fffff8149ab70>] ? SyS_read+0x1c0/0x1c0 [ 1025.159227] [] ? lockdep_sys_exit_thunk+0x12/0x14 [ 1025.159237] [] entry_SYSCALL_64_fastpath+0x1e/0x9a [ 1025.159240] Mem-Info: [ 1025.159265] active_anon:70088 inactive_anon:6188 isolated_anon:0 [ 1025.159265] active_file:11182 inactive_file:11777 isolated_file:0 [ 1025.159265] unevictable:0 dirty:47 writeback:0 unstable:0 [ 1025.159265] slab_reclaimable:4381 slab_unreclaimable:63336 [ 1025.159265] mapped:59023 shmem:8673 pagetables:8487 bounce:0 [ 1025.159265] free:1407168 free_pcp:516 free_cma:0 [ 1025.159311] DMA32 free:2573112kB min:4696kB low:5868kB high:7044kB active_anon:127752kB inactive_anon:11540kB active_file:19752kB inactive_file:20788kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:3145324kB managed:3021976kB mlocked:0kB dirty:8kB writeback:0kB mapped:107976kB shmem:15668kB slab_reclaimable:8324kB slab_unreclaimable:115780kB kernel_stack:6400kB pagetables:15372kB unstable:0kB bounce:0kB free_pcp:1056kB local_pcp:720kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no [ 1025.160616] lowmem_reserve[]: 0 3504 3504 [ 1025.160653] Normal free:3055560kB min:5580kB low:6972kB high:8368kB active_anon:152600kB inactive_anon:13212kB active_file:24976kB inactive_file:26320kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:4718592kB managed:3588764kB mlocked:0kB dirty:180kB writeback:0kB mapped:128116kB shmem:19024kB slab_reclaimable:9200kB slab_unreclaimable:137564kB kernel_stack:8192kB pagetables:18724kB unstable:0kB bounce:0kB free_pcp:988kB local_pcp:544kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no [ 1025.160662] lowmem_reserve[]: 0 0 0 [ 1025.160724] DMA32: 10*4kB (UE) 63*8kB (UME) 312*16kB (UME) 178*32kB (UME) 74*64kB (UME) 23*128kB (UME) 11*256kB (UM) 5*512kB (M) 1*1024kB (E) 2*2048kB (UE) 621*4096kB (M) = 2573024kB [ 1025.160776] Normal: 550*4kB (UM) 322*8kB (UME) 284*16kB (UME) 216*32kB (UM) 90*64kB (UME) 32*128kB (UME) 10*256kB (UM) 8*512kB (UME) 4*1024kB (M) 4*2048kB (UME) 735*4096kB (M) = 3055592kB [ 1025.160780] 31631 total pagecache pages [ 1025.160784] 0 pages in swap cache [ 1025.160789] Swap cache stats: add 0, delete 0, find 0/0 [ 1025.160792] Free swap = 0kB [ 1025.160794] Total swap = 0kB [ 1025.160797] 1965979 pages RAM [ 1025.160799] 0 pages HighMem/MovableOnly [ 1025.160802] 313294 pages reserved [ 1025.780628] vmalloc: allocation failure: 0 bytes [ 1025.780634] syz-executor.4: page allocation failure: order:0, mode:0x24000c2 [ 1025.780643] CPU: 0 PID: 14426 Comm: syz-executor.4 Not tainted 4.4.174+ #4 [ 1025.780657] 0000000000000000 1047ff6d2a440cb3 ffff8801d5b679f0 ffffffff81aad1a1 [ 1025.780668] 1ffff1003ab6cf41 ffff8800b80bc740 00000000024000c2 0000000000000000 [ 1025.780680] ffffffff82895080 ffff8801d5b67b00 ffffffff8148c0cb ffffffff00000001 [ 1025.780682] Call Trace: [ 1025.780698] [] dump_stack+0xc1/0x120 [ 1025.780713] [] warn_alloc_failed.cold+0x78/0x99 [ 1025.780726] [] ? zone_watermark_ok_safe+0x290/0x290 [ 1025.780735] [] ? sel_write_load+0x9e/0xf90 [ 1025.780746] [] __vmalloc_node_range+0x365/0x650 [ 1025.780755] [] ? check_preemption_disabled+0x3c/0x200 [ 1025.780762] [] ? check_preemption_disabled+0x3c/0x200 [ 1025.780770] [] ? task_has_security+0x130/0x270 [ 1025.780778] [] vmalloc+0x5c/0x70 [ 1025.780788] [] ? sel_write_load+0x119/0xf90 [ 1025.780796] [] sel_write_load+0x119/0xf90 [ 1025.780804] [] ? sel_read_bool+0x240/0x240 [ 1025.780813] [] ? trace_hardirqs_on+0x10/0x10 [ 1025.780823] [] __vfs_write+0x116/0x3d0 [ 1025.780832] [] ? sel_read_bool+0x240/0x240 [ 1025.780840] [] ? __vfs_read+0x3c0/0x3c0 [ 1025.780848] [] ? check_preemption_disabled+0x3c/0x200 [ 1025.780856] [] ? check_preemption_disabled+0x3c/0x200 [ 1025.780866] [] ? rcu_read_lock_sched_held+0x10b/0x130 [ 1025.780874] [] ? rcu_sync_lockdep_assert+0x73/0xb0 12:13:26 executing program 2: openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r0 = creat(&(0x7f0000000700)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x40000006100) ftruncate(r0, 0x208203) r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000008000/0x600000)=nil, 0x600000, 0x800002, 0x11, r1, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r2, &(0x7f0000000180)={0xa, 0x4e24, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) sendmmsg(r2, &(0x7f00000092c0), 0x4ff, 0x0) r3 = open(&(0x7f00000003c0)='./bus\x00', 0x0, 0x0) sendfile(r0, r3, 0x0, 0x8000fffffffe) r4 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r4, 0x1000008912, &(0x7f0000000000)="11dca5055e0acfec7be070") 12:13:26 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x6, 0x1100082) r1 = memfd_create(&(0x7f0000000080)='t\bnu\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00', 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000340)=[{&(0x7f0000001140)='\'', 0x1}], 0x1, 0x1081804) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendfile(r0, r0, 0x0, 0x200000d) ioctl$LOOP_CLR_FD(r0, 0x4c01) syz_genetlink_get_family_id$tipc(0x0) dup3(r1, r0, 0x0) 12:13:26 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) 12:13:26 executing program 0: openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)={'vet\x00\x00\x96T\x00\x00\x00\x00\x00\xbdh \x00', 0x402}) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000180)={'vd\x7f\x00\x16\x00\xf9V\xdbZ\xdd\x91\x80\xd2{\x00', 0x43732e5398417f1e}) close(r0) 12:13:26 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) 12:13:26 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) [ 1025.780882] [] ? __sb_start_write+0x14f/0x310 [ 1025.780889] [] vfs_write+0x182/0x4e0 [ 1025.780900] [] SyS_write+0xdc/0x1c0 [ 1025.780910] [] ? SyS_read+0x1c0/0x1c0 [ 1025.780923] [] ? lockdep_sys_exit_thunk+0x12/0x14 12:13:26 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) [ 1025.780947] [] entry_SYSCALL_64_fastpath+0x1e/0x9a [ 1025.780951] Mem-Info: [ 1025.780976] active_anon:70054 inactive_anon:5696 isolated_anon:0 [ 1025.780976] active_file:11182 inactive_file:11777 isolated_file:0 12:13:26 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) 12:13:26 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) [ 1025.780976] unevictable:0 dirty:47 writeback:0 unstable:0 [ 1025.780976] slab_reclaimable:4381 slab_unreclaimable:63567 [ 1025.780976] mapped:58996 shmem:8189 pagetables:8505 bounce:0 [ 1025.780976] free:1407524 free_pcp:508 free_cma:0 12:13:26 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) 12:13:26 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) 12:13:26 executing program 0: openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)={'vet\x00\x00\x96T\x00\x00\x00\x00\x00\xbdh \x00', 0x402}) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000180)={'vd\x7f\x00\x16\x00\xf9V\xdbZ\xdd\x91\x80\xd2{\x00', 0x43732e5398417f1e}) close(r0) ** 92 printk messages dropped ** [ 1028.415853] [] ? sel_write_load+0x9e/0xf90 [ 1028.415864] [] __vmalloc_node_range+0x365/0x650 [ 1028.415874] [] ? check_preemption_disabled+0x3c/0x200 [ 1028.415882] [] ? check_preemption_disabled+0x3c/0x200 [ 1028.415890] [] ? task_has_security+0x130/0x270 [ 1028.415898] [] vmalloc+0x5c/0x70 [ 1028.415906] [] ? sel_write_load+0x119/0xf90 [ 1028.415913] [] sel_write_load+0x119/0xf90 [ 1028.415921] [] ? sel_read_bool+0x240/0x240 [ 1028.415930] [] ? trace_hardirqs_on+0x10/0x10 [ 1028.415938] [] __vfs_write+0x116/0x3d0 [ 1028.415948] [] ? sel_read_bool+0x240/0x240 [ 1028.415957] [] ? __vfs_read+0x3c0/0x3c0 [ 1028.415965] [] ? check_preemption_disabled+0x3c/0x200 [ 1028.415975] [] ? check_preemption_disabled+0x3c/0x200 [ 1028.415986] [] ? rcu_read_lock_sched_held+0x10b/0x130 [ 1028.415994] [] ? rcu_sync_lockdep_assert+0x73/0xb0 [ 1028.416002] [] ? __sb_start_write+0x14f/0x310 [ 1028.416018] [] vfs_write+0x182/0x4e0 [ 1028.416030] [] SyS_write+0xdc/0x1c0 [ 1028.416040] [] ? SyS_read+0x1c0/0x1c0 [ 1028.416053] [] ? lockdep_sys_exit_thunk+0x12/0x14 [ 1028.416065] [] entry_SYSCALL_64_fastpath+0x1e/0x9a [ 1028.417751] Mem-Info: [ 1028.417777] active_anon:70031 inactive_anon:5700 isolated_anon:0 [ 1028.417777] active_file:11182 inactive_file:11777 isolated_file:0 [ 1028.417777] unevictable:0 dirty:47 writeback:0 unstable:0 [ 1028.417777] slab_reclaimable:4381 slab_unreclaimable:63600 [ 1028.417777] mapped:58964 shmem:8152 pagetables:8515 bounce:0 [ 1028.417777] free:1407611 free_pcp:376 free_cma:0 [ 1028.417813] DMA32 free:2575944kB min:4696kB low:5868kB high:7044kB active_anon:127424kB inactive_anon:10300kB active_file:19752kB inactive_file:20788kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:3145324kB managed:3021976kB mlocked:0kB dirty:8kB writeback:0kB mapped:107888kB shmem:14252kB slab_reclaimable:8324kB slab_unreclaimable:114792kB kernel_stack:6240kB pagetables:15504kB unstable:0kB bounce:0kB free_pcp:768kB local_pcp:120kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no [ 1028.417823] lowmem_reserve[]: 0 3504 3504 12:13:27 executing program 2: openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r0 = creat(&(0x7f0000000700)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x40000006100) ftruncate(r0, 0x208203) r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000008000/0x600000)=nil, 0x600000, 0x800002, 0x11, r1, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r2, &(0x7f0000000180)={0xa, 0x4e24, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) sendmmsg(r2, &(0x7f00000092c0), 0x4ff, 0x0) r3 = open(&(0x7f00000003c0)='./bus\x00', 0x0, 0x0) sendfile(r0, r3, 0x0, 0x8000fffffffe) r4 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r4, 0x1000008912, &(0x7f0000000000)="11dca5055e0acfec7be070") 12:13:27 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) 12:13:27 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x6, 0x1100082) r1 = memfd_create(&(0x7f0000000080)='t\bnu\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00', 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000340)=[{&(0x7f0000001140)='\'', 0x1}], 0x1, 0x1081804) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendfile(r0, r0, 0x0, 0x200000d) ioctl$LOOP_CLR_FD(r0, 0x4c01) syz_genetlink_get_family_id$tipc(0x0) dup3(r1, r0, 0x0) 12:13:27 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) 12:13:27 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) 12:13:27 executing program 0: openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)={'vet\x00\x00\x96T\x00\x00\x00\x00\x00\xbdh \x00', 0x402}) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000180)={'vd\x7f\x00\x16\x00\xf9V\xdbZ\xdd\x91\x80\xd2{\x00', 0x43732e5398417f1e}) close(r0) 12:13:27 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) [ 1028.417859] Normal free:3054500kB min:5580kB low:6972kB high:8368kB active_anon:152700kB inactive_anon:12500kB active_file:24976kB inactive_file:26320kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:4718592kB managed:3588764kB mlocked:0kB dirty:180kB writeback:0kB mapped:127968kB shmem:18356kB slab_reclaimable:9200kB slab_unreclaimable:139608kB kernel_stack:7904kB pagetables:18556kB unstable:0kB bounce:0kB free_pcp:736kB local_pcp:96kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no [ 1028.417869] lowmem_reserve[]: 0 0 0 [ 1028.417931] DMA32: 325*4kB (UME) 145*8kB (UME) 293*16kB (UME) 212*32kB (UME) 74*64kB (UME) 24*128kB (UME) 11*256kB (UM) 5*512kB (M) 1*1024kB (E) 2*2048kB (UE) 621*4096kB (M) = 2575852kB 12:13:27 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) 12:13:27 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) 12:13:27 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) ** 21 printk messages dropped ** [ 1028.504458] [] ? check_preemption_disabled+0x3c/0x200 12:13:27 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x6, 0x1100082) r1 = memfd_create(&(0x7f0000000080)='t\bnu\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00', 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000340)=[{&(0x7f0000001140)='\'', 0x1}], 0x1, 0x1081804) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendfile(r0, r0, 0x0, 0x200000d) ioctl$LOOP_CLR_FD(r0, 0x4c01) syz_genetlink_get_family_id$tipc(0x0) dup3(r1, r0, 0x0) 12:13:27 executing program 0: openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)={'vet\x00\x00\x96T\x00\x00\x00\x00\x00\xbdh \x00', 0x402}) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000180)={'vd\x7f\x00\x16\x00\xf9V\xdbZ\xdd\x91\x80\xd2{\x00', 0x43732e5398417f1e}) close(r0) ** 1 printk messages dropped ** [ 1028.504477] [] ? task_has_security+0x130/0x270 ** 1 printk messages dropped ** [ 1028.504493] [] ? sel_write_load+0x119/0xf90 [ 1028.504500] [] sel_write_load+0x119/0xf90 [ 1028.504509] [] ? sel_read_bool+0x240/0x240 [ 1028.504518] [] ? trace_hardirqs_on+0x10/0x10 [ 1028.504528] [] __vfs_write+0x116/0x3d0 [ 1028.504537] [] ? sel_read_bool+0x240/0x240 [ 1028.504546] [] ? __vfs_read+0x3c0/0x3c0 [ 1028.504555] [] ? check_preemption_disabled+0x3c/0x200 [ 1028.504565] [] ? check_preemption_disabled+0x3c/0x200 [ 1028.504576] [] ? rcu_read_lock_sched_held+0x10b/0x130 [ 1028.504586] [] ? rcu_sync_lockdep_assert+0x73/0xb0 [ 1028.504596] [] ? __sb_start_write+0x14f/0x310 [ 1028.504602] [] vfs_write+0x182/0x4e0 [ 1028.504610] [] SyS_write+0xdc/0x1c0 [ 1028.504617] [] ? SyS_read+0x1c0/0x1c0 [ 1028.504627] [] ? lockdep_sys_exit_thunk+0x12/0x14 [ 1028.504638] [] entry_SYSCALL_64_fastpath+0x1e/0x9a [ 1028.504641] Mem-Info: [ 1028.504674] active_anon:70081 inactive_anon:5750 isolated_anon:0 [ 1028.504674] active_file:11182 inactive_file:11777 isolated_file:0 [ 1028.504674] unevictable:0 dirty:47 writeback:0 unstable:0 [ 1028.504674] slab_reclaimable:4381 slab_unreclaimable:63398 [ 1028.504674] mapped:58964 shmem:8263 pagetables:8552 bounce:0 [ 1028.504674] free:1407641 free_pcp:338 free_cma:0 [ 1028.506667] DMA32 free:2575384kB min:4696kB low:5868kB high:7044kB active_anon:127524kB inactive_anon:10800kB active_file:19752kB inactive_file:20788kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:3145324kB managed:3021976kB mlocked:0kB dirty:8kB writeback:0kB mapped:107888kB shmem:14844kB slab_reclaimable:8324kB slab_unreclaimable:114792kB kernel_stack:6240kB pagetables:15504kB unstable:0kB bounce:0kB free_pcp:436kB local_pcp:176kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no [ 1028.506677] lowmem_reserve[]: 0 3504 3504 12:13:28 executing program 2: openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r0 = creat(&(0x7f0000000700)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x40000006100) ftruncate(r0, 0x208203) r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000008000/0x600000)=nil, 0x600000, 0x800002, 0x11, r1, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r2, &(0x7f0000000180)={0xa, 0x4e24, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) sendmmsg(r2, &(0x7f00000092c0), 0x4ff, 0x0) r3 = open(&(0x7f00000003c0)='./bus\x00', 0x0, 0x0) sendfile(r0, r3, 0x0, 0x8000fffffffe) r4 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r4, 0x1000008912, &(0x7f0000000000)="11dca5055e0acfec7be070") 12:13:28 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) 12:13:28 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) 12:13:28 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x6, 0x1100082) r1 = memfd_create(&(0x7f0000000080)='t\bnu\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00', 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000340)=[{&(0x7f0000001140)='\'', 0x1}], 0x1, 0x1081804) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendfile(r0, r0, 0x0, 0x200000d) ioctl$LOOP_CLR_FD(r0, 0x4c01) syz_genetlink_get_family_id$tipc(0x0) dup3(r1, r0, 0x0) 12:13:28 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) 12:13:28 executing program 0: openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)={'vet\x00\x00\x96T\x00\x00\x00\x00\x00\xbdh \x00', 0x402}) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000180)={'vd\x7f\x00\x16\x00\xf9V\xdbZ\xdd\x91\x80\xd2{\x00', 0x43732e5398417f1e}) close(r0) 12:13:28 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) [ 1028.506707] Normal free:3054960kB min:5580kB low:6972kB high:8368kB active_anon:152800kB inactive_anon:12500kB active_file:24976kB inactive_file:26320kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:4718592kB managed:3588764kB mlocked:0kB dirty:180kB writeback:0kB mapped:127968kB shmem:18356kB slab_reclaimable:9200kB slab_unreclaimable:138800kB kernel_stack:7904kB pagetables:18704kB unstable:0kB bounce:0kB free_pcp:940kB local_pcp:700kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no [ 1028.506715] lowmem_reserve[]: 0 0 0 [ 1028.507244] DMA32: 220*4kB (UME) 150*8kB (UME) 293*16kB (UME) 209*32kB (UME) 74*64kB (UME) 24*128kB (UME) 11*256kB (UM) 5*512kB (M) 1*1024kB (E) 2*2048kB (UE) 621*4096kB (M) = 2575376kB 12:13:28 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) 12:13:28 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) 12:13:28 executing program 0: openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)={'vet\x00\x00\x96T\x00\x00\x00\x00\x00\xbdh \x00', 0x402}) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000180)={'vd\x7f\x00\x16\x00\xf9V\xdbZ\xdd\x91\x80\xd2{\x00', 0x43732e5398417f1e}) close(r0) [ 1028.507303] Normal: 534*4kB (UM) 381*8kB (UME) 291*16kB (UME) 182*32kB (UM) 91*64kB (UME) 31*128kB (UME) 10*256kB (UM) 8*512kB (UME) 4*1024kB (M) 4*2048kB (UME) 735*4096kB (M) = 3054960kB 12:13:28 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) 12:13:28 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) [ 1028.507306] 31258 total pagecache pages [ 1028.507310] 0 pages in swap cache [ 1028.507315] Swap cache stats: add 0, delete 0, find 0/0 [ 1028.507317] Free swap = 0kB [ 1028.507320] Total swap = 0kB [ 1028.507324] 1965979 pages RAM [ 1028.507326] 0 pages HighMem/MovableOnly [ 1028.507328] 313294 pages reserved [ 1028.513022] binder_alloc: 14575: binder_alloc_buf, no vma [ 1028.513065] binder: 14575:14583 transaction failed 29189/-3, size 0-0 line 3137 [ 1028.517281] binder: undelivered TRANSACTION_ERROR: 29189 [ 1028.607086] vmalloc: allocation failure: 0 bytes [ 1028.607093] syz-executor.4: page allocation failure: order:0, mode:0x24000c2 [ 1028.607102] CPU: 0 PID: 14593 Comm: syz-executor.4 Not tainted 4.4.174+ #4 [ 1028.607115] 0000000000000000 5d3a525a5f3b6dfe ffff8801b88f79f0 ffffffff81aad1a1 [ 1028.607126] 1ffff1003711ef41 ffff8801d367af80 00000000024000c2 0000000000000000 [ 1028.607137] ffffffff82895080 ffff8801b88f7b00 ffffffff8148c0cb ffffffff00000001 [ 1028.607140] Call Trace: [ 1028.607155] [] dump_stack+0xc1/0x120 [ 1028.607167] [] warn_alloc_failed.cold+0x78/0x99 [ 1028.607177] [] ? zone_watermark_ok_safe+0x290/0x290 [ 1028.607194] [] ? sel_write_load+0x9e/0xf90 [ 1028.607206] [] __vmalloc_node_range+0x365/0x650 [ 1028.607216] [] ? check_preemption_disabled+0x3c/0x200 [ 1028.607225] [] ? check_preemption_disabled+0x3c/0x200 [ 1028.607235] [] ? task_has_security+0x130/0x270 [ 1028.607242] [] vmalloc+0x5c/0x70 [ 1028.607250] [] ? sel_write_load+0x119/0xf90 [ 1028.607257] [] sel_write_load+0x119/0xf90 [ 1028.607266] [] ? sel_read_bool+0x240/0x240 [ 1028.607275] [] ? trace_hardirqs_on+0x10/0x10 [ 1028.607283] [] __vfs_write+0x116/0x3d0 [ 1028.607290] [] ? sel_read_bool+0x240/0x240 [ 1028.607298] [] ? __vfs_read+0x3c0/0x3c0 12:13:29 executing program 2: openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r0 = creat(&(0x7f0000000700)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x40000006100) ftruncate(r0, 0x208203) r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000008000/0x600000)=nil, 0x600000, 0x800002, 0x11, r1, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r2, &(0x7f0000000180)={0xa, 0x4e24, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) sendmmsg(r2, &(0x7f00000092c0), 0x4ff, 0x0) r3 = open(&(0x7f00000003c0)='./bus\x00', 0x0, 0x0) sendfile(r0, r3, 0x0, 0x8000fffffffe) r4 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r4, 0x1000008912, &(0x7f0000000000)="11dca5055e0acfec7be070") 12:13:29 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x6, 0x1100082) r1 = memfd_create(&(0x7f0000000080)='t\bnu\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00', 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000340)=[{&(0x7f0000001140)='\'', 0x1}], 0x1, 0x1081804) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendfile(r0, r0, 0x0, 0x200000d) ioctl$LOOP_CLR_FD(r0, 0x4c01) syz_genetlink_get_family_id$tipc(0x0) dup3(r1, r0, 0x0) 12:13:29 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) 12:13:29 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) 12:13:29 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) 12:13:29 executing program 0: openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)={'vet\x00\x00\x96T\x00\x00\x00\x00\x00\xbdh \x00', 0x402}) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000180)={'vd\x7f\x00\x16\x00\xf9V\xdbZ\xdd\x91\x80\xd2{\x00', 0x43732e5398417f1e}) close(r0) [ 1028.607306] [] ? check_preemption_disabled+0x3c/0x200 [ 1028.607314] [] ? check_preemption_disabled+0x3c/0x200 [ 1028.607323] [] ? rcu_read_lock_sched_held+0x10b/0x130 [ 1028.607331] [] ? rcu_sync_lockdep_assert+0x73/0xb0 12:13:29 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) 12:13:29 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) 12:13:29 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) [ 1028.607340] [] ? __sb_start_write+0x14f/0x310 [ 1028.607348] [] vfs_write+0x182/0x4e0 [ 1028.607355] [] SyS_write+0xdc/0x1c0 12:13:29 executing program 0: openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)={'vet\x00\x00\x96T\x00\x00\x00\x00\x00\xbdh \x00', 0x402}) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000180)={'vd\x7f\x00\x16\x00\xf9V\xdbZ\xdd\x91\x80\xd2{\x00', 0x43732e5398417f1e}) close(r0) [ 1028.607363] [] ? SyS_read+0x1c0/0x1c0 12:13:29 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) [ 1028.607373] [] ? lockdep_sys_exit_thunk+0x12/0x14 12:13:29 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) [ 1028.607383] [] entry_SYSCALL_64_fastpath+0x1e/0x9a [ 1028.607488] Mem-Info: [ 1028.607513] active_anon:70056 inactive_anon:6175 isolated_anon:0 [ 1028.607513] active_file:11182 inactive_file:11777 isolated_file:0 [ 1028.607513] unevictable:0 dirty:47 writeback:0 unstable:0 [ 1028.607513] slab_reclaimable:4381 slab_unreclaimable:63432 [ 1028.607513] mapped:59001 shmem:8670 pagetables:8478 bounce:0 [ 1028.607513] free:1407150 free_pcp:427 free_cma:0 [ 1028.607548] DMA32 free:2574780kB min:4696kB low:5868kB high:7044kB active_anon:127424kB inactive_anon:11100kB active_file:19752kB inactive_file:20788kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:3145324kB managed:3021976kB mlocked:0kB dirty:8kB writeback:0kB mapped:107888kB shmem:15288kB slab_reclaimable:8324kB slab_unreclaimable:114912kB kernel_stack:6240kB pagetables:15356kB unstable:0kB bounce:0kB free_pcp:876kB local_pcp:420kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no [ 1028.607557] lowmem_reserve[]: 0 3504 3504 [ 1028.607587] Normal free:3053820kB min:5580kB low:6972kB high:8368kB active_anon:152800kB inactive_anon:13600kB active_file:24976kB inactive_file:26320kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:4718592kB managed:3588764kB mlocked:0kB dirty:180kB writeback:0kB mapped:128116kB shmem:19392kB slab_reclaimable:9200kB slab_unreclaimable:138816kB kernel_stack:7904kB pagetables:18556kB unstable:0kB bounce:0kB free_pcp:832kB local_pcp:592kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no [ 1028.607595] lowmem_reserve[]: 0 0 0 [ 1028.607648] DMA32: 127*4kB (UME) 150*8kB (UME) 293*16kB (UME) 204*32kB (UME) 74*64kB (UME) 24*128kB (UME) 11*256kB (UM) 5*512kB (M) 1*1024kB (E) 2*2048kB (UE) 621*4096kB (M) = 2574844kB [ 1028.607709] Normal: 415*4kB (UM) 335*8kB (UME) 293*16kB (UME) 167*32kB (UM) 91*64kB (UME) 31*128kB (UME) 10*256kB (UM) 8*512kB (UME) 4*1024kB (M) 4*2048kB (UME) 735*4096kB (M) = 3053668kB [ 1028.607712] 31628 total pagecache pages [ 1028.607717] 0 pages in swap cache [ 1028.607721] Swap cache stats: add 0, delete 0, find 0/0 [ 1028.607725] Free swap = 0kB [ 1028.607727] Total swap = 0kB [ 1028.607730] 1965979 pages RAM [ 1028.607733] 0 pages HighMem/MovableOnly [ 1028.607736] 313294 pages reserved [ 1029.293426] vmalloc: allocation failure: 0 bytes [ 1029.293440] syz-executor.4: page allocation failure: order:0, mode:0x24000c2 [ 1029.293450] CPU: 1 PID: 14610 Comm: syz-executor.4 Not tainted 4.4.174+ #4 [ 1029.293463] 0000000000000000 ff665aa18f683546 ffff8800b66879f0 ffffffff81aad1a1 [ 1029.293474] 1ffff10016cd0f41 ffff8800a6254740 00000000024000c2 0000000000000000 [ 1029.293485] ffffffff82895080 ffff8800b6687b00 ffffffff8148c0cb ffffffff00000001 [ 1029.293488] Call Trace: 12:13:29 executing program 2: openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r0 = creat(&(0x7f0000000700)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x40000006100) ftruncate(r0, 0x208203) r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000008000/0x600000)=nil, 0x600000, 0x800002, 0x11, r1, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r2, &(0x7f0000000180)={0xa, 0x4e24, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) sendmmsg(r2, &(0x7f00000092c0), 0x4ff, 0x0) r3 = open(&(0x7f00000003c0)='./bus\x00', 0x0, 0x0) sendfile(r0, r3, 0x0, 0x8000fffffffe) r4 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r4, 0x1000008912, &(0x7f0000000000)="11dca5055e0acfec7be070") 12:13:29 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x6, 0x1100082) r1 = memfd_create(&(0x7f0000000080)='t\bnu\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00', 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000340)=[{&(0x7f0000001140)='\'', 0x1}], 0x1, 0x1081804) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendfile(r0, r0, 0x0, 0x200000d) ioctl$LOOP_CLR_FD(r0, 0x4c01) syz_genetlink_get_family_id$tipc(0x0) dup3(r1, r0, 0x0) 12:13:29 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) 12:13:29 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) 12:13:29 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) 12:13:29 executing program 0: openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)={'vet\x00\x00\x96T\x00\x00\x00\x00\x00\xbdh \x00', 0x402}) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000180)={'vd\x7f\x00\x16\x00\xf9V\xdbZ\xdd\x91\x80\xd2{\x00', 0x43732e5398417f1e}) close(r0) [ 1029.293503] [] dump_stack+0xc1/0x120 12:13:29 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) 12:13:30 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) 12:13:30 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) [ 1029.293515] [] warn_alloc_failed.cold+0x78/0x99 [ 1029.293527] [] ? zone_watermark_ok_safe+0x290/0x290 12:13:30 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x6, 0x1100082) r1 = memfd_create(&(0x7f0000000080)='t\bnu\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00', 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000340)=[{&(0x7f0000001140)='\'', 0x1}], 0x1, 0x1081804) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendfile(r0, r0, 0x0, 0x200000d) ioctl$LOOP_CLR_FD(r0, 0x4c01) syz_genetlink_get_family_id$tipc(0x0) dup3(r1, r0, 0x0) 12:13:30 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) [ 1029.293535] [] ? sel_write_load+0x9e/0xf90 12:13:30 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) [ 1029.293544] [] __vmalloc_node_range+0x365/0x650 [ 1029.293553] [] ? check_preemption_disabled+0x3c/0x200 [ 1029.293561] [] ? check_preemption_disabled+0x3c/0x200 [ 1029.293569] [] ? task_has_security+0x130/0x270 [ 1029.293576] [] vmalloc+0x5c/0x70 [ 1029.293584] [] ? sel_write_load+0x119/0xf90 [ 1029.293592] [] sel_write_load+0x119/0xf90 [ 1029.293600] [] ? sel_read_bool+0x240/0x240 [ 1029.293609] [] ? trace_hardirqs_on+0x10/0x10 [ 1029.293618] [] __vfs_write+0x116/0x3d0 [ 1029.293625] [] ? sel_read_bool+0x240/0x240 [ 1029.293633] [] ? __vfs_read+0x3c0/0x3c0 [ 1029.293641] [] ? check_preemption_disabled+0x3c/0x200 [ 1029.293649] [] ? check_preemption_disabled+0x3c/0x200 [ 1029.293658] [] ? rcu_read_lock_sched_held+0x10b/0x130 [ 1029.293666] [] ? rcu_sync_lockdep_assert+0x73/0xb0 [ 1029.293675] [] ? __sb_start_write+0x14f/0x310 [ 1029.293683] [] vfs_write+0x182/0x4e0 [ 1029.293690] [] SyS_write+0xdc/0x1c0 [ 1029.293698] [] ? SyS_read+0x1c0/0x1c0 [ 1029.293708] [] ? lockdep_sys_exit_thunk+0x12/0x14 [ 1029.293718] [] entry_SYSCALL_64_fastpath+0x1e/0x9a [ 1029.293721] Mem-Info: [ 1029.293746] active_anon:70007 inactive_anon:5703 isolated_anon:0 [ 1029.293746] active_file:11182 inactive_file:11777 isolated_file:0 [ 1029.293746] unevictable:0 dirty:47 writeback:0 unstable:0 [ 1029.293746] slab_reclaimable:4381 slab_unreclaimable:63428 [ 1029.293746] mapped:58972 shmem:8149 pagetables:8515 bounce:0 [ 1029.293746] free:1407739 free_pcp:510 free_cma:0 [ 1029.293784] DMA32 free:2575616kB min:4696kB low:5868kB high:7044kB active_anon:127636kB inactive_anon:10224kB active_file:19752kB inactive_file:20788kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:3145324kB managed:3021976kB mlocked:0kB dirty:8kB writeback:0kB mapped:107832kB shmem:14296kB slab_reclaimable:8324kB slab_unreclaimable:115152kB kernel_stack:6240kB pagetables:15132kB unstable:0kB bounce:0kB free_pcp:972kB local_pcp:296kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no [ 1029.293794] lowmem_reserve[]: 0 3504 3504 [ 1029.293829] Normal free:3055340kB min:5580kB low:6972kB high:8368kB active_anon:152392kB inactive_anon:12588kB active_file:24976kB inactive_file:26320kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:4718592kB managed:3588764kB mlocked:0kB dirty:180kB writeback:0kB mapped:128056kB shmem:18300kB slab_reclaimable:9200kB slab_unreclaimable:138560kB kernel_stack:7904kB pagetables:18928kB unstable:0kB bounce:0kB free_pcp:1068kB local_pcp:392kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no [ 1029.293838] lowmem_reserve[]: 0 0 0 [ 1029.293899] DMA32: 214*4kB (UME) 175*8kB (UME) 299*16kB (UME) 203*32kB (UME) 74*64kB (UME) 24*128kB (UME) 11*256kB (UM) 5*512kB (M) 1*1024kB (E) 2*2048kB (UE) 621*4096kB (M) = 2575456kB [ 1029.296277] Normal: 513*4kB (UM) 340*8kB (UME) 294*16kB (UME) 203*32kB (UM) 91*64kB (UME) 32*128kB (UME) 10*256kB (UM) 8*512kB (UME) 4*1024kB (M) 4*2048kB (UME) 735*4096kB (M) = 3055396kB [ 1029.296280] 31107 total pagecache pages [ 1029.296284] 0 pages in swap cache 12:13:30 executing program 2: openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r0 = creat(&(0x7f0000000700)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x40000006100) ftruncate(r0, 0x208203) r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000008000/0x600000)=nil, 0x600000, 0x800002, 0x11, r1, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r2, &(0x7f0000000180)={0xa, 0x4e24, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) sendmmsg(r2, &(0x7f00000092c0), 0x4ff, 0x0) r3 = open(&(0x7f00000003c0)='./bus\x00', 0x0, 0x0) sendfile(r0, r3, 0x0, 0x8000fffffffe) r4 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r4, 0x1000008912, &(0x7f0000000000)="11dca5055e0acfec7be070") 12:13:30 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) 12:13:30 executing program 0: openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)={'vet\x00\x00\x96T\x00\x00\x00\x00\x00\xbdh \x00', 0x402}) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000180)={'vd\x7f\x00\x16\x00\xf9V\xdbZ\xdd\x91\x80\xd2{\x00', 0x43732e5398417f1e}) close(r0) 12:13:30 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) 12:13:30 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) 12:13:30 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x6, 0x1100082) r1 = memfd_create(&(0x7f0000000080)='t\bnu\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00', 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000340)=[{&(0x7f0000001140)='\'', 0x1}], 0x1, 0x1081804) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendfile(r0, r0, 0x0, 0x200000d) ioctl$LOOP_CLR_FD(r0, 0x4c01) syz_genetlink_get_family_id$tipc(0x0) dup3(r1, r0, 0x0) [ 1029.296289] Swap cache stats: add 0, delete 0, find 0/0 12:13:30 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) 12:13:30 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) 12:13:30 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) [ 1029.296292] Free swap = 0kB [ 1029.296294] Total swap = 0kB [ 1029.296297] 1965979 pages RAM 12:13:30 executing program 0: openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)={'vet\x00\x00\x96T\x00\x00\x00\x00\x00\xbdh \x00', 0x402}) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000180)={'vd\x7f\x00\x16\x00\xf9V\xdbZ\xdd\x91\x80\xd2{\x00', 0x43732e5398417f1e}) close(r0) [ 1029.296299] 0 pages HighMem/MovableOnly [ 1029.296302] 313294 pages reserved [ 1029.301118] binder_alloc: 14604: binder_alloc_buf, no vma [ 1029.301162] binder: 14604:14612 transaction failed 29189/-3, size 0-0 line 3137 12:13:30 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x6, 0x1100082) r1 = memfd_create(&(0x7f0000000080)='t\bnu\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00', 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000340)=[{&(0x7f0000001140)='\'', 0x1}], 0x1, 0x1081804) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendfile(r0, r0, 0x0, 0x200000d) ioctl$LOOP_CLR_FD(r0, 0x4c01) syz_genetlink_get_family_id$tipc(0x0) dup3(r1, r0, 0x0) 12:13:30 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) ** 33 printk messages dropped ** [ 1029.501742] [] entry_SYSCALL_64_fastpath+0x1e/0x9a ** 48 printk messages dropped ** [ 1030.154560] [] ? SyS_read+0x1c0/0x1c0 [ 1030.154572] [] ? lockdep_sys_exit_thunk+0x12/0x14 [ 1030.154582] [] entry_SYSCALL_64_fastpath+0x1e/0x9a [ 1030.154585] Mem-Info: [ 1030.154610] active_anon:70032 inactive_anon:5703 isolated_anon:0 [ 1030.154610] active_file:11182 inactive_file:11777 isolated_file:0 [ 1030.154610] unevictable:0 dirty:47 writeback:0 unstable:0 [ 1030.154610] slab_reclaimable:4381 slab_unreclaimable:63432 [ 1030.154610] mapped:58972 shmem:8149 pagetables:8515 bounce:0 [ 1030.154610] free:1407813 free_pcp:404 free_cma:0 [ 1030.154651] DMA32 free:2575396kB min:4696kB low:5868kB high:7044kB active_anon:127636kB inactive_anon:10224kB active_file:19752kB inactive_file:20788kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:3145324kB managed:3021976kB mlocked:0kB dirty:8kB writeback:0kB mapped:107832kB shmem:14296kB slab_reclaimable:8324kB slab_unreclaimable:115452kB kernel_stack:6240kB pagetables:15280kB unstable:0kB bounce:0kB free_pcp:588kB local_pcp:232kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no [ 1030.155206] lowmem_reserve[]: 0 3504 3504 [ 1030.155244] Normal free:3055856kB min:5580kB low:6972kB high:8368kB active_anon:152492kB inactive_anon:12588kB active_file:24976kB inactive_file:26320kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:4718592kB managed:3588764kB mlocked:0kB dirty:180kB writeback:0kB mapped:128056kB shmem:18300kB slab_reclaimable:9200kB slab_unreclaimable:138276kB kernel_stack:7904kB pagetables:18780kB unstable:0kB bounce:0kB free_pcp:1028kB local_pcp:336kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no [ 1030.155253] lowmem_reserve[]: 0 0 0 [ 1030.155310] DMA32: 133*4kB (UME) 196*8kB (UME) 299*16kB (UME) 200*32kB (UME) 74*64kB (UME) 24*128kB (UME) 11*256kB (UM) 5*512kB (M) 1*1024kB (E) 2*2048kB (UE) 621*4096kB (M) = 2575204kB [ 1030.155361] Normal: 566*4kB (UM) 349*8kB (UME) 295*16kB (UME) 198*32kB (UM) 95*64kB (UME) 32*128kB (UME) 10*256kB (UM) 8*512kB (UME) 4*1024kB (M) 4*2048kB (UME) 735*4096kB (M) = 3055792kB [ 1030.155363] 31107 total pagecache pages [ 1030.155367] 0 pages in swap cache [ 1030.155372] Swap cache stats: add 0, delete 0, find 0/0 [ 1030.155374] Free swap = 0kB [ 1030.155377] Total swap = 0kB [ 1030.155379] 1965979 pages RAM [ 1030.155382] 0 pages HighMem/MovableOnly [ 1030.155384] 313294 pages reserved [ 1030.160083] binder: 14651:14661 transaction failed 29189/-22, size 0-0 line 3014 [ 1030.160255] binder: undelivered TRANSACTION_ERROR: 29189 [ 1030.418446] vmalloc: allocation failure: 0 bytes [ 1030.418452] syz-executor.4: page allocation failure: order:0, mode:0x24000c2 [ 1030.418462] CPU: 1 PID: 14682 Comm: syz-executor.4 Not tainted 4.4.174+ #4 12:13:31 executing program 2: openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r0 = creat(&(0x7f0000000700)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x40000006100) ftruncate(r0, 0x208203) r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000008000/0x600000)=nil, 0x600000, 0x800002, 0x11, r1, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r2, &(0x7f0000000180)={0xa, 0x4e24, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) sendmmsg(r2, &(0x7f00000092c0), 0x4ff, 0x0) r3 = open(&(0x7f00000003c0)='./bus\x00', 0x0, 0x0) sendfile(r0, r3, 0x0, 0x8000fffffffe) r4 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r4, 0x1000008912, &(0x7f0000000000)="11dca5055e0acfec7be070") 12:13:31 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) 12:13:31 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) 12:13:31 executing program 0: openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)={'vet\x00\x00\x96T\x00\x00\x00\x00\x00\xbdh \x00', 0x402}) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000180)={'vd\x7f\x00\x16\x00\xf9V\xdbZ\xdd\x91\x80\xd2{\x00', 0x43732e5398417f1e}) close(r0) 12:13:31 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) 12:13:31 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x6, 0x1100082) r1 = memfd_create(&(0x7f0000000080)='t\bnu\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00', 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000340)=[{&(0x7f0000001140)='\'', 0x1}], 0x1, 0x1081804) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendfile(r0, r0, 0x0, 0x200000d) ioctl$LOOP_CLR_FD(r0, 0x4c01) syz_genetlink_get_family_id$tipc(0x0) dup3(r1, r0, 0x0) [ 1030.418474] 0000000000000000 565e2b2e4b0e1c53 ffff8800002f79f0 ffffffff81aad1a1 [ 1030.418484] 1ffff1000005ef41 ffff8801c07d0000 00000000024000c2 0000000000000000 12:13:31 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) 12:13:31 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) [ 1030.418492] ffffffff82895080 ffff8800002f7b00 ffffffff8148c0cb ffffffff00000001 12:13:31 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) ** 25 printk messages dropped ** [ 1030.418725] [] ? lockdep_sys_exit_thunk+0x12/0x14 12:13:31 executing program 0: openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)={'vet\x00\x00\x96T\x00\x00\x00\x00\x00\xbdh \x00', 0x402}) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000180)={'vd\x7f\x00\x16\x00\xf9V\xdbZ\xdd\x91\x80\xd2{\x00', 0x43732e5398417f1e}) close(r0) 12:13:31 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) 12:13:31 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) ** 48 printk messages dropped ** [ 1031.039570] [] ? check_preemption_disabled+0x3c/0x200 ** 50 printk messages dropped ** [ 1031.143914] [] ? check_preemption_disabled+0x3c/0x200 ** 1 printk messages dropped ** [ 1031.143931] [] ? rcu_sync_lockdep_assert+0x73/0xb0 [ 1031.143952] [] ? __sb_start_write+0x14f/0x310 [ 1031.143961] [] vfs_write+0x182/0x4e0 [ 1031.143970] [] SyS_write+0xdc/0x1c0 [ 1031.143979] [] ? SyS_read+0x1c0/0x1c0 [ 1031.143994] [] ? lockdep_sys_exit_thunk+0x12/0x14 [ 1031.144006] [] entry_SYSCALL_64_fastpath+0x1e/0x9a [ 1031.144010] Mem-Info: [ 1031.144035] active_anon:70100 inactive_anon:5698 isolated_anon:0 [ 1031.144035] active_file:11182 inactive_file:11777 isolated_file:0 [ 1031.144035] unevictable:0 dirty:47 writeback:0 unstable:0 [ 1031.144035] slab_reclaimable:4381 slab_unreclaimable:63492 [ 1031.144035] mapped:59001 shmem:8189 pagetables:8567 bounce:0 [ 1031.144035] free:1407452 free_pcp:516 free_cma:0 [ 1031.144072] DMA32 free:2574464kB min:4696kB low:5868kB high:7044kB active_anon:127620kB inactive_anon:10228kB active_file:19752kB inactive_file:20788kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:3145324kB managed:3021976kB mlocked:0kB dirty:8kB writeback:0kB mapped:107972kB shmem:14372kB slab_reclaimable:8324kB slab_unreclaimable:115916kB kernel_stack:6432kB pagetables:15276kB unstable:0kB bounce:0kB free_pcp:960kB local_pcp:512kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no [ 1031.144082] lowmem_reserve[]: 0 3504 3504 [ 1031.144115] Normal free:3055344kB min:5580kB low:6972kB high:8368kB active_anon:152780kB inactive_anon:12564kB active_file:24976kB inactive_file:26320kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:4718592kB managed:3588764kB mlocked:0kB dirty:180kB writeback:0kB mapped:128032kB shmem:18384kB slab_reclaimable:9200kB slab_unreclaimable:138052kB kernel_stack:8064kB pagetables:18992kB unstable:0kB bounce:0kB free_pcp:1104kB local_pcp:672kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no [ 1031.144124] lowmem_reserve[]: 0 0 0 [ 1031.144181] DMA32: 251*4kB (UME) 136*8kB (UME) 299*16kB (UME) 178*32kB (UME) 74*64kB (UME) 24*128kB (UME) 11*256kB (UM) 5*512kB (M) 1*1024kB (E) 2*2048kB (UE) 621*4096kB (M) = 2574492kB [ 1031.144237] Normal: 485*4kB (UM) 379*8kB (UME) 294*16kB (UME) 189*32kB (UM) 96*64kB (UME) 31*128kB (UME) 10*256kB (UM) 8*512kB (UME) 4*1024kB (M) 4*2048kB (UME) 735*4096kB (M) = 3055340kB [ 1031.144239] 31147 total pagecache pages [ 1031.144244] 0 pages in swap cache [ 1031.144250] Swap cache stats: add 0, delete 0, find 0/0 [ 1031.144254] Free swap = 0kB [ 1031.144256] Total swap = 0kB [ 1031.144259] 1965979 pages RAM [ 1031.144263] 0 pages HighMem/MovableOnly [ 1031.144265] 313294 pages reserved [ 1031.178340] binder: 14726:14728 transaction failed 29189/-22, size 0-0 line 3014 [ 1031.178508] binder: undelivered TRANSACTION_ERROR: 29189 [ 1031.844775] binder: 14746:14753 transaction failed 29189/-22, size 0-0 line 3014 [ 1031.844953] binder: undelivered TRANSACTION_ERROR: 29189 [ 1031.929515] binder: 14763:14768 transaction failed 29189/-22, size 0-0 line 3014 [ 1031.929665] binder: undelivered TRANSACTION_ERROR: 29189 [ 1032.021807] binder: 14773:14781 transaction failed 29189/-22, size 0-0 line 3014 [ 1032.021969] binder: undelivered TRANSACTION_ERROR: 29189 [ 1032.704288] binder: 14791:14797 transaction failed 29189/-22, size 0-0 line 3014 [ 1032.704976] binder: undelivered TRANSACTION_ERROR: 29189 12:13:32 executing program 2: openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r0 = creat(&(0x7f0000000700)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x40000006100) ftruncate(r0, 0x208203) r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000008000/0x600000)=nil, 0x600000, 0x800002, 0x11, r1, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r2, &(0x7f0000000180)={0xa, 0x4e24, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) sendmmsg(r2, &(0x7f00000092c0), 0x4ff, 0x0) r3 = open(&(0x7f00000003c0)='./bus\x00', 0x0, 0x0) sendfile(r0, r3, 0x0, 0x8000fffffffe) r4 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r4, 0x1000008912, &(0x7f0000000000)="11dca5055e0acfec7be070") 12:13:32 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x6, 0x1100082) r1 = memfd_create(&(0x7f0000000080)='t\bnu\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00', 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000340)=[{&(0x7f0000001140)='\'', 0x1}], 0x1, 0x1081804) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendfile(r0, r0, 0x0, 0x200000d) ioctl$LOOP_CLR_FD(r0, 0x4c01) syz_genetlink_get_family_id$tipc(0x0) dup3(r1, r0, 0x0) 12:13:32 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) 12:13:32 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) 12:13:32 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) 12:13:32 executing program 0: openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)={'vet\x00\x00\x96T\x00\x00\x00\x00\x00\xbdh \x00', 0x402}) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000180)={'vd\x7f\x00\x16\x00\xf9V\xdbZ\xdd\x91\x80\xd2{\x00', 0x43732e5398417f1e}) close(r0) [ 1032.858993] binder: 14811:14816 transaction failed 29189/-22, size 0-0 line 3014 [ 1032.859134] binder: undelivered TRANSACTION_ERROR: 29189 12:13:32 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) 12:13:32 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) [ 1032.990445] binder: 14827:14831 transaction failed 29189/-22, size 0-0 line 3014 12:13:32 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) 12:13:32 executing program 0: openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)={'vet\x00\x00\x96T\x00\x00\x00\x00\x00\xbdh \x00', 0x402}) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000180)={'vd\x7f\x00\x16\x00\xf9V\xdbZ\xdd\x91\x80\xd2{\x00', 0x43732e5398417f1e}) close(r0) ** 15 printk messages dropped ** [ 1033.563368] [] __vmalloc_node_range+0x365/0x650 12:13:32 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) 12:13:32 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x6, 0x1100082) r1 = memfd_create(&(0x7f0000000080)='t\bnu\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00', 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000340)=[{&(0x7f0000001140)='\'', 0x1}], 0x1, 0x1081804) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendfile(r0, r0, 0x0, 0x200000d) ioctl$LOOP_CLR_FD(r0, 0x4c01) syz_genetlink_get_family_id$tipc(0x0) dup3(r1, r0, 0x0) [ 1033.563377] [] ? check_preemption_disabled+0x3c/0x200 ** 52 printk messages dropped ** [ 1033.729874] [] ? task_has_security+0x130/0x270 [ 1033.729881] [] vmalloc+0x5c/0x70 [ 1033.729889] [] ? sel_write_load+0x119/0xf90 [ 1033.729896] [] sel_write_load+0x119/0xf90 [ 1033.729905] [] ? sel_read_bool+0x240/0x240 [ 1033.729914] [] ? trace_hardirqs_on+0x10/0x10 [ 1033.729922] [] __vfs_write+0x116/0x3d0 [ 1033.729929] [] ? sel_read_bool+0x240/0x240 [ 1033.729949] [] ? __vfs_read+0x3c0/0x3c0 [ 1033.729959] [] ? check_preemption_disabled+0x3c/0x200 [ 1033.729969] [] ? check_preemption_disabled+0x3c/0x200 [ 1033.729981] [] ? rcu_read_lock_sched_held+0x10b/0x130 [ 1033.729992] [] ? rcu_sync_lockdep_assert+0x73/0xb0 [ 1033.730004] [] ? __sb_start_write+0x14f/0x310 [ 1033.730012] [] vfs_write+0x182/0x4e0 [ 1033.730020] [] SyS_write+0xdc/0x1c0 [ 1033.730028] [] ? SyS_read+0x1c0/0x1c0 [ 1033.730042] [] ? lockdep_sys_exit_thunk+0x12/0x14 [ 1033.730054] [] entry_SYSCALL_64_fastpath+0x1e/0x9a [ 1033.730057] Mem-Info: [ 1033.730081] active_anon:70081 inactive_anon:6200 isolated_anon:0 [ 1033.730081] active_file:11182 inactive_file:11777 isolated_file:0 [ 1033.730081] unevictable:0 dirty:47 writeback:0 unstable:0 [ 1033.730081] slab_reclaimable:4381 slab_unreclaimable:63432 [ 1033.730081] mapped:59001 shmem:8670 pagetables:8515 bounce:0 [ 1033.730081] free:1407190 free_pcp:406 free_cma:0 [ 1033.730114] DMA32 free:2572376kB min:4696kB low:5868kB high:7044kB active_anon:127624kB inactive_anon:10944kB active_file:19752kB inactive_file:20788kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:3145324kB managed:3021976kB mlocked:0kB dirty:8kB writeback:0kB mapped:107824kB shmem:15076kB slab_reclaimable:8324kB slab_unreclaimable:117312kB kernel_stack:6240kB pagetables:15296kB unstable:0kB bounce:0kB free_pcp:904kB local_pcp:652kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no [ 1033.730123] lowmem_reserve[]: 0 3504 3504 [ 1033.730157] Normal free:3056384kB min:5580kB low:6972kB high:8368kB active_anon:152700kB inactive_anon:13856kB active_file:24976kB inactive_file:26320kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:4718592kB managed:3588764kB mlocked:0kB dirty:180kB writeback:0kB mapped:128180kB shmem:19604kB slab_reclaimable:9200kB slab_unreclaimable:136416kB kernel_stack:7904kB pagetables:18764kB unstable:0kB bounce:0kB free_pcp:720kB local_pcp:560kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no 12:13:33 executing program 2: openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r0 = creat(&(0x7f0000000700)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x40000006100) ftruncate(r0, 0x208203) r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000008000/0x600000)=nil, 0x600000, 0x800002, 0x11, r1, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r2, &(0x7f0000000180)={0xa, 0x4e24, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) sendmmsg(r2, &(0x7f00000092c0), 0x4ff, 0x0) r3 = open(&(0x7f00000003c0)='./bus\x00', 0x0, 0x0) sendfile(r0, r3, 0x0, 0x8000fffffffe) r4 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r4, 0x1000008912, &(0x7f0000000000)="11dca5055e0acfec7be070") 12:13:33 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) 12:13:33 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) 12:13:33 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) 12:13:33 executing program 0: openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)={'vet\x00\x00\x96T\x00\x00\x00\x00\x00\xbdh \x00', 0x402}) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000180)={'vd\x7f\x00\x16\x00\xf9V\xdbZ\xdd\x91\x80\xd2{\x00', 0x43732e5398417f1e}) close(r0) 12:13:33 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x6, 0x1100082) r1 = memfd_create(&(0x7f0000000080)='t\bnu\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00', 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000340)=[{&(0x7f0000001140)='\'', 0x1}], 0x1, 0x1081804) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendfile(r0, r0, 0x0, 0x200000d) ioctl$LOOP_CLR_FD(r0, 0x4c01) syz_genetlink_get_family_id$tipc(0x0) dup3(r1, r0, 0x0) [ 1033.730166] lowmem_reserve[]: 0 0 0 [ 1033.730226] DMA32: 2*4kB (ME) 86*8kB (UME) 270*16kB (UME) 163*32kB (UME) 73*64kB (UME) 25*128kB (UME) 11*256kB (UM) 5*512kB (M) 1*1024kB (E) 2*2048kB (UE) 621*4096kB (M) = 2572216kB [ 1033.730276] Normal: 692*4kB (UM) 368*8kB (UME) 303*16kB (UME) 195*32kB (UM) 96*64kB (UME) 32*128kB (UME) 10*256kB (UM) 8*512kB (UME) 4*1024kB (M) 4*2048kB (UME) 735*4096kB (M) = 3056544kB 12:13:33 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) 12:13:33 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) 12:13:33 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) ** 24 printk messages dropped ** [ 1034.295794] [] ? task_has_security+0x130/0x270 12:13:33 executing program 0: openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)={'vet\x00\x00\x96T\x00\x00\x00\x00\x00\xbdh \x00', 0x402}) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000180)={'vd\x7f\x00\x16\x00\xf9V\xdbZ\xdd\x91\x80\xd2{\x00', 0x43732e5398417f1e}) close(r0) 12:13:33 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) 12:13:33 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) ** 1 printk messages dropped ** [ 1034.295809] [] ? sel_write_load+0x119/0xf90 [ 1034.295818] [] sel_write_load+0x119/0xf90 [ 1034.295829] [] ? sel_read_bool+0x240/0x240 [ 1034.295841] [] ? trace_hardirqs_on+0x10/0x10 [ 1034.295854] [] __vfs_write+0x116/0x3d0 [ 1034.295862] [] ? sel_read_bool+0x240/0x240 [ 1034.295871] [] ? __vfs_read+0x3c0/0x3c0 [ 1034.295880] [] ? check_preemption_disabled+0x3c/0x200 [ 1034.295891] [] ? check_preemption_disabled+0x3c/0x200 [ 1034.295903] [] ? rcu_read_lock_sched_held+0x10b/0x130 [ 1034.295914] [] ? rcu_sync_lockdep_assert+0x73/0xb0 [ 1034.295925] [] ? __sb_start_write+0x14f/0x310 [ 1034.295932] [] vfs_write+0x182/0x4e0 [ 1034.295946] [] SyS_write+0xdc/0x1c0 [ 1034.295955] [] ? SyS_read+0x1c0/0x1c0 [ 1034.295968] [] ? lockdep_sys_exit_thunk+0x12/0x14 [ 1034.295982] [] entry_SYSCALL_64_fastpath+0x1e/0x9a [ 1034.295985] Mem-Info: [ 1034.296012] active_anon:70056 inactive_anon:5725 isolated_anon:0 [ 1034.296012] active_file:11182 inactive_file:11777 isolated_file:0 [ 1034.296012] unevictable:0 dirty:47 writeback:0 unstable:0 [ 1034.296012] slab_reclaimable:4381 slab_unreclaimable:63301 [ 1034.296012] mapped:58972 shmem:8152 pagetables:8515 bounce:0 [ 1034.296012] free:1407872 free_pcp:427 free_cma:0 [ 1034.296047] DMA32 free:2573424kB min:4696kB low:5868kB high:7044kB active_anon:127540kB inactive_anon:10352kB active_file:19752kB inactive_file:20788kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:3145324kB managed:3021976kB mlocked:0kB dirty:8kB writeback:0kB mapped:107916kB shmem:14292kB slab_reclaimable:8324kB slab_unreclaimable:117424kB kernel_stack:6304kB pagetables:15216kB unstable:0kB bounce:0kB free_pcp:1056kB local_pcp:376kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no [ 1034.296058] lowmem_reserve[]: 0 3504 3504 [ 1034.296096] Normal free:3058064kB min:5580kB low:6972kB high:8368kB active_anon:152684kB inactive_anon:12548kB active_file:24976kB inactive_file:26320kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:4718592kB managed:3588764kB mlocked:0kB dirty:180kB writeback:0kB mapped:127972kB shmem:18316kB slab_reclaimable:9200kB slab_unreclaimable:135780kB kernel_stack:7840kB pagetables:18844kB unstable:0kB bounce:0kB free_pcp:652kB local_pcp:216kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no [ 1034.296105] lowmem_reserve[]: 0 0 0 [ 1034.296166] DMA32: 112*4kB (ME) 122*8kB (UME) 272*16kB (UME) 180*32kB (UME) 73*64kB (UME) 25*128kB (UME) 11*256kB (UM) 5*512kB (M) 1*1024kB (E) 2*2048kB (UE) 621*4096kB (M) = 2573520kB [ 1034.296217] Normal: 944*4kB (UM) 440*8kB (UME) 305*16kB (UME) 191*32kB (UM) 96*64kB (UME) 32*128kB (UME) 10*256kB (UM) 8*512kB (UME) 4*1024kB (M) 4*2048kB (UME) 735*4096kB (M) = 3058032kB [ 1034.296219] 31110 total pagecache pages [ 1034.296223] 0 pages in swap cache 12:13:34 executing program 2: openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r0 = creat(&(0x7f0000000700)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x40000006100) ftruncate(r0, 0x208203) r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000008000/0x600000)=nil, 0x600000, 0x800002, 0x11, r1, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r2, &(0x7f0000000180)={0xa, 0x4e24, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) sendmmsg(r2, &(0x7f00000092c0), 0x4ff, 0x0) r3 = open(&(0x7f00000003c0)='./bus\x00', 0x0, 0x0) sendfile(r0, r3, 0x0, 0x8000fffffffe) r4 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r4, 0x1000008912, &(0x7f0000000000)="11dca5055e0acfec7be070") 12:13:34 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x6, 0x1100082) r1 = memfd_create(&(0x7f0000000080)='t\bnu\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00', 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000340)=[{&(0x7f0000001140)='\'', 0x1}], 0x1, 0x1081804) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendfile(r0, r0, 0x0, 0x200000d) ioctl$LOOP_CLR_FD(r0, 0x4c01) syz_genetlink_get_family_id$tipc(0x0) dup3(r1, r0, 0x0) 12:13:34 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) 12:13:34 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) 12:13:34 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) 12:13:34 executing program 0: openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)={'vet\x00\x00\x96T\x00\x00\x00\x00\x00\xbdh \x00', 0x402}) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000180)={'vd\x7f\x00\x16\x00\xf9V\xdbZ\xdd\x91\x80\xd2{\x00', 0x43732e5398417f1e}) close(r0) [ 1034.296228] Swap cache stats: add 0, delete 0, find 0/0 [ 1034.296231] Free swap = 0kB [ 1034.296233] Total swap = 0kB 12:13:34 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) [ 1034.296236] 1965979 pages RAM 12:13:34 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) 12:13:34 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) [ 1034.296238] 0 pages HighMem/MovableOnly 12:13:34 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) [ 1034.296240] 313294 pages reserved [ 1034.302268] binder: 14889:14893 transaction failed 29189/-22, size 0-0 line 3014 12:13:34 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) 12:13:34 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) [ 1034.302907] binder: undelivered TRANSACTION_ERROR: 29189 [ 1034.436579] binder: 14905:14910 transaction failed 29189/-22, size 0-0 line 3014 [ 1034.436752] binder: undelivered TRANSACTION_ERROR: 29189 [ 1034.440501] vmalloc: allocation failure: 0 bytes [ 1034.440507] syz-executor.4: page allocation failure: order:0, mode:0x24000c2 [ 1034.440517] CPU: 1 PID: 14909 Comm: syz-executor.4 Not tainted 4.4.174+ #4 [ 1034.440532] 0000000000000000 d5fcbd8ce656fea9 ffff8801d8f479f0 ffffffff81aad1a1 [ 1034.440543] 1ffff1003b1e8f41 ffff8800a4b58000 00000000024000c2 0000000000000000 [ 1034.440552] ffffffff82895080 ffff8801d8f47b00 ffffffff8148c0cb ffffffff00000001 [ 1034.440555] Call Trace: [ 1034.440568] [] dump_stack+0xc1/0x120 [ 1034.440581] [] warn_alloc_failed.cold+0x78/0x99 [ 1034.440601] [] ? zone_watermark_ok_safe+0x290/0x290 [ 1034.440611] [] ? sel_write_load+0x9e/0xf90 [ 1034.440622] [] __vmalloc_node_range+0x365/0x650 [ 1034.440633] [] ? check_preemption_disabled+0x3c/0x200 [ 1034.440641] [] ? check_preemption_disabled+0x3c/0x200 [ 1034.440650] [] ? task_has_security+0x130/0x270 [ 1034.440658] [] vmalloc+0x5c/0x70 [ 1034.440668] [] ? sel_write_load+0x119/0xf90 [ 1034.440676] [] sel_write_load+0x119/0xf90 [ 1034.440683] [] ? sel_read_bool+0x240/0x240 [ 1034.440693] [] ? trace_hardirqs_on+0x10/0x10 [ 1034.440701] [] __vfs_write+0x116/0x3d0 [ 1034.440708] [] ? sel_read_bool+0x240/0x240 [ 1034.440716] [] ? __vfs_read+0x3c0/0x3c0 [ 1034.440724] [] ? check_preemption_disabled+0x3c/0x200 [ 1034.440732] [] ? check_preemption_disabled+0x3c/0x200 [ 1034.440740] [] ? rcu_read_lock_sched_held+0x10b/0x130 [ 1034.440747] [] ? rcu_sync_lockdep_assert+0x73/0xb0 [ 1034.440755] [] ? __sb_start_write+0x14f/0x310 [ 1034.440761] [] vfs_write+0x182/0x4e0 [ 1034.440768] [] SyS_write+0xdc/0x1c0 [ 1034.440779] [] ? SyS_read+0x1c0/0x1c0 [ 1034.440792] [] ? lockdep_sys_exit_thunk+0x12/0x14 [ 1034.440805] [] entry_SYSCALL_64_fastpath+0x1e/0x9a [ 1034.441057] Mem-Info: [ 1034.441085] active_anon:70106 inactive_anon:5875 isolated_anon:0 [ 1034.441085] active_file:11182 inactive_file:11777 isolated_file:0 [ 1034.441085] unevictable:0 dirty:47 writeback:0 unstable:0 [ 1034.441085] slab_reclaimable:4381 slab_unreclaimable:63301 [ 1034.441085] mapped:58972 shmem:8374 pagetables:8478 bounce:0 [ 1034.441085] free:1407631 free_pcp:427 free_cma:0 [ 1034.441124] DMA32 free:2572804kB min:4696kB low:5868kB high:7044kB active_anon:127540kB inactive_anon:10952kB active_file:19752kB inactive_file:20788kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:3145324kB managed:3021976kB mlocked:0kB dirty:8kB writeback:0kB mapped:107916kB shmem:15032kB slab_reclaimable:8324kB slab_unreclaimable:117424kB kernel_stack:6304kB pagetables:15216kB unstable:0kB bounce:0kB free_pcp:628kB local_pcp:460kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no [ 1034.441133] lowmem_reserve[]: 0 3504 3504 [ 1034.441164] Normal free:3057720kB min:5580kB low:6972kB high:8368kB active_anon:152884kB inactive_anon:12548kB active_file:24976kB inactive_file:26320kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:4718592kB managed:3588764kB mlocked:0kB dirty:180kB writeback:0kB mapped:127972kB shmem:18464kB slab_reclaimable:9200kB slab_unreclaimable:135780kB kernel_stack:7840kB pagetables:18696kB unstable:0kB bounce:0kB free_pcp:1080kB local_pcp:472kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no [ 1034.441173] lowmem_reserve[]: 0 0 0 [ 1034.441234] DMA32: 29*4kB (ME) 116*8kB (UME) 271*16kB (UME) 176*32kB (UME) 73*64kB (UME) 24*128kB (UME) 11*256kB (UM) 5*512kB (M) 1*1024kB (E) 2*2048kB (UE) 621*4096kB (M) = 2572868kB [ 1034.441289] Normal: 837*4kB (UM) 447*8kB (UME) 305*16kB (UME) 191*32kB (UM) 96*64kB (UME) 32*128kB (UME) 10*256kB (UM) 8*512kB (UME) 4*1024kB (M) 4*2048kB (UME) 735*4096kB (M) = 3057660kB [ 1034.441292] 31332 total pagecache pages [ 1034.441296] 0 pages in swap cache [ 1034.441301] Swap cache stats: add 0, delete 0, find 0/0 [ 1034.441303] Free swap = 0kB [ 1034.441306] Total swap = 0kB [ 1034.441309] 1965979 pages RAM [ 1034.441312] 0 pages HighMem/MovableOnly [ 1034.441314] 313294 pages reserved [ 1034.501853] binder: 14918:14920 transaction failed 29189/-22, size 0-0 line 3014 [ 1034.502020] binder: undelivered TRANSACTION_ERROR: 29189 [ 1034.538806] vmalloc: allocation failure: 0 bytes [ 1034.538812] syz-executor.4: page allocation failure: order:0, mode:0x24000c2 [ 1034.538822] CPU: 1 PID: 14922 Comm: syz-executor.4 Not tainted 4.4.174+ #4 12:13:34 executing program 2: openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r0 = creat(&(0x7f0000000700)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x40000006100) ftruncate(r0, 0x208203) r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000008000/0x600000)=nil, 0x600000, 0x800002, 0x11, r1, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r2, &(0x7f0000000180)={0xa, 0x4e24, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) sendmmsg(r2, &(0x7f00000092c0), 0x4ff, 0x0) r3 = open(&(0x7f00000003c0)='./bus\x00', 0x0, 0x0) sendfile(r0, r3, 0x0, 0x8000fffffffe) r4 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r4, 0x1000008912, &(0x7f0000000000)="11dca5055e0acfec7be070") 12:13:34 executing program 0: openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)={'vet\x00\x00\x96T\x00\x00\x00\x00\x00\xbdh \x00', 0x402}) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000180)={'vd\x7f\x00\x16\x00\xf9V\xdbZ\xdd\x91\x80\xd2{\x00', 0x43732e5398417f1e}) close(r0) 12:13:34 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x6, 0x1100082) r1 = memfd_create(&(0x7f0000000080)='t\bnu\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00', 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000340)=[{&(0x7f0000001140)='\'', 0x1}], 0x1, 0x1081804) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendfile(r0, r0, 0x0, 0x200000d) ioctl$LOOP_CLR_FD(r0, 0x4c01) syz_genetlink_get_family_id$tipc(0x0) dup3(r1, r0, 0x0) 12:13:34 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) 12:13:34 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) 12:13:34 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) 12:13:35 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) [ 1034.538843] 0000000000000000 71a994870adf8d85 ffff8801d524f9f0 ffffffff81aad1a1 [ 1034.538852] 1ffff1003aa49f41 ffff8801bddcdf00 00000000024000c2 0000000000000000 [ 1034.538863] ffffffff82895080 ffff8801d524fb00 ffffffff8148c0cb ffffffff00000001 12:13:35 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) 12:13:35 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) [ 1034.538866] Call Trace: [ 1034.538880] [] dump_stack+0xc1/0x120 12:13:35 executing program 0: openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)={'vet\x00\x00\x96T\x00\x00\x00\x00\x00\xbdh \x00', 0x402}) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000180)={'vd\x7f\x00\x16\x00\xf9V\xdbZ\xdd\x91\x80\xd2{\x00', 0x43732e5398417f1e}) close(r0) 12:13:35 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) [ 1034.538894] [] warn_alloc_failed.cold+0x78/0x99 12:13:35 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x6, 0x1100082) r1 = memfd_create(&(0x7f0000000080)='t\bnu\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00', 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000340)=[{&(0x7f0000001140)='\'', 0x1}], 0x1, 0x1081804) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendfile(r0, r0, 0x0, 0x200000d) ioctl$LOOP_CLR_FD(r0, 0x4c01) syz_genetlink_get_family_id$tipc(0x0) dup3(r1, r0, 0x0) [ 1034.538906] [] ? zone_watermark_ok_safe+0x290/0x290 [ 1034.538915] [] ? sel_write_load+0x9e/0xf90 [ 1034.538924] [] __vmalloc_node_range+0x365/0x650 [ 1034.538933] [] ? check_preemption_disabled+0x3c/0x200 [ 1034.538944] [] ? check_preemption_disabled+0x3c/0x200 [ 1034.538954] [] ? task_has_security+0x130/0x270 [ 1034.538962] [] vmalloc+0x5c/0x70 [ 1034.538972] [] ? sel_write_load+0x119/0xf90 [ 1034.538980] [] sel_write_load+0x119/0xf90 [ 1034.538990] [] ? sel_read_bool+0x240/0x240 [ 1034.539001] [] ? trace_hardirqs_on+0x10/0x10 [ 1034.539009] [] __vfs_write+0x116/0x3d0 [ 1034.539016] [] ? sel_read_bool+0x240/0x240 [ 1034.539024] [] ? __vfs_read+0x3c0/0x3c0 [ 1034.539032] [] ? check_preemption_disabled+0x3c/0x200 [ 1034.539040] [] ? check_preemption_disabled+0x3c/0x200 [ 1034.539049] [] ? rcu_read_lock_sched_held+0x10b/0x130 [ 1034.539057] [] ? rcu_sync_lockdep_assert+0x73/0xb0 [ 1034.539065] [] ? __sb_start_write+0x14f/0x310 [ 1034.539073] [] vfs_write+0x182/0x4e0 [ 1034.539081] [] SyS_write+0xdc/0x1c0 [ 1034.539089] [] ? SyS_read+0x1c0/0x1c0 [ 1034.539099] [] ? lockdep_sys_exit_thunk+0x12/0x14 [ 1034.539109] [] entry_SYSCALL_64_fastpath+0x1e/0x9a [ 1034.542237] Mem-Info: [ 1034.542265] active_anon:70106 inactive_anon:6200 isolated_anon:0 [ 1034.542265] active_file:11182 inactive_file:11777 isolated_file:0 [ 1034.542265] unevictable:0 dirty:47 writeback:0 unstable:0 [ 1034.542265] slab_reclaimable:4381 slab_unreclaimable:63301 [ 1034.542265] mapped:59009 shmem:8633 pagetables:8552 bounce:0 [ 1034.542265] free:1407425 free_pcp:337 free_cma:0 [ 1034.542300] DMA32 free:2572284kB min:4696kB low:5868kB high:7044kB active_anon:127740kB inactive_anon:11352kB active_file:19752kB inactive_file:20788kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:3145324kB managed:3021976kB mlocked:0kB dirty:8kB writeback:0kB mapped:107916kB shmem:15328kB slab_reclaimable:8324kB slab_unreclaimable:117424kB kernel_stack:6304kB pagetables:15364kB unstable:0kB bounce:0kB free_pcp:500kB local_pcp:324kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no [ 1034.542311] lowmem_reserve[]: 0 3504 3504 [ 1034.542345] Normal free:3057416kB min:5580kB low:6972kB high:8368kB active_anon:152684kB inactive_anon:13448kB active_file:24976kB inactive_file:26320kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:4718592kB managed:3588764kB mlocked:0kB dirty:180kB writeback:0kB mapped:128120kB shmem:19204kB slab_reclaimable:9200kB slab_unreclaimable:135780kB kernel_stack:7840kB pagetables:18844kB unstable:0kB bounce:0kB free_pcp:848kB local_pcp:632kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no [ 1034.542354] lowmem_reserve[]: 0 0 0 [ 1034.542408] DMA32: 3*4kB (UME) 52*8kB (UME) 264*16kB (UME) 176*32kB (UME) 73*64kB (UME) 25*128kB (UME) 11*256kB (UM) 5*512kB (M) 1*1024kB (E) 2*2048kB (UE) 621*4096kB (M) = 2572268kB [ 1034.542477] Normal: 770*4kB (UM) 434*8kB (UME) 305*16kB (UME) 196*32kB (UM) 96*64kB (UME) 32*128kB (UME) 10*256kB (UM) 8*512kB (UME) 4*1024kB (M) 4*2048kB (UME) 735*4096kB (M) = 3057448kB [ 1034.542480] 31591 total pagecache pages [ 1034.542484] 0 pages in swap cache [ 1034.542490] Swap cache stats: add 0, delete 0, find 0/0 [ 1034.542493] Free swap = 0kB [ 1034.542495] Total swap = 0kB [ 1034.542498] 1965979 pages RAM [ 1034.542501] 0 pages HighMem/MovableOnly [ 1034.542503] 313294 pages reserved [ 1035.193568] vmalloc: allocation failure: 0 bytes 12:13:35 executing program 2: openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r0 = creat(&(0x7f0000000700)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x40000006100) ftruncate(r0, 0x208203) r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000008000/0x600000)=nil, 0x600000, 0x800002, 0x11, r1, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r2, &(0x7f0000000180)={0xa, 0x4e24, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) sendmmsg(r2, &(0x7f00000092c0), 0x4ff, 0x0) r3 = open(&(0x7f00000003c0)='./bus\x00', 0x0, 0x0) sendfile(r0, r3, 0x0, 0x8000fffffffe) r4 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r4, 0x1000008912, &(0x7f0000000000)="11dca5055e0acfec7be070") 12:13:35 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) 12:13:35 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) 12:13:35 executing program 0: openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)={'vet\x00\x00\x96T\x00\x00\x00\x00\x00\xbdh \x00', 0x402}) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000180)={'vd\x7f\x00\x16\x00\xf9V\xdbZ\xdd\x91\x80\xd2{\x00', 0x43732e5398417f1e}) close(r0) 12:13:35 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) 12:13:35 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x6, 0x1100082) r1 = memfd_create(&(0x7f0000000080)='t\bnu\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00', 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000340)=[{&(0x7f0000001140)='\'', 0x1}], 0x1, 0x1081804) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendfile(r0, r0, 0x0, 0x200000d) ioctl$LOOP_CLR_FD(r0, 0x4c01) syz_genetlink_get_family_id$tipc(0x0) dup3(r1, r0, 0x0) 12:13:35 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) [ 1035.193574] syz-executor.4: page allocation failure: order:0, mode:0x24000c2 [ 1035.193584] CPU: 1 PID: 14937 Comm: syz-executor.4 Not tainted 4.4.174+ #4 [ 1035.193597] 0000000000000000 9319fe18dd0c1ccb ffff8801d10af9f0 ffffffff81aad1a1 12:13:35 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) 12:13:35 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) [ 1035.193608] 1ffff1003a215f41 ffff8800a48d0000 00000000024000c2 0000000000000000 12:13:35 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) 12:13:35 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x6, 0x1100082) r1 = memfd_create(&(0x7f0000000080)='t\bnu\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00', 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000340)=[{&(0x7f0000001140)='\'', 0x1}], 0x1, 0x1081804) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendfile(r0, r0, 0x0, 0x200000d) ioctl$LOOP_CLR_FD(r0, 0x4c01) syz_genetlink_get_family_id$tipc(0x0) dup3(r1, r0, 0x0) 12:13:35 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) [ 1035.193619] ffffffff82895080 ffff8801d10afb00 ffffffff8148c0cb