_MGR already set
[ 1543.195357] binder: 18608:18610 ioctl 40046207 0 returned -16
[ 1543.205243] binder: 18608:18610 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1543.220175] binder: BINDER_SET_CONTEXT_MGR already set
[ 1543.220183] binder: 18609:18611 ioctl 40046207 0 returned -16
2018/03/29 19:07:57 executing program 5:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
r1 = mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x7c, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @increfs_done={0x40106308, r1, 0x3}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r2 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r3, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
keyctl$assume_authority(0x10, 0x0)
r4 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r4, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(r4, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x200, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6c834", 0x51, 0x0, &(0x7f0000000040)={0x77359400})
r5 = add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0e9467edd7f398f", 0x1c, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, r5, &(0x7f00000006c0)=[{&(0x7f0000000400)}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r6 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(0xffffffffffffffff, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(0xffffffffffffffff, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000080)={0x0, 0x0, &(0x7f000000dff8), 0x0, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r6}], 0x1, 0x0)

[ 1543.222993] binder: 18609:18611 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1543.245776] binder: BINDER_SET_CONTEXT_MGR already set
[ 1543.245783] binder: 18613:18614 ioctl 40046207 0 returned -16
[ 1543.253888] binder: BINDER_SET_CONTEXT_MGR already set
[ 1543.253895] binder: 18616:18617 ioctl 40046207 0 returned -16
[ 1543.257505] binder: 18616:18617 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1543.273956] binder: BINDER_SET_CONTEXT_MGR already set
[ 1543.273964] binder: 18618:18619 ioctl 40046207 0 returned -16
[ 1543.279047] binder: 18618:18619 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1543.336103] binder: BINDER_SET_CONTEXT_MGR already set
[ 1543.336110] binder: 18622:18623 ioctl 40046207 0 returned -16
[ 1543.341286] binder: 18622:18623 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1543.341487] binder: BINDER_SET_CONTEXT_MGR already set
[ 1543.341493] binder: 18624:18625 ioctl 40046207 0 returned -16
[ 1543.345407] binder: 18624:18625 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1543.752141] binder: BINDER_SET_CONTEXT_MGR already set
[ 1543.752150] binder: 18628:18637 ioctl 40046207 0 returned -16
[ 1543.754573] binder: BINDER_SET_CONTEXT_MGR already set
[ 1543.754580] binder: 18626:18638 ioctl 40046207 0 returned -16
[ 1543.766662] binder: 18628:18637 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1543.788408] binder: BINDER_SET_CONTEXT_MGR already set
[ 1543.788416] binder: 18636:18640 ioctl 40046207 0 returned -16
[ 1543.820890] binder: 18636:18640 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1543.938317] binder: BINDER_SET_CONTEXT_MGR already set
[ 1543.938324] binder: 18648:18651 ioctl 40046207 0 returned -16
[ 1543.940346] binder: BINDER_SET_CONTEXT_MGR already set
[ 1543.940353] binder: 18644:18646 ioctl 40046207 0 returned -16
[ 1543.942375] binder: BINDER_SET_CONTEXT_MGR already set
[ 1543.942382] binder: 18647:18649 ioctl 40046207 0 returned -16
[ 1543.949376] binder: 18648:18651 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1543.950341] binder: BINDER_SET_CONTEXT_MGR already set
[ 1543.950349] binder: 18645:18650 ioctl 40046207 0 returned -16
[ 1543.952545] binder: 18647:18649 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1544.003636] binder: BINDER_SET_CONTEXT_MGR already set
[ 1544.003643] binder: 18654:18655 ioctl 40046207 0 returned -16
[ 1544.267237] binder: BINDER_SET_CONTEXT_MGR already set
[ 1544.267247] binder: 18661:18665 ioctl 40046207 0 returned -16
[ 1544.277769] binder: BINDER_SET_CONTEXT_MGR already set
[ 1544.277776] binder: 18660:18666 ioctl 40046207 0 returned -16
[ 1544.280985] binder: 18661:18665 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1544.281729] binder: BINDER_SET_CONTEXT_MGR already set
[ 1544.281736] binder: 18663:18667 ioctl 40046207 0 returned -16
[ 1544.284648] binder: BINDER_SET_CONTEXT_MGR already set
[ 1544.284655] binder: 18659:18672 ioctl 40046207 0 returned -16
[ 1544.286789] binder: 18660:18666 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1544.291420] binder: 18663:18667 ioctl c0306201 20000080 returned -14
[ 1544.307702] binder: BINDER_SET_CONTEXT_MGR already set
[ 1544.307708] binder: 18677:18679 ioctl 40046207 0 returned -16
[ 1544.313779] binder: 18677:18679 ioctl c0306201 20000080 returned -14
[ 1544.358425] binder: BINDER_SET_CONTEXT_MGR already set
[ 1544.358431] binder: 18685:18686 ioctl 40046207 0 returned -16
[ 1544.361546] binder: BINDER_SET_CONTEXT_MGR already set
[ 1544.361553] binder: 18683:18687 ioctl 40046207 0 returned -16
[ 1544.380185] binder: 18683:18687 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1544.384259] binder: BINDER_SET_CONTEXT_MGR already set
[ 1544.384266] binder: 18684:18689 ioctl 40046207 0 returned -16
[ 1544.387859] binder: BINDER_SET_CONTEXT_MGR already set
[ 1544.387866] binder: 18688:18690 ioctl 40046207 0 returned -16
[ 1544.396773] binder: 18684:18689 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1544.398898] binder: 18688:18690 ioctl c0306201 20000080 returned -14
[ 1544.434906] binder: BINDER_SET_CONTEXT_MGR already set
[ 1544.434913] binder: 18692:18694 ioctl 40046207 0 returned -16
[ 1544.439227] binder: 18692:18694 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1544.442383] binder: BINDER_SET_CONTEXT_MGR already set
[ 1544.442390] binder: 18691:18693 ioctl 40046207 0 returned -16
[ 1544.744189] binder: BINDER_SET_CONTEXT_MGR already set
[ 1544.744198] binder: 18696:18703 ioctl 40046207 0 returned -16
2018/03/29 19:07:57 executing program 2:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x70, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @release={0x40046306, 0x1}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r1 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
r2 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r2, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
r3 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r3, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(r3, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x200, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6c8344f9f96ef2c7fe911c019080e", 0x5d, 0x0, &(0x7f0000000040)={0x77359400})
r4 = add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0e9467edd7f398f", 0x1c, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, r4, &(0x7f00000006c0), 0x0, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r5 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(r0, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x32b, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r5}], 0x1, 0x0)

2018/03/29 19:07:57 executing program 0:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
r1 = mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x70, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @increfs_done={0x40106308, r1, 0x3}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r2 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r3, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
keyctl$assume_authority(0x10, 0x0)
r4 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r4, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(0xffffffffffffffff, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x0, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6c8344f9f96ef2c7fe911c01908", 0x5c, 0x0, &(0x7f0000000040)={0x77359400})
r5 = add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0e9467edd", 0x19, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, r5, &(0x7f00000006c0)=[{&(0x7f0000000400)}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r6 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(r0, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x32b, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r6}], 0x1, 0x0)

2018/03/29 19:07:57 executing program 5:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
r1 = mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x7c, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @increfs_done={0x40106308, r1, 0x3}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r2 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r3, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
keyctl$assume_authority(0x10, 0x0)
r4 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r4, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(r4, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x200, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6c834", 0x51, 0x0, &(0x7f0000000040)={0x77359400})
r5 = add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0e9467edd7f398f", 0x1c, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, r5, &(0x7f00000006c0)=[{&(0x7f0000000400)}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r6 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(0xffffffffffffffff, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(0xffffffffffffffff, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000080)={0x0, 0x0, &(0x7f000000dff8), 0x0, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r6}], 0x1, 0x0)

2018/03/29 19:07:57 executing program 3:
add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={0x73, 0x79, 0x7a}, &(0x7f0000001100)="a1", 0x1, 0xfffffffffffffffb)
perf_event_open(&(0x7f000025c000)={0x2, 0x78}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sendmmsg(0xffffffffffffffff, &(0x7f0000000200), 0x0, 0x0)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f00000000c0)={"d202b999cf85000000000088f301e710"})
r0 = syz_open_dev$tun(&(0x7f0000000280)='/dev/net/tun\x00', 0x0, 0x400200)
r1 = socket(0x11, 0x100000802, 0x0)
r2 = syz_open_dev$tun(&(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000000c0)={'ifb0\x00', 0x1001})
ioctl$TUNSETLINK(r2, 0x400454cd, 0x308)
ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000040)={'ifb0\x00', 0xa201})
r3 = dup2(r0, 0xffffffffffffffff)
ioctl$TUNSETQUEUE(0xffffffffffffffff, 0x400454d9, &(0x7f0000000000)={'vlan0\x00'})
write$cgroup_subtree(r3, &(0x7f00000001c0)={[{0x0, 'cpu', 0x20}, {0x0, 'pids', 0x20}, {0x2d, 'pids', 0x20}, {0x2b, 'rdma', 0x20}, {0x2b, 'pids', 0x20}, {0x0, 'memory', 0x20}]}, 0x25)
connect$unix(0xffffffffffffffff, &(0x7f0000000100)=@abs, 0x6e)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)

2018/03/29 19:07:57 executing program 6:
add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={0x73, 0x79, 0x7a}, &(0x7f0000001100)="a1", 0x1, 0xfffffffffffffffb)
sendmmsg(0xffffffffffffffff, &(0x7f0000000200)=[{{&(0x7f0000003000)=@rc={0x1f}, 0x80, &(0x7f0000004fa0), 0x0, &(0x7f0000002d30)}}], 0x1, 0x0)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f00000000c0)={"d202b999cf85000000000088f301e710"})
syz_open_dev$tun(&(0x7f0000000280)='/dev/net/tun\x00', 0x0, 0x400200)
r0 = socket(0x11, 0x100000802, 0x0)
r1 = syz_open_dev$tun(&(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'ifb0\x00', 0x1001})
ioctl$TUNSETLINK(r1, 0x400454cd, 0x308)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000040)={'ifb0\x00', 0xa201})
r2 = dup2(0xffffffffffffffff, 0xffffffffffffffff)
ioctl$TUNSETQUEUE(0xffffffffffffffff, 0x400454d9, &(0x7f0000000000)={'vlan0\x00'})
write$cgroup_subtree(r2, &(0x7f00000001c0)={[{0x0, 'cpu', 0x20}, {0x0, 'pids', 0x20}, {0x0, 'cpu', 0x20}, {0x2d, 'pids', 0x20}, {0x2b, 'pids', 0x20}, {0x0, 'memory', 0x20}]}, 0x24)
ioctl$LOOP_CTL_GET_FREE(r2, 0x4c82)

2018/03/29 19:07:57 executing program 1:
add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={0x73, 0x79, 0x7a}, &(0x7f0000001100)="a1", 0x1, 0xfffffffffffffffb)
perf_event_open(&(0x7f000025c000)={0x0, 0x78}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sendmmsg(0xffffffffffffffff, &(0x7f0000000200)=[{{&(0x7f0000003000)=@rc={0x1f}, 0x80, &(0x7f0000004fa0), 0x0, &(0x7f0000002d30)}}], 0x1, 0x0)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f00000000c0)={"d202b999cf85000000000088f301e710"})
r0 = syz_open_dev$tun(&(0x7f0000000280)='/dev/net/tun\x00', 0x0, 0x400200)
r1 = socket(0x11, 0x100000802, 0x0)
r2 = syz_open_dev$tun(&(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000000c0)={'ifb0\x00', 0x1001})
ioctl$TUNSETLINK(r2, 0x400454cd, 0x308)
ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000040)={'ifb0\x00', 0xa201})
r3 = dup2(r0, 0xffffffffffffffff)
ioctl$TUNSETQUEUE(0xffffffffffffffff, 0x400454d9, &(0x7f0000000000)={'vlan0\x00'})
write$cgroup_subtree(r3, &(0x7f00000001c0)={[{0x0, 'cpu', 0x20}, {0x0, 'pids', 0x20}, {0x0, 'cpu', 0x20}, {0x0, 'pids', 0x20}, {0x2b, 'pids', 0x20}, {0x0, 'memory', 0x20}]}, 0x24)
connect$unix(r1, &(0x7f0000000100)=@abs, 0x6e)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)

2018/03/29 19:07:57 executing program 4:
add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={0x73, 0x79, 0x7a}, &(0x7f0000001100)="a1", 0x1, 0xfffffffffffffffb)
perf_event_open(&(0x7f000025c000)={0x2, 0x78}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
pipe2(&(0x7f0000000180), 0x0)
socket(0x18, 0x0, 0x1)
sendmmsg(0xffffffffffffffff, &(0x7f0000000200)=[{{&(0x7f0000003000)=@rc={0x1f}, 0x80, &(0x7f0000004fa0), 0x0, &(0x7f0000002d30)}}], 0x1, 0x0)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f00000000c0)={"d202b999cf85000000000088f301e710"})
r0 = syz_open_dev$tun(&(0x7f0000000280)='/dev/net/tun\x00', 0x0, 0x400200)
r1 = socket(0x11, 0x100000802, 0x0)
r2 = syz_open_dev$tun(&(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000000c0)={'ifb0\x00', 0x1001})
ioctl$TUNSETLINK(r2, 0x400454cd, 0x308)
ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000040)={'ifb0\x00', 0xa201})
r3 = dup2(r0, 0xffffffffffffffff)
ioctl$TUNSETQUEUE(0xffffffffffffffff, 0x400454d9, &(0x7f0000000000)={'vlan0\x00'})
write$cgroup_subtree(r3, &(0x7f00000001c0)={[{0x0, 'pids', 0x20}, {0x0, 'cpu', 0x20}, {0x2d, 'pids', 0x20}, {0x2b, 'rdma', 0x20}, {0x0, 'pids', 0x20}, {0x0, 'io', 0x20}]}, 0x21)
connect$unix(0xffffffffffffffff, &(0x7f0000000100)=@abs, 0x6e)
ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82)

2018/03/29 19:07:57 executing program 7:
add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={0x73, 0x79, 0x7a}, &(0x7f0000001100)="a1", 0x1, 0xfffffffffffffffb)
sendmmsg(0xffffffffffffffff, &(0x7f0000000200)=[{{&(0x7f0000003000)=@rc={0x1f}, 0x80, &(0x7f0000004fa0), 0x0, &(0x7f0000002d30)}}], 0x1, 0x0)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f00000000c0)={"d202b999cf85000000000088f301e710"})
r0 = syz_open_dev$tun(&(0x7f0000000280)='/dev/net/tun\x00', 0x0, 0x400200)
r1 = socket(0x11, 0x100000802, 0x0)
r2 = syz_open_dev$tun(&(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000000c0)={'ifb0\x00', 0x1001})
ioctl$TUNSETLINK(r2, 0x400454cd, 0x308)
ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000040)={'ifb0\x00', 0xa201})
r3 = dup2(r0, 0xffffffffffffffff)
ioctl$TUNSETQUEUE(0xffffffffffffffff, 0x400454d9, &(0x7f0000000000)={'vlan0\x00'})
write$cgroup_subtree(r3, &(0x7f00000001c0)={[{0x0, 'pids', 0x20}, {0x0, 'cpu', 0x20}, {0x2d, 'pids', 0x20}, {0x2b, 'pids', 0x20}, {0x0, 'memory', 0x20}]}, 0x1f)
connect$unix(r1, &(0x7f0000000100)=@abs, 0x6e)
ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)

[ 1544.747894] binder: BINDER_SET_CONTEXT_MGR already set
[ 1544.747901] binder: 18700:18704 ioctl 40046207 0 returned -16
[ 1544.758672] binder: 18700:18704 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1544.763338] binder: BINDER_SET_CONTEXT_MGR already set
[ 1544.763345] binder: 18697:18705 ioctl 40046207 0 returned -16
2018/03/29 19:07:57 executing program 0:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
r1 = mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x70, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @increfs_done={0x40106308, r1, 0x3}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r2 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r3, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
keyctl$assume_authority(0x10, 0x0)
r4 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r4, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(0xffffffffffffffff, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x0, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6c8344f9f96ef2c7fe911c01908", 0x5c, 0x0, &(0x7f0000000040)={0x77359400})
r5 = add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0e9467edd", 0x19, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, r5, &(0x7f00000006c0)=[{&(0x7f0000000400)}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r6 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(r0, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x32b, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r6}], 0x1, 0x0)

2018/03/29 19:07:58 executing program 2:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x70, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @release={0x40046306, 0x1}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r1 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
r2 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r2, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
r3 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r3, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(r3, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x200, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6c8344f9f96ef2c7fe911c019080e", 0x5d, 0x0, &(0x7f0000000040)={0x77359400})
r4 = add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0e9467edd7f398f", 0x1c, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, r4, &(0x7f00000006c0), 0x0, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r5 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00', 0x4000})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(r0, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x32b, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r5}], 0x1, 0x0)

[ 1544.764313] binder: BINDER_SET_CONTEXT_MGR already set
[ 1544.764319] binder: 18695:18707 ioctl 40046207 0 returned -16
[ 1544.785077] binder: 18695:18707 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1544.815771] binder: BINDER_SET_CONTEXT_MGR already set
[ 1544.815778] binder: 18716:18717 ioctl 40046207 0 returned -16
[ 1544.836180] binder: BINDER_SET_CONTEXT_MGR already set
[ 1544.836187] binder: 18718:18719 ioctl 40046207 0 returned -16
[ 1544.852768] binder: BINDER_SET_CONTEXT_MGR already set
2018/03/29 19:07:58 executing program 5:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
r1 = mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x2010, 0xffffffffffffffff, 0x0)
close(r0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x7c, 0x0, &(0x7f0000000140)=[@request_death={0x400c630e}, @increfs_done={0x40106308, r1, 0x3}, @increfs={0x40046304}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f00000000c0), &(0x7f0000000100)=[0x38, 0x0, 0x20]}}, @free_buffer={0x40086303}], 0x7c, 0x0, &(0x7f0000000240)="d30a3838691366c4d5babaf61be10f1978ba57e51907caaddaf04403debc6dbb202e78c206c92e0ec46a7ba39069d863603e4269b10b0c9a91a3589a088d2fea28058e72d553f5f3bf14992f90e3dae03935cc2ba087eb5275862e98b898d535ef90889188b67018bbd1ff30daab0cca58ed89de2418e5e9ee39d77f"})
r2 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
r3 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x9})
mq_timedsend(r3, &(0x7f0000000180)="eae331b69e5a59d1482eb0bc2db06f216d624660dd70eee7d0ee86a0442500bb630eefc6d2499834ecfb1841b13806f248c951885757cca684cf0d39f554a64671c42278fc046669e9c677e7f42ec483a2547eb8c0f42108121572ab62a518", 0x5f, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
keyctl$assume_authority(0x10, 0x0)
r4 = socket$l2tp(0x18, 0x1, 0x1)
connect$l2tp(r4, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e21, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e)
sendmsg$nl_crypto(r4, &(0x7f000037ffc8)={&(0x7f00009dd000)={0x10}, 0xc, &(0x7f00002ceff0)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x200, 0x1, 0x3}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81)
mq_timedsend(0xffffffffffffffff, &(0x7f0000000240)="37e6f77a3795ab4b8e0d35892dea11513cf71c63ac4349d20b0950239d14de892933caa0e1d4ab8b0600b3ff46500db5fdfe541d673e710efda9d88e780790c72fed6fdacc24c734c4890557633eb6c834", 0x51, 0x0, &(0x7f0000000040)={0x77359400})
r5 = add_key$user(&(0x7f0000000300)='user\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, &(0x7f00000003c0)="9972845b577b6fb20c980a7d9180627bea7b2b09e0e9467edd7f398f", 0x1c, 0xfffffffffffffff8)
request_key(&(0x7f0000000700)='ceph\x00', &(0x7f0000000740)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000780)='^vboxnet0selinuxmd5sumvboxnet0self^cgroup^securitykeyring\x00', 0xfffffffffffffff8)
keyctl$instantiate_iov(0x14, r5, &(0x7f00000006c0)=[{&(0x7f0000000400)}], 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000480)={&(0x7f0000000440)=[0x0, 0x0], 0x2})
r6 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$VT_WAITACTIVE(r0, 0x5607)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'tunl0\x00'})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, &(0x7f0000012fc7)})
openat$cgroup_int(0xffffffffffffffff, &(0x7f00000004c0)='cpuset.mem_hardwall\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000080)={0x0, 0x0, &(0x7f000000dff8), 0x0, 0x0, &(0x7f0000000040)})
poll(&(0x7f0000000000)=[{r6}], 0x1, 0x0)

[ 1544.852775] binder: 18720:18721 ioctl 40046207 0 returned -16
[ 1544.879561] binder: BINDER_SET_CONTEXT_MGR already set
[ 1544.879569] binder: 18722:18723 ioctl 40046207 0 returned -16
[ 1544.883529] binder: 18722:18723 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1544.908872] binder: BINDER_SET_CONTEXT_MGR already set
[ 1544.908879] binder: 18725:18726 ioctl 40046207 0 returned -16
[ 1544.914819] binder: BINDER_SET_CONTEXT_MGR already set
[ 1544.914826] binder: 18727:18729 ioctl 40046207 0 returned -16
[ 1544.927844] binder: BINDER_SET_CONTEXT_MGR already set
[ 1544.927851] binder: 18728:18730 ioctl 40046207 0 returned -16
[ 1544.942004] binder: BINDER_SET_CONTEXT_MGR already set
[ 1544.942012] binder: 18733:18734 ioctl 40046207 0 returned -16
[ 1544.946236] binder: 18731:18732 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1545.297772] binder: BINDER_SET_CONTEXT_MGR already set
[ 1545.297781] binder: 18738:18745 ioctl 40046207 0 returned -16
[ 1545.300543] binder: BINDER_SET_CONTEXT_MGR already set
[ 1545.300549] binder: 18737:18741 ioctl 40046207 0 returned -16
[ 1545.306277] binder: BINDER_SET_CONTEXT_MGR already set
[ 1545.306284] binder: 18735:18748 ioctl 40046207 0 returned -16
[ 1545.306690] binder: 18736:18740 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1545.360288] binder: BINDER_SET_CONTEXT_MGR already set
[ 1545.360294] binder: 18755:18757 ioctl 40046207 0 returned -16
[ 1545.390246] binder: BINDER_SET_CONTEXT_MGR already set
[ 1545.390254] binder: 18758:18759 ioctl 40046207 0 returned -16
[ 1545.391660] binder: 18760:18762 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1545.392937] binder: 18758:18759 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1545.413680] binder: BINDER_SET_CONTEXT_MGR already set
[ 1545.413688] binder: 18761:18765 ioctl 40046207 0 returned -16
[ 1545.414259] binder: BINDER_SET_CONTEXT_MGR already set
[ 1545.414266] binder: 18766:18767 ioctl 40046207 0 returned -16
[ 1545.458982] binder: BINDER_SET_CONTEXT_MGR already set
[ 1545.458989] binder: 18770:18771 ioctl 40046207 0 returned -16
[ 1545.468862] binder: BINDER_SET_CONTEXT_MGR already set
[ 1545.468869] binder: 18769:18773 ioctl 40046207 0 returned -16
[ 1545.470640] binder: 18770:18771 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1545.473565] binder: BINDER_SET_CONTEXT_MGR already set
[ 1545.473571] binder: 18772:18774 ioctl 40046207 0 returned -16
[ 1545.474459] binder: 18769:18773 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1545.753639] binder: BINDER_SET_CONTEXT_MGR already set
[ 1545.753646] binder: 18775:18777 ioctl 40046207 0 returned -16
[ 1545.768464] binder: BINDER_SET_CONTEXT_MGR already set
[ 1545.768471] binder: 18776:18785 ioctl 40046207 0 returned -16
[ 1545.772552] binder: BINDER_SET_CONTEXT_MGR already set
[ 1545.772559] binder: 18779:18783 ioctl 40046207 0 returned -16
[ 1545.773564] binder: BINDER_SET_CONTEXT_MGR already set
[ 1545.773571] binder: 18778:18788 ioctl 40046207 0 returned -16
[ 1545.780222] binder: 18779:18783 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1545.801511] binder: 18778:18788 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1545.852933] binder: BINDER_SET_CONTEXT_MGR already set
[ 1545.852942] binder: 18796:18797 ioctl 40046207 0 returned -16
[ 1545.862666] binder: BINDER_SET_CONTEXT_MGR already set
[ 1545.862674] binder: 18795:18798 ioctl 40046207 0 returned -16
[ 1545.863565] binder: BINDER_SET_CONTEXT_MGR already set
[ 1545.863571] binder: 18800:18801 ioctl 40046207 0 returned -16
[ 1545.867048] binder: BINDER_SET_CONTEXT_MGR already set
[ 1545.867055] binder: 18799:18803 ioctl 40046207 0 returned -16
[ 1545.871605] binder: 18799:18803 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1545.881025] binder: 18800:18801 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1545.901970] binder: BINDER_SET_CONTEXT_MGR already set
[ 1545.901977] binder: 18805:18806 ioctl 40046207 0 returned -16
[ 1545.923614] binder: BINDER_SET_CONTEXT_MGR already set
[ 1545.923621] binder: 18807:18808 ioctl 40046207 0 returned -16
[ 1545.932681] binder: BINDER_SET_CONTEXT_MGR already set
[ 1545.932688] binder: 18809:18810 ioctl 40046207 0 returned -16
[ 1545.942387] binder: 18809:18810 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1545.943446] binder: BINDER_SET_CONTEXT_MGR already set
[ 1545.943453] binder: 18811:18812 ioctl 40046207 0 returned -16
[ 1545.947624] binder: 18811:18812 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1546.253901] binder: BINDER_SET_CONTEXT_MGR already set
[ 1546.253909] binder: 18817:18824 ioctl 40046207 0 returned -16
[ 1546.257426] binder: BINDER_SET_CONTEXT_MGR already set
[ 1546.257434] binder: 18814:18819 ioctl 40046207 0 returned -16
[ 1546.259414] binder: BINDER_SET_CONTEXT_MGR already set
[ 1546.259421] binder: 18813:18826 ioctl 40046207 0 returned -16
[ 1546.263052] binder: BINDER_SET_CONTEXT_MGR already set
[ 1546.263060] binder: 18815:18822 ioctl 40046207 0 returned -16