ffffffff00000001 ** 25 printk messages dropped ** [ 1035.193858] [] ? lockdep_sys_exit_thunk+0x12/0x14 [ 1035.193868] [] entry_SYSCALL_64_fastpath+0x1e/0x9a [ 1035.193871] Mem-Info: [ 1035.193893] active_anon:70031 inactive_anon:5725 isolated_anon:0 [ 1035.193893] active_file:11182 inactive_file:11777 isolated_file:0 [ 1035.193893] unevictable:0 dirty:47 writeback:0 unstable:0 [ 1035.193893] slab_reclaimable:4381 slab_unreclaimable:63323 [ 1035.193893] mapped:58972 shmem:8152 pagetables:8515 bounce:0 [ 1035.193893] free:1407774 free_pcp:559 free_cma:0 [ 1035.193933] DMA32 free:2573060kB min:4696kB low:5868kB high:7044kB active_anon:127540kB inactive_anon:10252kB active_file:19752kB inactive_file:20788kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:3145324kB managed:3021976kB mlocked:0kB dirty:8kB writeback:0kB mapped:107916kB shmem:14292kB slab_reclaimable:8324kB slab_unreclaimable:117212kB kernel_stack:6304kB pagetables:15512kB unstable:0kB bounce:0kB free_pcp:1188kB local_pcp:492kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no [ 1035.193941] lowmem_reserve[]: 0 3504 3504 [ 1035.193974] Normal free:3058036kB min:5580kB low:6972kB high:8368kB active_anon:152584kB inactive_anon:12648kB active_file:24976kB inactive_file:26320kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:4718592kB managed:3588764kB mlocked:0kB dirty:180kB writeback:0kB mapped:127972kB shmem:18316kB slab_reclaimable:9200kB slab_unreclaimable:136080kB kernel_stack:7840kB pagetables:18548kB unstable:0kB bounce:0kB free_pcp:1048kB local_pcp:432kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no [ 1035.193982] lowmem_reserve[]: 0 0 0 [ 1035.194039] DMA32: 127*4kB (UME) 81*8kB (UME) 264*16kB (UME) 179*32kB (UME) 73*64kB (UME) 25*128kB (UME) 11*256kB (UM) 5*512kB (M) 1*1024kB (E) 2*2048kB (UE) 621*4096kB (M) = 2573092kB [ 1035.194091] Normal: 845*4kB (UM) 468*8kB (UME) 306*16kB (UME) 196*32kB (UM) 96*64kB (UME) 32*128kB (UME) 10*256kB (UM) 8*512kB (UME) 4*1024kB (M) 4*2048kB (UME) 735*4096kB (M) = 3058036kB [ 1035.194100] 31110 total pagecache pages [ 1035.194842] binder: 14932:14938 transaction failed 29189/-22, size 0-0 line 3014 [ 1035.195006] binder: undelivered TRANSACTION_ERROR: 29189 [ 1035.195313] 0 pages in swap cache [ 1035.195325] Swap cache stats: add 0, delete 0, find 0/0 [ 1035.195408] Free swap = 0kB [ 1035.195411] Total swap = 0kB [ 1035.195415] 1965979 pages RAM [ 1035.195417] 0 pages HighMem/MovableOnly [ 1035.195420] 313294 pages reserved [ 1035.330856] binder: 14952:14955 transaction failed 29189/-22, size 0-0 line 3014 [ 1035.331019] binder: undelivered TRANSACTION_ERROR: 29189 [ 1035.366197] vmalloc: allocation failure: 0 bytes [ 1035.366204] syz-executor.4: page allocation failure: order:0, mode:0x24000c2 [ 1035.366214] CPU: 0 PID: 14957 Comm: syz-executor.4 Not tainted 4.4.174+ #4 [ 1035.366229] 0000000000000000 131f113ed2b4cad8 ffff8800b7ad79f0 ffffffff81aad1a1 [ 1035.366241] 1ffff10016f5af41 ffff8800a478af80 00000000024000c2 0000000000000000 [ 1035.366252] ffffffff82895080 ffff8800b7ad7b00 ffffffff8148c0cb ffffffff00000001 [ 1035.366256] Call Trace: [ 1035.366272] [] dump_stack+0xc1/0x120 [ 1035.366288] [] warn_alloc_failed.cold+0x78/0x99 [ 1035.366300] [] ? zone_watermark_ok_safe+0x290/0x290 [ 1035.366311] [] ? sel_write_load+0x9e/0xf90 [ 1035.366323] [] __vmalloc_node_range+0x365/0x650 [ 1035.366334] [] ? check_preemption_disabled+0x3c/0x200 [ 1035.366343] [] ? check_preemption_disabled+0x3c/0x200 [ 1035.366351] [] ? task_has_security+0x130/0x270 [ 1035.366359] [] vmalloc+0x5c/0x70 [ 1035.366367] [] ? sel_write_load+0x119/0xf90 [ 1035.366375] [] sel_write_load+0x119/0xf90 [ 1035.366386] [] ? sel_read_bool+0x240/0x240 [ 1035.366399] [] ? trace_hardirqs_on+0x10/0x10 [ 1035.366411] [] __vfs_write+0x116/0x3d0 12:13:36 executing program 2: openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r0 = creat(&(0x7f0000000700)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x40000006100) ftruncate(r0, 0x208203) r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000008000/0x600000)=nil, 0x600000, 0x800002, 0x11, r1, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r2, &(0x7f0000000180)={0xa, 0x4e24, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) sendmmsg(r2, &(0x7f00000092c0), 0x4ff, 0x0) r3 = open(&(0x7f00000003c0)='./bus\x00', 0x0, 0x0) sendfile(r0, r3, 0x0, 0x8000fffffffe) r4 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r4, 0x1000008912, &(0x7f0000000000)="11dca5055e0acfec7be070") 12:13:36 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) 12:13:36 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) 12:13:36 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) 12:13:36 executing program 0: openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)={'vet\x00\x00\x96T\x00\x00\x00\x00\x00\xbdh \x00', 0x402}) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000180)={'vd\x7f\x00\x16\x00\xf9V\xdbZ\xdd\x91\x80\xd2{\x00', 0x43732e5398417f1e}) close(r0) 12:13:36 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x6, 0x1100082) r1 = memfd_create(&(0x7f0000000080)='t\bnu\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00', 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000340)=[{&(0x7f0000001140)='\'', 0x1}], 0x1, 0x1081804) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendfile(r0, r0, 0x0, 0x200000d) ioctl$LOOP_CLR_FD(r0, 0x4c01) syz_genetlink_get_family_id$tipc(0x0) dup3(r1, r0, 0x0) [ 1035.366419] [] ? sel_read_bool+0x240/0x240 [ 1035.366429] [] ? __vfs_read+0x3c0/0x3c0 [ 1035.366439] [] ? check_preemption_disabled+0x3c/0x200 [ 1035.366449] [] ? check_preemption_disabled+0x3c/0x200 12:13:36 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) 12:13:36 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) 12:13:36 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) [ 1035.366461] [] ? rcu_read_lock_sched_held+0x10b/0x130 ** 2 printk messages dropped ** [ 1035.366493] [] vfs_write+0x182/0x4e0 [ 1035.366503] [] SyS_write+0xdc/0x1c0 12:13:36 executing program 0: openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)={'vet\x00\x00\x96T\x00\x00\x00\x00\x00\xbdh \x00', 0x402}) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000180)={'vd\x7f\x00\x16\x00\xf9V\xdbZ\xdd\x91\x80\xd2{\x00', 0x43732e5398417f1e}) close(r0) [ 1035.366512] [] ? SyS_read+0x1c0/0x1c0 12:13:36 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) 12:13:36 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) [ 1035.366525] [] ? lockdep_sys_exit_thunk+0x12/0x14 ** 46 printk messages dropped ** [ 1036.123688] [] ? rcu_sync_lockdep_assert+0x73/0xb0 [ 1036.123697] [] ? __sb_start_write+0x14f/0x310 ** 48 printk messages dropped ** [ 1036.244328] [] ? check_preemption_disabled+0x3c/0x200 [ 1036.244335] [] ? check_preemption_disabled+0x3c/0x200 [ 1036.244344] [] ? rcu_read_lock_sched_held+0x10b/0x130 [ 1036.244352] [] ? rcu_sync_lockdep_assert+0x73/0xb0 [ 1036.244360] [] ? __sb_start_write+0x14f/0x310 [ 1036.244367] [] vfs_write+0x182/0x4e0 [ 1036.244375] [] SyS_write+0xdc/0x1c0 [ 1036.244382] [] ? SyS_read+0x1c0/0x1c0 [ 1036.244392] [] ? lockdep_sys_exit_thunk+0x12/0x14 [ 1036.244402] [] entry_SYSCALL_64_fastpath+0x1e/0x9a [ 1036.244405] Mem-Info: [ 1036.244429] active_anon:70127 inactive_anon:5870 isolated_anon:0 [ 1036.244429] active_file:11182 inactive_file:11777 isolated_file:0 [ 1036.244429] unevictable:0 dirty:47 writeback:0 unstable:0 [ 1036.244429] slab_reclaimable:4381 slab_unreclaimable:63407 [ 1036.244429] mapped:59005 shmem:8374 pagetables:8554 bounce:0 [ 1036.244429] free:1407547 free_pcp:218 free_cma:0 [ 1036.244473] DMA32 free:2573504kB min:4696kB low:5868kB high:7044kB active_anon:127768kB inactive_anon:10272kB active_file:19752kB inactive_file:20788kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:3145324kB managed:3021976kB mlocked:0kB dirty:8kB writeback:0kB mapped:107900kB shmem:14388kB slab_reclaimable:8324kB slab_unreclaimable:116664kB kernel_stack:6592kB pagetables:15544kB unstable:0kB bounce:0kB free_pcp:544kB local_pcp:68kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no [ 1036.244483] lowmem_reserve[]: 0 3504 3504 [ 1036.244514] Normal free:3056684kB min:5580kB low:6972kB high:8368kB active_anon:152740kB inactive_anon:13208kB active_file:24976kB inactive_file:26320kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:4718592kB managed:3588764kB mlocked:0kB dirty:180kB writeback:0kB mapped:128120kB shmem:19108kB slab_reclaimable:9200kB slab_unreclaimable:136964kB kernel_stack:7904kB pagetables:18672kB unstable:0kB bounce:0kB free_pcp:328kB local_pcp:240kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no 12:13:37 executing program 2: openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r0 = creat(&(0x7f0000000700)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x40000006100) ftruncate(r0, 0x208203) r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000008000/0x600000)=nil, 0x600000, 0x800002, 0x11, r1, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r2, &(0x7f0000000180)={0xa, 0x4e24, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) sendmmsg(r2, &(0x7f00000092c0), 0x4ff, 0x0) r3 = open(&(0x7f00000003c0)='./bus\x00', 0x0, 0x0) sendfile(r0, r3, 0x0, 0x8000fffffffe) r4 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r4, 0x1000008912, &(0x7f0000000000)="11dca5055e0acfec7be070") 12:13:37 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x6, 0x1100082) r1 = memfd_create(&(0x7f0000000080)='t\bnu\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00', 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000340)=[{&(0x7f0000001140)='\'', 0x1}], 0x1, 0x1081804) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendfile(r0, r0, 0x0, 0x200000d) ioctl$LOOP_CLR_FD(r0, 0x4c01) syz_genetlink_get_family_id$tipc(0x0) dup3(r1, r0, 0x0) 12:13:37 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) 12:13:37 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) 12:13:37 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) 12:13:37 executing program 0: openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)={'vet\x00\x00\x96T\x00\x00\x00\x00\x00\xbdh \x00', 0x402}) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000180)={'vd\x7f\x00\x16\x00\xf9V\xdbZ\xdd\x91\x80\xd2{\x00', 0x43732e5398417f1e}) close(r0) [ 1036.244523] lowmem_reserve[]: 0 0 0 [ 1036.244579] DMA32: 316*4kB (UME) 94*8kB (UME) 269*16kB (UME) 164*32kB (UME) 73*64kB (UME) 25*128kB (UME) 11*256kB (UM) 5*512kB (M) 1*1024kB (E) 2*2048kB (UE) 621*4096kB (M) = 2573552kB [ 1036.244631] Normal: 653*4kB (UM) 425*8kB (UME) 305*16kB (UME) 193*32kB (UM) 96*64kB (UME) 31*128kB (UME) 10*256kB (UM) 8*512kB (UME) 4*1024kB (M) 4*2048kB (UME) 735*4096kB (M) = 3056684kB 12:13:37 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) 12:13:37 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) 12:13:37 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) [ 1036.244634] 31332 total pagecache pages [ 1036.244638] 0 pages in swap cache ** 31 printk messages dropped ** [ 1036.333166] [] ? rcu_read_lock_sched_held+0x10b/0x130 12:13:37 executing program 0: openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)={'vet\x00\x00\x96T\x00\x00\x00\x00\x00\xbdh \x00', 0x402}) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000180)={'vd\x7f\x00\x16\x00\xf9V\xdbZ\xdd\x91\x80\xd2{\x00', 0x43732e5398417f1e}) close(r0) [ 1036.333174] [] ? rcu_sync_lockdep_assert+0x73/0xb0 12:13:37 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) 12:13:37 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x6, 0x1100082) r1 = memfd_create(&(0x7f0000000080)='t\bnu\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00', 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000340)=[{&(0x7f0000001140)='\'', 0x1}], 0x1, 0x1081804) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendfile(r0, r0, 0x0, 0x200000d) ioctl$LOOP_CLR_FD(r0, 0x4c01) syz_genetlink_get_family_id$tipc(0x0) dup3(r1, r0, 0x0) ** 47 printk messages dropped ** [ 1039.024795] [] warn_alloc_failed.cold+0x78/0x99 ** 50 printk messages dropped ** [ 1039.142569] [] warn_alloc_failed.cold+0x78/0x99 [ 1039.142581] [] ? zone_watermark_ok_safe+0x290/0x290 [ 1039.142591] [] ? sel_write_load+0x9e/0xf90 [ 1039.142602] [] __vmalloc_node_range+0x365/0x650 [ 1039.142613] [] ? check_preemption_disabled+0x3c/0x200 [ 1039.142621] [] ? check_preemption_disabled+0x3c/0x200 [ 1039.142632] [] ? task_has_security+0x130/0x270 [ 1039.142640] [] vmalloc+0x5c/0x70 [ 1039.142649] [] ? sel_write_load+0x119/0xf90 [ 1039.142656] [] sel_write_load+0x119/0xf90 [ 1039.142664] [] ? sel_read_bool+0x240/0x240 [ 1039.142675] [] ? trace_hardirqs_on+0x10/0x10 [ 1039.142685] [] __vfs_write+0x116/0x3d0 [ 1039.142696] [] ? sel_read_bool+0x240/0x240 [ 1039.142707] [] ? __vfs_read+0x3c0/0x3c0 [ 1039.142716] [] ? check_preemption_disabled+0x3c/0x200 [ 1039.142728] [] ? check_preemption_disabled+0x3c/0x200 [ 1039.142740] [] ? rcu_read_lock_sched_held+0x10b/0x130 [ 1039.142749] [] ? rcu_sync_lockdep_assert+0x73/0xb0 [ 1039.142760] [] ? __sb_start_write+0x14f/0x310 [ 1039.142769] [] vfs_write+0x182/0x4e0 [ 1039.142778] [] SyS_write+0xdc/0x1c0 [ 1039.142785] [] ? SyS_read+0x1c0/0x1c0 [ 1039.142794] [] ? lockdep_sys_exit_thunk+0x12/0x14 [ 1039.142803] [] entry_SYSCALL_64_fastpath+0x1e/0x9a [ 1039.142806] Mem-Info: [ 1039.142834] active_anon:70087 inactive_anon:6089 isolated_anon:0 [ 1039.142834] active_file:11182 inactive_file:11777 isolated_file:0 [ 1039.142834] unevictable:0 dirty:47 writeback:0 unstable:0 [ 1039.142834] slab_reclaimable:4381 slab_unreclaimable:62911 [ 1039.142834] mapped:58956 shmem:8565 pagetables:8578 bounce:0 [ 1039.142834] free:1407698 free_pcp:456 free_cma:0 [ 1039.142870] DMA32 free:2574364kB min:4696kB low:5868kB high:7044kB active_anon:127656kB inactive_anon:11424kB active_file:19752kB inactive_file:20788kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:3145324kB managed:3021976kB mlocked:0kB dirty:8kB writeback:0kB mapped:107908kB shmem:15504kB slab_reclaimable:8324kB slab_unreclaimable:115120kB kernel_stack:6560kB pagetables:15360kB unstable:0kB bounce:0kB free_pcp:664kB local_pcp:232kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no [ 1039.142880] lowmem_reserve[]: 0 3504 3504 [ 1039.142909] Normal free:3056428kB min:5580kB low:6972kB high:8368kB active_anon:152692kB inactive_anon:12932kB active_file:24976kB inactive_file:26320kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:4718592kB managed:3588764kB mlocked:0kB dirty:180kB writeback:0kB mapped:127916kB shmem:18756kB slab_reclaimable:9200kB slab_unreclaimable:136524kB kernel_stack:8128kB pagetables:18952kB unstable:0kB bounce:0kB free_pcp:1160kB local_pcp:528kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no [ 1039.142918] lowmem_reserve[]: 0 0 0 [ 1039.142977] DMA32: 218*4kB (UME) 131*8kB (UME) 270*16kB (UME) 191*32kB (UME) 73*64kB (UME) 25*128kB (UME) 11*256kB (UM) 5*512kB (M) 1*1024kB (E) 2*2048kB (UE) 621*4096kB (M) = 2574336kB [ 1039.143024] Normal: 521*4kB (UM) 439*8kB (UME) 310*16kB (UME) 188*32kB (UM) 99*64kB (UME) 32*128kB (UME) 10*256kB (UM) 8*512kB (UME) 4*1024kB (M) 4*2048kB (UME) 735*4096kB (M) = 3056508kB [ 1039.143027] 31523 total pagecache pages [ 1039.143030] 0 pages in swap cache [ 1039.143035] Swap cache stats: add 0, delete 0, find 0/0 [ 1039.143037] Free swap = 0kB [ 1039.143039] Total swap = 0kB [ 1039.143042] 1965979 pages RAM [ 1039.143046] 0 pages HighMem/MovableOnly [ 1039.143049] 313294 pages reserved [ 1039.206081] vmalloc: allocation failure: 0 bytes [ 1039.206087] syz-executor.4: page allocation failure: order:0, mode:0x24000c2 [ 1039.206098] CPU: 0 PID: 15162 Comm: syz-executor.4 Not tainted 4.4.174+ #4 [ 1039.206113] 0000000000000000 6e9c6365ae36cf72 ffff8800b55979f0 ffffffff81aad1a1 [ 1039.206123] 1ffff10016ab2f41 ffff8801d76e5f00 00000000024000c2 0000000000000000 [ 1039.206133] ffffffff82895080 ffff8800b5597b00 ffffffff8148c0cb ffffffff00000001 [ 1039.206135] Call Trace: [ 1039.206150] [] dump_stack+0xc1/0x120 [ 1039.206166] [] warn_alloc_failed.cold+0x78/0x99 [ 1039.206179] [] ? zone_watermark_ok_safe+0x290/0x290 [ 1039.206189] [] ? sel_write_load+0x9e/0xf90 [ 1039.206201] [] __vmalloc_node_range+0x365/0x650 [ 1039.206212] [] ? check_preemption_disabled+0x3c/0x200 12:13:38 executing program 2: openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r0 = creat(&(0x7f0000000700)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x40000006100) ftruncate(r0, 0x208203) r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000008000/0x600000)=nil, 0x600000, 0x800002, 0x11, r1, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r2, &(0x7f0000000180)={0xa, 0x4e24, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) sendmmsg(r2, &(0x7f00000092c0), 0x4ff, 0x0) r3 = open(&(0x7f00000003c0)='./bus\x00', 0x0, 0x0) sendfile(r0, r3, 0x0, 0x8000fffffffe) r4 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r4, 0x1000008912, &(0x7f0000000000)="11dca5055e0acfec7be070") 12:13:38 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) 12:13:38 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) 12:13:38 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x6, 0x1100082) r1 = memfd_create(&(0x7f0000000080)='t\bnu\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00', 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000340)=[{&(0x7f0000001140)='\'', 0x1}], 0x1, 0x1081804) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendfile(r0, r0, 0x0, 0x200000d) ioctl$LOOP_CLR_FD(r0, 0x4c01) syz_genetlink_get_family_id$tipc(0x0) dup3(r1, r0, 0x0) 12:13:38 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) 12:13:38 executing program 0: openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)={'vet\x00\x00\x96T\x00\x00\x00\x00\x00\xbdh \x00', 0x402}) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000180)={'vd\x7f\x00\x16\x00\xf9V\xdbZ\xdd\x91\x80\xd2{\x00', 0x43732e5398417f1e}) close(r0) 12:13:38 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) [ 1039.206220] [] ? check_preemption_disabled+0x3c/0x200 [ 1039.206227] [] ? task_has_security+0x130/0x270 [ 1039.206236] [] vmalloc+0x5c/0x70 12:13:38 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) 12:13:38 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) [ 1039.206247] [] ? sel_write_load+0x119/0xf90 [ 1039.206255] [] sel_write_load+0x119/0xf90 12:13:38 executing program 0: openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)={'vet\x00\x00\x96T\x00\x00\x00\x00\x00\xbdh \x00', 0x402}) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000180)={'vd\x7f\x00\x16\x00\xf9V\xdbZ\xdd\x91\x80\xd2{\x00', 0x43732e5398417f1e}) close(r0) 12:13:38 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x6, 0x1100082) r1 = memfd_create(&(0x7f0000000080)='t\bnu\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00', 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000340)=[{&(0x7f0000001140)='\'', 0x1}], 0x1, 0x1081804) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendfile(r0, r0, 0x0, 0x200000d) ioctl$LOOP_CLR_FD(r0, 0x4c01) syz_genetlink_get_family_id$tipc(0x0) dup3(r1, r0, 0x0) 12:13:38 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) [ 1039.206266] [] ? sel_read_bool+0x240/0x240 [ 1039.206279] [] ? trace_hardirqs_on+0x10/0x10 [ 1039.206290] [] __vfs_write+0x116/0x3d0 [ 1039.206299] [] ? sel_read_bool+0x240/0x240 [ 1039.206309] [] ? __vfs_read+0x3c0/0x3c0 [ 1039.206318] [] ? check_preemption_disabled+0x3c/0x200 [ 1039.206327] [] ? check_preemption_disabled+0x3c/0x200 [ 1039.206338] [] ? rcu_read_lock_sched_held+0x10b/0x130 [ 1039.206347] [] ? rcu_sync_lockdep_assert+0x73/0xb0 [ 1039.206359] [] ? __sb_start_write+0x14f/0x310 [ 1039.206367] [] vfs_write+0x182/0x4e0 [ 1039.206377] [] SyS_write+0xdc/0x1c0 [ 1039.206386] [] ? SyS_read+0x1c0/0x1c0 [ 1039.206399] [] ? lockdep_sys_exit_thunk+0x12/0x14 [ 1039.206410] [] entry_SYSCALL_64_fastpath+0x1e/0x9a [ 1039.206414] Mem-Info: [ 1039.206439] active_anon:70087 inactive_anon:6189 isolated_anon:0 [ 1039.206439] active_file:11182 inactive_file:11777 isolated_file:0 [ 1039.206439] unevictable:0 dirty:47 writeback:0 unstable:0 [ 1039.206439] slab_reclaimable:4381 slab_unreclaimable:63036 [ 1039.206439] mapped:58956 shmem:8676 pagetables:8541 bounce:0 [ 1039.206439] free:1407476 free_pcp:586 free_cma:0 [ 1039.206478] DMA32 free:2573600kB min:4696kB low:5868kB high:7044kB active_anon:127656kB inactive_anon:11824kB active_file:19752kB inactive_file:20788kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:3145324kB managed:3021976kB mlocked:0kB dirty:8kB writeback:0kB mapped:107908kB shmem:15948kB slab_reclaimable:8324kB slab_unreclaimable:115256kB kernel_stack:6560kB pagetables:15360kB unstable:0kB bounce:0kB free_pcp:1228kB local_pcp:736kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no [ 1039.206488] lowmem_reserve[]: 0 3504 3504 [ 1039.206524] Normal free:3056304kB min:5580kB low:6972kB high:8368kB active_anon:152692kB inactive_anon:12932kB active_file:24976kB inactive_file:26320kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:4718592kB managed:3588764kB mlocked:0kB dirty:180kB writeback:0kB mapped:127916kB shmem:18756kB slab_reclaimable:9200kB slab_unreclaimable:136888kB kernel_stack:8128kB pagetables:18804kB unstable:0kB bounce:0kB free_pcp:1108kB local_pcp:472kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no [ 1039.206533] lowmem_reserve[]: 0 0 0 [ 1039.206592] DMA32: 218*4kB (UME) 73*8kB (UME) 269*16kB (UME) 185*32kB (UME) 73*64kB (UME) 24*128kB (UME) 11*256kB (UM) 5*512kB (M) 1*1024kB (E) 2*2048kB (UE) 621*4096kB (M) = 2573536kB [ 1039.206647] Normal: 548*4kB (UM) 444*8kB (UME) 310*16kB (UME) 178*32kB (UM) 99*64kB (UME) 32*128kB (UME) 10*256kB (UM) 8*512kB (UME) 4*1024kB (M) 4*2048kB (UME) 735*4096kB (M) = 3056336kB [ 1039.206650] 31634 total pagecache pages [ 1039.206653] 0 pages in swap cache [ 1039.206659] Swap cache stats: add 0, delete 0, find 0/0 [ 1039.206662] Free swap = 0kB [ 1039.206665] Total swap = 0kB [ 1039.206667] 1965979 pages RAM [ 1039.206671] 0 pages HighMem/MovableOnly [ 1039.206674] 313294 pages reserved 12:13:39 executing program 2: openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r0 = creat(&(0x7f0000000700)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x40000006100) ftruncate(r0, 0x208203) r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000008000/0x600000)=nil, 0x600000, 0x800002, 0x11, r1, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r2, &(0x7f0000000180)={0xa, 0x4e24, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) sendmmsg(r2, &(0x7f00000092c0), 0x4ff, 0x0) r3 = open(&(0x7f00000003c0)='./bus\x00', 0x0, 0x0) sendfile(r0, r3, 0x0, 0x8000fffffffe) r4 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r4, 0x1000008912, &(0x7f0000000000)="11dca5055e0acfec7be070") 12:13:39 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) 12:13:39 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) 12:13:39 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) 12:13:39 executing program 0: openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)={'vet\x00\x00\x96T\x00\x00\x00\x00\x00\xbdh \x00', 0x402}) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000180)={'vd\x7f\x00\x16\x00\xf9V\xdbZ\xdd\x91\x80\xd2{\x00', 0x43732e5398417f1e}) close(r0) 12:13:39 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x6, 0x1100082) r1 = memfd_create(&(0x7f0000000080)='t\bnu\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00', 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000340)=[{&(0x7f0000001140)='\'', 0x1}], 0x1, 0x1081804) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendfile(r0, r0, 0x0, 0x200000d) ioctl$LOOP_CLR_FD(r0, 0x4c01) syz_genetlink_get_family_id$tipc(0x0) dup3(r1, r0, 0x0) [ 1039.828328] binder: 15172:15177 transaction failed 29189/-22, size 0-0 line 3014 [ 1039.828495] binder: undelivered TRANSACTION_ERROR: 29189 [ 1039.832974] vmalloc: allocation failure: 0 bytes [ 1039.832981] syz-executor.4: page allocation failure: order:0, mode:0x24000c2 12:13:39 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) 12:13:39 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) 12:13:39 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) [ 1039.832990] CPU: 1 PID: 15179 Comm: syz-executor.4 Not tainted 4.4.174+ #4 12:13:39 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) [ 1039.833004] 0000000000000000 ece7f82956ece386 ffff8801d852f9f0 ffffffff81aad1a1 12:13:39 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x6, 0x1100082) r1 = memfd_create(&(0x7f0000000080)='t\bnu\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00', 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000340)=[{&(0x7f0000001140)='\'', 0x1}], 0x1, 0x1081804) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendfile(r0, r0, 0x0, 0x200000d) ioctl$LOOP_CLR_FD(r0, 0x4c01) syz_genetlink_get_family_id$tipc(0x0) dup3(r1, r0, 0x0) 12:13:39 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) [ 1039.833015] 1ffff1003b0a5f41 ffff8801d341c740 00000000024000c2 0000000000000000 [ 1039.833027] ffffffff82895080 ffff8801d852fb00 ffffffff8148c0cb ffffffff00000001 [ 1039.833029] Call Trace: [ 1039.833043] [] dump_stack+0xc1/0x120 [ 1039.833056] [] warn_alloc_failed.cold+0x78/0x99 [ 1039.833067] [] ? zone_watermark_ok_safe+0x290/0x290 [ 1039.833079] [] ? sel_write_load+0x9e/0xf90 [ 1039.833089] [] __vmalloc_node_range+0x365/0x650 [ 1039.833097] [] ? check_preemption_disabled+0x3c/0x200 [ 1039.833106] [] ? check_preemption_disabled+0x3c/0x200 [ 1039.833114] [] ? task_has_security+0x130/0x270 [ 1039.833122] [] vmalloc+0x5c/0x70 [ 1039.833129] [] ? sel_write_load+0x119/0xf90 [ 1039.833136] [] sel_write_load+0x119/0xf90 [ 1039.833144] [] ? sel_read_bool+0x240/0x240 [ 1039.833153] [] ? trace_hardirqs_on+0x10/0x10 [ 1039.833161] [] __vfs_write+0x116/0x3d0 [ 1039.833168] [] ? sel_read_bool+0x240/0x240 [ 1039.833175] [] ? __vfs_read+0x3c0/0x3c0 [ 1039.833183] [] ? check_preemption_disabled+0x3c/0x200 [ 1039.833190] [] ? check_preemption_disabled+0x3c/0x200 [ 1039.833199] [] ? rcu_read_lock_sched_held+0x10b/0x130 [ 1039.833207] [] ? rcu_sync_lockdep_assert+0x73/0xb0 [ 1039.833215] [] ? __sb_start_write+0x14f/0x310 [ 1039.833222] [] vfs_write+0x182/0x4e0 [ 1039.833230] [] SyS_write+0xdc/0x1c0 [ 1039.833237] [] ? SyS_read+0x1c0/0x1c0 [ 1039.833247] [] ? lockdep_sys_exit_thunk+0x12/0x14 [ 1039.833256] [] entry_SYSCALL_64_fastpath+0x1e/0x9a [ 1039.833260] Mem-Info: [ 1039.833285] active_anon:69997 inactive_anon:5695 isolated_anon:0 [ 1039.833285] active_file:11182 inactive_file:11777 isolated_file:0 [ 1039.833285] unevictable:0 dirty:47 writeback:0 unstable:0 [ 1039.833285] slab_reclaimable:4381 slab_unreclaimable:63122 [ 1039.833285] mapped:58921 shmem:8151 pagetables:8488 bounce:0 [ 1039.833285] free:1408151 free_pcp:488 free_cma:0 12:13:39 executing program 2: openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r0 = creat(&(0x7f0000000700)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x40000006100) ftruncate(r0, 0x208203) r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000008000/0x600000)=nil, 0x600000, 0x800002, 0x11, r1, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r2, &(0x7f0000000180)={0xa, 0x4e24, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) sendmmsg(r2, &(0x7f00000092c0), 0x4ff, 0x0) r3 = open(&(0x7f00000003c0)='./bus\x00', 0x0, 0x0) sendfile(r0, r3, 0x0, 0x8000fffffffe) r4 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r4, 0x1000008912, &(0x7f0000000000)="11dca5055e0acfec7be070") 12:13:39 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) 12:13:39 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) 12:13:39 executing program 0: openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)={'vet\x00\x00\x96T\x00\x00\x00\x00\x00\xbdh \x00', 0x402}) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000180)={'vd\x7f\x00\x16\x00\xf9V\xdbZ\xdd\x91\x80\xd2{\x00', 0x43732e5398417f1e}) close(r0) 12:13:39 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) 12:13:39 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x6, 0x1100082) r1 = memfd_create(&(0x7f0000000080)='t\bnu\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00', 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000340)=[{&(0x7f0000001140)='\'', 0x1}], 0x1, 0x1081804) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendfile(r0, r0, 0x0, 0x200000d) ioctl$LOOP_CLR_FD(r0, 0x4c01) syz_genetlink_get_family_id$tipc(0x0) dup3(r1, r0, 0x0) [ 1039.833316] DMA32 free:2575076kB min:4696kB low:5868kB high:7044kB active_anon:127460kB inactive_anon:10236kB active_file:19752kB inactive_file:20788kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:3145324kB managed:3021976kB mlocked:0kB dirty:8kB writeback:0kB mapped:107748kB shmem:14292kB slab_reclaimable:8324kB slab_unreclaimable:115868kB kernel_stack:6432kB pagetables:15128kB unstable:0kB bounce:0kB free_pcp:1072kB local_pcp:448kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no 12:13:40 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) 12:13:40 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) [ 1039.833326] lowmem_reserve[]: 0 3504 3504 12:13:40 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) [ 1039.833357] Normal free:3057528kB min:5580kB low:6972kB high:8368kB active_anon:152528kB inactive_anon:12544kB active_file:24976kB inactive_file:26320kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:4718592kB managed:3588764kB mlocked:0kB dirty:180kB writeback:0kB mapped:127936kB shmem:18312kB slab_reclaimable:9200kB slab_unreclaimable:136620kB kernel_stack:8128kB pagetables:18824kB unstable:0kB bounce:0kB free_pcp:880kB local_pcp:192kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no 12:13:40 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x6, 0x1100082) r1 = memfd_create(&(0x7f0000000080)='t\bnu\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00', 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000340)=[{&(0x7f0000001140)='\'', 0x1}], 0x1, 0x1081804) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendfile(r0, r0, 0x0, 0x200000d) ioctl$LOOP_CLR_FD(r0, 0x4c01) syz_genetlink_get_family_id$tipc(0x0) dup3(r1, r0, 0x0) 12:13:40 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) 12:13:40 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) [ 1039.833366] lowmem_reserve[]: 0 0 0 [ 1039.833418] DMA32: 425*4kB (UME) 122*8kB (UME) 271*16kB (UME) 189*32kB (UME) 72*64kB (UME) 26*128kB (UME) 11*256kB (UM) 5*512kB (M) 1*1024kB (E) 2*2048kB (UE) 621*4096kB (M) = 2575108kB [ 1039.833486] Normal: 669*4kB (UM) 460*8kB (UME) 310*16kB (UME) 192*32kB (UM) 99*64kB (UME) 32*128kB (UME) 10*256kB (UM) 8*512kB (UME) 4*1024kB (M) 4*2048kB (UME) 735*4096kB (M) = 3057396kB [ 1039.833489] 31109 total pagecache pages [ 1039.833492] 0 pages in swap cache [ 1039.833497] Swap cache stats: add 0, delete 0, find 0/0 [ 1039.833500] Free swap = 0kB [ 1039.833502] Total swap = 0kB [ 1039.833505] 1965979 pages RAM [ 1039.833508] 0 pages HighMem/MovableOnly [ 1039.833510] 313294 pages reserved [ 1039.894814] vmalloc: allocation failure: 0 bytes [ 1039.894820] syz-executor.4: page allocation failure: order:0, mode:0x24000c2 [ 1039.894830] CPU: 0 PID: 15190 Comm: syz-executor.4 Not tainted 4.4.174+ #4 [ 1039.894843] 0000000000000000 5e6a337570c893cb ffff8801c0b579f0 ffffffff81aad1a1 [ 1039.894853] 1ffff1003816af41 ffff8800badc2f80 00000000024000c2 0000000000000000 [ 1039.894865] ffffffff82895080 ffff8801c0b57b00 ffffffff8148c0cb ffffffff00000001 [ 1039.894868] Call Trace: [ 1039.894882] [] dump_stack+0xc1/0x120 [ 1039.894895] [] warn_alloc_failed.cold+0x78/0x99 [ 1039.894927] [] ? zone_watermark_ok_safe+0x290/0x290 [ 1039.894945] [] ? sel_write_load+0x9e/0xf90 [ 1039.894959] [] __vmalloc_node_range+0x365/0x650 [ 1039.894970] [] ? check_preemption_disabled+0x3c/0x200 [ 1039.894978] [] ? check_preemption_disabled+0x3c/0x200 [ 1039.894988] [] ? task_has_security+0x130/0x270 [ 1039.894996] [] vmalloc+0x5c/0x70 [ 1039.895003] [] ? sel_write_load+0x119/0xf90 [ 1039.895010] [] sel_write_load+0x119/0xf90 [ 1039.895018] [] ? sel_read_bool+0x240/0x240 12:13:40 executing program 2: openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r0 = creat(&(0x7f0000000700)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x40000006100) ftruncate(r0, 0x208203) r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000008000/0x600000)=nil, 0x600000, 0x800002, 0x11, r1, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r2, &(0x7f0000000180)={0xa, 0x4e24, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) sendmmsg(r2, &(0x7f00000092c0), 0x4ff, 0x0) r3 = open(&(0x7f00000003c0)='./bus\x00', 0x0, 0x0) sendfile(r0, r3, 0x0, 0x8000fffffffe) r4 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r4, 0x1000008912, &(0x7f0000000000)="11dca5055e0acfec7be070") 12:13:40 executing program 0: openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)={'vet\x00\x00\x96T\x00\x00\x00\x00\x00\xbdh \x00', 0x402}) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000180)={'vd\x7f\x00\x16\x00\xf9V\xdbZ\xdd\x91\x80\xd2{\x00', 0x43732e5398417f1e}) close(r0) 12:13:40 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) 12:13:40 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) 12:13:40 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) 12:13:40 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x6, 0x1100082) r1 = memfd_create(&(0x7f0000000080)='t\bnu\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00', 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000340)=[{&(0x7f0000001140)='\'', 0x1}], 0x1, 0x1081804) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendfile(r0, r0, 0x0, 0x200000d) ioctl$LOOP_CLR_FD(r0, 0x4c01) syz_genetlink_get_family_id$tipc(0x0) dup3(r1, r0, 0x0) [ 1039.895027] [] ? trace_hardirqs_on+0x10/0x10 [ 1039.895035] [] __vfs_write+0x116/0x3d0 [ 1039.895041] [] ? sel_read_bool+0x240/0x240 12:13:40 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) 12:13:40 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) 12:13:40 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) [ 1039.895048] [] ? __vfs_read+0x3c0/0x3c0 12:13:40 executing program 0: openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)={'vet\x00\x00\x96T\x00\x00\x00\x00\x00\xbdh \x00', 0x402}) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000180)={'vd\x7f\x00\x16\x00\xf9V\xdbZ\xdd\x91\x80\xd2{\x00', 0x43732e5398417f1e}) close(r0) 12:13:40 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) [ 1039.895056] [] ? check_preemption_disabled+0x3c/0x200 12:13:40 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x6, 0x1100082) r1 = memfd_create(&(0x7f0000000080)='t\bnu\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00', 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000340)=[{&(0x7f0000001140)='\'', 0x1}], 0x1, 0x1081804) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendfile(r0, r0, 0x0, 0x200000d) ioctl$LOOP_CLR_FD(r0, 0x4c01) syz_genetlink_get_family_id$tipc(0x0) dup3(r1, r0, 0x0) [ 1039.895063] [] ? check_preemption_disabled+0x3c/0x200 [ 1039.895073] [] ? rcu_read_lock_sched_held+0x10b/0x130 [ 1039.895080] [] ? rcu_sync_lockdep_assert+0x73/0xb0 [ 1039.895089] [] ? __sb_start_write+0x14f/0x310 [ 1039.895096] [] vfs_write+0x182/0x4e0 [ 1039.895103] [] SyS_write+0xdc/0x1c0 [ 1039.895111] [] ? SyS_read+0x1c0/0x1c0 [ 1039.895120] [] ? lockdep_sys_exit_thunk+0x12/0x14 [ 1039.895131] [] entry_SYSCALL_64_fastpath+0x1e/0x9a [ 1039.895135] Mem-Info: [ 1039.895160] active_anon:70047 inactive_anon:5695 isolated_anon:0 [ 1039.895160] active_file:11182 inactive_file:11777 isolated_file:0 [ 1039.895160] unevictable:0 dirty:47 writeback:0 unstable:0 [ 1039.895160] slab_reclaimable:4381 slab_unreclaimable:63040 [ 1039.895160] mapped:58995 shmem:8151 pagetables:8562 bounce:0 [ 1039.895160] free:1408014 free_pcp:470 free_cma:0 [ 1039.895198] DMA32 free:2575116kB min:4696kB low:5868kB high:7044kB active_anon:127460kB inactive_anon:10236kB active_file:19752kB inactive_file:20788kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:3145324kB managed:3021976kB mlocked:0kB dirty:8kB writeback:0kB mapped:107896kB shmem:14292kB slab_reclaimable:8324kB slab_unreclaimable:115540kB kernel_stack:6432kB pagetables:15424kB unstable:0kB bounce:0kB free_pcp:932kB local_pcp:652kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no [ 1039.895206] lowmem_reserve[]: 0 3504 3504 [ 1039.895243] Normal free:3056940kB min:5580kB low:6972kB high:8368kB active_anon:152728kB inactive_anon:12544kB active_file:24976kB inactive_file:26320kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:4718592kB managed:3588764kB mlocked:0kB dirty:180kB writeback:0kB mapped:128084kB shmem:18312kB slab_reclaimable:9200kB slab_unreclaimable:136620kB kernel_stack:8128kB pagetables:18824kB unstable:0kB bounce:0kB free_pcp:936kB local_pcp:468kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no [ 1039.895251] lowmem_reserve[]: 0 0 0 [ 1039.895308] DMA32: 401*4kB (UME) 134*8kB (UME) 271*16kB (UME) 192*32kB (UME) 72*64kB (UME) 26*128kB (UME) 11*256kB (UM) 5*512kB (M) 1*1024kB (E) 2*2048kB (UE) 621*4096kB (M) = 2575204kB [ 1039.895365] Normal: 558*4kB (UM) 469*8kB (UME) 309*16kB (UME) 190*32kB (UM) 99*64kB (UME) 31*128kB (UME) 10*256kB (UM) 8*512kB (UME) 4*1024kB (M) 4*2048kB (UME) 735*4096kB (M) = 3056816kB [ 1039.895368] 31109 total pagecache pages [ 1039.895372] 0 pages in swap cache [ 1039.895378] Swap cache stats: add 0, delete 0, find 0/0 [ 1039.895380] Free swap = 0kB [ 1039.895383] Total swap = 0kB [ 1039.895386] 1965979 pages RAM [ 1039.895390] 0 pages HighMem/MovableOnly [ 1039.895392] 313294 pages reserved [ 1039.908684] binder: 15189:15191 transaction failed 29189/-22, size 0-0 line 3014 [ 1039.908984] binder: undelivered TRANSACTION_ERROR: 29189 [ 1040.001518] binder: 15197:15198 transaction failed 29189/-22, size 0-0 line 3014 [ 1040.001674] binder: undelivered TRANSACTION_ERROR: 29189 [ 1040.026552] vmalloc: allocation failure: 0 bytes [ 1040.026559] syz-executor.4: page allocation failure: order:0, mode:0x24000c2 [ 1040.026569] CPU: 1 PID: 15204 Comm: syz-executor.4 Not tainted 4.4.174+ #4 [ 1040.026583] 0000000000000000 30598b35fefdfe59 ffff8801d31179f0 ffffffff81aad1a1 [ 1040.026596] 1ffff1003a622f41 ffff8800b82997c0 00000000024000c2 0000000000000000 [ 1040.026608] ffffffff82895080 ffff8801d3117b00 ffffffff8148c0cb ffffffff00000001 [ 1040.026610] Call Trace: [ 1040.026625] [] dump_stack+0xc1/0x120 [ 1040.026641] [] warn_alloc_failed.cold+0x78/0x99 [ 1040.026653] [] ? zone_watermark_ok_safe+0x290/0x290 [ 1040.026663] [] ? sel_write_load+0x9e/0xf90 [ 1040.026674] [] __vmalloc_node_range+0x365/0x650 [ 1040.026683] [] ? check_preemption_disabled+0x3c/0x200 [ 1040.026691] [] ? check_preemption_disabled+0x3c/0x200 [ 1040.026700] [] ? task_has_security+0x130/0x270 [ 1040.026708] [] vmalloc+0x5c/0x70 [ 1040.026716] [] ? sel_write_load+0x119/0xf90 [ 1040.026723] [] sel_write_load+0x119/0xf90 [ 1040.026731] [] ? sel_read_bool+0x240/0x240 [ 1040.026752] [] ? trace_hardirqs_on+0x10/0x10 [ 1040.026763] [] __vfs_write+0x116/0x3d0 [ 1040.026772] [] ? sel_read_bool+0x240/0x240 [ 1040.026781] [] ? __vfs_read+0x3c0/0x3c0 [ 1040.026790] [] ? check_preemption_disabled+0x3c/0x200 [ 1040.026800] [] ? check_preemption_disabled+0x3c/0x200 [ 1040.026810] [] ? rcu_read_lock_sched_held+0x10b/0x130 [ 1040.026818] [] ? rcu_sync_lockdep_assert+0x73/0xb0 [ 1040.026827] [] ? __sb_start_write+0x14f/0x310 [ 1040.026835] [] vfs_write+0x182/0x4e0 12:13:41 executing program 2: openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r0 = creat(&(0x7f0000000700)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x40000006100) ftruncate(r0, 0x208203) r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000008000/0x600000)=nil, 0x600000, 0x800002, 0x11, r1, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r2, &(0x7f0000000180)={0xa, 0x4e24, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) sendmmsg(r2, &(0x7f00000092c0), 0x4ff, 0x0) r3 = open(&(0x7f00000003c0)='./bus\x00', 0x0, 0x0) sendfile(r0, r3, 0x0, 0x8000fffffffe) r4 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r4, 0x1000008912, &(0x7f0000000000)="11dca5055e0acfec7be070") 12:13:41 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) 12:13:41 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) 12:13:41 executing program 0: openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)={'vet\x00\x00\x96T\x00\x00\x00\x00\x00\xbdh \x00', 0x402}) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000180)={'vd\x7f\x00\x16\x00\xf9V\xdbZ\xdd\x91\x80\xd2{\x00', 0x43732e5398417f1e}) close(r0) 12:13:41 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) 12:13:41 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x6, 0x1100082) r1 = memfd_create(&(0x7f0000000080)='t\bnu\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00', 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000340)=[{&(0x7f0000001140)='\'', 0x1}], 0x1, 0x1081804) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendfile(r0, r0, 0x0, 0x200000d) ioctl$LOOP_CLR_FD(r0, 0x4c01) syz_genetlink_get_family_id$tipc(0x0) dup3(r1, r0, 0x0) [ 1040.026843] [] SyS_write+0xdc/0x1c0 [ 1040.026850] [] ? SyS_read+0x1c0/0x1c0 [ 1040.026861] [] ? lockdep_sys_exit_thunk+0x12/0x14 [ 1040.026870] [] entry_SYSCALL_64_fastpath+0x1e/0x9a 12:13:41 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) 12:13:41 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) 12:13:41 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) [ 1040.028551] Mem-Info: [ 1040.028577] active_anon:70047 inactive_anon:5995 isolated_anon:0 [ 1040.028577] active_file:11182 inactive_file:11777 isolated_file:0 [ 1040.028577] unevictable:0 dirty:47 writeback:0 unstable:0 [ 1040.028577] slab_reclaimable:4381 slab_unreclaimable:62963 [ 1040.028577] mapped:58921 shmem:8484 pagetables:8488 bounce:0 [ 1040.028577] free:1407830 free_pcp:605 free_cma:0 12:13:41 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x6, 0x1100082) r1 = memfd_create(&(0x7f0000000080)='t\bnu\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00', 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000340)=[{&(0x7f0000001140)='\'', 0x1}], 0x1, 0x1081804) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendfile(r0, r0, 0x0, 0x200000d) ioctl$LOOP_CLR_FD(r0, 0x4c01) syz_genetlink_get_family_id$tipc(0x0) dup3(r1, r0, 0x0) 12:13:41 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) 12:13:41 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) [ 1040.028614] DMA32 free:2574932kB min:4696kB low:5868kB high:7044kB active_anon:127660kB inactive_anon:10736kB active_file:19752kB inactive_file:20788kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:3145324kB managed:3021976kB mlocked:0kB dirty:8kB writeback:0kB mapped:107748kB shmem:14884kB slab_reclaimable:8324kB slab_unreclaimable:115336kB kernel_stack:6432kB pagetables:15128kB unstable:0kB bounce:0kB free_pcp:1096kB local_pcp:500kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no ** 48 printk messages dropped ** [ 1040.756911] Mem-Info: [ 1040.756936] active_anon:70031 inactive_anon:5700 isolated_anon:0 [ 1040.756936] active_file:11182 inactive_file:11777 isolated_file:0 [ 1040.756936] unevictable:0 dirty:47 writeback:0 unstable:0 [ 1040.756936] slab_reclaimable:4381 slab_unreclaimable:63040 [ 1040.756936] mapped:59001 shmem:8152 pagetables:8515 bounce:0 [ 1040.756936] free:1408236 free_pcp:351 free_cma:0 [ 1040.756976] DMA32 free:2575212kB min:4696kB low:5868kB high:7044kB active_anon:127712kB inactive_anon:10268kB active_file:19752kB inactive_file:20788kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:3145324kB managed:3021976kB mlocked:0kB dirty:8kB writeback:0kB mapped:107888kB shmem:14264kB slab_reclaimable:8324kB slab_unreclaimable:115600kB kernel_stack:6272kB pagetables:15360kB unstable:0kB bounce:0kB free_pcp:804kB local_pcp:108kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no [ 1040.756987] lowmem_reserve[]: 0 3504 3504 [ 1040.757021] Normal free:3057732kB min:5580kB low:6972kB high:8368kB active_anon:152412kB inactive_anon:12532kB active_file:24976kB inactive_file:26320kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:4718592kB managed:3588764kB mlocked:0kB dirty:180kB writeback:0kB mapped:128116kB shmem:18344kB slab_reclaimable:9200kB slab_unreclaimable:136560kB kernel_stack:7872kB pagetables:18700kB unstable:0kB bounce:0kB free_pcp:600kB local_pcp:60kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no [ 1040.757031] lowmem_reserve[]: 0 0 0 [ 1040.757086] DMA32: 297*4kB (UME) 191*8kB (UME) 271*16kB (UME) 191*32kB (UME) 74*64kB (UME) 25*128kB (UME) 11*256kB (UM) 5*512kB (M) 1*1024kB (E) 2*2048kB (UE) 621*4096kB (M) = 2575212kB [ 1040.757140] Normal: 699*4kB (UM) 468*8kB (UME) 311*16kB (UME) 195*32kB (UM) 99*64kB (UME) 32*128kB (UME) 10*256kB (UM) 8*512kB (UME) 4*1024kB (M) 4*2048kB (UME) 735*4096kB (M) = 3057692kB [ 1040.757142] 31110 total pagecache pages [ 1040.757146] 0 pages in swap cache [ 1040.757151] Swap cache stats: add 0, delete 0, find 0/0 [ 1040.757153] Free swap = 0kB [ 1040.757156] Total swap = 0kB [ 1040.757159] 1965979 pages RAM [ 1040.757161] 0 pages HighMem/MovableOnly [ 1040.757164] 313294 pages reserved [ 1040.846964] vmalloc: allocation failure: 0 bytes [ 1040.846971] syz-executor.4: page allocation failure: order:0, mode:0x24000c2 [ 1040.846981] CPU: 0 PID: 15235 Comm: syz-executor.4 Not tainted 4.4.174+ #4 [ 1040.846994] 0000000000000000 fec53532f41dc377 ffff8800a65b79f0 ffffffff81aad1a1 [ 1040.847005] 1ffff10014cb6f41 ffff8800b915c740 00000000024000c2 0000000000000000 [ 1040.847017] ffffffff82895080 ffff8800a65b7b00 ffffffff8148c0cb ffffffff00000001 [ 1040.847020] Call Trace: [ 1040.847036] [] dump_stack+0xc1/0x120 [ 1040.847049] [] warn_alloc_failed.cold+0x78/0x99 [ 1040.847059] [] ? zone_watermark_ok_safe+0x290/0x290 [ 1040.847068] [] ? sel_write_load+0x9e/0xf90 [ 1040.847080] [] __vmalloc_node_range+0x365/0x650 [ 1040.847090] [] ? check_preemption_disabled+0x3c/0x200 [ 1040.847099] [] ? check_preemption_disabled+0x3c/0x200 [ 1040.847107] [] ? task_has_security+0x130/0x270 [ 1040.847115] [] vmalloc+0x5c/0x70 [ 1040.847123] [] ? sel_write_load+0x119/0xf90 [ 1040.847131] [] sel_write_load+0x119/0xf90 12:13:42 executing program 2: openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r0 = creat(&(0x7f0000000700)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x40000006100) ftruncate(r0, 0x208203) r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000008000/0x600000)=nil, 0x600000, 0x800002, 0x11, r1, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r2, &(0x7f0000000180)={0xa, 0x4e24, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) sendmmsg(r2, &(0x7f00000092c0), 0x4ff, 0x0) r3 = open(&(0x7f00000003c0)='./bus\x00', 0x0, 0x0) sendfile(r0, r3, 0x0, 0x8000fffffffe) r4 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r4, 0x1000008912, &(0x7f0000000000)="11dca5055e0acfec7be070") 12:13:42 executing program 0: openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)={'vet\x00\x00\x96T\x00\x00\x00\x00\x00\xbdh \x00', 0x402}) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000180)={'vd\x7f\x00\x16\x00\xf9V\xdbZ\xdd\x91\x80\xd2{\x00', 0x43732e5398417f1e}) close(r0) 12:13:42 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) 12:13:42 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) 12:13:42 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x6, 0x1100082) r1 = memfd_create(&(0x7f0000000080)='t\bnu\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00', 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000340)=[{&(0x7f0000001140)='\'', 0x1}], 0x1, 0x1081804) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendfile(r0, r0, 0x0, 0x200000d) ioctl$LOOP_CLR_FD(r0, 0x4c01) syz_genetlink_get_family_id$tipc(0x0) dup3(r1, r0, 0x0) 12:13:42 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) [ 1040.847139] [] ? sel_read_bool+0x240/0x240 [ 1040.847149] [] ? trace_hardirqs_on+0x10/0x10 [ 1040.847158] [] __vfs_write+0x116/0x3d0 [ 1040.847166] [] ? sel_read_bool+0x240/0x240 [ 1040.847173] [] ? __vfs_read+0x3c0/0x3c0 12:13:42 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) 12:13:42 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) 12:13:42 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) ** 12 printk messages dropped ** [ 1040.847339] DMA32 free:2575056kB min:4696kB low:5868kB high:7044kB active_anon:127712kB inactive_anon:10268kB active_file:19752kB inactive_file:20788kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:3145324kB managed:3021976kB mlocked:0kB dirty:8kB writeback:0kB mapped:107888kB shmem:14264kB slab_reclaimable:8324kB slab_unreclaimable:115600kB kernel_stack:6272kB pagetables:15508kB unstable:0kB bounce:0kB free_pcp:464kB local_pcp:420kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no 12:13:42 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) 12:13:42 executing program 0: openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)={'vet\x00\x00\x96T\x00\x00\x00\x00\x00\xbdh \x00', 0x402}) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000180)={'vd\x7f\x00\x16\x00\xf9V\xdbZ\xdd\x91\x80\xd2{\x00', 0x43732e5398417f1e}) close(r0) 12:13:42 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) ** 99 printk messages dropped ** [ 1041.552775] [] ? lockdep_sys_exit_thunk+0x12/0x14 [ 1041.552785] [] entry_SYSCALL_64_fastpath+0x1e/0x9a [ 1041.552788] Mem-Info: [ 1041.552810] active_anon:70058 inactive_anon:5700 isolated_anon:0 [ 1041.552810] active_file:11182 inactive_file:11777 isolated_file:0 [ 1041.552810] unevictable:0 dirty:47 writeback:0 unstable:0 [ 1041.552810] slab_reclaimable:4381 slab_unreclaimable:62959 [ 1041.552810] mapped:58948 shmem:8152 pagetables:8515 bounce:0 [ 1041.552810] free:1408196 free_pcp:499 free_cma:0 [ 1041.552850] DMA32 free:2575860kB min:4696kB low:5868kB high:7044kB active_anon:127604kB inactive_anon:10236kB active_file:19752kB inactive_file:20788kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:3145324kB managed:3021976kB mlocked:0kB dirty:8kB writeback:0kB mapped:107824kB shmem:14328kB slab_reclaimable:8324kB slab_unreclaimable:114764kB kernel_stack:6240kB pagetables:15584kB unstable:0kB bounce:0kB free_pcp:1028kB local_pcp:336kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no [ 1041.552859] lowmem_reserve[]: 0 3504 3504 [ 1041.552891] Normal free:3056924kB min:5580kB low:6972kB high:8368kB active_anon:152628kB inactive_anon:12564kB active_file:24976kB inactive_file:26320kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:4718592kB managed:3588764kB mlocked:0kB dirty:180kB writeback:0kB mapped:127968kB shmem:18280kB slab_reclaimable:9200kB slab_unreclaimable:137072kB kernel_stack:7872kB pagetables:18476kB unstable:0kB bounce:0kB free_pcp:968kB local_pcp:376kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no [ 1041.552899] lowmem_reserve[]: 0 0 0 [ 1041.552957] DMA32: 369*4kB (UME) 190*8kB (UME) 272*16kB (UME) 198*32kB (UME) 74*64kB (UME) 26*128kB (UME) 11*256kB (UM) 5*512kB (M) 1*1024kB (E) 2*2048kB (UE) 621*4096kB (M) = 2575860kB 12:13:43 executing program 2: openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r0 = creat(&(0x7f0000000700)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x40000006100) ftruncate(r0, 0x208203) r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000008000/0x600000)=nil, 0x600000, 0x800002, 0x11, r1, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r2, &(0x7f0000000180)={0xa, 0x4e24, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) sendmmsg(r2, &(0x7f00000092c0), 0x4ff, 0x0) r3 = open(&(0x7f00000003c0)='./bus\x00', 0x0, 0x0) sendfile(r0, r3, 0x0, 0x8000fffffffe) r4 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r4, 0x1000008912, &(0x7f0000000000)="11dca5055e0acfec7be070") 12:13:43 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) 12:13:43 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x6, 0x1100082) r1 = memfd_create(&(0x7f0000000080)='t\bnu\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00', 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000340)=[{&(0x7f0000001140)='\'', 0x1}], 0x1, 0x1081804) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendfile(r0, r0, 0x0, 0x200000d) ioctl$LOOP_CLR_FD(r0, 0x4c01) syz_genetlink_get_family_id$tipc(0x0) dup3(r1, r0, 0x0) 12:13:43 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) 12:13:43 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) 12:13:43 executing program 0: openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)={'vet\x00\x00\x96T\x00\x00\x00\x00\x00\xbdh \x00', 0x402}) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000180)={'vd\x7f\x00\x16\x00\xf9V\xdbZ\xdd\x91\x80\xd2{\x00', 0x43732e5398417f1e}) close(r0) [ 1041.553250] Normal: 571*4kB (UM) 430*8kB (UME) 310*16kB (UME) 198*32kB (UM) 99*64kB (UME) 31*128kB (UME) 10*256kB (UM) 8*512kB (UME) 4*1024kB (M) 4*2048kB (UME) 735*4096kB (M) = 3056828kB [ 1041.553252] 31110 total pagecache pages [ 1041.553257] 0 pages in swap cache [ 1041.553261] Swap cache stats: add 0, delete 0, find 0/0 12:13:43 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) 12:13:43 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) [ 1041.553280] Free swap = 0kB 12:13:43 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) ** 37 printk messages dropped ** [ 1044.175222] [] ? check_preemption_disabled+0x3c/0x200 [ 1044.175231] [] ? check_preemption_disabled+0x3c/0x200 12:13:43 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x6, 0x1100082) r1 = memfd_create(&(0x7f0000000080)='t\bnu\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00', 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000340)=[{&(0x7f0000001140)='\'', 0x1}], 0x1, 0x1081804) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendfile(r0, r0, 0x0, 0x200000d) ioctl$LOOP_CLR_FD(r0, 0x4c01) syz_genetlink_get_family_id$tipc(0x0) dup3(r1, r0, 0x0) [ 1044.175239] [] ? task_has_security+0x130/0x270 12:13:43 executing program 0: openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)={'vet\x00\x00\x96T\x00\x00\x00\x00\x00\xbdh \x00', 0x402}) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000180)={'vd\x7f\x00\x16\x00\xf9V\xdbZ\xdd\x91\x80\xd2{\x00', 0x43732e5398417f1e}) close(r0) 12:13:43 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) ** 47 printk messages dropped ** [ 1044.808885] [] ? check_preemption_disabled+0x3c/0x200 ** 48 printk messages dropped ** [ 1044.972571] [] ? zone_watermark_ok_safe+0x290/0x290 [ 1044.972581] [] ? sel_write_load+0x9e/0xf90 [ 1044.972592] [] __vmalloc_node_range+0x365/0x650 [ 1044.972601] [] ? check_preemption_disabled+0x3c/0x200 [ 1044.972609] [] ? check_preemption_disabled+0x3c/0x200 [ 1044.972617] [] ? task_has_security+0x130/0x270 [ 1044.972625] [] vmalloc+0x5c/0x70 [ 1044.972632] [] ? sel_write_load+0x119/0xf90 [ 1044.972640] [] sel_write_load+0x119/0xf90 [ 1044.972648] [] ? sel_read_bool+0x240/0x240 [ 1044.972658] [] ? trace_hardirqs_on+0x10/0x10 [ 1044.972666] [] __vfs_write+0x116/0x3d0 [ 1044.972674] [] ? sel_read_bool+0x240/0x240 [ 1044.972681] [] ? __vfs_read+0x3c0/0x3c0 [ 1044.972690] [] ? check_preemption_disabled+0x3c/0x200 [ 1044.972698] [] ? check_preemption_disabled+0x3c/0x200 [ 1044.972708] [] ? rcu_read_lock_sched_held+0x10b/0x130 [ 1044.972716] [] ? rcu_sync_lockdep_assert+0x73/0xb0 [ 1044.972725] [] ? __sb_start_write+0x14f/0x310 [ 1044.972732] [] vfs_write+0x182/0x4e0 [ 1044.972740] [] SyS_write+0xdc/0x1c0 [ 1044.972748] [] ? SyS_read+0x1c0/0x1c0 [ 1044.972758] [] ? lockdep_sys_exit_thunk+0x12/0x14 [ 1044.972768] [] entry_SYSCALL_64_fastpath+0x1e/0x9a [ 1044.972771] Mem-Info: [ 1044.972796] active_anon:70104 inactive_anon:5721 isolated_anon:0 [ 1044.972796] active_file:11182 inactive_file:11777 isolated_file:0 [ 1044.972796] unevictable:0 dirty:47 writeback:0 unstable:0 [ 1044.972796] slab_reclaimable:4381 slab_unreclaimable:62965 [ 1044.972796] mapped:58991 shmem:8189 pagetables:8558 bounce:0 [ 1044.972796] free:1408163 free_pcp:401 free_cma:0 [ 1044.972831] DMA32 free:2576780kB min:4696kB low:5868kB high:7044kB active_anon:127652kB inactive_anon:10296kB active_file:19752kB inactive_file:20788kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:3145324kB managed:3021976kB mlocked:0kB dirty:8kB writeback:0kB mapped:107868kB shmem:14356kB slab_reclaimable:8324kB slab_unreclaimable:114156kB kernel_stack:6368kB pagetables:15284kB unstable:0kB bounce:0kB free_pcp:920kB local_pcp:268kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no [ 1044.972840] lowmem_reserve[]: 0 3504 3504 [ 1044.972874] Normal free:3055872kB min:5580kB low:6972kB high:8368kB active_anon:152764kB inactive_anon:12588kB active_file:24976kB inactive_file:26320kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:4718592kB managed:3588764kB mlocked:0kB dirty:180kB writeback:0kB mapped:128096kB shmem:18400kB slab_reclaimable:9200kB slab_unreclaimable:137704kB kernel_stack:8096kB pagetables:18948kB unstable:0kB bounce:0kB free_pcp:684kB local_pcp:292kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no [ 1044.972883] lowmem_reserve[]: 0 0 0 [ 1044.972940] DMA32: 423*4kB (UME) 275*8kB (UME) 275*16kB (UME) 197*32kB (UME) 74*64kB (UME) 26*128kB (UME) 11*256kB (UM) 5*512kB (M) 1*1024kB (E) 2*2048kB (UE) 621*4096kB (M) = 2576772kB [ 1044.973001] Normal: 197*4kB (UM) 450*8kB (UME) 318*16kB (UME) 203*32kB (UM) 99*64kB (UME) 31*128kB (UME) 10*256kB (UM) 8*512kB (UME) 4*1024kB (M) 4*2048kB (UME) 735*4096kB (M) = 3055780kB [ 1044.973004] 31147 total pagecache pages [ 1044.973007] 0 pages in swap cache [ 1044.973012] Swap cache stats: add 0, delete 0, find 0/0 [ 1044.973015] Free swap = 0kB [ 1044.973017] Total swap = 0kB [ 1044.973020] 1965979 pages RAM [ 1044.973024] 0 pages HighMem/MovableOnly [ 1044.973026] 313294 pages reserved [ 1045.046308] vmalloc: allocation failure: 0 bytes [ 1045.046315] syz-executor.4: page allocation failure: order:0, mode:0x24000c2 [ 1045.046324] CPU: 0 PID: 15470 Comm: syz-executor.4 Not tainted 4.4.174+ #4 [ 1045.046338] 0000000000000000 aced6e644b34f9ed ffff8801b87ef9f0 ffffffff81aad1a1 [ 1045.046348] 1ffff100370fdf41 ffff8801d8532f80 00000000024000c2 0000000000000000 [ 1045.046370] ffffffff82895080 ffff8801b87efb00 ffffffff8148c0cb ffffffff00000001 [ 1045.046373] Call Trace: [ 1045.046389] [] dump_stack+0xc1/0x120 [ 1045.046403] [] warn_alloc_failed.cold+0x78/0x99 [ 1045.046414] [] ? zone_watermark_ok_safe+0x290/0x290 [ 1045.046423] [] ? sel_write_load+0x9e/0xf90 12:13:44 executing program 2: openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r0 = creat(&(0x7f0000000700)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x40000006100) ftruncate(r0, 0x208203) r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000008000/0x600000)=nil, 0x600000, 0x800002, 0x11, r1, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r2, &(0x7f0000000180)={0xa, 0x4e24, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) sendmmsg(r2, &(0x7f00000092c0), 0x4ff, 0x0) r3 = open(&(0x7f00000003c0)='./bus\x00', 0x0, 0x0) sendfile(r0, r3, 0x0, 0x8000fffffffe) r4 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r4, 0x1000008912, &(0x7f0000000000)="11dca5055e0acfec7be070") 12:13:44 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) 12:13:44 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) 12:13:44 executing program 0: openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)={'vet\x00\x00\x96T\x00\x00\x00\x00\x00\xbdh \x00', 0x402}) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000180)={'vd\x7f\x00\x16\x00\xf9V\xdbZ\xdd\x91\x80\xd2{\x00', 0x43732e5398417f1e}) close(r0) 12:13:44 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) 12:13:44 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x6, 0x1100082) r1 = memfd_create(&(0x7f0000000080)='t\bnu\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00', 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000340)=[{&(0x7f0000001140)='\'', 0x1}], 0x1, 0x1081804) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendfile(r0, r0, 0x0, 0x200000d) ioctl$LOOP_CLR_FD(r0, 0x4c01) syz_genetlink_get_family_id$tipc(0x0) dup3(r1, r0, 0x0) [ 1045.046432] [] __vmalloc_node_range+0x365/0x650 [ 1045.046440] [] ? check_preemption_disabled+0x3c/0x200 [ 1045.046449] [] ? check_preemption_disabled+0x3c/0x200 12:13:44 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) 12:13:44 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) 12:13:44 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) [ 1045.046460] [] ? task_has_security+0x130/0x270 12:13:44 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) 12:13:44 executing program 0: openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)={'vet\x00\x00\x96T\x00\x00\x00\x00\x00\xbdh \x00', 0x402}) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000180)={'vd\x7f\x00\x16\x00\xf9V\xdbZ\xdd\x91\x80\xd2{\x00', 0x43732e5398417f1e}) close(r0) [ 1045.046469] [] vmalloc+0x5c/0x70 [ 1045.046478] [] ? sel_write_load+0x119/0xf90 12:13:44 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x6, 0x1100082) r1 = memfd_create(&(0x7f0000000080)='t\bnu\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00', 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000340)=[{&(0x7f0000001140)='\'', 0x1}], 0x1, 0x1081804) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendfile(r0, r0, 0x0, 0x200000d) ioctl$LOOP_CLR_FD(r0, 0x4c01) syz_genetlink_get_family_id$tipc(0x0) dup3(r1, r0, 0x0) [ 1045.046487] [] sel_write_load+0x119/0xf90 [ 1045.046497] [] ? sel_read_bool+0x240/0x240 [ 1045.046506] [] ? trace_hardirqs_on+0x10/0x10 [ 1045.046514] [] __vfs_write+0x116/0x3d0 [ 1045.046523] [] ? sel_read_bool+0x240/0x240 [ 1045.046533] [] ? __vfs_read+0x3c0/0x3c0 [ 1045.046542] [] ? check_preemption_disabled+0x3c/0x200 [ 1045.046552] [] ? check_preemption_disabled+0x3c/0x200 [ 1045.046562] [] ? rcu_read_lock_sched_held+0x10b/0x130 [ 1045.046571] [] ? rcu_sync_lockdep_assert+0x73/0xb0 [ 1045.046579] [] ? __sb_start_write+0x14f/0x310 [ 1045.046589] [] vfs_write+0x182/0x4e0 [ 1045.046599] [] SyS_write+0xdc/0x1c0 [ 1045.046608] [] ? SyS_read+0x1c0/0x1c0 [ 1045.046622] [] ? lockdep_sys_exit_thunk+0x12/0x14 [ 1045.046633] [] entry_SYSCALL_64_fastpath+0x1e/0x9a [ 1045.048094] Mem-Info: [ 1045.048121] active_anon:70079 inactive_anon:5721 isolated_anon:0 [ 1045.048121] active_file:11182 inactive_file:11777 isolated_file:0 [ 1045.048121] unevictable:0 dirty:47 writeback:0 unstable:0 [ 1045.048121] slab_reclaimable:4381 slab_unreclaimable:62865 [ 1045.048121] mapped:58991 shmem:8189 pagetables:8521 bounce:0 [ 1045.048121] free:1408219 free_pcp:466 free_cma:0 [ 1045.048156] DMA32 free:2576596kB min:4696kB low:5868kB high:7044kB active_anon:127652kB inactive_anon:10296kB active_file:19752kB inactive_file:20788kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:3145324kB managed:3021976kB mlocked:0kB dirty:8kB writeback:0kB mapped:107868kB shmem:14356kB slab_reclaimable:8324kB slab_unreclaimable:114156kB kernel_stack:6368kB pagetables:15284kB unstable:0kB bounce:0kB free_pcp:920kB local_pcp:712kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no [ 1045.048166] lowmem_reserve[]: 0 3504 3504 [ 1045.048202] Normal free:3056280kB min:5580kB low:6972kB high:8368kB active_anon:152664kB inactive_anon:12588kB active_file:24976kB inactive_file:26320kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:4718592kB managed:3588764kB mlocked:0kB dirty:180kB writeback:0kB mapped:128096kB shmem:18400kB slab_reclaimable:9200kB slab_unreclaimable:137304kB kernel_stack:8096kB pagetables:18800kB unstable:0kB bounce:0kB free_pcp:944kB local_pcp:464kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no [ 1045.048210] lowmem_reserve[]: 0 0 0 [ 1045.051042] DMA32: 415*4kB (UME) 279*8kB (UME) 275*16kB (UME) 191*32kB (UME) 74*64kB (UME) 26*128kB (UME) 11*256kB (UM) 5*512kB (M) 1*1024kB (E) 2*2048kB (UE) 621*4096kB (M) = 2576580kB [ 1045.051102] Normal: 311*4kB (UM) 451*8kB (UME) 320*16kB (UME) 203*32kB (UM) 99*64kB (UME) 31*128kB (UME) 10*256kB (UM) 8*512kB (UME) 4*1024kB (M) 4*2048kB (UME) 735*4096kB (M) = 3056276kB [ 1045.051105] 31147 total pagecache pages [ 1045.051108] 0 pages in swap cache [ 1045.051114] Swap cache stats: add 0, delete 0, find 0/0 [ 1045.051117] Free swap = 0kB [ 1045.051119] Total swap = 0kB [ 1045.051123] 1965979 pages RAM [ 1045.051125] 0 pages HighMem/MovableOnly [ 1045.051128] 313294 pages reserved [ 1045.599910] vmalloc: allocation failure: 0 bytes [ 1045.599917] syz-executor.4: page allocation failure: order:0, mode:0x24000c2 [ 1045.599926] CPU: 1 PID: 15484 Comm: syz-executor.4 Not tainted 4.4.174+ #4 [ 1045.599938] 0000000000000000 7daefb81594f6d20 ffff8800a62479f0 ffffffff81aad1a1 [ 1045.599947] 1ffff10014c48f41 ffff8801c07fdf00 00000000024000c2 0000000000000000 [ 1045.599958] ffffffff82895080 ffff8800a6247b00 ffffffff8148c0cb ffffffff00000001 [ 1045.599961] Call Trace: [ 1045.599974] [] dump_stack+0xc1/0x120 12:13:45 executing program 2: openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r0 = creat(&(0x7f0000000700)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x40000006100) ftruncate(r0, 0x208203) r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000008000/0x600000)=nil, 0x600000, 0x800002, 0x11, r1, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r2, &(0x7f0000000180)={0xa, 0x4e24, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) sendmmsg(r2, &(0x7f00000092c0), 0x4ff, 0x0) r3 = open(&(0x7f00000003c0)='./bus\x00', 0x0, 0x0) sendfile(r0, r3, 0x0, 0x8000fffffffe) r4 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r4, 0x1000008912, &(0x7f0000000000)="11dca5055e0acfec7be070") 12:13:45 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) 12:13:45 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) 12:13:45 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) 12:13:45 executing program 0: openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)={'vet\x00\x00\x96T\x00\x00\x00\x00\x00\xbdh \x00', 0x402}) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000180)={'vd\x7f\x00\x16\x00\xf9V\xdbZ\xdd\x91\x80\xd2{\x00', 0x43732e5398417f1e}) close(r0) 12:13:45 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x6, 0x1100082) r1 = memfd_create(&(0x7f0000000080)='t\bnu\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00', 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000340)=[{&(0x7f0000001140)='\'', 0x1}], 0x1, 0x1081804) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendfile(r0, r0, 0x0, 0x200000d) ioctl$LOOP_CLR_FD(r0, 0x4c01) syz_genetlink_get_family_id$tipc(0x0) dup3(r1, r0, 0x0) [ 1045.599988] [] warn_alloc_failed.cold+0x78/0x99 [ 1045.600000] [] ? zone_watermark_ok_safe+0x290/0x290 [ 1045.600009] [] ? sel_write_load+0x9e/0xf90 12:13:45 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) 12:13:45 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) 12:13:45 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) [ 1045.600020] [] __vmalloc_node_range+0x365/0x650 [ 1045.600032] [] ? check_preemption_disabled+0x3c/0x200 [ 1045.600040] [] ? check_preemption_disabled+0x3c/0x200 12:13:45 executing program 0: openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)={'vet\x00\x00\x96T\x00\x00\x00\x00\x00\xbdh \x00', 0x402}) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000180)={'vd\x7f\x00\x16\x00\xf9V\xdbZ\xdd\x91\x80\xd2{\x00', 0x43732e5398417f1e}) close(r0) 12:13:45 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x6, 0x1100082) r1 = memfd_create(&(0x7f0000000080)='t\bnu\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00', 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000340)=[{&(0x7f0000001140)='\'', 0x1}], 0x1, 0x1081804) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendfile(r0, r0, 0x0, 0x200000d) ioctl$LOOP_CLR_FD(r0, 0x4c01) syz_genetlink_get_family_id$tipc(0x0) dup3(r1, r0, 0x0) 12:13:45 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) [ 1045.600048] [] ? task_has_security+0x130/0x270 [ 1045.600055] [] vmalloc+0x5c/0x70 [ 1045.600064] [] ? sel_write_load+0x119/0xf90 [ 1045.600072] [] sel_write_load+0x119/0xf90 [ 1045.600081] [] ? sel_read_bool+0x240/0x240 [ 1045.600090] [] ? trace_hardirqs_on+0x10/0x10 [ 1045.600099] [] __vfs_write+0x116/0x3d0 [ 1045.600106] [] ? sel_read_bool+0x240/0x240 [ 1045.600114] [] ? __vfs_read+0x3c0/0x3c0 [ 1045.600122] [] ? check_preemption_disabled+0x3c/0x200 [ 1045.600129] [] ? check_preemption_disabled+0x3c/0x200 [ 1045.600138] [] ? rcu_read_lock_sched_held+0x10b/0x130 [ 1045.600145] [] ? rcu_sync_lockdep_assert+0x73/0xb0 [ 1045.600154] [] ? __sb_start_write+0x14f/0x310 [ 1045.600163] [] vfs_write+0x182/0x4e0 [ 1045.600171] [] SyS_write+0xdc/0x1c0 [ 1045.600177] [] ? SyS_read+0x1c0/0x1c0 [ 1045.600187] [] ? lockdep_sys_exit_thunk+0x12/0x14 [ 1045.600197] [] entry_SYSCALL_64_fastpath+0x1e/0x9a [ 1045.600199] Mem-Info: [ 1045.600226] active_anon:70006 inactive_anon:5683 isolated_anon:0 [ 1045.600226] active_file:11182 inactive_file:11777 isolated_file:0 [ 1045.600226] unevictable:0 dirty:47 writeback:0 unstable:0 [ 1045.600226] slab_reclaimable:4381 slab_unreclaimable:63074 [ 1045.600226] mapped:58953 shmem:8154 pagetables:8478 bounce:0 [ 1045.600226] free:1408296 free_pcp:324 free_cma:0 [ 1045.600260] DMA32 free:2575920kB min:4696kB low:5868kB