[ 1546.267967] binder: 18817:18824 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1546.271094] binder: 18815:18822 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1546.292458] binder: BINDER_SET_CONTEXT_MGR already set
[ 1546.292465] binder: 18833:18835 ioctl 40046207 0 returned -16
[ 1546.335589] binder: BINDER_SET_CONTEXT_MGR already set
[ 1546.335596] binder: 18837:18840 ioctl 40046207 0 returned -16
[ 1546.340233] binder: 18837:18840 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1546.341529] binder: BINDER_SET_CONTEXT_MGR already set
[ 1546.341537] binder: 18838:18842 ioctl 40046207 0 returned -16
[ 1546.346545] binder: BINDER_SET_CONTEXT_MGR already set
[ 1546.346552] binder: 18839:18841 ioctl 40046207 0 returned -16
[ 1546.351285] binder: 18839:18841 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1546.386980] binder: BINDER_SET_CONTEXT_MGR already set
[ 1546.386987] binder: 18845:18846 ioctl 40046207 0 returned -16
[ 1546.388433] binder: BINDER_SET_CONTEXT_MGR already set
[ 1546.388440] binder: 18843:18844 ioctl 40046207 0 returned -16
[ 1546.401219] binder: 18845:18846 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1546.413230] binder: BINDER_SET_CONTEXT_MGR already set
[ 1546.413237] binder: 18847:18850 ioctl 40046207 0 returned -16
[ 1546.417392] binder: 18847:18850 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1546.421087] binder: BINDER_SET_CONTEXT_MGR already set
[ 1546.421094] binder: 18848:18849 ioctl 40046207 0 returned -16
[ 1546.700473] binder: BINDER_SET_CONTEXT_MGR already set
[ 1546.700482] binder: 18853:18857 ioctl 40046207 0 returned -16
[ 1546.701271] binder: BINDER_SET_CONTEXT_MGR already set
[ 1546.701278] binder: 18852:18860 ioctl 40046207 0 returned -16
[ 1546.704720] binder: BINDER_SET_CONTEXT_MGR already set
[ 1546.704726] binder: 18851:18862 ioctl 40046207 0 returned -16
[ 1546.711534] binder: BINDER_SET_CONTEXT_MGR already set
[ 1546.711541] binder: 18854:18864 ioctl 40046207 0 returned -16
[ 1546.718550] binder: 18852:18860 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1546.719839] binder: 18853:18857 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1546.785739] binder: BINDER_SET_CONTEXT_MGR already set
[ 1546.785746] binder: 18871:18877 ioctl 40046207 0 returned -16
[ 1546.787031] binder: BINDER_SET_CONTEXT_MGR already set
[ 1546.787038] binder: 18873:18874 ioctl 40046207 0 returned -16
[ 1546.787419] binder: BINDER_SET_CONTEXT_MGR already set
[ 1546.787425] binder: 18872:18875 ioctl 40046207 0 returned -16
[ 1546.792800] binder: BINDER_SET_CONTEXT_MGR already set
[ 1546.792807] binder: 18876:18878 ioctl 40046207 0 returned -16
[ 1546.800474] binder: 18873:18874 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1546.804948] binder: 18876:18878 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1546.859571] binder: BINDER_SET_CONTEXT_MGR already set
[ 1546.859579] binder: 18882:18886 ioctl 40046207 0 returned -16
[ 1546.864029] binder: BINDER_SET_CONTEXT_MGR already set
[ 1546.864035] binder: 18884:18889 ioctl 40046207 0 returned -16
[ 1546.868047] binder: 18884:18889 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1546.870538] binder: 18882:18886 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1546.873205] binder: BINDER_SET_CONTEXT_MGR already set
[ 1546.873212] binder: 18883:18888 ioctl 40046207 0 returned -16
[ 1546.881122] binder: BINDER_SET_CONTEXT_MGR already set
[ 1546.881129] binder: 18885:18887 ioctl 40046207 0 returned -16
[ 1547.117699] binder: BINDER_SET_CONTEXT_MGR already set
[ 1547.117707] binder: 18891:18896 ioctl 40046207 0 returned -16
[ 1547.123309] binder: BINDER_SET_CONTEXT_MGR already set
[ 1547.123318] binder: 18894:18898 ioctl 40046207 0 returned -16
[ 1547.128582] binder: BINDER_SET_CONTEXT_MGR already set
[ 1547.128589] binder: 18892:18902 ioctl 40046207 0 returned -16
[ 1547.132497] binder: BINDER_SET_CONTEXT_MGR already set
[ 1547.132504] binder: 18890:18904 ioctl 40046207 0 returned -16
[ 1547.136023] binder: 18891:18896 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1547.143860] binder: 18890:18904 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1547.214262] binder: BINDER_SET_CONTEXT_MGR already set
[ 1547.214270] binder: 18910:18913 ioctl 40046207 0 returned -16
[ 1547.218375] binder: BINDER_SET_CONTEXT_MGR already set
[ 1547.218383] binder: 18912:18916 ioctl 40046207 0 returned -16
[ 1547.218784] binder: BINDER_SET_CONTEXT_MGR already set
[ 1547.218790] binder: 18911:18914 ioctl 40046207 0 returned -16
[ 1547.226928] binder: 18911:18914 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1547.227282] binder: BINDER_SET_CONTEXT_MGR already set
[ 1547.227338] binder: 18915:18918 ioctl 40046207 0 returned -16
[ 1547.280314] binder: BINDER_SET_CONTEXT_MGR already set
[ 1547.280321] binder: 18920:18922 ioctl 40046207 0 returned -16
[ 1547.529125] binder: BINDER_SET_CONTEXT_MGR already set
[ 1547.529133] binder: 18926:18928 ioctl 40046207 0 returned -16
[ 1547.529971] binder: BINDER_SET_CONTEXT_MGR already set
[ 1547.529977] binder: 18925:18927 ioctl 40046207 0 returned -16
[ 1547.533944] binder: BINDER_SET_CONTEXT_MGR already set
[ 1547.533951] binder: 18931:18938 ioctl 40046207 0 returned -16
[ 1547.540810] binder: BINDER_SET_CONTEXT_MGR already set
[ 1547.540818] binder: 18924:18936 ioctl 40046207 0 returned -16
[ 1547.549503] binder: 18931:18938 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1547.600925] binder: BINDER_SET_CONTEXT_MGR already set
[ 1547.600932] binder: 18944:18945 ioctl 40046207 0 returned -16
[ 1547.626043] binder: BINDER_SET_CONTEXT_MGR already set
[ 1547.626050] binder: 18948:18949 ioctl 40046207 0 returned -16
[ 1547.629306] binder: BINDER_SET_CONTEXT_MGR already set
[ 1547.629313] binder: 18946:18950 ioctl 40046207 0 returned -16
[ 1547.631499] binder: BINDER_SET_CONTEXT_MGR already set
[ 1547.631506] binder: 18947:18951 ioctl 40046207 0 returned -16
[ 1547.662354] binder: 18947:18951 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1547.679925] binder: BINDER_SET_CONTEXT_MGR already set
[ 1547.679932] binder: 18952:18953 ioctl 40046207 0 returned -16
[ 1547.685874] binder: BINDER_SET_CONTEXT_MGR already set
[ 1547.685881] binder: 18955:18957 ioctl 40046207 0 returned -16
[ 1547.692932] binder: 18952:18953 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1547.707193] binder: BINDER_SET_CONTEXT_MGR already set
[ 1547.707200] binder: 18954:18956 ioctl 40046207 0 returned -16
[ 1547.729053] binder: BINDER_SET_CONTEXT_MGR already set
[ 1547.729060] binder: 18958:18959 ioctl 40046207 0 returned -16
[ 1547.747306] binder: 18958:18959 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1547.755911] binder: BINDER_SET_CONTEXT_MGR already set
[ 1547.755918] binder: 18960:18961 ioctl 40046207 0 returned -16
[ 1547.761426] binder: BINDER_SET_CONTEXT_MGR already set
[ 1547.761433] binder: 18962:18963 ioctl 40046207 0 returned -16
[ 1547.764156] binder: 18960:18961 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1547.997139] binder: BINDER_SET_CONTEXT_MGR already set
[ 1547.997146] binder: 18967:18971 ioctl 40046207 0 returned -16
[ 1548.002939] binder: BINDER_SET_CONTEXT_MGR already set
[ 1548.002946] binder: 18965:18969 ioctl 40046207 0 returned -16
[ 1548.006978] binder: BINDER_SET_CONTEXT_MGR already set
[ 1548.006985] binder: 18964:18974 ioctl 40046207 0 returned -16
[ 1548.008342] binder: 18967:18971 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1548.008936] binder: BINDER_SET_CONTEXT_MGR already set
[ 1548.008943] binder: 18966:18976 ioctl 40046207 0 returned -16
[ 1548.023486] binder: 18966:18976 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1548.097459] binder: BINDER_SET_CONTEXT_MGR already set
[ 1548.097466] binder: 18985:18989 ioctl 40046207 0 returned -16
[ 1548.105926] binder: BINDER_SET_CONTEXT_MGR already set
[ 1548.105933] binder: 18988:18991 ioctl 40046207 0 returned -16
[ 1548.109909] binder: BINDER_SET_CONTEXT_MGR already set
[ 1548.109915] binder: 18986:18992 ioctl 40046207 0 returned -16
[ 1548.121523] binder: BINDER_SET_CONTEXT_MGR already set
[ 1548.121531] binder: 18987:18990 ioctl 40046207 0 returned -16
[ 1548.121931] binder: 18988:18991 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1548.122050] binder: 18986:18992 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1548.173256] binder: BINDER_SET_CONTEXT_MGR already set
[ 1548.173264] binder: 18993:18994 ioctl 40046207 0 returned -16
[ 1548.181807] binder: BINDER_SET_CONTEXT_MGR already set
[ 1548.181814] binder: 18995:18997 ioctl 40046207 0 returned -16
[ 1548.184392] binder: 18993:18994 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1548.187717] binder: 18995:18997 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1548.195373] binder: BINDER_SET_CONTEXT_MGR already set
[ 1548.195380] binder: 18998:19002 ioctl 40046207 0 returned -16
[ 1548.207664] binder: BINDER_SET_CONTEXT_MGR already set
[ 1548.207671] binder: 18999:19001 ioctl 40046207 0 returned -16
[ 1548.236403] binder: BINDER_SET_CONTEXT_MGR already set
[ 1548.236411] binder: 19004:19006 ioctl 40046207 0 returned -16
[ 1548.242447] binder: 19004:19006 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1548.251940] binder: BINDER_SET_CONTEXT_MGR already set
[ 1548.251947] binder: 19005:19008 ioctl 40046207 0 returned -16
[ 1548.254217] binder: BINDER_SET_CONTEXT_MGR already set
[ 1548.254224] binder: 19007:19009 ioctl 40046207 0 returned -16
[ 1548.256217] binder: 19005:19008 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1548.343701] binder: BINDER_SET_CONTEXT_MGR already set
[ 1548.343709] binder: 19011:19013 ioctl 40046207 0 returned -16
[ 1548.424638] binder: BINDER_SET_CONTEXT_MGR already set
[ 1548.424646] binder: 19017:19023 ioctl 40046207 0 returned -16
[ 1548.426901] binder: BINDER_SET_CONTEXT_MGR already set
[ 1548.426908] binder: 19015:19021 ioctl 40046207 0 returned -16
[ 1548.427848] binder: BINDER_SET_CONTEXT_MGR already set
[ 1548.427855] binder: 19016:19024 ioctl 40046207 0 returned -16
[ 1548.429879] binder: BINDER_SET_CONTEXT_MGR already set
[ 1548.429885] binder: 19020:19022 ioctl 40046207 0 returned -16
[ 1548.439225] binder: 19020:19022 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1548.440935] binder: 19016:19024 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1548.763081] binder: BINDER_SET_CONTEXT_MGR already set
[ 1548.763088] binder: 19033:19037 ioctl 40046207 0 returned -16
[ 1548.766424] binder: BINDER_SET_CONTEXT_MGR already set
[ 1548.766431] binder: 19034:19041 ioctl 40046207 0 returned -16
[ 1548.766542] binder: BINDER_SET_CONTEXT_MGR already set
[ 1548.766550] binder: 19032:19043 ioctl 40046207 0 returned -16
[ 1548.772456] binder: BINDER_SET_CONTEXT_MGR already set
[ 1548.772463] binder: 19035:19044 ioctl 40046207 0 returned -16
[ 1548.778053] binder: 19032:19043 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1548.782980] binder: 19035:19044 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1548.851437] binder: BINDER_SET_CONTEXT_MGR already set
[ 1548.851446] binder: 19050:19054 ioctl 40046207 0 returned -16
[ 1548.852470] binder: BINDER_SET_CONTEXT_MGR already set
[ 1548.852476] binder: 19053:19055 ioctl 40046207 0 returned -16
[ 1548.853153] binder: BINDER_SET_CONTEXT_MGR already set
[ 1548.853161] binder: 19051:19056 ioctl 40046207 0 returned -16
[ 1548.858289] binder: 19051:19056 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1548.859245] binder: BINDER_SET_CONTEXT_MGR already set
[ 1548.859253] binder: 19052:19057 ioctl 40046207 0 returned -16
[ 1548.860769] binder: 19050:19054 ioctl c0306201 20000080 returned -14
[ 1548.863426] binder: 19053:19055 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1548.912507] binder: BINDER_SET_CONTEXT_MGR already set
[ 1548.912514] binder: 19061:19063 ioctl 40046207 0 returned -16
[ 1548.915395] binder: BINDER_SET_CONTEXT_MGR already set
[ 1548.915401] binder: 19058:19059 ioctl 40046207 0 returned -16
[ 1548.923361] binder: BINDER_SET_CONTEXT_MGR already set
[ 1548.923369] binder: 19060:19062 ioctl 40046207 0 returned -16
[ 1548.927137] binder: 19060:19062 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1548.934383] binder: BINDER_SET_CONTEXT_MGR already set
[ 1548.934390] binder: 19064:19065 ioctl 40046207 0 returned -16
[ 1548.937739] binder: 19064:19065 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1549.242808] binder: BINDER_SET_CONTEXT_MGR already set
[ 1549.242817] binder: 19070:19074 ioctl 40046207 0 returned -16
[ 1549.244391] binder: BINDER_SET_CONTEXT_MGR already set
[ 1549.244398] binder: 19067:19076 ioctl 40046207 0 returned -16
[ 1549.248235] binder: BINDER_SET_CONTEXT_MGR already set
[ 1549.248243] binder: 19069:19079 ioctl 40046207 0 returned -16
[ 1549.259917] binder: BINDER_SET_CONTEXT_MGR already set
[ 1549.259924] binder: 19066:19081 ioctl 40046207 0 returned -16
[ 1549.264215] binder: 19069:19079 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1549.267136] binder: 19066:19081 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1549.340465] binder: BINDER_SET_CONTEXT_MGR already set
[ 1549.340473] binder: 19086:19090 ioctl 40046207 0 returned -16
[ 1549.344895] binder: BINDER_SET_CONTEXT_MGR already set
[ 1549.344901] binder: 19088:19091 ioctl 40046207 0 returned -16
[ 1549.349251] binder: BINDER_SET_CONTEXT_MGR already set
[ 1549.349258] binder: 19087:19092 ioctl 40046207 0 returned -16
[ 1549.351309] binder: BINDER_SET_CONTEXT_MGR already set
[ 1549.351316] binder: 19089:19093 ioctl 40046207 0 returned -16
[ 1549.353160] binder: 19088:19091 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1549.360269] binder: 19089:19093 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1549.419374] binder: BINDER_SET_CONTEXT_MGR already set
[ 1549.419381] binder: 19094:19095 ioctl 40046207 0 returned -16
[ 1549.429487] binder: BINDER_SET_CONTEXT_MGR already set
[ 1549.429493] binder: 19096:19101 ioctl 40046207 0 returned -16
[ 1549.433417] binder: 19096:19101 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1549.441265] binder: BINDER_SET_CONTEXT_MGR already set
[ 1549.441273] binder: 19098:19099 ioctl 40046207 0 returned -16
[ 1549.448007] binder: 19098:19099 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1549.456759] binder: BINDER_SET_CONTEXT_MGR already set
[ 1549.456765] binder: 19097:19100 ioctl 40046207 0 returned -16
[ 1549.777921] binder: BINDER_SET_CONTEXT_MGR already set
[ 1549.777928] binder: 19106:19115 ioctl 40046207 0 returned -16
[ 1549.784487] binder: BINDER_SET_CONTEXT_MGR already set
[ 1549.784493] binder: 19102:19116 ioctl 40046207 0 returned -16
[ 1549.785246] binder: BINDER_SET_CONTEXT_MGR already set
[ 1549.785252] binder: 19109:19111 ioctl 40046207 0 returned -16
[ 1549.786026] binder: BINDER_SET_CONTEXT_MGR already set
[ 1549.786033] binder: 19103:19112 ioctl 40046207 0 returned -16
[ 1549.794903] binder: 19106:19115 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1549.799077] binder: 19103:19112 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1549.855540] binder: BINDER_SET_CONTEXT_MGR already set
[ 1549.855548] binder: 19124:19128 ioctl 40046207 0 returned -16
[ 1549.856024] binder: BINDER_SET_CONTEXT_MGR already set
[ 1549.856031] binder: 19125:19131 ioctl 40046207 0 returned -16
[ 1549.860092] binder: BINDER_SET_CONTEXT_MGR already set
[ 1549.860098] binder: 19126:19132 ioctl 40046207 0 returned -16
[ 1549.860927] binder: BINDER_SET_CONTEXT_MGR already set
[ 1549.860934] binder: 19127:19129 ioctl 40046207 0 returned -16
[ 1549.863209] binder: 19125:19131 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1549.870195] binder: 19127:19129 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1549.900535] binder: BINDER_SET_CONTEXT_MGR already set
[ 1549.900542] binder: 19134:19135 ioctl 40046207 0 returned -16
[ 1549.917960] binder: BINDER_SET_CONTEXT_MGR already set
[ 1549.917967] binder: 19136:19137 ioctl 40046207 0 returned -16
[ 1549.921585] binder: 19136:19137 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1549.954634] binder: BINDER_SET_CONTEXT_MGR already set
[ 1549.954642] binder: 19138:19139 ioctl 40046207 0 returned -16
[ 1549.963344] binder: BINDER_SET_CONTEXT_MGR already set
[ 1549.963351] binder: 19140:19141 ioctl 40046207 0 returned -16
[ 1549.967152] binder: 19140:19141 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1550.116163] binder: BINDER_SET_CONTEXT_MGR already set
[ 1550.116171] binder: 19142:19150 ioctl 40046207 0 returned -16
[ 1550.117053] binder: BINDER_SET_CONTEXT_MGR already set
[ 1550.117059] binder: 19143:19152 ioctl 40046207 0 returned -16
[ 1550.120759] binder: BINDER_SET_CONTEXT_MGR already set
[ 1550.120767] binder: 19147:19151 ioctl 40046207 0 returned -16
[ 1550.123681] binder: BINDER_SET_CONTEXT_MGR already set
[ 1550.123688] binder: 19149:19157 ioctl 40046207 0 returned -16
[ 1550.136370] binder: 19149:19157 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1550.139733] binder: 19147:19151 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1550.157129] binder: BINDER_SET_CONTEXT_MGR already set
[ 1550.157136] binder: 19161:19164 ioctl 40046207 0 returned -16
[ 1550.212805] binder: BINDER_SET_CONTEXT_MGR already set
[ 1550.212813] binder: 19169:19171 ioctl 40046207 0 returned -16
[ 1550.214321] binder: BINDER_SET_CONTEXT_MGR already set
[ 1550.214328] binder: 19168:19173 ioctl 40046207 0 returned -16
[ 1550.217001] binder: BINDER_SET_CONTEXT_MGR already set
[ 1550.217008] binder: 19170:19172 ioctl 40046207 0 returned -16
[ 1550.220635] binder: BINDER_SET_CONTEXT_MGR already set
[ 1550.220643] binder: 19166:19174 ioctl 40046207 0 returned -16
[ 1550.221839] binder: 19169:19171 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1550.227291] binder: 19168:19173 ioctl c0306201 20000080 returned -14
[ 1550.279066] binder: BINDER_SET_CONTEXT_MGR already set
[ 1550.279074] binder: 19175:19176 ioctl 40046207 0 returned -16
[ 1550.280992] binder: BINDER_SET_CONTEXT_MGR already set
[ 1550.280998] binder: 19177:19179 ioctl 40046207 0 returned -16
[ 1550.284272] binder: 19177:19179 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1550.300481] binder: BINDER_SET_CONTEXT_MGR already set
[ 1550.300488] binder: 19178:19180 ioctl 40046207 0 returned -16
[ 1550.309876] binder: 19175:19176 ioctl c0306201 20000080 returned -14
[ 1550.391955] binder: BINDER_SET_CONTEXT_MGR already set
[ 1550.391964] binder: 19182:19184 ioctl 40046207 0 returned -16
[ 1550.394478] binder: BINDER_SET_CONTEXT_MGR already set
[ 1550.394487] binder: 19185:19189 ioctl 40046207 0 returned -16
[ 1550.394834] binder: BINDER_SET_CONTEXT_MGR already set
[ 1550.394841] binder: 19181:19183 ioctl 40046207 0 returned -16
[ 1550.401866] binder: BINDER_SET_CONTEXT_MGR already set
[ 1550.401872] binder: 19187:19192 ioctl 40046207 0 returned -16
[ 1550.407734] binder: 19182:19184 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1550.410848] binder: 19185:19189 ioctl c0306201 20000080 returned -14
[ 1550.437278] binder: BINDER_SET_CONTEXT_MGR already set
[ 1550.437285] binder: 19199:19200 ioctl 40046207 0 returned -16
[ 1550.448229] binder: 19199:19200 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1550.480529] binder: BINDER_SET_CONTEXT_MGR already set
[ 1550.480536] binder: 19205:19209 ioctl 40046207 0 returned -16
[ 1550.484345] binder: 19205:19209 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1550.489338] binder: BINDER_SET_CONTEXT_MGR already set
[ 1550.489345] binder: 19208:19210 ioctl 40046207 0 returned -16
[ 1550.494597] binder: BINDER_SET_CONTEXT_MGR already set
[ 1550.494604] binder: 19206:19207 ioctl 40046207 0 returned -16
[ 1550.505240] binder: BINDER_SET_CONTEXT_MGR already set
[ 1550.505246] binder: 19211:19212 ioctl 40046207 0 returned -16
[ 1550.510164] binder: 19211:19212 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1550.551189] binder: BINDER_SET_CONTEXT_MGR already set
[ 1550.551197] binder: 19213:19214 ioctl 40046207 0 returned -16
[ 1550.554224] binder: BINDER_SET_CONTEXT_MGR already set
[ 1550.554230] binder: 19215:19216 ioctl 40046207 0 returned -16
[ 1550.557779] binder: 19213:19214 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1550.559210] binder: BINDER_SET_CONTEXT_MGR already set
[ 1550.559217] binder: 19217:19218 ioctl 40046207 0 returned -16
[ 1550.687295] binder: BINDER_SET_CONTEXT_MGR already set
[ 1550.687303] binder: 19219:19225 ioctl 40046207 0 returned -16
[ 1550.691534] binder: BINDER_SET_CONTEXT_MGR already set
[ 1550.691546] binder: 19221:19227 ioctl 40046207 0 returned -16
[ 1550.693148] binder: 19219:19225 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1550.701058] binder: BINDER_SET_CONTEXT_MGR already set
[ 1550.701065] binder: 19223:19228 ioctl 40046207 0 returned -16
[ 1550.701172] binder: BINDER_SET_CONTEXT_MGR already set
[ 1550.701179] binder: 19220:19231 ioctl 40046207 0 returned -16
[ 1550.709103] binder: 19223:19228 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1550.755051] binder: BINDER_SET_CONTEXT_MGR already set
[ 1550.755058] binder: 19237:19238 ioctl 40046207 0 returned -16
[ 1550.758064] binder: 19237:19238 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1550.781463] binder: BINDER_SET_CONTEXT_MGR already set
[ 1550.781470] binder: 19241:19243 ioctl 40046207 0 returned -16
[ 1550.789002] binder: 19241:19243 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1550.789470] binder: BINDER_SET_CONTEXT_MGR already set
[ 1550.789476] binder: 19246:19247 ioctl 40046207 0 returned -16
[ 1550.792628] binder: BINDER_SET_CONTEXT_MGR already set
[ 1550.792636] binder: 19239:19245 ioctl 40046207 0 returned -16
[ 1550.805708] binder: BINDER_SET_CONTEXT_MGR already set
[ 1550.805716] binder: 19244:19248 ioctl 40046207 0 returned -16
[ 1550.812087] binder: 19244:19248 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1550.873584] binder: BINDER_SET_CONTEXT_MGR already set
[ 1550.873591] binder: 19253:19260 ioctl 40046207 0 returned -16
[ 1550.873762] binder: BINDER_SET_CONTEXT_MGR already set
[ 1550.873770] binder: 19252:19255 ioctl 40046207 0 returned -16
[ 1550.874836] binder: BINDER_SET_CONTEXT_MGR already set
[ 1550.874843] binder: 19256:19261 ioctl 40046207 0 returned -16
[ 1550.879202] binder: BINDER_SET_CONTEXT_MGR already set
[ 1550.879210] binder: 19254:19259 ioctl 40046207 0 returned -16
[ 1550.892394] binder: 19253:19260 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1550.896172] binder: 19256:19261 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1550.933144] binder: BINDER_SET_CONTEXT_MGR already set
[ 1550.933152] binder: 19270:19271 ioctl 40046207 0 returned -16
[ 1550.951151] binder: BINDER_SET_CONTEXT_MGR already set
[ 1550.951157] binder: 19272:19276 ioctl 40046207 0 returned -16
[ 1550.968608] binder: BINDER_SET_CONTEXT_MGR already set
[ 1550.968616] binder: 19269:19275 ioctl 40046207 0 returned -16
[ 1550.971091] binder: BINDER_SET_CONTEXT_MGR already set
[ 1550.971097] binder: 19277:19278 ioctl 40046207 0 returned -16
[ 1550.974504] binder: 19277:19278 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1550.978247] binder: 19269:19275 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1551.023618] binder: BINDER_SET_CONTEXT_MGR already set
[ 1551.023625] binder: 19279:19281 ioctl 40046207 0 returned -16
[ 1551.031591] binder: BINDER_SET_CONTEXT_MGR already set
[ 1551.031605] binder: 19280:19282 ioctl 40046207 0 returned -16
[ 1551.049362] binder: BINDER_SET_CONTEXT_MGR already set
[ 1551.049370] binder: 19284:19285 ioctl 40046207 0 returned -16
[ 1551.056323] binder: 19284:19285 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1551.079430] binder: BINDER_SET_CONTEXT_MGR already set
[ 1551.079440] binder: 19283:19286 ioctl 40046207 0 returned -16
[ 1551.090275] binder: 19283:19286 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1551.256731] binder: BINDER_SET_CONTEXT_MGR already set
[ 1551.256739] binder: 19288:19292 ioctl 40046207 0 returned -16
[ 1551.258836] binder: BINDER_SET_CONTEXT_MGR already set
[ 1551.258843] binder: 19287:19298 ioctl 40046207 0 returned -16
[ 1551.258887] binder: BINDER_SET_CONTEXT_MGR already set
[ 1551.258894] binder: 19289:19297 ioctl 40046207 0 returned -16
[ 1551.264171] binder: BINDER_SET_CONTEXT_MGR already set
[ 1551.264179] binder: 19291:19299 ioctl 40046207 0 returned -16
[ 1551.276805] binder: 19289:19297 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1551.277011] binder: 19291:19299 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1551.342516] binder: BINDER_SET_CONTEXT_MGR already set
[ 1551.342523] binder: 19307:19308 ioctl 40046207 0 returned -16
[ 1551.534245] binder: BINDER_SET_CONTEXT_MGR already set
[ 1551.534253] binder: 19312:19316 ioctl 40046207 0 returned -16
[ 1551.536060] binder: BINDER_SET_CONTEXT_MGR already set
[ 1551.536068] binder: 19310:19314 ioctl 40046207 0 returned -16
[ 1551.540990] binder: BINDER_SET_CONTEXT_MGR already set
[ 1551.540998] binder: 19311:19319 ioctl 40046207 0 returned -16
[ 1551.546877] binder: BINDER_SET_CONTEXT_MGR already set
[ 1551.546884] binder: 19309:19321 ioctl 40046207 0 returned -16
[ 1551.554900] binder: 19309:19321 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1551.555720] binder: 19311:19319 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1551.583551] binder: BINDER_SET_CONTEXT_MGR already set
[ 1551.583558] binder: 19327:19329 ioctl 40046207 0 returned -16
[ 1551.586878] binder: 19327:19329 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1551.602685] binder: BINDER_SET_CONTEXT_MGR already set
[ 1551.602693] binder: 19331:19332 ioctl 40046207 0 returned -16
[ 1551.631184] binder: BINDER_SET_CONTEXT_MGR already set
[ 1551.631191] binder: 19336:19339 ioctl 40046207 0 returned -16
[ 1551.639934] binder: BINDER_SET_CONTEXT_MGR already set
[ 1551.639941] binder: 19334:19337 ioctl 40046207 0 returned -16
[ 1551.642204] binder: 19334:19337 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1551.642781] binder: BINDER_SET_CONTEXT_MGR already set
[ 1551.642787] binder: 19333:19338 ioctl 40046207 0 returned -16
[ 1551.646780] binder: 19333:19338 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1551.831307] binder: BINDER_SET_CONTEXT_MGR already set
[ 1551.831315] binder: 19351:19354 ioctl 40046207 0 returned -16
[ 1551.834622] binder: BINDER_SET_CONTEXT_MGR already set
[ 1551.834631] binder: 19349:19355 ioctl 40046207 0 returned -16
[ 1551.835170] binder: BINDER_SET_CONTEXT_MGR already set
[ 1551.835177] binder: 19346:19353 ioctl 40046207 0 returned -16
[ 1551.839340] binder: 19346:19353 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1551.848496] binder: 19351:19354 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1551.849838] binder: BINDER_SET_CONTEXT_MGR already set
[ 1551.849847] binder: 19345:19358 ioctl 40046207 0 returned -16