high:7044kB active_anon:127532kB inactive_anon:10224kB active_file:19752kB inactive_file:20788kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:3145324kB managed:3021976kB mlocked:0kB dirty:8kB writeback:0kB mapped:107832kB shmem:14308kB slab_reclaimable:8324kB slab_unreclaimable:115260kB kernel_stack:6272kB pagetables:15072kB unstable:0kB bounce:0kB free_pcp:700kB local_pcp:152kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no [ 1045.600268] lowmem_reserve[]: 0 3504 3504 12:13:45 executing program 2: openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r0 = creat(&(0x7f0000000700)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x40000006100) ftruncate(r0, 0x208203) r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000008000/0x600000)=nil, 0x600000, 0x800002, 0x11, r1, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r2, &(0x7f0000000180)={0xa, 0x4e24, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) sendmmsg(r2, &(0x7f00000092c0), 0x4ff, 0x0) r3 = open(&(0x7f00000003c0)='./bus\x00', 0x0, 0x0) sendfile(r0, r3, 0x0, 0x8000fffffffe) r4 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r4, 0x1000008912, &(0x7f0000000000)="11dca5055e0acfec7be070") 12:13:45 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) 12:13:45 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) 12:13:45 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) 12:13:45 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x6, 0x1100082) r1 = memfd_create(&(0x7f0000000080)='t\bnu\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00', 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000340)=[{&(0x7f0000001140)='\'', 0x1}], 0x1, 0x1081804) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendfile(r0, r0, 0x0, 0x200000d) ioctl$LOOP_CLR_FD(r0, 0x4c01) syz_genetlink_get_family_id$tipc(0x0) dup3(r1, r0, 0x0) 12:13:45 executing program 0: openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)={'vet\x00\x00\x96T\x00\x00\x00\x00\x00\xbdh \x00', 0x402}) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000180)={'vd\x7f\x00\x16\x00\xf9V\xdbZ\xdd\x91\x80\xd2{\x00', 0x43732e5398417f1e}) close(r0) [ 1045.600300] Normal free:3057264kB min:5580kB low:6972kB high:8368kB active_anon:152492kB inactive_anon:12508kB active_file:24976kB inactive_file:26320kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:4718592kB managed:3588764kB mlocked:0kB dirty:180kB writeback:0kB mapped:127980kB shmem:18308kB slab_reclaimable:9200kB slab_unreclaimable:137036kB kernel_stack:7904kB pagetables:18840kB unstable:0kB bounce:0kB free_pcp:596kB local_pcp:252kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no [ 1045.600310] lowmem_reserve[]: 0 0 0 12:13:45 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) 12:13:46 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) 12:13:46 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) [ 1045.600365] DMA32: 356*4kB (UME) 294*8kB (UME) 275*16kB (UME) 173*32kB (UME) 75*64kB (UME) 26*128kB (UME) 11*256kB (UM) 5*512kB (M) 1*1024kB (E) 2*2048kB (UE) 621*4096kB (M) = 2575952kB [ 1045.600415] Normal: 438*4kB (UM) 469*8kB (UME) 323*16kB (UME) 208*32kB (UM) 99*64kB (UME) 32*128kB (UME) 10*256kB (UM) 8*512kB (UME) 4*1024kB (M) 4*2048kB (UME) 735*4096kB (M) = 3057264kB 12:13:46 executing program 0: openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)={'vet\x00\x00\x96T\x00\x00\x00\x00\x00\xbdh \x00', 0x402}) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000180)={'vd\x7f\x00\x16\x00\xf9V\xdbZ\xdd\x91\x80\xd2{\x00', 0x43732e5398417f1e}) close(r0) 12:13:46 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) 12:13:46 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) [ 1045.600418] 31112 total pagecache pages [ 1045.600422] 0 pages in swap cache [ 1045.600428] Swap cache stats: add 0, delete 0, find 0/0 [ 1045.600432] Free swap = 0kB [ 1045.600442] Total swap = 0kB [ 1045.600445] 1965979 pages RAM [ 1045.600449] 0 pages HighMem/MovableOnly [ 1045.600452] 313294 pages reserved [ 1045.604696] binder_alloc: 15480: binder_alloc_buf, no vma [ 1045.604740] binder: 15480:15488 transaction failed 29189/-3, size 0-0 line 3137 [ 1045.604879] binder: undelivered TRANSACTION_ERROR: 29189 [ 1045.707812] vmalloc: allocation failure: 0 bytes [ 1045.707818] syz-executor.4: page allocation failure: order:0, mode:0x24000c2 [ 1045.707828] CPU: 1 PID: 15500 Comm: syz-executor.4 Not tainted 4.4.174+ #4 [ 1045.707842] 0000000000000000 38eec930256a2337 ffff8800a63bf9f0 ffffffff81aad1a1 [ 1045.707854] 1ffff10014c77f41 ffff8801bfd3af80 00000000024000c2 0000000000000000 [ 1045.707864] ffffffff82895080 ffff8800a63bfb00 ffffffff8148c0cb ffffffff00000001 [ 1045.707866] Call Trace: [ 1045.707880] [] dump_stack+0xc1/0x120 [ 1045.707893] [] warn_alloc_failed.cold+0x78/0x99 [ 1045.707904] [] ? zone_watermark_ok_safe+0x290/0x290 [ 1045.707913] [] ? sel_write_load+0x9e/0xf90 [ 1045.707922] [] __vmalloc_node_range+0x365/0x650 [ 1045.707931] [] ? check_preemption_disabled+0x3c/0x200 [ 1045.707940] [] ? check_preemption_disabled+0x3c/0x200 [ 1045.707951] [] ? task_has_security+0x130/0x270 [ 1045.707959] [] vmalloc+0x5c/0x70 [ 1045.707970] [] ? sel_write_load+0x119/0xf90 [ 1045.707977] [] sel_write_load+0x119/0xf90 [ 1045.707987] [] ? sel_read_bool+0x240/0x240 [ 1045.707997] [] ? trace_hardirqs_on+0x10/0x10 [ 1045.708005] [] __vfs_write+0x116/0x3d0 [ 1045.708012] [] ? sel_read_bool+0x240/0x240 [ 1045.708019] [] ? __vfs_read+0x3c0/0x3c0 [ 1045.708027] [] ? check_preemption_disabled+0x3c/0x200 12:13:46 executing program 2: openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r0 = creat(&(0x7f0000000700)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x40000006100) ftruncate(r0, 0x208203) r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000008000/0x600000)=nil, 0x600000, 0x800002, 0x11, r1, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r2, &(0x7f0000000180)={0xa, 0x4e24, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) sendmmsg(r2, &(0x7f00000092c0), 0x4ff, 0x0) r3 = open(&(0x7f00000003c0)='./bus\x00', 0x0, 0x0) sendfile(r0, r3, 0x0, 0x8000fffffffe) r4 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r4, 0x1000008912, &(0x7f0000000000)="11dca5055e0acfec7be070") 12:13:46 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) 12:13:46 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x6, 0x1100082) r1 = memfd_create(&(0x7f0000000080)='t\bnu\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00', 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000340)=[{&(0x7f0000001140)='\'', 0x1}], 0x1, 0x1081804) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendfile(r0, r0, 0x0, 0x200000d) ioctl$LOOP_CLR_FD(r0, 0x4c01) syz_genetlink_get_family_id$tipc(0x0) dup3(r1, r0, 0x0) 12:13:46 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) 12:13:46 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) 12:13:46 executing program 0: openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)={'vet\x00\x00\x96T\x00\x00\x00\x00\x00\xbdh \x00', 0x402}) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000180)={'vd\x7f\x00\x16\x00\xf9V\xdbZ\xdd\x91\x80\xd2{\x00', 0x43732e5398417f1e}) close(r0) [ 1045.708035] [] ? check_preemption_disabled+0x3c/0x200 [ 1045.708044] [] ? rcu_read_lock_sched_held+0x10b/0x130 [ 1045.708051] [] ? rcu_sync_lockdep_assert+0x73/0xb0 12:13:46 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) 12:13:46 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) 12:13:46 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) [ 1045.708060] [] ? __sb_start_write+0x14f/0x310 [ 1045.708068] [] vfs_write+0x182/0x4e0 12:13:46 executing program 0: openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)={'vet\x00\x00\x96T\x00\x00\x00\x00\x00\xbdh \x00', 0x402}) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000180)={'vd\x7f\x00\x16\x00\xf9V\xdbZ\xdd\x91\x80\xd2{\x00', 0x43732e5398417f1e}) close(r0) [ 1045.708078] [] SyS_write+0xdc/0x1c0 [ 1045.708087] [] ? SyS_read+0x1c0/0x1c0 [ 1045.708098] [] ? lockdep_sys_exit_thunk+0x12/0x14 12:13:46 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) 12:13:46 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) [ 1045.708110] [] entry_SYSCALL_64_fastpath+0x1e/0x9a [ 1045.708113] Mem-Info: [ 1045.708137] active_anon:70106 inactive_anon:5933 isolated_anon:0 [ 1045.708137] active_file:11182 inactive_file:11777 isolated_file:0 [ 1045.708137] unevictable:0 dirty:47 writeback:0 unstable:0 [ 1045.708137] slab_reclaimable:4381 slab_unreclaimable:63018 [ 1045.708137] mapped:58953 shmem:8413 pagetables:8552 bounce:0 [ 1045.708137] free:1407895 free_pcp:302 free_cma:0 [ 1045.708176] DMA32 free:2575220kB min:4696kB low:5868kB high:7044kB active_anon:127832kB inactive_anon:10224kB active_file:19752kB inactive_file:20788kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:3145324kB managed:3021976kB mlocked:0kB dirty:8kB writeback:0kB mapped:107832kB shmem:14308kB slab_reclaimable:8324kB slab_unreclaimable:115260kB kernel_stack:6272kB pagetables:15368kB unstable:0kB bounce:0kB free_pcp:684kB local_pcp:304kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no [ 1045.708186] lowmem_reserve[]: 0 3504 3504 [ 1045.708220] Normal free:3056360kB min:5580kB low:6972kB high:8368kB active_anon:152592kB inactive_anon:13508kB active_file:24976kB inactive_file:26320kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:4718592kB managed:3588764kB mlocked:0kB dirty:180kB writeback:0kB mapped:127980kB shmem:19344kB slab_reclaimable:9200kB slab_unreclaimable:136812kB kernel_stack:7904kB pagetables:18840kB unstable:0kB bounce:0kB free_pcp:524kB local_pcp:312kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no [ 1045.708229] lowmem_reserve[]: 0 0 0 [ 1045.708284] DMA32: 201*4kB (UME) 293*8kB (UME) 274*16kB (UME) 174*32kB (UME) 75*64kB (UME) 25*128kB (UME) 11*256kB (UM) 5*512kB (M) 1*1024kB (E) 2*2048kB (UE) 621*4096kB (M) = 2575212kB [ 1045.708339] Normal: 260*4kB (UM) 429*8kB (UME) 323*16kB (UME) 214*32kB (UM) 99*64kB (UME) 32*128kB (UME) 10*256kB (UM) 8*512kB (UME) 4*1024kB (M) 4*2048kB (UME) 735*4096kB (M) = 3056424kB [ 1045.708341] 31371 total pagecache pages [ 1045.708344] 0 pages in swap cache [ 1045.708350] Swap cache stats: add 0, delete 0, find 0/0 [ 1045.708353] Free swap = 0kB [ 1045.708355] Total swap = 0kB [ 1045.708358] 1965979 pages RAM [ 1045.708362] 0 pages HighMem/MovableOnly [ 1045.708365] 313294 pages reserved 12:13:47 executing program 2: openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r0 = creat(&(0x7f0000000700)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x40000006100) ftruncate(r0, 0x208203) r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000008000/0x600000)=nil, 0x600000, 0x800002, 0x11, r1, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r2, &(0x7f0000000180)={0xa, 0x4e24, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) sendmmsg(r2, &(0x7f00000092c0), 0x4ff, 0x0) r3 = open(&(0x7f00000003c0)='./bus\x00', 0x0, 0x0) sendfile(r0, r3, 0x0, 0x8000fffffffe) r4 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r4, 0x1000008912, &(0x7f0000000000)="11dca5055e0acfec7be070") 12:13:47 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) 12:13:47 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x6, 0x1100082) r1 = memfd_create(&(0x7f0000000080)='t\bnu\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00', 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000340)=[{&(0x7f0000001140)='\'', 0x1}], 0x1, 0x1081804) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendfile(r0, r0, 0x0, 0x200000d) ioctl$LOOP_CLR_FD(r0, 0x4c01) syz_genetlink_get_family_id$tipc(0x0) dup3(r1, r0, 0x0) 12:13:47 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) 12:13:47 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) 12:13:47 executing program 0: openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)={'vet\x00\x00\x96T\x00\x00\x00\x00\x00\xbdh \x00', 0x402}) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000180)={'vd\x7f\x00\x16\x00\xf9V\xdbZ\xdd\x91\x80\xd2{\x00', 0x43732e5398417f1e}) close(r0) 12:13:47 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) 12:13:47 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) [ 1045.734075] binder: 15499:15504 transaction failed 29189/-22, size 0-0 line 3014 [ 1045.734238] binder: undelivered TRANSACTION_ERROR: 29189 [ 1045.801671] vmalloc: allocation failure: 0 bytes 12:13:47 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) 12:13:47 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) 12:13:47 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) ** 31 printk messages dropped ** [ 1045.801975] [] entry_SYSCALL_64_fastpath+0x1e/0x9a 12:13:47 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x6, 0x1100082) r1 = memfd_create(&(0x7f0000000080)='t\bnu\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00', 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000340)=[{&(0x7f0000001140)='\'', 0x1}], 0x1, 0x1081804) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendfile(r0, r0, 0x0, 0x200000d) ioctl$LOOP_CLR_FD(r0, 0x4c01) syz_genetlink_get_family_id$tipc(0x0) dup3(r1, r0, 0x0) ** 2 printk messages dropped ** [ 1045.807326] DMA32 free:2574668kB min:4696kB low:5868kB high:7044kB active_anon:127532kB inactive_anon:10724kB active_file:19752kB inactive_file:20788kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:3145324kB managed:3021976kB mlocked:0kB dirty:8kB writeback:0kB mapped:107832kB shmem:14752kB slab_reclaimable:8324kB slab_unreclaimable:115492kB kernel_stack:6272kB pagetables:15220kB unstable:0kB bounce:0kB free_pcp:860kB local_pcp:480kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no ** 47 printk messages dropped ** [ 1046.492627] [] SyS_write+0xdc/0x1c0 [ 1046.492635] [] ? SyS_read+0x1c0/0x1c0 [ 1046.492646] [] ? lockdep_sys_exit_thunk+0x12/0x14 [ 1046.492656] [] entry_SYSCALL_64_fastpath+0x1e/0x9a [ 1046.492659] Mem-Info: [ 1046.492685] active_anon:70032 inactive_anon:5725 isolated_anon:0 [ 1046.492685] active_file:11182 inactive_file:11777 isolated_file:0 [ 1046.492685] unevictable:0 dirty:47 writeback:0 unstable:0 [ 1046.492685] slab_reclaimable:4381 slab_unreclaimable:62994 [ 1046.492685] mapped:58964 shmem:8152 pagetables:8478 bounce:0 [ 1046.492685] free:1408083 free_pcp:572 free_cma:0 [ 1046.492722] DMA32 free:2574692kB min:4696kB low:5868kB high:7044kB active_anon:127416kB inactive_anon:10264kB active_file:19752kB inactive_file:20788kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:3145324kB managed:3021976kB mlocked:0kB dirty:8kB writeback:0kB mapped:107824kB shmem:14252kB slab_reclaimable:8324kB slab_unreclaimable:115712kB kernel_stack:6304kB pagetables:15440kB unstable:0kB bounce:0kB free_pcp:1160kB local_pcp:496kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no [ 1046.492731] lowmem_reserve[]: 0 3504 3504 [ 1046.492757] Normal free:3057640kB min:5580kB low:6972kB high:8368kB active_anon:152712kB inactive_anon:12636kB active_file:24976kB inactive_file:26320kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:4718592kB managed:3588764kB mlocked:0kB dirty:180kB writeback:0kB mapped:128032kB shmem:18356kB slab_reclaimable:9200kB slab_unreclaimable:136264kB kernel_stack:7872kB pagetables:18472kB unstable:0kB bounce:0kB free_pcp:1128kB local_pcp:436kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no [ 1046.492766] lowmem_reserve[]: 0 0 0 [ 1046.492827] DMA32: 127*4kB (UME) 295*8kB (UME) 275*16kB (UME) 163*32kB (UME) 75*64kB (UME) 26*128kB (UME) 11*256kB (UM) 5*512kB (M) 1*1024kB (E) 2*2048kB (UE) 621*4096kB (M) = 2574724kB [ 1046.492879] Normal: 488*4kB (UM) 408*8kB (UME) 321*16kB (UME) 231*32kB (UM) 98*64kB (UME) 32*128kB (UME) 10*256kB (UM) 8*512kB (UME) 4*1024kB (M) 4*2048kB (UME) 735*4096kB (M) = 3057616kB [ 1046.492882] 31110 total pagecache pages [ 1046.492885] 0 pages in swap cache [ 1046.492890] Swap cache stats: add 0, delete 0, find 0/0 [ 1046.492893] Free swap = 0kB [ 1046.492895] Total swap = 0kB [ 1046.492898] 1965979 pages RAM [ 1046.492900] 0 pages HighMem/MovableOnly [ 1046.492903] 313294 pages reserved [ 1046.591279] vmalloc: allocation failure: 0 bytes [ 1046.591285] syz-executor.4: page allocation failure: order:0, mode:0x24000c2 [ 1046.591294] CPU: 1 PID: 15547 Comm: syz-executor.4 Not tainted 4.4.174+ #4 [ 1046.591307] 0000000000000000 1fd37d5f920ba44f ffff8800a1eff9f0 ffffffff81aad1a1 [ 1046.591317] 1ffff100143dff41 ffff8801c04817c0 00000000024000c2 0000000000000000 [ 1046.591326] ffffffff82895080 ffff8800a1effb00 ffffffff8148c0cb ffffffff00000001 [ 1046.591329] Call Trace: [ 1046.591344] [] dump_stack+0xc1/0x120 [ 1046.591357] [] warn_alloc_failed.cold+0x78/0x99 [ 1046.591368] [] ? zone_watermark_ok_safe+0x290/0x290 [ 1046.591378] [] ? sel_write_load+0x9e/0xf90 [ 1046.591387] [] __vmalloc_node_range+0x365/0x650 [ 1046.591395] [] ? check_preemption_disabled+0x3c/0x200 [ 1046.591403] [] ? check_preemption_disabled+0x3c/0x200 [ 1046.591411] [] ? task_has_security+0x130/0x270 [ 1046.591418] [] vmalloc+0x5c/0x70 [ 1046.591425] [] ? sel_write_load+0x119/0xf90 [ 1046.591439] [] sel_write_load+0x119/0xf90 [ 1046.591449] [] ? sel_read_bool+0x240/0x240 [ 1046.591460] [] ? trace_hardirqs_on+0x10/0x10 [ 1046.591470] [] __vfs_write+0x116/0x3d0 [ 1046.591478] [] ? sel_read_bool+0x240/0x240 [ 1046.591490] [] ? __vfs_read+0x3c0/0x3c0 [ 1046.591499] [] ? check_preemption_disabled+0x3c/0x200 [ 1046.591508] [] ? check_preemption_disabled+0x3c/0x200 [ 1046.591520] [] ? rcu_read_lock_sched_held+0x10b/0x130 12:13:48 executing program 2: openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r0 = creat(&(0x7f0000000700)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x40000006100) ftruncate(r0, 0x208203) r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000008000/0x600000)=nil, 0x600000, 0x800002, 0x11, r1, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r2, &(0x7f0000000180)={0xa, 0x4e24, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) sendmmsg(r2, &(0x7f00000092c0), 0x4ff, 0x0) r3 = open(&(0x7f00000003c0)='./bus\x00', 0x0, 0x0) sendfile(r0, r3, 0x0, 0x8000fffffffe) r4 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r4, 0x1000008912, &(0x7f0000000000)="11dca5055e0acfec7be070") 12:13:48 executing program 0: openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)={'vet\x00\x00\x96T\x00\x00\x00\x00\x00\xbdh \x00', 0x402}) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000180)={'vd\x7f\x00\x16\x00\xf9V\xdbZ\xdd\x91\x80\xd2{\x00', 0x43732e5398417f1e}) close(r0) 12:13:48 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) 12:13:48 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) 12:13:48 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) 12:13:48 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x6, 0x1100082) r1 = memfd_create(&(0x7f0000000080)='t\bnu\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00', 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000340)=[{&(0x7f0000001140)='\'', 0x1}], 0x1, 0x1081804) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendfile(r0, r0, 0x0, 0x200000d) ioctl$LOOP_CLR_FD(r0, 0x4c01) syz_genetlink_get_family_id$tipc(0x0) dup3(r1, r0, 0x0) [ 1046.591528] [] ? rcu_sync_lockdep_assert+0x73/0xb0 [ 1046.591536] [] ? __sb_start_write+0x14f/0x310 [ 1046.591544] [] vfs_write+0x182/0x4e0 12:13:48 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) 12:13:48 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) 12:13:48 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) ** 2 printk messages dropped ** [ 1046.591568] [] ? lockdep_sys_exit_thunk+0x12/0x14 12:13:48 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) [ 1046.591578] [] entry_SYSCALL_64_fastpath+0x1e/0x9a 12:13:48 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x6, 0x1100082) r1 = memfd_create(&(0x7f0000000080)='t\bnu\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00', 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000340)=[{&(0x7f0000001140)='\'', 0x1}], 0x1, 0x1081804) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendfile(r0, r0, 0x0, 0x200000d) ioctl$LOOP_CLR_FD(r0, 0x4c01) syz_genetlink_get_family_id$tipc(0x0) dup3(r1, r0, 0x0) 12:13:48 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) ** 49 printk messages dropped ** [ 1047.340170] [] ? rcu_sync_lockdep_assert+0x73/0xb0 ** 47 printk messages dropped ** [ 1049.839614] [] dump_stack+0xc1/0x120 [ 1049.839626] [] warn_alloc_failed.cold+0x78/0x99 [ 1049.839636] [] ? zone_watermark_ok_safe+0x290/0x290 [ 1049.839644] [] ? sel_write_load+0x9e/0xf90 [ 1049.839653] [] __vmalloc_node_range+0x365/0x650 [ 1049.839661] [] ? check_preemption_disabled+0x3c/0x200 [ 1049.839669] [] ? check_preemption_disabled+0x3c/0x200 [ 1049.839676] [] ? task_has_security+0x130/0x270 [ 1049.839683] [] vmalloc+0x5c/0x70 [ 1049.839690] [] ? sel_write_load+0x119/0xf90 [ 1049.839697] [] sel_write_load+0x119/0xf90 [ 1049.839705] [] ? sel_read_bool+0x240/0x240 [ 1049.839714] [] ? trace_hardirqs_on+0x10/0x10 [ 1049.839721] [] __vfs_write+0x116/0x3d0 [ 1049.839729] [] ? sel_read_bool+0x240/0x240 [ 1049.839736] [] ? __vfs_read+0x3c0/0x3c0 [ 1049.839744] [] ? check_preemption_disabled+0x3c/0x200 [ 1049.839751] [] ? check_preemption_disabled+0x3c/0x200 [ 1049.839760] [] ? rcu_read_lock_sched_held+0x10b/0x130 [ 1049.839768] [] ? rcu_sync_lockdep_assert+0x73/0xb0 [ 1049.839776] [] ? __sb_start_write+0x14f/0x310 [ 1049.839784] [] vfs_write+0x182/0x4e0 [ 1049.839791] [] SyS_write+0xdc/0x1c0 [ 1049.839798] [] ? SyS_read+0x1c0/0x1c0 [ 1049.839808] [] ? lockdep_sys_exit_thunk+0x12/0x14 [ 1049.839817] [] entry_SYSCALL_64_fastpath+0x1e/0x9a [ 1049.839821] Mem-Info: [ 1049.839846] active_anon:70023 inactive_anon:5700 isolated_anon:0 [ 1049.839846] active_file:11182 inactive_file:11777 isolated_file:0 [ 1049.839846] unevictable:0 dirty:47 writeback:0 unstable:0 [ 1049.839846] slab_reclaimable:4381 slab_unreclaimable:63045 [ 1049.839846] mapped:58979 shmem:8152 pagetables:8502 bounce:0 [ 1049.839846] free:1408219 free_pcp:505 free_cma:0 [ 1049.839883] DMA32 free:2575196kB min:4696kB low:5868kB high:7044kB active_anon:127536kB inactive_anon:10276kB active_file:19752kB inactive_file:20788kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:3145324kB managed:3021976kB mlocked:0kB dirty:8kB writeback:0kB mapped:107824kB shmem:14312kB slab_reclaimable:8324kB slab_unreclaimable:115612kB kernel_stack:6336kB pagetables:15304kB unstable:0kB bounce:0kB free_pcp:1128kB local_pcp:412kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no [ 1049.839892] lowmem_reserve[]: 0 3504 3504 [ 1049.839922] Normal free:3057680kB min:5580kB low:6972kB high:8368kB active_anon:152556kB inactive_anon:12524kB active_file:24976kB inactive_file:26320kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:4718592kB managed:3588764kB mlocked:0kB dirty:180kB writeback:0kB mapped:128092kB shmem:18296kB slab_reclaimable:9200kB slab_unreclaimable:136568kB kernel_stack:7936kB pagetables:18704kB unstable:0kB bounce:0kB free_pcp:892kB local_pcp:300kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no [ 1049.839930] lowmem_reserve[]: 0 0 0 [ 1049.839997] DMA32: 87*4kB (UME) 256*8kB (UME) 280*16kB (UME) 190*32kB (UME) 75*64kB (UME) 26*128kB (UME) 11*256kB (UM) 5*512kB (M) 1*1024kB (E) 2*2048kB (UE) 621*4096kB (M) = 2575196kB 12:13:49 executing program 2: openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r0 = creat(&(0x7f0000000700)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x40000006100) ftruncate(r0, 0x208203) r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000008000/0x600000)=nil, 0x600000, 0x800002, 0x11, r1, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r2, &(0x7f0000000180)={0xa, 0x4e24, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) sendmmsg(r2, &(0x7f00000092c0), 0x4ff, 0x0) r3 = open(&(0x7f00000003c0)='./bus\x00', 0x0, 0x0) sendfile(r0, r3, 0x0, 0x8000fffffffe) r4 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r4, 0x1000008912, &(0x7f0000000000)="11dca5055e0acfec7be070") 12:13:49 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) 12:13:49 executing program 0: openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)={'vet\x00\x00\x96T\x00\x00\x00\x00\x00\xbdh \x00', 0x402}) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000180)={'vd\x7f\x00\x16\x00\xf9V\xdbZ\xdd\x91\x80\xd2{\x00', 0x43732e5398417f1e}) close(r0) 12:13:49 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) 12:13:49 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) 12:13:49 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x6, 0x1100082) r1 = memfd_create(&(0x7f0000000080)='t\bnu\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00', 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000340)=[{&(0x7f0000001140)='\'', 0x1}], 0x1, 0x1081804) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendfile(r0, r0, 0x0, 0x200000d) ioctl$LOOP_CLR_FD(r0, 0x4c01) syz_genetlink_get_family_id$tipc(0x0) dup3(r1, r0, 0x0) [ 1049.840050] Normal: 616*4kB (UM) 410*8kB (UME) 326*16kB (UME) 210*32kB (UM) 98*64kB (UME) 33*128kB (UME) 10*256kB (UM) 8*512kB (UME) 4*1024kB (M) 4*2048kB (UME) 735*4096kB (M) = 3057680kB [ 1049.840055] 31110 total pagecache pages [ 1049.840058] 0 pages in swap cache [ 1049.840063] Swap cache stats: add 0, delete 0, find 0/0 [ 1049.840065] Free swap = 0kB [ 1049.840067] Total swap = 0kB [ 1049.840070] 1965979 pages RAM 12:13:49 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) [ 1049.840073] 0 pages HighMem/MovableOnly 12:13:49 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) 12:13:49 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) ** 11 printk messages dropped ** [ 1049.899284] [] warn_alloc_failed.cold+0x78/0x99 [ 1049.899304] [] ? zone_watermark_ok_safe+0x290/0x290 12:13:49 executing program 0: openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)={'vet\x00\x00\x96T\x00\x00\x00\x00\x00\xbdh \x00', 0x402}) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000180)={'vd\x7f\x00\x16\x00\xf9V\xdbZ\xdd\x91\x80\xd2{\x00', 0x43732e5398417f1e}) close(r0) 12:13:49 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) 12:13:49 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x6, 0x1100082) r1 = memfd_create(&(0x7f0000000080)='t\bnu\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00', 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000340)=[{&(0x7f0000001140)='\'', 0x1}], 0x1, 0x1081804) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendfile(r0, r0, 0x0, 0x200000d) ioctl$LOOP_CLR_FD(r0, 0x4c01) syz_genetlink_get_family_id$tipc(0x0) dup3(r1, r0, 0x0) [ 1049.899320] [] ? sel_write_load+0x9e/0xf90 ** 48 printk messages dropped ** [ 1049.978783] [] ? sel_write_load+0x9e/0xf90 [ 1049.978794] [] __vmalloc_node_range+0x365/0x650 [ 1049.978806] [] ? check_preemption_disabled+0x3c/0x200 [ 1049.978815] [] ? check_preemption_disabled+0x3c/0x200 [ 1049.978825] [] ? task_has_security+0x130/0x270 [ 1049.978839] [] vmalloc+0x5c/0x70 [ 1049.978849] [] ? sel_write_load+0x119/0xf90 [ 1049.978857] [] sel_write_load+0x119/0xf90 [ 1049.978867] [] ? sel_read_bool+0x240/0x240 [ 1049.978878] [] ? trace_hardirqs_on+0x10/0x10 [ 1049.978887] [] __vfs_write+0x116/0x3d0 [ 1049.978895] [] ? sel_read_bool+0x240/0x240 [ 1049.978904] [] ? __vfs_read+0x3c0/0x3c0 [ 1049.978913] [] ? check_preemption_disabled+0x3c/0x200 [ 1049.978921] [] ? check_preemption_disabled+0x3c/0x200 [ 1049.978930] [] ? rcu_read_lock_sched_held+0x10b/0x130 [ 1049.978947] [] ? rcu_sync_lockdep_assert+0x73/0xb0 [ 1049.978959] [] ? __sb_start_write+0x14f/0x310 [ 1049.978967] [] vfs_write+0x182/0x4e0 [ 1049.978977] [] SyS_write+0xdc/0x1c0 [ 1049.978985] [] ? SyS_read+0x1c0/0x1c0 [ 1049.978998] [] ? lockdep_sys_exit_thunk+0x12/0x14 [ 1049.979008] [] entry_SYSCALL_64_fastpath+0x1e/0x9a [ 1049.983450] Mem-Info: [ 1049.983477] active_anon:70098 inactive_anon:5950 isolated_anon:0 [ 1049.983477] active_file:11182 inactive_file:11777 isolated_file:0 [ 1049.983477] unevictable:0 dirty:47 writeback:0 unstable:0 [ 1049.983477] slab_reclaimable:4381 slab_unreclaimable:62921 [ 1049.983477] mapped:58979 shmem:8448 pagetables:8576 bounce:0 [ 1049.983477] free:1408058 free_pcp:300 free_cma:0 [ 1049.983512] DMA32 free:2575096kB min:4696kB low:5868kB high:7044kB active_anon:127636kB inactive_anon:10676kB active_file:19752kB inactive_file:20788kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:3145324kB managed:3021976kB mlocked:0kB dirty:8kB writeback:0kB mapped:107824kB shmem:14756kB slab_reclaimable:8324kB slab_unreclaimable:115360kB kernel_stack:6336kB pagetables:15452kB unstable:0kB bounce:0kB free_pcp:692kB local_pcp:460kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no [ 1049.983522] lowmem_reserve[]: 0 3504 3504 [ 1049.983556] Normal free:3057136kB min:5580kB low:6972kB high:8368kB active_anon:152756kB inactive_anon:13124kB active_file:24976kB inactive_file:26320kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:4718592kB managed:3588764kB mlocked:0kB dirty:180kB writeback:0kB mapped:128092kB shmem:19036kB slab_reclaimable:9200kB slab_unreclaimable:136324kB kernel_stack:7936kB pagetables:18852kB unstable:0kB bounce:0kB free_pcp:508kB local_pcp:228kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no [ 1049.983565] lowmem_reserve[]: 0 0 0 [ 1049.983623] DMA32: 66*4kB (UME) 250*8kB (UME) 280*16kB (UME) 194*32kB (UME) 76*64kB (UME) 26*128kB (UME) 11*256kB (UM) 5*512kB (M) 1*1024kB (E) 2*2048kB (UE) 621*4096kB (M) = 2575256kB [ 1049.983683] Normal: 451*4kB (UM) 415*8kB (UME) 325*16kB (UME) 213*32kB (UM) 98*64kB (UME) 32*128kB (UME) 10*256kB (UM) 8*512kB (UME) 4*1024kB (M) 4*2048kB (UME) 735*4096kB (M) = 3057012kB [ 1049.983686] 31406 total pagecache pages [ 1049.983690] 0 pages in swap cache [ 1049.983695] Swap cache stats: add 0, delete 0, find 0/0 [ 1049.983697] Free swap = 0kB [ 1049.983700] Total swap = 0kB [ 1049.983703] 1965979 pages RAM [ 1049.983706] 0 pages HighMem/MovableOnly [ 1049.983708] 313294 pages reserved 12:13:50 executing program 2: openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r0 = creat(&(0x7f0000000700)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x40000006100) ftruncate(r0, 0x208203) r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000008000/0x600000)=nil, 0x600000, 0x800002, 0x11, r1, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r2, &(0x7f0000000180)={0xa, 0x4e24, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) sendmmsg(r2, &(0x7f00000092c0), 0x4ff, 0x0) r3 = open(&(0x7f00000003c0)='./bus\x00', 0x0, 0x0) sendfile(r0, r3, 0x0, 0x8000fffffffe) r4 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r4, 0x1000008912, &(0x7f0000000000)="11dca5055e0acfec7be070") 12:13:50 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) 12:13:50 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) 12:13:50 executing program 0: openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)={'vet\x00\x00\x96T\x00\x00\x00\x00\x00\xbdh \x00', 0x402}) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000180)={'vd\x7f\x00\x16\x00\xf9V\xdbZ\xdd\x91\x80\xd2{\x00', 0x43732e5398417f1e}) close(r0) 12:13:50 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) 12:13:50 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x6, 0x1100082) r1 = memfd_create(&(0x7f0000000080)='t\bnu\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00', 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000340)=[{&(0x7f0000001140)='\'', 0x1}], 0x1, 0x1081804) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendfile(r0, r0, 0x0, 0x200000d) ioctl$LOOP_CLR_FD(r0, 0x4c01) syz_genetlink_get_family_id$tipc(0x0) dup3(r1, r0, 0x0) [ 1049.992631] binder: 15719:15724 transaction failed 29189/-22, size 0-0 line 3014 [ 1049.992882] binder: undelivered TRANSACTION_ERROR: 29189 [ 1050.705926] binder: 15742:15749 transaction failed 29189/-22, size 0-0 line 3014 12:13:50 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) 12:13:50 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) 12:13:50 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) [ 1050.706060] binder: undelivered TRANSACTION_ERROR: 29189 [ 1050.713381] vmalloc: allocation failure: 0 bytes 12:13:50 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) 12:13:50 executing program 0: openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)={'vet\x00\x00\x96T\x00\x00\x00\x00\x00\xbdh \x00', 0x402}) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000180)={'vd\x7f\x00\x16\x00\xf9V\xdbZ\xdd\x91\x80\xd2{\x00', 0x43732e5398417f1e}) close(r0) [ 1050.713387] syz-executor.4: page allocation failure: order:0, mode:0x24000c2 12:13:50 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) [ 1050.713397] CPU: 1 PID: 15750 Comm: syz-executor.4 Not tainted 4.4.174+ #4 [ 1050.713410] 0000000000000000 e36cde9cd8e9e1c0 ffff8800b5da79f0 ffffffff81aad1a1 [ 1050.713420] 1ffff10016bb4f41 ffff8801c05fdf00 00000000024000c2 0000000000000000 [ 1050.713432] ffffffff82895080 ffff8800b5da7b00 ffffffff8148c0cb ffffffff00000001 [ 1050.713442] Call Trace: [ 1050.713459] [] dump_stack+0xc1/0x120 [ 1050.713472] [] warn_alloc_failed.cold+0x78/0x99 [ 1050.713484] [] ? zone_watermark_ok_safe+0x290/0x290 [ 1050.713494] [] ? sel_write_load+0x9e/0xf90 [ 1050.713505] [] __vmalloc_node_range+0x365/0x650 [ 1050.713515] [] ? check_preemption_disabled+0x3c/0x200 [ 1050.713523] [] ? check_preemption_disabled+0x3c/0x200 [ 1050.713531] [] ? task_has_security+0x130/0x270 [ 1050.713538] [] vmalloc+0x5c/0x70 [ 1050.713546] [] ? sel_write_load+0x119/0xf90 [ 1050.713553] [] sel_write_load+0x119/0xf90 [ 1050.713562] [] ? sel_read_bool+0x240/0x240 [ 1050.713571] [] ? trace_hardirqs_on+0x10/0x10 [ 1050.713579] [] __vfs_write+0x116/0x3d0 [ 1050.713587] [] ? sel_read_bool+0x240/0x240 [ 1050.713595] [] ? __vfs_read+0x3c0/0x3c0 [ 1050.713610] [] ? check_preemption_disabled+0x3c/0x200 [ 1050.713620] [] ? check_preemption_disabled+0x3c/0x200 [ 1050.713631] [] ? rcu_read_lock_sched_held+0x10b/0x130 [ 1050.713641] [] ? rcu_sync_lockdep_assert+0x73/0xb0 [ 1050.713649] [] ? __sb_start_write+0x14f/0x310 [ 1050.713658] [] vfs_write+0x182/0x4e0 [ 1050.713668] [] SyS_write+0xdc/0x1c0 [ 1050.713676] [] ? SyS_read+0x1c0/0x1c0 [ 1050.713686] [] ? lockdep_sys_exit_thunk+0x12/0x14 [ 1050.713698] [] entry_SYSCALL_64_fastpath+0x1e/0x9a [ 1050.714906] Mem-Info: [ 1050.714932] active_anon:70032 inactive_anon:5698 isolated_anon:0 [ 1050.714932] active_file:11182 inactive_file:11777 isolated_file:0 [ 1050.714932] unevictable:0 dirty:47 writeback:0 unstable:0 [ 1050.714932] slab_reclaimable:4381 slab_unreclaimable:62887 [ 1050.714932] mapped:58964 shmem:8151 pagetables:8478 bounce:0 [ 1050.714932] free:1408317 free_pcp:429 free_cma:0 12:13:50 executing program 2: openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r0 = creat(&(0x7f0000000700)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x40000006100) ftruncate(r0, 0x208203) r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000008000/0x600000)=nil, 0x600000, 0x800002, 0x11, r1, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r2, &(0x7f0000000180)={0xa, 0x4e24, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) sendmmsg(r2, &(0x7f00000092c0), 0x4ff, 0x0) r3 = open(&(0x7f00000003c0)='./bus\x00', 0x0, 0x0) sendfile(r0, r3, 0x0, 0x8000fffffffe) r4 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r4, 0x1000008912, &(0x7f0000000000)="11dca5055e0acfec7be070") 12:13:50 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) 12:13:50 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) 12:13:50 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x6, 0x1100082) r1 = memfd_create(&(0x7f0000000080)='t\bnu\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00', 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000340)=[{&(0x7f0000001140)='\'', 0x1}], 0x1, 0x1081804) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendfile(r0, r0, 0x0, 0x200000d) ioctl$LOOP_CLR_FD(r0, 0x4c01) syz_genetlink_get_family_id$tipc(0x0) dup3(r1, r0, 0x0) 12:13:50 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) [ 1050.714970] DMA32 free:2576404kB min:4696kB low:5868kB high:7044kB active_anon:127688kB inactive_anon:10228kB active_file:19752kB inactive_file:20788kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:3145324kB managed:3021976kB mlocked:0kB dirty:8kB writeback:0kB mapped:107888kB shmem:14272kB slab_reclaimable:8324kB slab_unreclaimable:114328kB kernel_stack:6304kB pagetables:15348kB unstable:0kB bounce:0kB free_pcp:880kB local_pcp:176kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no 12:13:50 executing program 0: openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)={'vet\x00\x00\x96T\x00\x00\x00\x00\x00\xbdh \x00', 0x402}) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000180)={'vd\x7f\x00\x16\x00\xf9V\xdbZ\xdd\x91\x80\xd2{\x00', 0x43732e5398417f1e}) close(r0) [ 1050.714980] lowmem_reserve[]: 0 3504 3504 12:13:50 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) 12:13:50 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) 12:13:50 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) [ 1050.715014] Normal free:3056864kB min:5580kB low:6972kB high:8368kB active_anon:152440kB inactive_anon:12564kB active_file:24976kB inactive_file:26320kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:4718592kB managed:3588764kB mlocked:0kB dirty:180kB writeback:0kB mapped:127968kB shmem:18332kB slab_reclaimable:9200kB slab_unreclaimable:137220kB kernel_stack:8064kB pagetables:18564kB unstable:0kB bounce:0kB free_pcp:836kB local_pcp:216kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no 12:13:50 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) 12:13:51 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) 12:13:51 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) [ 1050.715023] lowmem_reserve[]: 0 0 0 [ 1050.715078] DMA32: 365*4kB (UME) 256*8kB (UME) 280*16kB (UME) 194*32kB (UME) 76*64kB (UME) 25*128kB (UME) 11*256kB (UM) 5*512kB (M) 1*1024kB (E) 2*2048kB (UE) 621*4096kB (M) = 2576372kB [ 1050.715132] Normal: 318*4kB (UM) 452*8kB (UME) 326*16kB (UME) 215*32kB (UM) 98*64kB (UME) 33*128kB (UME) 10*256kB (UM) 8*512kB (UME) 4*1024kB (M) 4*2048kB (UME) 735*4096kB (M) = 3056984kB [ 1050.715134] 31109 total pagecache pages [ 1050.715138] 0 pages in swap cache [ 1050.715143] Swap cache stats: add 0, delete 0, find 0/0 [ 1050.715146] Free swap = 0kB [ 1050.715148] Total swap = 0kB [ 1050.715151] 1965979 pages RAM [ 1050.715153] 0 pages HighMem/MovableOnly [ 1050.715156] 313294 pages reserved [ 1050.846777] vmalloc: allocation failure: 0 bytes [ 1050.846783] syz-executor.4: page allocation failure: order:0, mode:0x24000c2 [ 1050.846793] CPU: 1 PID: 15771 Comm: syz-executor.4 Not tainted 4.4.174+ #4 [ 1050.846807] 0000000000000000 ba4178b989c9a626 ffff8800b4a879f0 ffffffff81aad1a1 [ 1050.846818] 1ffff10016950f41 ffff8800a41117c0 00000000024000c2 0000000000000000 [ 1050.846829] ffffffff82895080 ffff8800b4a87b00 ffffffff8148c0cb ffffffff00000001 [ 1050.846831] Call Trace: [ 1050.846848] [] dump_stack+0xc1/0x120 [ 1050.846862] [] warn_alloc_failed.cold+0x78/0x99 [ 1050.846874] [] ? zone_watermark_ok_safe+0x290/0x290 [ 1050.846886] [] ? sel_write_load+0x9e/0xf90 [ 1050.846897] [] __vmalloc_node_range+0x365/0x650 [ 1050.846926] [] ? check_preemption_disabled+0x3c/0x200 [ 1050.846943] [] ? check_preemption_disabled+0x3c/0x200 [ 1050.846954] [] ? task_has_security+0x130/0x270 [ 1050.846964] [] vmalloc+0x5c/0x70 [ 1050.846974] [] ? sel_write_load+0x119/0xf90 12:13:51 executing program 2: openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r0 = creat(&(0x7f0000000700)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x40000006100) ftruncate(r0, 0x208203) r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000008000/0x600000)=nil, 0x600000, 0x800002, 0x11, r1, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r2, &(0x7f0000000180)={0xa, 0x4e24, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) sendmmsg(r2, &(0x7f00000092c0), 0x4ff, 0x0) r3 = open(&(0x7f00000003c0)='./bus\x00', 0x0, 0x0) sendfile(r0, r3, 0x0, 0x8000fffffffe) r4 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r4, 0x1000008912, &(0x7f0000000000)="11dca5055e0acfec7be070") 12:13:51 executing program 0: openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)={'vet\x00\x00\x96T\x00\x00\x00\x00\x00\xbdh \x00', 0x402}) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000180)={'vd\x7f\x00\x16\x00\xf9V\xdbZ\xdd\x91\x80\xd2{\x00', 0x43732e5398417f1e}) close(r0) 12:13:51 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x6, 0x1100082) r1 = memfd_create(&(0x7f0000000080)='t\bnu\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00', 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000340)=[{&(0x7f0000001140)='\'', 0x1}], 0x1, 0x1081804) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendfile(r0, r0, 0x0, 0x200000d) ioctl$LOOP_CLR_FD(r0, 0x4c01) syz_genetlink_get_family_id$tipc(0x0) dup3(r1, r0, 0x0) 12:13:51 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) 12:13:51 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) 12:13:51 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) [ 1050.846983] [] sel_write_load+0x119/0xf90 [ 1050.846992] [] ? sel_read_bool+0x240/0x240 [ 1050.847004] [] ? trace_hardirqs_on+0x10/0x10 [ 1050.847013] [] __vfs_write+0x116/0x3d0 12:13:51 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) 12:13:51 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) 12:13:51 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) [ 1050.847020] [] ? sel_read_bool+0x240/0x240 [ 1050.847027] [] ? __vfs_read+0x3c0/0x3c0 [ 1050.847036] [] ? check_preemption_disabled+0x3c/0x200 [ 1050.847044] [] ? check_preemption_disabled+0x3c/0x200 12:13:51 executing program 0: openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)={'vet\x00\x00\x96T\x00\x00\x00\x00\x00\xbdh \x00', 0x402}) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000180)={'vd\x7f\x00\x16\x00\xf9V\xdbZ\xdd\x91\x80\xd2{\x00', 0x43732e5398417f1e}) close(r0) 12:13:51 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x6, 0x1100082) r1 = memfd_create(&(0x7f0000000080)='t\bnu\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00', 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000340)=[{&(0x7f0000001140)='\'', 0x1}], 0x1, 0x1081804) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendfile(r0, r0, 0x0, 0x200000d) ioctl$LOOP_CLR_FD(r0, 0x4c01) syz_genetlink_get_family_id$tipc(0x0) dup3(r1, r0, 0x0) [ 1050.847053] [] ? rcu_read_lock_sched_held+0x10b/0x130 12:13:51 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) [ 1050.847062] [] ? rcu_sync_lockdep_assert+0x73/0xb0 [ 1050.847072] [] ? __sb_start_write+0x14f/0x310 [ 1050.847080] [] vfs_write+0x182/0x4e0 [ 1050.847087] [] SyS_write+0xdc/0x1c0 [ 1050.847096] [] ? SyS_read+0x1c0/0x1c0 [ 1050.847108] [] ? lockdep_sys_exit_thunk+0x12/0x14 [ 1050.847118] [] entry_SYSCALL_64_fastpath+0x1e/0x9a [ 1050.847144] Mem-Info: [ 1050.847168] active_anon:70107 inactive_anon:5998 isolated_anon:0 [ 1050.847168] active_file:11182 inactive_file:11777 isolated_file:0 [ 1050.847168] unevictable:0 dirty:47 writeback:0 unstable:0 [ 1050.847168] slab_reclaimable:4381 slab_unreclaimable:62860 [ 1050.847168] mapped:58964 shmem:8484 pagetables:8552 bounce:0 [ 1050.847168] free:1408038 free_pcp:280 free_cma:0 [ 1050.847204] DMA32 free:2575876kB min:4696kB low:5868kB high:7044kB active_anon:127788kB inactive_anon:10628kB active_file:19752kB inactive_file:20788kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:3145324kB managed:3021976kB mlocked:0kB dirty:8kB writeback:0kB mapped:107888kB shmem:14716kB slab_reclaimable:8324kB slab_unreclaimable:114328kB kernel_stack:6304kB pagetables:15496kB unstable:0kB bounce:0kB free_pcp:684kB local_pcp:416kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no [ 1050.847214] lowmem_reserve[]: 0 3504 3504 [ 1050.847250] Normal free:3056276kB min:5580kB low:6972kB high:8368kB active_anon:152640kB inactive_anon:13364kB active_file:24976kB inactive_file:26320kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:4718592kB managed:3588764kB mlocked:0kB dirty:180kB writeback:0kB mapped:127968kB shmem:19220kB slab_reclaimable:9200kB slab_unreclaimable:137112kB kernel_stack:8064kB pagetables:18712kB unstable:0kB bounce:0kB free_pcp:428kB local_pcp:180kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no [ 1050.847259] lowmem_reserve[]: 0 0 0 [ 1050.847319] DMA32: 229*4kB (UME) 262*8kB (UME) 281*16kB (UME) 192*32kB (UME) 76*64kB (UME) 26*128kB (UME) 11*256kB (UM) 5*512kB (M) 1*1024kB (E) 2*2048kB (UE) 621*4096kB (M) = 2575956kB [ 1050.847367] Normal: 97*4kB (UM) 454*8kB (UME) 326*16kB (UME) 218*32kB (UM) 99*64kB (UME) 33*128kB (UME) 10*256kB (UM) 8*512kB (UME) 4*1024kB (M) 4*2048kB (UME) 735*4096kB (M) = 3056276kB [ 1050.847370] 31442 total pagecache pages [ 1050.847374] 0 pages in swap cache [ 1050.847379] Swap cache stats: add 0, delete 0, find 0/0 [ 1050.847382] Free swap = 0kB [ 1050.847384] Total swap = 0kB [ 1050.847387] 1965979 pages RAM [ 1050.847389] 0 pages HighMem/MovableOnly [ 1050.847392] 313294 pages reserved [ 1050.924942] binder: 15775:15778 transaction failed 29189/-22, size 0-0 line 3014 [ 1050.925111] binder: undelivered TRANSACTION_ERROR: 29189 [ 1050.942270] vmalloc: allocation failure: 0 bytes [ 1050.942276] syz-executor.4: page allocation failure: order:0, mode:0x24000c2 [ 1050.942286] CPU: 0 PID: 15780 Comm: syz-executor.4 Not tainted 4.4.174+ #4 [ 1050.942298] 0000000000000000 da60a3c6f65626ab ffff88009f4d79f0 ffffffff81aad1a1 [ 1050.942309] 1ffff10013e9af41 ffff8801d1454740 00000000024000c2 0000000000000000 [ 1050.942321] ffffffff82895080 ffff88009f4d7b00 ffffffff8148c0cb ffffffff00000001 [ 1050.942324] Call Trace: [ 1050.942337] [] dump_stack+0xc1/0x120 [ 1050.942348] [] warn_alloc_failed.cold+0x78/0x99 [ 1050.942360] [] ? zone_watermark_ok_safe+0x290/0x290 [ 1050.942370] [] ? sel_write_load+0x9e/0xf90 [ 1050.942379] [] __vmalloc_node_range+0x365/0x650 [ 1050.942388] [] ? check_preemption_disabled+0x3c/0x200 [ 1050.942395] [] ? check_preemption_disabled+0x3c/0x200 [ 1050.942403] [] ? task_has_security+0x130/0x270 [ 1050.942411] [] vmalloc+0x5c/0x70 [ 1050.942419] [] ? sel_write_load+0x119/0xf90 [ 1050.942426] [] sel_write_load+0x119/0xf90 [ 1050.942434] [] ? sel_read_bool+0x240/0x240 [ 1050.942443] [] ? trace_hardirqs_on+0x10/0x10 [ 1050.942453] [] __vfs_write+0x116/0x3d0 [ 1050.942461] [] ? sel_read_bool+0x240/0x240 [ 1050.942476] [] ? __vfs_read+0x3c0/0x3c0 [ 1050.942486] [] ? check_preemption_disabled+0x3c/0x200 [ 1050.942495] [] ? check_preemption_disabled+0x3c/0x200 [ 1050.942506] [] ? rcu_read_lock_sched_held+0x10b/0x130 [ 1050.942515] [] ? rcu_sync_lockdep_assert+0x73/0xb0 [ 1050.942524] [] ? __sb_start_write+0x14f/0x310 [ 1050.942532] [] vfs_write+0x182/0x4e0 [ 1050.942540] [] SyS_write+0xdc/0x1c0 [ 1050.942546] [] ? SyS_read+0x1c0/0x1c0 12:13:52 executing program 2: openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r0 = creat(&(0x7f0000000700)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x40000006100) ftruncate(r0, 0x208203) r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000008000/0x600000)=nil, 0x600000, 0x800002, 0x11, r1, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r2, &(0x7f0000000180)={0xa, 0x4e24, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) sendmmsg(r2, &(0x7f00000092c0), 0x4ff, 0x0) r3 = open(&(0x7f00000003c0)='./bus\x00', 0x0, 0x0) sendfile(r0, r3, 0x0, 0x8000fffffffe) r4 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r4, 0x1000008912, &(0x7f0000000000)="11dca5055e0acfec7be070") 12:13:52 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) 12:13:52 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) 12:13:52 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) 12:13:52 executing program 0: openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)={'vet\x00\x00\x96T\x00\x00\x00\x00\x00\xbdh \x00', 0x402}) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000180)={'vd\x7f\x00\x16\x00\xf9V\xdbZ\xdd\x91\x80\xd2{\x00', 0x43732e5398417f1e}) close(r0) 12:13:52 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x6, 0x1100082) r1 = memfd_create(&(0x7f0000000080)='t\bnu\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00', 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000340)=[{&(0x7f0000001140)='\'', 0x1}], 0x1, 0x1081804) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendfile(r0, r0, 0x0, 0x200000d) ioctl$LOOP_CLR_FD(r0, 0x4c01) syz_genetlink_get_family_id$tipc(0x0) dup3(r1, r0, 0x0) [ 1050.942556] [] ? lockdep_sys_exit_thunk+0x12/0x14 [ 1050.942565] [] entry_SYSCALL_64_fastpath+0x1e/0x9a [ 1050.942568] Mem-Info: [ 1050.942594] active_anon:70082 inactive_anon:6173 isolated_anon:0 [ 1050.942594] active_file:11182 inactive_file:11777 isolated_file:0 12:13:52 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) 12:13:52 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) [ 1050.942594] unevictable:0 dirty:47 writeback:0 unstable:0 [ 1050.942594] slab_reclaimable:4381 slab_unreclaimable:62969 [ 1050.942594] mapped:58927 shmem:8669 pagetables:8478 bounce:0 [ 1050.942594] free:1407743 free_pcp:474 free_cma:0 12:13:52 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) 12:13:52 executing program 0: openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)={'vet\x00\x00\x96T\x00\x00\x00\x00\x00\xbdh \x00', 0x402}) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000180)={'vd\x7f\x00\x16\x00\xf9V\xdbZ\xdd\x91\x80\xd2{\x00', 0x43732e5398417f1e}) close(r0) 12:13:52 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x6, 0x1100082) r1 = memfd_create(&(0x7f0000000080)='t\bnu\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00', 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000340)=[{&(0x7f0000001140)='\'', 0x1}], 0x1, 0x1081804) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendfile(r0, r0, 0x0, 0x200000d) ioctl$LOOP_CLR_FD(r0, 0x4c01) syz_genetlink_get_family_id$tipc(0x0) dup3(r1, r0, 0x0) 12:13:52 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) [ 1050.942628] DMA32 free:2575856kB min:4696kB low:5868kB high:7044kB active_anon:127588kB inactive_anon:10628kB active_file:19752kB inactive_file:20788kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:3145324kB managed:3021976kB mlocked:0kB dirty:8kB writeback:0kB mapped:107740kB shmem:14716kB slab_reclaimable:8324kB slab_unreclaimable:114432kB kernel_stack:6304kB pagetables:15200kB unstable:0kB bounce:0kB free_pcp:1124kB local_pcp:640kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no [ 1050.942639] lowmem_reserve[]: 0 3504 3504 [ 1050.942672] Normal free:3055116kB min:5580kB low:6972kB high:8368kB active_anon:152740kB inactive_anon:14064kB active_file:24976kB inactive_file:26320kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:4718592kB managed:3588764kB mlocked:0kB dirty:180kB writeback:0kB mapped:127968kB shmem:19960kB slab_reclaimable:9200kB slab_unreclaimable:137444kB kernel_stack:8064kB pagetables:18712kB unstable:0kB bounce:0kB free_pcp:772kB local_pcp:484kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no [ 1050.942682] lowmem_reserve[]: 0 0 0 [ 1050.942742] DMA32: 229*4kB (UME) 262*8kB (UME) 280*16kB (UME) 196*32kB (UME) 76*64kB (UME) 25*128kB (UME) 11*256kB (UM) 5*512kB (M) 1*1024kB (E) 2*2048kB (UE) 621*4096kB (M) = 2575940kB [ 1050.942797] Normal: 97*4kB (UM) 361*8kB (UME) 326*16kB (UME) 209*32kB (UM) 99*64kB (UME) 33*128kB (UME) 10*256kB (UM) 8*512kB (UME) 4*1024kB (M) 4*2048kB (UME) 735*4096kB (M) = 3055244kB [ 1050.942800] 31627 total pagecache pages [ 1050.942804] 0 pages in swap cache [ 1050.942809] Swap cache stats: add 0, delete 0, find 0/0 [ 1050.942812] Free swap = 0kB [ 1050.942815] Total swap = 0kB [ 1050.942818] 1965979 pages RAM [ 1050.942821] 0 pages HighMem/MovableOnly [ 1050.942824] 313294 pages reserved [ 1051.490444] vmalloc: allocation failure: 0 bytes [ 1051.490451] syz-executor.4: page allocation failure: order:0, mode:0x24000c2 [ 1051.490460] CPU: 0 PID: 15792 Comm: syz-executor.4 Not tainted 4.4.174+ #4 [ 1051.490473] 0000000000000000 0fa7453dda9058a9 ffff8801d770f9f0 ffffffff81aad1a1 [ 1051.490484] 1ffff1003aee1f41 ffff8801c025df00 00000000024000c2 0000000000000000 [ 1051.490496] ffffffff82895080 ffff8801d770fb00 ffffffff8148c0cb ffffffff00000001 [ 1051.490498] Call Trace: [ 1051.490514] [] dump_stack+0xc1/0x120 [ 1051.490527] [] warn_alloc_failed.cold+0x78/0x99 [ 1051.490537] [] ? zone_watermark_ok_safe+0x290/0x290 [ 1051.490547] [] ? sel_write_load+0x9e/0xf90 [ 1051.490559] [] __vmalloc_node_range+0x365/0x650 12:13:53 executing program 2: openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r0 = creat(&(0x7f0000000700)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x40000006100) ftruncate(r0, 0x208203) r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000008000/0x600000)=nil, 0x600000, 0x800002, 0x11, r1, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r2, &(0x7f0000000180)={0xa, 0x4e24, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) sendmmsg(r2, &(0x7f00000092c0), 0x4ff, 0x0) r3 = open(&(0x7f00000003c0)='./bus\x00', 0x0, 0x0) sendfile(r0, r3, 0x0, 0x8000fffffffe) r4 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r4, 0x1000008912, &(0x7f0000000000)="11dca5055e0acfec7be070") 12:13:53 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) 12:13:53 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) 12:13:53 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) 12:13:53 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x6, 0x1100082) r1 = memfd_create(&(0x7f0000000080)='t\bnu\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00', 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000340)=[{&(0x7f0000001140)='\'', 0x1}], 0x1, 0x1081804) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendfile(r0, r0, 0x0, 0x200000d) ioctl$LOOP_CLR_FD(r0, 0x4c01) syz_genetlink_get_family_id$tipc(0x0) dup3(r1, r0, 0x0) 12:13:53 executing program 0: openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)={'vet\x00\x00\x96T\x00\x00\x00\x00\x00\xbdh \x00', 0x402}) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000180)={'vd\x7f\x00\x16\x00\xf9V\xdbZ\xdd\x91\x80\xd2{\x00', 0x43732e5398417f1e}) close(r0) 12:13:53 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) [ 1051.490569] [] ? check_preemption_disabled+0x3c/0x200 12:13:53 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) 12:13:53 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) ** 15 printk messages dropped ** [ 1051.490702] [] vfs_write+0x182/0x4e0 [ 1051.490710] [] SyS_write+0xdc/0x1c0 [ 1051.490718] [] ? SyS_read+0x1c0/0x1c0 12:13:53 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) 12:13:53 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) [ 1051.490729] [] ? lockdep_sys_exit_thunk+0x12/0x14 12:13:53 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) ** 54 printk messages dropped ** [ 1051.575698] DMA32 free:2577424kB min:4696kB low:5868kB high:7044kB active_anon:127524kB inactive_anon:10280kB active_file:19752kB inactive_file:20788kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:3145324kB managed:3021976kB mlocked:0kB dirty:8kB writeback:0kB mapped:107972kB shmem:14316kB slab_reclaimable:8324kB slab_unreclaimable:113800kB kernel_stack:6240kB pagetables:15200kB unstable:0kB bounce:0kB free_pcp:892kB local_pcp:308kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no ** 50 printk messages dropped ** [ 1051.676038] DMA32 free:2576396kB min:4696kB low:5868kB high:7044kB active_anon:127624kB inactive_anon:10780kB active_file:19752kB inactive_file:20788kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:3145324kB managed:3021976kB mlocked:0kB dirty:8kB writeback:0kB mapped:107824kB shmem:14908kB slab_reclaimable:8324kB slab_unreclaimable:113700kB kernel_stack:6240kB pagetables:15496kB unstable:0kB bounce:0kB free_pcp:692kB local_pcp:296kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no [ 1051.676047] lowmem_reserve[]: 0 3504 3504 [ 1051.676077] Normal free:3054344kB min:5580kB low:6972kB high:8368kB active_anon:152600kB inactive_anon:14020kB active_file:24976kB inactive_file:26320kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:4718592kB managed:3588764kB mlocked:0kB dirty:168kB writeback:0kB mapped:128032kB shmem:19772kB slab_reclaimable:9200kB slab_unreclaimable:137964kB kernel_stack:7904kB pagetables:18712kB unstable:0kB bounce:0kB free_pcp:1244kB local_pcp:616kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no [ 1051.676086] lowmem_reserve[]: 0 0 0 [ 1051.676143] DMA32: 217*4kB (UME) 310*8kB (UME) 284*16kB (UME) 198*32kB (UME) 76*64kB (UME) 25*128kB (UME) 11*256kB (UM) 5*512kB (M) 1*1024kB (E) 2*2048kB (UE) 621*4096kB (M) = 2576404kB [ 1051.676297] Normal: 2*4kB (UM) 272*8kB (UME) 326*16kB (UME) 215*32kB (UM) 99*64kB (UME) 33*128kB (UME) 10*256kB (UM) 8*512kB (UME) 4*1024kB (M) 4*2048kB (UME) 735*4096kB (M) = 3054344kB [ 1051.676301] 31628 total pagecache pages [ 1051.676306] 0 pages in swap cache [ 1051.676311] Swap cache stats: add 0, delete 0, find 0/0 [ 1051.676314] Free swap = 0kB [ 1051.676317] Total swap = 0kB [ 1051.676320] 1965979 pages RAM [ 1051.676322] 0 pages HighMem/MovableOnly [ 1051.676326] 313294 pages reserved [ 1052.354772] binder: 15833:15843 transaction failed 29189/-22, size 0-0 line 3014 [ 1052.354962] binder: undelivered TRANSACTION_ERROR: 29189 [ 1052.356809] vmalloc: allocation failure: 0 bytes [ 1052.356816] syz-executor.4: page allocation failure: order:0, mode:0x24000c2 [ 1052.356824] CPU: 1 PID: 15841 Comm: syz-executor.4 Not tainted 4.4.174+ #4 [ 1052.356837] 0000000000000000 e689ab9455847a13 ffff8801c0fff9f0 ffffffff81aad1a1 [ 1052.356848] 1ffff100381fff41 ffff8800b5668000 00000000024000c2 0000000000000000 [ 1052.356859] ffffffff82895080 ffff8801c0fffb00 ffffffff8148c0cb ffffffff00000001 [ 1052.356861] Call Trace: [ 1052.356877] [] dump_stack+0xc1/0x120 [ 1052.356891] [] warn_alloc_failed.cold+0x78/0x99 [ 1052.356902] [] ? zone_watermark_ok_safe+0x290/0x290 [ 1052.356911] [] ? sel_write_load+0x9e/0xf90 [ 1052.356922] [] __vmalloc_node_range+0x365/0x650 [ 1052.356932] [] ? check_preemption_disabled+0x3c/0x200 [ 1052.356939] [] ? check_preemption_disabled+0x3c/0x200 [ 1052.356948] [] ? task_has_security+0x130/0x270 [ 1052.356957] [] vmalloc+0x5c/0x70 [ 1052.356966] [] ? sel_write_load+0x119/0xf90 [ 1052.356974] [] sel_write_load+0x119/0xf90 [ 1052.356982] [] ? sel_read_bool+0x240/0x240 [ 1052.356991] [] ? trace_hardirqs_on+0x10/0x10 [ 1052.356999] [] __vfs_write+0x116/0x3d0 [ 1052.357007] [] ? sel_read_bool+0x240/0x240 [ 1052.357014] [] ? __vfs_read+0x3c0/0x3c0 [ 1052.357023] [] ? check_preemption_disabled+0x3c/0x200 [ 1052.357030] [] ? check_preemption_disabled+0x3c/0x200 [ 1052.357040] [] ? rcu_read_lock_sched_held+0x10b/0x130 [ 1052.357048] [] ? rcu_sync_lockdep_assert+0x73/0xb0 12:13:54 executing program 2: openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r0 = creat(&(0x7f0000000700)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x40000006100) ftruncate(r0, 0x208203) r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000008000/0x600000)=nil, 0x600000, 0x800002, 0x11, r1, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r2, &(0x7f0000000180)={0xa, 0x4e24, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) sendmmsg(r2, &(0x7f00000092c0), 0x4ff, 0x0) r3 = open(&(0x7f00000003c0)='./bus\x00', 0x0, 0x0) sendfile(r0, r3, 0x0, 0x8000fffffffe) r4 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r4, 0x1000008912, &(0x7f0000000000)="11dca5055e0acfec7be070") 12:13:54 executing program 0: openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)={'vet\x00\x00\x96T\x00\x00\x00\x00\x00\xbdh \x00', 0x402}) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000180)={'vd\x7f\x00\x16\x00\xf9V\xdbZ\xdd\x91\x80\xd2{\x00', 0x43732e5398417f1e}) close(r0) 12:13:54 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) 12:13:54 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x6, 0x1100082) r1 = memfd_create(&(0x7f0000000080)='t\bnu\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00', 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000340)=[{&(0x7f0000001140)='\'', 0x1}], 0x1, 0x1081804) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendfile(r0, r0, 0x0, 0x200000d) ioctl$LOOP_CLR_FD(r0, 0x4c01) syz_genetlink_get_family_id$tipc(0x0) dup3(r1, r0, 0x0) 12:13:54 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) 12:13:54 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) [ 1052.357057] [] ? __sb_start_write+0x14f/0x310 [ 1052.357064] [] vfs_write+0x182/0x4e0 12:13:54 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) 12:13:54 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) 12:13:54 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) 12:13:54 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x6, 0x1100082) r1 = memfd_create(&(0x7f0000000080)='t\bnu\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00', 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000340)=[{&(0x7f0000001140)='\'', 0x1}], 0x1, 0x1081804) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendfile(r0, r0, 0x0, 0x200000d) ioctl$LOOP_CLR_FD(r0, 0x4c01) syz_genetlink_get_family_id$tipc(0x0) dup3(r1, r0, 0x0) ** 6 printk messages dropped ** [ 1052.357167] DMA32 free:2577496kB min:4696kB low:5868kB high:7044kB active_anon:127616kB inactive_anon:10360kB active_file:19752kB inactive_file:20788kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:3145324kB managed:3021976kB mlocked:0kB dirty:8kB writeback:0kB mapped:107884kB shmem:14248kB slab_reclaimable:8324kB slab_unreclaimable:113072kB kernel_stack:6272kB pagetables:15392kB unstable:0kB bounce:0kB free_pcp:1276kB local_pcp:576kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no [ 1052.358202] lowmem_reserve[]: 0 3504 3504 12:13:54 executing program 0: openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)={'vet\x00\x00\x96T\x00\x00\x00\x00\x00\xbdh \x00', 0x402}) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000180)={'vd\x7f\x00\x16\x00\xf9V\xdbZ\xdd\x91\x80\xd2{\x00', 0x43732e5398417f1e}) close(r0) 12:13:54 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) 12:13:54 executing program 2: openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r0 = creat(&(0x7f0000000700)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x40000006100) ftruncate(r0, 0x208203) r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000008000/0x600000)=nil, 0x600000, 0x800002, 0x11, r1, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r2, &(0x7f0000000180)={0xa, 0x4e24, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) sendmmsg(r2, &(0x7f00000092c0), 0x4ff, 0x0) r3 = open(&(0x7f00000003c0)='./bus\x00', 0x0, 0x0) sendfile(r0, r3, 0x0, 0x8000fffffffe) r4 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r4, 0x1000008912, &(0x7f0000000000)="11dca5055e0acfec7be070") 12:13:54 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) 12:13:54 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) ** 45 printk messages dropped ** [ 1054.980524] [] __vmalloc_node_range+0x365/0x650 12:13:54 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) ** 50 printk messages dropped ** [ 1055.728932] [] __vmalloc_node_range+0x365/0x650 12:13:54 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) 12:13:54 executing program 0: openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)={'vet\x00\x00\x96T\x00\x00\x00\x00\x00\xbdh \x00', 0x402}) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000180)={'vd\x7f\x00\x16\x00\xf9V\xdbZ\xdd\x91\x80\xd2{\x00', 0x43732e5398417f1e}) close(r0) 12:13:54 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) 12:13:54 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x6, 0x1100082) r1 = memfd_create(&(0x7f0000000080)='t\bnu\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00', 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000340)=[{&(0x7f0000001140)='\'', 0x1}], 0x1, 0x1081804) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendfile(r0, r0, 0x0, 0x200000d) ioctl$LOOP_CLR_FD(r0, 0x4c01) syz_genetlink_get_family_id$tipc(0x0) dup3(r1, r0, 0x0) 12:13:54 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) 12:13:54 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) ** 50 printk messages dropped ** [ 1055.884825] [] warn_alloc_failed.cold+0x78/0x99 12:13:54 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) 12:13:54 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) ** 1 printk messages dropped ** [ 1055.884847] [] ? sel_write_load+0x9e/0xf90 ** 1 printk messages dropped ** [ 1055.884869] [] ? check_preemption_disabled+0x3c/0x200 [ 1055.884877] [] ? check_preemption_disabled+0x3c/0x200 [ 1055.884885] [] ? task_has_security+0x130/0x270 [ 1055.884892] [] vmalloc+0x5c/0x70 [ 1055.884900] [] ? sel_write_load+0x119/0xf90 [ 1055.884907] [] sel_write_load+0x119/0xf90 [ 1055.884915] [] ? sel_read_bool+0x240/0x240 [ 1055.884924] [] ? trace_hardirqs_on+0x10/0x10 [ 1055.884932] [] __vfs_write+0x116/0x3d0 [ 1055.884942] [] ? sel_read_bool+0x240/0x240 [ 1055.884954] [] ? __vfs_read+0x3c0/0x3c0 [ 1055.884965] [] ? check_preemption_disabled+0x3c/0x200 [ 1055.884975] [] ? check_preemption_disabled+0x3c/0x200 [ 1055.884985] [] ? rcu_read_lock_sched_held+0x10b/0x130 [ 1055.884993] [] ? rcu_sync_lockdep_assert+0x73/0xb0 [ 1055.885003] [] ? __sb_start_write+0x14f/0x310 [ 1055.885012] [] vfs_write+0x182/0x4e0 [ 1055.885021] [] SyS_write+0xdc/0x1c0 [ 1055.885031] [] ? SyS_read+0x1c0/0x1c0 [ 1055.885042] [] ? lockdep_sys_exit_thunk+0x12/0x14 [ 1055.885054] [] entry_SYSCALL_64_fastpath+0x1e/0x9a [ 1055.885057] Mem-Info: [ 1055.885082] active_anon:70081 inactive_anon:5925 isolated_anon:0 [ 1055.885082] active_file:11182 inactive_file:11777 isolated_file:0 [ 1055.885082] unevictable:0 dirty:46 writeback:0 unstable:0 [ 1055.885082] slab_reclaimable:4381 slab_unreclaimable:63268 [ 1055.885082] mapped:59001 shmem:8411 pagetables:8589 bounce:0 [ 1055.885082] free:1407582 free_pcp:386 free_cma:0 [ 1055.885118] DMA32 free:2577352kB min:4696kB low:5868kB high:7044kB active_anon:127640kB inactive_anon:10576kB active_file:19752kB inactive_file:20788kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:3145324kB managed:3021976kB mlocked:0kB dirty:8kB writeback:0kB mapped:107972kB shmem:14708kB slab_reclaimable:8324kB slab_unreclaimable:113020kB kernel_stack:6336kB pagetables:15496kB unstable:0kB bounce:0kB free_pcp:884kB local_pcp:552kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no [ 1055.885128] lowmem_reserve[]: 0 3504 3504 [ 1055.885164] Normal free:3052976kB min:5580kB low:6972kB high:8368kB active_anon:152684kB inactive_anon:13124kB active_file:24976kB inactive_file:26320kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:4718592kB managed:3588764kB mlocked:0kB dirty:176kB writeback:0kB mapped:128032kB shmem:18936kB slab_reclaimable:9200kB slab_unreclaimable:140052kB kernel_stack:7968kB pagetables:18860kB unstable:0kB bounce:0kB free_pcp:652kB local_pcp:232kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no [ 1055.885174] lowmem_reserve[]: 0 0 0 [ 1055.885233] DMA32: 306*4kB (UME) 316*8kB (UME) 298*16kB (UME) 201*32kB (UME) 76*64kB (UME) 26*128kB (UME) 11*256kB (UM) 5*512kB (M) 1*1024kB (E) 2*2048kB (UE) 621*4096kB (M) = 2577256kB [ 1055.885290] Normal: 48*4kB (M) 190*8kB (UME) 328*16kB (UME) 185*32kB (UM) 100*64kB (UME) 32*128kB (UME) 10*256kB (UM) 8*512kB (UME) 4*1024kB (M) 4*2048kB (UME) 735*4096kB (M) = 3052880kB [ 1055.885293] 31369 total pagecache pages [ 1055.885297] 0 pages in swap cache [ 1055.885304] Swap cache stats: add 0, delete 0, find 0/0 [ 1055.885307] Free swap = 0kB [ 1055.885310] Total swap = 0kB [ 1055.885312] 1965979 pages RAM [ 1055.885317] 0 pages HighMem/MovableOnly [ 1055.885319] 313294 pages reserved [ 1055.988702] binder: 16058:16062 transaction failed 29189/-22, size 0-0 line 3014 [ 1055.988956] binder: undelivered TRANSACTION_ERROR: 29189 [ 1056.022893] vmalloc: allocation failure: 0 bytes 12:13:55 executing program 2: openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r0 = creat(&(0x7f0000000700)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x40000006100) ftruncate(r0, 0x208203) r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000008000/0x600000)=nil, 0x600000, 0x800002, 0x11, r1, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r2, &(0x7f0000000180)={0xa, 0x4e24, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) sendmmsg(r2, &(0x7f00000092c0), 0x4ff, 0x0) r3 = open(&(0x7f00000003c0)='./bus\x00', 0x0, 0x0) sendfile(r0, r3, 0x0, 0x8000fffffffe) r4 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r4, 0x1000008912, &(0x7f0000000000)="11dca5055e0acfec7be070") 12:13:55 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x6, 0x1100082) r1 = memfd_create(&(0x7f0000000080)='t\bnu\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00', 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000340)=[{&(0x7f0000001140)='\'', 0x1}], 0x1, 0x1081804) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendfile(r0, r0, 0x0, 0x200000d) ioctl$LOOP_CLR_FD(r0, 0x4c01) syz_genetlink_get_family_id$tipc(0x0) dup3(r1, r0, 0x0) 12:13:55 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) 12:13:55 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) 12:13:55 executing program 0: openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)={'vet\x00\x00\x96T\x00\x00\x00\x00\x00\xbdh \x00', 0x402}) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000180)={'vd\x7f\x00\x16\x00\xf9V\xdbZ\xdd\x91\x80\xd2{\x00', 0x43732e5398417f1e}) close(r0) 12:13:55 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) [ 1056.022900] syz-executor.4: page allocation failure: order:0, mode:0x24000c2 [ 1056.022909] CPU: 1 PID: 16063 Comm: syz-executor.4 Not tainted 4.4.174+ #4 12:13:55 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) 12:13:55 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) [ 1056.022921] 0000000000000000 474ab97c3bae8ed9 ffff8801d11ff9f0 ffffffff81aad1a1 12:13:55 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) 12:13:55 executing program 0: openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)={'vet\x00\x00\x96T\x00\x00\x00\x00\x00\xbdh \x00', 0x402}) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000180)={'vd\x7f\x00\x16\x00\xf9V\xdbZ\xdd\x91\x80\xd2{\x00', 0x43732e5398417f1e}) close(r0) 12:13:55 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) [ 1056.022930] 1ffff1003a23ff41 ffff8800a464df00 00000000024000c2 0000000000000000 [ 1056.022939] ffffffff82895080 ffff8801d11ffb00 ffffffff8148c0cb ffffffff00000001 [ 1056.022943] Call Trace: 12:13:55 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x6, 0x1100082) r1 = memfd_create(&(0x7f0000000080)='t\bnu\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00', 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000340)=[{&(0x7f0000001140)='\'', 0x1}], 0x1, 0x1081804) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendfile(r0, r0, 0x0, 0x200000d) ioctl$LOOP_CLR_FD(r0, 0x4c01) syz_genetlink_get_family_id$tipc(0x0) dup3(r1, r0, 0x0) [ 1056.022960] [] dump_stack+0xc1/0x120 [ 1056.022974] [] warn_alloc_failed.cold+0x78/0x99 [ 1056.022985] [] ? zone_watermark_ok_safe+0x290/0x290 [ 1056.022994] [] ? sel_write_load+0x9e/0xf90 [ 1056.023003] [] __vmalloc_node_range+0x365/0x650 [ 1056.023014] [] ? check_preemption_disabled+0x3c/0x200 [ 1056.023024] [] ? check_preemption_disabled+0x3c/0x200 [ 1056.023034] [] ? task_has_security+0x130/0x270 [ 1056.023042] [] vmalloc+0x5c/0x70 [ 1056.023051] [] ? sel_write_load+0x119/0xf90 [ 1056.023058] [] sel_write_load+0x119/0xf90 [ 1056.023066] [] ? sel_read_bool+0x240/0x240 [ 1056.023075] [] ? trace_hardirqs_on+0x10/0x10 [ 1056.023083] [] __vfs_write+0x116/0x3d0 [ 1056.023090] [] ? sel_read_bool+0x240/0x240 [ 1056.023099] [] ? __vfs_read+0x3c0/0x3c0 [ 1056.023108] [] ? check_preemption_disabled+0x3c/0x200 [ 1056.023116] [] ? check_preemption_disabled+0x3c/0x200 [ 1056.023126] [] ? rcu_read_lock_sched_held+0x10b/0x130 [ 1056.023136] [] ? rcu_sync_lockdep_assert+0x73/0xb0 [ 1056.023145] [] ? __sb_start_write+0x14f/0x310 [ 1056.023153] [] vfs_write+0x182/0x4e0 [ 1056.023161] [] SyS_write+0xdc/0x1c0 [ 1056.023169] [] ? SyS_read+0x1c0/0x1c0 [ 1056.023181] [] ? lockdep_sys_exit_thunk+0x12/0x14 [ 1056.023192] [] entry_SYSCALL_64_fastpath+0x1e/0x9a [ 1056.023195] Mem-Info: [ 1056.023220] active_anon:70081 inactive_anon:6200 isolated_anon:0 [ 1056.023220] active_file:11182 inactive_file:11777 isolated_file:0 [ 1056.023220] unevictable:0 dirty:46 writeback:0 unstable:0 [ 1056.023220] slab_reclaimable:4381 slab_unreclaimable:63381 [ 1056.023220] mapped:59001 shmem:8633 pagetables:8478 bounce:0 [ 1056.023220] free:1407354 free_pcp:482 free_cma:0 [ 1056.023257] DMA32 free:2576800kB min:4696kB low:5868kB high:7044kB active_anon:127840kB inactive_anon:11176kB active_file:19752kB inactive_file:20788kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:3145324kB managed:3021976kB mlocked:0kB dirty:8kB writeback:0kB mapped:107972kB shmem:15152kB slab_reclaimable:8324kB slab_unreclaimable:113240kB kernel_stack:6336kB pagetables:15200kB unstable:0kB bounce:0kB free_pcp:872kB local_pcp:632kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no [ 1056.023266] lowmem_reserve[]: 0 3504 3504 [ 1056.023296] Normal free:3052616kB min:5580kB low:6972kB high:8368kB active_anon:152484kB inactive_anon:13624kB active_file:24976kB inactive_file:26320kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:4718592kB managed:3588764kB mlocked:0kB dirty:176kB writeback:0kB mapped:128032kB shmem:19380kB slab_reclaimable:9200kB slab_unreclaimable:140284kB kernel_stack:7968kB pagetables:18712kB unstable:0kB bounce:0kB free_pcp:1056kB local_pcp:412kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no [ 1056.023304] lowmem_reserve[]: 0 0 0 [ 1056.023366] DMA32: 352*4kB (UME) 262*8kB (UME) 298*16kB (UME) 196*32kB (UME) 76*64kB (UME) 26*128kB (UME) 11*256kB (UM) 5*512kB (M) 1*1024kB (E) 2*2048kB (UE) 621*4096kB (M) = 2576848kB [ 1056.023420] Normal: 0*4kB 183*8kB (UME) 329*16kB (UME) 178*32kB (UM) 100*64kB (UME) 33*128kB (UME) 10*256kB (UM) 8*512kB (UME) 4*1024kB (M) 4*2048kB (UME) 735*4096kB (M) = 3052552kB [ 1056.023423] 31591 total pagecache pages [ 1056.023427] 0 pages in swap cache [ 1056.023432] Swap cache stats: add 0, delete 0, find 0/0 [ 1056.023444] Free swap = 0kB [ 1056.023449] Total swap = 0kB [ 1056.023451] 1965979 pages RAM [ 1056.023454] 0 pages HighMem/MovableOnly [ 1056.023457] 313294 pages reserved [ 1056.611069] vmalloc: allocation failure: 0 bytes [ 1056.611075] syz-executor.4: page allocation failure: order:0, mode:0x24000c2 [ 1056.611085] CPU: 0 PID: 16074 Comm: syz-executor.4 Not tainted 4.4.174+ #4 [ 1056.611098] 0000000000000000 888092eac9c3badc ffff8800a67cf9f0 ffffffff81aad1a1 [ 1056.611109] 1ffff10014cf9f41 ffff8801d7425f00 00000000024000c2 0000000000000000 [ 1056.611121] ffffffff82895080 ffff8800a67cfb00 ffffffff8148c0cb ffffffff00000001 [ 1056.611123] Call Trace: [ 1056.611139] [] dump_stack+0xc1/0x120 [ 1056.611152] [] warn_alloc_failed.cold+0x78/0x99 [ 1056.611163] [] ? zone_watermark_ok_safe+0x290/0x290 [ 1056.611172] [] ? sel_write_load+0x9e/0xf90 [ 1056.611181] [] __vmalloc_node_range+0x365/0x650 [ 1056.611190] [] ? check_preemption_disabled+0x3c/0x200 [ 1056.611197] [] ? check_preemption_disabled+0x3c/0x200 12:13:56 executing program 2: openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r0 = creat(&(0x7f0000000700)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x40000006100) ftruncate(r0, 0x208203) r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000008000/0x600000)=nil, 0x600000, 0x800002, 0x11, r1, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r2, &(0x7f0000000180)={0xa, 0x4e24, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) sendmmsg(r2, &(0x7f00000092c0), 0x4ff, 0x0) r3 = open(&(0x7f00000003c0)='./bus\x00', 0x0, 0x0) sendfile(r0, r3, 0x0, 0x8000fffffffe) r4 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r4, 0x1000008912, &(0x7f0000000000)="11dca5055e0acfec7be070") 12:13:56 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) 12:13:56 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) 12:13:56 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) 12:13:56 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x6, 0x1100082) r1 = memfd_create(&(0x7f0000000080)='t\bnu\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00', 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000340)=[{&(0x7f0000001140)='\'', 0x1}], 0x1, 0x1081804) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendfile(r0, r0, 0x0, 0x200000d) ioctl$LOOP_CLR_FD(r0, 0x4c01) syz_genetlink_get_family_id$tipc(0x0) dup3(r1, r0, 0x0) 12:13:56 executing program 0: openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)={'vet\x00\x00\x96T\x00\x00\x00\x00\x00\xbdh \x00', 0x402}) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000180)={'vd\x7f\x00\x16\x00\xf9V\xdbZ\xdd\x91\x80\xd2{\x00', 0x43732e5398417f1e}) close(r0) [ 1056.611205] [] ? task_has_security+0x130/0x270 [ 1056.611212] [] vmalloc+0x5c/0x70 [ 1056.611220] [] ? sel_write_load+0x119/0xf90 [ 1056.611227] [] sel_write_load+0x119/0xf90 12:13:56 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) [ 1056.611235] [] ? sel_read_bool+0x240/0x240 [ 1056.611244] [] ? trace_hardirqs_on+0x10/0x10 12:13:56 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) 12:13:56 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) [ 1056.611252] [] __vfs_write+0x116/0x3d0 [ 1056.611258] [] ? sel_read_bool+0x240/0x240 12:13:56 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) 12:13:56 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) [ 1056.611263] [] ? __vfs_read+0x3c0/0x3c0 [ 1056.611269] [] ? check_preemption_disabled+0x3c/0x200 12:13:56 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x6, 0x1100082) r1 = memfd_create(&(0x7f0000000080)='t\bnu\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00', 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000340)=[{&(0x7f0000001140)='\'', 0x1}], 0x1, 0x1081804) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendfile(r0, r0, 0x0, 0x200000d) ioctl$LOOP_CLR_FD(r0, 0x4c01) syz_genetlink_get_family_id$tipc(0x0) dup3(r1, r0, 0x0) [ 1056.611276] [] ? check_preemption_disabled+0x3c/0x200 [ 1056.611287] [] ? rcu_read_lock_sched_held+0x10b/0x130 [ 1056.611296] [] ? rcu_sync_lockdep_assert+0x73/0xb0 [ 1056.611305] [] ? __sb_start_write+0x14f/0x310 [ 1056.611311] [] vfs_write+0x182/0x4e0 [ 1056.611321] [] SyS_write+0xdc/0x1c0 [ 1056.611329] [] ? SyS_read+0x1c0/0x1c0 [ 1056.611339] [] ? lockdep_sys_exit_thunk+0x12/0x14 [ 1056.611348] [] entry_SYSCALL_64_fastpath+0x1e/0x9a [ 1056.611351] Mem-Info: [ 1056.611376] active_anon:70031 inactive_anon:5700 isolated_anon:0 [ 1056.611376] active_file:11182 inactive_file:11777 isolated_file:0 [ 1056.611376] unevictable:0 dirty:41 writeback:0 unstable:0 [ 1056.611376] slab_reclaimable:4381 slab_unreclaimable:63492 [ 1056.611376] mapped:58964 shmem:8189 pagetables:8515 bounce:0 [ 1056.611376] free:1407801 free_pcp:438 free_cma:0 [ 1056.611415] DMA32 free:2578020kB min:4696kB low:5868kB high:7044kB active_anon:127636kB inactive_anon:10280kB active_file:19752kB inactive_file:20788kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:3145324kB managed:3021976kB mlocked:0kB dirty:8kB writeback:0kB mapped:107888kB shmem:14372kB slab_reclaimable:8324kB slab_unreclaimable:112852kB kernel_stack:6304kB pagetables:15512kB unstable:0kB bounce:0kB free_pcp:848kB local_pcp:620kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no [ 1056.611425] lowmem_reserve[]: 0 3504 3504 [ 1056.611462] Normal free:3053184kB min:5580kB low:6972kB high:8368kB active_anon:152488kB inactive_anon:12520kB active_file:24976kB inactive_file:26320kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:4718592kB managed:3588764kB mlocked:0kB dirty:156kB writeback:0kB mapped:127968kB shmem:18384kB slab_reclaimable:9200kB slab_unreclaimable:141116kB kernel_stack:7840kB pagetables:18548kB unstable:0kB bounce:0kB free_pcp:916kB local_pcp:556kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no [ 1056.611470] lowmem_reserve[]: 0 0 0 [ 1056.611531] DMA32: 483*4kB (UME) 272*8kB (UME) 299*16kB (UME) 211*32kB (UME) 76*64kB (UME) 26*128kB (UME) 11*256kB (UM) 5*512kB (M) 1*1024kB (E) 2*2048kB (UE) 621*4096kB (M) = 2577948kB 12:13:56 executing program 2: openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r0 = creat(&(0x7f0000000700)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x40000006100) ftruncate(r0, 0x208203) r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000008000/0x600000)=nil, 0x600000, 0x800002, 0x11, r1, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r2, &(0x7f0000000180)={0xa, 0x4e24, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) sendmmsg(r2, &(0x7f00000092c0), 0x4ff, 0x0) r3 = open(&(0x7f00000003c0)='./bus\x00', 0x0, 0x0) sendfile(r0, r3, 0x0, 0x8000fffffffe) r4 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r4, 0x1000008912, &(0x7f0000000000)="11dca5055e0acfec7be070") 12:13:56 executing program 0: openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)={'vet\x00\x00\x96T\x00\x00\x00\x00\x00\xbdh \x00', 0x402}) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000180)={'vd\x7f\x00\x16\x00\xf9V\xdbZ\xdd\x91\x80\xd2{\x00', 0x43732e5398417f1e}) close(r0) 12:13:56 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) 12:13:56 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) 12:13:56 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) 12:13:56 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x6, 0x1100082) r1 = memfd_create(&(0x7f0000000080)='t\bnu\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00', 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000340)=[{&(0x7f0000001140)='\'', 0x1}], 0x1, 0x1081804) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendfile(r0, r0, 0x0, 0x200000d) ioctl$LOOP_CLR_FD(r0, 0x4c01) syz_genetlink_get_family_id$tipc(0x0) dup3(r1, r0, 0x0) [ 1056.612775] Normal: 152*4kB (M) 192*8kB (UME) 326*16kB (UME) 180*32kB (UM) 100*64kB (UME) 32*128kB (UME) 10*256kB (UM) 8*512kB (UME) 4*1024kB (M) 4*2048kB (UME) 735*4096kB (M) = 3053120kB [ 1056.612778] 31147 total pagecache pages [ 1056.612783] 0 pages in swap cache [ 1056.612788] Swap cache stats: add 0, delete 0, find 0/0 12:13:56 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) 12:13:56 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) [ 1056.612792] Free swap = 0kB 12:13:56 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) [ 1056.612794] Total swap = 0kB [ 1056.612797] 1965979 pages RAM [ 1056.612799] 0 pages HighMem/MovableOnly 12:13:57 executing program 0: openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)={'vet\x00\x00\x96T\x00\x00\x00\x00\x00\xbdh \x00', 0x402}) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000180)={'vd\x7f\x00\x16\x00\xf9V\xdbZ\xdd\x91\x80\xd2{\x00', 0x43732e5398417f1e}) close(r0) [ 1056.612802] 313294 pages reserved 12:13:57 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) 12:13:57 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x6, 0x1100082) r1 = memfd_create(&(0x7f0000000080)='t\bnu\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00', 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000340)=[{&(0x7f0000001140)='\'', 0x1}], 0x1, 0x1081804) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendfile(r0, r0, 0x0, 0x200000d) ioctl$LOOP_CLR_FD(r0, 0x4c01) syz_genetlink_get_family_id$tipc(0x0) dup3(r1, r0, 0x0) [ 1056.621942] binder: 16067:16076 transaction failed 29189/-22, size 0-0 line 3014 [ 1056.622067] binder: undelivered TRANSACTION_ERROR: 29189 [ 1056.713553] vmalloc: allocation failure: 0 bytes [ 1056.713559] syz-executor.4: page allocation failure: order:0, mode:0x24000c2 [ 1056.713569] CPU: 0 PID: 16084 Comm: syz-executor.4 Not tainted 4.4.174+ #4 [ 1056.713582] 0000000000000000 219976de987e7885 ffff8800b3c079f0 ffffffff81aad1a1 [ 1056.713593] 1ffff10016780f41 ffff8800b3655f00 00000000024000c2 0000000000000000 [ 1056.713605] ffffffff82895080 ffff8800b3c07b00 ffffffff8148c0cb ffffffff00000001 [ 1056.713608] Call Trace: [ 1056.713623] [] dump_stack+0xc1/0x120 [ 1056.713637] [] warn_alloc_failed.cold+0x78/0x99 [ 1056.713648] [] ? zone_watermark_ok_safe+0x290/0x290 [ 1056.713658] [] ? sel_write_load+0x9e/0xf90 [ 1056.713666] [] __vmalloc_node_range+0x365/0x650 [ 1056.713675] [] ? check_preemption_disabled+0x3c/0x200 [ 1056.713683] [] ? check_preemption_disabled+0x3c/0x200 [ 1056.713691] [] ? task_has_security+0x130/0x270 [ 1056.713699] [] vmalloc+0x5c/0x70 [ 1056.713706] [] ? sel_write_load+0x119/0xf90 [ 1056.713714] [] sel_write_load+0x119/0xf90 [ 1056.713722] [] ? sel_read_bool+0x240/0x240 [ 1056.713731] [] ? trace_hardirqs_on+0x10/0x10 [ 1056.713740] [] __vfs_write+0x116/0x3d0 [ 1056.713747] [] ? sel_read_bool+0x240/0x240 [ 1056.713755] [] ? __vfs_read+0x3c0/0x3c0 [ 1056.713762] [] ? check_preemption_disabled+0x3c/0x200 [ 1056.713770] [] ? check_preemption_disabled+0x3c/0x200 [ 1056.713780] [] ? rcu_read_lock_sched_held+0x10b/0x130 [ 1056.713788] [] ? rcu_sync_lockdep_assert+0x73/0xb0 12:13:57 executing program 2: openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r0 = creat(&(0x7f0000000700)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x40000006100) ftruncate(r0, 0x208203) r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000008000/0x600000)=nil, 0x600000, 0x800002, 0x11, r1, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r2, &(0x7f0000000180)={0xa, 0x4e24, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) sendmmsg(r2, &(0x7f00000092c0), 0x4ff, 0x0) r3 = open(&(0x7f00000003c0)='./bus\x00', 0x0, 0x0) sendfile(r0, r3, 0x0, 0x8000fffffffe) r4 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r4, 0x1000008912, &(0x7f0000000000)="11dca5055e0acfec7be070") 12:13:57 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) 12:13:57 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) 12:13:57 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x6, 0x1100082) r1 = memfd_create(&(0x7f0000000080)='t\bnu\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00', 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000340)=[{&(0x7f0000001140)='\'', 0x1}], 0x1, 0x1081804) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendfile(r0, r0, 0x0, 0x200000d) ioctl$LOOP_CLR_FD(r0, 0x4c01) syz_genetlink_get_family_id$tipc(0x0) dup3(r1, r0, 0x0) 12:13:57 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) 12:13:57 executing program 0: openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)={'vet\x00\x00\x96T\x00\x00\x00\x00\x00\xbdh \x00', 0x402}) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000180)={'vd\x7f\x00\x16\x00\xf9V\xdbZ\xdd\x91\x80\xd2{\x00', 0x43732e5398417f1e}) close(r0) 12:13:57 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) 12:13:57 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) [ 1056.713796] [] ? __sb_start_write+0x14f/0x310 [ 1056.713804] [] vfs_write+0x182/0x4e0 [ 1056.713812] [] SyS_write+0xdc/0x1c0 [ 1056.713819] [] ? SyS_read+0x1c0/0x1c0 [ 1056.713830] [] ? lockdep_sys_exit_thunk+0x12/0x14 12:13:57 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) 12:13:57 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) [ 1056.713839] [] entry_SYSCALL_64_fastpath+0x1e/0x9a 12:13:57 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) 12:13:57 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) [ 1056.713842] Mem-Info: [ 1056.713866] active_anon:70031 inactive_anon:5700 isolated_anon:0 [ 1056.713866] active_file:11182 inactive_file:11777 isolated_file:0 [ 1056.713866] unevictable:0 dirty:41 writeback:0 unstable:0 [ 1056.713866] slab_reclaimable:4381 slab_unreclaimable:63493 [ 1056.713866] mapped:58964 shmem:8189 pagetables:8478 bounce:0 [ 1056.713866] free:1407748 free_pcp:445 free_cma:0 [ 1056.713913] DMA32 free:2578092kB min:4696kB low:5868kB high:7044kB active_anon:127636kB inactive_anon:10280kB active_file:19752kB inactive_file:20788kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:3145324kB managed:3021976kB mlocked:0kB dirty:8kB writeback:0kB mapped:107888kB shmem:14372kB slab_reclaimable:8324kB slab_unreclaimable:112752kB kernel_stack:6304kB pagetables:15364kB unstable:0kB bounce:0kB free_pcp:872kB local_pcp:656kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no [ 1056.716425] lowmem_reserve[]: 0 3504 3504 [ 1056.716467] Normal free:3052900kB min:5580kB low:6972kB high:8368kB active_anon:152488kB inactive_anon:12520kB active_file:24976kB inactive_file:26320kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:4718592kB managed:3588764kB mlocked:0kB dirty:156kB writeback:0kB mapped:127968kB shmem:18384kB slab_reclaimable:9200kB slab_unreclaimable:141220kB kernel_stack:7840kB pagetables:18548kB unstable:0kB bounce:0kB free_pcp:908kB local_pcp:560kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no [ 1056.716476] lowmem_reserve[]: 0 0 0 [ 1056.716533] DMA32: 506*4kB (UME) 276*8kB (UME) 299*16kB (UME) 208*32kB (UME) 76*64kB (UME) 26*128kB (UME) 11*256kB (UM) 5*512kB (M) 1*1024kB (E) 2*2048kB (UE) 621*4096kB (M) = 2577976kB [ 1056.716586] Normal: 153*4kB (UM) 192*8kB (UME) 317*16kB (UME) 177*32kB (UM) 100*64kB (UME) 32*128kB (UME) 10*256kB (UM) 8*512kB (UME) 4*1024kB (M) 4*2048kB (UME) 735*4096kB (M) = 3052884kB [ 1056.716589] 31147 total pagecache pages [ 1056.716593] 0 pages in swap cache [ 1056.716598] Swap cache stats: add 0, delete 0, find 0/0 [ 1056.716600] Free swap = 0kB [ 1056.716603] Total swap = 0kB [ 1056.716605] 1965979 pages RAM [ 1056.716608] 0 pages HighMem/MovableOnly [ 1056.716610] 313294 pages reserved [ 1056.748004] binder: 16086:16090 transaction failed 29189/-22, size 0-0 line 3014 [ 1056.748154] binder: undelivered TRANSACTION_ERROR: 29189 [ 1056.830063] vmalloc: allocation failure: 0 bytes [ 1056.830069] syz-executor.4: page allocation failure: order:0, mode:0x24000c2 [ 1056.830080] CPU: 0 PID: 16096 Comm: syz-executor.4 Not tainted 4.4.174+ #4 12:13:58 executing program 2: openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r0 = creat(&(0x7f0000000700)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x40000006100) ftruncate(r0, 0x208203) r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000008000/0x600000)=nil, 0x600000, 0x800002, 0x11, r1, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r2, &(0x7f0000000180)={0xa, 0x4e24, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) sendmmsg(r2, &(0x7f00000092c0), 0x4ff, 0x0) r3 = open(&(0x7f00000003c0)='./bus\x00', 0x0, 0x0) sendfile(r0, r3, 0x0, 0x8000fffffffe) r4 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r4, 0x1000008912, &(0x7f0000000000)="11dca5055e0acfec7be070") 12:13:58 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x6, 0x1100082) r1 = memfd_create(&(0x7f0000000080)='t\bnu\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00', 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000340)=[{&(0x7f0000001140)='\'', 0x1}], 0x1, 0x1081804) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendfile(r0, r0, 0x0, 0x200000d) ioctl$LOOP_CLR_FD(r0, 0x4c01) syz_genetlink_get_family_id$tipc(0x0) dup3(r1, r0, 0x0) 12:13:58 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) 12:13:58 executing program 0: openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)={'vet\x00\x00\x96T\x00\x00\x00\x00\x00\xbdh \x00', 0x402}) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000180)={'vd\x7f\x00\x16\x00\xf9V\xdbZ\xdd\x91\x80\xd2{\x00', 0x43732e5398417f1e}) close(r0) 12:13:58 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) 12:13:58 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) [ 1056.830093] 0000000000000000 5f5622db3685418d ffff8801bece79f0 ffffffff81aad1a1 [ 1056.830104] 1ffff10037d9cf41 ffff8800a35b97c0 00000000024000c2 0000000000000000 [ 1056.830114] ffffffff82895080 ffff8801bece7b00 ffffffff8148c0cb ffffffff00000001 [ 1056.830116] Call Trace: [ 1056.830130] [] dump_stack+0xc1/0x120 [ 1056.830142] [] warn_alloc_failed.cold+0x78/0x99 12:13:58 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) 12:13:58 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) 12:13:58 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) [ 1056.830153] [] ? zone_watermark_ok_safe+0x290/0x290 ** 22 printk messages dropped ** [ 1056.830345] [] entry_SYSCALL_64_fastpath+0x1e/0x9a 12:13:58 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) 12:13:58 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x6, 0x1100082) r1 = memfd_create(&(0x7f0000000080)='t\bnu\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00', 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000340)=[{&(0x7f0000001140)='\'', 0x1}], 0x1, 0x1081804) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendfile(r0, r0, 0x0, 0x200000d) ioctl$LOOP_CLR_FD(r0, 0x4c01) syz_genetlink_get_family_id$tipc(0x0) dup3(r1, r0, 0x0) ** 2 printk messages dropped ** [ 1056.830414] DMA32 free:2577800kB min:4696kB low:5868kB high:7044kB active_anon:127736kB inactive_anon:10680kB active_file:19752kB inactive_file:20788kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:3145324kB managed:3021976kB mlocked:0kB dirty:8kB writeback:0kB mapped:108036kB shmem:14816kB slab_reclaimable:8324kB slab_unreclaimable:112472kB kernel_stack:6304kB pagetables:15364kB unstable:0kB bounce:0kB free_pcp:680kB local_pcp:356kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no 12:13:58 executing program 0: openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)={'vet\x00\x00\x96T\x00\x00\x00\x00\x00\xbdh \x00', 0x402}) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000180)={'vd\x7f\x00\x16\x00\xf9V\xdbZ\xdd\x91\x80\xd2{\x00', 0x43732e5398417f1e}) close(r0) ** 50 printk messages dropped ** [ 1057.425072] DMA32 free:2578456kB min:4696kB low:5868kB high:7044kB active_anon:127764kB inactive_anon:10268kB active_file:19752kB inactive_file:20788kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:3145324kB managed:3021976kB mlocked:0kB dirty:8kB writeback:0kB mapped:107828kB shmem:14356kB slab_reclaimable:8324kB slab_unreclaimable:112208kB kernel_stack:6240kB pagetables:15200kB unstable:0kB bounce:0kB free_pcp:1020kB local_pcp:644kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no [ 1057.425083] lowmem_reserve[]: 0 3504 3504 [ 1057.425115] Normal free:3052172kB min:5580kB low:6972kB high:8368kB active_anon:152460kB inactive_anon:12632kB active_file:24976kB inactive_file:26320kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:4718592kB managed:3588764kB mlocked:0kB dirty:176kB writeback:0kB mapped:128028kB shmem:18400kB slab_reclaimable:9200kB slab_unreclaimable:141952kB kernel_stack:7904kB pagetables:18712kB unstable:0kB bounce:0kB free_pcp:1044kB local_pcp:688kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no [ 1057.425125] lowmem_reserve[]: 0 0 0 [ 1057.425183] DMA32: 498*4kB (UME) 312*8kB (UME) 299*16kB (UME) 218*32kB (UME) 76*64kB (UME) 25*128kB (UME) 11*256kB (UM) 5*512kB (M) 1*1024kB (E) 2*2048kB (UE) 621*4096kB (M) = 2578424kB [ 1057.425241] Normal: 253*4kB (UM) 144*8kB (UME) 281*16kB (UME) 173*32kB (UM) 97*64kB (UME) 33*128kB (UME) 10*256kB (UM) 8*512kB (UME) 4*1024kB (M) 4*2048kB (UME) 735*4096kB (M) = 3052132kB [ 1057.425244] 31147 total pagecache pages [ 1057.425248] 0 pages in swap cache [ 1057.425253] Swap cache stats: add 0, delete 0, find 0/0 [ 1057.425256] Free swap = 0kB [ 1057.425258] Total swap = 0kB [ 1057.425261] 1965979 pages RAM [ 1057.425265] 0 pages HighMem/MovableOnly [ 1057.425267] 313294 pages reserved [ 1057.528743] vmalloc: allocation failure: 0 bytes [ 1057.528749] syz-executor.4: page allocation failure: order:0, mode:0x24000c2 [ 1057.528759] CPU: 0 PID: 16129 Comm: syz-executor.4 Not tainted 4.4.174+ #4 [ 1057.528772] 0000000000000000 a44606135d3e4ee2 ffff8801d0b979f0 ffffffff81aad1a1 12:13:59 executing program 2: openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r0 = creat(&(0x7f0000000700)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x40000006100) ftruncate(r0, 0x208203) r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000008000/0x600000)=nil, 0x600000, 0x800002, 0x11, r1, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r2, &(0x7f0000000180)={0xa, 0x4e24, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) sendmmsg(r2, &(0x7f00000092c0), 0x4ff, 0x0) r3 = open(&(0x7f00000003c0)='./bus\x00', 0x0, 0x0) sendfile(r0, r3, 0x0, 0x8000fffffffe) r4 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r4, 0x1000008912, &(0x7f0000000000)="11dca5055e0acfec7be070") 12:13:59 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) 12:13:59 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) 12:13:59 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) 12:13:59 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x6, 0x1100082) r1 = memfd_create(&(0x7f0000000080)='t\bnu\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00', 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000340)=[{&(0x7f0000001140)='\'', 0x1}], 0x1, 0x1081804) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendfile(r0, r0, 0x0, 0x200000d) ioctl$LOOP_CLR_FD(r0, 0x4c01) syz_genetlink_get_family_id$tipc(0x0) dup3(r1, r0, 0x0) 12:13:59 executing program 0: openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)={'vet\x00\x00\x96T\x00\x00\x00\x00\x00\xbdh \x00', 0x402}) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000180)={'vd\x7f\x00\x16\x00\xf9V\xdbZ\xdd\x91\x80\xd2{\x00', 0x43732e5398417f1e}) close(r0) 12:13:59 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) 12:13:59 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) [ 1057.528781] 1ffff1003a172f41 ffff8800b7a097c0 00000000024000c2 0000000000000000 [ 1057.528792] ffffffff82895080 ffff8801d0b97b00 ffffffff8148c0cb ffffffff00000001 [ 1057.528795] Call Trace: [ 1057.528811] [] dump_stack+0xc1/0x120 [ 1057.528825] [] warn_alloc_failed.cold+0x78/0x99 [ 1057.528842] [] ? zone_watermark_ok_safe+0x290/0x290 12:13:59 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) 12:13:59 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) ** 25 printk messages dropped ** [ 1057.533292] DMA32 free:2579080kB min:4696kB low:5868kB high:7044kB active_anon:127764kB inactive_anon:10468kB active_file:19752kB inactive_file:20788kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:3145324kB managed:3021976kB mlocked:0kB dirty:8kB writeback:0kB mapped:107828kB shmem:14652kB slab_reclaimable:8324kB slab_unreclaimable:111608kB kernel_stack:6240kB pagetables:15644kB unstable:0kB bounce:0kB free_pcp:408kB local_pcp:64kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no 12:13:59 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) 12:13:59 executing program 0: openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)={'vet\x00\x00\x96T\x00\x00\x00\x00\x00\xbdh \x00', 0x402}) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000180)={'vd\x7f\x00\x16\x00\xf9V\xdbZ\xdd\x91\x80\xd2{\x00', 0x43732e5398417f1e}) close(r0) ** 51 printk messages dropped ** [ 1057.620018] lowmem_reserve[]: 0 3504 3504 [ 1057.620058] Normal free:3050876kB min:5580kB low:6972kB high:8368kB active_anon:152760kB inactive_anon:13232kB active_file:24976kB inactive_file:26320kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:4718592kB managed:3588764kB mlocked:0kB dirty:176kB writeback:0kB mapped:128028kB shmem:19140kB slab_reclaimable:9200kB slab_unreclaimable:142296kB kernel_stack:7904kB pagetables:18712kB unstable:0kB bounce:0kB free_pcp:796kB local_pcp:556kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no [ 1057.622487] lowmem_reserve[]: 0 0 0 [ 1057.622548] DMA32: 506*4kB (UE) 259*8kB (UME) 301*16kB (UME) 212*32kB (UME) 76*64kB (UME) 26*128kB (UME) 11*256kB (UM) 5*512kB (M) 1*1024kB (E) 2*2048kB (UE) 621*4096kB (M) = 2578000kB [ 1057.622603] Normal: 139*4kB (M) 144*8kB (UME) 279*16kB (ME) 165*32kB (UM) 88*64kB (UME) 33*128kB (UME) 10*256kB (UM) 8*512kB (UME) 4*1024kB (M) 4*2048kB (UME) 735*4096kB (M) = 3050812kB [ 1057.622606] 31628 total pagecache pages [ 1057.622610] 0 pages in swap cache [ 1057.622614] Swap cache stats: add 0, delete 0, find 0/0 [ 1057.622617] Free swap = 0kB [ 1057.622619] Total swap = 0kB [ 1057.622621] 1965979 pages RAM [ 1057.622624] 0 pages HighMem/MovableOnly [ 1057.622626] 313294 pages reserved [ 1058.330807] binder: 16159:16161 transaction failed 29189/-22, size 0-0 line 3014 [ 1058.330983] binder: undelivered TRANSACTION_ERROR: 29189 [ 1058.387270] binder: 16173:16176 transaction failed 29189/-22, size 0-0 line 3014 [ 1058.387413] binder: undelivered TRANSACTION_ERROR: 29189 [ 1058.467930] binder: 16184:16188 transaction failed 29189/-22, size 0-0 line 3014 [ 1058.468073] binder: undelivered TRANSACTION_ERROR: 29189 [ 1059.200273] binder: 16210:16217 transaction failed 29189/-22, size 0-0 line 3014 [ 1059.200449] binder: undelivered TRANSACTION_ERROR: 29189 [ 1059.286888] binder: 16226:16232 transaction failed 29189/-22, size 0-0 line 3014 [ 1059.287231] binder: undelivered TRANSACTION_ERROR: 29189 [ 1060.009323] binder_alloc: 16257: binder_alloc_buf, no vma [ 1060.009368] binder: 16257:16265 transaction failed 29189/-3, size 0-0 line 3137 [ 1060.009511] binder: undelivered TRANSACTION_ERROR: 29189 [ 1060.111633] binder: 16276:16282 transaction failed 29189/-22, size 0-0 line 3014 [ 1060.111766] binder: undelivered TRANSACTION_ERROR: 29189 [ 1060.206085] binder: 16288:16290 transaction failed 29189/-22, size 0-0 line 3014 [ 1060.206254] binder: undelivered TRANSACTION_ERROR: 29189 [ 1060.750181] warn_alloc_failed: 7 callbacks suppressed [ 1060.750193] vmalloc: allocation failure: 0 bytes [ 1060.750284] syz-executor.4: page allocation failure: order:0, mode:0x24000c2 [ 1060.750293] CPU: 0 PID: 16306 Comm: syz-executor.4 Not tainted 4.4.174+ #4 [ 1060.750306] 0000000000000000 2fbba58838c55d3d ffff8800a65b79f0 ffffffff81aad1a1 [ 1060.750317] 1ffff10014cb6f41 ffff8801d5ba2f80 00000000024000c2 0000000000000000 [ 1060.750327] ffffffff82895080 ffff8800a65b7b00 ffffffff8148c0cb ffffffff00000001 [ 1060.750330] Call Trace: [ 1060.750343] [] dump_stack+0xc1/0x120 [ 1060.750356] [] warn_alloc_failed.cold+0x78/0x99 [ 1060.750368] [] ? zone_watermark_ok_safe+0x290/0x290 [ 1060.750377] [] ? sel_write_load+0x9e/0xf90 [ 1060.750388] [] __vmalloc_node_range+0x365/0x650 [ 1060.750397] [] ? check_preemption_disabled+0x3c/0x200 [ 1060.750404] [] ? check_preemption_disabled+0x3c/0x200 [ 1060.750412] [] ? task_has_security+0x130/0x270 [ 1060.750419] [] vmalloc+0x5c/0x70 [ 1060.750426] [] ? sel_write_load+0x119/0xf90 [ 1060.750433] [] sel_write_load+0x119/0xf90 [ 1060.750440] [] ? sel_read_bool+0x240/0x240 [ 1060.750451] [] ? trace_hardirqs_on+0x10/0x10 [ 1060.750461] [] __vfs_write+0x116/0x3d0 [ 1060.750469] [] ? sel_read_bool+0x240/0x240 [ 1060.750477] [] ? __vfs_read+0x3c0/0x3c0 [ 1060.750485] [] ? check_preemption_disabled+0x3c/0x200 [ 1060.750492] [] ? check_preemption_disabled+0x3c/0x200 [ 1060.750501] [] ? rcu_read_lock_sched_held+0x10b/0x130 [ 1060.750509] [] ? rcu_sync_lockdep_assert+0x73/0xb0 [ 1060.750517] [] ? __sb_start_write+0x14f/0x310 [ 1060.750525] [] vfs_write+0x182/0x4e0 [ 1060.750532] [] SyS_write+0xdc/0x1c0 [ 1060.750539] [] ? SyS_read+0x1c0/0x1c0 [ 1060.750548] [] ? lockdep_sys_exit_thunk+0x12/0x14 12:14:00 executing program 2: openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r0 = creat(&(0x7f0000000700)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x40000006100) ftruncate(r0, 0x208203) r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000008000/0x600000)=nil, 0x600000, 0x800002, 0x11, r1, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r2, &(0x7f0000000180)={0xa, 0x4e24, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) sendmmsg(r2, &(0x7f00000092c0), 0x4ff, 0x0) r3 = open(&(0x7f00000003c0)='./bus\x00', 0x0, 0x0) sendfile(r0, r3, 0x0, 0x8000fffffffe) r4 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r4, 0x1000008912, &(0x7f0000000000)="11dca5055e0acfec7be070") 12:14:00 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) 12:14:00 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x6, 0x1100082) r1 = memfd_create(&(0x7f0000000080)='t\bnu\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00', 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000340)=[{&(0x7f0000001140)='\'', 0x1}], 0x1, 0x1081804) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendfile(r0, r0, 0x0, 0x200000d) ioctl$LOOP_CLR_FD(r0, 0x4c01) syz_genetlink_get_family_id$tipc(0x0) dup3(r1, r0, 0x0) 12:14:00 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) 12:14:00 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) 12:14:00 executing program 0: openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)={'vet\x00\x00\x96T\x00\x00\x00\x00\x00\xbdh \x00', 0x402}) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000180)={'vd\x7f\x00\x16\x00\xf9V\xdbZ\xdd\x91\x80\xd2{\x00', 0x43732e5398417f1e}) close(r0) [ 1060.750558] [] entry_SYSCALL_64_fastpath+0x1e/0x9a [ 1060.750561] Mem-Info: [ 1060.750585] active_anon:70008 inactive_anon:5721 isolated_anon:0 [ 1060.750585] active_file:11182 inactive_file:11777 isolated_file:0 [ 1060.750585] unevictable:0 dirty:46 writeback:0 unstable:0 [ 1060.750585] slab_reclaimable:4385 slab_unreclaimable:63329 [ 1060.750585] mapped:58971 shmem:8151 pagetables:8483 bounce:0 [ 1060.750585] free:1407893 free_pcp:479 free_cma:0 12:14:00 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) [ 1060.750627] DMA32 free:2578080kB min:4696kB low:5868kB high:7044kB active_anon:127636kB inactive_anon:10356kB active_file:19752kB inactive_file:20788kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:3145324kB managed:3021976kB mlocked:0kB dirty:8kB writeback:0kB mapped:107884kB shmem:14264kB slab_reclaimable:8324kB slab_unreclaimable:112780kB kernel_stack:6432kB pagetables:15472kB unstable:0kB bounce:0kB free_pcp:904kB local_pcp:624kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no 12:14:00 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) 12:14:00 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) 12:14:00 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) 12:14:00 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) 12:14:00 executing program 0: openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)={'vet\x00\x00\x96T\x00\x00\x00\x00\x00\xbdh \x00', 0x402}) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000180)={'vd\x7f\x00\x16\x00\xf9V\xdbZ\xdd\x91\x80\xd2{\x00', 0x43732e5398417f1e}) close(r0) ** 88 printk messages dropped ** [ 1061.478989] [] ? trace_hardirqs_on+0x10/0x10 [ 1061.478997] [] __vfs_write+0x116/0x3d0 [ 1061.479005] [] ? sel_read_bool+0x240/0x240 [ 1061.479012] [] ? __vfs_read+0x3c0/0x3c0 [ 1061.479021] [] ? check_preemption_disabled+0x3c/0x200 [ 1061.479029] [] ? check_preemption_disabled+0x3c/0x200 [ 1061.479038] [] ? rcu_read_lock_sched_held+0x10b/0x130 [ 1061.479046] [] ? rcu_sync_lockdep_assert+0x73/0xb0 [ 1061.479055] [] ? __sb_start_write+0x14f/0x310 [ 1061.479062] [] vfs_write+0x182/0x4e0 [ 1061.479070] [] SyS_write+0xdc/0x1c0 [ 1061.479078] [] ? SyS_read+0x1c0/0x1c0 [ 1061.479090] [] ? lockdep_sys_exit_thunk+0x12/0x14 [ 1061.479100] [] entry_SYSCALL_64_fastpath+0x1e/0x9a [ 1061.482702] Mem-Info: [ 1061.482729] active_anon:70030 inactive_anon:5725 isolated_anon:0 [ 1061.482729] active_file:11182 inactive_file:11777 isolated_file:0 [ 1061.482729] unevictable:0 dirty:11 writeback:0 unstable:0 [ 1061.482729] slab_reclaimable:4385 slab_unreclaimable:63238 [ 1061.482729] mapped:59001 shmem:8152 pagetables:8515 bounce:0 [ 1061.482729] free:1408034 free_pcp:502 free_cma:0 [ 1061.482766] DMA32 free:2578224kB min:4696kB low:5868kB high:7044kB active_anon:127436kB inactive_anon:10304kB active_file:19752kB inactive_file:20788kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:3145324kB managed:3021976kB mlocked:0kB dirty:0kB writeback:0kB mapped:107888kB shmem:14344kB slab_reclaimable:8324kB slab_unreclaimable:112908kB kernel_stack:6272kB pagetables:15088kB unstable:0kB bounce:0kB free_pcp:1328kB local_pcp:624kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no [ 1061.482777] lowmem_reserve[]: 0 3504 3504 [ 1061.482812] Normal free:3053912kB min:5580kB low:6972kB high:8368kB active_anon:152684kB inactive_anon:12596kB active_file:24976kB inactive_file:26320kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:4718592kB managed:3588764kB mlocked:0kB dirty:44kB writeback:0kB mapped:128116kB shmem:18264kB slab_reclaimable:9216kB slab_unreclaimable:140044kB kernel_stack:7872kB pagetables:18972kB unstable:0kB bounce:0kB free_pcp:680kB local_pcp:480kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no [ 1061.482822] lowmem_reserve[]: 0 0 0 [ 1061.482877] DMA32: 432*4kB (UME) 348*8kB (UME) 307*16kB (UME) 206*32kB (UME) 76*64kB (UME) 25*128kB (UME) 11*256kB (UM) 5*512kB (M) 1*1024kB (E) 2*2048kB (UE) 621*4096kB (M) = 2578192kB [ 1061.482930] Normal: 478*4kB (UM) 215*8kB (UME) 286*16kB (UME) 195*32kB (UM) 88*64kB (UME) 33*128kB (UME) 10*256kB (UM) 8*512kB (UME) 4*1024kB (M) 4*2048kB (UME) 735*4096kB (M) = 3053808kB [ 1061.482940] 31110 total pagecache pages [ 1061.482946] 0 pages in swap cache [ 1061.482951] Swap cache stats: add 0, delete 0, find 0/0 [ 1061.482954] Free swap = 0kB [ 1061.482956] Total swap = 0kB [ 1061.482960] 1965979 pages RAM [ 1061.482963] 0 pages HighMem/MovableOnly [ 1061.482965] 313294 pages reserved [ 1061.498539] binder: 16341:16350 transaction failed 29189/-22, size 0-0 line 3014 [ 1061.498673] binder: undelivered TRANSACTION_ERROR: 29189 [ 1061.565169] vmalloc: allocation failure: 0 bytes [ 1061.565175] syz-executor.4: page allocation failure: order:0, mode:0x24000c2 [ 1061.565184] CPU: 0 PID: 16360 Comm: syz-executor.4 Not tainted 4.4.174+ #4 [ 1061.565198] 0000000000000000 a08e2736cf61c3bb ffff8801c03179f0 ffffffff81aad1a1 [ 1061.565210] 1ffff10038062f41 ffff8801d76ddf00 00000000024000c2 0000000000000000 [ 1061.565221] ffffffff82895080 ffff8801c0317b00 ffffffff8148c0cb ffffffff00000001 [ 1061.565224] Call Trace: [ 1061.565238] [] dump_stack+0xc1/0x120 [ 1061.565251] [] warn_alloc_failed.cold+0x78/0x99 [ 1061.565263] [] ? zone_watermark_ok_safe+0x290/0x290 [ 1061.565272] [] ? sel_write_load+0x9e/0xf90 [ 1061.565284] [] __vmalloc_node_range+0x365/0x650 [ 1061.565294] [] ? check_preemption_disabled+0x3c/0x200 [ 1061.565303] [] ? check_preemption_disabled+0x3c/0x200 [ 1061.565312] [] ? task_has_security+0x130/0x270 [ 1061.565319] [] vmalloc+0x5c/0x70 [ 1061.565336] [] ? sel_write_load+0x119/0xf90 [ 1061.565344] [] sel_write_load+0x119/0xf90 [ 1061.565354] [] ? sel_read_bool+0x240/0x240 [ 1061.565365] [] ? trace_hardirqs_on+0x10/0x10 [ 1061.565376] [] __vfs_write+0x116/0x3d0 [ 1061.565384] [] ? sel_read_bool+0x240/0x240 [ 1061.565392] [] ? __vfs_read+0x3c0/0x3c0 [ 1061.565400] [] ? check_preemption_disabled+0x3c/0x200 12:14:01 executing program 2: openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r0 = creat(&(0x7f0000000700)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x40000006100) ftruncate(r0, 0x208203) r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000008000/0x600000)=nil, 0x600000, 0x800002, 0x11, r1, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r2, &(0x7f0000000180)={0xa, 0x4e24, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) sendmmsg(r2, &(0x7f00000092c0), 0x4ff, 0x0) r3 = open(&(0x7f00000003c0)='./bus\x00', 0x0, 0x0) sendfile(r0, r3, 0x0, 0x8000fffffffe) r4 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r4, 0x1000008912, &(0x7f0000000000)="11dca5055e0acfec7be070") 12:14:01 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) 12:14:01 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) 12:14:01 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x6, 0x1100082) r1 = memfd_create(&(0x7f0000000080)='t\bnu\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00', 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000340)=[{&(0x7f0000001140)='\'', 0x1}], 0x1, 0x1081804) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendfile(r0, r0, 0x0, 0x200000d) ioctl$LOOP_CLR_FD(r0, 0x4c01) syz_genetlink_get_family_id$tipc(0x0) dup3(r1, r0, 0x0) 12:14:01 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) 12:14:01 executing program 0: openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)={'vet\x00\x00\x96T\x00\x00\x00\x00\x00\xbdh \x00', 0x402}) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000180)={'vd\x7f\x00\x16\x00\xf9V\xdbZ\xdd\x91\x80\xd2{\x00', 0x43732e5398417f1e}) close(r0) 12:14:01 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) [ 1061.565408] [] ? check_preemption_disabled+0x3c/0x200 [ 1061.565418] [] ? rcu_read_lock_sched_held+0x10b/0x130 [ 1061.565426] [] ? rcu_sync_lockdep_assert+0x73/0xb0 [ 1061.565435] [] ? __sb_start_write+0x14f/0x310 [ 1061.565444] [] vfs_write+0x182/0x4e0 [ 1061.565454] [] SyS_write+0xdc/0x1c0 12:14:01 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) [ 1061.565462] [] ? SyS_read+0x1c0/0x1c0 [ 1061.565476] [] ? lockdep_sys_exit_thunk+0x12/0x14 12:14:01 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) 12:14:01 executing program 0: openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)={'vet\x00\x00\x96T\x00\x00\x00\x00\x00\xbdh \x00', 0x402}) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000180)={'vd\x7f\x00\x16\x00\xf9V\xdbZ\xdd\x91\x80\xd2{\x00', 0x43732e5398417f1e}) close(r0) [ 1061.565488] [] entry_SYSCALL_64_fastpath+0x1e/0x9a [ 1061.567378] Mem-Info: [ 1061.567403] active_anon:70105 inactive_anon:5725 isolated_anon:0 [ 1061.567403] active_file:11182 inactive_file:11777 isolated_file:0 [ 1061.567403] unevictable:0 dirty:11 writeback:0 unstable:0 [ 1061.567403] slab_reclaimable:4385 slab_unreclaimable:63290 [ 1061.567403] mapped:59038 shmem:8152 pagetables:8515 bounce:0 [ 1061.567403] free:1407810 free_pcp:385 free_cma:0 12:14:01 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) 12:14:01 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x6, 0x1100082) r1 = memfd_create(&(0x7f0000000080)='t\bnu\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00', 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000340)=[{&(0x7f0000001140)='\'', 0x1}], 0x1, 0x1081804) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendfile(r0, r0, 0x0, 0x200000d) ioctl$LOOP_CLR_FD(r0, 0x4c01) syz_genetlink_get_family_id$tipc(0x0) dup3(r1, r0, 0x0) [ 1061.567437] DMA32 free:2577560kB min:4696kB low:5868kB high:7044kB active_anon:127736kB inactive_anon:10304kB active_file:19752kB inactive_file:20788kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:3145324kB managed:3021976kB mlocked:0kB dirty:0kB writeback:0kB mapped:108036kB shmem:14344kB slab_reclaimable:8324kB slab_unreclaimable:113116kB kernel_stack:6272kB pagetables:15384kB unstable:0kB bounce:0kB free_pcp:688kB local_pcp:468kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no [ 1061.567448] lowmem_reserve[]: 0 3504 3504 [ 1061.567483] Normal free:3053680kB min:5580kB low:6972kB high:8368kB active_anon:152684kB inactive_anon:12596kB active_file:24976kB inactive_file:26320kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:4718592kB managed:3588764kB mlocked:0kB dirty:44kB writeback:0kB mapped:128116kB shmem:18264kB slab_reclaimable:9216kB slab_unreclaimable:140044kB kernel_stack:7872kB pagetables:18676kB unstable:0kB bounce:0kB free_pcp:852kB local_pcp:428kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no [ 1061.567493] lowmem_reserve[]: 0 0 0 [ 1061.567552] DMA32: 401*4kB (UME) 348*8kB (UME) 307*16kB (UME) 191*32kB (UME) 76*64kB (UME) 25*128kB (UME) 11*256kB (UM) 5*512kB (M) 1*1024kB (E) 2*2048kB (UE) 621*4096kB (M) = 2577588kB [ 1061.567606] Normal: 456*4kB (UM) 226*8kB (UME) 286*16kB (UME) 191*32kB (UM) 88*64kB (UME) 33*128kB (UME) 10*256kB (UM) 8*512kB (UME) 4*1024kB (M) 4*2048kB (UME) 735*4096kB (M) = 3053680kB [ 1061.567609] 31110 total pagecache pages [ 1061.567612] 0 pages in swap cache [ 1061.567617] Swap cache stats: add 0, delete 0, find 0/0 [ 1061.567619] Free swap = 0kB [ 1061.567622] Total swap = 0kB [ 1061.567624] 1965979 pages RAM [ 1061.567627] 0 pages HighMem/MovableOnly [ 1061.567629] 313294 pages reserved [ 1061.616011] binder: 16363:16366 transaction failed 29189/-22, size 0-0 line 3014 [ 1061.616150] binder: undelivered TRANSACTION_ERROR: 29189 [ 1061.681097] vmalloc: allocation failure: 0 bytes [ 1061.681103] syz-executor.4: page allocation failure: order:0, mode:0x24000c2 [ 1061.681112] CPU: 0 PID: 16376 Comm: syz-executor.4 Not tainted 4.4.174+ #4 [ 1061.681124] 0000000000000000 6135c72e8f95cb0f ffff8801d040f9f0 ffffffff81aad1a1 [ 1061.681136] 1ffff1003a081f41 ffff8800b80bc740 00000000024000c2 0000000000000000 12:14:01 executing program 2: openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r0 = creat(&(0x7f0000000700)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x40000006100) ftruncate(r0, 0x208203) r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000008000/0x600000)=nil, 0x600000, 0x800002, 0x11, r1, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r2, &(0x7f0000000180)={0xa, 0x4e24, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) sendmmsg(r2, &(0x7f00000092c0), 0x4ff, 0x0) r3 = open(&(0x7f00000003c0)='./bus\x00', 0x0, 0x0) sendfile(r0, r3, 0x0, 0x8000fffffffe) r4 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r4, 0x1000008912, &(0x7f0000000000)="11dca5055e0acfec7be070") 12:14:01 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) 12:14:01 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) 12:14:01 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) 12:14:01 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x6, 0x1100082) r1 = memfd_create(&(0x7f0000000080)='t\bnu\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00', 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000340)=[{&(0x7f0000001140)='\'', 0x1}], 0x1, 0x1081804) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendfile(r0, r0, 0x0, 0x200000d) ioctl$LOOP_CLR_FD(r0, 0x4c01) syz_genetlink_get_family_id$tipc(0x0) dup3(r1, r0, 0x0) 12:14:01 executing program 0: openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)={'vet\x00\x00\x96T\x00\x00\x00\x00\x00\xbdh \x00', 0x402}) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000180)={'vd\x7f\x00\x16\x00\xf9V\xdbZ\xdd\x91\x80\xd2{\x00', 0x43732e5398417f1e}) close(r0) [ 1061.681146] ffffffff82895080 ffff8801d040fb00 ffffffff8148c0cb ffffffff00000001 12:14:01 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) 12:14:01 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) 12:14:01 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) [ 1061.681149] Call Trace: [ 1061.681162] [] dump_stack+0xc1/0x120 [ 1061.681174] [] warn_alloc_failed.cold+0x78/0x99 12:14:01 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) [ 1061.681184] [] ? zone_watermark_ok_safe+0x290/0x290 12:14:02 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) 12:14:02 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) [ 1061.681194] [] ? sel_write_load+0x9e/0xf90 [ 1061.681205] [] __vmalloc_node_range+0x365/0x650 [ 1061.681214] [] ? check_preemption_disabled+0x3c/0x200 [ 1061.681221] [] ? check_preemption_disabled+0x3c/0x200 [ 1061.681229] [] ? task_has_security+0x130/0x270 [ 1061.681237] [] vmalloc+0x5c/0x70 [ 1061.681244] [] ? sel_write_load+0x119/0xf90 [ 1061.681251] [] sel_write_load+0x119/0xf90 [ 1061.681259] [] ? sel_read_bool+0x240/0x240 [ 1061.681268] [] ? trace_hardirqs_on+0x10/0x10 [ 1061.681276] [] __vfs_write+0x116/0x3d0 [ 1061.681283] [] ? sel_read_bool+0x240/0x240 [ 1061.681290] [] ? __vfs_read+0x3c0/0x3c0 [ 1061.681298] [] ? check_preemption_disabled+0x3c/0x200 [ 1061.681305] [] ? check_preemption_disabled+0x3c/0x200 [ 1061.681314] [] ? rcu_read_lock_sched_held+0x10b/0x130 [ 1061.681322] [] ? rcu_sync_lockdep_assert+0x73/0xb0 [ 1061.681330] [] ? __sb_start_write+0x14f/0x310 [ 1061.681337] [] vfs_write+0x182/0x4e0 [ 1061.681345] [] SyS_write+0xdc/0x1c0 [ 1061.681353] [] ? SyS_read+0x1c0/0x1c0 [ 1061.681363] [] ? lockdep_sys_exit_thunk+0x12/0x14 [ 1061.681372] [] entry_SYSCALL_64_fastpath+0x1e/0x9a [ 1061.681376] Mem-Info: [ 1061.681400] active_anon:70055 inactive_anon:6050 isolated_anon:0 [ 1061.681400] active_file:11182 inactive_file:11777 isolated_file:0 [ 1061.681400] unevictable:0 dirty:11 writeback:0 unstable:0 [ 1061.681400] slab_reclaimable:4385 slab_unreclaimable:63260 [ 1061.681400] mapped:58964 shmem:8522 pagetables:8515 bounce:0 [ 1061.681400] free:1407692 free_pcp:386 free_cma:0 [ 1061.681433] DMA32 free:2577516kB min:4696kB low:5868kB high:7044kB active_anon:127536kB inactive_anon:11004kB active_file:19752kB inactive_file:20788kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:3145324kB managed:3021976kB mlocked:0kB dirty:0kB writeback:0kB mapped:107888kB shmem:15084kB slab_reclaimable:8324kB slab_unreclaimable:113096kB kernel_stack:6272kB pagetables:15236kB unstable:0kB bounce:0kB free_pcp:932kB local_pcp:344kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no [ 1061.681442] lowmem_reserve[]: 0 3504 3504 12:14:02 executing program 2: openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r0 = creat(&(0x7f0000000700)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x40000006100) ftruncate(r0, 0x208203) r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000008000/0x600000)=nil, 0x600000, 0x800002, 0x11, r1, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r2, &(0x7f0000000180)={0xa, 0x4e24, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) sendmmsg(r2, &(0x7f00000092c0), 0x4ff, 0x0) r3 = open(&(0x7f00000003c0)='./bus\x00', 0x0, 0x0) sendfile(r0, r3, 0x0, 0x8000fffffffe) r4 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r4, 0x1000008912, &(0x7f0000000000)="11dca5055e0acfec7be070") 12:14:02 executing program 0: openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)={'vet\x00\x00\x96T\x00\x00\x00\x00\x00\xbdh \x00', 0x402}) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000180)={'vd\x7f\x00\x16\x00\xf9V\xdbZ\xdd\x91\x80\xd2{\x00', 0x43732e5398417f1e}) close(r0) 12:14:02 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x6, 0x1100082) r1 = memfd_create(&(0x7f0000000080)='t\bnu\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00', 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000340)=[{&(0x7f0000001140)='\'', 0x1}], 0x1, 0x1081804) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendfile(r0, r0, 0x0, 0x200000d) ioctl$LOOP_CLR_FD(r0, 0x4c01) syz_genetlink_get_family_id$tipc(0x0) dup3(r1, r0, 0x0) 12:14:02 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) 12:14:02 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) 12:14:02 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) [ 1061.681475] Normal free:3053252kB min:5580kB low:6972kB high:8368kB active_anon:152684kB inactive_anon:13196kB active_file:24976kB inactive_file:26320kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:4718592kB managed:3588764kB mlocked:0kB dirty:44kB writeback:0kB mapped:127968kB shmem:19004kB slab_reclaimable:9216kB slab_unreclaimable:139944kB kernel_stack:7872kB pagetables:18824kB unstable:0kB bounce:0kB free_pcp:612kB local_pcp:300kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no [ 1061.681484] lowmem_reserve[]: 0 0 0 [ 1061.681540] DMA32: 317*4kB (UE) 327*8kB (UME) 308*16kB (UME) 204*32kB (UME) 76*64kB (UME) 26*128kB (UME) 11*256kB (UM) 5*512kB (M) 1*1024kB (E) 2*2048kB (UE) 621*4096kB (M) = 2577644kB 12:14:02 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) 12:14:02 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) [ 1061.681593] Normal: 301*4kB (UM) 226*8kB (UME) 286*16kB (UME) 197*32kB (UM) 88*64kB (UME) 33*128kB (UME) 10*256kB (UM) 8*512kB (UME) 4*1024kB (M) 4*2048kB (UME) 735*4096kB (M) = 3053252kB 12:14:02 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) 12:14:02 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) 12:14:02 executing program 0: openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)={'vet\x00\x00\x96T\x00\x00\x00\x00\x00\xbdh \x00', 0x402}) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000180)={'vd\x7f\x00\x16\x00\xf9V\xdbZ\xdd\x91\x80\xd2{\x00', 0x43732e5398417f1e}) close(r0) 12:14:02 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) [ 1061.681596] 31480 total pagecache pages [ 1061.681599] 0 pages in swap cache [ 1061.681604] Swap cache stats: add 0, delete 0, find 0/0 [ 1061.681606] Free swap = 0kB [ 1061.681608] Total swap = 0kB [ 1061.681611] 1965979 pages RAM [ 1061.681614] 0 pages HighMem/MovableOnly [ 1061.681616] 313294 pages reserved [ 1062.404519] vmalloc: allocation failure: 0 bytes [ 1062.404526] syz-executor.4: page allocation failure: order:0, mode:0x24000c2 [ 1062.404535] CPU: 0 PID: 16394 Comm: syz-executor.4 Not tainted 4.4.174+ #4 [ 1062.404548] 0000000000000000 6b66308c14675246 ffff8801d13ef9f0 ffffffff81aad1a1 [ 1062.404559] 1ffff1003a27df41 ffff8800b5d717c0 00000000024000c2 0000000000000000 [ 1062.404570] ffffffff82895080 ffff8801d13efb00 ffffffff8148c0cb ffffffff00000001 [ 1062.404573] Call Trace: [ 1062.404589] [] dump_stack+0xc1/0x120 [ 1062.404602] [] warn_alloc_failed.cold+0x78/0x99 [ 1062.404614] [] ? zone_watermark_ok_safe+0x290/0x290 [ 1062.404624] [] ? sel_write_load+0x9e/0xf90 [ 1062.404635] [] __vmalloc_node_range+0x365/0x650 [ 1062.404645] [] ? check_preemption_disabled+0x3c/0x200 [ 1062.404653] [] ? check_preemption_disabled+0x3c/0x200 [ 1062.404661] [] ? task_has_security+0x130/0x270 [ 1062.404668] [] vmalloc+0x5c/0x70 [ 1062.404676] [] ? sel_write_load+0x119/0xf90 [ 1062.404683] [] sel_write_load+0x119/0xf90 [ 1062.404691] [] ? sel_read_bool+0x240/0x240 [ 1062.404700] [] ? trace_hardirqs_on+0x10/0x10 [ 1062.404708] [] __vfs_write+0x116/0x3d0 [ 1062.404717] [] ? sel_read_bool+0x240/0x240 [ 1062.404725] [] ? __vfs_read+0x3c0/0x3c0 [ 1062.404735] [] ? check_preemption_disabled+0x3c/0x200 [ 1062.404743] [] ? check_preemption_disabled+0x3c/0x200 [ 1062.404753] [] ? rcu_read_lock_sched_held+0x10b/0x130 [ 1062.404760] [] ? rcu_sync_lockdep_assert+0x73/0xb0 [ 1062.404770] [] ? __sb_start_write+0x14f/0x310 [ 1062.404777] [] vfs_write+0x182/0x4e0 [ 1062.404785] [] SyS_write+0xdc/0x1c0 [ 1062.404792] [] ? SyS_read+0x1c0/0x1c0 [ 1062.404802] [] ? lockdep_sys_exit_thunk+0x12/0x14 [ 1062.404812] [] entry_SYSCALL_64_fastpath+0x1e/0x9a [ 1062.404815] Mem-Info: [ 1062.404837] active_anon:70031 inactive_anon:5725 isolated_anon:0 [ 1062.404837] active_file:11182 inactive_file:11777 isolated_file:0 [ 1062.404837] unevictable:0 dirty:35 writeback:0 unstable:0 [ 1062.404837] slab_reclaimable:4385 slab_unreclaimable:63242 [ 1062.404837] mapped:58964 shmem:8152 pagetables:8552 bounce:0 [ 1062.404837] free:1407898 free_pcp:562 free_cma:0 12:14:03 executing program 2: openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r0 = creat(&(0x7f0000000700)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x40000006100) ftruncate(r0, 0x208203) r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000008000/0x600000)=nil, 0x600000, 0x800002, 0x11, r1, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r2, &(0x7f0000000180)={0xa, 0x4e24, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) sendmmsg(r2, &(0x7f00000092c0), 0x4ff, 0x0) r3 = open(&(0x7f00000003c0)='./bus\x00', 0x0, 0x0) sendfile(r0, r3, 0x0, 0x8000fffffffe) r4 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r4, 0x1000008912, &(0x7f0000000000)="11dca5055e0acfec7be070") 12:14:03 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) 12:14:03 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) 12:14:03 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x6, 0x1100082) r1 = memfd_create(&(0x7f0000000080)='t\bnu\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00', 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000340)=[{&(0x7f0000001140)='\'', 0x1}], 0x1, 0x1081804) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendfile(r0, r0, 0x0, 0x200000d) ioctl$LOOP_CLR_FD(r0, 0x4c01) syz_genetlink_get_family_id$tipc(0x0) dup3(r1, r0, 0x0) 12:14:03 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) 12:14:03 executing program 0: openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)={'vet\x00\x00\x96T\x00\x00\x00\x00\x00\xbdh \x00', 0x402}) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000180)={'vd\x7f\x00\x16\x00\xf9V\xdbZ\xdd\x91\x80\xd2{\x00', 0x43732e5398417f1e}) close(r0) [ 1062.404868] DMA32 free:2577948kB min:4696kB low:5868kB high:7044kB active_anon:127428kB inactive_anon:10220kB active_file:19752kB inactive_file:20788kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:3145324kB managed:3021976kB mlocked:0kB dirty:8kB writeback:0kB mapped:107828kB shmem:14268kB slab_reclaimable:8324kB slab_unreclaimable:112856kB kernel_stack:6240kB pagetables:15436kB unstable:0kB bounce:0kB free_pcp:1296kB local_pcp:720kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no [ 1062.404878] lowmem_reserve[]: 0 3504 3504 12:14:03 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) 12:14:03 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) 12:14:03 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) [ 1062.404914] Normal free:3053644kB min:5580kB low:6972kB high:8368kB active_anon:152696kB inactive_anon:12680kB active_file:24976kB inactive_file:26320kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:4718592kB managed:3588764kB mlocked:0kB dirty:132kB writeback:0kB mapped:128028kB shmem:18340kB slab_reclaimable:9216kB slab_unreclaimable:140112kB kernel_stack:7904kB pagetables:18772kB unstable:0kB bounce:0kB free_pcp:952kB local_pcp:532kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no 12:14:03 executing program 0: openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)={'vet\x00\x00\x96T\x00\x00\x00\x00\x00\xbdh \x00', 0x402}) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000180)={'vd\x7f\x00\x16\x00\xf9V\xdbZ\xdd\x91\x80\xd2{\x00', 0x43732e5398417f1e}) close(r0) 12:14:03 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x6, 0x1100082) r1 = memfd_create(&(0x7f0000000080)='t\bnu\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00', 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000340)=[{&(0x7f0000001140)='\'', 0x1}], 0x1, 0x1081804) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendfile(r0, r0, 0x0, 0x200000d) ioctl$LOOP_CLR_FD(r0, 0x4c01) syz_genetlink_get_family_id$tipc(0x0) dup3(r1, r0, 0x0) 12:14:03 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) ** 49 printk messages dropped ** [ 1062.520119] lowmem_reserve[]: 0 3504 3504 [ 1062.520157] Normal free:3052824kB min:5580kB low:6972kB high:8368kB active_anon:152796kB inactive_anon:12980kB active_file:24976kB inactive_file:26320kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:4718592kB managed:3588764kB mlocked:0kB dirty:132kB writeback:0kB mapped:128028kB shmem:18932kB slab_reclaimable:9216kB slab_unreclaimable:140112kB kernel_stack:7904kB pagetables:18920kB unstable:0kB bounce:0kB free_pcp:400kB local_pcp:248kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no [ 1062.520166] lowmem_reserve[]: 0 0 0 [ 1062.520290] DMA32: 446*4kB (UME) 303*8kB (UME) 313*16kB (UME) 190*32kB (UME) 76*64kB (UME) 26*128kB (UME) 11*256kB (UM) 5*512kB (M) 1*1024kB (E) 2*2048kB (UE) 621*4096kB (M) = 2577600kB [ 1062.520344] Normal: 244*4kB (UM) 239*8kB (UME) 285*16kB (UME) 191*32kB (UM) 88*64kB (UME) 32*128kB (UME) 10*256kB (UM) 8*512kB (UME) 4*1024kB (M) 4*2048kB (UME) 735*4096kB (M) = 3052792kB [ 1062.520347] 31443 total pagecache pages [ 1062.520350] 0 pages in swap cache [ 1062.520355] Swap cache stats: add 0, delete 0, find 0/0 [ 1062.520358] Free swap = 0kB [ 1062.520360] Total swap = 0kB [ 1062.520363] 1965979 pages RAM [ 1062.520365] 0 pages HighMem/MovableOnly [ 1062.520367] 313294 pages reserved [ 1062.550110] binder: 16411:16415 transaction failed 29189/-22, size 0-0 line 3014 [ 1062.550259] binder: undelivered TRANSACTION_ERROR: 29189 [ 1062.597525] vmalloc: allocation failure: 0 bytes [ 1062.597532] syz-executor.4: page allocation failure: order:0, mode:0x24000c2 [ 1062.597542] CPU: 1 PID: 16421 Comm: syz-executor.4 Not tainted 4.4.174+ #4 [ 1062.597556] 0000000000000000 0ec11b00c95078c1 ffff8801d13ef9f0 ffffffff81aad1a1 [ 1062.597567] 1ffff1003a27df41 ffff8801bfdaaf80 00000000024000c2 0000000000000000 [ 1062.597578] ffffffff82895080 ffff8801d13efb00 ffffffff8148c0cb ffffffff00000001 [ 1062.597581] Call Trace: [ 1062.597596] [] dump_stack+0xc1/0x120 [ 1062.597609] [] warn_alloc_failed.cold+0x78/0x99 [ 1062.597619] [] ? zone_watermark_ok_safe+0x290/0x290 [ 1062.597628] [] ? sel_write_load+0x9e/0xf90 [ 1062.597639] [] __vmalloc_node_range+0x365/0x650 [ 1062.597650] [] ? check_preemption_disabled+0x3c/0x200 [ 1062.597658] [] ? check_preemption_disabled+0x3c/0x200 [ 1062.597666] [] ? task_has_security+0x130/0x270 [ 1062.597674] [] vmalloc+0x5c/0x70 [ 1062.597682] [] ? sel_write_load+0x119/0xf90 [ 1062.597690] [] sel_write_load+0x119/0xf90 [ 1062.597698] [] ? sel_read_bool+0x240/0x240 [ 1062.597707] [] ? trace_hardirqs_on+0x10/0x10 [ 1062.597716] [] __vfs_write+0x116/0x3d0 12:14:04 executing program 2: openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r0 = creat(&(0x7f0000000700)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x40000006100) ftruncate(r0, 0x208203) r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000008000/0x600000)=nil, 0x600000, 0x800002, 0x11, r1, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r2, &(0x7f0000000180)={0xa, 0x4e24, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) sendmmsg(r2, &(0x7f00000092c0), 0x4ff, 0x0) r3 = open(&(0x7f00000003c0)='./bus\x00', 0x0, 0x0) sendfile(r0, r3, 0x0, 0x8000fffffffe) r4 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r4, 0x1000008912, &(0x7f0000000000)="11dca5055e0acfec7be070") 12:14:04 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) 12:14:04 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) 12:14:04 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x6, 0x1100082) r1 = memfd_create(&(0x7f0000000080)='t\bnu\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00', 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000340)=[{&(0x7f0000001140)='\'', 0x1}], 0x1, 0x1081804) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendfile(r0, r0, 0x0, 0x200000d) ioctl$LOOP_CLR_FD(r0, 0x4c01) syz_genetlink_get_family_id$tipc(0x0) dup3(r1, r0, 0x0) 12:14:04 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) 12:14:04 executing program 0: openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)={'vet\x00\x00\x96T\x00\x00\x00\x00\x00\xbdh \x00', 0x402}) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000180)={'vd\x7f\x00\x16\x00\xf9V\xdbZ\xdd\x91\x80\xd2{\x00', 0x43732e5398417f1e}) close(r0) [ 1062.597723] [] ? sel_read_bool+0x240/0x240 [ 1062.597730] [] ? __vfs_read+0x3c0/0x3c0 [ 1062.597737] [] ? check_preemption_disabled+0x3c/0x200 [ 1062.597746] [] ? check_preemption_disabled+0x3c/0x200 [ 1062.597757] [] ? rcu_read_lock_sched_held+0x10b/0x130 12:14:04 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) 12:14:04 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) [ 1062.597767] [] ? rcu_sync_lockdep_assert+0x73/0xb0 ** 1 printk messages dropped ** [ 1062.597786] [] vfs_write+0x182/0x4e0 12:14:04 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) 12:14:04 executing program 0: openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)={'vet\x00\x00\x96T\x00\x00\x00\x00\x00\xbdh \x00', 0x402}) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000180)={'vd\x7f\x00\x16\x00\xf9V\xdbZ\xdd\x91\x80\xd2{\x00', 0x43732e5398417f1e}) close(r0) ** 7 printk messages dropped ** [ 1062.597903] lowmem_reserve[]: 0 3504 3504 12:14:04 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) 12:14:04 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) [ 1062.597940] Normal free:3052792kB min:5580kB low:6972kB high:8368kB active_anon:152796kB inactive_anon:13380kB active_file:24976kB inactive_file:26320kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:4718592kB managed:3588764kB mlocked:0kB dirty:132kB writeback:0kB mapped:128028kB shmem:19228kB slab_reclaimable:9216kB slab_unreclaimable:140336kB kernel_stack:7904kB pagetables:18772kB unstable:0kB bounce:0kB free_pcp:620kB local_pcp:392kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no ** 96 printk messages dropped ** [ 1063.372849] [] entry_SYSCALL_64_fastpath+0x1e/0x9a [ 1063.372852] Mem-Info: [ 1063.372875] active_anon:70114 inactive_anon:5801 isolated_anon:0 [ 1063.372875] active_file:11182 inactive_file:11777 isolated_file:0 [ 1063.372875] unevictable:0 dirty:47 writeback:0 unstable:0 [ 1063.372875] slab_reclaimable:4385 slab_unreclaimable:63516 [ 1063.372875] mapped:59008 shmem:8260 pagetables:8576 bounce:0 [ 1063.372875] free:1407553 free_pcp:340 free_cma:0 [ 1063.372912] DMA32 free:2578376kB min:4696kB low:5868kB high:7044kB active_anon:127680kB inactive_anon:10408kB active_file:19752kB inactive_file:20788kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:3145324kB managed:3021976kB mlocked:0kB dirty:8kB writeback:0kB mapped:107988kB shmem:14448kB slab_reclaimable:8324kB slab_unreclaimable:112516kB kernel_stack:6464kB pagetables:15420kB unstable:0kB bounce:0kB free_pcp:628kB local_pcp:188kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no [ 1063.372921] lowmem_reserve[]: 0 3504 3504 [ 1063.372966] Normal free:3051836kB min:5580kB low:6972kB high:8368kB active_anon:152776kB inactive_anon:12796kB active_file:24976kB inactive_file:26320kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:4718592kB managed:3588764kB mlocked:0kB dirty:180kB writeback:0kB mapped:128044kB shmem:18592kB slab_reclaimable:9216kB slab_unreclaimable:141548kB kernel_stack:8000kB pagetables:18884kB unstable:0kB bounce:0kB free_pcp:732kB local_pcp:320kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no [ 1063.372974] lowmem_reserve[]: 0 0 0 [ 1063.373033] DMA32: 470*4kB (UME) 350*8kB (UME) 314*16kB (UME) 194*32kB (UME) 77*64kB (UME) 26*128kB (UME) 11*256kB (UM) 5*512kB (M) 1*1024kB (E) 2*2048kB (UE) 621*4096kB (M) = 2578280kB [ 1063.373093] Normal: 83*4kB (UM) 232*8kB (UME) 285*16kB (UME) 182*32kB (UM) 88*64kB (UME) 32*128kB (UME) 10*256kB (UM) 8*512kB (UME) 4*1024kB (M) 4*2048kB (UME) 735*4096kB (M) = 3051804kB [ 1063.373096] 31218 total pagecache pages [ 1063.373100] 0 pages in swap cache [ 1063.373105] Swap cache stats: add 0, delete 0, find 0/0 [ 1063.373108] Free swap = 0kB [ 1063.373111] Total swap = 0kB [ 1063.373114] 1965979 pages RAM [ 1063.373117] 0 pages HighMem/MovableOnly [ 1063.373120] 313294 pages reserved [ 1064.117737] binder: 16478:16490 transaction failed 29189/-22, size 0-0 line 3014 [ 1064.117880] binder: undelivered TRANSACTION_ERROR: 29189 [ 1064.242462] binder: 16502:16510 transaction failed 29189/-22, size 0-0 line 3014 [ 1064.242605] binder: undelivered TRANSACTION_ERROR: 29189 [ 1064.342918] binder: 16514:16516 transaction failed 29189/-22, size 0-0 line 3014 [ 1064.343039] binder: undelivered TRANSACTION_ERROR: 29189 [ 1064.896011] binder: 16521:16529 transaction failed 29189/-22, size 0-0 line 3014 [ 1064.896179] binder: undelivered TRANSACTION_ERROR: 29189 [ 1064.950225] binder: 16535:16538 transaction failed 29189/-22, size 0-0 line 3014 [ 1064.950359] binder: undelivered TRANSACTION_ERROR: 29189 [ 1065.022435] binder: 16544:16548 transaction failed 29189/-22, size 0-0 line 3014 [ 1065.022558] binder: undelivered TRANSACTION_ERROR: 29189 [ 1065.109369] binder: 16555:16560 transaction failed 29189/-22, size 0-0 line 3014 [ 1065.109546] binder: undelivered TRANSACTION_ERROR: 29189 [ 1065.573008] binder: 16564:16570 transaction failed 29189/-22, size 0-0 line 3014 12:14:05 executing program 2: openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r0 = creat(&(0x7f0000000700)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x40000006100) ftruncate(r0, 0x208203) r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000008000/0x600000)=nil, 0x600000, 0x800002, 0x11, r1, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r2, &(0x7f0000000180)={0xa, 0x4e24, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) sendmmsg(r2, &(0x7f00000092c0), 0x4ff, 0x0) r3 = open(&(0x7f00000003c0)='./bus\x00', 0x0, 0x0) sendfile(r0, r3, 0x0, 0x8000fffffffe) r4 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r4, 0x1000008912, &(0x7f0000000000)="11dca5055e0acfec7be070") 12:14:05 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) 12:14:05 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x6, 0x1100082) r1 = memfd_create(&(0x7f0000000080)='t\bnu\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00', 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000340)=[{&(0x7f0000001140)='\'', 0x1}], 0x1, 0x1081804) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendfile(r0, r0, 0x0, 0x200000d) ioctl$LOOP_CLR_FD(r0, 0x4c01) syz_genetlink_get_family_id$tipc(0x0) dup3(r1, r0, 0x0) 12:14:05 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) 12:14:05 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) 12:14:05 executing program 0: openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)={'vet\x00\x00\x96T\x00\x00\x00\x00\x00\xbdh \x00', 0x402}) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000180)={'vd\x7f\x00\x16\x00\xf9V\xdbZ\xdd\x91\x80\xd2{\x00', 0x43732e5398417f1e}) close(r0) 12:14:05 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) [ 1065.573267] binder: undelivered TRANSACTION_ERROR: 29189 [ 1066.540950] binder: 16616:16620 transaction failed 29189/-22, size 0-0 line 3014 [ 1066.541219] warn_alloc_failed: 9 callbacks suppressed [ 1066.541225] vmalloc: allocation failure: 0 bytes [ 1066.541230] syz-executor.4: page allocation failure: order:0, mode:0x24000c2 12:14:05 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) 12:14:05 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) [ 1066.541240] CPU: 1 PID: 16622 Comm: syz-executor.4 Not tainted 4.4.174+ #4 ** 12 printk messages dropped ** [ 1066.541369] [] vmalloc+0x5c/0x70 12:14:05 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x6, 0x1100082) r1 = memfd_create(&(0x7f0000000080)='t\bnu\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00', 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000340)=[{&(0x7f0000001140)='\'', 0x1}], 0x1, 0x1081804) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendfile(r0, r0, 0x0, 0x200000d) ioctl$LOOP_CLR_FD(r0, 0x4c01) syz_genetlink_get_family_id$tipc(0x0) dup3(r1, r0, 0x0) 12:14:05 executing program 0: openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)={'vet\x00\x00\x96T\x00\x00\x00\x00\x00\xbdh \x00', 0x402}) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000180)={'vd\x7f\x00\x16\x00\xf9V\xdbZ\xdd\x91\x80\xd2{\x00', 0x43732e5398417f1e}) close(r0) 12:14:05 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) [ 1066.541376] [] ? sel_write_load+0x119/0xf90 ** 48 printk messages dropped ** [ 1066.616359] [] ? task_has_security+0x130/0x270 ** 2 printk messages dropped ** [ 1066.616382] [] sel_write_load+0x119/0xf90 [ 1066.616389] [] ? sel_read_bool+0x240/0x240 [ 1066.616398] [] ? trace_hardirqs_on+0x10/0x10 [ 1066.616407] [] __vfs_write+0x116/0x3d0 [ 1066.616415] [] ? sel_read_bool+0x240/0x240 [ 1066.616425] [] ? __vfs_read+0x3c0/0x3c0 [ 1066.616433] [] ? check_preemption_disabled+0x3c/0x200 [ 1066.616440] [] ? check_preemption_disabled+0x3c/0x200 [ 1066.616452] [] ? rcu_read_lock_sched_held+0x10b/0x130 [ 1066.616460] [] ? rcu_sync_lockdep_assert+0x73/0xb0 [ 1066.616472] [] ? __sb_start_write+0x14f/0x310 [ 1066.616487] [] vfs_write+0x182/0x4e0 [ 1066.616496] [] SyS_write+0xdc/0x1c0 [ 1066.616504] [] ? SyS_read+0x1c0/0x1c0 [ 1066.616517] [] ? lockdep_sys_exit_thunk+0x12/0x14 [ 1066.616527] [] entry_SYSCALL_64_fastpath+0x1e/0x9a [ 1066.628613] Mem-Info: [ 1066.628641] active_anon:70080 inactive_anon:6075 isolated_anon:0 [ 1066.628641] active_file:11182 inactive_file:11777 isolated_file:0 [ 1066.628641] unevictable:0 dirty:47 writeback:0 unstable:0 [ 1066.628641] slab_reclaimable:4385 slab_unreclaimable:63428 [ 1066.628641] mapped:58964 shmem:8522 pagetables:8552 bounce:0 [ 1066.628641] free:1407225 free_pcp:587 free_cma:0 [ 1066.628679] DMA32 free:2577500kB min:4696kB low:5868kB high:7044kB active_anon:127596kB inactive_anon:11124kB active_file:19752kB inactive_file:20788kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:3145324kB managed:3021976kB mlocked:0kB dirty:8kB writeback:0kB mapped:107888kB shmem:15204kB slab_reclaimable:8324kB slab_unreclaimable:112664kB kernel_stack:6304kB pagetables:15156kB unstable:0kB bounce:0kB free_pcp:1204kB local_pcp:516kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no [ 1066.628688] lowmem_reserve[]: 0 3504 3504 [ 1066.628724] Normal free:3051400kB min:5580kB low:6972kB high:8368kB active_anon:152724kB inactive_anon:13176kB active_file:24976kB inactive_file:26320kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:4718592kB managed:3588764kB mlocked:0kB dirty:180kB writeback:0kB mapped:127968kB shmem:18884kB slab_reclaimable:9216kB slab_unreclaimable:141048kB kernel_stack:7840kB pagetables:19052kB unstable:0kB bounce:0kB free_pcp:1136kB local_pcp:504kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no [ 1066.628733] lowmem_reserve[]: 0 0 0 [ 1066.628795] DMA32: 327*4kB (UE) 313*8kB (UME) 318*16kB (UME) 192*32kB (UME) 79*64kB (UME) 26*128kB (UME) 11*256kB (UM) 5*512kB (M) 1*1024kB (E) 2*2048kB (UE) 621*4096kB (M) = 2577540kB [ 1066.629013] Normal: 32*4kB (UM) 187*8kB (UME) 287*16kB (UME) 179*32kB (UM) 89*64kB (UME) 33*128kB (UME) 10*256kB (UM) 8*512kB (UME) 4*1024kB (M) 4*2048kB (UME) 735*4096kB (M) = 3051368kB [ 1066.629017] 31480 total pagecache pages [ 1066.629021] 0 pages in swap cache [ 1066.629026] Swap cache stats: add 0, delete 0, find 0/0 [ 1066.629029] Free swap = 0kB [ 1066.629032] Total swap = 0kB [ 1066.629035] 1965979 pages RAM 12:14:06 executing program 2: openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r0 = creat(&(0x7f0000000700)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x40000006100) ftruncate(r0, 0x208203) r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000008000/0x600000)=nil, 0x600000, 0x800002, 0x11, r1, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r2, &(0x7f0000000180)={0xa, 0x4e24, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) sendmmsg(r2, &(0x7f00000092c0), 0x4ff, 0x0) r3 = open(&(0x7f00000003c0)='./bus\x00', 0x0, 0x0) sendfile(r0, r3, 0x0, 0x8000fffffffe) r4 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r4, 0x1000008912, &(0x7f0000000000)="11dca5055e0acfec7be070") 12:14:06 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) 12:14:06 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) 12:14:06 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) 12:14:06 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x6, 0x1100082) r1 = memfd_create(&(0x7f0000000080)='t\bnu\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00', 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000340)=[{&(0x7f0000001140)='\'', 0x1}], 0x1, 0x1081804) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendfile(r0, r0, 0x0, 0x200000d) ioctl$LOOP_CLR_FD(r0, 0x4c01) syz_genetlink_get_family_id$tipc(0x0) dup3(r1, r0, 0x0) 12:14:06 executing program 0: openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)={'vet\x00\x00\x96T\x00\x00\x00\x00\x00\xbdh \x00', 0x402}) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000180)={'vd\x7f\x00\x16\x00\xf9V\xdbZ\xdd\x91\x80\xd2{\x00', 0x43732e5398417f1e}) close(r0) [ 1066.629038] 0 pages HighMem/MovableOnly [ 1066.629040] 313294 pages reserved [ 1066.687634] binder: 16628:16637 transaction failed 29189/-22, size 0-0 line 3014 12:14:06 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) 12:14:06 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) 12:14:06 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) ** 18 printk messages dropped ** [ 1066.730544] [] sel_write_load+0x119/0xf90 [ 1066.730553] [] ? sel_read_bool+0x240/0x240 [ 1066.730562] [] ? trace_hardirqs_on+0x10/0x10 [ 1066.730570] [] __vfs_write+0x116/0x3d0 12:14:06 executing program 0: openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)={'vet\x00\x00\x96T\x00\x00\x00\x00\x00\xbdh \x00', 0x402}) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000180)={'vd\x7f\x00\x16\x00\xf9V\xdbZ\xdd\x91\x80\xd2{\x00', 0x43732e5398417f1e}) close(r0) 12:14:06 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x6, 0x1100082) r1 = memfd_create(&(0x7f0000000080)='t\bnu\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00', 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000340)=[{&(0x7f0000001140)='\'', 0x1}], 0x1, 0x1081804) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendfile(r0, r0, 0x0, 0x200000d) ioctl$LOOP_CLR_FD(r0, 0x4c01) syz_genetlink_get_family_id$tipc(0x0) dup3(r1, r0, 0x0) 12:14:06 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) [ 1066.730578] [] ? sel_read_bool+0x240/0x240 [ 1066.730585] [] ? __vfs_read+0x3c0/0x3c0 [ 1066.730593] [] ? check_preemption_disabled+0x3c/0x200 [ 1066.730601] [] ? check_preemption_disabled+0x3c/0x200 [ 1066.730610] [] ? rcu_read_lock_sched_held+0x10b/0x130 [ 1066.730618] [] ? rcu_sync_lockdep_assert+0x73/0xb0 [ 1066.730627] [] ? __sb_start_write+0x14f/0x310 [ 1066.730635] [] vfs_write+0x182/0x4e0 [ 1066.730642] [] SyS_write+0xdc/0x1c0 [ 1066.730650] [] ? SyS_read+0x1c0/0x1c0 [ 1066.730661] [] ? lockdep_sys_exit_thunk+0x12/0x14 [ 1066.730670] [] entry_SYSCALL_64_fastpath+0x1e/0x9a [ 1066.730673] Mem-Info: [ 1066.730699] active_anon:70105 inactive_anon:6200 isolated_anon:0 [ 1066.730699] active_file:11182 inactive_file:11777 isolated_file:0 [ 1066.730699] unevictable:0 dirty:47 writeback:0 unstable:0 [ 1066.730699] slab_reclaimable:4385 slab_unreclaimable:63397 [ 1066.730699] mapped:59001 shmem:8633 pagetables:8589 bounce:0 [ 1066.730699] free:1407094 free_pcp:473 free_cma:0 [ 1066.730737] DMA32 free:2577024kB min:4696kB low:5868kB high:7044kB active_anon:127796kB inactive_anon:11124kB active_file:19752kB inactive_file:20788kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:3145324kB managed:3021976kB mlocked:0kB dirty:8kB writeback:0kB mapped:108036kB shmem:15204kB slab_reclaimable:8324kB slab_unreclaimable:112540kB kernel_stack:6304kB pagetables:15452kB unstable:0kB bounce:0kB free_pcp:692kB local_pcp:400kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no [ 1066.730747] lowmem_reserve[]: 0 3504 3504 [ 1066.730778] Normal free:3051352kB min:5580kB low:6972kB high:8368kB active_anon:152624kB inactive_anon:13676kB active_file:24976kB inactive_file:26320kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:4718592kB managed:3588764kB mlocked:0kB dirty:180kB writeback:0kB mapped:127968kB shmem:19328kB slab_reclaimable:9216kB slab_unreclaimable:141048kB kernel_stack:7840kB pagetables:18904kB unstable:0kB bounce:0kB free_pcp:1200kB local_pcp:624kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no [ 1066.730787] lowmem_reserve[]: 0 0 0 [ 1066.730850] DMA32: 284*4kB (UME) 320*8kB (UME) 317*16kB (UME) 187*32kB (UME) 79*64kB (UME) 25*128kB (UME) 11*256kB (UM) 5*512kB (M) 1*1024kB (E) 2*2048kB (UE) 621*4096kB (M) = 2577120kB [ 1066.730904] Normal: 58*4kB (UM) 174*8kB (UME) 287*16kB (UME) 181*32kB (UM) 89*64kB (UME) 33*128kB (UME) 10*256kB (UM) 8*512kB (UME) 4*1024kB (M) 4*2048kB (UME) 735*4096kB (M) = 3051432kB [ 1066.730907] 31591 total pagecache pages 12:14:06 executing program 2: openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r0 = creat(&(0x7f0000000700)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x40000006100) ftruncate(r0, 0x208203) r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000008000/0x600000)=nil, 0x600000, 0x800002, 0x11, r1, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r2, &(0x7f0000000180)={0xa, 0x4e24, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) sendmmsg(r2, &(0x7f00000092c0), 0x4ff, 0x0) r3 = open(&(0x7f00000003c0)='./bus\x00', 0x0, 0x0) sendfile(r0, r3, 0x0, 0x8000fffffffe) r4 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r4, 0x1000008912, &(0x7f0000000000)="11dca5055e0acfec7be070") 12:14:06 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) 12:14:06 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) 12:14:06 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) 12:14:06 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x6, 0x1100082) r1 = memfd_create(&(0x7f0000000080)='t\bnu\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00', 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000340)=[{&(0x7f0000001140)='\'', 0x1}], 0x1, 0x1081804) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendfile(r0, r0, 0x0, 0x200000d) ioctl$LOOP_CLR_FD(r0, 0x4c01) syz_genetlink_get_family_id$tipc(0x0) dup3(r1, r0, 0x0) 12:14:06 executing program 0: openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)={'vet\x00\x00\x96T\x00\x00\x00\x00\x00\xbdh \x00', 0x402}) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000180)={'vd\x7f\x00\x16\x00\xf9V\xdbZ\xdd\x91\x80\xd2{\x00', 0x43732e5398417f1e}) close(r0) [ 1066.730911] 0 pages in swap cache [ 1066.730917] Swap cache stats: add 0, delete 0, find 0/0 [ 1066.730920] Free swap = 0kB [ 1066.730922] Total swap = 0kB 12:14:06 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) 12:14:06 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) 12:14:06 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) [ 1066.730925] 1965979 pages RAM [ 1066.730928] 0 pages HighMem/MovableOnly [ 1066.730930] 313294 pages reserved [ 1067.269988] binder: 16657:16658 transaction failed 29189/-22, size 0-0 line 3014 12:14:07 executing program 0: openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)={'vet\x00\x00\x96T\x00\x00\x00\x00\x00\xbdh \x00', 0x402}) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000180)={'vd\x7f\x00\x16\x00\xf9V\xdbZ\xdd\x91\x80\xd2{\x00', 0x43732e5398417f1e}) close(r0) 12:14:07 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) 12:14:07 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) [ 1067.270155] binder: undelivered TRANSACTION_ERROR: 29189 [ 1067.277815] vmalloc: allocation failure: 0 bytes [ 1067.277821] syz-executor.4: page allocation failure: order:0, mode:0x24000c2 [ 1067.277831] CPU: 1 PID: 16661 Comm: syz-executor.4 Not tainted 4.4.174+ #4 [ 1067.277843] 0000000000000000 5833d6c7805fa76b ffff8800b50779f0 ffffffff81aad1a1 [ 1067.277855] 1ffff10016a0ef41 ffff8800a5c6df00 00000000024000c2 0000000000000000 [ 1067.277867] ffffffff82895080 ffff8800b5077b00 ffffffff8148c0cb ffffffff00000001 [ 1067.277869] Call Trace: [ 1067.277884] [] dump_stack+0xc1/0x120 [ 1067.277897] [] warn_alloc_failed.cold+0x78/0x99 [ 1067.277910] [] ? zone_watermark_ok_safe+0x290/0x290 [ 1067.277919] [] ? sel_write_load+0x9e/0xf90 [ 1067.277929] [] __vmalloc_node_range+0x365/0x650 [ 1067.277937] [] ? check_preemption_disabled+0x3c/0x200 [ 1067.277947] [] ? check_preemption_disabled+0x3c/0x200 [ 1067.277957] [] ? task_has_security+0x130/0x270 [ 1067.277966] [] vmalloc+0x5c/0x70 [ 1067.277975] [] ? sel_write_load+0x119/0xf90 [ 1067.277984] [] sel_write_load+0x119/0xf90 [ 1067.277992] [] ? sel_read_bool+0x240/0x240 [ 1067.278002] [] ? trace_hardirqs_on+0x10/0x10 [ 1067.278012] [] __vfs_write+0x116/0x3d0 [ 1067.278021] [] ? sel_read_bool+0x240/0x240 [ 1067.278030] [] ? __vfs_read+0x3c0/0x3c0 [ 1067.278038] [] ? check_preemption_disabled+0x3c/0x200 [ 1067.278046] [] ? check_preemption_disabled+0x3c/0x200 [ 1067.278056] [] ? rcu_read_lock_sched_held+0x10b/0x130 [ 1067.278064] [] ? rcu_sync_lockdep_assert+0x73/0xb0 [ 1067.278073] [] ? __sb_start_write+0x14f/0x310 [ 1067.278080] [] vfs_write+0x182/0x4e0 [ 1067.278088] [] SyS_write+0xdc/0x1c0 [ 1067.278096] [] ? SyS_read+0x1c0/0x1c0 [ 1067.278109] [] ? lockdep_sys_exit_thunk+0x12/0x14 [ 1067.278120] [] entry_SYSCALL_64_fastpath+0x1e/0x9a [ 1067.278124] Mem-Info: [ 1067.278151] active_anon:70016 inactive_anon:5680 isolated_anon:0 [ 1067.278151] active_file:11182 inactive_file:11777 isolated_file:0 [ 1067.278151] unevictable:0 dirty:47 writeback:0 unstable:0 [ 1067.278151] slab_reclaimable:4385 slab_unreclaimable:63400 [ 1067.278151] mapped:58948 shmem:8139 pagetables:8488 bounce:0 [ 1067.278151] free:1407958 free_pcp:516 free_cma:0 12:14:07 executing program 2: openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r0 = creat(&(0x7f0000000700)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x40000006100) ftruncate(r0, 0x208203) r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000008000/0x600000)=nil, 0x600000, 0x800002, 0x11, r1, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r2, &(0x7f0000000180)={0xa, 0x4e24, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) sendmmsg(r2, &(0x7f00000092c0), 0x4ff, 0x0) r3 = open(&(0x7f00000003c0)='./bus\x00', 0x0, 0x0) sendfile(r0, r3, 0x0, 0x8000fffffffe) r4 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r4, 0x1000008912, &(0x7f0000000000)="11dca5055e0acfec7be070") 12:14:07 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x6, 0x1100082) r1 = memfd_create(&(0x7f0000000080)='t\bnu\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00', 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000340)=[{&(0x7f0000001140)='\'', 0x1}], 0x1, 0x1081804) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendfile(r0, r0, 0x0, 0x200000d) ioctl$LOOP_CLR_FD(r0, 0x4c01) syz_genetlink_get_family_id$tipc(0x0) dup3(r1, r0, 0x0) 12:14:07 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) 12:14:07 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) 12:14:07 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) 12:14:07 executing program 0: openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)={'vet\x00\x00\x96T\x00\x00\x00\x00\x00\xbdh \x00', 0x402}) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000180)={'vd\x7f\x00\x16\x00\xf9V\xdbZ\xdd\x91\x80\xd2{\x00', 0x43732e5398417f1e}) close(r0) [ 1067.278185] DMA32 free:2578512kB min:4696kB low:5868kB high:7044kB active_anon:127508kB inactive_anon:10204kB active_file:19752kB inactive_file:20788kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:3145324kB managed:3021976kB mlocked:0kB dirty:8kB writeback:0kB mapped:107824kB shmem:14284kB slab_reclaimable:8324kB slab_unreclaimable:112304kB kernel_stack:6432kB pagetables:15492kB unstable:0kB bounce:0kB free_pcp:1300kB local_pcp:636kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no [ 1067.278197] lowmem_reserve[]: 0 3504 3504 12:14:07 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) 12:14:07 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) 12:14:07 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) [ 1067.278227] Normal free:3053320kB min:5580kB low:6972kB high:8368kB active_anon:152556kB inactive_anon:12516kB active_file:24976kB inactive_file:26320kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:4718592kB managed:3588764kB mlocked:0kB dirty:180kB writeback:0kB mapped:127968kB shmem:18272kB slab_reclaimable:9216kB slab_unreclaimable:141296kB kernel_stack:7872kB pagetables:18460kB unstable:0kB bounce:0kB free_pcp:764kB local_pcp:136kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no 12:14:07 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) 12:14:07 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) 12:14:07 executing program 0: openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)={'vet\x00\x00\x96T\x00\x00\x00\x00\x00\xbdh \x00', 0x402}) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000180)={'vd\x7f\x00\x16\x00\xf9V\xdbZ\xdd\x91\x80\xd2{\x00', 0x43732e5398417f1e}) close(r0) [ 1067.278236] lowmem_reserve[]: 0 0 0 [ 1067.278291] DMA32: 452*4kB (UME) 370*8kB (UME) 319*16kB (UME) 190*32kB (UME) 79*64kB (UME) 26*128kB (UME) 11*256kB (UM) 5*512kB (M) 1*1024kB (E) 2*2048kB (UE) 621*4096kB (M) = 2578448kB [ 1067.278345] Normal: 416*4kB (UM) 212*8kB (UME) 287*16kB (UME) 186*32kB (UM) 89*64kB (UME) 33*128kB (UME) 10*256kB (UM) 8*512kB (UME) 4*1024kB (M) 4*2048kB (UME) 735*4096kB (M) = 3053328kB [ 1067.278347] 31097 total pagecache pages [ 1067.278351] 0 pages in swap cache [ 1067.278356] Swap cache stats: add 0, delete 0, find 0/0 [ 1067.278359] Free swap = 0kB [ 1067.278361] Total swap = 0kB [ 1067.278364] 1965979 pages RAM [ 1067.278367] 0 pages HighMem/MovableOnly [ 1067.278370] 313294 pages reserved [ 1067.364242] binder: 16678:16680 transaction failed 29189/-22, size 0-0 line 3014 [ 1067.364411] binder: undelivered TRANSACTION_ERROR: 29189 [ 1067.398304] vmalloc: allocation failure: 0 bytes [ 1067.398311] syz-executor.4: page allocation failure: order:0, mode:0x24000c2 [ 1067.398321] CPU: 0 PID: 16683 Comm: syz-executor.4 Not tainted 4.4.174+ #4 [ 1067.398334] 0000000000000000 8394d36d14aaa9e2 ffff8801d31af9f0 ffffffff81aad1a1 [ 1067.398344] 1ffff1003a635f41 ffff8800a5e417c0 00000000024000c2 0000000000000000 [ 1067.398362] ffffffff82895080 ffff8801d31afb00 ffffffff8148c0cb ffffffff00000001 [ 1067.398365] Call Trace: [ 1067.398381] [] dump_stack+0xc1/0x120 [ 1067.398395] [] warn_alloc_failed.cold+0x78/0x99 [ 1067.398407] [] ? zone_watermark_ok_safe+0x290/0x290 [ 1067.398419] [] ? sel_write_load+0x9e/0xf90 [ 1067.398428] [] __vmalloc_node_range+0x365/0x650 [ 1067.398436] [] ? check_preemption_disabled+0x3c/0x200 [ 1067.398443] [] ? check_preemption_disabled+0x3c/0x200 [ 1067.398452] [] ? task_has_security+0x130/0x270 [ 1067.398459] [] vmalloc+0x5c/0x70 [ 1067.398467] [] ? sel_write_load+0x119/0xf90 [ 1067.398474] [] sel_write_load+0x119/0xf90 [ 1067.398483] [] ? finish_task_switch+0x1e1/0x660 12:14:08 executing program 2: openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r0 = creat(&(0x7f0000000700)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x40000006100) ftruncate(r0, 0x208203) r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000008000/0x600000)=nil, 0x600000, 0x800002, 0x11, r1, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r2, &(0x7f0000000180)={0xa, 0x4e24, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) sendmmsg(r2, &(0x7f00000092c0), 0x4ff, 0x0) r3 = open(&(0x7f00000003c0)='./bus\x00', 0x0, 0x0) sendfile(r0, r3, 0x0, 0x8000fffffffe) r4 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r4, 0x1000008912, &(0x7f0000000000)="11dca5055e0acfec7be070") 12:14:08 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) 12:14:08 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x6, 0x1100082) r1 = memfd_create(&(0x7f0000000080)='t\bnu\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00', 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000340)=[{&(0x7f0000001140)='\'', 0x1}], 0x1, 0x1081804) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendfile(r0, r0, 0x0, 0x200000d) ioctl$LOOP_CLR_FD(r0, 0x4c01) syz_genetlink_get_family_id$tipc(0x0) dup3(r1, r0, 0x0) 12:14:08 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) 12:14:08 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) 12:14:08 executing program 0: openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)={'vet\x00\x00\x96T\x00\x00\x00\x00\x00\xbdh \x00', 0x402}) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000180)={'vd\x7f\x00\x16\x00\xf9V\xdbZ\xdd\x91\x80\xd2{\x00', 0x43732e5398417f1e}) close(r0) [ 1067.398491] [] ? finish_task_switch+0x1b3/0x660 [ 1067.398500] [] ? __schedule+0x7a3/0x1ee0 12:14:08 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) 12:14:08 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) 12:14:08 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) ** 13 printk messages dropped ** [ 1067.398628] [] vfs_write+0x182/0x4e0 12:14:08 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) 12:14:08 executing program 0: openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)={'vet\x00\x00\x96T\x00\x00\x00\x00\x00\xbdh \x00', 0x402}) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000180)={'vd\x7f\x00\x16\x00\xf9V\xdbZ\xdd\x91\x80\xd2{\x00', 0x43732e5398417f1e}) close(r0) 12:14:08 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x6, 0x1100082) r1 = memfd_create(&(0x7f0000000080)='t\bnu\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00', 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000340)=[{&(0x7f0000001140)='\'', 0x1}], 0x1, 0x1081804) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendfile(r0, r0, 0x0, 0x200000d) ioctl$LOOP_CLR_FD(r0, 0x4c01) syz_genetlink_get_family_id$tipc(0x0) dup3(r1, r0, 0x0) ** 51 printk messages dropped ** [ 1067.463328] [] SyS_write+0xdc/0x1c0 ** 48 printk messages dropped ** [ 1068.120121] [] ? __sb_start_write+0x14f/0x310 [ 1068.120129] [] vfs_write+0x182/0x4e0 [ 1068.120135] [] SyS_write+0xdc/0x1c0 [ 1068.120140] [] ? SyS_read+0x1c0/0x1c0 [ 1068.120149] [] ? lockdep_sys_exit_thunk+0x12/0x14 [ 1068.120157] [] entry_SYSCALL_64_fastpath+0x1e/0x9a [ 1068.120160] Mem-Info: [ 1068.120184] active_anon:70041 inactive_anon:5680 isolated_anon:0 [ 1068.120184] active_file:11182 inactive_file:11777 isolated_file:0 [ 1068.120184] unevictable:0 dirty:47 writeback:0 unstable:0 [ 1068.120184] slab_reclaimable:4385 slab_unreclaimable:63423 [ 1068.120184] mapped:58948 shmem:8139 pagetables:8525 bounce:0 [ 1068.120184] free:1407754 free_pcp:500 free_cma:0 [ 1068.120218] DMA32 free:2578620kB min:4696kB low:5868kB high:7044kB active_anon:127508kB inactive_anon:10204kB active_file:19752kB inactive_file:20788kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:3145324kB managed:3021976kB mlocked:0kB dirty:8kB writeback:0kB mapped:107824kB shmem:14284kB slab_reclaimable:8324kB slab_unreclaimable:112700kB kernel_stack:6432kB pagetables:15196kB unstable:0kB bounce:0kB free_pcp:964kB local_pcp:340kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no [ 1068.120228] lowmem_reserve[]: 0 3504 3504 [ 1068.120259] Normal free:3052396kB min:5580kB low:6972kB high:8368kB active_anon:152656kB inactive_anon:12516kB active_file:24976kB inactive_file:26320kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:4718592kB managed:3588764kB mlocked:0kB dirty:180kB writeback:0kB mapped:127968kB shmem:18272kB slab_reclaimable:9216kB slab_unreclaimable:140992kB kernel_stack:7872kB pagetables:18904kB unstable:0kB bounce:0kB free_pcp:1036kB local_pcp:524kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no [ 1068.120266] lowmem_reserve[]: 0 0 0 [ 1068.120324] DMA32: 397*4kB (UME) 373*8kB (UME) 318*16kB (UME) 203*32kB (UME) 80*64kB (UME) 25*128kB (UME) 11*256kB (UM) 5*512kB (M) 1*1024kB (E) 2*2048kB (UE) 621*4096kB (M) = 2578588kB [ 1068.124707] Normal: 235*4kB (UM) 234*8kB (UME) 287*16kB (UME) 174*32kB (UM) 89*64kB (UME) 33*128kB (UME) 10*256kB (UM) 8*512kB (UME) 4*1024kB (M) 4*2048kB (UME) 735*4096kB (M) = 3052396kB [ 1068.124711] 31097 total pagecache pages [ 1068.124716] 0 pages in swap cache [ 1068.124721] Swap cache stats: add 0, delete 0, find 0/0 [ 1068.124725] Free swap = 0kB [ 1068.124728] Total swap = 0kB [ 1068.124731] 1965979 pages RAM [ 1068.124734] 0 pages HighMem/MovableOnly [ 1068.124736] 313294 pages reserved [ 1068.267010] vmalloc: allocation failure: 0 bytes [ 1068.267018] syz-executor.4: page allocation failure: order:0, mode:0x24000c2 [ 1068.267029] CPU: 1 PID: 16728 Comm: syz-executor.4 Not tainted 4.4.174+ #4 [ 1068.267042] 0000000000000000 81eb93144dc228ff ffff8800ba3ff9f0 ffffffff81aad1a1 [ 1068.267053] 1ffff1001747ff41 ffff8800b66faf80 00000000024000c2 0000000000000000 [ 1068.267064] ffffffff82895080 ffff8800ba3ffb00 ffffffff8148c0cb ffffffff00000001 [ 1068.267067] Call Trace: [ 1068.267081] [] dump_stack+0xc1/0x120 [ 1068.267094] [] warn_alloc_failed.cold+0x78/0x99 [ 1068.267106] [] ? zone_watermark_ok_safe+0x290/0x290 [ 1068.267116] [] ? sel_write_load+0x9e/0xf90 [ 1068.267127] [] __vmalloc_node_range+0x365/0x650 [ 1068.267137] [] ? check_preemption_disabled+0x3c/0x200 [ 1068.267145] [] ? check_preemption_disabled+0x3c/0x200 [ 1068.267153] [] ? task_has_security+0x130/0x270 [ 1068.267160] [] vmalloc+0x5c/0x70 [ 1068.267168] [] ? sel_write_load+0x119/0xf90 [ 1068.267175] [] sel_write_load+0x119/0xf90 [ 1068.267184] [] ? sel_read_bool+0x240/0x240 [ 1068.267193] [] ? trace_hardirqs_on+0x10/0x10 [ 1068.267201] [] __vfs_write+0x116/0x3d0 [ 1068.267209] [] ? sel_read_bool+0x240/0x240 12:14:09 executing program 2: openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r0 = creat(&(0x7f0000000700)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x40000006100) ftruncate(r0, 0x208203) r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000008000/0x600000)=nil, 0x600000, 0x800002, 0x11, r1, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r2, &(0x7f0000000180)={0xa, 0x4e24, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) sendmmsg(r2, &(0x7f00000092c0), 0x4ff, 0x0) r3 = open(&(0x7f00000003c0)='./bus\x00', 0x0, 0x0) sendfile(r0, r3, 0x0, 0x8000fffffffe) r4 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r4, 0x1000008912, &(0x7f0000000000)="11dca5055e0acfec7be070") 12:14:09 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) 12:14:09 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) 12:14:09 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) 12:14:09 executing program 0: openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)={'vet\x00\x00\x96T\x00\x00\x00\x00\x00\xbdh \x00', 0x402}) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000180)={'vd\x7f\x00\x16\x00\xf9V\xdbZ\xdd\x91\x80\xd2{\x00', 0x43732e5398417f1e}) close(r0) 12:14:09 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x6, 0x1100082) r1 = memfd_create(&(0x7f0000000080)='t\bnu\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00', 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000340)=[{&(0x7f0000001140)='\'', 0x1}], 0x1, 0x1081804) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendfile(r0, r0, 0x0, 0x200000d) ioctl$LOOP_CLR_FD(r0, 0x4c01) syz_genetlink_get_family_id$tipc(0x0) dup3(r1, r0, 0x0) [ 1068.267219] [] ? __vfs_read+0x3c0/0x3c0 [ 1068.267228] [] ? check_preemption_disabled+0x3c/0x200 12:14:09 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) 12:14:09 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) 12:14:09 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) 12:14:09 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) ** 5 printk messages dropped ** [ 1068.267280] [] SyS_write+0xdc/0x1c0 [ 1068.267287] [] ? SyS_read+0x1c0/0x1c0 12:14:09 executing program 0: openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)={'vet\x00\x00\x96T\x00\x00\x00\x00\x00\xbdh \x00', 0x402}) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000180)={'vd\x7f\x00\x16\x00\xf9V\xdbZ\xdd\x91\x80\xd2{\x00', 0x43732e5398417f1e}) close(r0) [ 1068.267296] [] ? lockdep_sys_exit_thunk+0x12/0x14 12:14:10 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x6, 0x1100082) r1 = memfd_create(&(0x7f0000000080)='t\bnu\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00', 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000340)=[{&(0x7f0000001140)='\'', 0x1}], 0x1, 0x1081804) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendfile(r0, r0, 0x0, 0x200000d) ioctl$LOOP_CLR_FD(r0, 0x4c01) syz_genetlink_get_family_id$tipc(0x0) dup3(r1, r0, 0x0) ** 48 printk messages dropped ** [ 1068.343578] [] SyS_write+0xdc/0x1c0 [ 1068.343587] [] ? SyS_read+0x1c0/0x1c0 [ 1068.343601] [] ? lockdep_sys_exit_thunk+0x12/0x14 [ 1068.343613] [] entry_SYSCALL_64_fastpath+0x1e/0x9a [ 1068.343616] Mem-Info: [ 1068.343641] active_anon:70134 inactive_anon:5694 isolated_anon:0 [ 1068.343641] active_file:11182 inactive_file:11777 isolated_file:0 [ 1068.343641] unevictable:0 dirty:47 writeback:0 unstable:0 [ 1068.343641] slab_reclaimable:4385 slab_unreclaimable:63398 [ 1068.343641] mapped:59022 shmem:8152 pagetables:8522 bounce:0 [ 1068.343641] free:1407668 free_pcp:420 free_cma:0 [ 1068.343679] DMA32 free:2577956kB min:4696kB low:5868kB high:7044kB active_anon:127760kB inactive_anon:10228kB active_file:19752kB inactive_file:20788kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:3145324kB managed:3021976kB mlocked:0kB dirty:8kB writeback:0kB mapped:107972kB shmem:14268kB slab_reclaimable:8324kB slab_unreclaimable:113004kB kernel_stack:6464kB pagetables:15344kB unstable:0kB bounce:0kB free_pcp:884kB local_pcp:356kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no [ 1068.343690] lowmem_reserve[]: 0 3504 3504 [ 1068.343727] Normal free:3052716kB min:5580kB low:6972kB high:8368kB active_anon:152776kB inactive_anon:12548kB active_file:24976kB inactive_file:26320kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:4718592kB managed:3588764kB mlocked:0kB dirty:180kB writeback:0kB mapped:128116kB shmem:18340kB slab_reclaimable:9216kB slab_unreclaimable:140588kB kernel_stack:8160kB pagetables:18744kB unstable:0kB bounce:0kB free_pcp:796kB local_pcp:468kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no [ 1068.343735] lowmem_reserve[]: 0 0 0 [ 1068.343797] DMA32: 269*4kB (UME) 376*8kB (UME) 319*16kB (UME) 195*32kB (UME) 80*64kB (UME) 26*128kB (UME) 11*256kB (UM) 5*512kB (M) 1*1024kB (E) 2*2048kB (UE) 621*4096kB (M) = 2577988kB [ 1068.343855] Normal: 437*4kB (UM) 199*8kB (UME) 286*16kB (UME) 172*32kB (UM) 89*64kB (UME) 32*128kB (UME) 10*256kB (UM) 8*512kB (UME) 4*1024kB (M) 4*2048kB (UME) 735*4096kB (M) = 3052716kB [ 1068.343858] 31110 total pagecache pages [ 1068.343862] 0 pages in swap cache [ 1068.343867] Swap cache stats: add 0, delete 0, find 0/0 [ 1068.343869] Free swap = 0kB [ 1068.343872] Total swap = 0kB [ 1068.343874] 1965979 pages RAM [ 1068.343877] 0 pages HighMem/MovableOnly [ 1068.343879] 313294 pages reserved [ 1068.422031] binder: 16745:16750 transaction failed 29189/-22, size 0-0 line 3014 [ 1068.422208] binder: undelivered TRANSACTION_ERROR: 29189 [ 1068.444326] vmalloc: allocation failure: 0 bytes [ 1068.444332] syz-executor.4: page allocation failure: order:0, mode:0x24000c2 [ 1068.444342] CPU: 1 PID: 16752 Comm: syz-executor.4 Not tainted 4.4.174+ #4 [ 1068.444355] 0000000000000000 e1f07b22f02293bb ffff8801b80d79f0 ffffffff81aad1a1 [ 1068.444366] 1ffff1003701af41 ffff8801bddc8000 00000000024000c2 0000000000000000 12:14:10 executing program 2: openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r0 = creat(&(0x7f0000000700)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x40000006100) ftruncate(r0, 0x208203) r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000008000/0x600000)=nil, 0x600000, 0x800002, 0x11, r1, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r2, &(0x7f0000000180)={0xa, 0x4e24, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) sendmmsg(r2, &(0x7f00000092c0), 0x4ff, 0x0) r3 = open(&(0x7f00000003c0)='./bus\x00', 0x0, 0x0) sendfile(r0, r3, 0x0, 0x8000fffffffe) r4 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r4, 0x1000008912, &(0x7f0000000000)="11dca5055e0acfec7be070") 12:14:10 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) 12:14:10 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) 12:14:10 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) 12:14:10 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x6, 0x1100082) r1 = memfd_create(&(0x7f0000000080)='t\bnu\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00', 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000340)=[{&(0x7f0000001140)='\'', 0x1}], 0x1, 0x1081804) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendfile(r0, r0, 0x0, 0x200000d) ioctl$LOOP_CLR_FD(r0, 0x4c01) syz_genetlink_get_family_id$tipc(0x0) dup3(r1, r0, 0x0) 12:14:10 executing program 0: openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)={'vet\x00\x00\x96T\x00\x00\x00\x00\x00\xbdh \x00', 0x402}) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000180)={'vd\x7f\x00\x16\x00\xf9V\xdbZ\xdd\x91\x80\xd2{\x00', 0x43732e5398417f1e}) close(r0) [ 1068.444378] ffffffff82895080 ffff8801b80d7b00 ffffffff8148c0cb ffffffff00000001 [ 1068.444381] Call Trace: [ 1068.444396] [] dump_stack+0xc1/0x120 [ 1068.444408] [] warn_alloc_failed.cold+0x78/0x99 [ 1068.444418] [] ? zone_watermark_ok_safe+0x290/0x290 12:14:10 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) 12:14:10 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) 12:14:10 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) [ 1068.444428] [] ? sel_write_load+0x9e/0xf90 [ 1068.444446] [] __vmalloc_node_range+0x365/0x650 ** 17 printk messages dropped ** [ 1068.444596] [] SyS_write+0xdc/0x1c0 12:14:10 executing program 0: openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)={'vet\x00\x00\x96T\x00\x00\x00\x00\x00\xbdh \x00', 0x402}) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000180)={'vd\x7f\x00\x16\x00\xf9V\xdbZ\xdd\x91\x80\xd2{\x00', 0x43732e5398417f1e}) close(r0) 12:14:10 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x6, 0x1100082) r1 = memfd_create(&(0x7f0000000080)='t\bnu\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00', 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000340)=[{&(0x7f0000001140)='\'', 0x1}], 0x1, 0x1081804) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendfile(r0, r0, 0x0, 0x200000d) ioctl$LOOP_CLR_FD(r0, 0x4c01) syz_genetlink_get_family_id$tipc(0x0) dup3(r1, r0, 0x0) 12:14:10 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) ** 48 printk messages dropped ** [ 1071.669000] Call Trace: [ 1071.669016] [] dump_stack+0xc1/0x120 [ 1071.669030] [] warn_alloc_failed.cold+0x78/0x99 [ 1071.669041] [] ? zone_watermark_ok_safe+0x290/0x290 [ 1071.669051] [] ? sel_write_load+0x9e/0xf90 [ 1071.669060] [] __vmalloc_node_range+0x365/0x650 [ 1071.669070] [] ? check_preemption_disabled+0x3c/0x200 [ 1071.669079] [] ? check_preemption_disabled+0x3c/0x200 [ 1071.669089] [] ? task_has_security+0x130/0x270 [ 1071.669097] [] vmalloc+0x5c/0x70 [ 1071.669105] [] ? sel_write_load+0x119/0xf90 [ 1071.669112] [] sel_write_load+0x119/0xf90 [ 1071.669120] [] ? sel_read_bool+0x240/0x240 [ 1071.669130] [] ? trace_hardirqs_on+0x10/0x10 [ 1071.669139] [] __vfs_write+0x116/0x3d0 [ 1071.669148] [] ? sel_read_bool+0x240/0x240 [ 1071.669157] [] ? __vfs_read+0x3c0/0x3c0 [ 1071.669167] [] ? check_preemption_disabled+0x3c/0x200 [ 1071.669175] [] ? check_preemption_disabled+0x3c/0x200 [ 1071.669185] [] ? rcu_read_lock_sched_held+0x10b/0x130 [ 1071.669193] [] ? rcu_sync_lockdep_assert+0x73/0xb0 [ 1071.669202] [] ? __sb_start_write+0x14f/0x310 [ 1071.669209] [] vfs_write+0x182/0x4e0 [ 1071.669217] [] SyS_write+0xdc/0x1c0 [ 1071.669225] [] ? SyS_read+0x1c0/0x1c0 [ 1071.669235] [] ? lockdep_sys_exit_thunk+0x12/0x14 [ 1071.669245] [] entry_SYSCALL_64_fastpath+0x1e/0x9a [ 1071.669248] Mem-Info: [ 1071.669275] active_anon:70012 inactive_anon:5720 isolated_anon:0 [ 1071.669275] active_file:11182 inactive_file:11777 isolated_file:0 [ 1071.669275] unevictable:0 dirty:47 writeback:0 unstable:0 [ 1071.669275] slab_reclaimable:4385 slab_unreclaimable:63550 [ 1071.669275] mapped:58997 shmem:8152 pagetables:8528 bounce:0 [ 1071.669275] free:1407827 free_pcp:495 free_cma:0 [ 1071.669308] DMA32 free:2577204kB min:4696kB low:5868kB high:7044kB active_anon:127592kB inactive_anon:10332kB active_file:19752kB inactive_file:20788kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:3145324kB managed:3021976kB mlocked:0kB dirty:8kB writeback:0kB mapped:107912kB shmem:14332kB slab_reclaimable:8324kB slab_unreclaimable:113616kB kernel_stack:6400kB pagetables:15532kB unstable:0kB bounce:0kB free_pcp:1024kB local_pcp:364kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no [ 1071.669318] lowmem_reserve[]: 0 3504 3504 12:14:11 executing program 2: openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r0 = creat(&(0x7f0000000700)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x40000006100) ftruncate(r0, 0x208203) r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000008000/0x600000)=nil, 0x600000, 0x800002, 0x11, r1, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r2, &(0x7f0000000180)={0xa, 0x4e24, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) sendmmsg(r2, &(0x7f00000092c0), 0x4ff, 0x0) r3 = open(&(0x7f00000003c0)='./bus\x00', 0x0, 0x0) sendfile(r0, r3, 0x0, 0x8000fffffffe) r4 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r4, 0x1000008912, &(0x7f0000000000)="11dca5055e0acfec7be070") 12:14:11 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) 12:14:11 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) 12:14:11 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) 12:14:11 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x6, 0x1100082) r1 = memfd_create(&(0x7f0000000080)='t\bnu\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00', 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000340)=[{&(0x7f0000001140)='\'', 0x1}], 0x1, 0x1081804) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendfile(r0, r0, 0x0, 0x200000d) ioctl$LOOP_CLR_FD(r0, 0x4c01) syz_genetlink_get_family_id$tipc(0x0) dup3(r1, r0, 0x0) 12:14:11 executing program 0: openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)={'vet\x00\x00\x96T\x00\x00\x00\x00\x00\xbdh \x00', 0x402}) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000180)={'vd\x7f\x00\x16\x00\xf9V\xdbZ\xdd\x91\x80\xd2{\x00', 0x43732e5398417f1e}) close(r0) [ 1071.669363] Normal free:3054104kB min:5580kB low:6972kB high:8368kB active_anon:152456kB inactive_anon:12548kB active_file:24976kB inactive_file:26320kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:4718592kB managed:3588764kB mlocked:0kB dirty:180kB writeback:0kB mapped:128076kB shmem:18276kB slab_reclaimable:9216kB slab_unreclaimable:140584kB kernel_stack:8128kB pagetables:18580kB unstable:0kB bounce:0kB free_pcp:956kB local_pcp:360kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no [ 1071.676847] lowmem_reserve[]: 0 0 0 12:14:11 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) 12:14:11 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) 12:14:11 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) [ 1071.676912] DMA32: 375*4kB (UME) 360*8kB (UME) 329*16kB (UME) 154*32kB (UME) 80*64kB (UME) 26*128kB (UME) 11*256kB (UM) 5*512kB (M) 1*1024kB (E) 2*2048kB (UE) 621*4096kB (M) = 2577132kB 12:14:11 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) 12:14:11 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) 12:14:11 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x6, 0x1100082) r1 = memfd_create(&(0x7f0000000080)='t\bnu\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00', 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000340)=[{&(0x7f0000001140)='\'', 0x1}], 0x1, 0x1081804) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendfile(r0, r0, 0x0, 0x200000d) ioctl$LOOP_CLR_FD(r0, 0x4c01) syz_genetlink_get_family_id$tipc(0x0) dup3(r1, r0, 0x0) ** 19 printk messages dropped ** [ 1071.756143] Call Trace: ** 50 printk messages dropped ** [ 1071.875880] Call Trace: [ 1071.875896] [] dump_stack+0xc1/0x120 [ 1071.875910] [] warn_alloc_failed.cold+0x78/0x99 [ 1071.875922] [] ? zone_watermark_ok_safe+0x290/0x290 [ 1071.875932] [] ? sel_write_load+0x9e/0xf90 [ 1071.875944] [] __vmalloc_node_range+0x365/0x650 [ 1071.875954] [] ? check_preemption_disabled+0x3c/0x200 [ 1071.875963] [] ? check_preemption_disabled+0x3c/0x200 [ 1071.875972] [] ? task_has_security+0x130/0x270 [ 1071.875980] [] vmalloc+0x5c/0x70 [ 1071.875988] [] ? sel_write_load+0x119/0xf90 [ 1071.875997] [] sel_write_load+0x119/0xf90 [ 1071.876008] [] ? sel_read_bool+0x240/0x240 [ 1071.876018] [] ? trace_hardirqs_on+0x10/0x10 [ 1071.876026] [] __vfs_write+0x116/0x3d0 [ 1071.876034] [] ? sel_read_bool+0x240/0x240 [ 1071.876041] [] ? __vfs_read+0x3c0/0x3c0 [ 1071.876049] [] ? check_preemption_disabled+0x3c/0x200 [ 1071.876056] [] ? check_preemption_disabled+0x3c/0x200 [ 1071.876065] [] ? rcu_read_lock_sched_held+0x10b/0x130 [ 1071.876073] [] ? rcu_sync_lockdep_assert+0x73/0xb0 [ 1071.876081] [] ? __sb_start_write+0x14f/0x310 [ 1071.876089] [] vfs_write+0x182/0x4e0 [ 1071.876096] [] SyS_write+0xdc/0x1c0 [ 1071.876104] [] ? SyS_read+0x1c0/0x1c0 [ 1071.876114] [] ? lockdep_sys_exit_thunk+0x12/0x14 [ 1071.876123] [] entry_SYSCALL_64_fastpath+0x1e/0x9a [ 1071.876127] Mem-Info: [ 1071.876151] active_anon:70062 inactive_anon:5870 isolated_anon:0 [ 1071.876151] active_file:11182 inactive_file:11777 isolated_file:0 [ 1071.876151] unevictable:0 dirty:47 writeback:0 unstable:0 [ 1071.876151] slab_reclaimable:4385 slab_unreclaimable:63343 [ 1071.876151] mapped:58997 shmem:8337 pagetables:8454 bounce:0 [ 1071.876151] free:1407892 free_pcp:327 free_cma:0 [ 1071.876183] DMA32 free:2577476kB min:4696kB low:5868kB high:7044kB active_anon:127692kB inactive_anon:10732kB active_file:19752kB inactive_file:20788kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:3145324kB managed:3021976kB mlocked:0kB dirty:8kB writeback:0kB mapped:107912kB shmem:14776kB slab_reclaimable:8324kB slab_unreclaimable:113388kB kernel_stack:6400kB pagetables:15088kB unstable:0kB bounce:0kB free_pcp:776kB local_pcp:472kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no [ 1071.876192] lowmem_reserve[]: 0 3504 3504 12:14:12 executing program 2: openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r0 = creat(&(0x7f0000000700)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x40000006100) ftruncate(r0, 0x208203) r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000008000/0x600000)=nil, 0x600000, 0x800002, 0x11, r1, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r2, &(0x7f0000000180)={0xa, 0x4e24, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) sendmmsg(r2, &(0x7f00000092c0), 0x4ff, 0x0) r3 = open(&(0x7f00000003c0)='./bus\x00', 0x0, 0x0) sendfile(r0, r3, 0x0, 0x8000fffffffe) r4 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r4, 0x1000008912, &(0x7f0000000000)="11dca5055e0acfec7be070") 12:14:12 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) 12:14:12 executing program 0: openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)={'vet\x00\x00\x96T\x00\x00\x00\x00\x00\xbdh \x00', 0x402}) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000180)={'vd\x7f\x00\x16\x00\xf9V\xdbZ\xdd\x91\x80\xd2{\x00', 0x43732e5398417f1e}) close(r0) 12:14:12 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) 12:14:12 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) 12:14:12 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x6, 0x1100082) r1 = memfd_create(&(0x7f0000000080)='t\bnu\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00', 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000340)=[{&(0x7f0000001140)='\'', 0x1}], 0x1, 0x1081804) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendfile(r0, r0, 0x0, 0x200000d) ioctl$LOOP_CLR_FD(r0, 0x4c01) syz_genetlink_get_family_id$tipc(0x0) dup3(r1, r0, 0x0) [ 1071.876226] Normal free:3054092kB min:5580kB low:6972kB high:8368kB active_anon:152556kB inactive_anon:12748kB active_file:24976kB inactive_file:26320kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:4718592kB managed:3588764kB mlocked:0kB dirty:180kB writeback:0kB mapped:128076kB shmem:18572kB slab_reclaimable:9216kB slab_unreclaimable:139984kB kernel_stack:8128kB pagetables:18728kB unstable:0kB bounce:0kB free_pcp:532kB local_pcp:460kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no 12:14:12 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) 12:14:12 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) 12:14:12 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) 12:14:12 executing program 0: openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)={'vet\x00\x00\x96T\x00\x00\x00\x00\x00\xbdh \x00', 0x402}) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000180)={'vd\x7f\x00\x16\x00\xf9V\xdbZ\xdd\x91\x80\xd2{\x00', 0x43732e5398417f1e}) close(r0) [ 1071.876235] lowmem_reserve[]: 0 0 0 12:14:12 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) 12:14:12 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) [ 1071.876288] DMA32: 377*4kB (UME) 391*8kB (UME) 329*16kB (UME) 157*32kB (UME) 81*64kB (UME) 26*128kB (UME) 11*256kB (UM) 5*512kB (M) 1*1024kB (E) 2*2048kB (UE) 621*4096kB (M) = 2577548kB [ 1071.878737] Normal: 401*4kB (UM) 301*8kB (UME) 288*16kB (UME) 193*32kB (UM) 85*64kB (UME) 33*128kB (UME) 10*256kB (UM) 8*512kB (UME) 4*1024kB (M) 4*2048kB (UME) 735*4096kB (M) = 3053964kB [ 1071.878740] 31332 total pagecache pages [ 1071.878745] 0 pages in swap cache [ 1071.878750] Swap cache stats: add 0, delete 0, find 0/0 [ 1071.878753] Free swap = 0kB [ 1071.878756] Total swap = 0kB [ 1071.878759] 1965979 pages RAM [ 1071.878762] 0 pages HighMem/MovableOnly [ 1071.878765] 313294 pages reserved [ 1072.446742] vmalloc: allocation failure: 0 bytes [ 1072.446749] syz-executor.4: page allocation failure: order:0, mode:0x24000c2 [ 1072.446758] CPU: 1 PID: 16976 Comm: syz-executor.4 Not tainted 4.4.174+ #4 [ 1072.446771] 0000000000000000 28f6ea62589ff1a0 ffff8801c0a079f0 ffffffff81aad1a1 [ 1072.446782] 1ffff10038140f41 ffff8800b44517c0 00000000024000c2 0000000000000000 [ 1072.446793] ffffffff82895080 ffff8801c0a07b00 ffffffff8148c0cb ffffffff00000001 [ 1072.446796] Call Trace: [ 1072.446812] [] dump_stack+0xc1/0x120 [ 1072.446825] [] warn_alloc_failed.cold+0x78/0x99 [ 1072.446835] [] ? zone_watermark_ok_safe+0x290/0x290 [ 1072.446844] [] ? sel_write_load+0x9e/0xf90 [ 1072.446853] [] __vmalloc_node_range+0x365/0x650 [ 1072.446863] [] ? check_preemption_disabled+0x3c/0x200 [ 1072.446870] [] ? check_preemption_disabled+0x3c/0x200 [ 1072.446878] [] ? task_has_security+0x130/0x270 [ 1072.446886] [] vmalloc+0x5c/0x70 [ 1072.446893] [] ? sel_write_load+0x119/0xf90 [ 1072.446918] [] sel_write_load+0x119/0xf90 12:14:13 executing program 2: openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r0 = creat(&(0x7f0000000700)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x40000006100) ftruncate(r0, 0x208203) r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000008000/0x600000)=nil, 0x600000, 0x800002, 0x11, r1, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r2, &(0x7f0000000180)={0xa, 0x4e24, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) sendmmsg(r2, &(0x7f00000092c0), 0x4ff, 0x0) r3 = open(&(0x7f00000003c0)='./bus\x00', 0x0, 0x0) sendfile(r0, r3, 0x0, 0x8000fffffffe) r4 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r4, 0x1000008912, &(0x7f0000000000)="11dca5055e0acfec7be070") 12:14:13 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x6, 0x1100082) r1 = memfd_create(&(0x7f0000000080)='t\bnu\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00', 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000340)=[{&(0x7f0000001140)='\'', 0x1}], 0x1, 0x1081804) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendfile(r0, r0, 0x0, 0x200000d) ioctl$LOOP_CLR_FD(r0, 0x4c01) syz_genetlink_get_family_id$tipc(0x0) dup3(r1, r0, 0x0) 12:14:13 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) 12:14:13 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) 12:14:13 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) 12:14:13 executing program 0: openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)={'vet\x00\x00\x96T\x00\x00\x00\x00\x00\xbdh \x00', 0x402}) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000180)={'vd\x7f\x00\x16\x00\xf9V\xdbZ\xdd\x91\x80\xd2{\x00', 0x43732e5398417f1e}) close(r0) [ 1072.446929] [] ? sel_read_bool+0x240/0x240 [ 1072.446941] [] ? trace_hardirqs_on+0x10/0x10 12:14:13 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) 12:14:13 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) 12:14:13 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) [ 1072.446954] [] __vfs_write+0x116/0x3d0 [ 1072.446962] [] ? sel_read_bool+0x240/0x240 [ 1072.446972] [] ? __vfs_read+0x3c0/0x3c0 [ 1072.446982] [] ? check_preemption_disabled+0x3c/0x200 12:14:13 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) 12:14:13 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x6, 0x1100082) r1 = memfd_create(&(0x7f0000000080)='t\bnu\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00', 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000340)=[{&(0x7f0000001140)='\'', 0x1}], 0x1, 0x1081804) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendfile(r0, r0, 0x0, 0x200000d) ioctl$LOOP_CLR_FD(r0, 0x4c01) syz_genetlink_get_family_id$tipc(0x0) dup3(r1, r0, 0x0) 12:14:13 executing program 0: openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)={'vet\x00\x00\x96T\x00\x00\x00\x00\x00\xbdh \x00', 0x402}) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000180)={'vd\x7f\x00\x16\x00\xf9V\xdbZ\xdd\x91\x80\xd2{\x00', 0x43732e5398417f1e}) close(r0) [ 1072.446991] [] ? check_preemption_disabled+0x3c/0x200 [ 1072.447001] [] ? rcu_read_lock_sched_held+0x10b/0x130 [ 1072.447009] [] ? rcu_sync_lockdep_assert+0x73/0xb0 [ 1072.447018] [] ? __sb_start_write+0x14f/0x310 [ 1072.447026] [] vfs_write+0x182/0x4e0 [ 1072.447034] [] SyS_write+0xdc/0x1c0 [ 1072.447041] [] ? SyS_read+0x1c0/0x1c0 [ 1072.447051] [] ? lockdep_sys_exit_thunk+0x12/0x14 [ 1072.447061] [] entry_SYSCALL_64_fastpath+0x1e/0x9a [ 1072.447064] Mem-Info: [ 1072.447089] active_anon:70031 inactive_anon:5725 isolated_anon:0 [ 1072.447089] active_file:11182 inactive_file:11777 isolated_file:0 [ 1072.447089] unevictable:0 dirty:48 writeback:0 unstable:0 [ 1072.447089] slab_reclaimable:4385 slab_unreclaimable:63577 [ 1072.447089] mapped:58964 shmem:8152 pagetables:8478 bounce:0 [ 1072.447089] free:1407652 free_pcp:493 free_cma:0 [ 1072.447123] DMA32 free:2577360kB min:4696kB low:5868kB high:7044kB active_anon:127500kB inactive_anon:10248kB active_file:19752kB inactive_file:20788kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:3145324kB managed:3021976kB mlocked:0kB dirty:8kB writeback:0kB mapped:107824kB shmem:14288kB slab_reclaimable:8324kB slab_unreclaimable:113588kB kernel_stack:6272kB pagetables:15496kB unstable:0kB bounce:0kB free_pcp:1036kB local_pcp:376kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no [ 1072.447134] lowmem_reserve[]: 0 3504 3504 [ 1072.447167] Normal free:3053248kB min:5580kB low:6972kB high:8368kB active_anon:152624kB inactive_anon:12652kB active_file:24976kB inactive_file:26320kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:4718592kB managed:3588764kB mlocked:0kB dirty:184kB writeback:0kB mapped:128032kB shmem:18320kB slab_reclaimable:9216kB slab_unreclaimable:140720kB kernel_stack:7872kB pagetables:18416kB unstable:0kB bounce:0kB free_pcp:936kB local_pcp:244kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no [ 1072.447176] lowmem_reserve[]: 0 0 0 [ 1072.447231] DMA32: 326*4kB (UME) 401*8kB (UME) 331*16kB (UME) 156*32kB (UME) 81*64kB (UME) 26*128kB (UME) 11*256kB (UM) 5*512kB (M) 1*1024kB (E) 2*2048kB (UE) 621*4096kB (M) = 2577424kB [ 1072.447283] Normal: 312*4kB (UM) 270*8kB (UME) 287*16kB (UME) 193*32kB (UM) 85*64kB (UME) 32*128kB (UME) 10*256kB (UM) 8*512kB (UME) 4*1024kB (M) 4*2048kB (UME) 735*4096kB (M) = 3053216kB [ 1072.447286] 31110 total pagecache pages [ 1072.447290] 0 pages in swap cache 12:14:13 executing program 2: openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r0 = creat(&(0x7f0000000700)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x40000006100) ftruncate(r0, 0x208203) r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000008000/0x600000)=nil, 0x600000, 0x800002, 0x11, r1, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r2, &(0x7f0000000180)={0xa, 0x4e24, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) sendmmsg(r2, &(0x7f00000092c0), 0x4ff, 0x0) r3 = open(&(0x7f00000003c0)='./bus\x00', 0x0, 0x0) sendfile(r0, r3, 0x0, 0x8000fffffffe) r4 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r4, 0x1000008912, &(0x7f0000000000)="11dca5055e0acfec7be070") 12:14:13 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) 12:14:13 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) 12:14:13 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) 12:14:13 executing program 0: openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)={'vet\x00\x00\x96T\x00\x00\x00\x00\x00\xbdh \x00', 0x402}) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000180)={'vd\x7f\x00\x16\x00\xf9V\xdbZ\xdd\x91\x80\xd2{\x00', 0x43732e5398417f1e}) close(r0) 12:14:13 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x6, 0x1100082) r1 = memfd_create(&(0x7f0000000080)='t\bnu\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00', 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000340)=[{&(0x7f0000001140)='\'', 0x1}], 0x1, 0x1081804) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendfile(r0, r0, 0x0, 0x200000d) ioctl$LOOP_CLR_FD(r0, 0x4c01) syz_genetlink_get_family_id$tipc(0x0) dup3(r1, r0, 0x0) [ 1072.447294] Swap cache stats: add 0, delete 0, find 0/0 [ 1072.447296] Free swap = 0kB [ 1072.447299] Total swap = 0kB [ 1072.447302] 1965979 pages RAM 12:14:13 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) 12:14:14 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) 12:14:14 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) [ 1072.447304] 0 pages HighMem/MovableOnly [ 1072.447306] 313294 pages reserved [ 1072.476700] binder: 16971:16981 transaction failed 29189/-22, size 0-0 line 3014 12:14:14 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) 12:14:14 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) 12:14:14 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) [ 1072.477033] binder: undelivered TRANSACTION_ERROR: 29189 [ 1072.620605] binder_alloc: 16990: binder_alloc_buf, no vma ** 21 printk messages dropped ** [ 1072.636522] [] ? trace_hardirqs_on+0x10/0x10 ** 50 printk messages dropped ** [ 1073.298967] [] ? trace_hardirqs_on+0x10/0x10 [ 1073.298978] [] __vfs_write+0x116/0x3d0 [ 1073.298987] [] ? sel_read_bool+0x240/0x240 [ 1073.298995] [] ? __vfs_read+0x3c0/0x3c0 [ 1073.299003] [] ? check_preemption_disabled+0x3c/0x200 [ 1073.299013] [] ? check_preemption_disabled+0x3c/0x200 [ 1073.299023] [] ? rcu_read_lock_sched_held+0x10b/0x130 [ 1073.299032] [] ? rcu_sync_lockdep_assert+0x73/0xb0 [ 1073.299043] [] ? __sb_start_write+0x14f/0x310 [ 1073.299052] [] vfs_write+0x182/0x4e0 [ 1073.299062] [] SyS_write+0xdc/0x1c0 [ 1073.299071] [] ? SyS_read+0x1c0/0x1c0 [ 1073.299083] [] ? lockdep_sys_exit_thunk+0x12/0x14 [ 1073.299094] [] entry_SYSCALL_64_fastpath+0x1e/0x9a [ 1073.301340] Mem-Info: [ 1073.301367] active_anon:70026 inactive_anon:5701 isolated_anon:0 [ 1073.301367] active_file:11182 inactive_file:11777 isolated_file:0 [ 1073.301367] unevictable:0 dirty:48 writeback:0 unstable:0 [ 1073.301367] slab_reclaimable:4385 slab_unreclaimable:63424 [ 1073.301367] mapped:58972 shmem:8149 pagetables:8446 bounce:0 [ 1073.301367] free:1407899 free_pcp:558 free_cma:0 [ 1073.301404] DMA32 free:2576920kB min:4696kB low:5868kB high:7044kB active_anon:127552kB inactive_anon:10212kB active_file:19752kB inactive_file:20788kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:3145324kB managed:3021976kB mlocked:0kB dirty:8kB writeback:0kB mapped:107832kB shmem:14292kB slab_reclaimable:8324kB slab_unreclaimable:114692kB kernel_stack:6272kB pagetables:15068kB unstable:0kB bounce:0kB free_pcp:936kB local_pcp:256kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no [ 1073.301414] lowmem_reserve[]: 0 3504 3504 [ 1073.301459] Normal free:3054676kB min:5580kB low:6972kB high:8368kB active_anon:152552kB inactive_anon:12592kB active_file:24976kB inactive_file:26320kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:4718592kB managed:3588764kB mlocked:0kB dirty:184kB writeback:0kB mapped:128056kB shmem:18304kB slab_reclaimable:9216kB slab_unreclaimable:139004kB kernel_stack:8064kB pagetables:18716kB unstable:0kB bounce:0kB free_pcp:1296kB local_pcp:716kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no [ 1073.301469] lowmem_reserve[]: 0 0 0 [ 1073.301528] DMA32: 222*4kB (UME) 375*8kB (UME) 332*16kB (UME) 158*32kB (UME) 81*64kB (UME) 26*128kB (UME) 11*256kB (UM) 5*512kB (M) 1*1024kB (E) 2*2048kB (UE) 621*4096kB (M) = 2576880kB [ 1073.301588] Normal: 411*4kB (UM) 303*8kB (UME) 289*16kB (UME) 216*32kB (UM) 85*64kB (UME) 33*128kB (UME) 10*256kB (UM) 8*512kB (UME) 4*1024kB (M) 4*2048kB (UME) 735*4096kB (M) = 3054772kB [ 1073.301591] 31107 total pagecache pages [ 1073.301595] 0 pages in swap cache [ 1073.301600] Swap cache stats: add 0, delete 0, find 0/0 [ 1073.301604] Free swap = 0kB [ 1073.301606] Total swap = 0kB [ 1073.301608] 1965979 pages RAM [ 1073.301611] 0 pages HighMem/MovableOnly [ 1073.301613] 313294 pages reserved [ 1073.338078] binder_alloc: 17032: binder_alloc_buf, no vma [ 1073.338121] binder: 17032:17034 transaction failed 29189/-3, size 0-0 line 3137 [ 1073.355248] binder: undelivered TRANSACTION_ERROR: 29189 [ 1073.420365] binder: 17043:17044 transaction failed 29189/-22, size 0-0 line 3014 [ 1073.420543] binder: undelivered TRANSACTION_ERROR: 29189 [ 1073.447116] vmalloc: allocation failure: 0 bytes [ 1073.447123] syz-executor.4: page allocation failure: order:0, mode:0x24000c2 [ 1073.447133] CPU: 0 PID: 17047 Comm: syz-executor.4 Not tainted 4.4.174+ #4 [ 1073.447154] 0000000000000000 31b1fa8b911e2539 ffff8801c2a279f0 ffffffff81aad1a1 [ 1073.447164] 1ffff10038544f41 ffff88009fa297c0 00000000024000c2 0000000000000000 [ 1073.447175] ffffffff82895080 ffff8801c2a27b00 ffffffff8148c0cb ffffffff00000001 [ 1073.447177] Call Trace: [ 1073.447192] [] dump_stack+0xc1/0x120 [ 1073.447205] [] warn_alloc_failed.cold+0x78/0x99 [ 1073.447216] [] ? zone_watermark_ok_safe+0x290/0x290 [ 1073.447225] [] ? sel_write_load+0x9e/0xf90 12:14:14 executing program 2: openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r0 = creat(&(0x7f0000000700)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x40000006100) ftruncate(r0, 0x208203) r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000008000/0x600000)=nil, 0x600000, 0x800002, 0x11, r1, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r2, &(0x7f0000000180)={0xa, 0x4e24, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) sendmmsg(r2, &(0x7f00000092c0), 0x4ff, 0x0) r3 = open(&(0x7f00000003c0)='./bus\x00', 0x0, 0x0) sendfile(r0, r3, 0x0, 0x8000fffffffe) r4 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r4, 0x1000008912, &(0x7f0000000000)="11dca5055e0acfec7be070") 12:14:14 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x6, 0x1100082) r1 = memfd_create(&(0x7f0000000080)='t\bnu\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00', 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000340)=[{&(0x7f0000001140)='\'', 0x1}], 0x1, 0x1081804) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendfile(r0, r0, 0x0, 0x200000d) ioctl$LOOP_CLR_FD(r0, 0x4c01) syz_genetlink_get_family_id$tipc(0x0) dup3(r1, r0, 0x0) 12:14:14 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) 12:14:14 executing program 0: openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)={'vet\x00\x00\x96T\x00\x00\x00\x00\x00\xbdh \x00', 0x402}) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000180)={'vd\x7f\x00\x16\x00\xf9V\xdbZ\xdd\x91\x80\xd2{\x00', 0x43732e5398417f1e}) close(r0) 12:14:14 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) 12:14:14 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) [ 1073.447233] [] __vmalloc_node_range+0x365/0x650 [ 1073.447242] [] ? check_preemption_disabled+0x3c/0x200 [ 1073.447250] [] ? check_preemption_disabled+0x3c/0x200 12:14:14 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) 12:14:14 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) 12:14:14 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) [ 1073.447258] [] ? task_has_security+0x130/0x270 ** 1 printk messages dropped ** [ 1073.447273] [] ? sel_write_load+0x119/0xf90 [ 1073.447281] [] sel_write_load+0x119/0xf90 [ 1073.447288] [] ? sel_read_bool+0x240/0x240 [ 1073.447298] [] ? trace_hardirqs_on+0x10/0x10 12:14:14 executing program 0: openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)={'vet\x00\x00\x96T\x00\x00\x00\x00\x00\xbdh \x00', 0x402}) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000180)={'vd\x7f\x00\x16\x00\xf9V\xdbZ\xdd\x91\x80\xd2{\x00', 0x43732e5398417f1e}) close(r0) 12:14:14 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x6, 0x1100082) r1 = memfd_create(&(0x7f0000000080)='t\bnu\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00', 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000340)=[{&(0x7f0000001140)='\'', 0x1}], 0x1, 0x1081804) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendfile(r0, r0, 0x0, 0x200000d) ioctl$LOOP_CLR_FD(r0, 0x4c01) syz_genetlink_get_family_id$tipc(0x0) dup3(r1, r0, 0x0) [ 1073.447306] [] __vfs_write+0x116/0x3d0 12:14:15 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) ** 46 printk messages dropped ** [ 1074.251827] [] ? sel_write_load+0x119/0xf90 ** 1 printk messages dropped ** [ 1074.251843] [] ? sel_read_bool+0x240/0x240 [ 1074.251852] [] ? trace_hardirqs_on+0x10/0x10 [ 1074.251860] [] __vfs_write+0x116/0x3d0 [ 1074.251868] [] ? sel_read_bool+0x240/0x240 [ 1074.251876] [] ? __vfs_read+0x3c0/0x3c0 [ 1074.251886] [] ? check_preemption_disabled+0x3c/0x200 [ 1074.251894] [] ? check_preemption_disabled+0x3c/0x200 [ 1074.251904] [] ? rcu_read_lock_sched_held+0x10b/0x130 [ 1074.251912] [] ? rcu_sync_lockdep_assert+0x73/0xb0 [ 1074.251922] [] ? __sb_start_write+0x14f/0x310 [ 1074.251946] [] vfs_write+0x182/0x4e0 [ 1074.251955] [] SyS_write+0xdc/0x1c0 [ 1074.251964] [] ? SyS_read+0x1c0/0x1c0 [ 1074.251977] [] ? lockdep_sys_exit_thunk+0x12/0x14 [ 1074.251988] [] entry_SYSCALL_64_fastpath+0x1e/0x9a [ 1074.253549] Mem-Info: [ 1074.253576] active_anon:70016 inactive_anon:5699 isolated_anon:0 [ 1074.253576] active_file:11182 inactive_file:11777 isolated_file:0 [ 1074.253576] unevictable:0 dirty:48 writeback:0 unstable:0 [ 1074.253576] slab_reclaimable:4385 slab_unreclaimable:63392 [ 1074.253576] mapped:58973 shmem:8151 pagetables:8496 bounce:0 [ 1074.253576] free:1407957 free_pcp:433 free_cma:0 [ 1074.253622] DMA32 free:2575688kB min:4696kB low:5868kB high:7044kB active_anon:127496kB inactive_anon:10264kB active_file:19752kB inactive_file:20788kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:3145324kB managed:3021976kB mlocked:0kB dirty:8kB writeback:0kB mapped:107836kB shmem:14300kB slab_reclaimable:8324kB slab_unreclaimable:115732kB kernel_stack:6176kB pagetables:15260kB unstable:0kB bounce:0kB free_pcp:684kB local_pcp:444kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no [ 1074.254368] lowmem_reserve[]: 0 3504 3504 12:14:15 executing program 2: openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r0 = creat(&(0x7f0000000700)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x40000006100) ftruncate(r0, 0x208203) r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000008000/0x600000)=nil, 0x600000, 0x800002, 0x11, r1, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r2, &(0x7f0000000180)={0xa, 0x4e24, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) sendmmsg(r2, &(0x7f00000092c0), 0x4ff, 0x0) r3 = open(&(0x7f00000003c0)='./bus\x00', 0x0, 0x0) sendfile(r0, r3, 0x0, 0x8000fffffffe) r4 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r4, 0x1000008912, &(0x7f0000000000)="11dca5055e0acfec7be070") 12:14:15 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) 12:14:15 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) 12:14:15 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) 12:14:15 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x6, 0x1100082) r1 = memfd_create(&(0x7f0000000080)='t\bnu\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00', 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000340)=[{&(0x7f0000001140)='\'', 0x1}], 0x1, 0x1081804) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendfile(r0, r0, 0x0, 0x200000d) ioctl$LOOP_CLR_FD(r0, 0x4c01) syz_genetlink_get_family_id$tipc(0x0) dup3(r1, r0, 0x0) 12:14:15 executing program 0: openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)={'vet\x00\x00\x96T\x00\x00\x00\x00\x00\xbdh \x00', 0x402}) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000180)={'vd\x7f\x00\x16\x00\xf9V\xdbZ\xdd\x91\x80\xd2{\x00', 0x43732e5398417f1e}) close(r0) [ 1074.254405] Normal free:3056140kB min:5580kB low:6972kB high:8368kB active_anon:152568kB inactive_anon:12532kB active_file:24976kB inactive_file:26320kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:4718592kB