[ 1551.911717] binder: BINDER_SET_CONTEXT_MGR already set
[ 1551.911725] binder: 19363:19365 ioctl 40046207 0 returned -16
[ 1551.922517] binder: 19364:19366 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1551.936024] binder: BINDER_SET_CONTEXT_MGR already set
[ 1551.936031] binder: 19367:19369 ioctl 40046207 0 returned -16
[ 1551.940042] binder: BINDER_SET_CONTEXT_MGR already set
[ 1551.940050] binder: 19368:19370 ioctl 40046207 0 returned -16
[ 1551.944796] binder: 19368:19370 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1551.991488] binder: BINDER_SET_CONTEXT_MGR already set
[ 1551.991496] binder: 19373:19376 ioctl 40046207 0 returned -16
[ 1552.001195] binder: BINDER_SET_CONTEXT_MGR already set
[ 1552.001202] binder: 19377:19379 ioctl 40046207 0 returned -16
[ 1552.007348] binder: 19374:19378 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1552.193499] binder: BINDER_SET_CONTEXT_MGR already set
[ 1552.193509] binder: 19382:19384 ioctl 40046207 0 returned -16
[ 1552.197967] binder: BINDER_SET_CONTEXT_MGR already set
[ 1552.197973] binder: 19385:19391 ioctl 40046207 0 returned -16
[ 1552.201458] binder: 19382:19384 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1552.215611] binder: 19383:19390 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1552.234026] binder: BINDER_SET_CONTEXT_MGR already set
[ 1552.234033] binder: 19381:19395 ioctl 40046207 0 returned -16
[ 1552.304869] binder: BINDER_SET_CONTEXT_MGR already set
[ 1552.304877] binder: 19400:19401 ioctl 40046207 0 returned -16
[ 1552.306150] binder: BINDER_SET_CONTEXT_MGR already set
[ 1552.306157] binder: 19408:19412 ioctl 40046207 0 returned -16
[ 1552.310966] binder: 19400:19401 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1552.312681] binder: BINDER_SET_CONTEXT_MGR already set
[ 1552.312687] binder: 19405:19409 ioctl 40046207 0 returned -16
[ 1552.328966] binder: 19406:19413 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1552.396500] binder: 19416:19420 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1552.407106] binder: BINDER_SET_CONTEXT_MGR already set
[ 1552.407113] binder: 19418:19421 ioctl 40046207 0 returned -16
[ 1552.419916] binder: BINDER_SET_CONTEXT_MGR already set
[ 1552.419923] binder: 19417:19423 ioctl 40046207 0 returned -16
[ 1552.428474] binder: BINDER_SET_CONTEXT_MGR already set
[ 1552.428482] binder: 19419:19422 ioctl 40046207 0 returned -16
[ 1552.432504] binder: 19419:19422 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1552.474362] binder: 19424:19428 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1552.477380] binder: BINDER_SET_CONTEXT_MGR already set
[ 1552.477387] binder: 19425:19427 ioctl 40046207 0 returned -16
[ 1552.477599] binder: BINDER_SET_CONTEXT_MGR already set
[ 1552.477605] binder: 19426:19429 ioctl 40046207 0 returned -16
[ 1552.519198] binder: BINDER_SET_CONTEXT_MGR already set
[ 1552.519207] binder: 19430:19431 ioctl 40046207 0 returned -16
[ 1552.523088] binder: 19430:19431 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1552.715667] binder: BINDER_SET_CONTEXT_MGR already set
[ 1552.715674] binder: 19432:19441 ioctl 40046207 0 returned -16
[ 1552.717732] binder: BINDER_SET_CONTEXT_MGR already set
[ 1552.717739] binder: 19433:19442 ioctl 40046207 0 returned -16
[ 1552.720322] binder: BINDER_SET_CONTEXT_MGR already set
[ 1552.720329] binder: 19434:19443 ioctl 40046207 0 returned -16
[ 1552.722801] binder: 19432:19441 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1552.726407] binder: BINDER_SET_CONTEXT_MGR already set
[ 1552.726415] binder: 19435:19444 ioctl 40046207 0 returned -16
[ 1552.733569] binder: 19435:19444 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1552.796796] binder: BINDER_SET_CONTEXT_MGR already set
[ 1552.796804] binder: 19451:19454 ioctl 40046207 0 returned -16
[ 1552.809398] binder: BINDER_SET_CONTEXT_MGR already set
[ 1552.809406] binder: 19452:19455 ioctl 40046207 0 returned -16
[ 1552.813000] binder: 19452:19455 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1552.815594] binder: BINDER_SET_CONTEXT_MGR already set
[ 1552.815602] binder: 19450:19453 ioctl 40046207 0 returned -16
[ 1552.857625] binder: 19450:19453 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1553.177769] binder: BINDER_SET_CONTEXT_MGR already set
[ 1553.177777] binder: 19458:19460 ioctl 40046207 0 returned -16
[ 1553.183243] binder: BINDER_SET_CONTEXT_MGR already set
[ 1553.183250] binder: 19461:19465 ioctl 40046207 0 returned -16
[ 1553.187894] binder: BINDER_SET_CONTEXT_MGR already set
[ 1553.187901] binder: 19459:19469 ioctl 40046207 0 returned -16
[ 1553.193660] binder: 19461:19465 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1553.195388] binder: BINDER_SET_CONTEXT_MGR already set
[ 1553.195395] binder: 19457:19468 ioctl 40046207 0 returned -16
[ 1553.199506] binder: 19457:19468 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1553.250682] binder: BINDER_SET_CONTEXT_MGR already set
[ 1553.250694] binder: 19474:19475 ioctl 40046207 0 returned -16
[ 1553.255544] binder: 19474:19475 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1553.260436] binder: BINDER_SET_CONTEXT_MGR already set
[ 1553.260443] binder: 19476:19477 ioctl 40046207 0 returned -16
[ 1553.263692] binder: 19476:19477 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1553.265829] binder: BINDER_SET_CONTEXT_MGR already set
[ 1553.265836] binder: 19478:19479 ioctl 40046207 0 returned -16
[ 1553.274652] binder: BINDER_SET_CONTEXT_MGR already set
[ 1553.274659] binder: 19482:19483 ioctl 40046207 0 returned -16
[ 1553.315948] binder: BINDER_SET_CONTEXT_MGR already set
[ 1553.315956] binder: 19485:19486 ioctl 40046207 0 returned -16
[ 1553.320344] binder: 19485:19486 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1553.325960] binder: BINDER_SET_CONTEXT_MGR already set
[ 1553.325967] binder: 19487:19488 ioctl 40046207 0 returned -16
[ 1553.606507] binder: BINDER_SET_CONTEXT_MGR already set
[ 1553.606515] binder: 19489:19492 ioctl 40046207 0 returned -16
[ 1553.617573] binder: BINDER_SET_CONTEXT_MGR already set
[ 1553.617580] binder: 19493:19499 ioctl 40046207 0 returned -16
[ 1553.620828] binder: BINDER_SET_CONTEXT_MGR already set
[ 1553.620836] binder: 19490:19500 ioctl 40046207 0 returned -16
[ 1553.623969] binder: BINDER_SET_CONTEXT_MGR already set
[ 1553.623976] binder: 19491:19494 ioctl 40046207 0 returned -16
[ 1553.631409] binder: 19491:19494 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1553.634519] binder: 19493:19499 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1553.704873] binder: BINDER_SET_CONTEXT_MGR already set
[ 1553.704883] binder: 19507:19509 ioctl 40046207 0 returned -16
[ 1553.713019] binder: BINDER_SET_CONTEXT_MGR already set
[ 1553.713026] binder: 19508:19510 ioctl 40046207 0 returned -16
[ 1553.718558] binder: BINDER_SET_CONTEXT_MGR already set
[ 1553.718564] binder: 19513:19515 ioctl 40046207 0 returned -16
[ 1553.718934] binder: BINDER_SET_CONTEXT_MGR already set
[ 1553.718940] binder: 19512:19514 ioctl 40046207 0 returned -16
[ 1553.721045] binder: 19508:19510 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1553.758221] binder: 19512:19514 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1553.789075] binder: BINDER_SET_CONTEXT_MGR already set
[ 1553.789086] binder: 19516:19517 ioctl 40046207 0 returned -16
[ 1553.792743] binder: BINDER_SET_CONTEXT_MGR already set
[ 1553.792749] binder: 19519:19521 ioctl 40046207 0 returned -16
[ 1553.796532] binder: BINDER_SET_CONTEXT_MGR already set
[ 1553.796539] binder: 19518:19520 ioctl 40046207 0 returned -16
[ 1553.814456] binder: 19518:19520 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1553.823124] binder: BINDER_SET_CONTEXT_MGR already set
[ 1553.823131] binder: 19522:19523 ioctl 40046207 0 returned -16
[ 1553.826846] binder: 19522:19523 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1554.073640] binder: BINDER_SET_CONTEXT_MGR already set
[ 1554.073649] binder: 19527:19533 ioctl 40046207 0 returned -16
[ 1554.076813] binder: BINDER_SET_CONTEXT_MGR already set
[ 1554.076821] binder: 19526:19532 ioctl 40046207 0 returned -16
[ 1554.077189] binder: BINDER_SET_CONTEXT_MGR already set
[ 1554.077196] binder: 19525:19534 ioctl 40046207 0 returned -16
[ 1554.083601] binder: BINDER_SET_CONTEXT_MGR already set
[ 1554.083608] binder: 19524:19537 ioctl 40046207 0 returned -16
[ 1554.091639] binder: 19527:19533 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1554.093900] binder: 19526:19532 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1554.173607] binder: BINDER_SET_CONTEXT_MGR already set
[ 1554.173615] binder: 19543:19544 ioctl 40046207 0 returned -16
[ 1554.185299] binder: BINDER_SET_CONTEXT_MGR already set
[ 1554.185306] binder: 19547:19549 ioctl 40046207 0 returned -16
[ 1554.197354] binder: BINDER_SET_CONTEXT_MGR already set
[ 1554.197361] binder: 19546:19551 ioctl 40046207 0 returned -16
[ 1554.208437] binder: BINDER_SET_CONTEXT_MGR already set
[ 1554.208445] binder: 19548:19550 ioctl 40046207 0 returned -16
[ 1554.209315] binder: 19546:19551 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1554.211474] binder: 19548:19550 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1554.225180] binder: BINDER_SET_CONTEXT_MGR already set
[ 1554.225186] binder: 19552:19553 ioctl 40046207 0 returned -16
[ 1554.287205] binder: BINDER_SET_CONTEXT_MGR already set
[ 1554.287212] binder: 19555:19557 ioctl 40046207 0 returned -16
[ 1554.291341] binder: 19555:19557 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1554.304121] binder: BINDER_SET_CONTEXT_MGR already set
[ 1554.304128] binder: 19554:19556 ioctl 40046207 0 returned -16
[ 1554.472138] binder: BINDER_SET_CONTEXT_MGR already set
[ 1554.472154] binder: 19559:19565 ioctl 40046207 0 returned -16
[ 1554.475760] binder: BINDER_SET_CONTEXT_MGR already set
[ 1554.475767] binder: 19563:19568 ioctl 40046207 0 returned -16
[ 1554.478549] binder: 19559:19565 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1554.480436] binder: BINDER_SET_CONTEXT_MGR already set
[ 1554.480444] binder: 19560:19569 ioctl 40046207 0 returned -16
[ 1554.486769] binder: BINDER_SET_CONTEXT_MGR already set
[ 1554.486777] binder: 19558:19573 ioctl 40046207 0 returned -16
[ 1554.489957] binder: 19563:19568 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1554.562745] binder: BINDER_SET_CONTEXT_MGR already set
[ 1554.562754] binder: 19579:19583 ioctl 40046207 0 returned -16
[ 1554.563952] binder: BINDER_SET_CONTEXT_MGR already set
[ 1554.563959] binder: 19578:19581 ioctl 40046207 0 returned -16
[ 1554.576437] binder: 19578:19581 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1554.578631] binder: BINDER_SET_CONTEXT_MGR already set
[ 1554.578646] binder: 19580:19584 ioctl 40046207 0 returned -16
[ 1554.579848] binder: 19579:19583 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1554.583723] binder: BINDER_SET_CONTEXT_MGR already set
[ 1554.583733] binder: 19582:19585 ioctl 40046207 0 returned -16
[ 1554.654284] binder: BINDER_SET_CONTEXT_MGR already set
[ 1554.654291] binder: 19587:19590 ioctl 40046207 0 returned -16
[ 1554.657100] binder: BINDER_SET_CONTEXT_MGR already set
[ 1554.657107] binder: 19588:19591 ioctl 40046207 0 returned -16
[ 1554.663187] binder: 19587:19590 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1554.670484] binder: BINDER_SET_CONTEXT_MGR already set
[ 1554.670490] binder: 19589:19592 ioctl 40046207 0 returned -16
[ 1554.674081] binder: 19589:19592 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1554.676779] binder: BINDER_SET_CONTEXT_MGR already set
[ 1554.676785] binder: 19586:19593 ioctl 40046207 0 returned -16
[ 1554.698754] binder: BINDER_SET_CONTEXT_MGR already set
[ 1554.698762] binder: 19595:19597 ioctl 40046207 0 returned -16
[ 1554.706287] binder: 19595:19597 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1554.722968] binder: BINDER_SET_CONTEXT_MGR already set
[ 1554.722975] binder: 19594:19596 ioctl 40046207 0 returned -16
[ 1554.900200] binder: BINDER_SET_CONTEXT_MGR already set
[ 1554.900208] binder: 19599:19606 ioctl 40046207 0 returned -16
[ 1554.908313] binder: BINDER_SET_CONTEXT_MGR already set
[ 1554.908321] binder: 19600:19608 ioctl 40046207 0 returned -16
[ 1554.910206] binder: 19599:19606 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1554.910663] binder: BINDER_SET_CONTEXT_MGR already set
[ 1554.910670] binder: 19598:19609 ioctl 40046207 0 returned -16
[ 1554.915312] binder: BINDER_SET_CONTEXT_MGR already set
[ 1554.915320] binder: 19601:19612 ioctl 40046207 0 returned -16
[ 1554.919973] binder: 19598:19609 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1554.979148] binder: BINDER_SET_CONTEXT_MGR already set
[ 1554.979155] binder: 19617:19620 ioctl 40046207 0 returned -16
[ 1554.982953] binder: 19617:19620 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1554.995450] binder: BINDER_SET_CONTEXT_MGR already set
[ 1554.995458] binder: 19622:19624 ioctl 40046207 0 returned -16
[ 1555.001699] binder: 19622:19624 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1555.006470] binder: BINDER_SET_CONTEXT_MGR already set
[ 1555.006477] binder: 19623:19625 ioctl 40046207 0 returned -16
[ 1555.023240] binder: BINDER_SET_CONTEXT_MGR already set
[ 1555.023248] binder: 19618:19619 ioctl 40046207 0 returned -16
[ 1555.071588] binder: BINDER_SET_CONTEXT_MGR already set