managed:3588764kB mlocked:0kB dirty:184kB writeback:0kB mapped:128056kB shmem:18304kB slab_reclaimable:9216kB slab_unreclaimable:137836kB kernel_stack:8192kB pagetables:18724kB unstable:0kB bounce:0kB free_pcp:1048kB local_pcp:692kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no 12:14:15 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x6, 0x1100082) r1 = memfd_create(&(0x7f0000000080)='t\bnu\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00', 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000340)=[{&(0x7f0000001140)='\'', 0x1}], 0x1, 0x1081804) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendfile(r0, r0, 0x0, 0x200000d) ioctl$LOOP_CLR_FD(r0, 0x4c01) syz_genetlink_get_family_id$tipc(0x0) dup3(r1, r0, 0x0) 12:14:15 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) 12:14:15 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) 12:14:15 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) 12:14:15 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) 12:14:15 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) ** 85 printk messages dropped ** [ 1074.431488] [] ? check_preemption_disabled+0x3c/0x200 [ 1074.431496] [] ? check_preemption_disabled+0x3c/0x200 [ 1074.431505] [] ? rcu_read_lock_sched_held+0x10b/0x130 [ 1074.431512] [] ? rcu_sync_lockdep_assert+0x73/0xb0 [ 1074.431521] [] ? __sb_start_write+0x14f/0x310 [ 1074.431529] [] vfs_write+0x182/0x4e0 [ 1074.431537] [] SyS_write+0xdc/0x1c0 [ 1074.431544] [] ? SyS_read+0x1c0/0x1c0 [ 1074.431555] [] ? lockdep_sys_exit_thunk+0x12/0x14 [ 1074.431564] [] entry_SYSCALL_64_fastpath+0x1e/0x9a [ 1074.431568] Mem-Info: [ 1074.431591] active_anon:70080 inactive_anon:6179 isolated_anon:0 [ 1074.431591] active_file:11182 inactive_file:11777 isolated_file:0 [ 1074.431591] unevictable:0 dirty:48 writeback:0 unstable:0 [ 1074.431591] slab_reclaimable:4385 slab_unreclaimable:63386 [ 1074.431591] mapped:58985 shmem:8667 pagetables:8493 bounce:0 [ 1074.431591] free:1407348 free_pcp:557 free_cma:0 [ 1074.431626] DMA32 free:2574324kB min:4696kB low:5868kB high:7044kB active_anon:127664kB inactive_anon:11212kB active_file:19752kB inactive_file:20788kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:3145324kB managed:3021976kB mlocked:0kB dirty:8kB writeback:0kB mapped:107824kB shmem:15328kB slab_reclaimable:8324kB slab_unreclaimable:115860kB kernel_stack:6432kB pagetables:15344kB unstable:0kB bounce:0kB free_pcp:924kB local_pcp:568kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no [ 1074.431635] lowmem_reserve[]: 0 3504 3504 [ 1074.431668] Normal free:3055068kB min:5580kB low:6972kB high:8368kB active_anon:152656kB inactive_anon:13504kB active_file:24976kB inactive_file:26320kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:4718592kB managed:3588764kB mlocked:0kB dirty:184kB writeback:0kB mapped:128116kB shmem:19340kB slab_reclaimable:9216kB slab_unreclaimable:137684kB kernel_stack:8032kB pagetables:18628kB unstable:0kB bounce:0kB free_pcp:1304kB local_pcp:704kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no [ 1074.431678] lowmem_reserve[]: 0 0 0 [ 1074.431732] DMA32: 3*4kB (UME) 299*8kB (UME) 331*16kB (UME) 147*32kB (UME) 72*64kB (UME) 25*128kB (UME) 11*256kB (UM) 5*512kB (M) 1*1024kB (E) 2*2048kB (UE) 621*4096kB (M) = 2574324kB [ 1074.431786] Normal: 341*4kB (UM) 351*8kB (UME) 291*16kB (UME) 223*32kB (UM) 86*64kB (UME) 33*128kB (UME) 10*256kB (UM) 8*512kB (UME) 4*1024kB (M) 4*2048kB (UME) 735*4096kB (M) = 3055196kB [ 1074.431789] 31625 total pagecache pages [ 1074.431793] 0 pages in swap cache [ 1074.431798] Swap cache stats: add 0, delete 0, find 0/0 [ 1074.431801] Free swap = 0kB [ 1074.431803] Total swap = 0kB [ 1074.431806] 1965979 pages RAM [ 1074.431808] 0 pages HighMem/MovableOnly [ 1074.431811] 313294 pages reserved [ 1075.099991] binder: 17104:17105 transaction failed 29189/-22, size 0-0 line 3014 [ 1075.100214] binder: undelivered TRANSACTION_ERROR: 29189 [ 1075.259215] binder: 17119:17121 transaction failed 29189/-22, size 0-0 line 3014 [ 1075.259383] binder: undelivered TRANSACTION_ERROR: 29189 [ 1075.367540] binder: 17140:17143 transaction failed 29189/-22, size 0-0 line 3014 [ 1075.367705] binder: undelivered TRANSACTION_ERROR: 29189 12:14:16 executing program 2: openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r0 = creat(&(0x7f0000000700)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x40000006100) ftruncate(r0, 0x208203) r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000008000/0x600000)=nil, 0x600000, 0x800002, 0x11, r1, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r2, &(0x7f0000000180)={0xa, 0x4e24, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) sendmmsg(r2, &(0x7f00000092c0), 0x4ff, 0x0) r3 = open(&(0x7f00000003c0)='./bus\x00', 0x0, 0x0) sendfile(r0, r3, 0x0, 0x8000fffffffe) r4 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r4, 0x1000008912, &(0x7f0000000000)="11dca5055e0acfec7be070") 12:14:16 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) 12:14:16 executing program 0: openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)={'vet\x00\x00\x96T\x00\x00\x00\x00\x00\xbdh \x00', 0x402}) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000180)={'vd\x7f\x00\x16\x00\xf9V\xdbZ\xdd\x91\x80\xd2{\x00', 0x43732e5398417f1e}) close(r0) 12:14:16 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) 12:14:16 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x6, 0x1100082) r1 = memfd_create(&(0x7f0000000080)='t\bnu\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00', 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000340)=[{&(0x7f0000001140)='\'', 0x1}], 0x1, 0x1081804) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendfile(r0, r0, 0x0, 0x200000d) ioctl$LOOP_CLR_FD(r0, 0x4c01) syz_genetlink_get_family_id$tipc(0x0) dup3(r1, r0, 0x0) 12:14:16 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) [ 1075.908606] binder: 17149:17156 transaction failed 29189/-22, size 0-0 line 3014 [ 1075.908750] binder: undelivered TRANSACTION_ERROR: 29189 [ 1075.981704] binder: 17168:17171 transaction failed 29189/-22, size 0-0 line 3014 [ 1075.981959] binder: undelivered TRANSACTION_ERROR: 29189 12:14:16 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) 12:14:16 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) 12:14:16 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) [ 1076.099970] binder: 17177:17183 transaction failed 29189/-22, size 0-0 line 3014 ** 13 printk messages dropped ** [ 1076.772432] [] ? zone_watermark_ok_safe+0x290/0x290 12:14:16 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x6, 0x1100082) r1 = memfd_create(&(0x7f0000000080)='t\bnu\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00', 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000340)=[{&(0x7f0000001140)='\'', 0x1}], 0x1, 0x1081804) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendfile(r0, r0, 0x0, 0x200000d) ioctl$LOOP_CLR_FD(r0, 0x4c01) syz_genetlink_get_family_id$tipc(0x0) dup3(r1, r0, 0x0) [ 1076.772443] [] ? sel_write_load+0x9e/0xf90 [ 1076.772455] [] __vmalloc_node_range+0x365/0x650 [ 1076.772466] [] ? check_preemption_disabled+0x3c/0x200 12:14:16 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) 12:14:16 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) ** 48 printk messages dropped ** [ 1076.933272] [] warn_alloc_failed.cold+0x78/0x99 ** 51 printk messages dropped ** [ 1077.642296] [] ? zone_watermark_ok_safe+0x290/0x290 [ 1077.642306] [] ? sel_write_load+0x9e/0xf90 [ 1077.642316] [] __vmalloc_node_range+0x365/0x650 [ 1077.642324] [] ? check_preemption_disabled+0x3c/0x200 [ 1077.642332] [] ? check_preemption_disabled+0x3c/0x200 [ 1077.642340] [] ? task_has_security+0x130/0x270 [ 1077.642347] [] vmalloc+0x5c/0x70 [ 1077.642355] [] ? sel_write_load+0x119/0xf90 [ 1077.642362] [] sel_write_load+0x119/0xf90 [ 1077.642370] [] ? sel_read_bool+0x240/0x240 [ 1077.642380] [] ? trace_hardirqs_on+0x10/0x10 [ 1077.642388] [] __vfs_write+0x116/0x3d0 [ 1077.642396] [] ? sel_read_bool+0x240/0x240 [ 1077.642405] [] ? __vfs_read+0x3c0/0x3c0 [ 1077.642414] [] ? check_preemption_disabled+0x3c/0x200 [ 1077.642423] [] ? check_preemption_disabled+0x3c/0x200 [ 1077.642441] [] ? rcu_read_lock_sched_held+0x10b/0x130 [ 1077.642451] [] ? rcu_sync_lockdep_assert+0x73/0xb0 [ 1077.642462] [] ? __sb_start_write+0x14f/0x310 [ 1077.642470] [] vfs_write+0x182/0x4e0 [ 1077.642480] [] SyS_write+0xdc/0x1c0 [ 1077.642487] [] ? SyS_read+0x1c0/0x1c0 [ 1077.642497] [] ? lockdep_sys_exit_thunk+0x12/0x14 [ 1077.642507] [] entry_SYSCALL_64_fastpath+0x1e/0x9a [ 1077.642532] Mem-Info: [ 1077.642558] active_anon:70056 inactive_anon:5725 isolated_anon:0 [ 1077.642558] active_file:11182 inactive_file:11777 isolated_file:0 [ 1077.642558] unevictable:0 dirty:48 writeback:0 unstable:0 [ 1077.642558] slab_reclaimable:4393 slab_unreclaimable:63492 [ 1077.642558] mapped:58964 shmem:8152 pagetables:8478 bounce:0 [ 1077.642558] free:1407683 free_pcp:550 free_cma:0 [ 1077.642594] DMA32 free:2574960kB min:4696kB low:5868kB high:7044kB active_anon:127492kB inactive_anon:10260kB active_file:19752kB inactive_file:20788kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:3145324kB managed:3021976kB mlocked:0kB dirty:8kB writeback:0kB mapped:107828kB shmem:14352kB slab_reclaimable:8340kB slab_unreclaimable:115920kB kernel_stack:6272kB pagetables:15364kB unstable:0kB bounce:0kB free_pcp:1232kB local_pcp:508kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no [ 1077.642605] lowmem_reserve[]: 0 3504 3504 [ 1077.642639] Normal free:3055772kB min:5580kB low:6972kB high:8368kB active_anon:152732kB inactive_anon:12640kB active_file:24976kB inactive_file:26320kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:4718592kB managed:3588764kB mlocked:0kB dirty:184kB writeback:0kB mapped:128028kB shmem:18256kB slab_reclaimable:9232kB slab_unreclaimable:138048kB kernel_stack:7872kB pagetables:18548kB unstable:0kB bounce:0kB free_pcp:968kB local_pcp:220kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no [ 1077.642648] lowmem_reserve[]: 0 0 0 [ 1077.642710] DMA32: 144*4kB (UME) 292*8kB (UME) 331*16kB (UME) 146*32kB (UME) 73*64kB (UME) 26*128kB (UME) 11*256kB (UM) 5*512kB (M) 1*1024kB (E) 2*2048kB (UE) 621*4096kB (M) = 2574992kB 12:14:17 executing program 0: openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)={'vet\x00\x00\x96T\x00\x00\x00\x00\x00\xbdh \x00', 0x402}) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000180)={'vd\x7f\x00\x16\x00\xf9V\xdbZ\xdd\x91\x80\xd2{\x00', 0x43732e5398417f1e}) close(r0) 12:14:17 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) 12:14:17 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) 12:14:17 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) 12:14:17 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x6, 0x1100082) r1 = memfd_create(&(0x7f0000000080)='t\bnu\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00', 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000340)=[{&(0x7f0000001140)='\'', 0x1}], 0x1, 0x1081804) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendfile(r0, r0, 0x0, 0x200000d) ioctl$LOOP_CLR_FD(r0, 0x4c01) syz_genetlink_get_family_id$tipc(0x0) dup3(r1, r0, 0x0) 12:14:17 executing program 2: openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r0 = creat(&(0x7f0000000700)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x40000006100) ftruncate(r0, 0x208203) r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000008000/0x600000)=nil, 0x600000, 0x800002, 0x11, r1, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r2, &(0x7f0000000180)={0xa, 0x4e24, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) sendmmsg(r2, &(0x7f00000092c0), 0x4ff, 0x0) r3 = open(&(0x7f00000003c0)='./bus\x00', 0x0, 0x0) sendfile(r0, r3, 0x0, 0x8000fffffffe) r4 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r4, 0x1000008912, &(0x7f0000000000)="11dca5055e0acfec7be070") [ 1077.642765] Normal: 251*4kB (UM) 412*8kB (UME) 299*16kB (UME) 235*32kB (UM) 87*64kB (UME) 32*128kB (UME) 10*256kB (UM) 8*512kB (UME) 4*1024kB (M) 4*2048kB (UME) 735*4096kB (M) = 3055772kB [ 1077.642768] 31110 total pagecache pages [ 1077.642772] 0 pages in swap cache 12:14:17 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) 12:14:17 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) [ 1077.642777] Swap cache stats: add 0, delete 0, find 0/0 [ 1077.642779] Free swap = 0kB [ 1077.642782] Total swap = 0kB 12:14:17 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) [ 1077.642785] 1965979 pages RAM [ 1077.642788] 0 pages HighMem/MovableOnly [ 1077.642790] 313294 pages reserved 12:14:17 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) 12:14:17 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) 12:14:17 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x6, 0x1100082) r1 = memfd_create(&(0x7f0000000080)='t\bnu\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00', 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000340)=[{&(0x7f0000001140)='\'', 0x1}], 0x1, 0x1081804) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendfile(r0, r0, 0x0, 0x200000d) ioctl$LOOP_CLR_FD(r0, 0x4c01) syz_genetlink_get_family_id$tipc(0x0) dup3(r1, r0, 0x0) [ 1077.715715] binder: 17251:17254 transaction failed 29189/-22, size 0-0 line 3014 12:14:17 executing program 0: openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)={'vet\x00\x00\x96T\x00\x00\x00\x00\x00\xbdh \x00', 0x402}) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000180)={'vd\x7f\x00\x16\x00\xf9V\xdbZ\xdd\x91\x80\xd2{\x00', 0x43732e5398417f1e}) close(r0) 12:14:17 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) 12:14:17 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) [ 1077.715847] binder: undelivered TRANSACTION_ERROR: 29189 12:14:17 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) 12:14:17 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) [ 1077.747224] vmalloc: allocation failure: 0 bytes [ 1077.747231] syz-executor.4: page allocation failure: order:0, mode:0x24000c2 [ 1077.747240] CPU: 1 PID: 17257 Comm: syz-executor.4 Not tainted 4.4.174+ #4 [ 1077.747253] 0000000000000000 275a70bc401f5bad ffff8801d3d9f9f0 ffffffff81aad1a1 [ 1077.747263] 1ffff1003a7b3f41 ffff8801d5e5c740 00000000024000c2 0000000000000000 [ 1077.747273] ffffffff82895080 ffff8801d3d9fb00 ffffffff8148c0cb ffffffff00000001 [ 1077.747276] Call Trace: [ 1077.747293] [] dump_stack+0xc1/0x120 [ 1077.747307] [] warn_alloc_failed.cold+0x78/0x99 [ 1077.747319] [] ? zone_watermark_ok_safe+0x290/0x290 [ 1077.747329] [] ? sel_write_load+0x9e/0xf90 [ 1077.747338] [] __vmalloc_node_range+0x365/0x650 [ 1077.747349] [] ? check_preemption_disabled+0x3c/0x200 [ 1077.747358] [] ? check_preemption_disabled+0x3c/0x200 [ 1077.747368] [] ? task_has_security+0x130/0x270 [ 1077.747377] [] vmalloc+0x5c/0x70 [ 1077.747386] [] ? sel_write_load+0x119/0xf90 [ 1077.747395] [] sel_write_load+0x119/0xf90 [ 1077.747405] [] ? sel_read_bool+0x240/0x240 [ 1077.747414] [] ? trace_hardirqs_on+0x10/0x10 [ 1077.747422] [] __vfs_write+0x116/0x3d0 [ 1077.747429] [] ? sel_read_bool+0x240/0x240 [ 1077.747449] [] ? __vfs_read+0x3c0/0x3c0 [ 1077.747457] [] ? check_preemption_disabled+0x3c/0x200 [ 1077.747467] [] ? check_preemption_disabled+0x3c/0x200 [ 1077.747478] [] ? rcu_read_lock_sched_held+0x10b/0x130 [ 1077.747486] [] ? rcu_sync_lockdep_assert+0x73/0xb0 [ 1077.747494] [] ? __sb_start_write+0x14f/0x310 [ 1077.747502] [] vfs_write+0x182/0x4e0 [ 1077.747509] [] SyS_write+0xdc/0x1c0 [ 1077.747516] [] ? SyS_read+0x1c0/0x1c0 [ 1077.747526] [] ? lockdep_sys_exit_thunk+0x12/0x14 [ 1077.747536] [] entry_SYSCALL_64_fastpath+0x1e/0x9a [ 1077.747539] Mem-Info: [ 1077.747565] active_anon:70106 inactive_anon:5725 isolated_anon:0 [ 1077.747565] active_file:11182 inactive_file:11777 isolated_file:0 [ 1077.747565] unevictable:0 dirty:48 writeback:0 unstable:0 [ 1077.747565] slab_reclaimable:4393 slab_unreclaimable:63402 [ 1077.747565] mapped:59001 shmem:8152 pagetables:8552 bounce:0 [ 1077.747565] free:1407715 free_pcp:498 free_cma:0 [ 1077.747601] DMA32 free:2574964kB min:4696kB low:5868kB high:7044kB active_anon:127792kB inactive_anon:10260kB active_file:19752kB inactive_file:20788kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:3145324kB managed:3021976kB mlocked:0kB dirty:8kB writeback:0kB mapped:107976kB shmem:14352kB slab_reclaimable:8340kB slab_unreclaimable:115796kB kernel_stack:6272kB pagetables:15364kB unstable:0kB bounce:0kB free_pcp:972kB local_pcp:396kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no [ 1077.747613] lowmem_reserve[]: 0 3504 3504 12:14:18 executing program 2: openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r0 = creat(&(0x7f0000000700)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x40000006100) ftruncate(r0, 0x208203) r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000008000/0x600000)=nil, 0x600000, 0x800002, 0x11, r1, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r2, &(0x7f0000000180)={0xa, 0x4e24, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) sendmmsg(r2, &(0x7f00000092c0), 0x4ff, 0x0) r3 = open(&(0x7f00000003c0)='./bus\x00', 0x0, 0x0) sendfile(r0, r3, 0x0, 0x8000fffffffe) r4 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r4, 0x1000008912, &(0x7f0000000000)="11dca5055e0acfec7be070") 12:14:18 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) 12:14:18 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x6, 0x1100082) r1 = memfd_create(&(0x7f0000000080)='t\bnu\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00', 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000340)=[{&(0x7f0000001140)='\'', 0x1}], 0x1, 0x1081804) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendfile(r0, r0, 0x0, 0x200000d) ioctl$LOOP_CLR_FD(r0, 0x4c01) syz_genetlink_get_family_id$tipc(0x0) dup3(r1, r0, 0x0) 12:14:18 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) 12:14:18 executing program 0: openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)={'vet\x00\x00\x96T\x00\x00\x00\x00\x00\xbdh \x00', 0x402}) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000180)={'vd\x7f\x00\x16\x00\xf9V\xdbZ\xdd\x91\x80\xd2{\x00', 0x43732e5398417f1e}) close(r0) 12:14:18 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) [ 1077.747649] Normal free:3055896kB min:5580kB low:6972kB high:8368kB active_anon:152632kB inactive_anon:12640kB active_file:24976kB inactive_file:26320kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:4718592kB managed:3588764kB mlocked:0kB dirty:184kB writeback:0kB mapped:128028kB shmem:18256kB slab_reclaimable:9232kB slab_unreclaimable:137812kB kernel_stack:7872kB pagetables:18844kB unstable:0kB bounce:0kB free_pcp:1012kB local_pcp:340kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no [ 1077.747657] lowmem_reserve[]: 0 0 0 12:14:18 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) 12:14:18 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) 12:14:18 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) [ 1077.747719] DMA32: 111*4kB (UME) 293*8kB (UME) 331*16kB (UME) 149*32kB (UME) 73*64kB (UME) 26*128kB (UME) 11*256kB (UM) 5*512kB (M) 1*1024kB (E) 2*2048kB (UE) 621*4096kB (M) = 2574964kB 12:14:18 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) 12:14:18 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) 12:14:18 executing program 0: openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)={'vet\x00\x00\x96T\x00\x00\x00\x00\x00\xbdh \x00', 0x402}) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000180)={'vd\x7f\x00\x16\x00\xf9V\xdbZ\xdd\x91\x80\xd2{\x00', 0x43732e5398417f1e}) close(r0) [ 1077.747780] Normal: 220*4kB (UM) 413*8kB (UME) 300*16kB (UME) 238*32kB (UM) 86*64kB (UME) 34*128kB (UME) 10*256kB (UM) 8*512kB (UME) 4*1024kB (M) 4*2048kB (UME) 735*4096kB (M) = 3055960kB [ 1077.747783] 31110 total pagecache pages [ 1077.747787] 0 pages in swap cache [ 1077.747792] Swap cache stats: add 0, delete 0, find 0/0 [ 1077.747795] Free swap = 0kB [ 1077.747797] Total swap = 0kB [ 1077.747800] 1965979 pages RAM [ 1077.747804] 0 pages HighMem/MovableOnly [ 1077.747806] 313294 pages reserved [ 1077.791206] binder: 17266:17268 transaction failed 29189/-22, size 0-0 line 3014 [ 1077.791374] binder: undelivered TRANSACTION_ERROR: 29189 [ 1078.428022] binder: 17281:17287 transaction failed 29189/-22, size 0-0 line 3014 [ 1078.428256] binder: undelivered TRANSACTION_ERROR: 29189 [ 1078.431385] vmalloc: allocation failure: 0 bytes [ 1078.431390] syz-executor.4: page allocation failure: order:0, mode:0x24000c2 [ 1078.431399] CPU: 0 PID: 17288 Comm: syz-executor.4 Not tainted 4.4.174+ #4 [ 1078.431412] 0000000000000000 8d29d33239b0e5db ffff8801d091f9f0 ffffffff81aad1a1 [ 1078.431422] 1ffff1003a123f41 ffff8800b7a0df00 00000000024000c2 0000000000000000 [ 1078.431433] ffffffff82895080 ffff8801d091fb00 ffffffff8148c0cb ffffffff00000001 [ 1078.431436] Call Trace: [ 1078.431453] [] dump_stack+0xc1/0x120 [ 1078.431467] [] warn_alloc_failed.cold+0x78/0x99 [ 1078.431480] [] ? zone_watermark_ok_safe+0x290/0x290 [ 1078.431490] [] ? sel_write_load+0x9e/0xf90 [ 1078.431501] [] __vmalloc_node_range+0x365/0x650 [ 1078.431511] [] ? check_preemption_disabled+0x3c/0x200 [ 1078.431519] [] ? check_preemption_disabled+0x3c/0x200 [ 1078.431529] [] ? task_has_security+0x130/0x270 [ 1078.431536] [] vmalloc+0x5c/0x70 [ 1078.431544] [] ? sel_write_load+0x119/0xf90 [ 1078.431551] [] sel_write_load+0x119/0xf90 [ 1078.431559] [] ? sel_read_bool+0x240/0x240 [ 1078.431568] [] ? trace_hardirqs_on+0x10/0x10 [ 1078.431576] [] __vfs_write+0x116/0x3d0 [ 1078.431585] [] ? sel_read_bool+0x240/0x240 12:14:18 executing program 2: openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r0 = creat(&(0x7f0000000700)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x40000006100) ftruncate(r0, 0x208203) r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000008000/0x600000)=nil, 0x600000, 0x800002, 0x11, r1, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r2, &(0x7f0000000180)={0xa, 0x4e24, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) sendmmsg(r2, &(0x7f00000092c0), 0x4ff, 0x0) r3 = open(&(0x7f00000003c0)='./bus\x00', 0x0, 0x0) sendfile(r0, r3, 0x0, 0x8000fffffffe) r4 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r4, 0x1000008912, &(0x7f0000000000)="11dca5055e0acfec7be070") 12:14:18 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) 12:14:18 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x6, 0x1100082) r1 = memfd_create(&(0x7f0000000080)='t\bnu\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00', 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000340)=[{&(0x7f0000001140)='\'', 0x1}], 0x1, 0x1081804) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendfile(r0, r0, 0x0, 0x200000d) ioctl$LOOP_CLR_FD(r0, 0x4c01) syz_genetlink_get_family_id$tipc(0x0) dup3(r1, r0, 0x0) 12:14:18 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) 12:14:18 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) 12:14:18 executing program 0: openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)={'vet\x00\x00\x96T\x00\x00\x00\x00\x00\xbdh \x00', 0x402}) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000180)={'vd\x7f\x00\x16\x00\xf9V\xdbZ\xdd\x91\x80\xd2{\x00', 0x43732e5398417f1e}) close(r0) [ 1078.431594] [] ? __vfs_read+0x3c0/0x3c0 [ 1078.431603] [] ? check_preemption_disabled+0x3c/0x200 [ 1078.431613] [] ? check_preemption_disabled+0x3c/0x200 [ 1078.431625] [] ? rcu_read_lock_sched_held+0x10b/0x130 [ 1078.431632] [] ? rcu_sync_lockdep_assert+0x73/0xb0 [ 1078.431640] [] ? __sb_start_write+0x14f/0x310 [ 1078.431649] [] vfs_write+0x182/0x4e0 [ 1078.431658] [] SyS_write+0xdc/0x1c0 12:14:18 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) 12:14:18 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) [ 1078.431665] [] ? SyS_read+0x1c0/0x1c0 [ 1078.431675] [] ? lockdep_sys_exit_thunk+0x12/0x14 [ 1078.431685] [] entry_SYSCALL_64_fastpath+0x1e/0x9a 12:14:18 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) 12:14:19 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) 12:14:19 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x6, 0x1100082) r1 = memfd_create(&(0x7f0000000080)='t\bnu\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00', 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000340)=[{&(0x7f0000001140)='\'', 0x1}], 0x1, 0x1081804) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendfile(r0, r0, 0x0, 0x200000d) ioctl$LOOP_CLR_FD(r0, 0x4c01) syz_genetlink_get_family_id$tipc(0x0) dup3(r1, r0, 0x0) [ 1078.431688] Mem-Info: [ 1078.431714] active_anon:70056 inactive_anon:5700 isolated_anon:0 [ 1078.431714] active_file:11182 inactive_file:11777 isolated_file:0 [ 1078.431714] unevictable:0 dirty:48 writeback:0 unstable:0 [ 1078.431714] slab_reclaimable:4393 slab_unreclaimable:63433 [ 1078.431714] mapped:58964 shmem:8152 pagetables:8515 bounce:0 [ 1078.431714] free:1407766 free_pcp:554 free_cma:0 12:14:19 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) [ 1078.431745] DMA32 free:2575092kB min:4696kB low:5868kB high:7044kB active_anon:127748kB inactive_anon:10240kB active_file:19752kB inactive_file:20788kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:3145324kB managed:3021976kB mlocked:0kB dirty:8kB writeback:0kB mapped:107824kB shmem:14324kB slab_reclaimable:8340kB slab_unreclaimable:115724kB kernel_stack:6304kB pagetables:15404kB unstable:0kB bounce:0kB free_pcp:1192kB local_pcp:660kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no [ 1078.431754] lowmem_reserve[]: 0 3504 3504 [ 1078.431800] Normal free:3055972kB min:5580kB low:6972kB high:8368kB active_anon:152476kB inactive_anon:12560kB active_file:24976kB inactive_file:26320kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:4718592kB managed:3588764kB mlocked:0kB dirty:184kB writeback:0kB mapped:128032kB shmem:18284kB slab_reclaimable:9232kB slab_unreclaimable:138008kB kernel_stack:7808kB pagetables:18656kB unstable:0kB bounce:0kB free_pcp:1024kB local_pcp:632kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no [ 1078.432992] lowmem_reserve[]: 0 0 0 [ 1078.441828] DMA32: 171*4kB (UME) 297*8kB (UME) 330*16kB (UME) 151*32kB (UME) 73*64kB (UME) 25*128kB (UME) 11*256kB (UM) 5*512kB (M) 1*1024kB (E) 2*2048kB (UE) 621*4096kB (M) = 2575156kB [ 1078.441886] Normal: 323*4kB (UM) 379*8kB (UME) 300*16kB (UME) 231*32kB (UM) 86*64kB (UME) 34*128kB (UME) 10*256kB (UM) 8*512kB (UME) 4*1024kB (M) 4*2048kB (UME) 735*4096kB (M) = 3055876kB [ 1078.441890] 31110 total pagecache pages [ 1078.441893] 0 pages in swap cache [ 1078.441898] Swap cache stats: add 0, delete 0, find 0/0 [ 1078.441901] Free swap = 0kB [ 1078.441903] Total swap = 0kB [ 1078.441906] 1965979 pages RAM [ 1078.441908] 0 pages HighMem/MovableOnly [ 1078.441911] 313294 pages reserved [ 1078.555709] vmalloc: allocation failure: 0 bytes [ 1078.555716] syz-executor.4: page allocation failure: order:0, mode:0x24000c2 [ 1078.555725] CPU: 1 PID: 17307 Comm: syz-executor.4 Not tainted 4.4.174+ #4 [ 1078.555738] 0000000000000000 9b4a74db53079912 ffff8800b4ff79f0 ffffffff81aad1a1 [ 1078.555748] 1ffff100169fef41 ffff8801d725c740 00000000024000c2 0000000000000000 [ 1078.555758] ffffffff82895080 ffff8800b4ff7b00 ffffffff8148c0cb ffffffff00000001 [ 1078.555762] Call Trace: [ 1078.555776] [] dump_stack+0xc1/0x120 [ 1078.555789] [] warn_alloc_failed.cold+0x78/0x99 [ 1078.555801] [] ? zone_watermark_ok_safe+0x290/0x290 [ 1078.555811] [] ? mark_held_locks+0xb1/0x100 [ 1078.555822] [] __vmalloc_node_range+0x365/0x650 [ 1078.555831] [] ? task_has_security+0x130/0x270 [ 1078.555838] [] vmalloc+0x5c/0x70 [ 1078.555845] [] ? sel_write_load+0x119/0xf90 [ 1078.555852] [] sel_write_load+0x119/0xf90 [ 1078.555860] [] ? sel_read_bool+0x240/0x240 [ 1078.555868] [] ? trace_hardirqs_on+0x10/0x10 [ 1078.555876] [] __vfs_write+0x116/0x3d0 [ 1078.555883] [] ? sel_read_bool+0x240/0x240 [ 1078.555891] [] ? __vfs_read+0x3c0/0x3c0 [ 1078.555899] [] ? check_preemption_disabled+0x3c/0x200 [ 1078.555907] [] ? check_preemption_disabled+0x3c/0x200 [ 1078.555916] [] ? rcu_read_lock_sched_held+0x10b/0x130 [ 1078.555924] [] ? rcu_sync_lockdep_assert+0x73/0xb0 [ 1078.555932] [] ? __sb_start_write+0x14f/0x310 [ 1078.555939] [] vfs_write+0x182/0x4e0 [ 1078.555947] [] SyS_write+0xdc/0x1c0 [ 1078.555956] [] ? SyS_read+0x1c0/0x1c0 [ 1078.555969] [] ? lockdep_sys_exit_thunk+0x12/0x14 [ 1078.555981] [] entry_SYSCALL_64_fastpath+0x1e/0x9a [ 1078.555984] Mem-Info: [ 1078.556009] active_anon:70131 inactive_anon:5700 isolated_anon:0 [ 1078.556009] active_file:11182 inactive_file:11777 isolated_file:0 [ 1078.556009] unevictable:0 dirty:48 writeback:0 unstable:0 [ 1078.556009] slab_reclaimable:4393 slab_unreclaimable:63277 [ 1078.556009] mapped:58964 shmem:8152 pagetables:8589 bounce:0 [ 1078.556009] free:1407826 free_pcp:462 free_cma:0 [ 1078.556041] DMA32 free:2575060kB min:4696kB low:5868kB high:7044kB active_anon:127748kB inactive_anon:10240kB active_file:19752kB inactive_file:20788kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:3145324kB managed:3021976kB mlocked:0kB dirty:8kB writeback:0kB mapped:107824kB shmem:14324kB slab_reclaimable:8340kB slab_unreclaimable:115364kB kernel_stack:6304kB pagetables:15552kB unstable:0kB bounce:0kB free_pcp:1016kB local_pcp:324kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no [ 1078.556051] lowmem_reserve[]: 0 3504 3504 12:14:19 executing program 2: openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r0 = creat(&(0x7f0000000700)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x40000006100) ftruncate(r0, 0x208203) r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000008000/0x600000)=nil, 0x600000, 0x800002, 0x11, r1, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r2, &(0x7f0000000180)={0xa, 0x4e24, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) sendmmsg(r2, &(0x7f00000092c0), 0x4ff, 0x0) r3 = open(&(0x7f00000003c0)='./bus\x00', 0x0, 0x0) sendfile(r0, r3, 0x0, 0x8000fffffffe) r4 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r4, 0x1000008912, &(0x7f0000000000)="11dca5055e0acfec7be070") 12:14:19 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) 12:14:19 executing program 0: openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)={'vet\x00\x00\x96T\x00\x00\x00\x00\x00\xbdh \x00', 0x402}) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000180)={'vd\x7f\x00\x16\x00\xf9V\xdbZ\xdd\x91\x80\xd2{\x00', 0x43732e5398417f1e}) close(r0) 12:14:19 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) 12:14:19 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) 12:14:19 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x6, 0x1100082) r1 = memfd_create(&(0x7f0000000080)='t\bnu\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00', 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000340)=[{&(0x7f0000001140)='\'', 0x1}], 0x1, 0x1081804) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendfile(r0, r0, 0x0, 0x200000d) ioctl$LOOP_CLR_FD(r0, 0x4c01) syz_genetlink_get_family_id$tipc(0x0) dup3(r1, r0, 0x0) 12:14:19 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) [ 1078.556083] Normal free:3056244kB min:5580kB low:6972kB high:8368kB active_anon:152776kB inactive_anon:12560kB active_file:24976kB inactive_file:26320kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:4718592kB managed:3588764kB mlocked:0kB dirty:184kB writeback:0kB mapped:128032kB shmem:18284kB slab_reclaimable:9232kB slab_unreclaimable:137744kB kernel_stack:7808kB pagetables:18804kB unstable:0kB bounce:0kB free_pcp:832kB local_pcp:436kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no 12:14:19 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) 12:14:19 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) 12:14:19 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x6, 0x1100082) r1 = memfd_create(&(0x7f0000000080)='t\bnu\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00', 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000340)=[{&(0x7f0000001140)='\'', 0x1}], 0x1, 0x1081804) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendfile(r0, r0, 0x0, 0x200000d) ioctl$LOOP_CLR_FD(r0, 0x4c01) syz_genetlink_get_family_id$tipc(0x0) dup3(r1, r0, 0x0) 12:14:19 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) 12:14:19 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) [ 1078.556091] lowmem_reserve[]: 0 0 0 [ 1078.556144] DMA32: 105*4kB (UME) 300*8kB (UME) 331*16kB (UME) 154*32kB (UME) 73*64kB (UME) 26*128kB (UME) 11*256kB (UM) 5*512kB (M) 1*1024kB (E) 2*2048kB (UE) 621*4096kB (M) = 2575156kB [ 1078.556201] Normal: 303*4kB (UM) 387*8kB (UME) 300*16kB (UME) 242*32kB (UM) 86*64kB (UME) 34*128kB (UME) 10*256kB (UM) 8*512kB (UME) 4*1024kB (M) 4*2048kB (UME) 735*4096kB (M) = 3056212kB [ 1078.556204] 31110 total pagecache pages [ 1078.556208] 0 pages in swap cache [ 1078.556213] Swap cache stats: add 0, delete 0, find 0/0 [ 1078.556215] Free swap = 0kB [ 1078.556217] Total swap = 0kB [ 1078.556220] 1965979 pages RAM [ 1078.556223] 0 pages HighMem/MovableOnly [ 1078.556225] 313294 pages reserved [ 1078.609739] vmalloc: allocation failure: 0 bytes [ 1078.609745] syz-executor.4: page allocation failure: order:0, mode:0x24000c2 [ 1078.609755] CPU: 1 PID: 17311 Comm: syz-executor.4 Not tainted 4.4.174+ #4 [ 1078.609767] 0000000000000000 746be1cf232f381c ffff8801d32479f0 ffffffff81aad1a1 [ 1078.609776] 1ffff1003a648f41 ffff8801d481df00 00000000024000c2 0000000000000000 [ 1078.609786] ffffffff82895080 ffff8801d3247b00 ffffffff8148c0cb ffffffff00000001 [ 1078.609788] Call Trace: [ 1078.609801] [] dump_stack+0xc1/0x120 [ 1078.609814] [] warn_alloc_failed.cold+0x78/0x99 [ 1078.609826] [] ? zone_watermark_ok_safe+0x290/0x290 [ 1078.609836] [] ? sel_write_load+0x9e/0xf90 [ 1078.609846] [] __vmalloc_node_range+0x365/0x650 [ 1078.609856] [] ? check_preemption_disabled+0x3c/0x200 [ 1078.609863] [] ? check_preemption_disabled+0x3c/0x200 [ 1078.609871] [] ? task_has_security+0x130/0x270 [ 1078.609878] [] vmalloc+0x5c/0x70 [ 1078.609885] [] ? sel_write_load+0x119/0xf90 [ 1078.609892] [] sel_write_load+0x119/0xf90 [ 1078.609900] [] ? sel_read_bool+0x240/0x240 [ 1078.609910] [] ? trace_hardirqs_on+0x10/0x10 [ 1078.609919] [] __vfs_write+0x116/0x3d0 [ 1078.609927] [] ? sel_read_bool+0x240/0x240 [ 1078.609935] [] ? __vfs_read+0x3c0/0x3c0 [ 1078.609944] [] ? check_preemption_disabled+0x3c/0x200 [ 1078.609955] [] ? check_preemption_disabled+0x3c/0x200 [ 1078.609965] [] ? rcu_read_lock_sched_held+0x10b/0x130 [ 1078.609974] [] ? rcu_sync_lockdep_assert+0x73/0xb0 [ 1078.609984] [] ? __sb_start_write+0x14f/0x310 [ 1078.609991] [] vfs_write+0x182/0x4e0 [ 1078.609999] [] SyS_write+0xdc/0x1c0 [ 1078.610006] [] ? SyS_read+0x1c0/0x1c0 [ 1078.610016] [] ? lockdep_sys_exit_thunk+0x12/0x14 [ 1078.610026] [] entry_SYSCALL_64_fastpath+0x1e/0x9a [ 1078.610029] Mem-Info: [ 1078.610054] active_anon:70106 inactive_anon:5700 isolated_anon:0 [ 1078.610054] active_file:11182 inactive_file:11777 isolated_file:0 [ 1078.610054] unevictable:0 dirty:48 writeback:0 unstable:0 [ 1078.610054] slab_reclaimable:4393 slab_unreclaimable:63277 [ 1078.610054] mapped:58964 shmem:8152 pagetables:8552 bounce:0 [ 1078.610054] free:1407763 free_pcp:531 free_cma:0 [ 1078.610088] DMA32 free:2574936kB min:4696kB low:5868kB high:7044kB active_anon:127648kB inactive_anon:10240kB active_file:19752kB inactive_file:20788kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:3145324kB managed:3021976kB mlocked:0kB dirty:8kB writeback:0kB mapped:107824kB shmem:14324kB slab_reclaimable:8340kB slab_unreclaimable:115364kB kernel_stack:6304kB pagetables:15552kB unstable:0kB bounce:0kB free_pcp:1360kB local_pcp:668kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no 12:14:20 executing program 2: openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r0 = creat(&(0x7f0000000700)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x40000006100) ftruncate(r0, 0x208203) r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000008000/0x600000)=nil, 0x600000, 0x800002, 0x11, r1, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r2, &(0x7f0000000180)={0xa, 0x4e24, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) sendmmsg(r2, &(0x7f00000092c0), 0x4ff, 0x0) r3 = open(&(0x7f00000003c0)='./bus\x00', 0x0, 0x0) sendfile(r0, r3, 0x0, 0x8000fffffffe) r4 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r4, 0x1000008912, &(0x7f0000000000)="11dca5055e0acfec7be070") 12:14:20 executing program 0: openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)={'vet\x00\x00\x96T\x00\x00\x00\x00\x00\xbdh \x00', 0x402}) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000180)={'vd\x7f\x00\x16\x00\xf9V\xdbZ\xdd\x91\x80\xd2{\x00', 0x43732e5398417f1e}) close(r0) 12:14:20 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) 12:14:20 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) 12:14:20 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) 12:14:20 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x6, 0x1100082) r1 = memfd_create(&(0x7f0000000080)='t\bnu\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00', 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000340)=[{&(0x7f0000001140)='\'', 0x1}], 0x1, 0x1081804) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendfile(r0, r0, 0x0, 0x200000d) ioctl$LOOP_CLR_FD(r0, 0x4c01) syz_genetlink_get_family_id$tipc(0x0) dup3(r1, r0, 0x0) 12:14:20 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) [ 1078.610098] lowmem_reserve[]: 0 3504 3504 [ 1078.610128] Normal free:3056116kB min:5580kB low:6972kB high:8368kB active_anon:152776kB inactive_anon:12560kB active_file:24976kB inactive_file:26320kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:4718592kB managed:3588764kB mlocked:0kB dirty:184kB writeback:0kB mapped:128032kB shmem:18284kB slab_reclaimable:9232kB slab_unreclaimable:137744kB kernel_stack:7808kB pagetables:18656kB unstable:0kB bounce:0kB free_pcp:764kB local_pcp:368kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no 12:14:20 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) 12:14:20 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) 12:14:20 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) [ 1078.610137] lowmem_reserve[]: 0 0 0 [ 1078.610190] DMA32: 105*4kB (UME) 300*8kB (UME) 331*16kB (UME) 152*32kB (UME) 73*64kB (UME) 26*128kB (UME) 11*256kB (UM) 5*512kB (M) 1*1024kB (E) 2*2048kB (UE) 621*4096kB (M) = 2575092kB 12:14:20 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x6, 0x1100082) r1 = memfd_create(&(0x7f0000000080)='t\bnu\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00', 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000340)=[{&(0x7f0000001140)='\'', 0x1}], 0x1, 0x1081804) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendfile(r0, r0, 0x0, 0x200000d) ioctl$LOOP_CLR_FD(r0, 0x4c01) syz_genetlink_get_family_id$tipc(0x0) dup3(r1, r0, 0x0) 12:14:20 executing program 0: openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)={'vet\x00\x00\x96T\x00\x00\x00\x00\x00\xbdh \x00', 0x402}) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000180)={'vd\x7f\x00\x16\x00\xf9V\xdbZ\xdd\x91\x80\xd2{\x00', 0x43732e5398417f1e}) close(r0) [ 1078.610240] Normal: 303*4kB (UM) 387*8kB (UME) 300*16kB (UME) 236*32kB (UM) 86*64kB (UME) 34*128kB (UME) 10*256kB (UM) 8*512kB (UME) 4*1024kB (M) 4*2048kB (UME) 735*4096kB (M) = 3056020kB ** 45 printk messages dropped ** [ 1079.322214] DMA32 free:2576604kB min:4696kB low:5868kB high:7044kB active_anon:127540kB inactive_anon:10216kB active_file:19752kB inactive_file:20788kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:3145324kB managed:3021976kB mlocked:0kB dirty:8kB writeback:0kB mapped:107824kB shmem:14296kB slab_reclaimable:8340kB slab_unreclaimable:114664kB kernel_stack:6240kB pagetables:15348kB unstable:0kB bounce:0kB free_pcp:872kB local_pcp:548kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no [ 1079.322288] lowmem_reserve[]: 0 3504 3504 [ 1079.322326] Normal free:3054668kB min:5580kB low:6972kB high:8368kB active_anon:152468kB inactive_anon:12500kB active_file:24976kB inactive_file:26320kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:4718592kB managed:3588764kB mlocked:0kB dirty:184kB writeback:0kB mapped:128116kB shmem:18300kB slab_reclaimable:9232kB slab_unreclaimable:139212kB kernel_stack:7936kB pagetables:18784kB unstable:0kB bounce:0kB free_pcp:1040kB local_pcp:592kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no [ 1079.322334] lowmem_reserve[]: 0 0 0 [ 1079.322394] DMA32: 319*4kB (UME) 324*8kB (UME) 330*16kB (UME) 170*32kB (UME) 74*64kB (UME) 25*128kB (UME) 11*256kB (UM) 5*512kB (M) 1*1024kB (E) 2*2048kB (UE) 621*4096kB (M) = 2576636kB [ 1079.322455] Normal: 229*4kB (UM) 355*8kB (UME) 300*16kB (UME) 212*32kB (UM) 86*64kB (UME) 34*128kB (UME) 10*256kB (UM) 8*512kB (UME) 4*1024kB (M) 4*2048kB (UME) 735*4096kB (M) = 3054700kB [ 1079.322458] 31107 total pagecache pages [ 1079.322462] 0 pages in swap cache [ 1079.322467] Swap cache stats: add 0, delete 0, find 0/0 [ 1079.322470] Free swap = 0kB [ 1079.322473] Total swap = 0kB [ 1079.322475] 1965979 pages RAM [ 1079.322478] 0 pages HighMem/MovableOnly [ 1079.322481] 313294 pages reserved [ 1079.384753] vmalloc: allocation failure: 0 bytes [ 1079.384759] syz-executor.4: page allocation failure: order:0, mode:0x24000c2 [ 1079.384769] CPU: 1 PID: 17339 Comm: syz-executor.4 Not tainted 4.4.174+ #4 [ 1079.384782] 0000000000000000 c974fe3708c11ff1 ffff8800ba2df9f0 ffffffff81aad1a1 [ 1079.384793] 1ffff1001745bf41 ffff8800b4a517c0 00000000024000c2 0000000000000000 [ 1079.384805] ffffffff82895080 ffff8800ba2dfb00 ffffffff8148c0cb ffffffff00000001 [ 1079.384808] Call Trace: [ 1079.384820] [] dump_stack+0xc1/0x120 [ 1079.384834] [] warn_alloc_failed.cold+0x78/0x99 [ 1079.384846] [] ? zone_watermark_ok_safe+0x290/0x290 [ 1079.384858] [] ? sel_write_load+0x9e/0xf90 [ 1079.384869] [] __vmalloc_node_range+0x365/0x650 [ 1079.384879] [] ? check_preemption_disabled+0x3c/0x200 [ 1079.384888] [] ? check_preemption_disabled+0x3c/0x200 [ 1079.384898] [] ? task_has_security+0x130/0x270 [ 1079.384906] [] vmalloc+0x5c/0x70 [ 1079.384914] [] ? sel_write_load+0x119/0xf90 [ 1079.384921] [] sel_write_load+0x119/0xf90 [ 1079.384930] [] ? sel_read_bool+0x240/0x240 [ 1079.384939] [] ? trace_hardirqs_on+0x10/0x10 [ 1079.384949] [] __vfs_write+0x116/0x3d0 [ 1079.384957] [] ? sel_read_bool+0x240/0x240 [ 1079.384966] [] ? __vfs_read+0x3c0/0x3c0 [ 1079.384975] [] ? check_preemption_disabled+0x3c/0x200 [ 1079.384985] [] ? check_preemption_disabled+0x3c/0x200 [ 1079.384995] [] ? rcu_read_lock_sched_held+0x10b/0x130 [ 1079.385003] [] ? rcu_sync_lockdep_assert+0x73/0xb0 [ 1079.385012] [] ? __sb_start_write+0x14f/0x310 [ 1079.385020] [] vfs_write+0x182/0x4e0 [ 1079.385028] [] SyS_write+0xdc/0x1c0 [ 1079.385036] [] ? SyS_read+0x1c0/0x1c0 [ 1079.385046] [] ? lockdep_sys_exit_thunk+0x12/0x14 [ 1079.385055] [] entry_SYSCALL_64_fastpath+0x1e/0x9a [ 1079.385058] Mem-Info: [ 1079.385080] active_anon:70052 inactive_anon:5679 isolated_anon:0 [ 1079.385080] active_file:11182 inactive_file:11777 isolated_file:0 [ 1079.385080] unevictable:0 dirty:48 writeback:0 unstable:0 [ 1079.385080] slab_reclaimable:4393 slab_unreclaimable:63350 [ 1079.385080] mapped:58985 shmem:8149 pagetables:8496 bounce:0 [ 1079.385080] free:1407918 free_pcp:469 free_cma:0 [ 1079.385113] DMA32 free:2576628kB min:4696kB low:5868kB high:7044kB active_anon:127640kB inactive_anon:10216kB active_file:19752kB inactive_file:20788kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:3145324kB managed:3021976kB mlocked:0kB dirty:8kB writeback:0kB mapped:107972kB shmem:14296kB slab_reclaimable:8340kB slab_unreclaimable:114416kB kernel_stack:6240kB pagetables:15496kB unstable:0kB bounce:0kB free_pcp:672kB local_pcp:336kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no 12:14:21 executing program 2: openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r0 = creat(&(0x7f0000000700)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x40000006100) ftruncate(r0, 0x208203) r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000008000/0x600000)=nil, 0x600000, 0x800002, 0x11, r1, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r2, &(0x7f0000000180)={0xa, 0x4e24, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) sendmmsg(r2, &(0x7f00000092c0), 0x4ff, 0x0) r3 = open(&(0x7f00000003c0)='./bus\x00', 0x0, 0x0) sendfile(r0, r3, 0x0, 0x8000fffffffe) r4 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r4, 0x1000008912, &(0x7f0000000000)="11dca5055e0acfec7be070") 12:14:21 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) 12:14:21 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) 12:14:21 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) 12:14:21 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x6, 0x1100082) r1 = memfd_create(&(0x7f0000000080)='t\bnu\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00', 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000340)=[{&(0x7f0000001140)='\'', 0x1}], 0x1, 0x1081804) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendfile(r0, r0, 0x0, 0x200000d) ioctl$LOOP_CLR_FD(r0, 0x4c01) syz_genetlink_get_family_id$tipc(0x0) dup3(r1, r0, 0x0) 12:14:21 executing program 0: openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)={'vet\x00\x00\x96T\x00\x00\x00\x00\x00\xbdh \x00', 0x402}) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000180)={'vd\x7f\x00\x16\x00\xf9V\xdbZ\xdd\x91\x80\xd2{\x00', 0x43732e5398417f1e}) close(r0) [ 1079.385122] lowmem_reserve[]: 0 3504 3504 12:14:21 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) 12:14:21 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) [ 1079.385156] Normal free:3055044kB min:5580kB low:6972kB high:8368kB active_anon:152568kB inactive_anon:12500kB active_file:24976kB inactive_file:26320kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:4718592kB managed:3588764kB mlocked:0kB dirty:184kB writeback:0kB mapped:127968kB shmem:18300kB slab_reclaimable:9232kB slab_unreclaimable:138984kB kernel_stack:7936kB pagetables:18488kB unstable:0kB bounce:0kB free_pcp:1204kB local_pcp:724kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no 12:14:21 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) 12:14:21 executing program 0: openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)={'vet\x00\x00\x96T\x00\x00\x00\x00\x00\xbdh \x00', 0x402}) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000180)={'vd\x7f\x00\x16\x00\xf9V\xdbZ\xdd\x91\x80\xd2{\x00', 0x43732e5398417f1e}) close(r0) 12:14:21 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) 12:14:21 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x6, 0x1100082) r1 = memfd_create(&(0x7f0000000080)='t\bnu\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00', 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000340)=[{&(0x7f0000001140)='\'', 0x1}], 0x1, 0x1081804) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendfile(r0, r0, 0x0, 0x200000d) ioctl$LOOP_CLR_FD(r0, 0x4c01) syz_genetlink_get_family_id$tipc(0x0) dup3(r1, r0, 0x0) ** 51 printk messages dropped ** [ 1080.084968] lowmem_reserve[]: 0 3504 3504 [ 1080.085004] Normal free:3055164kB min:5580kB low:6972kB high:8368kB active_anon:152732kB inactive_anon:12520kB active_file:24976kB inactive_file:26320kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:4718592kB managed:3588764kB mlocked:0kB dirty:184kB writeback:0kB mapped:128116kB shmem:18312kB slab_reclaimable:9232kB slab_unreclaimable:138800kB kernel_stack:7776kB pagetables:18944kB unstable:0kB bounce:0kB free_pcp:708kB local_pcp:200kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no [ 1080.085013] lowmem_reserve[]: 0 0 0 [ 1080.089353] DMA32: 377*4kB (UME) 293*8kB (UME) 331*16kB (UME) 170*32kB (UME) 74*64kB (UME) 26*128kB (UME) 11*256kB (UM) 5*512kB (M) 1*1024kB (E) 2*2048kB (UE) 621*4096kB (M) = 2576764kB [ 1080.089412] Normal: 153*4kB (UM) 419*8kB (UME) 302*16kB (UME) 217*32kB (UM) 86*64kB (UME) 34*128kB (UME) 10*256kB (UM) 8*512kB (UME) 4*1024kB (M) 4*2048kB (UME) 735*4096kB (M) = 3055100kB [ 1080.089415] 31107 total pagecache pages [ 1080.089418] 0 pages in swap cache [ 1080.089423] Swap cache stats: add 0, delete 0, find 0/0 [ 1080.089426] Free swap = 0kB [ 1080.089428] Total swap = 0kB [ 1080.089431] 1965979 pages RAM [ 1080.089433] 0 pages HighMem/MovableOnly [ 1080.089435] 313294 pages reserved [ 1080.212147] binder: 17382:17391 transaction failed 29189/-22, size 0-0 line 3014 [ 1080.212306] binder: undelivered TRANSACTION_ERROR: 29189 [ 1080.288030] binder_alloc: 17400: binder_alloc_buf, no vma [ 1080.288075] binder: 17400:17403 transaction failed 29189/-3, size 0-0 line 3137 [ 1080.291070] binder: undelivered TRANSACTION_ERROR: 29189 [ 1080.968949] binder: 17412:17422 transaction failed 29189/-22, size 0-0 line 3014 [ 1080.969137] binder: undelivered TRANSACTION_ERROR: 29189 [ 1081.087158] binder: 17432:17435 transaction failed 29189/-22, size 0-0 line 3014 [ 1081.087326] binder: undelivered TRANSACTION_ERROR: 29189 [ 1081.192682] binder: 17446:17448 transaction failed 29189/-22, size 0-0 line 3014 [ 1081.192841] binder: undelivered TRANSACTION_ERROR: 29189 [ 1081.805034] binder_alloc: 17455: binder_alloc_buf, no vma [ 1081.805078] binder: 17455:17459 transaction failed 29189/-3, size 0-0 line 3137 [ 1081.830355] binder: undelivered TRANSACTION_ERROR: 29189 [ 1081.905543] binder: 17468:17475 transaction failed 29189/-22, size 0-0 line 3014 [ 1081.905813] binder: undelivered TRANSACTION_ERROR: 29189 [ 1081.991638] warn_alloc_failed: 6 callbacks suppressed [ 1081.991645] vmalloc: allocation failure: 0 bytes [ 1081.991650] syz-executor.4: page allocation failure: order:0, mode:0x24000c2 [ 1081.991660] CPU: 1 PID: 17483 Comm: syz-executor.4 Not tainted 4.4.174+ #4 [ 1081.991675] 0000000000000000 6deb4468f6b9f312 ffff8800a63379f0 ffffffff81aad1a1 [ 1081.991686] 1ffff10014c66f41 ffff8801c0665f00 00000000024000c2 0000000000000000 [ 1081.991698] ffffffff82895080 ffff8800a6337b00 ffffffff8148c0cb ffffffff00000001 [ 1081.991700] Call Trace: [ 1081.991716] [] dump_stack+0xc1/0x120 [ 1081.991730] [] warn_alloc_failed.cold+0x78/0x99 [ 1081.991742] [] ? zone_watermark_ok_safe+0x290/0x290 [ 1081.991754] [] ? sel_write_load+0x9e/0xf90 [ 1081.991765] [] __vmalloc_node_range+0x365/0x650 [ 1081.991775] [] ? check_preemption_disabled+0x3c/0x200 [ 1081.991783] [] ? check_preemption_disabled+0x3c/0x200 [ 1081.991791] [] ? task_has_security+0x130/0x270 [ 1081.991799] [] vmalloc+0x5c/0x70 [ 1081.991808] [] ? sel_write_load+0x119/0xf90 [ 1081.991817] [] sel_write_load+0x119/0xf90 [ 1081.991826] [] ? sel_read_bool+0x240/0x240 [ 1081.991837] [] ? trace_hardirqs_on+0x10/0x10 [ 1081.991846] [] __vfs_write+0x116/0x3d0 [ 1081.991855] [] ? sel_read_bool+0x240/0x240 [ 1081.991864] [] ? __vfs_read+0x3c0/0x3c0 [ 1081.991873] [] ? check_preemption_disabled+0x3c/0x200 [ 1081.991881] [] ? check_preemption_disabled+0x3c/0x200 [ 1081.991890] [] ? rcu_read_lock_sched_held+0x10b/0x130 [ 1081.991898] [] ? rcu_sync_lockdep_assert+0x73/0xb0 [ 1081.991907] [] ? __sb_start_write+0x14f/0x310 [ 1081.991915] [] vfs_write+0x182/0x4e0 [ 1081.991923] [] SyS_write+0xdc/0x1c0 [ 1081.991930] [] ? SyS_read+0x1c0/0x1c0 [ 1081.991941] [] ? lockdep_sys_exit_thunk+0x12/0x14 [ 1081.991954] [] entry_SYSCALL_64_fastpath+0x1e/0x9a [ 1081.991957] Mem-Info: [ 1081.991982] active_anon:70054 inactive_anon:6096 isolated_anon:0 [ 1081.991982] active_file:11182 inactive_file:11777 isolated_file:0 [ 1081.991982] unevictable:0 dirty:48 writeback:0 unstable:0 [ 1081.991982] slab_reclaimable:4393 slab_unreclaimable:63378 [ 1081.991982] mapped:58950 shmem:8559 pagetables:8499 bounce:0 [ 1081.991982] free:1407627 free_pcp:390 free_cma:0 12:14:22 executing program 2: openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r0 = creat(&(0x7f0000000700)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x40000006100) ftruncate(r0, 0x208203) r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000008000/0x600000)=nil, 0x600000, 0x800002, 0x11, r1, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r2, &(0x7f0000000180)={0xa, 0x4e24, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) sendmmsg(r2, &(0x7f00000092c0), 0x4ff, 0x0) r3 = open(&(0x7f00000003c0)='./bus\x00', 0x0, 0x0) sendfile(r0, r3, 0x0, 0x8000fffffffe) r4 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r4, 0x1000008912, &(0x7f0000000000)="11dca5055e0acfec7be070") 12:14:22 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) 12:14:22 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) 12:14:22 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) 12:14:22 executing program 0: openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)={'vet\x00\x00\x96T\x00\x00\x00\x00\x00\xbdh \x00', 0x402}) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000180)={'vd\x7f\x00\x16\x00\xf9V\xdbZ\xdd\x91\x80\xd2{\x00', 0x43732e5398417f1e}) close(r0) 12:14:22 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x6, 0x1100082) r1 = memfd_create(&(0x7f0000000080)='t\bnu\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00', 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000340)=[{&(0x7f0000001140)='\'', 0x1}], 0x1, 0x1081804) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendfile(r0, r0, 0x0, 0x200000d) ioctl$LOOP_CLR_FD(r0, 0x4c01) syz_genetlink_get_family_id$tipc(0x0) dup3(r1, r0, 0x0) [ 1081.992018] DMA32 free:2575724kB min:4696kB low:5868kB high:7044kB active_anon:127628kB inactive_anon:11024kB active_file:19752kB inactive_file:20788kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:3145324kB managed:3021976kB mlocked:0kB dirty:8kB writeback:0kB mapped:107844kB shmem:15016kB slab_reclaimable:8340kB slab_unreclaimable:115156kB kernel_stack:6368kB pagetables:15132kB unstable:0kB bounce:0kB free_pcp:860kB local_pcp:632kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no [ 1081.992027] lowmem_reserve[]: 0 3504 3504 12:14:22 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) 12:14:22 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) [ 1081.992059] Normal free:3054784kB min:5580kB low:6972kB high:8368kB active_anon:152588kB inactive_anon:13360kB active_file:24976kB inactive_file:26320kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:4718592kB managed:3588764kB mlocked:0kB dirty:184kB writeback:0kB mapped:127956kB shmem:19220kB slab_reclaimable:9232kB slab_unreclaimable:138356kB kernel_stack:7968kB pagetables:18864kB unstable:0kB bounce:0kB free_pcp:700kB local_pcp:572kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no 12:14:22 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) 12:14:22 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) 12:14:22 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x6, 0x1100082) r1 = memfd_create(&(0x7f0000000080)='t\bnu\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00', 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000340)=[{&(0x7f0000001140)='\'', 0x1}], 0x1, 0x1081804) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendfile(r0, r0, 0x0, 0x200000d) ioctl$LOOP_CLR_FD(r0, 0x4c01) syz_genetlink_get_family_id$tipc(0x0) dup3(r1, r0, 0x0) 12:14:22 executing program 0: openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)={'vet\x00\x00\x96T\x00\x00\x00\x00\x00\xbdh \x00', 0x402}) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000180)={'vd\x7f\x00\x16\x00\xf9V\xdbZ\xdd\x91\x80\xd2{\x00', 0x43732e5398417f1e}) close(r0) ** 42 printk messages dropped ** [ 1082.707820] [] ? __sb_start_write+0x14f/0x310 [ 1082.707828] [] vfs_write+0x182/0x4e0 [ 1082.707836] [] SyS_write+0xdc/0x1c0 [ 1082.707845] [] ? SyS_read+0x1c0/0x1c0 [ 1082.707856] [] ? lockdep_sys_exit_thunk+0x12/0x14 [ 1082.707866] [] entry_SYSCALL_64_fastpath+0x1e/0x9a [ 1082.707869] Mem-Info: [ 1082.707892] active_anon:70056 inactive_anon:5700 isolated_anon:0 [ 1082.707892] active_file:11182 inactive_file:11777 isolated_file:0 [ 1082.707892] unevictable:0 dirty:48 writeback:0 unstable:0 [ 1082.707892] slab_reclaimable:4393 slab_unreclaimable:63254 [ 1082.707892] mapped:58964 shmem:8152 pagetables:8515 bounce:0 [ 1082.707892] free:1408049 free_pcp:474 free_cma:0 [ 1082.707940] DMA32 free:2576224kB min:4696kB low:5868kB high:7044kB active_anon:127616kB inactive_anon:10292kB active_file:19752kB inactive_file:20788kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:3145324kB managed:3021976kB mlocked:0kB dirty:8kB writeback:0kB mapped:107828kB shmem:14336kB slab_reclaimable:8340kB slab_unreclaimable:115140kB kernel_stack:6272kB pagetables:15288kB unstable:0kB bounce:0kB free_pcp:940kB local_pcp:360kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no [ 1082.708082] lowmem_reserve[]: 0 3504 3504 [ 1082.708119] Normal free:3055972kB min:5580kB low:6972kB high:8368kB active_anon:152608kB inactive_anon:12508kB active_file:24976kB inactive_file:26320kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:4718592kB managed:3588764kB mlocked:0kB dirty:184kB writeback:0kB mapped:128028kB shmem:18272kB slab_reclaimable:9232kB slab_unreclaimable:137876kB kernel_stack:7840kB pagetables:18772kB unstable:0kB bounce:0kB free_pcp:956kB local_pcp:336kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no [ 1082.708139] lowmem_reserve[]: 0 0 0 [ 1082.708204] DMA32: 112*4kB (UME) 271*8kB (UME) 330*16kB (UME) 196*32kB (UME) 74*64kB (UME) 25*128kB (UME) 11*256kB (UM) 5*512kB (M) 1*1024kB (E) 2*2048kB (UE) 621*4096kB (M) = 2576216kB [ 1082.708255] Normal: 417*4kB (UM) 382*8kB (UME) 303*16kB (UME) 221*32kB (UM) 86*64kB (UME) 34*128kB (UME) 10*256kB (UM) 8*512kB (UME) 4*1024kB (M) 4*2048kB (UME) 735*4096kB (M) = 3056004kB [ 1082.708258] 31110 total pagecache pages [ 1082.708262] 0 pages in swap cache [ 1082.708267] Swap cache stats: add 0, delete 0, find 0/0 [ 1082.708270] Free swap = 0kB [ 1082.708272] Total swap = 0kB [ 1082.708275] 1965979 pages RAM [ 1082.708278] 0 pages HighMem/MovableOnly [ 1082.708280] 313294 pages reserved [ 1082.785522] vmalloc: allocation failure: 0 bytes [ 1082.785606] syz-executor.4: page allocation failure: order:0, mode:0x24000c2 12:14:23 executing program 2: openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r0 = creat(&(0x7f0000000700)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x40000006100) ftruncate(r0, 0x208203) r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000008000/0x600000)=nil, 0x600000, 0x800002, 0x11, r1, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r2, &(0x7f0000000180)={0xa, 0x4e24, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) sendmmsg(r2, &(0x7f00000092c0), 0x4ff, 0x0) r3 = open(&(0x7f00000003c0)='./bus\x00', 0x0, 0x0) sendfile(r0, r3, 0x0, 0x8000fffffffe) r4 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r4, 0x1000008912, &(0x7f0000000000)="11dca5055e0acfec7be070") 12:14:23 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) 12:14:23 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) 12:14:23 executing program 0: openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)={'vet\x00\x00\x96T\x00\x00\x00\x00\x00\xbdh \x00', 0x402}) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000180)={'vd\x7f\x00\x16\x00\xf9V\xdbZ\xdd\x91\x80\xd2{\x00', 0x43732e5398417f1e}) close(r0) 12:14:23 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) 12:14:23 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x6, 0x1100082) r1 = memfd_create(&(0x7f0000000080)='t\bnu\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00', 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000340)=[{&(0x7f0000001140)='\'', 0x1}], 0x1, 0x1081804) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendfile(r0, r0, 0x0, 0x200000d) ioctl$LOOP_CLR_FD(r0, 0x4c01) syz_genetlink_get_family_id$tipc(0x0) dup3(r1, r0, 0x0) [ 1082.785616] CPU: 0 PID: 17518 Comm: syz-executor.4 Not tainted 4.4.174+ #4 [ 1082.785628] 0000000000000000 d44634f1d14a35b4 ffff8800a1ef79f0 ffffffff81aad1a1 [ 1082.785638] 1ffff100143def41 ffff8800a6a98000 00000000024000c2 0000000000000000 [ 1082.785650] ffffffff82895080 ffff8800a1ef7b00 ffffffff8148c0cb ffffffff00000001 12:14:23 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) [ 1082.785652] Call Trace: [ 1082.785668] [] dump_stack+0xc1/0x120 ** 21 printk messages dropped ** [ 1082.785866] [] SyS_write+0xdc/0x1c0 12:14:23 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) 12:14:23 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) [ 1082.785874] [] ? SyS_read+0x1c0/0x1c0 12:14:23 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) 12:14:23 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x6, 0x1100082) r1 = memfd_create(&(0x7f0000000080)='t\bnu\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00', 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000340)=[{&(0x7f0000001140)='\'', 0x1}], 0x1, 0x1081804) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendfile(r0, r0, 0x0, 0x200000d) ioctl$LOOP_CLR_FD(r0, 0x4c01) syz_genetlink_get_family_id$tipc(0x0) dup3(r1, r0, 0x0) ** 1 printk messages dropped ** [ 1082.785898] [] entry_SYSCALL_64_fastpath+0x1e/0x9a 12:14:23 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) ** 1 printk messages dropped ** [ 1082.785926] active_anon:70106 inactive_anon:5700 isolated_anon:0 [ 1082.785926] active_file:11182 inactive_file:11777 isolated_file:0 [ 1082.785926] unevictable:0 dirty:48 writeback:0 unstable:0 [ 1082.785926] slab_reclaimable:4393 slab_unreclaimable:63254 [ 1082.785926] mapped:59001 shmem:8152 pagetables:8515 bounce:0 [ 1082.785926] free:1407938 free_pcp:397 free_cma:0 [ 1082.785975] DMA32 free:2575780kB min:4696kB low:5868kB high:7044kB active_anon:127816kB inactive_anon:10292kB active_file:19752kB inactive_file:20788kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:3145324kB managed:3021976kB mlocked:0kB dirty:8kB writeback:0kB mapped:107976kB shmem:14336kB slab_reclaimable:8340kB slab_unreclaimable:115140kB kernel_stack:6272kB pagetables:15436kB unstable:0kB bounce:0kB free_pcp:700kB local_pcp:132kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no [ 1082.785985] lowmem_reserve[]: 0 3504 3504 [ 1082.786022] Normal free:3055972kB min:5580kB low:6972kB high:8368kB active_anon:152608kB inactive_anon:12508kB active_file:24976kB inactive_file:26320kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:4718592kB managed:3588764kB mlocked:0kB dirty:184kB writeback:0kB mapped:128028kB shmem:18272kB slab_reclaimable:9232kB slab_unreclaimable:137876kB kernel_stack:7840kB pagetables:18624kB unstable:0kB bounce:0kB free_pcp:884kB local_pcp:400kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no [ 1082.786032] lowmem_reserve[]: 0 0 0 [ 1082.786090] DMA32: 81*4kB (UME) 239*8kB (UME) 330*16kB (UME) 194*32kB (UME) 74*64kB (UME) 25*128kB (UME) 11*256kB (UM) 5*512kB (M) 1*1024kB (E) 2*2048kB (UE) 621*4096kB (M) = 2575772kB [ 1082.786147] Normal: 471*4kB (UM) 386*8kB (UME) 303*16kB (UME) 215*32kB (UM) 86*64kB (UME) 34*128kB (UME) 10*256kB (UM) 8*512kB (UME) 4*1024kB (M) 4*2048kB (UME) 735*4096kB (M) = 3056060kB [ 1082.786150] 31110 total pagecache pages [ 1082.786153] 0 pages in swap cache [ 1082.786158] Swap cache stats: add 0, delete 0, find 0/0 [ 1082.786161] Free swap = 0kB [ 1082.786163] Total swap = 0kB [ 1082.786166] 1965979 pages RAM [ 1082.786168] 0 pages HighMem/MovableOnly [ 1082.786171] 313294 pages reserved 12:14:24 executing program 2: openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r0 = creat(&(0x7f0000000700)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x40000006100) ftruncate(r0, 0x208203) r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000008000/0x600000)=nil, 0x600000, 0x800002, 0x11, r1, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r2, &(0x7f0000000180)={0xa, 0x4e24, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) sendmmsg(r2, &(0x7f00000092c0), 0x4ff, 0x0) r3 = open(&(0x7f00000003c0)='./bus\x00', 0x0, 0x0) sendfile(r0, r3, 0x0, 0x8000fffffffe) r4 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r4, 0x1000008912, &(0x7f0000000000)="11dca5055e0acfec7be070") 12:14:24 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) 12:14:24 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) 12:14:24 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) 12:14:24 executing program 0: openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)={'vet\x00\x00\x96T\x00\x00\x00\x00\x00\xbdh \x00', 0x402}) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000180)={'vd\x7f\x00\x16\x00\xf9V\xdbZ\xdd\x91\x80\xd2{\x00', 0x43732e5398417f1e}) close(r0) 12:14:24 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x6, 0x1100082) r1 = memfd_create(&(0x7f0000000080)='t\bnu\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00', 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000340)=[{&(0x7f0000001140)='\'', 0x1}], 0x1, 0x1081804) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendfile(r0, r0, 0x0, 0x200000d) ioctl$LOOP_CLR_FD(r0, 0x4c01) syz_genetlink_get_family_id$tipc(0x0) dup3(r1, r0, 0x0) [ 1082.798066] binder_alloc: 17512: binder_alloc_buf, no vma [ 1082.798108] binder: 17512:17519 transaction failed 29189/-3, size 0-0 line 3137 [ 1082.798239] binder: undelivered TRANSACTION_ERROR: 29189 [ 1082.896881] vmalloc: allocation failure: 0 bytes 12:14:24 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) [ 1082.896887] syz-executor.4: page allocation failure: order:0, mode:0x24000c2 12:14:24 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) 12:14:24 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) [ 1082.896897] CPU: 1 PID: 17528 Comm: syz-executor.4 Not tainted 4.4.174+ #4 12:14:24 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) 12:14:24 executing program 0: openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)={'vet\x00\x00\x96T\x00\x00\x00\x00\x00\xbdh \x00', 0x402}) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000180)={'vd\x7f\x00\x16\x00\xf9V\xdbZ\xdd\x91\x80\xd2{\x00', 0x43732e5398417f1e}) close(r0) 12:14:24 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x6, 0x1100082) r1 = memfd_create(&(0x7f0000000080)='t\bnu\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00', 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000340)=[{&(0x7f0000001140)='\'', 0x1}], 0x1, 0x1081804) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendfile(r0, r0, 0x0, 0x200000d) ioctl$LOOP_CLR_FD(r0, 0x4c01) syz_genetlink_get_family_id$tipc(0x0) dup3(r1, r0, 0x0) [ 1082.896910] 0000000000000000 791061cec7aca937 ffff8800b25b79f0 ffffffff81aad1a1 [ 1082.896921] 1ffff100164b6f41 ffff8800b2655f00 00000000024000c2 0000000000000000 [ 1082.896933] ffffffff82895080 ffff8800b25b7b00 ffffffff8148c0cb ffffffff00000001 [ 1082.896936] Call Trace: [ 1082.896950] [] dump_stack+0xc1/0x120 [ 1082.896964] [] warn_alloc_failed.cold+0x78/0x99 [ 1082.896975] [] ? zone_watermark_ok_safe+0x290/0x290 [ 1082.896985] [] ? sel_write_load+0x9e/0xf90 [ 1082.896994] [] __vmalloc_node_range+0x365/0x650 [ 1082.897003] [] ? check_preemption_disabled+0x3c/0x200 [ 1082.897011] [] ? check_preemption_disabled+0x3c/0x200 [ 1082.897019] [] ? task_has_security+0x130/0x270 [ 1082.897027] [] vmalloc+0x5c/0x70 [ 1082.897034] [] ? sel_write_load+0x119/0xf90 [ 1082.897042] [] sel_write_load+0x119/0xf90 [ 1082.897050] [] ? sel_read_bool+0x240/0x240 [ 1082.897059] [] ? trace_hardirqs_on+0x10/0x10 [ 1082.897068] [] __vfs_write+0x116/0x3d0 [ 1082.897075] [] ? sel_read_bool+0x240/0x240 [ 1082.897083] [] ? __vfs_read+0x3c0/0x3c0 [ 1082.897091] [] ? check_preemption_disabled+0x3c/0x200 [ 1082.897098] [] ? check_preemption_disabled+0x3c/0x200 [ 1082.897108] [] ? rcu_read_lock_sched_held+0x10b/0x130 [ 1082.897116] [] ? rcu_sync_lockdep_assert+0x73/0xb0 [ 1082.897125] [] ? __sb_start_write+0x14f/0x310 [ 1082.897132] [] vfs_write+0x182/0x4e0 [ 1082.897147] [] SyS_write+0xdc/0x1c0 [ 1082.897156] [] ? SyS_read+0x1c0/0x1c0 [ 1082.897169] [] ? lockdep_sys_exit_thunk+0x12/0x14 [ 1082.897181] [] entry_SYSCALL_64_fastpath+0x1e/0x9a [ 1082.897693] Mem-Info: [ 1082.897721] active_anon:70056 inactive_anon:6025 isolated_anon:0 [ 1082.897721] active_file:11182 inactive_file:11777 isolated_file:0 [ 1082.897721] unevictable:0 dirty:48 writeback:0 unstable:0 [ 1082.897721] slab_reclaimable:4393 slab_unreclaimable:63344 [ 1082.897721] mapped:58964 shmem:8485 pagetables:8478 bounce:0 [ 1082.897721] free:1407566 free_pcp:585 free_cma:0 [ 1082.897760] DMA32 free:2575816kB min:4696kB low:5868kB high:7044kB active_anon:127616kB inactive_anon:10292kB active_file:19752kB inactive_file:20788kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:3145324kB managed:3021976kB mlocked:0kB dirty:8kB writeback:0kB mapped:107828kB shmem:14336kB slab_reclaimable:8340kB slab_unreclaimable:115372kB kernel_stack:6272kB pagetables:15288kB unstable:0kB bounce:0kB free_pcp:1220kB local_pcp:644kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no [ 1082.897770] lowmem_reserve[]: 0 3504 3504 [ 1082.897801] Normal free:3054448kB min:5580kB low:6972kB high:8368kB active_anon:152608kB inactive_anon:13808kB active_file:24976kB inactive_file:26320kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:4718592kB managed:3588764kB mlocked:0kB dirty:184kB writeback:0kB mapped:128028kB shmem:19604kB slab_reclaimable:9232kB slab_unreclaimable:138004kB kernel_stack:7840kB pagetables:18624kB unstable:0kB bounce:0kB free_pcp:1120kB local_pcp:644kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no [ 1082.897809] lowmem_reserve[]: 0 0 0 [ 1082.897865] DMA32: 112*4kB (UME) 239*8kB (UME) 331*16kB (UME) 188*32kB (UME) 74*64kB (UME) 26*128kB (UME) 11*256kB (UM) 5*512kB (M) 1*1024kB (E) 2*2048kB (UE) 621*4096kB (M) = 2575848kB [ 1082.897979] Normal: 286*4kB (U) 308*8kB (UME) 303*16kB (UME) 212*32kB (UM) 86*64kB (UME) 34*128kB (UME) 10*256kB (UM) 8*512kB (UME) 4*1024kB (M) 4*2048kB (UME) 735*4096kB (M) = 3054600kB [ 1082.897982] 31443 total pagecache pages [ 1082.897987] 0 pages in swap cache [ 1082.897993] Swap cache stats: add 0, delete 0, find 0/0 [ 1082.897995] Free swap = 0kB [ 1082.897997] Total swap = 0kB [ 1082.898000] 1965979 pages RAM [ 1082.898003] 0 pages HighMem/MovableOnly [ 1082.898005] 313294 pages reserved [ 1083.856107] binder: 17546:17550 transaction failed 29189/-22, size 0-0 line 3014 [ 1083.856273] binder: undelivered TRANSACTION_ERROR: 29189 [ 1083.861367] vmalloc: allocation failure: 0 bytes [ 1083.861374] syz-executor.4: page allocation failure: order:0, mode:0x24000c2 [ 1083.861384] CPU: 0 PID: 17553 Comm: syz-executor.4 Not tainted 4.4.174+ #4 [ 1083.861397] 0000000000000000 5f8c036cb3995b15 ffff8800b25b79f0 ffffffff81aad1a1 [ 1083.861408] 1ffff100164b6f41 ffff8801d11197c0 00000000024000c2 0000000000000000 12:14:25 executing program 2: openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r0 = creat(&(0x7f0000000700)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x40000006100) ftruncate(r0, 0x208203) r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000008000/0x600000)=nil, 0x600000, 0x800002, 0x11, r1, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r2, &(0x7f0000000180)={0xa, 0x4e24, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) sendmmsg(r2, &(0x7f00000092c0), 0x4ff, 0x0) r3 = open(&(0x7f00000003c0)='./bus\x00', 0x0, 0x0) sendfile(r0, r3, 0x0, 0x8000fffffffe) r4 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r4, 0x1000008912, &(0x7f0000000000)="11dca5055e0acfec7be070") 12:14:25 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) 12:14:25 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) 12:14:25 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) 12:14:25 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x6, 0x1100082) r1 = memfd_create(&(0x7f0000000080)='t\bnu\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00', 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000340)=[{&(0x7f0000001140)='\'', 0x1}], 0x1, 0x1081804) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendfile(r0, r0, 0x0, 0x200000d) ioctl$LOOP_CLR_FD(r0, 0x4c01) syz_genetlink_get_family_id$tipc(0x0) dup3(r1, r0, 0x0) 12:14:25 executing program 0: openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)={'vet\x00\x00\x96T\x00\x00\x00\x00\x00\xbdh \x00', 0x402}) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000180)={'vd\x7f\x00\x16\x00\xf9V\xdbZ\xdd\x91\x80\xd2{\x00', 0x43732e5398417f1e}) close(r0) [ 1083.861419] ffffffff82895080 ffff8800b25b7b00 ffffffff8148c0cb ffffffff00000001 [ 1083.861422] Call Trace: [ 1083.861439] [] dump_stack+0xc1/0x120 [ 1083.861453] [] warn_alloc_failed.cold+0x78/0x99 12:14:25 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) 12:14:25 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) 12:14:25 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) [ 1083.861466] [] ? zone_watermark_ok_safe+0x290/0x290 [ 1083.861476] [] ? sel_write_load+0x9e/0xf90 12:14:25 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) 12:14:25 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x6, 0x1100082) r1 = memfd_create(&(0x7f0000000080)='t\bnu\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00', 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000340)=[{&(0x7f0000001140)='\'', 0x1}], 0x1, 0x1081804) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendfile(r0, r0, 0x0, 0x200000d) ioctl$LOOP_CLR_FD(r0, 0x4c01) syz_genetlink_get_family_id$tipc(0x0) dup3(r1, r0, 0x0) 12:14:25 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) [ 1083.861488] [] __vmalloc_node_range+0x365/0x650 [ 1083.861499] [] ? check_preemption_disabled+0x3c/0x200 ** 23 printk messages dropped ** [ 1083.861758] lowmem_reserve[]: 0 3504 3504 [ 1083.861795] Normal free:3055992kB min:5580kB low:6972kB high:8368kB active_anon:152512kB inactive_anon:12516kB active_file:24976kB inactive_file:26320kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:4718592kB managed:3588764kB mlocked:0kB dirty:184kB writeback:0kB mapped:128032kB shmem:18336kB slab_reclaimable:9232kB slab_unreclaimable:138004kB kernel_stack:7936kB pagetables:18852kB unstable:0kB bounce:0kB free_pcp:1052kB local_pcp:620kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no [ 1083.861803] lowmem_reserve[]: 0 0 0 [ 1083.861856] DMA32: 147*4kB (UME) 316*8kB (UME) 331*16kB (UME) 191*32kB (UME) 74*64kB (UME) 26*128kB (UME) 11*256kB (UM) 5*512kB (M) 1*1024kB (E) 2*2048kB (UE) 621*4096kB (M) = 2576700kB [ 1083.861908] Normal: 472*4kB (UM) 327*8kB (UME) 304*16kB (UME) 227*32kB (UM) 86*64kB (UME) 34*128kB (UME) 10*256kB (UM) 8*512kB (UME) 4*1024kB (M) 4*2048kB (UME) 735*4096kB (M) = 3055992kB [ 1083.863114] 31110 total pagecache pages [ 1083.863119] 0 pages in swap cache [ 1083.863124] Swap cache stats: add 0, delete 0, find 0/0 [ 1083.863128] Free swap = 0kB [ 1083.863130] Total swap = 0kB [ 1083.863134] 1965979 pages RAM [ 1083.863137] 0 pages HighMem/MovableOnly [ 1083.863139] 313294 pages reserved [ 1084.015739] binder: 17565:17577 transaction failed 29189/-22, size 0-0 line 3014 [ 1084.015917] binder: undelivered TRANSACTION_ERROR: 29189 [ 1084.018245] vmalloc: allocation failure: 0 bytes [ 1084.018251] syz-executor.4: page allocation failure: order:0, mode:0x24000c2 [ 1084.018261] CPU: 0 PID: 17574 Comm: syz-executor.4 Not tainted 4.4.174+ #4 [ 1084.018276] 0000000000000000 b6cd3ee8412c290e ffff8800b655f9f0 ffffffff81aad1a1 [ 1084.018288] 1ffff10016cabf41 ffff8800a66caf80 00000000024000c2 0000000000000000 [ 1084.018299] ffffffff82895080 ffff8800b655fb00 ffffffff8148c0cb ffffffff00000001 [ 1084.018302] Call Trace: [ 1084.018316] [] dump_stack+0xc1/0x120 [ 1084.018330] [] warn_alloc_failed.cold+0x78/0x99 [ 1084.018342] [] ? zone_watermark_ok_safe+0x290/0x290 [ 1084.018354] [] ? sel_write_load+0x9e/0xf90 [ 1084.018366] [] __vmalloc_node_range+0x365/0x650 [ 1084.018377] [] ? check_preemption_disabled+0x3c/0x200 [ 1084.018386] [] ? check_preemption_disabled+0x3c/0x200 [ 1084.018397] [] ? task_has_security+0x130/0x270 [ 1084.018406] [] vmalloc+0x5c/0x70 [ 1084.018416] [] ? sel_write_load+0x119/0xf90 [ 1084.018424] [] sel_write_load+0x119/0xf90 [ 1084.018433] [] ? sel_read_bool+0x240/0x240 [ 1084.018444] [] ? trace_hardirqs_on+0x10/0x10 [ 1084.018455] [] __vfs_write+0x116/0x3d0 [ 1084.018463] [] ? sel_read_bool+0x240/0x240 [ 1084.018472] [] ? __vfs_read+0x3c0/0x3c0 [ 1084.018481] [] ? check_preemption_disabled+0x3c/0x200 [ 1084.018488] [] ? check_preemption_disabled+0x3c/0x200 [ 1084.018499] [] ? rcu_read_lock_sched_held+0x10b/0x130 [ 1084.018509] [] ? rcu_sync_lockdep_assert+0x73/0xb0 [ 1084.018518] [] ? __sb_start_write+0x14f/0x310 [ 1084.018526] [] vfs_write+0x182/0x4e0 [ 1084.018544] [] SyS_write+0xdc/0x1c0 [ 1084.018553] [] ? SyS_read+0x1c0/0x1c0 [ 1084.018566] [] ? lockdep_sys_exit_thunk+0x12/0x14 [ 1084.018579] [] entry_SYSCALL_64_fastpath+0x1e/0x9a [ 1084.018769] Mem-Info: [ 1084.018797] active_anon:70130 inactive_anon:6050 isolated_anon:0 [ 1084.018797] active_file:11182 inactive_file:11777 isolated_file:0 [ 1084.018797] unevictable:0 dirty:48 writeback:0 unstable:0 [ 1084.018797] slab_reclaimable:4393 slab_unreclaimable:63034 [ 1084.018797] mapped:59001 shmem:8522 pagetables:8609 bounce:0 [ 1084.018797] free:1407752 free_pcp:350 free_cma:0 [ 1084.018839] DMA32 free:2575828kB min:4696kB low:5868kB high:7044kB active_anon:127808kB inactive_anon:10384kB active_file:19752kB inactive_file:20788kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:3145324kB managed:3021976kB mlocked:0kB dirty:8kB writeback:0kB mapped:107972kB shmem:14420kB slab_reclaimable:8340kB slab_unreclaimable:114472kB kernel_stack:6304kB pagetables:15732kB unstable:0kB bounce:0kB free_pcp:840kB local_pcp:692kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no [ 1084.018894] lowmem_reserve[]: 0 3504 3504 [ 1084.018931] Normal free:3055180kB min:5580kB low:6972kB high:8368kB active_anon:152712kB inactive_anon:13816kB active_file:24976kB inactive_file:26320kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:4718592kB managed:3588764kB mlocked:0kB dirty:184kB writeback:0kB mapped:128032kB shmem:19668kB slab_reclaimable:9232kB slab_unreclaimable:137664kB kernel_stack:7936kB pagetables:18704kB unstable:0kB bounce:0kB free_pcp:560kB local_pcp:416kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no [ 1084.018949] lowmem_reserve[]: 0 0 0 [ 1084.019009] DMA32: 61*4kB (ME) 262*8kB (UME) 331*16kB (UME) 186*32kB (UME) 74*64kB (UME) 26*128kB (UME) 11*256kB (UM) 5*512kB (M) 1*1024kB (E) 2*2048kB (UE) 621*4096kB (M) = 2575764kB [ 1084.019066] Normal: 227*4kB (U) 310*8kB (UME) 304*16kB (UME) 239*32kB (UM) 86*64kB (UME) 34*128kB (UME) 10*256kB (UM) 8*512kB (UME) 4*1024kB (M) 4*2048kB (UME) 735*4096kB (M) = 3055260kB [ 1084.019069] 31480 total pagecache pages [ 1084.019074] 0 pages in swap cache [ 1084.019079] Swap cache stats: add 0, delete 0, find 0/0 [ 1084.019082] Free swap = 0kB [ 1084.019085] Total swap = 0kB [ 1084.019088] 1965979 pages RAM [ 1084.019091] 0 pages HighMem/MovableOnly [ 1084.019094] 313294 pages reserved [ 1084.698586] vmalloc: allocation failure: 0 bytes [ 1084.698592] syz-executor.4: page allocation failure: order:0, mode:0x24000c2 [ 1084.698601] CPU: 1 PID: 17599 Comm: syz-executor.4 Not tainted 4.4.174+ #4 [ 1084.698614] 0000000000000000 9a506bcda6596d11 ffff8801d0a5f9f0 ffffffff81aad1a1 [ 1084.698624] 1ffff1003a14bf41 ffff8801d2075f00 00000000024000c2 0000000000000000 [ 1084.698635] ffffffff82895080 ffff8801d0a5fb00 ffffffff8148c0cb ffffffff00000001 [ 1084.698638] Call Trace: [ 1084.698652] [] dump_stack+0xc1/0x120 [ 1084.698665] [] warn_alloc_failed.cold+0x78/0x99 [ 1084.698677] [] ? zone_watermark_ok_safe+0x290/0x290 12:14:26 executing program 2: openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r0 = creat(&(0x7f0000000700)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x40000006100) ftruncate(r0, 0x208203) r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000008000/0x600000)=nil, 0x600000, 0x800002, 0x11, r1, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r2, &(0x7f0000000180)={0xa, 0x4e24, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) sendmmsg(r2, &(0x7f00000092c0), 0x4ff, 0x0) r3 = open(&(0x7f00000003c0)='./bus\x00', 0x0, 0x0) sendfile(r0, r3, 0x0, 0x8000fffffffe) r4 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r4, 0x1000008912, &(0x7f0000000000)="11dca5055e0acfec7be070") 12:14:26 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) 12:14:26 executing program 0: openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)={'vet\x00\x00\x96T\x00\x00\x00\x00\x00\xbdh \x00', 0x402}) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000180)={'vd\x7f\x00\x16\x00\xf9V\xdbZ\xdd\x91\x80\xd2{\x00', 0x43732e5398417f1e}) close(r0) 12:14:26 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) 12:14:26 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) 12:14:26 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x6, 0x1100082) r1 = memfd_create(&(0x7f0000000080)='t\bnu\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00', 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000340)=[{&(0x7f0000001140)='\'', 0x1}], 0x1, 0x1081804) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendfile(r0, r0, 0x0, 0x200000d) ioctl$LOOP_CLR_FD(r0, 0x4c01) syz_genetlink_get_family_id$tipc(0x0) dup3(r1, r0, 0x0) 12:14:26 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) [ 1084.698686] [] ? sel_write_load+0x9e/0xf90 [ 1084.698695] [] __vmalloc_node_range+0x365/0x650 12:14:26 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) 12:14:26 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) 12:14:26 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) [ 1084.698705] [] ? check_preemption_disabled+0x3c/0x200 ** 23 printk messages dropped ** [ 1084.706347] lowmem_reserve[]: 0 3504 3504 12:14:26 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x6, 0x1100082) r1 = memfd_create(&(0x7f0000000080)='t\bnu\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00', 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000340)=[{&(0x7f0000001140)='\'', 0x1}], 0x1, 0x1081804) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendfile(r0, r0, 0x0, 0x200000d) ioctl$LOOP_CLR_FD(r0, 0x4c01) syz_genetlink_get_family_id$tipc(0x0) dup3(r1, r0, 0x0) 12:14:26 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) [ 1084.706378] Normal free:3055516kB min:5580kB low:6972kB high:8368kB active_anon:152548kB inactive_anon:12668kB active_file:24976kB inactive_file:26320kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:4718592kB managed:3588764kB mlocked:0kB dirty:184kB writeback:0kB mapped:128012kB shmem:18344kB slab_reclaimable:9232kB slab_unreclaimable:138220kB kernel_stack:7968kB pagetables:18836kB unstable:0kB bounce:0kB free_pcp:1072kB local_pcp:432kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no ** 51 printk messages dropped ** [ 1084.839581] lowmem_reserve[]: 0 3504 3504 [ 1084.839611] Normal free:3055072kB min:5580kB low:6972kB high:8368kB active_anon:152648kB inactive_anon:13368kB active_file:24976kB inactive_file:26320kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:4718592kB managed:3588764kB mlocked:0kB dirty:184kB writeback:0kB mapped:128012kB shmem:19232kB slab_reclaimable:9232kB slab_unreclaimable:137580kB kernel_stack:7968kB pagetables:18688kB unstable:0kB bounce:0kB free_pcp:1168kB local_pcp:556kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no [ 1084.839621] lowmem_reserve[]: 0 0 0 [ 1084.839676] DMA32: 22*4kB (UE) 236*8kB (UME) 331*16kB (UME) 206*32kB (UME) 77*64kB (UME) 26*128kB (UME) 11*256kB (UM) 5*512kB (M) 1*1024kB (E) 2*2048kB (UE) 621*4096kB (M) = 2576232kB [ 1084.839725] Normal: 262*4kB (UM) 345*8kB (UME) 305*16kB (UME) 219*32kB (UM) 86*64kB (UME) 34*128kB (UME) 10*256kB (UM) 8*512kB (UME) 4*1024kB (M) 4*2048kB (UME) 735*4096kB (M) = 3055056kB [ 1084.839727] 31627 total pagecache pages [ 1084.839731] 0 pages in swap cache [ 1084.839737] Swap cache stats: add 0, delete 0, find 0/0 [ 1084.839740] Free swap = 0kB [ 1084.839743] Total swap = 0kB [ 1084.839745] 1965979 pages RAM [ 1084.839749] 0 pages HighMem/MovableOnly [ 1084.839752] 313294 pages reserved [ 1085.589853] binder: 17639:17643 transaction failed 29189/-22, size 0-0 line 3014 [ 1085.590023] binder: undelivered TRANSACTION_ERROR: 29189 [ 1085.650555] binder: 17648:17649 transaction failed 29189/-22, size 0-0 line 3014 [ 1085.650720] binder: undelivered TRANSACTION_ERROR: 29189 [ 1085.660166] vmalloc: allocation failure: 0 bytes [ 1085.660172] syz-executor.4: page allocation failure: order:0, mode:0x24000c2 [ 1085.660182] CPU: 0 PID: 17647 Comm: syz-executor.4 Not tainted 4.4.174+ #4 [ 1085.660198] 0000000000000000 1f02217b7c5a5fad ffff8801d09ef9f0 ffffffff81aad1a1 [ 1085.660210] 1ffff1003a13df41 ffff8800b70d0000 00000000024000c2 0000000000000000 [ 1085.660221] ffffffff82895080 ffff8801d09efb00 ffffffff8148c0cb ffffffff00000001 [ 1085.660224] Call Trace: [ 1085.660237] [] dump_stack+0xc1/0x120 [ 1085.660251] [] warn_alloc_failed.cold+0x78/0x99 [ 1085.660262] [] ? zone_watermark_ok_safe+0x290/0x290 [ 1085.660274] [] ? sel_write_load+0x9e/0xf90 [ 1085.660286] [] __vmalloc_node_range+0x365/0x650 [ 1085.660296] [] ? check_preemption_disabled+0x3c/0x200 [ 1085.660305] [] ? check_preemption_disabled+0x3c/0x200 [ 1085.660314] [] ? task_has_security+0x130/0x270 [ 1085.660323] [] vmalloc+0x5c/0x70 [ 1085.660330] [] ? sel_write_load+0x119/0xf90 [ 1085.660336] [] sel_write_load+0x119/0xf90 [ 1085.660344] [] ? sel_read_bool+0x240/0x240 [ 1085.660353] [] ? trace_hardirqs_on+0x10/0x10 [ 1085.660363] [] __vfs_write+0x116/0x3d0 [ 1085.660372] [] ? sel_read_bool+0x240/0x240 [ 1085.660381] [] ? __vfs_read+0x3c0/0x3c0 [ 1085.660390] [] ? check_preemption_disabled+0x3c/0x200 [ 1085.660398] [] ? check_preemption_disabled+0x3c/0x200 [ 1085.660407] [] ? rcu_read_lock_sched_held+0x10b/0x130 [ 1085.660415] [] ? rcu_sync_lockdep_assert+0x73/0xb0 [ 1085.660424] [] ? __sb_start_write+0x14f/0x310 [ 1085.660431] [] vfs_write+0x182/0x4e0 [ 1085.660438] [] SyS_write+0xdc/0x1c0 [ 1085.660446] [] ? SyS_read+0x1c0/0x1c0 [ 1085.660460] [] ? lockdep_sys_exit_thunk+0x12/0x14 [ 1085.660470] [] entry_SYSCALL_64_fastpath+0x1e/0x9a [ 1085.660473] Mem-Info: [ 1085.660499] active_anon:70031 inactive_anon:5700 isolated_anon:0 [ 1085.660499] active_file:11182 inactive_file:11777 isolated_file:0 [ 1085.660499] unevictable:0 dirty:48 writeback:0 unstable:0 [ 1085.660499] slab_reclaimable:4393 slab_unreclaimable:62938 [ 1085.660499] mapped:58964 shmem:8152 pagetables:8515 bounce:0 [ 1085.660499] free:1408274 free_pcp:549 free_cma:0 [ 1085.660535] DMA32 free:2576688kB min:4696kB low:5868kB high:7044kB active_anon:127584kB inactive_anon:10248kB active_file:19752kB inactive_file:20788kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:3145324kB managed:3021976kB mlocked:0kB dirty:8kB writeback:0kB mapped:107884kB shmem:14244kB slab_reclaimable:8340kB slab_unreclaimable:114268kB kernel_stack:6272kB pagetables:15428kB unstable:0kB bounce:0kB free_pcp:1128kB local_pcp:460kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no 12:14:26 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) 12:14:26 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) 12:14:26 executing program 0: openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)={'vet\x00\x00\x96T\x00\x00\x00\x00\x00\xbdh \x00', 0x402}) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000180)={'vd\x7f\x00\x16\x00\xf9V\xdbZ\xdd\x91\x80\xd2{\x00', 0x43732e5398417f1e}) close(r0) 12:14:26 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) 12:14:26 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x6, 0x1100082) r1 = memfd_create(&(0x7f0000000080)='t\bnu\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00', 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000340)=[{&(0x7f0000001140)='\'', 0x1}], 0x1, 0x1081804) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendfile(r0, r0, 0x0, 0x200000d) ioctl$LOOP_CLR_FD(r0, 0x4c01) syz_genetlink_get_family_id$tipc(0x0) dup3(r1, r0, 0x0) 12:14:26 executing program 2: openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r0 = creat(&(0x7f0000000700)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x40000006100) ftruncate(r0, 0x208203) r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000008000/0x600000)=nil, 0x600000, 0x800002, 0x11, r1, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r2, &(0x7f0000000180)={0xa, 0x4e24, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) sendmmsg(r2, &(0x7f00000092c0), 0x4ff, 0x0) r3 = open(&(0x7f00000003c0)='./bus\x00', 0x0, 0x0) sendfile(r0, r3, 0x0, 0x8000fffffffe) r4 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r4, 0x1000008912, &(0x7f0000000000)="11dca5055e0acfec7be070") [ 1085.660546] lowmem_reserve[]: 0 3504 3504 12:14:27 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) [ 1085.660578] Normal free:3056408kB min:5580kB low:6972kB high:8368kB active_anon:152540kB inactive_anon:12552kB active_file:24976kB inactive_file:26320kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:4718592kB managed:3588764kB mlocked:0kB dirty:184kB writeback:0kB mapped:127972kB shmem:18364kB slab_reclaimable:9232kB slab_unreclaimable:137484kB kernel_stack:7840kB pagetables:18632kB unstable:0kB bounce:0kB free_pcp:1068kB local_pcp:452kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no 12:14:27 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) 12:14:27 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) 12:14:27 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) 12:14:27 executing program 0: openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)={'vet\x00\x00\x96T\x00\x00\x00\x00\x00\xbdh \x00', 0x402}) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000180)={'vd\x7f\x00\x16\x00\xf9V\xdbZ\xdd\x91\x80\xd2{\x00', 0x43732e5398417f1e}) close(r0) 12:14:27 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) 12:14:27 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x6, 0x1100082) r1 = memfd_create(&(0x7f0000000080)='t\bnu\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00', 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000340)=[{&(0x7f0000001140)='\'', 0x1}], 0x1, 0x1081804) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendfile(r0, r0, 0x0, 0x200000d) ioctl$LOOP_CLR_FD(r0, 0x4c01) syz_genetlink_get_family_id$tipc(0x0) dup3(r1, r0, 0x0) 12:14:27 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) 12:14:27 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) 12:14:27 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) 12:14:27 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) ** 107 printk messages dropped ** [ 1088.036951] [] ? lockdep_sys_exit_thunk+0x12/0x14 ** 50 printk messages dropped ** [ 1088.116344] [] ? SyS_read+0x1c0/0x1c0 [ 1088.116354] [] ? lockdep_sys_exit_thunk+0x12/0x14 [ 1088.116363] [] entry_SYSCALL_64_fastpath+0x1e/0x9a [ 1088.116366] Mem-Info: [ 1088.116392] active_anon:70065 inactive_anon:5877 isolated_anon:0 [ 1088.116392] active_file:11182 inactive_file:11777 isolated_file:0 [ 1088.116392] unevictable:0 dirty:47 writeback:0 unstable:0 [ 1088.116392] slab_reclaimable:4393 slab_unreclaimable:62963 [ 1088.116392] mapped:59031 shmem:8334 pagetables:8548 bounce:0 [ 1088.116392] free:1408184 free_pcp:320 free_cma:0 [ 1088.116426] DMA32 free:2577416kB min:4696kB low:5868kB high:7044kB active_anon:127568kB inactive_anon:10696kB active_file:19752kB inactive_file:20788kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:3145324kB managed:3021976kB mlocked:0kB dirty:8kB writeback:0kB mapped:108040kB shmem:14724kB slab_reclaimable:8340kB slab_unreclaimable:113656kB kernel_stack:6464kB pagetables:15348kB unstable:0kB bounce:0kB free_pcp:576kB local_pcp:392kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no [ 1088.116443] lowmem_reserve[]: 0 3504 3504 [ 1088.116479] Normal free:3055320kB min:5580kB low:6972kB high:8368kB active_anon:152692kB inactive_anon:12812kB active_file:24976kB inactive_file:26320kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:4718592kB managed:3588764kB mlocked:0kB dirty:180kB writeback:0kB mapped:128084kB shmem:18612kB slab_reclaimable:9232kB slab_unreclaimable:138196kB kernel_stack:7936kB pagetables:18844kB unstable:0kB bounce:0kB free_pcp:704kB local_pcp:456kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no [ 1088.116488] lowmem_reserve[]: 0 0 0 [ 1088.116545] DMA32: 158*4kB (UME) 324*8kB (UME) 331*16kB (UME) 195*32kB (UME) 80*64kB (UME) 26*128kB (UME) 11*256kB (UM) 5*512kB (M) 1*1024kB (E) 2*2048kB (UE) 621*4096kB (M) = 2577320kB [ 1088.116602] Normal: 258*4kB (UM) 270*8kB (UME) 306*16kB (UME) 246*32kB (UM) 89*64kB (UME) 33*128kB (UME) 10*256kB (UM) 8*512kB (UME) 4*1024kB (M) 4*2048kB (UME) 735*4096kB (M) = 3055384kB [ 1088.116605] 31292 total pagecache pages [ 1088.116608] 0 pages in swap cache [ 1088.116614] Swap cache stats: add 0, delete 0, find 0/0 [ 1088.116617] Free swap = 0kB [ 1088.116619] Total swap = 0kB [ 1088.116622] 1965979 pages RAM [ 1088.116624] 0 pages HighMem/MovableOnly [ 1088.116627] 313294 pages reserved [ 1088.196272] binder: 17800:17803 transaction failed 29189/-22, size 0-0 line 3014 [ 1088.196458] binder: undelivered TRANSACTION_ERROR: 29189 [ 1088.214307] vmalloc: allocation failure: 0 bytes 12:14:27 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x6, 0x1100082) r1 = memfd_create(&(0x7f0000000080)='t\bnu\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00', 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000340)=[{&(0x7f0000001140)='\'', 0x1}], 0x1, 0x1081804) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendfile(r0, r0, 0x0, 0x200000d) ioctl$LOOP_CLR_FD(r0, 0x4c01) syz_genetlink_get_family_id$tipc(0x0) dup3(r1, r0, 0x0) 12:14:27 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) 12:14:27 executing program 0: openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)={'vet\x00\x00\x96T\x00\x00\x00\x00\x00\xbdh \x00', 0x402}) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000180)={'vd\x7f\x00\x16\x00\xf9V\xdbZ\xdd\x91\x80\xd2{\x00', 0x43732e5398417f1e}) close(r0) 12:14:27 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) 12:14:27 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) 12:14:27 executing program 2: openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r0 = creat(&(0x7f0000000700)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x40000006100) ftruncate(r0, 0x208203) r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000008000/0x600000)=nil, 0x600000, 0x800002, 0x11, r1, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r2, &(0x7f0000000180)={0xa, 0x4e24, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) sendmmsg(r2, &(0x7f00000092c0), 0x4ff, 0x0) r3 = open(&(0x7f00000003c0)='./bus\x00', 0x0, 0x0) sendfile(r0, r3, 0x0, 0x8000fffffffe) r4 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r4, 0x1000008912, &(0x7f0000000000)="11dca5055e0acfec7be070") 12:14:27 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) 12:14:27 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) 12:14:27 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) [ 1088.214314] syz-executor.4: page allocation failure: order:0, mode:0x24000c2 [ 1088.214325] CPU: 0 PID: 17805 Comm: syz-executor.4 Not tainted 4.4.174+ #4 [ 1088.214339] 0000000000000000 8222551dad790ea3 ffff8801b8cd79f0 ffffffff81aad1a1 ** 26 printk messages dropped ** [ 1088.214593] [] ? SyS_read+0x1c0/0x1c0 12:14:28 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) 12:14:28 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) [ 1088.214603] [] ? lockdep_sys_exit_thunk+0x12/0x14 12:14:28 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x6, 0x1100082) r1 = memfd_create(&(0x7f0000000080)='t\bnu\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00', 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000340)=[{&(0x7f0000001140)='\'', 0x1}], 0x1, 0x1081804) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendfile(r0, r0, 0x0, 0x200000d) ioctl$LOOP_CLR_FD(r0, 0x4c01) syz_genetlink_get_family_id$tipc(0x0) dup3(r1, r0, 0x0) 12:14:28 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) 12:14:28 executing program 0: openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)={'vet\x00\x00\x96T\x00\x00\x00\x00\x00\xbdh \x00', 0x402}) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000180)={'vd\x7f\x00\x16\x00\xf9V\xdbZ\xdd\x91\x80\xd2{\x00', 0x43732e5398417f1e}) close(r0) 12:14:28 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) [ 1088.214612] [] entry_SYSCALL_64_fastpath+0x1e/0x9a 12:14:28 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) ** 2 printk messages dropped ** [ 1088.214679] DMA32 free:2577400kB min:4696kB low:5868kB high:7044kB active_anon:127568kB inactive_anon:11396kB active_file:19752kB inactive_file:20788kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:3145324kB managed:3021976kB mlocked:0kB dirty:8kB writeback:0kB mapped:107892kB shmem:15464kB slab_reclaimable:8340kB slab_unreclaimable:113248kB kernel_stack:6464kB pagetables:15200kB unstable:0kB bounce:0kB free_pcp:1080kB local_pcp:340kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no 12:14:28 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) [ 1088.214691] lowmem_reserve[]: 0 3504 3504 [ 1088.214727] Normal free:3054848kB min:5580kB low:6972kB high:8368kB active_anon:152692kB inactive_anon:13312kB active_file:24976kB inactive_file:26320kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:4718592kB managed:3588764kB mlocked:0kB dirty:180kB writeback:0kB mapped:128232kB shmem:19056kB slab_reclaimable:9232kB slab_unreclaimable:138196kB kernel_stack:7936kB pagetables:18696kB unstable:0kB bounce:0kB free_pcp:940kB local_pcp:520kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no [ 1088.214737] lowmem_reserve[]: 0 0 0 [ 1088.214797] DMA32: 158*4kB (UME) 262*8kB (UME) 331*16kB (UME) 216*32kB (UME) 80*64kB (UME) 26*128kB (UME) 11*256kB (UM) 5*512kB (M) 1*1024kB (E) 2*2048kB (UE) 621*4096kB (M) = 2577496kB [ 1088.214846] Normal: 134*4kB (UM) 277*8kB (UME) 307*16kB (UME) 239*32kB (UM) 89*64kB (UME) 34*128kB (UME) 10*256kB (UM) 8*512kB (UME) 4*1024kB (M) 4*2048kB (UME) 735*4096kB (M) = 3054864kB [ 1088.214849] 31588 total pagecache pages [ 1088.214852] 0 pages in swap cache [ 1088.214857] Swap cache stats: add 0, delete 0, find 0/0 [ 1088.214859] Free swap = 0kB [ 1088.214861] Total swap = 0kB [ 1088.214864] 1965979 pages RAM [ 1088.214867] 0 pages HighMem/MovableOnly [ 1088.214870] 313294 pages reserved [ 1088.835914] vmalloc: allocation failure: 0 bytes [ 1088.835920] syz-executor.4: page allocation failure: order:0, mode:0x24000c2 [ 1088.835930] CPU: 1 PID: 17817 Comm: syz-executor.4 Not tainted 4.4.174+ #4 [ 1088.835942] 0000000000000000 8148badd87f47c24 ffff8801d013f9f0 ffffffff81aad1a1 [ 1088.835952] 1ffff1003a027f41 ffff8801d4288000 00000000024000c2 0000000000000000 [ 1088.835964] ffffffff82895080 ffff8801d013fb00 ffffffff8148c0cb ffffffff00000001 [ 1088.835966] Call Trace: [ 1088.835982] [] dump_stack+0xc1/0x120 12:14:28 executing program 2: openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r0 = creat(&(0x7f0000000700)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x40000006100) ftruncate(r0, 0x208203) r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000008000/0x600000)=nil, 0x600000, 0x800002, 0x11, r1, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r2, &(0x7f0000000180)={0xa, 0x4e24, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) sendmmsg(r2, &(0x7f00000092c0), 0x4ff, 0x0) r3 = open(&(0x7f00000003c0)='./bus\x00', 0x0, 0x0) sendfile(r0, r3, 0x0, 0x8000fffffffe) r4 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r4, 0x1000008912, &(0x7f0000000000)="11dca5055e0acfec7be070") 12:14:28 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x6, 0x1100082) r1 = memfd_create(&(0x7f0000000080)='t\bnu\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00', 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000340)=[{&(0x7f0000001140)='\'', 0x1}], 0x1, 0x1081804) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendfile(r0, r0, 0x0, 0x200000d) ioctl$LOOP_CLR_FD(r0, 0x4c01) syz_genetlink_get_family_id$tipc(0x0) dup3(r1, r0, 0x0) 12:14:28 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) 12:14:28 executing program 0: openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)={'vet\x00\x00\x96T\x00\x00\x00\x00\x00\xbdh \x00', 0x402}) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000180)={'vd\x7f\x00\x16\x00\xf9V\xdbZ\xdd\x91\x80\xd2{\x00', 0x43732e5398417f1e}) close(r0) 12:14:28 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) 12:14:28 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) [ 1088.835996] [] warn_alloc_failed.cold+0x78/0x99 [ 1088.836007] [] ? zone_watermark_ok_safe+0x290/0x290 [ 1088.836017] [] ? sel_write_load+0x9e/0xf90 [ 1088.836028] [] __vmalloc_node_range+0x365/0x650 12:14:28 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) 12:14:28 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) 12:14:28 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) [ 1088.836039] [] ? check_preemption_disabled+0x3c/0x200 [ 1088.836048] [] ? check_preemption_disabled+0x3c/0x200 12:14:28 executing program 0: openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)={'vet\x00\x00\x96T\x00\x00\x00\x00\x00\xbdh \x00', 0x402}) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000180)={'vd\x7f\x00\x16\x00\xf9V\xdbZ\xdd\x91\x80\xd2{\x00', 0x43732e5398417f1e}) close(r0) [ 1088.836058] [] ? task_has_security+0x130/0x270 12:14:28 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) 12:14:28 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) [ 1088.836066] [] vmalloc+0x5c/0x70 [ 1088.836074] [] ? sel_write_load+0x119/0xf90 [ 1088.836081] [] sel_write_load+0x119/0xf90 [ 1088.836089] [] ? sel_read_bool+0x240/0x240 [ 1088.836100] [] ? trace_hardirqs_on+0x10/0x10 [ 1088.836110] [] __vfs_write+0x116/0x3d0 [ 1088.836118] [] ? sel_read_bool+0x240/0x240 [ 1088.836127] [] ? __vfs_read+0x3c0/0x3c0 [ 1088.836135] [] ? check_preemption_disabled+0x3c/0x200 [ 1088.836143] [] ? check_preemption_disabled+0x3c/0x200 [ 1088.836154] [] ? rcu_read_lock_sched_held+0x10b/0x130 [ 1088.836164] [] ? rcu_sync_lockdep_assert+0x73/0xb0 [ 1088.836173] [] ? __sb_start_write+0x14f/0x310 [ 1088.836180] [] vfs_write+0x182/0x4e0 [ 1088.836188] [] SyS_write+0xdc/0x1c0 [ 1088.836195] [] ? SyS_read+0x1c0/0x1c0 [ 1088.836204] [] ? lockdep_sys_exit_thunk+0x12/0x14 [ 1088.836213] [] entry_SYSCALL_64_fastpath+0x1e/0x9a [ 1088.836216] Mem-Info: [ 1088.836241] active_anon:70018 inactive_anon:5695 isolated_anon:0 [ 1088.836241] active_file:11182 inactive_file:11777 isolated_file:0 [ 1088.836241] unevictable:0 dirty:48 writeback:0 unstable:0 [ 1088.836241] slab_reclaimable:4393 slab_unreclaimable:63265 [ 1088.836241] mapped:58964 shmem:8152 pagetables:8501 bounce:0 [ 1088.836241] free:1408110 free_pcp:464 free_cma:0 [ 1088.836280] DMA32 free:2577756kB min:4696kB low:5868kB high:7044kB active_anon:127488kB inactive_anon:10224kB active_file:19752kB inactive_file:20788kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:3145324kB managed:3021976kB mlocked:0kB dirty:8kB writeback:0kB mapped:107828kB shmem:14320kB slab_reclaimable:8340kB slab_unreclaimable:114144kB kernel_stack:6368kB pagetables:15144kB unstable:0kB bounce:0kB free_pcp:1048kB local_pcp:372kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no [ 1088.836291] lowmem_reserve[]: 0 3504 3504 [ 1088.836329] Normal free:3054684kB min:5580kB low:6972kB high:8368kB active_anon:152584kB inactive_anon:12556kB active_file:24976kB inactive_file:26320kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:4718592kB managed:3588764kB mlocked:0kB dirty:184kB writeback:0kB mapped:128028kB shmem:18288kB slab_reclaimable:9232kB slab_unreclaimable:138916kB kernel_stack:7968kB pagetables:18860kB unstable:0kB bounce:0kB free_pcp:808kB local_pcp:116kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no [ 1088.836337] lowmem_reserve[]: 0 0 0 [ 1088.836401] DMA32: 323*4kB (UME) 256*8kB (UME) 331*16kB (UME) 203*32kB (UME) 80*64kB (UME) 26*128kB (UME) 11*256kB (UM) 5*512kB (M) 1*1024kB (E) 2*2048kB (UE) 621*4096kB (M) = 2577692kB [ 1088.836474] Normal: 115*4kB (M) 298*8kB (UME) 306*16kB (UME) 236*32kB (UM) 89*64kB (UME) 33*128kB (UME) 10*256kB (UM) 8*512kB (UME) 4*1024kB (M) 4*2048kB (UME) 735*4096kB (M) = 3054716kB [ 1088.836477] 31110 total pagecache pages [ 1088.836480] 0 pages in swap cache [ 1088.836486] Swap cache stats: add 0, delete 0, find 0/0 [ 1088.836490] Free swap = 0kB [ 1088.836492] Total swap = 0kB [ 1088.836495] 1965979 pages RAM [ 1088.836498] 0 pages HighMem/MovableOnly [ 1088.836500] 313294 pages reserved [ 1088.841520] binder: 17814:17819 transaction failed 29189/-22, size 0-0 line 3014 [ 1088.841684] binder: undelivered TRANSACTION_ERROR: 29189 [ 1088.960408] vmalloc: allocation failure: 0 bytes [ 1088.960421] syz-executor.4: page allocation failure: order:0, mode:0x24000c2 [ 1088.960644] CPU: 0 PID: 17831 Comm: syz-executor.4 Not tainted 4.4.174+ #4 [ 1088.960657] 0000000000000000 2efa6b36493e2d56 ffff8800b5f679f0 ffffffff81aad1a1 [ 1088.960668] 1ffff10016becf41 ffff8801be49df00 00000000024000c2 0000000000000000 [ 1088.960681] ffffffff82895080 ffff8800b5f67b00 ffffffff8148c0cb ffffffff00000001 [ 1088.960683] Call Trace: [ 1088.960700] [] dump_stack+0xc1/0x120 [ 1088.960713] [] warn_alloc_failed.cold+0x78/0x99 [ 1088.960724] [] ? zone_watermark_ok_safe+0x290/0x290 [ 1088.960734] [] ? sel_write_load+0x9e/0xf90 [ 1088.960743] [] __vmalloc_node_range+0x365/0x650 [ 1088.960752] [] ? check_preemption_disabled+0x3c/0x200 [ 1088.960760] [] ? check_preemption_disabled+0x3c/0x200 [ 1088.960768] [] ? task_has_security+0x130/0x270 [ 1088.960776] [] vmalloc+0x5c/0x70 [ 1088.960786] [] ? sel_write_load+0x119/0xf90 [ 1088.960795] [] sel_write_load+0x119/0xf90 12:14:29 executing program 2: openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r0 = creat(&(0x7f0000000700)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x40000006100) ftruncate(r0, 0x208203) r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000008000/0x600000)=nil, 0x600000, 0x800002, 0x11, r1, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r2, &(0x7f0000000180)={0xa, 0x4e24, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) sendmmsg(r2, &(0x7f00000092c0), 0x4ff, 0x0) r3 = open(&(0x7f00000003c0)='./bus\x00', 0x0, 0x0) sendfile(r0, r3, 0x0, 0x8000fffffffe) r4 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r4, 0x1000008912, &(0x7f0000000000)="11dca5055e0acfec7be070") 12:14:29 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x6, 0x1100082) r1 = memfd_create(&(0x7f0000000080)='t\bnu\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00', 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000340)=[{&(0x7f0000001140)='\'', 0x1}], 0x1, 0x1081804) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendfile(r0, r0, 0x0, 0x200000d) ioctl$LOOP_CLR_FD(r0, 0x4c01) syz_genetlink_get_family_id$tipc(0x0) dup3(r1, r0, 0x0) 12:14:29 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) 12:14:29 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) 12:14:29 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) 12:14:29 executing program 0: openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)={'vet\x00\x00\x96T\x00\x00\x00\x00\x00\xbdh \x00', 0x402}) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000180)={'vd\x7f\x00\x16\x00\xf9V\xdbZ\xdd\x91\x80\xd2{\x00', 0x43732e5398417f1e}) close(r0) [ 1088.960804] [] ? sel_read_bool+0x240/0x240 [ 1088.960814] [] ? trace_hardirqs_on+0x10/0x10 [ 1088.960824] [] __vfs_write+0x116/0x3d0 [ 1088.960833] [] ? sel_read_bool+0x240/0x240 [ 1088.960841] [] ? __vfs_read+0x3c0/0x3c0 12:14:29 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) 12:14:29 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) 12:14:29 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) [ 1088.960851] [] ? check_preemption_disabled+0x3c/0x200 [ 1088.960859] [] ? check_preemption_disabled+0x3c/0x200 [ 1088.960868] [] ? rcu_read_lock_sched_held+0x10b/0x130 [ 1088.960876] [] ? rcu_sync_lockdep_assert+0x73/0xb0 [ 1088.960885] [] ? __sb_start_write+0x14f/0x310 12:14:29 executing program 0: openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)={'vet\x00\x00\x96T\x00\x00\x00\x00\x00\xbdh \x00', 0x402}) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000180)={'vd\x7f\x00\x16\x00\xf9V\xdbZ\xdd\x91\x80\xd2{\x00', 0x43732e5398417f1e}) close(r0) 12:14:29 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x6, 0x1100082) r1 = memfd_create(&(0x7f0000000080)='t\bnu\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00', 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000340)=[{&(0x7f0000001140)='\'', 0x1}], 0x1, 0x1081804) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendfile(r0, r0, 0x0, 0x200000d) ioctl$LOOP_CLR_FD(r0, 0x4c01) syz_genetlink_get_family_id$tipc(0x0) dup3(r1, r0, 0x0) 12:14:29 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) [ 1088.960893] [] vfs_write+0x182/0x4e0 [ 1088.960901] [] SyS_write+0xdc/0x1c0 [ 1088.960908] [] ? SyS_read+0x1c0/0x1c0 [ 1088.960919] [] ? lockdep_sys_exit_thunk+0x12/0x14 [ 1088.960928] [] entry_SYSCALL_64_fastpath+0x1e/0x9a [ 1088.960931] Mem-Info: [ 1088.960964] active_anon:70093 inactive_anon:5870 isolated_anon:0 [ 1088.960964] active_file:11182 inactive_file:11777 isolated_file:0 [ 1088.960964] unevictable:0 dirty:48 writeback:0 unstable:0 [ 1088.960964] slab_reclaimable:4393 slab_unreclaimable:63061 [ 1088.960964] mapped:59001 shmem:8374 pagetables:8538 bounce:0 [ 1088.960964] free:1408232 free_pcp:275 free_cma:0 [ 1088.960998] DMA32 free:2577444kB min:4696kB low:5868kB high:7044kB active_anon:127588kB inactive_anon:10924kB active_file:19752kB inactive_file:20788kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:3145324kB managed:3021976kB mlocked:0kB dirty:8kB writeback:0kB mapped:107976kB shmem:15060kB slab_reclaimable:8340kB slab_unreclaimable:114044kB kernel_stack:6368kB pagetables:15292kB unstable:0kB bounce:0kB free_pcp:424kB local_pcp:140kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no [ 1088.961008] lowmem_reserve[]: 0 3504 3504 [ 1088.961041] Normal free:3055484kB min:5580kB low:6972kB high:8368kB active_anon:152784kB inactive_anon:12556kB active_file:24976kB inactive_file:26320kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:4718592kB managed:3588764kB mlocked:0kB dirty:184kB writeback:0kB mapped:128028kB shmem:18436kB slab_reclaimable:9232kB slab_unreclaimable:138200kB kernel_stack:7968kB pagetables:18860kB unstable:0kB bounce:0kB free_pcp:676kB local_pcp:124kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no [ 1088.961049] lowmem_reserve[]: 0 0 0 [ 1088.961104] DMA32: 239*4kB (UME) 267*8kB (UME) 331*16kB (UME) 204*32kB (UME) 80*64kB (UME) 26*128kB (UME) 11*256kB (UM) 5*512kB (M) 1*1024kB (E) 2*2048kB (UE) 621*4096kB (M) = 2577476kB [ 1088.961252] Normal: 167*4kB (UM) 350*8kB (UME) 307*16kB (UME) 236*32kB (UM) 89*64kB (UME) 34*128kB (UME) 10*256kB (UM) 8*512kB (UME) 4*1024kB (M) 4*2048kB (UME) 735*4096kB (M) = 3055484kB [ 1088.961255] 31332 total pagecache pages [ 1088.961259] 0 pages in swap cache [ 1088.961265] Swap cache stats: add 0, delete 0, find 0/0 [ 1088.961267] Free swap = 0kB [ 1088.961270] Total swap = 0kB [ 1088.961273] 1965979 pages RAM [ 1088.961276] 0 pages HighMem/MovableOnly [ 1088.961279] 313294 pages reserved [ 1088.998958] binder: 17827:17836 transaction failed 29189/-22, size 0-0 line 3014 [ 1088.999146] binder: undelivered TRANSACTION_ERROR: 29189 [ 1089.083435] binder: 17846:17849 transaction failed 29189/-22, size 0-0 line 3014 [ 1089.083579] binder: undelivered TRANSACTION_ERROR: 29189 [ 1089.656500] binder: 17855:17869 transaction failed 29189/-22, size 0-0 line 3014 [ 1089.656652] binder: undelivered TRANSACTION_ERROR: 29189 [ 1089.658519] vmalloc: allocation failure: 0 bytes [ 1089.658525] syz-executor.4: page allocation failure: order:0, mode:0x24000c2 [ 1089.658535] CPU: 0 PID: 17868 Comm: syz-executor.4 Not tainted 4.4.174+ #4 [ 1089.658548] 0000000000000000 09d753e8057dc119 ffff8800b67079f0 ffffffff81aad1a1 [ 1089.658558] 1ffff10016ce0f41 ffff8801c01e5f00 00000000024000c2 0000000000000000 [ 1089.658570] ffffffff82895080 ffff8800b6707b00 ffffffff8148c0cb ffffffff00000001 [ 1089.658572] Call Trace: [ 1089.658586] [] dump_stack+0xc1/0x120 [ 1089.658599] [] warn_alloc_failed.cold+0x78/0x99 [ 1089.658611] [] ? zone_watermark_ok_safe+0x290/0x290 [ 1089.658622] [] ? sel_write_load+0x9e/0xf90 [ 1089.658634] [] __vmalloc_node_range+0x365/0x650 [ 1089.658645] [] ? check_preemption_disabled+0x3c/0x200 [ 1089.658654] [] ? check_preemption_disabled+0x3c/0x200 [ 1089.658664] [] ? task_has_security+0x130/0x270 [ 1089.658672] [] vmalloc+0x5c/0x70 [ 1089.658679] [] ? sel_write_load+0x119/0xf90 [ 1089.658686] [] sel_write_load+0x119/0xf90 [ 1089.658694] [] ? sel_read_bool+0x240/0x240 [ 1089.658703] [] ? trace_hardirqs_on+0x10/0x10 [ 1089.658711] [] __vfs_write+0x116/0x3d0 12:14:30 executing program 2: openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r0 = creat(&(0x7f0000000700)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x40000006100) ftruncate(r0, 0x208203) r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000008000/0x600000)=nil, 0x600000, 0x800002, 0x11, r1, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r2, &(0x7f0000000180)={0xa, 0x4e24, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) sendmmsg(r2, &(0x7f00000092c0), 0x4ff, 0x0) r3 = open(&(0x7f00000003c0)='./bus\x00', 0x0, 0x0) sendfile(r0, r3, 0x0, 0x8000fffffffe) r4 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r4, 0x1000008912, &(0x7f0000000000)="11dca5055e0acfec7be070") 12:14:30 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) 12:14:30 executing program 0: openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)={'vet\x00\x00\x96T\x00\x00\x00\x00\x00\xbdh \x00', 0x402}) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000180)={'vd\x7f\x00\x16\x00\xf9V\xdbZ\xdd\x91\x80\xd2{\x00', 0x43732e5398417f1e}) close(r0) 12:14:30 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) 12:14:30 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x6, 0x1100082) r1 = memfd_create(&(0x7f0000000080)='t\bnu\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00', 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000340)=[{&(0x7f0000001140)='\'', 0x1}], 0x1, 0x1081804) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendfile(r0, r0, 0x0, 0x200000d) ioctl$LOOP_CLR_FD(r0, 0x4c01) syz_genetlink_get_family_id$tipc(0x0) dup3(r1, r0, 0x0) 12:14:30 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) [ 1089.658718] [] ? sel_read_bool+0x240/0x240 [ 1089.658727] [] ? __vfs_read+0x3c0/0x3c0 [ 1089.658735] [] ? check_preemption_disabled+0x3c/0x200 [ 1089.658743] [] ? check_preemption_disabled+0x3c/0x200 [ 1089.658755] [] ? rcu_read_lock_sched_held+0x10b/0x130 12:14:30 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) 12:14:30 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) 12:14:30 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) [ 1089.658765] [] ? rcu_sync_lockdep_assert+0x73/0xb0 12:14:30 executing program 0: openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)={'vet\x00\x00\x96T\x00\x00\x00\x00\x00\xbdh \x00', 0x402}) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000180)={'vd\x7f\x00\x16\x00\xf9V\xdbZ\xdd\x91\x80\xd2{\x00', 0x43732e5398417f1e}) close(r0) 12:14:30 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) 12:14:30 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) [ 1089.658775] [] ? __sb_start_write+0x14f/0x310 [ 1089.658784] [] vfs_write+0x182/0x4e0 ** 7 printk messages dropped ** [ 1089.678222] lowmem_reserve[]: 0 3504 3504 [ 1089.678263] Normal free:3055316kB min:5580kB low:6972kB high:8368kB active_anon:152684kB inactive_anon:12572kB active_file:24976kB inactive_file:26320kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:4718592kB managed:3588764kB mlocked:0kB dirty:184kB writeback:0kB mapped:128028kB shmem:18288kB slab_reclaimable:9232kB slab_unreclaimable:138356kB kernel_stack:7840kB pagetables:18780kB unstable:0kB bounce:0kB free_pcp:904kB local_pcp:604kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no [ 1089.678272] lowmem_reserve[]: 0 0 0 [ 1089.678325] DMA32: 52*4kB (UME) 259*8kB (UME) 330*16kB (UME) 212*32kB (UME) 81*64kB (UME) 24*128kB (UME) 12*256kB (UM) 5*512kB (M) 1*1024kB (E) 2*2048kB (UE) 621*4096kB (M) = 2576968kB [ 1089.678376] Normal: 147*4kB (UM) 335*8kB (UME) 307*16kB (UME) 236*32kB (UM) 89*64kB (UME) 34*128kB (UME) 10*256kB (UM) 8*512kB (UME) 4*1024kB (M) 4*2048kB (UME) 735*4096kB (M) = 3055284kB [ 1089.678385] 31110 total pagecache pages [ 1089.691032] 0 pages in swap cache [ 1089.691039] Swap cache stats: add 0, delete 0, find 0/0 [ 1089.691042] Free swap = 0kB [ 1089.691045] Total swap = 0kB [ 1089.691049] 1965979 pages RAM [ 1089.691052] 0 pages HighMem/MovableOnly [ 1089.691055] 313294 pages reserved [ 1089.746288] binder: 17874:17881 transaction failed 29189/-22, size 0-0 line 3014 [ 1089.746467] binder: undelivered TRANSACTION_ERROR: 29189 [ 1089.766626] vmalloc: allocation failure: 0 bytes [ 1089.766632] syz-executor.4: page allocation failure: order:0, mode:0x24000c2 [ 1089.766643] CPU: 1 PID: 17886 Comm: syz-executor.4 Not tainted 4.4.174+ #4 [ 1089.766656] 0000000000000000 304ad3487b04e0aa ffff88009fbf79f0 ffffffff81aad1a1 [ 1089.766668] 1ffff10013f7ef41 ffff8801c0678000 00000000024000c2 0000000000000000 [ 1089.766680] ffffffff82895080 ffff88009fbf7b00 ffffffff8148c0cb ffffffff00000001 [ 1089.766682] Call Trace: [ 1089.766698] [] dump_stack+0xc1/0x120 [ 1089.766709] [] warn_alloc_failed.cold+0x78/0x99 [ 1089.766719] [] ? zone_watermark_ok_safe+0x290/0x290 [ 1089.766729] [] ? sel_write_load+0x9e/0xf90 [ 1089.766738] [] __vmalloc_node_range+0x365/0x650 [ 1089.766747] [] ? check_preemption_disabled+0x3c/0x200 [ 1089.766755] [] ? check_preemption_disabled+0x3c/0x200 [ 1089.766764] [] ? task_has_security+0x130/0x270 [ 1089.766771] [] vmalloc+0x5c/0x70 [ 1089.766779] [] ? sel_write_load+0x119/0xf90 [ 1089.766787] [] sel_write_load+0x119/0xf90 [ 1089.766795] [] ? sel_read_bool+0x240/0x240 [ 1089.766805] [] ? trace_hardirqs_on+0x10/0x10 [ 1089.766813] [] __vfs_write+0x116/0x3d0 [ 1089.766821] [] ? sel_read_bool+0x240/0x240 [ 1089.766829] [] ? __vfs_read+0x3c0/0x3c0 [ 1089.766837] [] ? check_preemption_disabled+0x3c/0x200 [ 1089.766845] [] ? check_preemption_disabled+0x3c/0x200 [ 1089.766855] [] ? rcu_read_lock_sched_held+0x10b/0x130 [ 1089.766864] [] ? rcu_sync_lockdep_assert+0x73/0xb0 [ 1089.766873] [] ? __sb_start_write+0x14f/0x310 [ 1089.766881] [] vfs_write+0x182/0x4e0 [ 1089.766889] [] SyS_write+0xdc/0x1c0 [ 1089.766897] [] ? SyS_read+0x1c0/0x1c0 [ 1089.766929] [] ? lockdep_sys_exit_thunk+0x12/0x14 [ 1089.766943] [] entry_SYSCALL_64_fastpath+0x1e/0x9a [ 1089.766946] Mem-Info: [ 1089.766973] active_anon:70125 inactive_anon:6175 isolated_anon:0 [ 1089.766973] active_file:11182 inactive_file:11777 isolated_file:0 12:14:31 executing program 2: openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r0 = creat(&(0x7f0000000700)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x40000006100) ftruncate(r0, 0x208203) r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000008000/0x600000)=nil, 0x600000, 0x800002, 0x11, r1, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r2, &(0x7f0000000180)={0xa, 0x4e24, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) sendmmsg(r2, &(0x7f00000092c0), 0x4ff, 0x0) r3 = open(&(0x7f00000003c0)='./bus\x00', 0x0, 0x0) sendfile(r0, r3, 0x0, 0x8000fffffffe) r4 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r4, 0x1000008912, &(0x7f0000000000)="11dca5055e0acfec7be070") 12:14:31 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x6, 0x1100082) r1 = memfd_create(&(0x7f0000000080)='t\bnu\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00', 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000340)=[{&(0x7f0000001140)='\'', 0x1}], 0x1, 0x1081804) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendfile(r0, r0, 0x0, 0x200000d) ioctl$LOOP_CLR_FD(r0, 0x4c01) syz_genetlink_get_family_id$tipc(0x0) dup3(r1, r0, 0x0) 12:14:31 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) 12:14:31 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) 12:14:31 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) 12:14:31 executing program 0: openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)={'vet\x00\x00\x96T\x00\x00\x00\x00\x00\xbdh \x00', 0x402}) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000180)={'vd\x7f\x00\x16\x00\xf9V\xdbZ\xdd\x91\x80\xd2{\x00', 0x43732e5398417f1e}) close(r0) 12:14:31 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) [ 1089.766973] unevictable:0 dirty:48 writeback:0 unstable:0 [ 1089.766973] slab_reclaimable:4393 slab_unreclaimable:62976 [ 1089.766973] mapped:58964 shmem:8670 pagetables:8552 bounce:0 [ 1089.766973] free:1407741 free_pcp:359 free_cma:0 12:14:31 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) 12:14:31 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) 12:14:31 executing program 0: openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)={'vet\x00\x00\x96T\x00\x00\x00\x00\x00\xbdh \x00', 0x402}) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000180)={'vd\x7f\x00\x16\x00\xf9V\xdbZ\xdd\x91\x80\xd2{\x00', 0x43732e5398417f1e}) close(r0) 12:14:31 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x6, 0x1100082) r1 = memfd_create(&(0x7f0000000080)='t\bnu\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00', 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000340)=[{&(0x7f0000001140)='\'', 0x1}], 0x1, 0x1081804) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendfile(r0, r0, 0x0, 0x200000d) ioctl$LOOP_CLR_FD(r0, 0x4c01) syz_genetlink_get_family_id$tipc(0x0) dup3(r1, r0, 0x0) 12:14:31 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) ** 54 printk messages dropped ** [ 1090.434055] lowmem_reserve[]: 0 3504 3504 ** 48 printk messages dropped ** [ 1090.538383] lowmem_reserve[]: 0 3504 3504 [ 1090.538430] Normal free:3056060kB min:5580kB low:6972kB high:8368kB active_anon:152640kB inactive_anon:12564kB active_file:24976kB inactive_file:26320kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:4718592kB managed:3588764kB mlocked:0kB dirty:184kB writeback:0kB mapped:128032kB shmem:18276kB slab_reclaimable:9232kB slab_unreclaimable:137792kB kernel_stack:7840kB pagetables:18860kB unstable:0kB bounce:0kB free_pcp:724kB local_pcp:516kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no [ 1090.539296] binder_alloc: 17917: binder_alloc_buf, no vma [ 1090.539337] binder: 17917:17919 transaction failed 29189/-3, size 0-0 line 3137 [ 1090.539636] lowmem_reserve[]: 0 0 0 [ 1090.539868] DMA32: 236*4kB (UME) 230*8kB (UME) 331*16kB (UME) 195*32kB (UME) 81*64kB (UME) 25*128kB (UME) 12*256kB (UM) 5*512kB (M) 1*1024kB (E) 2*2048kB (UE) 621*4096kB (M) = 2577072kB [ 1090.539927] Normal: 273*4kB (UM) 372*8kB (UME) 307*16kB (UME) 240*32kB (UM) 89*64kB (UME) 33*128kB (UME) 10*256kB (UM) 8*512kB (UME) 4*1024kB (M) 4*2048kB (UME) 735*4096kB (M) = 3056084kB [ 1090.539930] 31110 total pagecache pages [ 1090.539933] 0 pages in swap cache [ 1090.539948] Swap cache stats: add 0, delete 0, find 0/0 [ 1090.539951] Free swap = 0kB [ 1090.539954] Total swap = 0kB [ 1090.539957] 1965979 pages RAM [ 1090.539960] 0 pages HighMem/MovableOnly [ 1090.539963] 313294 pages reserved [ 1090.543985] binder: undelivered TRANSACTION_ERROR: 29189 [ 1090.628639] vmalloc: allocation failure: 0 bytes [ 1090.628645] syz-executor.4: page allocation failure: order:0, mode:0x24000c2 [ 1090.628656] CPU: 1 PID: 17932 Comm: syz-executor.4 Not tainted 4.4.174+ #4 [ 1090.628669] 0000000000000000 3273013074da769c ffff8800bab1f9f0 ffffffff81aad1a1 [ 1090.628679] 1ffff10017563f41 ffff8801d044df00 00000000024000c2 0000000000000000 [ 1090.628689] ffffffff82895080 ffff8800bab1fb00 ffffffff8148c0cb ffffffff00000001 [ 1090.628692] Call Trace: 12:14:32 executing program 2: openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r0 = creat(&(0x7f0000000700)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x40000006100) ftruncate(r0, 0x208203) r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000008000/0x600000)=nil, 0x600000, 0x800002, 0x11, r1, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r2, &(0x7f0000000180)={0xa, 0x4e24, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) sendmmsg(r2, &(0x7f00000092c0), 0x4ff, 0x0) r3 = open(&(0x7f00000003c0)='./bus\x00', 0x0, 0x0) sendfile(r0, r3, 0x0, 0x8000fffffffe) r4 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r4, 0x1000008912, &(0x7f0000000000)="11dca5055e0acfec7be070") 12:14:32 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) 12:14:32 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) 12:14:32 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) 12:14:32 executing program 0: openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)={'vet\x00\x00\x96T\x00\x00\x00\x00\x00\xbdh \x00', 0x402}) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000180)={'vd\x7f\x00\x16\x00\xf9V\xdbZ\xdd\x91\x80\xd2{\x00', 0x43732e5398417f1e}) close(r0) 12:14:32 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x6, 0x1100082) r1 = memfd_create(&(0x7f0000000080)='t\bnu\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00', 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000340)=[{&(0x7f0000001140)='\'', 0x1}], 0x1, 0x1081804) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendfile(r0, r0, 0x0, 0x200000d) ioctl$LOOP_CLR_FD(r0, 0x4c01) syz_genetlink_get_family_id$tipc(0x0) dup3(r1, r0, 0x0) [ 1090.628705] [] dump_stack+0xc1/0x120 [ 1090.628718] [] warn_alloc_failed.cold+0x78/0x99 [ 1090.628729] [] ? zone_watermark_ok_safe+0x290/0x290 [ 1090.628739] [] ? sel_write_load+0x9e/0xf90 12:14:32 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) 12:14:32 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) 12:14:32 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) ** 25 printk messages dropped ** [ 1090.629095] lowmem_reserve[]: 0 3504 3504 12:14:32 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) 12:14:32 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x6, 0x1100082) r1 = memfd_create(&(0x7f0000000080)='t\bnu\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00', 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000340)=[{&(0x7f0000001140)='\'', 0x1}], 0x1, 0x1081804) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendfile(r0, r0, 0x0, 0x200000d) ioctl$LOOP_CLR_FD(r0, 0x4c01) syz_genetlink_get_family_id$tipc(0x0) dup3(r1, r0, 0x0) 12:14:32 executing program 0: openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)={'vet\x00\x00\x96T\x00\x00\x00\x00\x00\xbdh \x00', 0x402}) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000180)={'vd\x7f\x00\x16\x00\xf9V\xdbZ\xdd\x91\x80\xd2{\x00', 0x43732e5398417f1e}) close(r0) ** 53 printk messages dropped ** [ 1093.821953] [] ? sel_write_load+0x119/0xf90 ** 50 printk messages dropped ** [ 1093.950918] [] ? sel_write_load+0x119/0xf90 [ 1093.950926] [] sel_write_load+0x119/0xf90 [ 1093.950934] [] ? sel_read_bool+0x240/0x240 [ 1093.950954] [] ? trace_hardirqs_on+0x10/0x10 [ 1093.950965] [] __vfs_write+0x116/0x3d0 [ 1093.950974] [] ? sel_read_bool+0x240/0x240 [ 1093.950984] [] ? __vfs_read+0x3c0/0x3c0 [ 1093.950991] [] ? check_preemption_disabled+0x3c/0x200 [ 1093.950998] [] ? check_preemption_disabled+0x3c/0x200 [ 1093.951009] [] ? rcu_read_lock_sched_held+0x10b/0x130 [ 1093.951019] [] ? rcu_sync_lockdep_assert+0x73/0xb0 [ 1093.951028] [] ? __sb_start_write+0x14f/0x310 [ 1093.951037] [] vfs_write+0x182/0x4e0 [ 1093.951046] [] SyS_write+0xdc/0x1c0 [ 1093.951053] [] ? SyS_read+0x1c0/0x1c0 [ 1093.951064] [] ? lockdep_sys_exit_thunk+0x12/0x14 [ 1093.951073] [] entry_SYSCALL_64_fastpath+0x1e/0x9a [ 1093.951132] Mem-Info: [ 1093.951159] active_anon:70101 inactive_anon:6196 isolated_anon:0 [ 1093.951159] active_file:11182 inactive_file:11777 isolated_file:0 [ 1093.951159] unevictable:0 dirty:48 writeback:0 unstable:0 [ 1093.951159] slab_reclaimable:4393 slab_unreclaimable:62949 [ 1093.951159] mapped:58971 shmem:8670 pagetables:8536 bounce:0 [ 1093.951159] free:1407720 free_pcp:442 free_cma:0 [ 1093.951199] DMA32 free:2577832kB min:4696kB low:5868kB high:7044kB active_anon:127520kB inactive_anon:11476kB active_file:19752kB inactive_file:20788kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:3145324kB managed:3021976kB mlocked:0kB dirty:8kB writeback:0kB mapped:107828kB shmem:15420kB slab_reclaimable:8340kB slab_unreclaimable:112100kB kernel_stack:6560kB pagetables:15532kB unstable:0kB bounce:0kB free_pcp:1212kB local_pcp:576kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no [ 1093.951209] lowmem_reserve[]: 0 3504 3504 [ 1093.951242] Normal free:3053048kB min:5580kB low:6972kB high:8368kB active_anon:152884kB inactive_anon:13308kB active_file:24976kB inactive_file:26320kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:4718592kB managed:3588764kB mlocked:0kB dirty:184kB writeback:0kB mapped:128056kB shmem:19260kB slab_reclaimable:9232kB slab_unreclaimable:139696kB kernel_stack:8000kB pagetables:18612kB unstable:0kB bounce:0kB free_pcp:552kB local_pcp:168kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no [ 1093.951251] lowmem_reserve[]: 0 0 0 [ 1093.951310] DMA32: 276*4kB (UME) 234*8kB (UME) 332*16kB (UME) 211*32kB (UME) 83*64kB (UME) 25*128kB (UME) 12*256kB (UM) 5*512kB (M) 1*1024kB (E) 2*2048kB (UE) 621*4096kB (M) = 2577920kB [ 1093.951366] Normal: 45*4kB (U) 216*8kB (UME) 308*16kB (UME) 213*32kB (UM) 90*64kB (UME) 33*128kB (UME) 10*256kB (UM) 8*512kB (UME) 4*1024kB (M) 4*2048kB (UME) 735*4096kB (M) = 3053140kB [ 1093.951369] 31628 total pagecache pages [ 1093.951380] 0 pages in swap cache [ 1093.951385] Swap cache stats: add 0, delete 0, find 0/0 [ 1093.951388] Free swap = 0kB [ 1093.951391] Total swap = 0kB [ 1093.951394] 1965979 pages RAM [ 1093.951398] 0 pages HighMem/MovableOnly [ 1093.951400] 313294 pages reserved [ 1093.962219] binder: 18116:18118 transaction failed 29189/-22, size 0-0 line 3014 [ 1093.962396] binder: undelivered TRANSACTION_ERROR: 29189 [ 1094.032739] vmalloc: allocation failure: 0 bytes [ 1094.032745] syz-executor.4: page allocation failure: order:0, mode:0x24000c2 [ 1094.032755] CPU: 1 PID: 18130 Comm: syz-executor.4 Not tainted 4.4.174+ #4 [ 1094.032767] 0000000000000000 88f70eecb59f5438 ffff8801bfdff9f0 ffffffff81aad1a1 [ 1094.032778] 1ffff10037fbff41 ffff8800b003c740 00000000024000c2 0000000000000000 [ 1094.032789] ffffffff82895080 ffff8801bfdffb00 ffffffff8148c0cb ffffffff00000001 [ 1094.032792] Call Trace: [ 1094.032809] [] dump_stack+0xc1/0x120 [ 1094.032823] [] warn_alloc_failed.cold+0x78/0x99 [ 1094.032835] [] ? zone_watermark_ok_safe+0x290/0x290 [ 1094.032845] [] ? sel_write_load+0x9e/0xf90 [ 1094.032854] [] __vmalloc_node_range+0x365/0x650 [ 1094.032865] [] ? check_preemption_disabled+0x3c/0x200 [ 1094.032874] [] ? check_preemption_disabled+0x3c/0x200 [ 1094.032882] [] ? task_has_security+0x130/0x270 12:14:33 executing program 2: openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r0 = creat(&(0x7f0000000700)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x40000006100) ftruncate(r0, 0x208203) r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000008000/0x600000)=nil, 0x600000, 0x800002, 0x11, r1, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r2, &(0x7f0000000180)={0xa, 0x4e24, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) sendmmsg(r2, &(0x7f00000092c0), 0x4ff, 0x0) r3 = open(&(0x7f00000003c0)='./bus\x00', 0x0, 0x0) sendfile(r0, r3, 0x0, 0x8000fffffffe) r4 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r4, 0x1000008912, &(0x7f0000000000)="11dca5055e0acfec7be070") 12:14:33 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) 12:14:33 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) 12:14:33 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) 12:14:33 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x6, 0x1100082) r1 = memfd_create(&(0x7f0000000080)='t\bnu\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00', 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000340)=[{&(0x7f0000001140)='\'', 0x1}], 0x1, 0x1081804) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendfile(r0, r0, 0x0, 0x200000d) ioctl$LOOP_CLR_FD(r0, 0x4c01) syz_genetlink_get_family_id$tipc(0x0) dup3(r1, r0, 0x0) 12:14:33 executing program 0: openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)={'vet\x00\x00\x96T\x00\x00\x00\x00\x00\xbdh \x00', 0x402}) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000180)={'vd\x7f\x00\x16\x00\xf9V\xdbZ\xdd\x91\x80\xd2{\x00', 0x43732e5398417f1e}) close(r0) [ 1094.032889] [] vmalloc+0x5c/0x70 [ 1094.032897] [] ? sel_write_load+0x119/0xf90 [ 1094.032904] [] sel_write_load+0x119/0xf90 [ 1094.032912] [] ? sel_read_bool+0x240/0x240 [ 1094.032922] [] ? trace_hardirqs_on+0x10/0x10 [ 1094.032930] [] __vfs_write+0x116/0x3d0 [ 1094.032937] [] ? sel_read_bool+0x240/0x240 12:14:33 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) 12:14:33 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) 12:14:33 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) 12:14:33 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) [ 1094.032945] [] ? __vfs_read+0x3c0/0x3c0 [ 1094.032954] [] ? check_preemption_disabled+0x3c/0x200 12:14:33 executing program 0: openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)={'vet\x00\x00\x96T\x00\x00\x00\x00\x00\xbdh \x00', 0x402}) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000180)={'vd\x7f\x00\x16\x00\xf9V\xdbZ\xdd\x91\x80\xd2{\x00', 0x43732e5398417f1e}) close(r0) [ 1094.032963] [] ? check_preemption_disabled+0x3c/0x200 12:14:33 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) [ 1094.032973] [] ? rcu_read_lock_sched_held+0x10b/0x130 [ 1094.032981] [] ? rcu_sync_lockdep_assert+0x73/0xb0 [ 1094.032990] [] ? __sb_start_write+0x14f/0x310 [ 1094.032997] [] vfs_write+0x182/0x4e0 [ 1094.033005] [] SyS_write+0xdc/0x1c0 [ 1094.033013] [] ? SyS_read+0x1c0/0x1c0 [ 1094.033023] [] ? lockdep_sys_exit_thunk+0x12/0x14 [ 1094.033033] [] entry_SYSCALL_64_fastpath+0x1e/0x9a [ 1094.033036] Mem-Info: [ 1094.033062] active_anon:70101 inactive_anon:6196 isolated_anon:0 [ 1094.033062] active_file:11182 inactive_file:11777 isolated_file:0 [ 1094.033062] unevictable:0 dirty:48 writeback:0 unstable:0 [ 1094.033062] slab_reclaimable:4393 slab_unreclaimable:62842 [ 1094.033062] mapped:59008 shmem:8670 pagetables:8536 bounce:0 [ 1094.033062] free:1407936 free_pcp:471 free_cma:0 [ 1094.033099] DMA32 free:2578204kB min:4696kB low:5868kB high:7044kB active_anon:127520kB inactive_anon:11476kB active_file:19752kB inactive_file:20788kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:3145324kB managed:3021976kB mlocked:0kB dirty:8kB writeback:0kB mapped:107976kB shmem:15420kB slab_reclaimable:8340kB slab_unreclaimable:112116kB kernel_stack:6560kB pagetables:15384kB unstable:0kB bounce:0kB free_pcp:1216kB local_pcp:636kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no [ 1094.033109] lowmem_reserve[]: 0 3504 3504 [ 1094.033145] Normal free:3053540kB min:5580kB low:6972kB high:8368kB active_anon:152884kB inactive_anon:13308kB active_file:24976kB inactive_file:26320kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:4718592kB managed:3588764kB mlocked:0kB dirty:184kB writeback:0kB mapped:128056kB shmem:19260kB slab_reclaimable:9232kB slab_unreclaimable:139252kB kernel_stack:8000kB pagetables:18760kB unstable:0kB bounce:0kB free_pcp:668kB local_pcp:280kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no [ 1094.033154] lowmem_reserve[]: 0 0 0 [ 1094.033214] DMA32: 312*4kB (UME) 246*8kB (UME) 333*16kB (UME) 212*32kB (UME) 83*64kB (UME) 25*128kB (UME) 12*256kB (UM) 5*512kB (M) 1*1024kB (E) 2*2048kB (UE) 621*4096kB (M) = 2578208kB [ 1094.033270] Normal: 1*4kB (U) 210*8kB (UME) 309*16kB (UME) 230*32kB (UM) 90*64kB (UME) 34*128kB (UME) 10*256kB (UM) 8*512kB (UME) 4*1024kB (M) 4*2048kB (UME) 735*4096kB (M) = 3053604kB [ 1094.033273] 31628 total pagecache pages [ 1094.033277] 0 pages in swap cache [ 1094.033282] Swap cache stats: add 0, delete 0, find 0/0 [ 1094.033285] Free swap = 0kB [ 1094.033288] Total swap = 0kB [ 1094.033290] 1965979 pages RAM [ 1094.033294] 0 pages HighMem/MovableOnly [ 1094.033296] 313294 pages reserved [ 1094.689100] binder: 18142:18144 transaction failed 29189/-22, size 0-0 line 3014 [ 1094.689265] binder: undelivered TRANSACTION_ERROR: 29189 [ 1094.707966] vmalloc: allocation failure: 0 bytes [ 1094.707972] syz-executor.4: page allocation failure: order:0, mode:0x24000c2 [ 1094.707982] CPU: 0 PID: 18148 Comm: syz-executor.4 Not tainted 4.4.174+ #4 [ 1094.707995] 0000000000000000 cc29f2078d9cef38 ffff8800a1ea79f0 ffffffff81aad1a1 [ 1094.708006] 1ffff100143d4f41 ffff8801c0190000 00000000024000c2 0000000000000000 [ 1094.708017] ffffffff82895080 ffff8800a1ea7b00 ffffffff8148c0cb ffffffff00000001 [ 1094.708019] Call Trace: [ 1094.708032] [] dump_stack+0xc1/0x120 [ 1094.708044] [] warn_alloc_failed.cold+0x78/0x99 [ 1094.708057] [] ? zone_watermark_ok_safe+0x290/0x290 [ 1094.708066] [] ? sel_write_load+0x9e/0xf90 [ 1094.708077] [] __vmalloc_node_range+0x365/0x650 [ 1094.708087] [] ? check_preemption_disabled+0x3c/0x200 [ 1094.708096] [] ? check_preemption_disabled+0x3c/0x200 [ 1094.708106] [] ? task_has_security+0x130/0x270 [ 1094.708115] [] vmalloc+0x5c/0x70 [ 1094.708124] [] ? sel_write_load+0x119/0xf90 [ 1094.708133] [] sel_write_load+0x119/0xf90 12:14:33 executing program 2: openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r0 = creat(&(0x7f0000000700)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x40000006100) ftruncate(r0, 0x208203) r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000008000/0x600000)=nil, 0x600000, 0x800002, 0x11, r1, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r2, &(0x7f0000000180)={0xa, 0x4e24, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) sendmmsg(r2, &(0x7f00000092c0), 0x4ff, 0x0) r3 = open(&(0x7f00000003c0)='./bus\x00', 0x0, 0x0) sendfile(r0, r3, 0x0, 0x8000fffffffe) r4 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r4, 0x1000008912, &(0x7f0000000000)="11dca5055e0acfec7be070") 12:14:33 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x6, 0x1100082) r1 = memfd_create(&(0x7f0000000080)='t\bnu\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00', 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000340)=[{&(0x7f0000001140)='\'', 0x1}], 0x1, 0x1081804) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendfile(r0, r0, 0x0, 0x200000d) ioctl$LOOP_CLR_FD(r0, 0x4c01) syz_genetlink_get_family_id$tipc(0x0) dup3(r1, r0, 