[ 1555.071595] binder: 19626:19627 ioctl 40046207 0 returned -16
[ 1555.098112] binder: 19626:19627 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1555.252727] binder: BINDER_SET_CONTEXT_MGR already set
[ 1555.252735] binder: 19628:19637 ioctl 40046207 0 returned -16
[ 1555.254949] binder: BINDER_SET_CONTEXT_MGR already set
[ 1555.254957] binder: 19629:19636 ioctl 40046207 0 returned -16
[ 1555.257053] binder: BINDER_SET_CONTEXT_MGR already set
[ 1555.257060] binder: 19631:19639 ioctl 40046207 0 returned -16
[ 1555.267306] binder: BINDER_SET_CONTEXT_MGR already set
[ 1555.267313] binder: 19630:19640 ioctl 40046207 0 returned -16
[ 1555.271273] binder: 19628:19637 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1555.277629] binder: 19630:19640 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1555.344528] binder: BINDER_SET_CONTEXT_MGR already set
[ 1555.344536] binder: 19652:19654 ioctl 40046207 0 returned -16
[ 1555.347574] binder: BINDER_SET_CONTEXT_MGR already set
[ 1555.347581] binder: 19648:19650 ioctl 40046207 0 returned -16
[ 1555.354208] binder: BINDER_SET_CONTEXT_MGR already set
[ 1555.354215] binder: 19651:19655 ioctl 40046207 0 returned -16
[ 1555.356144] binder: BINDER_SET_CONTEXT_MGR already set
[ 1555.356150] binder: 19649:19653 ioctl 40046207 0 returned -16
[ 1555.358847] binder: 19651:19655 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1555.361356] binder: 19652:19654 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1555.408422] binder: BINDER_SET_CONTEXT_MGR already set
[ 1555.408430] binder: 19656:19657 ioctl 40046207 0 returned -16
[ 1555.419504] binder: BINDER_SET_CONTEXT_MGR already set
[ 1555.419511] binder: 19660:19661 ioctl 40046207 0 returned -16
[ 1555.422028] binder: BINDER_SET_CONTEXT_MGR already set
[ 1555.422034] binder: 19659:19663 ioctl 40046207 0 returned -16
[ 1555.423110] binder: BINDER_SET_CONTEXT_MGR already set
[ 1555.423116] binder: 19658:19662 ioctl 40046207 0 returned -16
[ 1555.425473] binder: 19659:19663 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1555.430528] binder: 19660:19661 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1555.456432] binder: BINDER_SET_CONTEXT_MGR already set
[ 1555.456439] binder: 19664:19665 ioctl 40046207 0 returned -16
[ 1555.527157] binder: BINDER_SET_CONTEXT_MGR already set
[ 1555.527165] binder: 19666:19667 ioctl 40046207 0 returned -16
[ 1555.679078] binder: BINDER_SET_CONTEXT_MGR already set
[ 1555.679086] binder: 19669:19677 ioctl 40046207 0 returned -16
[ 1555.684059] binder: BINDER_SET_CONTEXT_MGR already set
[ 1555.684067] binder: 19668:19681 ioctl 40046207 0 returned -16
[ 1555.685248] binder: BINDER_SET_CONTEXT_MGR already set
[ 1555.685487] binder: 19672:19682 ioctl 40046207 0 returned -16
[ 1555.696720] binder: 19669:19677 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1555.698216] binder: BINDER_SET_CONTEXT_MGR already set
[ 1555.698223] binder: 19670:19679 ioctl 40046207 0 returned -16
[ 1555.703619] binder: 19670:19679 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1555.782917] binder: BINDER_SET_CONTEXT_MGR already set
[ 1555.782925] binder: 19689:19691 ioctl 40046207 0 returned -16
[ 1555.784217] binder: BINDER_SET_CONTEXT_MGR already set
[ 1555.784224] binder: 19686:19692 ioctl 40046207 0 returned -16
[ 1555.787368] binder: BINDER_SET_CONTEXT_MGR already set
[ 1555.787374] binder: 19688:19690 ioctl 40046207 0 returned -16
[ 1555.789312] binder: BINDER_SET_CONTEXT_MGR already set
[ 1555.789319] binder: 19687:19693 ioctl 40046207 0 returned -16
[ 1555.795175] binder: 19689:19691 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1555.797747] binder: 19688:19690 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1555.860284] binder: BINDER_SET_CONTEXT_MGR already set
[ 1555.860291] binder: 19697:19699 ioctl 40046207 0 returned -16
[ 1555.863107] binder: BINDER_SET_CONTEXT_MGR already set
[ 1555.863113] binder: 19694:19698 ioctl 40046207 0 returned -16
[ 1555.866422] binder: BINDER_SET_CONTEXT_MGR already set
[ 1555.866429] binder: 19695:19700 ioctl 40046207 0 returned -16
[ 1555.870295] binder: BINDER_SET_CONTEXT_MGR already set
[ 1555.870302] binder: 19696:19701 ioctl 40046207 0 returned -16
[ 1555.880630] binder: 19694:19698 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1555.887919] binder: 19695:19700 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1555.925470] binder: BINDER_SET_CONTEXT_MGR already set
[ 1555.925477] binder: 19703:19704 ioctl 40046207 0 returned -16
[ 1555.928748] binder: BINDER_SET_CONTEXT_MGR already set
[ 1555.928755] binder: 19702:19706 ioctl 40046207 0 returned -16
[ 1555.932809] binder: 19703:19704 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1555.953327] binder: BINDER_SET_CONTEXT_MGR already set
[ 1555.953334] binder: 19705:19707 ioctl 40046207 0 returned -16
[ 1556.084707] binder: BINDER_SET_CONTEXT_MGR already set
[ 1556.084714] binder: 19709:19717 ioctl 40046207 0 returned -16
[ 1556.087137] binder: BINDER_SET_CONTEXT_MGR already set
[ 1556.087144] binder: 19711:19716 ioctl 40046207 0 returned -16
[ 1556.091117] binder: BINDER_SET_CONTEXT_MGR already set
[ 1556.091125] binder: 19708:19720 ioctl 40046207 0 returned -16
[ 1556.099739] binder: BINDER_SET_CONTEXT_MGR already set
[ 1556.099746] binder: 19710:19723 ioctl 40046207 0 returned -16
[ 1556.103532] binder: 19708:19720 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1556.105997] binder: 19710:19723 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1556.155067] binder: BINDER_SET_CONTEXT_MGR already set
[ 1556.155075] binder: 19729:19734 ioctl 40046207 0 returned -16
[ 1556.159799] binder: BINDER_SET_CONTEXT_MGR already set
[ 1556.159805] binder: 19727:19731 ioctl 40046207 0 returned -16
[ 1556.165204] binder: BINDER_SET_CONTEXT_MGR already set
[ 1556.165210] binder: 19728:19732 ioctl 40046207 0 returned -16
[ 1556.167386] binder: 19729:19734 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1556.169505] binder: 19728:19732 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1556.177066] binder: BINDER_SET_CONTEXT_MGR already set
[ 1556.177073] binder: 19730:19735 ioctl 40046207 0 returned -16
[ 1556.224488] binder: BINDER_SET_CONTEXT_MGR already set
[ 1556.224495] binder: 19738:19739 ioctl 40046207 0 returned -16
[ 1556.239232] binder: 19738:19739 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1556.451249] binder: BINDER_SET_CONTEXT_MGR already set
[ 1556.451257] binder: 19743:19745 ioctl 40046207 0 returned -16
[ 1556.458476] binder: BINDER_SET_CONTEXT_MGR already set
[ 1556.458483] binder: 19741:19744 ioctl 40046207 0 returned -16
[ 1556.463325] binder: BINDER_SET_CONTEXT_MGR already set
[ 1556.463332] binder: 19740:19751 ioctl 40046207 0 returned -16
[ 1556.467357] binder: 19741:19744 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1556.470668] binder: BINDER_SET_CONTEXT_MGR already set
[ 1556.470676] binder: 19742:19752 ioctl 40046207 0 returned -16
[ 1556.484829] binder: 19742:19752 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1556.520744] binder: BINDER_SET_CONTEXT_MGR already set
[ 1556.520751] binder: 19759:19760 ioctl 40046207 0 returned -16
[ 1556.548973] binder: BINDER_SET_CONTEXT_MGR already set
[ 1556.548980] binder: 19763:19764 ioctl 40046207 0 returned -16
[ 1556.551837] binder: BINDER_SET_CONTEXT_MGR already set
[ 1556.551844] binder: 19762:19765 ioctl 40046207 0 returned -16
[ 1556.557924] binder: 19763:19764 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1556.582920] binder: BINDER_SET_CONTEXT_MGR already set
[ 1556.582927] binder: 19766:19767 ioctl 40046207 0 returned -16
[ 1556.586616] binder: 19766:19767 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1556.615171] binder: BINDER_SET_CONTEXT_MGR already set
[ 1556.615179] binder: 19768:19769 ioctl 40046207 0 returned -16
[ 1556.636751] binder: BINDER_SET_CONTEXT_MGR already set
[ 1556.636758] binder: 19771:19772 ioctl 40046207 0 returned -16
[ 1556.642241] binder: BINDER_SET_CONTEXT_MGR already set
[ 1556.642248] binder: 19770:19775 ioctl 40046207 0 returned -16
[ 1556.646642] binder: 19771:19772 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1556.652094] binder: BINDER_SET_CONTEXT_MGR already set
[ 1556.652100] binder: 19773:19774 ioctl 40046207 0 returned -16
[ 1556.656743] binder: 19773:19774 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1556.880746] binder: BINDER_SET_CONTEXT_MGR already set
[ 1556.880754] binder: 19776:19784 ioctl 40046207 0 returned -16
[ 1556.884365] binder: BINDER_SET_CONTEXT_MGR already set
[ 1556.884372] binder: 19780:19785 ioctl 40046207 0 returned -16
[ 1556.884609] binder: BINDER_SET_CONTEXT_MGR already set
[ 1556.884615] binder: 19777:19788 ioctl 40046207 0 returned -16
[ 1556.890141] binder: BINDER_SET_CONTEXT_MGR already set
[ 1556.890148] binder: 19778:19786 ioctl 40046207 0 returned -16
[ 1556.900118] binder: 19780:19785 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1556.900242] binder: 19778:19786 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1556.978010] binder: BINDER_SET_CONTEXT_MGR already set
[ 1556.978018] binder: 19794:19795 ioctl 40046207 0 returned -16
[ 1556.980735] binder: BINDER_SET_CONTEXT_MGR already set
[ 1556.981056] binder: 19797:19802 ioctl 40046207 0 returned -16
[ 1556.981607] binder: BINDER_SET_CONTEXT_MGR already set
[ 1556.981614] binder: 19796:19801 ioctl 40046207 0 returned -16
[ 1556.987275] binder: 19797:19802 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1556.994880] binder: 19796:19801 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1556.994930] binder: BINDER_SET_CONTEXT_MGR already set
[ 1556.994937] binder: 19798:19803 ioctl 40046207 0 returned -16
[ 1557.058358] binder: BINDER_SET_CONTEXT_MGR already set
[ 1557.058365] binder: 19804:19805 ioctl 40046207 0 returned -16
[ 1557.059020] binder: BINDER_SET_CONTEXT_MGR already set
[ 1557.059027] binder: 19806:19807 ioctl 40046207 0 returned -16
[ 1557.068529] binder: 19806:19807 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1557.073807] binder: BINDER_SET_CONTEXT_MGR already set
[ 1557.073813] binder: 19808:19810 ioctl 40046207 0 returned -16
[ 1557.092272] binder: BINDER_SET_CONTEXT_MGR already set
[ 1557.092279] binder: 19809:19811 ioctl 40046207 0 returned -16
[ 1557.096271] binder: 19809:19811 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1557.266313] binder: BINDER_SET_CONTEXT_MGR already set
[ 1557.266321] binder: 19813:19816 ioctl 40046207 0 returned -16
[ 1557.278426] binder: BINDER_SET_CONTEXT_MGR already set
[ 1557.278433] binder: 19814:19818 ioctl 40046207 0 returned -16
[ 1557.282650] binder: 19814:19818 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1557.285499] binder: BINDER_SET_CONTEXT_MGR already set
[ 1557.285508] binder: 19817:19819 ioctl 40046207 0 returned -16
[ 1557.285717] binder: BINDER_SET_CONTEXT_MGR already set
[ 1557.285725] binder: 19812:19822 ioctl 40046207 0 returned -16
[ 1557.292646] binder: 19817:19819 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1557.374455] binder: BINDER_SET_CONTEXT_MGR already set
[ 1557.374463] binder: 19831:19836 ioctl 40046207 0 returned -16
[ 1557.382919] binder: BINDER_SET_CONTEXT_MGR already set
[ 1557.382926] binder: 19832:19837 ioctl 40046207 0 returned -16
[ 1557.385239] binder: BINDER_SET_CONTEXT_MGR already set
[ 1557.385246] binder: 19834:19838 ioctl 40046207 0 returned -16
[ 1557.386278] binder: 19831:19836 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1557.390562] binder: 19834:19838 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1557.422578] binder: BINDER_SET_CONTEXT_MGR already set
[ 1557.422585] binder: 19835:19839 ioctl 40046207 0 returned -16
[ 1557.458095] binder: BINDER_SET_CONTEXT_MGR already set
[ 1557.458102] binder: 19841:19843 ioctl 40046207 0 returned -16
[ 1557.459187] binder: BINDER_SET_CONTEXT_MGR already set
[ 1557.459193] binder: 19842:19844 ioctl 40046207 0 returned -16
[ 1557.464919] binder: BINDER_SET_CONTEXT_MGR already set
[ 1557.464926] binder: 19840:19845 ioctl 40046207 0 returned -16
[ 1557.470099] binder: 19841:19843 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1557.481125] binder: 19840:19845 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1557.835743] binder: BINDER_SET_CONTEXT_MGR already set
[ 1557.835750] binder: 19848:19850 ioctl 40046207 0 returned -16
[ 1557.840582] binder: BINDER_SET_CONTEXT_MGR already set
[ 1557.840589] binder: 19851:19853 ioctl 40046207 0 returned -16
[ 1557.844340] binder: BINDER_SET_CONTEXT_MGR already set
[ 1557.844347] binder: 19847:19849 ioctl 40046207 0 returned -16
[ 1557.851012] binder: BINDER_SET_CONTEXT_MGR already set
[ 1557.851023] binder: 19846:19857 ioctl 40046207 0 returned -16
[ 1557.853523] binder: 19851:19853 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1557.858787] binder: 19847:19849 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1557.936050] binder: BINDER_SET_CONTEXT_MGR already set
[ 1557.936058] binder: 19867:19870 ioctl 40046207 0 returned -16
[ 1557.937410] binder: BINDER_SET_CONTEXT_MGR already set
[ 1557.937416] binder: 19869:19871 ioctl 40046207 0 returned -16
[ 1557.946793] binder: 19867:19870 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1557.949041] binder: 19869:19871 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1557.972824] binder: BINDER_SET_CONTEXT_MGR already set
[ 1557.972831] binder: 19868:19872 ioctl 40046207 0 returned -16
[ 1558.009608] binder: BINDER_SET_CONTEXT_MGR already set
[ 1558.009615] binder: 19873:19874 ioctl 40046207 0 returned -16
[ 1558.028749] binder: BINDER_SET_CONTEXT_MGR already set
[ 1558.028757] binder: 19876:19878 ioctl 40046207 0 returned -16
[ 1558.034422] binder: 19876:19878 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1558.048684] binder: BINDER_SET_CONTEXT_MGR already set
[ 1558.048691] binder: 19875:19877 ioctl 40046207 0 returned -16
[ 1558.052711] binder: 19875:19877 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1558.064224] binder: BINDER_SET_CONTEXT_MGR already set
[ 1558.064232] binder: 19879:19880 ioctl 40046207 0 returned -16
[ 1558.124482] binder: BINDER_SET_CONTEXT_MGR already set
[ 1558.124490] binder: 19881:19882 ioctl 40046207 0 returned -16
[ 1558.348424] binder: BINDER_SET_CONTEXT_MGR already set
[ 1558.348432] binder: 19884:19887 ioctl 40046207 0 returned -16
[ 1558.352094] binder: BINDER_SET_CONTEXT_MGR already set
[ 1558.352102] binder: 19886:19893 ioctl 40046207 0 returned -16
[ 1558.353044] binder: BINDER_SET_CONTEXT_MGR already set
[ 1558.353050] binder: 19883:19894 ioctl 40046207 0 returned -16
[ 1558.354467] binder: BINDER_SET_CONTEXT_MGR already set
[ 1558.354475] binder: 19885:19888 ioctl 40046207 0 returned -16
[ 1558.357375] binder: 19884:19887 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1558.360505] binder: 19885:19888 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1558.431404] binder: BINDER_SET_CONTEXT_MGR already set
[ 1558.431411] binder: 19903:19905 ioctl 40046207 0 returned -16
[ 1558.435028] binder: 19903:19905 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1558.446834] binder: BINDER_SET_CONTEXT_MGR already set
[ 1558.446841] binder: 19906:19909 ioctl 40046207 0 returned -16
[ 1558.447549] binder: BINDER_SET_CONTEXT_MGR already set
[ 1558.447555] binder: 19908:19910 ioctl 40046207 0 returned -16
[ 1558.458349] binder: BINDER_SET_CONTEXT_MGR already set
[ 1558.458356] binder: 19904:19911 ioctl 40046207 0 returned -16
[ 1558.465655] binder: 19904:19911 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1558.514747] binder: BINDER_SET_CONTEXT_MGR already set
[ 1558.514754] binder: 19912:19913 ioctl 40046207 0 returned -16
[ 1558.518574] binder: 19912:19913 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1558.536178] binder: BINDER_SET_CONTEXT_MGR already set
[ 1558.536186] binder: 19915:19916 ioctl 40046207 0 returned -16
[ 1558.541804] binder: BINDER_SET_CONTEXT_MGR already set
[ 1558.541812] binder: 19914:19917 ioctl 40046207 0 returned -16
[ 1558.545829] binder: 19914:19917 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1558.984037] binder: BINDER_SET_CONTEXT_MGR already set
[ 1558.984046] binder: 19925:19930 ioctl 40046207 0 returned -16
[ 1558.991902] binder: BINDER_SET_CONTEXT_MGR already set
[ 1558.991909] binder: 19926:19933 ioctl 40046207 0 returned -16
[ 1558.992914] binder: 19925:19930 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1558.999686] binder: BINDER_SET_CONTEXT_MGR already set
[ 1558.999694] binder: 19923:19937 ioctl 40046207 0 returned -16
[ 1559.009402] binder: 19923:19937 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1559.078663] binder: BINDER_SET_CONTEXT_MGR already set
[ 1559.078670] binder: 19947:19949 ioctl 40046207 0 returned -16
[ 1559.082222] binder: BINDER_SET_CONTEXT_MGR already set
[ 1559.082229] binder: 19946:19950 ioctl 40046207 0 returned -16
[ 1559.090834] binder: 19946:19950 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1559.091119] binder: 19947:19949 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1559.099568] binder: BINDER_SET_CONTEXT_MGR already set
[ 1559.099575] binder: 19945:19948 ioctl 40046207 0 returned -16
[ 1559.160028] binder: BINDER_SET_CONTEXT_MGR already set
[ 1559.160035] binder: 19951:19953 ioctl 40046207 0 returned -16
[ 1559.163593] binder: 19951:19953 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1559.183836] binder: BINDER_SET_CONTEXT_MGR already set
[ 1559.183843] binder: 19952:19954 ioctl 40046207 0 returned -16
[ 1559.188861] binder: BINDER_SET_CONTEXT_MGR already set
[ 1559.188867] binder: 19955:19956 ioctl 40046207 0 returned -16
[ 1559.206023] binder: 19952:19954 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1559.221875] binder: BINDER_SET_CONTEXT_MGR already set
[ 1559.221883] binder: 19957:19958 ioctl 40046207 0 returned -16
[ 1559.225275] binder: 19957:19958 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1559.286568] binder: BINDER_SET_CONTEXT_MGR already set
[ 1559.286576] binder: 19959:19960 ioctl 40046207 0 returned -16
[ 1559.554359] binder: BINDER_SET_CONTEXT_MGR already set
[ 1559.554362] binder: BINDER_SET_CONTEXT_MGR already set
[ 1559.554369] binder: 19962:19965 ioctl 40046207 0 returned -16
[ 1559.554373] binder: 19963:19967 ioctl 40046207 0 returned -16
[ 1559.563734] binder: BINDER_SET_CONTEXT_MGR already set
[ 1559.563739] binder: 19961:19973 ioctl 40046207 0 returned -16
[ 1559.564842] binder: 19962:19965 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1559.576131] binder: 19961:19973 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1559.640183] binder: BINDER_SET_CONTEXT_MGR already set
[ 1559.640191] binder: 19982:19985 ioctl 40046207 0 returned -16
[ 1559.647655] binder: BINDER_SET_CONTEXT_MGR already set
[ 1559.647662] binder: 19983:19984 ioctl 40046207 0 returned -16
[ 1559.656034] binder: BINDER_SET_CONTEXT_MGR already set
[ 1559.656086] binder: 19981:19987 ioctl 40046207 0 returned -16
[ 1559.656297] binder: 19983:19984 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1559.662672] binder: 19981:19987 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1559.721617] binder: BINDER_SET_CONTEXT_MGR already set
[ 1559.721624] binder: 19990:19992 ioctl 40046207 0 returned -16
[ 1559.736355] binder: BINDER_SET_CONTEXT_MGR already set
[ 1559.736362] binder: 19991:19994 ioctl 40046207 0 returned -16
[ 1559.739678] binder: 19991:19994 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1559.761084] binder: BINDER_SET_CONTEXT_MGR already set
[ 1559.761095] binder: 19989:19993 ioctl 40046207 0 returned -16
[ 1559.786753] binder: 19989:19993 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1559.796114] binder: BINDER_SET_CONTEXT_MGR already set
[ 1559.796121] binder: 19995:19996 ioctl 40046207 0 returned -16
[ 1559.799745] binder: 19995:19996 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1560.154364] binder: BINDER_SET_CONTEXT_MGR already set
[ 1560.154374] binder: 19998:20000 ioctl 40046207 0 returned -16
[ 1560.160707] binder: BINDER_SET_CONTEXT_MGR already set
[ 1560.160714] binder: 19997:20006 ioctl 40046207 0 returned -16
[ 1560.162692] binder: BINDER_SET_CONTEXT_MGR already set
[ 1560.162700] binder: 19999:20012 ioctl 40046207 0 returned -16
[ 1560.170981] binder: 19997:20006 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1560.175336] binder: 19999:20012 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1560.244647] binder: BINDER_SET_CONTEXT_MGR already set
[ 1560.244655] binder: 20017:20023 ioctl 40046207 0 returned -16
[ 1560.244826] binder: BINDER_SET_CONTEXT_MGR already set
[ 1560.244832] binder: 20021:20024 ioctl 40046207 0 returned -16
[ 1560.254866] binder: 20021:20024 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1560.261494] binder: BINDER_SET_CONTEXT_MGR already set
[ 1560.261501] binder: 20022:20025 ioctl 40046207 0 returned -16
[ 1560.268680] binder: 20022:20025 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1560.330113] binder: BINDER_SET_CONTEXT_MGR already set
[ 1560.330120] binder: 20028:20029 ioctl 40046207 0 returned -16
[ 1560.335123] binder: 20028:20029 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1560.342632] binder: BINDER_SET_CONTEXT_MGR already set
[ 1560.342639] binder: 20026:20027 ioctl 40046207 0 returned -16
[ 1560.352975] binder: 20026:20027 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1560.367862] binder: BINDER_SET_CONTEXT_MGR already set
[ 1560.367869] binder: 20030:20031 ioctl 40046207 0 returned -16
[ 1560.377486] binder: BINDER_SET_CONTEXT_MGR already set
[ 1560.377493] binder: 20032:20033 ioctl 40046207 0 returned -16
[ 1560.382968] binder: 20032:20033 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1560.433651] binder: BINDER_SET_CONTEXT_MGR already set
[ 1560.433660] binder: 20034:20035 ioctl 40046207 0 returned -16
[ 1560.440473] binder: 20034:20035 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1560.797782] binder: BINDER_SET_CONTEXT_MGR already set
[ 1560.797790] binder: 20037:20039 ioctl 40046207 0 returned -16
[ 1560.797992] binder: BINDER_SET_CONTEXT_MGR already set
[ 1560.797999] binder: 20038:20040 ioctl 40046207 0 returned -16
[ 1560.804310] binder: BINDER_SET_CONTEXT_MGR already set
[ 1560.804317] binder: 20036:20046 ioctl 40046207 0 returned -16
[ 1560.808484] binder: 20038:20040 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1560.809396] binder: 20037:20039 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1560.872830] binder: BINDER_SET_CONTEXT_MGR already set
[ 1560.872836] binder: 20058:20062 ioctl 40046207 0 returned -16
[ 1560.880617] binder: BINDER_SET_CONTEXT_MGR already set
[ 1560.880624] binder: 20060:20064 ioctl 40046207 0 returned -16
[ 1560.883334] binder: BINDER_SET_CONTEXT_MGR already set
[ 1560.883341] binder: 20059:20063 ioctl 40046207 0 returned -16
[ 1560.890431] binder: 20059:20063 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1560.893560] binder: 20060:20064 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1560.960865] binder: BINDER_SET_CONTEXT_MGR already set
[ 1560.960873] binder: 20066:20068 ioctl 40046207 0 returned -16
[ 1560.962268] binder: BINDER_SET_CONTEXT_MGR already set
[ 1560.962275] binder: 20067:20070 ioctl 40046207 0 returned -16
[ 1560.962888] binder: BINDER_SET_CONTEXT_MGR already set
[ 1560.962895] binder: 20065:20069 ioctl 40046207 0 returned -16
[ 1560.966296] binder: 20067:20070 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1560.972772] binder: 20066:20068 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1561.032028] binder: BINDER_SET_CONTEXT_MGR already set
[ 1561.032035] binder: 20071:20072 ioctl 40046207 0 returned -16
[ 1561.035193] binder: 20071:20072 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1561.087664] binder: BINDER_SET_CONTEXT_MGR already set
[ 1561.087671] binder: 20073:20074 ioctl 40046207 0 returned -16
[ 1561.095938] binder: 20073:20074 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1561.431805] binder: BINDER_SET_CONTEXT_MGR already set
[ 1561.431812] binder: 20077:20079 ioctl 40046207 0 returned -16
[ 1561.438882] binder: 20077:20079 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1561.439902] binder: BINDER_SET_CONTEXT_MGR already set
[ 1561.439909] binder: 20076:20078 ioctl 40046207 0 returned -16
[ 1561.447030] binder: BINDER_SET_CONTEXT_MGR already set
[ 1561.447039] binder: 20075:20087 ioctl 40046207 0 returned -16
[ 1561.459782] binder: 20075:20087 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1561.520938] binder: BINDER_SET_CONTEXT_MGR already set
[ 1561.520945] binder: 20095:20097 ioctl 40046207 0 returned -16
[ 1561.521871] binder: BINDER_SET_CONTEXT_MGR already set
[ 1561.521886] binder: 20093:20098 ioctl 40046207 0 returned -16
[ 1561.526637] binder: BINDER_SET_CONTEXT_MGR already set
[ 1561.526644] binder: 20096:20099 ioctl 40046207 0 returned -16
[ 1561.530200] binder: 20095:20097 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1561.538635] binder: 20096:20099 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1561.597959] binder: BINDER_SET_CONTEXT_MGR already set
[ 1561.597966] binder: 20103:20106 ioctl 40046207 0 returned -16
[ 1561.604885] binder: BINDER_SET_CONTEXT_MGR already set
[ 1561.604893] binder: 20104:20107 ioctl 40046207 0 returned -16
[ 1561.608497] binder: 20104:20107 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1561.617541] binder: BINDER_SET_CONTEXT_MGR already set
[ 1561.617548] binder: 20105:20108 ioctl 40046207 0 returned -16
[ 1561.621271] binder: 20105:20108 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1561.696326] binder: BINDER_SET_CONTEXT_MGR already set
[ 1561.696333] binder: 20109:20110 ioctl 40046207 0 returned -16
[ 1562.064138] binder: BINDER_SET_CONTEXT_MGR already set
[ 1562.064146] binder: 20112:20115 ioctl 40046207 0 returned -16
[ 1562.071510] binder: 20112:20115 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1562.074975] binder: BINDER_SET_CONTEXT_MGR already set
[ 1562.074983] binder: 20113:20117 ioctl 40046207 0 returned -16
[ 1562.079559] binder: 20113:20117 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1562.080904] binder: BINDER_SET_CONTEXT_MGR already set
[ 1562.080912] binder: 20111:20124 ioctl 40046207 0 returned -16
[ 1562.150231] binder: BINDER_SET_CONTEXT_MGR already set
[ 1562.150239] binder: 20135:20138 ioctl 40046207 0 returned -16
[ 1562.150540] binder: BINDER_SET_CONTEXT_MGR already set
[ 1562.150548] binder: 20134:20137 ioctl 40046207 0 returned -16
[ 1562.154250] binder: 20135:20138 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1562.158935] binder: BINDER_SET_CONTEXT_MGR already set
[ 1562.158942] binder: 20139:20143 ioctl 40046207 0 returned -16
[ 1562.159247] INFO: task init:2598 blocked for more than 120 seconds.
[ 1562.159251]       Not tainted 4.4.125-g38f41ec #63
[ 1562.159253] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
[ 1562.159274] init            D ffff88006b5a7718 29272  2598      1 0x00000000
[ 1562.159281]  ffff88006b5a7718 ffff88018dc21800 0000000000000000 0000000000000007
[ 1562.159287]  ffff88018dc21800 ffff8801db21fdb8 ffff8801db21fde0 ffff8801db21f4d8
[ 1562.159293]  ffff8801db21f4c0 ffff880186986000 ffff88018dc21800 0000000000000000
[ 1562.159295] Call Trace:
[ 1562.159308]  [<ffffffff8376b82a>] schedule+0x7a/0x1b0
[ 1562.159314]  [<ffffffff8376c023>] schedule_preempt_disabled+0x13/0x20
[ 1562.159319]  [<ffffffff837705e6>] mutex_lock_nested+0x306/0x850
[ 1562.159329]  [<ffffffff81f4f7ea>] ? tty_open+0x4ca/0xee0
[ 1562.159334]  [<ffffffff837702e0>] ? __ww_mutex_lock+0x14f0/0x14f0
[ 1562.159340]  [<ffffffff81f4f478>] ? tty_open+0x158/0xee0
[ 1562.159349]  [<ffffffff814f9d40>] ? kmem_cache_alloc_trace+0x100/0x2b0
[ 1562.159355]  [<ffffffff81f4f7ea>] tty_open+0x4ca/0xee0
[ 1562.159361]  [<ffffffff81f4f320>] ? tty_init_dev+0x430/0x430
[ 1562.159368]  [<ffffffff8152a507>] ? chrdev_open+0xc7/0x4c0
[ 1562.159374]  [<ffffffff81f4f320>] ? tty_init_dev+0x430/0x430
[ 1562.159379]  [<ffffffff8152a66b>] chrdev_open+0x22b/0x4c0
[ 1562.159384]  [<ffffffff8152a440>] ? cdev_put.part.0+0x50/0x50
[ 1562.159392]  [<ffffffff8151881b>] do_dentry_open+0x59b/0xba0
[ 1562.159397]  [<ffffffff8153cfab>] ? __inode_permission2+0x9b/0x240
[ 1562.159403]  [<ffffffff8152a440>] ? cdev_put.part.0+0x50/0x50
[ 1562.159409]  [<ffffffff8151c0e0>] vfs_open+0x110/0x210
[ 1562.159413]  [<ffffffff8153d59e>] ? may_open+0x1ae/0x280
[ 1562.159419]  [<ffffffff8154d373>] path_openat+0x923/0x3940
[ 1562.159425]  [<ffffffff81daf873>] ? depot_save_stack+0x1c3/0x640
[ 1562.159431]  [<ffffffff8154ca50>] ? path_mountpoint+0x830/0x830
[ 1562.159435]  [<ffffffff815508cb>] ? getname_flags+0xcb/0x580
[ 1562.159440]  [<ffffffff81550d99>] ? getname+0x19/0x20
[ 1562.159445]  [<ffffffff8151c96f>] ? do_sys_open+0x21f/0x660
[ 1562.159450]  [<ffffffff8151cddd>] ? SyS_open+0x2d/0x40
[ 1562.159456]  [<ffffffff83779965>] ? entry_SYSCALL_64_fastpath+0x22/0x9e
[ 1562.159464]  [<ffffffff812378f0>] ? debug_check_no_locks_freed+0x2c0/0x2c0
[ 1562.159469]  [<ffffffff81230631>] ? __lock_is_held+0xa1/0xf0
[ 1562.159474]  [<ffffffff81553017>] do_filp_open+0x197/0x290
[ 1562.159480]  [<ffffffff81552e80>] ? user_path_mountpoint_at+0x40/0x40
[ 1562.159485]  [<ffffffff83778e2c>] ? _raw_spin_unlock+0x2c/0x50
[ 1562.159491]  [<ffffffff8157a573>] ? __alloc_fd+0x1e3/0x500
[ 1562.159498]  [<ffffffff8151cab9>] do_sys_open+0x369/0x660
[ 1562.159505]  [<ffffffff8151c750>] ? filp_open+0x70/0x70
[ 1562.159511]  [<ffffffff81f4a2b9>] ? proc_clear_tty+0xd9/0x140
[ 1562.159518]  [<ffffffff83779457>] ? _raw_write_unlock_irq+0x27/0x50
[ 1562.159524]  [<ffffffff8151cddd>] SyS_open+0x2d/0x40
[ 1562.159530]  [<ffffffff83779965>] entry_SYSCALL_64_fastpath+0x22/0x9e
[ 1562.159535] 1 lock held by init/2598:
[ 1562.159550]  #0:  (tty_mutex){+.+.+.}, at: [<ffffffff81f4f7ea>] tty_open+0x4ca/0xee0
[ 1562.159553] Sending NMI to all CPUs:
[ 1562.159780] NMI backtrace for cpu 0
[ 1562.159783] CPU: 0 PID: 487 Comm: khungtaskd Not tainted 4.4.125-g38f41ec #63
[ 1562.159787] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 1562.159789] task: ffff8800bace6000 task.stack: ffff8800bacf8000
[ 1562.159792] RIP: 0010:[<ffffffff810c3f87>]  [<ffffffff810c3f87>] flat_send_IPI_mask+0xf7/0x1a0
[ 1562.159795] RSP: 0018:ffff8800bacffcb8  EFLAGS: 00000046
[ 1562.159798] RAX: 0000000003000000 RBX: 0000000000000c00 RCX: 0000000000000000
[ 1562.159801] RDX: 0000000000000c00 RSI: 0000000000000000 RDI: ffffffffff5fb300
[ 1562.159804] RBP: ffff8800bacffce0 R08: 0000000000000001 R09: 0000000000000000
[ 1562.159807] R10: 0000000000000000 R11: 0000000000000001 R12: 0000000000000246
[ 1562.159810] R13: 0000000000000003 R14: ffffffff8426f5a0 R15: 0000000000000002
[ 1562.159813] FS:  0000000000000000(0000) GS:ffff8801db200000(0000) knlGS:0000000000000000
[ 1562.159816] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 1562.159819] CR2: 0000001b9bc23000 CR3: 00000001789ba000 CR4: 0000000000160670
[ 1562.159822] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 1562.159826] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[ 1562.159827] Stack:
[ 1562.159830]  ffffffff8426f5a0 ffffffff847f0b40 fffffbfff08fdc1c dffffc0000000000
[ 1562.159833]  ffff8801db31bca0 ffff8800bacffd00 ffffffff810b9abb ffffffff839f6dc0
[ 1562.159836]  0000000000000003 ffff8800bacffd60 ffffffff81d11764 ffffffff8141b993
[ 1562.159838] Call Trace:
[ 1562.159841]  [<ffffffff810b9abb>] nmi_raise_cpu_backtrace+0x5b/0x70
[ 1562.159844]  [<ffffffff81d11764>] nmi_trigger_all_cpu_backtrace+0x4a4/0x550
[ 1562.159846]  [<ffffffff8141b993>] ? print_lock+0xab/0xae
[ 1562.159849]  [<ffffffff810b9a60>] ? irq_force_complete_move+0x3b0/0x3b0
[ 1562.159852]  [<ffffffff810b9b54>] arch_trigger_all_cpu_backtrace+0x14/0x20
[ 1562.159860]  [<ffffffff813695ca>] watchdog+0x6fa/0xae0
[ 1562.159862]  [<ffffffff81368f93>] ? watchdog+0xc3/0xae0
[ 1562.159865]  [<ffffffff81190b48>] kthread+0x268/0x300
[ 1562.159868]  [<ffffffff81368ed0>] ? reset_hung_task_detector+0x20/0x20
[ 1562.159871]  [<ffffffff811908e0>] ? kthread_create_on_node+0x400/0x400
[ 1562.159873]  [<ffffffff811908e0>] ? kthread_create_on_node+0x400/0x400
[ 1562.159876]  [<ffffffff83779d95>] ret_from_fork+0x55/0x80
[ 1562.159879]  [<ffffffff811908e0>] ? kthread_create_on_node+0x400/0x400
[ 1562.159885] Code: b3 5f ff f6 c4 10 75 e1 44 89 e8 c1 e0 18 89 04 25 10 b3 5f ff 44 89 fa 09 da 80 cf 04 41 83 ff 02 0f 44 d3 89 14 25 00 b3 5f ff <41> f7 c4 00 02 00 00 74 1a e8 2b 33 17 00 4c 89 e7 57 9d 0f 1f 
[ 1562.159887] NMI backtrace for cpu 1
[ 1562.159891] CPU: 1 PID: 20143 Comm: syz-executor5 Not tainted 4.4.125-g38f41ec #63
[ 1562.159894] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 1562.159897] task: ffff880176134800 task.stack: ffff8801756e0000
[ 1562.159901] RIP: 0010:[<ffffffff81d6992d>]  [<ffffffff81d6992d>] debug_check_no_obj_freed+0x1bd/0x9b0
[ 1562.159903] RSP: 0018:ffff8801756e7c90  EFLAGS: 00000006
[ 1562.159906] RAX: 0000000000000292 RBX: ffff8801ccc44300 RCX: 0000000000000009
[ 1562.159909] RDX: 0000000000000000 RSI: ffff8801756e7d20 RDI: ffff8801cce9b868
[ 1562.159912] RBP: ffff8801756e7d88 R08: 1ffff10016b19bca R09: ffffffff8512f880
[ 1562.159915] R10: dead000000000200 R11: 1ffff1002eadcf58 R12: ffff8801c5c53e60
[ 1562.159918] R13: ffff8801ccc43300 R14: ffff8801cce9b850 R15: dffffc0000000000
[ 1562.159921] FS:  00007fd7dac08700(0000) GS:ffff8801db300000(0000) knlGS:0000000000000000
[ 1562.159924] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 1562.159926] CR2: 0000000020664fc0 CR3: 0000000062d1a000 CR4: 0000000000160670
[ 1562.159929] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 1562.159931] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[ 1562.159933] Stack:
[ 1562.159935]  ffff880176134800 0000000000000000 0000000000000007 ffff880176134800
[ 1562.159937]  1ffff1002eadcfa0 ffffffff85852fc0 ffff8801ccc45000 ffff8801ccc44300
[ 1562.159940]  dffffc0000000000 ffff8801c6765990 00000000000ed580 fffffbfff0b0a5f8
[ 1562.159941] Call Trace:
[ 1562.159944]  [<ffffffff81d69770>] ? debug_object_active_state+0x420/0x420
[ 1562.159946]  [<ffffffff814fab2d>] ? kmem_cache_free+0x9d/0x320
[ 1562.159948]  [<ffffffff815507be>] ? putname+0xee/0x130
[ 1562.159950]  [<ffffffff815507be>] ? putname+0xee/0x130
[ 1562.159953]  [<ffffffff814fab4c>] kmem_cache_free+0xbc/0x320
[ 1562.159955]  [<ffffffff815507be>] putname+0xee/0x130
[ 1562.159957]  [<ffffffff81b20a66>] SyS_mq_open+0x266/0x940
[ 1562.159960]  [<ffffffff81b20800>] ? mqueue_evict_inode+0x660/0x660
[ 1562.159962]  [<ffffffff812e26d0>] ? do_futex+0x15d0/0x15d0
[ 1562.159964]  [<ffffffff81003044>] ? lockdep_sys_exit_thunk+0x12/0x14
[ 1562.159966]  [<ffffffff83779965>] entry_SYSCALL_64_fastpath+0x22/0x9e
[ 1562.159972] Code: ba 00 02 00 00 00 00 ad de 31 c9 48 8d 75 98 4c 89 f2 48 c1 ea 03 42 80 3c 3a 00 0f 85 f0 03 00 00 49 8d 7e 18 83 c1 01 49 8b 16 <49> 89 f8 49 c1 e8 03 43 80 3c 38 00 0f 85 17 04 00 00 4d 8b 66 
[ 1562.160142] Kernel panic - not syncing: hung_task: blocked tasks
[ 1562.160148] CPU: 0 PID: 487 Comm: khungtaskd Not tainted 4.4.125-g38f41ec #63
[ 1562.160151] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 1562.160159]  0000000000000000 6137dd649daebebf ffff8800bacffca8 ffffffff81d067bd
[ 1562.160166]  ffffffff838831a0 ffff8800bacffd80 dffffc0000000000 7fffffffffffffff
[ 1562.160173]  ffff88018dc21c48 ffff8800bacffd70 ffffffff8141b46a 0000000041b58ab3
[ 1562.160174] Call Trace:
[ 1562.160183]  [<ffffffff81d067bd>] dump_stack+0xc1/0x124
[ 1562.160189]  [<ffffffff8141b46a>] panic+0x1aa/0x388
[ 1562.160196]  [<ffffffff8141b2c0>] ? percpu_up_read.constprop.45+0xe1/0xe1
[ 1562.160202]  [<ffffffff81d116b8>] ? nmi_trigger_all_cpu_backtrace+0x3f8/0x550
[ 1562.160207]  [<ffffffff81d116b8>] ? nmi_trigger_all_cpu_backtrace+0x3f8/0x550
[ 1562.160213]  [<ffffffff813695db>] watchdog+0x70b/0xae0
[ 1562.160218]  [<ffffffff81368f93>] ? watchdog+0xc3/0xae0
[ 1562.160225]  [<ffffffff81190b48>] kthread+0x268/0x300
[ 1562.160231]  [<ffffffff81368ed0>] ? reset_hung_task_detector+0x20/0x20
[ 1562.160237]  [<ffffffff811908e0>] ? kthread_create_on_node+0x400/0x400
[ 1562.160243]  [<ffffffff811908e0>] ? kthread_create_on_node+0x400/0x400
[ 1562.160249]  [<ffffffff83779d95>] ret_from_fork+0x55/0x80
[ 1562.160256]  [<ffffffff811908e0>] ? kthread_create_on_node+0x400/0x400
[ 1562.160740] Dumping ftrace buffer:
[ 1562.160766]    (ftrace buffer empty)
[ 1562.160767] Kernel Offset: disabled
[ 1569.365165] Rebooting in 86400 seconds..