0x0) 12:14:33 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) 12:14:33 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) 12:14:33 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) 12:14:33 executing program 0: openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)={'vet\x00\x00\x96T\x00\x00\x00\x00\x00\xbdh \x00', 0x402}) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000180)={'vd\x7f\x00\x16\x00\xf9V\xdbZ\xdd\x91\x80\xd2{\x00', 0x43732e5398417f1e}) close(r0) [ 1094.708143] [] ? sel_read_bool+0x240/0x240 [ 1094.708152] [] ? trace_hardirqs_on+0x10/0x10 [ 1094.708161] [] __vfs_write+0x116/0x3d0 [ 1094.708168] [] ? sel_read_bool+0x240/0x240 [ 1094.708177] [] ? __vfs_read+0x3c0/0x3c0 [ 1094.708186] [] ? check_preemption_disabled+0x3c/0x200 12:14:33 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) 12:14:33 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) 12:14:33 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) [ 1094.708193] [] ? check_preemption_disabled+0x3c/0x200 [ 1094.708202] [] ? rcu_read_lock_sched_held+0x10b/0x130 12:14:34 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) 12:14:34 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) 12:14:34 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) [ 1094.708211] [] ? rcu_sync_lockdep_assert+0x73/0xb0 [ 1094.708219] [] ? __sb_start_write+0x14f/0x310 [ 1094.708226] [] vfs_write+0x182/0x4e0 [ 1094.708233] [] SyS_write+0xdc/0x1c0 [ 1094.708242] [] ? SyS_read+0x1c0/0x1c0 [ 1094.708255] [] ? lockdep_sys_exit_thunk+0x12/0x14 [ 1094.708266] [] entry_SYSCALL_64_fastpath+0x1e/0x9a [ 1094.708269] Mem-Info: [ 1094.708290] active_anon:70030 inactive_anon:5725 isolated_anon:0 [ 1094.708290] active_file:11182 inactive_file:11777 isolated_file:0 [ 1094.708290] unevictable:0 dirty:48 writeback:0 unstable:0 [ 1094.708290] slab_reclaimable:4393 slab_unreclaimable:63041 [ 1094.708290] mapped:58964 shmem:8152 pagetables:8515 bounce:0 [ 1094.708290] free:1408269 free_pcp:614 free_cma:0 [ 1094.708322] DMA32 free:2578128kB min:4696kB low:5868kB high:7044kB active_anon:127508kB inactive_anon:10208kB active_file:19752kB inactive_file:20788kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:3145324kB managed:3021976kB mlocked:0kB dirty:8kB writeback:0kB mapped:107824kB shmem:14304kB slab_reclaimable:8340kB slab_unreclaimable:113132kB kernel_stack:6304kB pagetables:15288kB unstable:0kB bounce:0kB free_pcp:1344kB local_pcp:608kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no [ 1094.708331] lowmem_reserve[]: 0 3504 3504 [ 1094.708367] Normal free:3054948kB min:5580kB low:6972kB high:8368kB active_anon:152612kB inactive_anon:12692kB active_file:24976kB inactive_file:26320kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:4718592kB managed:3588764kB mlocked:0kB dirty:184kB writeback:0kB mapped:128032kB shmem:18304kB slab_reclaimable:9232kB slab_unreclaimable:139032kB kernel_stack:7808kB pagetables:18772kB unstable:0kB bounce:0kB free_pcp:1108kB local_pcp:472kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no [ 1094.708376] lowmem_reserve[]: 0 0 0 [ 1094.708437] DMA32: 444*4kB (UME) 302*8kB (UME) 335*16kB (UME) 181*32kB (UME) 83*64kB (UME) 24*128kB (UME) 12*256kB (UM) 5*512kB (M) 1*1024kB (E) 2*2048kB (UE) 621*4096kB (M) = 2578096kB [ 1094.708500] Normal: 178*4kB (UM) 261*8kB (UME) 309*16kB (UME) 235*32kB (UM) 90*64kB (UME) 34*128kB (UME) 10*256kB (UM) 8*512kB (UME) 4*1024kB (M) 4*2048kB (UME) 735*4096kB (M) = 3054880kB [ 1094.708503] 31110 total pagecache pages [ 1094.708506] 0 pages in swap cache [ 1094.708512] Swap cache stats: add 0, delete 0, find 0/0 [ 1094.708515] Free swap = 0kB [ 1094.708518] Total swap = 0kB [ 1094.708521] 1965979 pages RAM [ 1094.708524] 0 pages HighMem/MovableOnly [ 1094.708526] 313294 pages reserved [ 1094.757278] binder: 18154:18156 transaction failed 29189/-22, size 0-0 line 3014 [ 1094.757452] binder: undelivered TRANSACTION_ERROR: 29189 [ 1094.841293] binder: 18166:18168 transaction failed 29189/-22, size 0-0 line 3014 [ 1094.841460] binder: undelivered TRANSACTION_ERROR: 29189 [ 1094.861507] vmalloc: allocation failure: 0 bytes [ 1094.861514] syz-executor.4: page allocation failure: order:0, mode:0x24000c2 [ 1094.861523] CPU: 1 PID: 18164 Comm: syz-executor.4 Not tainted 4.4.174+ #4 [ 1094.861536] 0000000000000000 1354dc37a6fc827c ffff8800b4cc79f0 ffffffff81aad1a1 [ 1094.861546] 1ffff10016998f41 ffff8800a45f0000 00000000024000c2 0000000000000000 [ 1094.861557] ffffffff82895080 ffff8800b4cc7b00 ffffffff8148c0cb ffffffff00000001 [ 1094.861560] Call Trace: [ 1094.861573] [] dump_stack+0xc1/0x120 [ 1094.861587] [] warn_alloc_failed.cold+0x78/0x99 [ 1094.861598] [] ? zone_watermark_ok_safe+0x290/0x290 [ 1094.861607] [] ? sel_write_load+0x9e/0xf90 [ 1094.861618] [] __vmalloc_node_range+0x365/0x650 [ 1094.861627] [] ? check_preemption_disabled+0x3c/0x200 [ 1094.861634] [] ? check_preemption_disabled+0x3c/0x200 [ 1094.861642] [] ? task_has_security+0x130/0x270 [ 1094.861649] [] vmalloc+0x5c/0x70 [ 1094.861657] [] ? sel_write_load+0x119/0xf90 12:14:34 executing program 2: openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r0 = creat(&(0x7f0000000700)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x40000006100) ftruncate(r0, 0x208203) r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000008000/0x600000)=nil, 0x600000, 0x800002, 0x11, r1, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r2, &(0x7f0000000180)={0xa, 0x4e24, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) sendmmsg(r2, &(0x7f00000092c0), 0x4ff, 0x0) r3 = open(&(0x7f00000003c0)='./bus\x00', 0x0, 0x0) sendfile(r0, r3, 0x0, 0x8000fffffffe) r4 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r4, 0x1000008912, &(0x7f0000000000)="11dca5055e0acfec7be070") 12:14:34 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x6, 0x1100082) r1 = memfd_create(&(0x7f0000000080)='t\bnu\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00', 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000340)=[{&(0x7f0000001140)='\'', 0x1}], 0x1, 0x1081804) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendfile(r0, r0, 0x0, 0x200000d) ioctl$LOOP_CLR_FD(r0, 0x4c01) syz_genetlink_get_family_id$tipc(0x0) dup3(r1, r0, 0x0) 12:14:34 executing program 0: openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)={'vet\x00\x00\x96T\x00\x00\x00\x00\x00\xbdh \x00', 0x402}) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000180)={'vd\x7f\x00\x16\x00\xf9V\xdbZ\xdd\x91\x80\xd2{\x00', 0x43732e5398417f1e}) close(r0) 12:14:34 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) 12:14:34 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) 12:14:34 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) [ 1094.861663] [] sel_write_load+0x119/0xf90 [ 1094.861671] [] ? sel_read_bool+0x240/0x240 [ 1094.861681] [] ? trace_hardirqs_on+0x10/0x10 [ 1094.861689] [] __vfs_write+0x116/0x3d0 12:14:34 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) 12:14:34 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) [ 1094.861696] [] ? sel_read_bool+0x240/0x240 12:14:34 executing program 0: openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)={'vet\x00\x00\x96T\x00\x00\x00\x00\x00\xbdh \x00', 0x402}) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000180)={'vd\x7f\x00\x16\x00\xf9V\xdbZ\xdd\x91\x80\xd2{\x00', 0x43732e5398417f1e}) close(r0) 12:14:34 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) 12:14:34 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) 12:14:34 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x6, 0x1100082) r1 = memfd_create(&(0x7f0000000080)='t\bnu\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00', 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000340)=[{&(0x7f0000001140)='\'', 0x1}], 0x1, 0x1081804) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendfile(r0, r0, 0x0, 0x200000d) ioctl$LOOP_CLR_FD(r0, 0x4c01) syz_genetlink_get_family_id$tipc(0x0) dup3(r1, r0, 0x0) [ 1094.861703] [] ? __vfs_read+0x3c0/0x3c0 [ 1094.861711] [] ? check_preemption_disabled+0x3c/0x200 [ 1094.861718] [] ? check_preemption_disabled+0x3c/0x200 [ 1094.861727] [] ? rcu_read_lock_sched_held+0x10b/0x130 [ 1094.861735] [] ? rcu_sync_lockdep_assert+0x73/0xb0 [ 1094.861743] [] ? __sb_start_write+0x14f/0x310 [ 1094.861751] [] vfs_write+0x182/0x4e0 [ 1094.861758] [] SyS_write+0xdc/0x1c0 [ 1094.861765] [] ? SyS_read+0x1c0/0x1c0 [ 1094.861775] [] ? lockdep_sys_exit_thunk+0x12/0x14 [ 1094.861785] [] entry_SYSCALL_64_fastpath+0x1e/0x9a [ 1094.861788] Mem-Info: [ 1094.861812] active_anon:70105 inactive_anon:6200 isolated_anon:0 [ 1094.861812] active_file:11182 inactive_file:11777 isolated_file:0 [ 1094.861812] unevictable:0 dirty:48 writeback:0 unstable:0 [ 1094.861812] slab_reclaimable:4393 slab_unreclaimable:63015 [ 1094.861812] mapped:59038 shmem:8670 pagetables:8515 bounce:0 [ 1094.861812] free:1407703 free_pcp:552 free_cma:0 [ 1094.861843] DMA32 free:2577416kB min:4696kB low:5868kB high:7044kB active_anon:127708kB inactive_anon:10708kB active_file:19752kB inactive_file:20788kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:3145324kB managed:3021976kB mlocked:0kB dirty:8kB writeback:0kB mapped:107972kB shmem:14896kB slab_reclaimable:8340kB slab_unreclaimable:113028kB kernel_stack:6304kB pagetables:15436kB unstable:0kB bounce:0kB free_pcp:1100kB local_pcp:460kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no [ 1094.861852] lowmem_reserve[]: 0 3504 3504 [ 1094.861881] Normal free:3053396kB min:5580kB low:6972kB high:8368kB active_anon:152712kB inactive_anon:14092kB active_file:24976kB inactive_file:26320kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:4718592kB managed:3588764kB mlocked:0kB dirty:184kB writeback:0kB mapped:128180kB shmem:19784kB slab_reclaimable:9232kB slab_unreclaimable:139032kB kernel_stack:7808kB pagetables:18624kB unstable:0kB bounce:0kB free_pcp:1108kB local_pcp:588kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no [ 1094.861889] lowmem_reserve[]: 0 0 0 [ 1094.861947] DMA32: 258*4kB (UME) 302*8kB (UME) 336*16kB (UME) 179*32kB (UME) 83*64kB (UME) 25*128kB (UME) 12*256kB (UM) 5*512kB (M) 1*1024kB (E) 2*2048kB (UE) 621*4096kB (M) = 2577432kB [ 1094.861999] Normal: 18*4kB (UM) 155*8kB (UME) 309*16kB (UME) 232*32kB (UM) 90*64kB (UME) 34*128kB (UME) 10*256kB (UM) 8*512kB (UME) 4*1024kB (M) 4*2048kB (UME) 735*4096kB (M) = 3053296kB [ 1094.862002] 31628 total pagecache pages [ 1094.862005] 0 pages in swap cache [ 1094.862010] Swap cache stats: add 0, delete 0, find 0/0 [ 1094.862012] Free swap = 0kB [ 1094.862014] Total swap = 0kB [ 1094.862017] 1965979 pages RAM [ 1094.862019] 0 pages HighMem/MovableOnly [ 1094.862021] 313294 pages reserved [ 1095.629309] binder_alloc: 18186: binder_alloc_buf, no vma [ 1095.629356] binder: 18186:18192 transaction failed 29189/-3, size 0-0 line 3137 [ 1095.647532] binder: undelivered TRANSACTION_ERROR: 29189 [ 1095.663289] vmalloc: allocation failure: 0 bytes [ 1095.663295] syz-executor.4: page allocation failure: order:0, mode:0x24000c2 [ 1095.663305] CPU: 1 PID: 18194 Comm: syz-executor.4 Not tainted 4.4.174+ #4 [ 1095.663319] 0000000000000000 4d85d12ab8227a30 ffff8800b47479f0 ffffffff81aad1a1 [ 1095.663332] 1ffff100168e8f41 ffff8801c0a5c740 00000000024000c2 0000000000000000 [ 1095.663343] ffffffff82895080 ffff8800b4747b00 ffffffff8148c0cb ffffffff00000001 [ 1095.663346] Call Trace: [ 1095.663363] [] dump_stack+0xc1/0x120 [ 1095.663376] [] warn_alloc_failed.cold+0x78/0x99 [ 1095.663387] [] ? zone_watermark_ok_safe+0x290/0x290 [ 1095.663396] [] ? sel_write_load+0x9e/0xf90 [ 1095.663404] [] __vmalloc_node_range+0x365/0x650 [ 1095.663412] [] ? check_preemption_disabled+0x3c/0x200 [ 1095.663420] [] ? check_preemption_disabled+0x3c/0x200 [ 1095.663427] [] ? task_has_security+0x130/0x270 [ 1095.663445] [] vmalloc+0x5c/0x70 [ 1095.663456] [] ? sel_write_load+0x119/0xf90 [ 1095.663464] [] sel_write_load+0x119/0xf90 [ 1095.663475] [] ? sel_read_bool+0x240/0x240 [ 1095.663486] [] ? trace_hardirqs_on+0x10/0x10 [ 1095.663496] [] __vfs_write+0x116/0x3d0 [ 1095.663505] [] ? sel_read_bool+0x240/0x240 [ 1095.663514] [] ? __vfs_read+0x3c0/0x3c0 [ 1095.663523] [] ? check_preemption_disabled+0x3c/0x200 [ 1095.663530] [] ? check_preemption_disabled+0x3c/0x200 [ 1095.663540] [] ? rcu_read_lock_sched_held+0x10b/0x130 [ 1095.663548] [] ? rcu_sync_lockdep_assert+0x73/0xb0 [ 1095.663557] [] ? __sb_start_write+0x14f/0x310 [ 1095.663564] [] vfs_write+0x182/0x4e0 [ 1095.663572] [] SyS_write+0xdc/0x1c0 [ 1095.663580] [] ? SyS_read+0x1c0/0x1c0 [ 1095.663590] [] ? lockdep_sys_exit_thunk+0x12/0x14 [ 1095.663600] [] entry_SYSCALL_64_fastpath+0x1e/0x9a [ 1095.663603] Mem-Info: [ 1095.663628] active_anon:70004 inactive_anon:5725 isolated_anon:0 [ 1095.663628] active_file:11182 inactive_file:11777 isolated_file:0 [ 1095.663628] unevictable:0 dirty:48 writeback:0 unstable:0 [ 1095.663628] slab_reclaimable:4393 slab_unreclaimable:62947 [ 1095.663628] mapped:58964 shmem:8152 pagetables:8515 bounce:0 [ 1095.663628] free:1408422 free_pcp:453 free_cma:0 [ 1095.663667] DMA32 free:2578500kB min:4696kB low:5868kB high:7044kB active_anon:127512kB inactive_anon:10276kB active_file:19752kB inactive_file:20788kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:3145324kB managed:3021976kB mlocked:0kB dirty:8kB writeback:0kB mapped:107884kB shmem:14264kB slab_reclaimable:8340kB slab_unreclaimable:113112kB kernel_stack:6304kB pagetables:15152kB unstable:0kB bounce:0kB free_pcp:864kB local_pcp:560kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no [ 1095.663677] lowmem_reserve[]: 0 3504 3504 12:14:35 executing program 2: openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r0 = creat(&(0x7f0000000700)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x40000006100) ftruncate(r0, 0x208203) r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000008000/0x600000)=nil, 0x600000, 0x800002, 0x11, r1, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r2, &(0x7f0000000180)={0xa, 0x4e24, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) sendmmsg(r2, &(0x7f00000092c0), 0x4ff, 0x0) r3 = open(&(0x7f00000003c0)='./bus\x00', 0x0, 0x0) sendfile(r0, r3, 0x0, 0x8000fffffffe) r4 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r4, 0x1000008912, &(0x7f0000000000)="11dca5055e0acfec7be070") 12:14:35 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) 12:14:35 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) 12:14:35 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) 12:14:35 executing program 0: openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)={'vet\x00\x00\x96T\x00\x00\x00\x00\x00\xbdh \x00', 0x402}) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000180)={'vd\x7f\x00\x16\x00\xf9V\xdbZ\xdd\x91\x80\xd2{\x00', 0x43732e5398417f1e}) close(r0) 12:14:35 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x6, 0x1100082) r1 = memfd_create(&(0x7f0000000080)='t\bnu\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00', 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000340)=[{&(0x7f0000001140)='\'', 0x1}], 0x1, 0x1081804) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendfile(r0, r0, 0x0, 0x200000d) ioctl$LOOP_CLR_FD(r0, 0x4c01) syz_genetlink_get_family_id$tipc(0x0) dup3(r1, r0, 0x0) [ 1095.663713] Normal free:3055188kB min:5580kB low:6972kB high:8368kB active_anon:152504kB inactive_anon:12624kB active_file:24976kB inactive_file:26320kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:4718592kB managed:3588764kB mlocked:0kB dirty:184kB writeback:0kB mapped:127972kB shmem:18344kB slab_reclaimable:9232kB slab_unreclaimable:138676kB kernel_stack:7776kB pagetables:18908kB unstable:0kB bounce:0kB free_pcp:948kB local_pcp:572kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no 12:14:35 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) 12:14:35 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) 12:14:35 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) [ 1095.663721] lowmem_reserve[]: 0 0 0 [ 1095.663776] DMA32: 418*4kB (UME) 317*8kB (UME) 335*16kB (UME) 194*32kB (UME) 83*64kB (UME) 24*128kB (UME) 12*256kB (UM) 5*512kB (M) 1*1024kB (E) 2*2048kB (UE) 621*4096kB (M) = 2578528kB 12:14:35 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) 12:14:35 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) 12:14:35 executing program 0: openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)={'vet\x00\x00\x96T\x00\x00\x00\x00\x00\xbdh \x00', 0x402}) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000180)={'vd\x7f\x00\x16\x00\xf9V\xdbZ\xdd\x91\x80\xd2{\x00', 0x43732e5398417f1e}) close(r0) [ 1095.665053] Normal: 385*4kB (UM) 239*8kB (UME) 309*16kB (UME) 224*32kB (UM) 90*64kB (UME) 34*128kB (UME) 10*256kB (UM) 8*512kB (UME) 4*1024kB (M) 4*2048kB (UME) 735*4096kB (M) = 3055180kB [ 1095.665056] 31110 total pagecache pages [ 1095.665061] 0 pages in swap cache [ 1095.665067] Swap cache stats: add 0, delete 0, find 0/0 [ 1095.665070] Free swap = 0kB [ 1095.665072] Total swap = 0kB [ 1095.665075] 1965979 pages RAM [ 1095.665078] 0 pages HighMem/MovableOnly [ 1095.665081] 313294 pages reserved [ 1095.683148] binder: 18199:18202 transaction failed 29189/-22, size 0-0 line 3014 [ 1095.683323] binder: undelivered TRANSACTION_ERROR: 29189 [ 1095.806423] vmalloc: allocation failure: 0 bytes [ 1095.806429] syz-executor.4: page allocation failure: order:0, mode:0x24000c2 [ 1095.806438] CPU: 0 PID: 18216 Comm: syz-executor.4 Not tainted 4.4.174+ #4 [ 1095.806451] 0000000000000000 73a563e182f79875 ffff8801d02979f0 ffffffff81aad1a1 [ 1095.806462] 1ffff1003a052f41 ffff8800b711af80 00000000024000c2 0000000000000000 [ 1095.806472] ffffffff82895080 ffff8801d0297b00 ffffffff8148c0cb ffffffff00000001 [ 1095.806475] Call Trace: [ 1095.806490] [] dump_stack+0xc1/0x120 [ 1095.806504] [] warn_alloc_failed.cold+0x78/0x99 [ 1095.806515] [] ? zone_watermark_ok_safe+0x290/0x290 [ 1095.806525] [] ? sel_write_load+0x9e/0xf90 [ 1095.806536] [] __vmalloc_node_range+0x365/0x650 [ 1095.806544] [] ? check_preemption_disabled+0x3c/0x200 [ 1095.806552] [] ? check_preemption_disabled+0x3c/0x200 [ 1095.806560] [] ? task_has_security+0x130/0x270 [ 1095.806568] [] vmalloc+0x5c/0x70 [ 1095.806576] [] ? sel_write_load+0x119/0xf90 [ 1095.806584] [] sel_write_load+0x119/0xf90 [ 1095.806593] [] ? sel_read_bool+0x240/0x240 [ 1095.806602] [] ? trace_hardirqs_on+0x10/0x10 [ 1095.806610] [] __vfs_write+0x116/0x3d0 [ 1095.806618] [] ? sel_read_bool+0x240/0x240 [ 1095.806625] [] ? __vfs_read+0x3c0/0x3c0 [ 1095.806633] [] ? check_preemption_disabled+0x3c/0x200 [ 1095.806640] [] ? check_preemption_disabled+0x3c/0x200 [ 1095.806649] [] ? rcu_read_lock_sched_held+0x10b/0x130 [ 1095.806658] [] ? rcu_sync_lockdep_assert+0x73/0xb0 [ 1095.806665] [] ? __sb_start_write+0x14f/0x310 [ 1095.806673] [] vfs_write+0x182/0x4e0 [ 1095.806681] [] SyS_write+0xdc/0x1c0 [ 1095.806688] [] ? SyS_read+0x1c0/0x1c0 [ 1095.806699] [] ? lockdep_sys_exit_thunk+0x12/0x14 [ 1095.806708] [] entry_SYSCALL_64_fastpath+0x1e/0x9a [ 1095.806711] Mem-Info: [ 1095.806736] active_anon:70104 inactive_anon:5875 isolated_anon:0 [ 1095.806736] active_file:11182 inactive_file:11777 isolated_file:0 [ 1095.806736] unevictable:0 dirty:48 writeback:0 unstable:0 [ 1095.806736] slab_reclaimable:4393 slab_unreclaimable:62916 [ 1095.806736] mapped:58964 shmem:8337 pagetables:8552 bounce:0 [ 1095.806736] free:1408152 free_pcp:412 free_cma:0 [ 1095.806774] DMA32 free:2577820kB min:4696kB low:5868kB high:7044kB active_anon:127712kB inactive_anon:10476kB active_file:19752kB inactive_file:20788kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:3145324kB managed:3021976kB mlocked:0kB dirty:8kB writeback:0kB mapped:107884kB shmem:14560kB slab_reclaimable:8340kB slab_unreclaimable:113112kB kernel_stack:6304kB pagetables:15300kB unstable:0kB bounce:0kB free_pcp:1168kB local_pcp:692kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no 12:14:36 executing program 2: openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r0 = creat(&(0x7f0000000700)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x40000006100) ftruncate(r0, 0x208203) r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000008000/0x600000)=nil, 0x600000, 0x800002, 0x11, r1, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r2, &(0x7f0000000180)={0xa, 0x4e24, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) sendmmsg(r2, &(0x7f00000092c0), 0x4ff, 0x0) r3 = open(&(0x7f00000003c0)='./bus\x00', 0x0, 0x0) sendfile(r0, r3, 0x0, 0x8000fffffffe) r4 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r4, 0x1000008912, &(0x7f0000000000)="11dca5055e0acfec7be070") 12:14:36 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) 12:14:36 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x6, 0x1100082) r1 = memfd_create(&(0x7f0000000080)='t\bnu\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00', 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000340)=[{&(0x7f0000001140)='\'', 0x1}], 0x1, 0x1081804) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendfile(r0, r0, 0x0, 0x200000d) ioctl$LOOP_CLR_FD(r0, 0x4c01) syz_genetlink_get_family_id$tipc(0x0) dup3(r1, r0, 0x0) 12:14:36 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) 12:14:36 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) 12:14:36 executing program 0: openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)={'vet\x00\x00\x96T\x00\x00\x00\x00\x00\xbdh \x00', 0x402}) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000180)={'vd\x7f\x00\x16\x00\xf9V\xdbZ\xdd\x91\x80\xd2{\x00', 0x43732e5398417f1e}) close(r0) [ 1095.806784] lowmem_reserve[]: 0 3504 3504 12:14:36 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) 12:14:36 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) [ 1095.806821] Normal free:3054788kB min:5580kB low:6972kB high:8368kB active_anon:152704kB inactive_anon:13024kB active_file:24976kB inactive_file:26320kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:4718592kB managed:3588764kB mlocked:0kB dirty:184kB writeback:0kB mapped:127972kB shmem:18788kB slab_reclaimable:9232kB slab_unreclaimable:138552kB kernel_stack:7776kB pagetables:18908kB unstable:0kB bounce:0kB free_pcp:480kB local_pcp:260kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no 12:14:36 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) 12:14:36 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x6, 0x1100082) r1 = memfd_create(&(0x7f0000000080)='t\bnu\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00', 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000340)=[{&(0x7f0000001140)='\'', 0x1}], 0x1, 0x1081804) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendfile(r0, r0, 0x0, 0x200000d) ioctl$LOOP_CLR_FD(r0, 0x4c01) syz_genetlink_get_family_id$tipc(0x0) dup3(r1, r0, 0x0) 12:14:36 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) 12:14:36 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) [ 1095.806830] lowmem_reserve[]: 0 0 0 [ 1095.806888] DMA32: 263*4kB (UME) 318*8kB (UME) 335*16kB (UME) 191*32kB (UME) 83*64kB (UME) 24*128kB (UME) 12*256kB (UM) 5*512kB (M) 1*1024kB (E) 2*2048kB (UE) 621*4096kB (M) = 2577820kB [ 1095.806951] Normal: 237*4kB (UM) 253*8kB (UME) 309*16kB (UME) 222*32kB (UM) 90*64kB (UME) 34*128kB (UME) 10*256kB (UM) 8*512kB (UME) 4*1024kB (M) 4*2048kB (UME) 735*4096kB (M) = 3054636kB [ 1095.806954] 31295 total pagecache pages [ 1095.806958] 0 pages in swap cache [ 1095.806963] Swap cache stats: add 0, delete 0, find 0/0 [ 1095.806966] Free swap = 0kB [ 1095.806969] Total swap = 0kB [ 1095.806972] 1965979 pages RAM [ 1095.806975] 0 pages HighMem/MovableOnly [ 1095.806977] 313294 pages reserved [ 1095.813526] binder: 18213:18220 transaction failed 29189/-22, size 0-0 line 3014 [ 1095.814191] binder: undelivered TRANSACTION_ERROR: 29189 [ 1096.604058] binder: 18236:18240 transaction failed 29189/-22, size 0-0 line 3014 [ 1096.604224] binder: undelivered TRANSACTION_ERROR: 29189 [ 1096.615439] vmalloc: allocation failure: 0 bytes [ 1096.615445] syz-executor.4: page allocation failure: order:0, mode:0x24000c2 [ 1096.615453] CPU: 0 PID: 18242 Comm: syz-executor.4 Not tainted 4.4.174+ #4 [ 1096.615466] 0000000000000000 a2cccc9f03c84603 ffff8800a42079f0 ffffffff81aad1a1 [ 1096.615476] 1ffff10014840f41 ffff8800b8092f80 00000000024000c2 0000000000000000 [ 1096.615487] ffffffff82895080 ffff8800a4207b00 ffffffff8148c0cb ffffffff00000001 [ 1096.615490] Call Trace: [ 1096.615502] [] dump_stack+0xc1/0x120 [ 1096.615516] [] warn_alloc_failed.cold+0x78/0x99 [ 1096.615527] [] ? zone_watermark_ok_safe+0x290/0x290 [ 1096.615537] [] ? sel_write_load+0x9e/0xf90 [ 1096.615546] [] __vmalloc_node_range+0x365/0x650 [ 1096.615555] [] ? check_preemption_disabled+0x3c/0x200 [ 1096.615562] [] ? check_preemption_disabled+0x3c/0x200 [ 1096.615570] [] ? task_has_security+0x130/0x270 [ 1096.615577] [] vmalloc+0x5c/0x70 [ 1096.615585] [] ? sel_write_load+0x119/0xf90 [ 1096.615591] [] sel_write_load+0x119/0xf90 [ 1096.615599] [] ? sel_read_bool+0x240/0x240 [ 1096.615608] [] ? trace_hardirqs_on+0x10/0x10 [ 1096.615616] [] __vfs_write+0x116/0x3d0 [ 1096.615623] [] ? sel_read_bool+0x240/0x240 [ 1096.615630] [] ? __vfs_read+0x3c0/0x3c0 [ 1096.615638] [] ? check_preemption_disabled+0x3c/0x200 [ 1096.615646] [] ? check_preemption_disabled+0x3c/0x200 12:14:37 executing program 2: openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r0 = creat(&(0x7f0000000700)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x40000006100) ftruncate(r0, 0x208203) r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000008000/0x600000)=nil, 0x600000, 0x800002, 0x11, r1, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r2, &(0x7f0000000180)={0xa, 0x4e24, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) sendmmsg(r2, &(0x7f00000092c0), 0x4ff, 0x0) r3 = open(&(0x7f00000003c0)='./bus\x00', 0x0, 0x0) sendfile(r0, r3, 0x0, 0x8000fffffffe) r4 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r4, 0x1000008912, &(0x7f0000000000)="11dca5055e0acfec7be070") 12:14:37 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) 12:14:37 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) 12:14:37 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) 12:14:37 executing program 0: openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)={'vet\x00\x00\x96T\x00\x00\x00\x00\x00\xbdh \x00', 0x402}) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000180)={'vd\x7f\x00\x16\x00\xf9V\xdbZ\xdd\x91\x80\xd2{\x00', 0x43732e5398417f1e}) close(r0) 12:14:37 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x6, 0x1100082) r1 = memfd_create(&(0x7f0000000080)='t\bnu\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00', 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000340)=[{&(0x7f0000001140)='\'', 0x1}], 0x1, 0x1081804) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendfile(r0, r0, 0x0, 0x200000d) ioctl$LOOP_CLR_FD(r0, 0x4c01) syz_genetlink_get_family_id$tipc(0x0) dup3(r1, r0, 0x0) [ 1096.615654] [] ? rcu_read_lock_sched_held+0x10b/0x130 [ 1096.615662] [] ? rcu_sync_lockdep_assert+0x73/0xb0 12:14:37 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) 12:14:37 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) 12:14:37 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) [ 1096.615671] [] ? __sb_start_write+0x14f/0x310 [ 1096.615678] [] vfs_write+0x182/0x4e0 12:14:37 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) 12:14:37 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) 12:14:37 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x6, 0x1100082) r1 = memfd_create(&(0x7f0000000080)='t\bnu\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00', 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000340)=[{&(0x7f0000001140)='\'', 0x1}], 0x1, 0x1081804) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendfile(r0, r0, 0x0, 0x200000d) ioctl$LOOP_CLR_FD(r0, 0x4c01) syz_genetlink_get_family_id$tipc(0x0) dup3(r1, r0, 0x0) ** 6 printk messages dropped ** [ 1096.615773] DMA32 free:2578484kB min:4696kB low:5868kB high:7044kB active_anon:127596kB inactive_anon:10296kB active_file:19752kB inactive_file:20788kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:3145324kB managed:3021976kB mlocked:0kB dirty:0kB writeback:0kB mapped:107888kB shmem:14336kB slab_reclaimable:8340kB slab_unreclaimable:113268kB kernel_stack:6208kB pagetables:15076kB unstable:0kB bounce:0kB free_pcp:1024kB local_pcp:468kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no ** 95 printk messages dropped ** [ 1097.457752] [] ? __sb_start_write+0x14f/0x310 [ 1097.457763] [] vfs_write+0x182/0x4e0 [ 1097.457771] [] SyS_write+0xdc/0x1c0 [ 1097.457780] [] ? SyS_read+0x1c0/0x1c0 [ 1097.457796] [] ? lockdep_sys_exit_thunk+0x12/0x14 [ 1097.457809] [] entry_SYSCALL_64_fastpath+0x1e/0x9a [ 1097.457812] Mem-Info: [ 1097.457839] active_anon:70031 inactive_anon:5725 isolated_anon:0 [ 1097.457839] active_file:11182 inactive_file:11777 isolated_file:0 [ 1097.457839] unevictable:0 dirty:47 writeback:0 unstable:0 [ 1097.457839] slab_reclaimable:4393 slab_unreclaimable:63151 [ 1097.457839] mapped:58964 shmem:8152 pagetables:8478 bounce:0 [ 1097.457839] free:1408269 free_pcp:477 free_cma:0 [ 1097.457877] DMA32 free:2577304kB min:4696kB low:5868kB high:7044kB active_anon:127504kB inactive_anon:10276kB active_file:19752kB inactive_file:20788kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:3145324kB managed:3021976kB mlocked:0kB dirty:8kB writeback:0kB mapped:107828kB shmem:14272kB slab_reclaimable:8340kB slab_unreclaimable:113924kB kernel_stack:6304kB pagetables:15400kB unstable:0kB bounce:0kB free_pcp:1252kB local_pcp:672kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no [ 1097.457886] lowmem_reserve[]: 0 3504 3504 [ 1097.457922] Normal free:3055772kB min:5580kB low:6972kB high:8368kB active_anon:152620kB inactive_anon:12624kB active_file:24976kB inactive_file:26320kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:4718592kB managed:3588764kB mlocked:0kB dirty:180kB writeback:0kB mapped:128028kB shmem:18336kB slab_reclaimable:9232kB slab_unreclaimable:138680kB kernel_stack:7808kB pagetables:18512kB unstable:0kB bounce:0kB free_pcp:652kB local_pcp:568kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no [ 1097.457932] lowmem_reserve[]: 0 0 0 [ 1097.458002] DMA32: 334*4kB (UME) 310*8kB (UME) 336*16kB (UME) 164*32kB (UME) 83*64kB (UME) 25*128kB (UME) 12*256kB (UM) 5*512kB (M) 1*1024kB (E) 2*2048kB (UE) 621*4096kB (M) = 2577320kB [ 1097.458063] Normal: 373*4kB (UM) 275*8kB (UME) 309*16kB (UME) 230*32kB (UM) 91*64kB (UME) 34*128kB (UME) 10*256kB (UM) 8*512kB (UME) 4*1024kB (M) 4*2048kB (UME) 735*4096kB (M) = 3055676kB [ 1097.458065] 31110 total pagecache pages [ 1097.458069] 0 pages in swap cache [ 1097.458073] Swap cache stats: add 0, delete 0, find 0/0 [ 1097.458076] Free swap = 0kB [ 1097.458078] Total swap = 0kB [ 1097.458081] 1965979 pages RAM [ 1097.458085] 0 pages HighMem/MovableOnly [ 1097.458087] 313294 pages reserved [ 1097.525427] binder: 18295:18297 transaction failed 29189/-22, size 0-0 line 3014 [ 1097.525603] binder: undelivered TRANSACTION_ERROR: 29189 [ 1097.593311] binder: 18308:18310 transaction failed 29189/-22, size 0-0 line 3014 [ 1097.593492] binder: undelivered TRANSACTION_ERROR: 29189 [ 1098.201621] binder_alloc: 18329: binder_alloc_buf, no vma [ 1098.201664] binder: 18329:18336 transaction failed 29189/-3, size 0-0 line 3137 [ 1098.203797] binder: undelivered TRANSACTION_ERROR: 29189 [ 1098.272942] binder: 18341:18345 transaction failed 29189/-22, size 0-0 line 3014 [ 1098.273115] binder: undelivered TRANSACTION_ERROR: 29189 [ 1098.359843] binder: 18354:18358 transaction failed 29189/-22, size 0-0 line 3014 [ 1098.360011] binder: undelivered TRANSACTION_ERROR: 29189 [ 1099.117927] binder: 18377:18383 transaction failed 29189/-22, size 0-0 line 3014 [ 1099.118089] binder: undelivered TRANSACTION_ERROR: 29189 [ 1099.141053] warn_alloc_failed: 3 callbacks suppressed [ 1099.141059] vmalloc: allocation failure: 0 bytes [ 1099.141064] syz-executor.4: page allocation failure: order:0, mode:0x24000c2 [ 1099.141074] CPU: 0 PID: 18387 Comm: syz-executor.4 Not tainted 4.4.174+ #4 [ 1099.141088] 0000000000000000 dfce13c139a13d2c ffff8801d3d079f0 ffffffff81aad1a1 12:14:38 executing program 2: openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r0 = creat(&(0x7f0000000700)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x40000006100) ftruncate(r0, 0x208203) r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000008000/0x600000)=nil, 0x600000, 0x800002, 0x11, r1, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r2, &(0x7f0000000180)={0xa, 0x4e24, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) sendmmsg(r2, &(0x7f00000092c0), 0x4ff, 0x0) r3 = open(&(0x7f00000003c0)='./bus\x00', 0x0, 0x0) sendfile(r0, r3, 0x0, 0x8000fffffffe) r4 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r4, 0x1000008912, &(0x7f0000000000)="11dca5055e0acfec7be070") 12:14:38 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) 12:14:38 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) 12:14:38 executing program 0: openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)={'vet\x00\x00\x96T\x00\x00\x00\x00\x00\xbdh \x00', 0x402}) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000180)={'vd\x7f\x00\x16\x00\xf9V\xdbZ\xdd\x91\x80\xd2{\x00', 0x43732e5398417f1e}) close(r0) 12:14:38 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) 12:14:38 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x6, 0x1100082) r1 = memfd_create(&(0x7f0000000080)='t\bnu\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00', 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000340)=[{&(0x7f0000001140)='\'', 0x1}], 0x1, 0x1081804) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendfile(r0, r0, 0x0, 0x200000d) ioctl$LOOP_CLR_FD(r0, 0x4c01) syz_genetlink_get_family_id$tipc(0x0) dup3(r1, r0, 0x0) [ 1099.141099] 1ffff1003a7a0f41 ffff8801d6cbaf80 00000000024000c2 0000000000000000 [ 1099.141111] ffffffff82895080 ffff8801d3d07b00 ffffffff8148c0cb ffffffff00000001 [ 1099.141113] Call Trace: [ 1099.141132] [] dump_stack+0xc1/0x120 [ 1099.141143] [] warn_alloc_failed.cold+0x78/0x99 [ 1099.141154] [] ? zone_watermark_ok_safe+0x290/0x290 [ 1099.141166] [] ? sel_write_load+0x9e/0xf90 12:14:38 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) [ 1099.141177] [] __vmalloc_node_range+0x365/0x650 12:14:38 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) 12:14:38 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) 12:14:38 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) ** 3 printk messages dropped ** [ 1099.141224] [] vmalloc+0x5c/0x70 [ 1099.141233] [] ? sel_write_load+0x119/0xf90 12:14:38 executing program 0: openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)={'vet\x00\x00\x96T\x00\x00\x00\x00\x00\xbdh \x00', 0x402}) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000180)={'vd\x7f\x00\x16\x00\xf9V\xdbZ\xdd\x91\x80\xd2{\x00', 0x43732e5398417f1e}) close(r0) 12:14:38 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) [ 1099.141243] [] sel_write_load+0x119/0xf90 [ 1099.141252] [] ? sel_read_bool+0x240/0x240 [ 1099.141264] [] ? trace_hardirqs_on+0x10/0x10 [ 1099.141274] [] __vfs_write+0x116/0x3d0 ** 45 printk messages dropped ** [ 1099.287895] [] vmalloc+0x5c/0x70 [ 1099.287903] [] ? sel_write_load+0x119/0xf90 [ 1099.287910] [] sel_write_load+0x119/0xf90 [ 1099.287918] [] ? sel_read_bool+0x240/0x240 [ 1099.287927] [] ? trace_hardirqs_on+0x10/0x10 [ 1099.287946] [] __vfs_write+0x116/0x3d0 [ 1099.287956] [] ? sel_read_bool+0x240/0x240 [ 1099.287965] [] ? __vfs_read+0x3c0/0x3c0 [ 1099.287974] [] ? check_preemption_disabled+0x3c/0x200 [ 1099.287983] [] ? check_preemption_disabled+0x3c/0x200 [ 1099.287994] [] ? rcu_read_lock_sched_held+0x10b/0x130 [ 1099.288002] [] ? rcu_sync_lockdep_assert+0x73/0xb0 [ 1099.288010] [] ? __sb_start_write+0x14f/0x310 [ 1099.288018] [] vfs_write+0x182/0x4e0 [ 1099.288026] [] SyS_write+0xdc/0x1c0 [ 1099.288033] [] ? SyS_read+0x1c0/0x1c0 [ 1099.288043] [] ? lockdep_sys_exit_thunk+0x12/0x14 [ 1099.288052] [] entry_SYSCALL_64_fastpath+0x1e/0x9a [ 1099.288056] Mem-Info: [ 1099.288081] active_anon:70062 inactive_anon:6151 isolated_anon:0 [ 1099.288081] active_file:11182 inactive_file:11777 isolated_file:0 [ 1099.288081] unevictable:0 dirty:47 writeback:0 unstable:0 [ 1099.288081] slab_reclaimable:4389 slab_unreclaimable:63059 [ 1099.288081] mapped:58986 shmem:8668 pagetables:8549 bounce:0 [ 1099.288081] free:1407022 free_pcp:421 free_cma:0 [ 1099.288120] DMA32 free:2575532kB min:4696kB low:5868kB high:7044kB active_anon:127600kB inactive_anon:10896kB active_file:19752kB inactive_file:20788kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:3145324kB managed:3021976kB mlocked:0kB dirty:8kB writeback:0kB mapped:107824kB shmem:15020kB slab_reclaimable:8340kB slab_unreclaimable:113472kB kernel_stack:6464kB pagetables:15448kB unstable:0kB bounce:0kB free_pcp:944kB local_pcp:404kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no [ 1099.288129] lowmem_reserve[]: 0 3504 3504 12:14:39 executing program 2: openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r0 = creat(&(0x7f0000000700)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x40000006100) ftruncate(r0, 0x208203) r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000008000/0x600000)=nil, 0x600000, 0x800002, 0x11, r1, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r2, &(0x7f0000000180)={0xa, 0x4e24, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) sendmmsg(r2, &(0x7f00000092c0), 0x4ff, 0x0) r3 = open(&(0x7f00000003c0)='./bus\x00', 0x0, 0x0) sendfile(r0, r3, 0x0, 0x8000fffffffe) r4 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r4, 0x1000008912, &(0x7f0000000000)="11dca5055e0acfec7be070") 12:14:39 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x6, 0x1100082) r1 = memfd_create(&(0x7f0000000080)='t\bnu\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00', 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000340)=[{&(0x7f0000001140)='\'', 0x1}], 0x1, 0x1081804) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendfile(r0, r0, 0x0, 0x200000d) ioctl$LOOP_CLR_FD(r0, 0x4c01) syz_genetlink_get_family_id$tipc(0x0) dup3(r1, r0, 0x0) 12:14:39 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) 12:14:39 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) 12:14:39 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) 12:14:39 executing program 0: openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)={'vet\x00\x00\x96T\x00\x00\x00\x00\x00\xbdh \x00', 0x402}) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000180)={'vd\x7f\x00\x16\x00\xf9V\xdbZ\xdd\x91\x80\xd2{\x00', 0x43732e5398417f1e}) close(r0) 12:14:39 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) [ 1099.288160] Normal free:3052556kB min:5580kB low:6972kB high:8368kB active_anon:152648kB inactive_anon:13708kB active_file:24976kB inactive_file:26320kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:4718592kB managed:3588764kB mlocked:0kB dirty:180kB writeback:0kB mapped:128120kB shmem:19652kB slab_reclaimable:9216kB slab_unreclaimable:138764kB kernel_stack:8064kB pagetables:18748kB unstable:0kB bounce:0kB free_pcp:740kB local_pcp:356kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no 12:14:39 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) [ 1099.288169] lowmem_reserve[]: 0 0 0 ** 27 printk messages dropped ** [ 1100.092918] [] vmalloc+0x5c/0x70 12:14:39 executing program 0: openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)={'vet\x00\x00\x96T\x00\x00\x00\x00\x00\xbdh \x00', 0x402}) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000180)={'vd\x7f\x00\x16\x00\xf9V\xdbZ\xdd\x91\x80\xd2{\x00', 0x43732e5398417f1e}) close(r0) 12:14:39 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) 12:14:39 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) 12:14:39 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x6, 0x1100082) r1 = memfd_create(&(0x7f0000000080)='t\bnu\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00', 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000340)=[{&(0x7f0000001140)='\'', 0x1}], 0x1, 0x1081804) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendfile(r0, r0, 0x0, 0x200000d) ioctl$LOOP_CLR_FD(r0, 0x4c01) syz_genetlink_get_family_id$tipc(0x0) dup3(r1, r0, 0x0) ** 1 printk messages dropped ** [ 1100.092932] [] sel_write_load+0x119/0xf90 [ 1100.092939] [] ? sel_read_bool+0x240/0x240 [ 1100.092948] [] ? trace_hardirqs_on+0x10/0x10 [ 1100.092958] [] __vfs_write+0x116/0x3d0 [ 1100.092966] [] ? sel_read_bool+0x240/0x240 [ 1100.092975] [] ? __vfs_read+0x3c0/0x3c0 [ 1100.092983] [] ? check_preemption_disabled+0x3c/0x200 [ 1100.092991] [] ? check_preemption_disabled+0x3c/0x200 [ 1100.093000] [] ? rcu_read_lock_sched_held+0x10b/0x130 [ 1100.093008] [] ? rcu_sync_lockdep_assert+0x73/0xb0 [ 1100.093016] [] ? __sb_start_write+0x14f/0x310 [ 1100.093024] [] vfs_write+0x182/0x4e0 [ 1100.093031] [] SyS_write+0xdc/0x1c0 [ 1100.093038] [] ? SyS_read+0x1c0/0x1c0 [ 1100.093048] [] ? lockdep_sys_exit_thunk+0x12/0x14 [ 1100.093057] [] entry_SYSCALL_64_fastpath+0x1e/0x9a [ 1100.094242] Mem-Info: [ 1100.094267] active_anon:70012 inactive_anon:5701 isolated_anon:0 [ 1100.094267] active_file:11182 inactive_file:11777 isolated_file:0 [ 1100.094267] unevictable:0 dirty:47 writeback:0 unstable:0 [ 1100.094267] slab_reclaimable:4389 slab_unreclaimable:63193 [ 1100.094267] mapped:58949 shmem:8150 pagetables:8438 bounce:0 [ 1100.094267] free:1407382 free_pcp:637 free_cma:0 [ 1100.094300] DMA32 free:2576324kB min:4696kB low:5868kB high:7044kB active_anon:127600kB inactive_anon:10196kB active_file:19752kB inactive_file:20788kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:3145324kB managed:3021976kB mlocked:0kB dirty:8kB writeback:0kB mapped:107824kB shmem:14280kB slab_reclaimable:8340kB slab_unreclaimable:113280kB kernel_stack:6464kB pagetables:15300kB unstable:0kB bounce:0kB free_pcp:1264kB local_pcp:616kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no [ 1100.094309] lowmem_reserve[]: 0 3504 3504 [ 1100.094338] Normal free:3053204kB min:5580kB low:6972kB high:8368kB active_anon:152448kB inactive_anon:12608kB active_file:24976kB inactive_file:26320kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:4718592kB managed:3588764kB mlocked:0kB dirty:180kB writeback:0kB mapped:127972kB shmem:18320kB slab_reclaimable:9216kB slab_unreclaimable:139492kB kernel_stack:8064kB pagetables:18452kB unstable:0kB bounce:0kB free_pcp:1284kB local_pcp:560kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no [ 1100.094347] lowmem_reserve[]: 0 0 0 [ 1100.094400] DMA32: 431*4kB (UME) 355*8kB (UME) 341*16kB (UME) 147*32kB (UME) 62*64kB (UME) 25*128kB (UME) 12*256kB (UM) 5*512kB (M) 1*1024kB (E) 2*2048kB (UE) 621*4096kB (M) = 2576260kB [ 1100.094463] Normal: 205*4kB (UM) 216*8kB (UME) 310*16kB (UME) 187*32kB (UM) 91*64kB (UME) 34*128kB (UME) 10*256kB (UM) 8*512kB (UME) 4*1024kB (M) 4*2048kB (UME) 735*4096kB (M) = 3053172kB [ 1100.094465] 31108 total pagecache pages [ 1100.094470] 0 pages in swap cache [ 1100.094474] Swap cache stats: add 0, delete 0, find 0/0 [ 1100.094477] Free swap = 0kB [ 1100.094479] Total swap = 0kB [ 1100.094482] 1965979 pages RAM [ 1100.094484] 0 pages HighMem/MovableOnly [ 1100.094486] 313294 pages reserved [ 1100.139467] binder: 18425:18430 transaction failed 29189/-22, size 0-0 line 3014 [ 1100.139634] binder: undelivered TRANSACTION_ERROR: 29189 [ 1100.148146] vmalloc: allocation failure: 0 bytes [ 1100.148152] syz-executor.4: page allocation failure: order:0, mode:0x24000c2 [ 1100.148161] CPU: 0 PID: 18436 Comm: syz-executor.4 Not tainted 4.4.174+ #4 12:14:39 executing program 2: openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r0 = creat(&(0x7f0000000700)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x40000006100) ftruncate(r0, 0x208203) r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000008000/0x600000)=nil, 0x600000, 0x800002, 0x11, r1, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r2, &(0x7f0000000180)={0xa, 0x4e24, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) sendmmsg(r2, &(0x7f00000092c0), 0x4ff, 0x0) r3 = open(&(0x7f00000003c0)='./bus\x00', 0x0, 0x0) sendfile(r0, r3, 0x0, 0x8000fffffffe) r4 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r4, 0x1000008912, &(0x7f0000000000)="11dca5055e0acfec7be070") 12:14:39 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) 12:14:39 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) 12:14:39 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) 12:14:39 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x6, 0x1100082) r1 = memfd_create(&(0x7f0000000080)='t\bnu\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00', 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000340)=[{&(0x7f0000001140)='\'', 0x1}], 0x1, 0x1081804) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendfile(r0, r0, 0x0, 0x200000d) ioctl$LOOP_CLR_FD(r0, 0x4c01) syz_genetlink_get_family_id$tipc(0x0) dup3(r1, r0, 0x0) 12:14:39 executing program 0: openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)={'vet\x00\x00\x96T\x00\x00\x00\x00\x00\xbdh \x00', 0x402}) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000180)={'vd\x7f\x00\x16\x00\xf9V\xdbZ\xdd\x91\x80\xd2{\x00', 0x43732e5398417f1e}) close(r0) [ 1100.148175] 0000000000000000 c3e7c7f8bd4b291f ffff8800b8ce79f0 ffffffff81aad1a1 12:14:39 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) 12:14:40 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) [ 1100.148186] 1ffff1001719cf41 ffff8801d416af80 00000000024000c2 0000000000000000 12:14:40 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) 12:14:40 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) [ 1100.148196] ffffffff82895080 ffff8800b8ce7b00 ffffffff8148c0cb ffffffff00000001 12:14:40 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x6, 0x1100082) r1 = memfd_create(&(0x7f0000000080)='t\bnu\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00', 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000340)=[{&(0x7f0000001140)='\'', 0x1}], 0x1, 0x1081804) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendfile(r0, r0, 0x0, 0x200000d) ioctl$LOOP_CLR_FD(r0, 0x4c01) syz_genetlink_get_family_id$tipc(0x0) dup3(r1, r0, 0x0) 12:14:40 executing program 0: openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)={'vet\x00\x00\x96T\x00\x00\x00\x00\x00\xbdh \x00', 0x402}) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000180)={'vd\x7f\x00\x16\x00\xf9V\xdbZ\xdd\x91\x80\xd2{\x00', 0x43732e5398417f1e}) close(r0) [ 1100.148199] Call Trace: [ 1100.148221] [] dump_stack+0xc1/0x120 [ 1100.148235] [] warn_alloc_failed.cold+0x78/0x99 [ 1100.148248] [] ? zone_watermark_ok_safe+0x290/0x290 [ 1100.148258] [] ? sel_write_load+0x9e/0xf90 [ 1100.148269] [] __vmalloc_node_range+0x365/0x650 [ 1100.148283] [] ? check_preemption_disabled+0x3c/0x200 [ 1100.148292] [] ? check_preemption_disabled+0x3c/0x200 [ 1100.148302] [] ? task_has_security+0x130/0x270 [ 1100.148309] [] vmalloc+0x5c/0x70 [ 1100.148319] [] ? sel_write_load+0x119/0xf90 [ 1100.148327] [] sel_write_load+0x119/0xf90 [ 1100.148338] [] ? sel_read_bool+0x240/0x240 [ 1100.148349] [] ? trace_hardirqs_on+0x10/0x10 [ 1100.148359] [] __vfs_write+0x116/0x3d0 [ 1100.148368] [] ? sel_read_bool+0x240/0x240 [ 1100.148378] [] ? __vfs_read+0x3c0/0x3c0 [ 1100.148386] [] ? check_preemption_disabled+0x3c/0x200 [ 1100.148395] [] ? check_preemption_disabled+0x3c/0x200 [ 1100.148405] [] ? rcu_read_lock_sched_held+0x10b/0x130 [ 1100.148413] [] ? rcu_sync_lockdep_assert+0x73/0xb0 [ 1100.148423] [] ? __sb_start_write+0x14f/0x310 [ 1100.148431] [] vfs_write+0x182/0x4e0 [ 1100.148438] [] SyS_write+0xdc/0x1c0 [ 1100.148446] [] ? SyS_read+0x1c0/0x1c0 [ 1100.148457] [] ? lockdep_sys_exit_thunk+0x12/0x14 [ 1100.148467] [] entry_SYSCALL_64_fastpath+0x1e/0x9a [ 1100.148924] Mem-Info: [ 1100.148959] active_anon:70037 inactive_anon:5701 isolated_anon:0 [ 1100.148959] active_file:11182 inactive_file:11777 isolated_file:0 [ 1100.148959] unevictable:0 dirty:47 writeback:0 unstable:0 [ 1100.148959] slab_reclaimable:4389 slab_unreclaimable:63193 [ 1100.148959] mapped:58949 shmem:8150 pagetables:8512 bounce:0 [ 1100.148959] free:1407316 free_pcp:599 free_cma:0 [ 1100.148999] DMA32 free:2576424kB min:4696kB low:5868kB high:7044kB active_anon:127600kB inactive_anon:10196kB active_file:19752kB inactive_file:20788kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:3145324kB managed:3021976kB mlocked:0kB dirty:8kB writeback:0kB mapped:107824kB shmem:14280kB slab_reclaimable:8340kB slab_unreclaimable:113280kB kernel_stack:6464kB pagetables:15152kB unstable:0kB bounce:0kB free_pcp:1256kB local_pcp:544kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no 12:14:40 executing program 2: openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r0 = creat(&(0x7f0000000700)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x40000006100) ftruncate(r0, 0x208203) r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000008000/0x600000)=nil, 0x600000, 0x800002, 0x11, r1, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r2, &(0x7f0000000180)={0xa, 0x4e24, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) sendmmsg(r2, &(0x7f00000092c0), 0x4ff, 0x0) r3 = open(&(0x7f00000003c0)='./bus\x00', 0x0, 0x0) sendfile(r0, r3, 0x0, 0x8000fffffffe) r4 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r4, 0x1000008912, &(0x7f0000000000)="11dca5055e0acfec7be070") 12:14:40 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) 12:14:40 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) 12:14:40 executing program 0: openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)={'vet\x00\x00\x96T\x00\x00\x00\x00\x00\xbdh \x00', 0x402}) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000180)={'vd\x7f\x00\x16\x00\xf9V\xdbZ\xdd\x91\x80\xd2{\x00', 0x43732e5398417f1e}) close(r0) 12:14:40 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) 12:14:40 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x6, 0x1100082) r1 = memfd_create(&(0x7f0000000080)='t\bnu\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00', 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000340)=[{&(0x7f0000001140)='\'', 0x1}], 0x1, 0x1081804) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendfile(r0, r0, 0x0, 0x200000d) ioctl$LOOP_CLR_FD(r0, 0x4c01) syz_genetlink_get_family_id$tipc(0x0) dup3(r1, r0, 0x0) [ 1100.149008] lowmem_reserve[]: 0 3504 3504 12:14:40 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) 12:14:40 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) 12:14:40 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) [ 1100.149041] Normal free:3052840kB min:5580kB low:6972kB high:8368kB active_anon:152548kB inactive_anon:12608kB active_file:24976kB inactive_file:26320kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:4718592kB managed:3588764kB mlocked:0kB dirty:180kB writeback:0kB mapped:127972kB shmem:18320kB slab_reclaimable:9216kB slab_unreclaimable:139492kB kernel_stack:8064kB pagetables:18896kB unstable:0kB bounce:0kB free_pcp:1140kB local_pcp:636kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no 12:14:40 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) 12:14:40 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) 12:14:40 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x6, 0x1100082) r1 = memfd_create(&(0x7f0000000080)='t\bnu\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00', 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000340)=[{&(0x7f0000001140)='\'', 0x1}], 0x1, 0x1081804) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendfile(r0, r0, 0x0, 0x200000d) ioctl$LOOP_CLR_FD(r0, 0x4c01) syz_genetlink_get_family_id$tipc(0x0) dup3(r1, r0, 0x0) [ 1100.149050] lowmem_reserve[]: 0 0 0 [ 1100.149105] DMA32: 491*4kB (UME) 353*8kB (UME) 342*16kB (UME) 145*32kB (UME) 62*64kB (UME) 25*128kB (UME) 12*256kB (UM) 5*512kB (M) 1*1024kB (E) 2*2048kB (UE) 621*4096kB (M) = 2576436kB [ 1100.149156] Normal: 201*4kB (UM) 187*8kB (UME) 309*16kB (UME) 184*32kB (UM) 91*64kB (UME) 33*128kB (UME) 10*256kB (UM) 8*512kB (UME) 4*1024kB (M) 4*2048kB (UME) 735*4096kB (M) = 3052684kB [ 1100.149159] 31108 total pagecache pages [ 1100.149162] 0 pages in swap cache [ 1100.149167] Swap cache stats: add 0, delete 0, find 0/0 [ 1100.149169] Free swap = 0kB [ 1100.149172] Total swap = 0kB [ 1100.149174] 1965979 pages RAM [ 1100.149177] 0 pages HighMem/MovableOnly [ 1100.149179] 313294 pages reserved [ 1100.212800] binder: 18442:18446 transaction failed 29189/-22, size 0-0 line 3014 [ 1100.212973] binder: undelivered TRANSACTION_ERROR: 29189 [ 1100.260020] vmalloc: allocation failure: 0 bytes [ 1100.260027] syz-executor.4: page allocation failure: order:0, mode:0x24000c2 [ 1100.260037] CPU: 1 PID: 18450 Comm: syz-executor.4 Not tainted 4.4.174+ #4 [ 1100.260050] 0000000000000000 1d770738a165c36f ffff8800a49279f0 ffffffff81aad1a1 [ 1100.260060] 1ffff10014924f41 ffff8801d7e6df00 00000000024000c2 0000000000000000 [ 1100.260071] ffffffff82895080 ffff8800a4927b00 ffffffff8148c0cb ffffffff00000001 [ 1100.260073] Call Trace: [ 1100.260087] [] dump_stack+0xc1/0x120 [ 1100.260100] [] warn_alloc_failed.cold+0x78/0x99 [ 1100.260112] [] ? zone_watermark_ok_safe+0x290/0x290 [ 1100.260121] [] ? sel_write_load+0x9e/0xf90 [ 1100.260129] [] __vmalloc_node_range+0x365/0x650 [ 1100.260138] [] ? check_preemption_disabled+0x3c/0x200 [ 1100.260145] [] ? check_preemption_disabled+0x3c/0x200 [ 1100.260153] [] ? task_has_security+0x130/0x270 [ 1100.260160] [] vmalloc+0x5c/0x70 [ 1100.260167] [] ? sel_write_load+0x119/0xf90 [ 1100.260174] [] sel_write_load+0x119/0xf90 [ 1100.260182] [] ? sel_read_bool+0x240/0x240 [ 1100.260191] [] ? trace_hardirqs_on+0x10/0x10 [ 1100.260199] [] __vfs_write+0x116/0x3d0 [ 1100.260207] [] ? sel_read_bool+0x240/0x240 [ 1100.260215] [] ? __vfs_read+0x3c0/0x3c0 [ 1100.260224] [] ? check_preemption_disabled+0x3c/0x200 [ 1100.260231] [] ? check_preemption_disabled+0x3c/0x200 [ 1100.260240] [] ? rcu_read_lock_sched_held+0x10b/0x130 [ 1100.260248] [] ? rcu_sync_lockdep_assert+0x73/0xb0 12:14:41 executing program 2: openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r0 = creat(&(0x7f0000000700)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x40000006100) ftruncate(r0, 0x208203) r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000008000/0x600000)=nil, 0x600000, 0x800002, 0x11, r1, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r2, &(0x7f0000000180)={0xa, 0x4e24, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) sendmmsg(r2, &(0x7f00000092c0), 0x4ff, 0x0) r3 = open(&(0x7f00000003c0)='./bus\x00', 0x0, 0x0) sendfile(r0, r3, 0x0, 0x8000fffffffe) r4 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r4, 0x1000008912, &(0x7f0000000000)="11dca5055e0acfec7be070") 12:14:41 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) 12:14:41 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) 12:14:41 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) 12:14:41 executing program 0: openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)={'vet\x00\x00\x96T\x00\x00\x00\x00\x00\xbdh \x00', 0x402}) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000180)={'vd\x7f\x00\x16\x00\xf9V\xdbZ\xdd\x91\x80\xd2{\x00', 0x43732e5398417f1e}) close(r0) 12:14:41 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x6, 0x1100082) r1 = memfd_create(&(0x7f0000000080)='t\bnu\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00', 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000340)=[{&(0x7f0000001140)='\'', 0x1}], 0x1, 0x1081804) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendfile(r0, r0, 0x0, 0x200000d) ioctl$LOOP_CLR_FD(r0, 0x4c01) syz_genetlink_get_family_id$tipc(0x0) dup3(r1, r0, 0x0) 12:14:41 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) 12:14:41 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) 12:14:41 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) [ 1100.260256] [] ? __sb_start_write+0x14f/0x310 [ 1100.260263] [] vfs_write+0x182/0x4e0 [ 1100.260273] [] SyS_write+0xdc/0x1c0 [ 1100.260281] [] ? SyS_read+0x1c0/0x1c0 12:14:41 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) 12:14:41 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) [ 1100.260294] [] ? lockdep_sys_exit_thunk+0x12/0x14 12:14:41 executing program 0: openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)={'vet\x00\x00\x96T\x00\x00\x00\x00\x00\xbdh \x00', 0x402}) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000180)={'vd\x7f\x00\x16\x00\xf9V\xdbZ\xdd\x91\x80\xd2{\x00', 0x43732e5398417f1e}) close(r0) [ 1100.260306] [] entry_SYSCALL_64_fastpath+0x1e/0x9a [ 1100.260309] Mem-Info: [ 1100.260334] active_anon:70056 inactive_anon:5695 isolated_anon:0 [ 1100.260334] active_file:11182 inactive_file:11777 isolated_file:0 [ 1100.260334] unevictable:0 dirty:47 writeback:0 unstable:0 [ 1100.260334] slab_reclaimable:4389 slab_unreclaimable:63042 [ 1100.260334] mapped:58975 shmem:8153 pagetables:8505 bounce:0 [ 1100.260334] free:1407374 free_pcp:649 free_cma:0 ** 43 printk messages dropped ** [ 1101.060489] [] ? rcu_read_lock_sched_held+0x10b/0x130 [ 1101.060497] [] ? rcu_sync_lockdep_assert+0x73/0xb0 [ 1101.060507] [] ? __sb_start_write+0x14f/0x310 [ 1101.060516] [] vfs_write+0x182/0x4e0 [ 1101.060524] [] SyS_write+0xdc/0x1c0 [ 1101.060532] [] ? SyS_read+0x1c0/0x1c0 [ 1101.060542] [] ? lockdep_sys_exit_thunk+0x12/0x14 [ 1101.060552] [] entry_SYSCALL_64_fastpath+0x1e/0x9a [ 1101.060555] Mem-Info: [ 1101.060581] active_anon:70043 inactive_anon:5676 isolated_anon:0 [ 1101.060581] active_file:11182 inactive_file:11777 isolated_file:0 [ 1101.060581] unevictable:0 dirty:47 writeback:0 unstable:0 [ 1101.060581] slab_reclaimable:4389 slab_unreclaimable:63199 [ 1101.060581] mapped:58981 shmem:8150 pagetables:8542 bounce:0 [ 1101.060581] free:1407446 free_pcp:461 free_cma:0 [ 1101.060613] DMA32 free:2577156kB min:4696kB low:5868kB high:7044kB active_anon:127540kB inactive_anon:10200kB active_file:19752kB inactive_file:20788kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:3145324kB managed:3021976kB mlocked:0kB dirty:8kB writeback:0kB mapped:107876kB shmem:14288kB slab_reclaimable:8340kB slab_unreclaimable:112504kB kernel_stack:6496kB pagetables:15620kB unstable:0kB bounce:0kB free_pcp:1116kB local_pcp:620kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no [ 1101.060622] lowmem_reserve[]: 0 3504 3504 [ 1101.060649] Normal free:3052628kB min:5580kB low:6972kB high:8368kB active_anon:152632kB inactive_anon:12504kB active_file:24976kB inactive_file:26320kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:4718592kB managed:3588764kB mlocked:0kB dirty:180kB writeback:0kB mapped:128048kB shmem:18312kB slab_reclaimable:9216kB slab_unreclaimable:140292kB kernel_stack:8064kB pagetables:18548kB unstable:0kB bounce:0kB free_pcp:728kB local_pcp:188kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no 12:14:42 executing program 2: openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r0 = creat(&(0x7f0000000700)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x40000006100) ftruncate(r0, 0x208203) r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000008000/0x600000)=nil, 0x600000, 0x800002, 0x11, r1, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r2, &(0x7f0000000180)={0xa, 0x4e24, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) sendmmsg(r2, &(0x7f00000092c0), 0x4ff, 0x0) r3 = open(&(0x7f00000003c0)='./bus\x00', 0x0, 0x0) sendfile(r0, r3, 0x0, 0x8000fffffffe) r4 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r4, 0x1000008912, &(0x7f0000000000)="11dca5055e0acfec7be070") 12:14:42 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) 12:14:42 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x6, 0x1100082) r1 = memfd_create(&(0x7f0000000080)='t\bnu\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00', 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000340)=[{&(0x7f0000001140)='\'', 0x1}], 0x1, 0x1081804) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendfile(r0, r0, 0x0, 0x200000d) ioctl$LOOP_CLR_FD(r0, 0x4c01) syz_genetlink_get_family_id$tipc(0x0) dup3(r1, r0, 0x0) 12:14:42 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) 12:14:42 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) 12:14:42 executing program 0: openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)={'vet\x00\x00\x96T\x00\x00\x00\x00\x00\xbdh \x00', 0x402}) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000180)={'vd\x7f\x00\x16\x00\xf9V\xdbZ\xdd\x91\x80\xd2{\x00', 0x43732e5398417f1e}) close(r0) [ 1101.060658] lowmem_reserve[]: 0 0 0 [ 1101.060715] DMA32: 521*4kB (UME) 377*8kB (UME) 343*16kB (UME) 158*32kB (UME) 62*64kB (UME) 25*128kB (UME) 12*256kB (UM) 5*512kB (M) 1*1024kB (E) 2*2048kB (UE) 621*4096kB (M) = 2577180kB 12:14:42 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) 12:14:42 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) 12:14:42 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) ** 36 printk messages dropped ** [ 1101.155735] [] ? rcu_read_lock_sched_held+0x10b/0x130 [ 1101.155742] [] ? rcu_sync_lockdep_assert+0x73/0xb0 12:14:42 executing program 0: openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)={'vet\x00\x00\x96T\x00\x00\x00\x00\x00\xbdh \x00', 0x402}) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000180)={'vd\x7f\x00\x16\x00\xf9V\xdbZ\xdd\x91\x80\xd2{\x00', 0x43732e5398417f1e}) close(r0) 12:14:42 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) [ 1101.155754] [] ? __sb_start_write+0x14f/0x310 12:14:42 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x6, 0x1100082) r1 = memfd_create(&(0x7f0000000080)='t\bnu\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00', 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000340)=[{&(0x7f0000001140)='\'', 0x1}], 0x1, 0x1081804) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendfile(r0, r0, 0x0, 0x200000d) ioctl$LOOP_CLR_FD(r0, 0x4c01) syz_genetlink_get_family_id$tipc(0x0) dup3(r1, r0, 0x0) ** 97 printk messages dropped ** [ 1101.366903] [] ? check_preemption_disabled+0x3c/0x200 [ 1101.366912] [] ? check_preemption_disabled+0x3c/0x200 [ 1101.366922] [] ? rcu_read_lock_sched_held+0x10b/0x130 [ 1101.366930] [] ? rcu_sync_lockdep_assert+0x73/0xb0 [ 1101.366946] [] ? __sb_start_write+0x14f/0x310 [ 1101.366955] [] vfs_write+0x182/0x4e0 [ 1101.366964] [] SyS_write+0xdc/0x1c0 [ 1101.366972] [] ? SyS_read+0x1c0/0x1c0 [ 1101.366985] [] ? lockdep_sys_exit_thunk+0x12/0x14 [ 1101.366995] [] entry_SYSCALL_64_fastpath+0x1e/0x9a [ 1101.372355] Mem-Info: [ 1101.372383] active_anon:70120 inactive_anon:6195 isolated_anon:0 [ 1101.372383] active_file:11182 inactive_file:11777 isolated_file:0 [ 1101.372383] unevictable:0 dirty:47 writeback:0 unstable:0 [ 1101.372383] slab_reclaimable:4389 slab_unreclaimable:63268 [ 1101.372383] mapped:58986 shmem:8669 pagetables:8545 bounce:0 [ 1101.372383] free:1406543 free_pcp:499 free_cma:0 [ 1101.372417] DMA32 free:2575516kB min:4696kB low:5868kB high:7044kB active_anon:127660kB inactive_anon:11144kB active_file:19752kB inactive_file:20788kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:3145324kB managed:3021976kB mlocked:0kB dirty:8kB writeback:0kB mapped:107976kB shmem:15224kB slab_reclaimable:8340kB slab_unreclaimable:112844kB kernel_stack:6528kB pagetables:15244kB unstable:0kB bounce:0kB free_pcp:1376kB local_pcp:704kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no [ 1101.372427] lowmem_reserve[]: 0 3504 3504 [ 1101.372455] Normal free:3050656kB min:5580kB low:6972kB high:8368kB active_anon:152820kB inactive_anon:13636kB active_file:24976kB inactive_file:26320kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:4718592kB managed:3588764kB mlocked:0kB dirty:180kB writeback:0kB mapped:127968kB shmem:19452kB slab_reclaimable:9216kB slab_unreclaimable:140228kB kernel_stack:8128kB pagetables:18936kB unstable:0kB bounce:0kB free_pcp:620kB local_pcp:292kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no [ 1101.372464] lowmem_reserve[]: 0 0 0 [ 1101.372527] DMA32: 477*4kB (UE) 307*8kB (UME) 343*16kB (UME) 148*32kB (UME) 54*64kB (UME) 25*128kB (UME) 12*256kB (UM) 5*512kB (M) 1*1024kB (E) 2*2048kB (UE) 621*4096kB (M) = 2575612kB [ 1101.372582] Normal: 18*4kB (M) 145*8kB (UME) 293*16kB (UME) 165*32kB (UM) 89*64kB (UME) 33*128kB (UME) 10*256kB (UM) 8*512kB (UME) 4*1024kB (M) 4*2048kB (UME) 735*4096kB (M) = 3050624kB [ 1101.372585] 31627 total pagecache pages [ 1101.372589] 0 pages in swap cache [ 1101.372594] Swap cache stats: add 0, delete 0, find 0/0 [ 1101.372598] Free swap = 0kB [ 1101.372600] Total swap = 0kB [ 1101.372603] 1965979 pages RAM [ 1101.372606] 0 pages HighMem/MovableOnly [ 1101.372609] 313294 pages reserved [ 1101.381070] binder: 18521:18524 transaction failed 29189/-22, size 0-0 line 3014 [ 1101.381234] binder: undelivered TRANSACTION_ERROR: 29189 [ 1101.920796] vmalloc: allocation failure: 0 bytes [ 1101.920801] syz-executor.4: page allocation failure: order:0, mode:0x24000c2 12:14:43 executing program 2: openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r0 = creat(&(0x7f0000000700)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x40000006100) ftruncate(r0, 0x208203) r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000008000/0x600000)=nil, 0x600000, 0x800002, 0x11, r1, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r2, &(0x7f0000000180)={0xa, 0x4e24, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) sendmmsg(r2, &(0x7f00000092c0), 0x4ff, 0x0) r3 = open(&(0x7f00000003c0)='./bus\x00', 0x0, 0x0) sendfile(r0, r3, 0x0, 0x8000fffffffe) r4 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r4, 0x1000008912, &(0x7f0000000000)="11dca5055e0acfec7be070") 12:14:43 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) 12:14:43 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) 12:14:43 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x6, 0x1100082) r1 = memfd_create(&(0x7f0000000080)='t\bnu\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00', 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000340)=[{&(0x7f0000001140)='\'', 0x1}], 0x1, 0x1081804) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendfile(r0, r0, 0x0, 0x200000d) ioctl$LOOP_CLR_FD(r0, 0x4c01) syz_genetlink_get_family_id$tipc(0x0) dup3(r1, r0, 0x0) 12:14:43 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) 12:14:43 executing program 0: openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)={'vet\x00\x00\x96T\x00\x00\x00\x00\x00\xbdh \x00', 0x402}) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000180)={'vd\x7f\x00\x16\x00\xf9V\xdbZ\xdd\x91\x80\xd2{\x00', 0x43732e5398417f1e}) close(r0) [ 1101.920810] CPU: 1 PID: 18537 Comm: syz-executor.4 Not tainted 4.4.174+ #4 [ 1101.920822] 0000000000000000 7e16e5f38819d8ce ffff8801b85379f0 ffffffff81aad1a1 [ 1101.920837] 1ffff100370a6f41 ffff8801d97f0000 00000000024000c2 0000000000000000 12:14:43 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) 12:14:43 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) [ 1101.920851] ffffffff82895080 ffff8801b8537b00 ffffffff8148c0cb ffffffff00000001 12:14:43 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) 12:14:43 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) ** 17 printk messages dropped ** [ 1101.921020] [] ? check_preemption_disabled+0x3c/0x200 12:14:43 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) 12:14:43 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x6, 0x1100082) r1 = memfd_create(&(0x7f0000000080)='t\bnu\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00', 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000340)=[{&(0x7f0000001140)='\'', 0x1}], 0x1, 0x1081804) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendfile(r0, r0, 0x0, 0x200000d) ioctl$LOOP_CLR_FD(r0, 0x4c01) syz_genetlink_get_family_id$tipc(0x0) dup3(r1, r0, 0x0) ** 52 printk messages dropped ** [ 1104.564101] [] warn_alloc_failed.cold+0x78/0x99 [ 1104.564113] [] ? zone_watermark_ok_safe+0x290/0x290 ** 47 printk messages dropped ** [ 1104.636610] Call Trace: [ 1104.636625] [] dump_stack+0xc1/0x120 [ 1104.636638] [] warn_alloc_failed.cold+0x78/0x99 [ 1104.636649] [] ? zone_watermark_ok_safe+0x290/0x290 [ 1104.636658] [] ? sel_write_load+0x9e/0xf90 [ 1104.636668] [] __vmalloc_node_range+0x365/0x650 [ 1104.636677] [] ? check_preemption_disabled+0x3c/0x200 [ 1104.636686] [] ? check_preemption_disabled+0x3c/0x200 [ 1104.636697] [] ? task_has_security+0x130/0x270 [ 1104.636705] [] vmalloc+0x5c/0x70 [ 1104.636715] [] ? sel_write_load+0x119/0xf90 [ 1104.636723] [] sel_write_load+0x119/0xf90 [ 1104.636732] [] ? sel_read_bool+0x240/0x240 [ 1104.636740] [] ? trace_hardirqs_on+0x10/0x10 [ 1104.636751] [] __vfs_write+0x116/0x3d0 [ 1104.636758] [] ? sel_read_bool+0x240/0x240 [ 1104.636767] [] ? __vfs_read+0x3c0/0x3c0 [ 1104.636776] [] ? check_preemption_disabled+0x3c/0x200 [ 1104.636785] [] ? check_preemption_disabled+0x3c/0x200 [ 1104.636797] [] ? rcu_read_lock_sched_held+0x10b/0x130 [ 1104.636805] [] ? rcu_sync_lockdep_assert+0x73/0xb0 [ 1104.636815] [] ? __sb_start_write+0x14f/0x310 [ 1104.636824] [] vfs_write+0x182/0x4e0 [ 1104.636833] [] SyS_write+0xdc/0x1c0 [ 1104.636842] [] ? SyS_read+0x1c0/0x1c0 [ 1104.636855] [] ? lockdep_sys_exit_thunk+0x12/0x14 [ 1104.636866] [] entry_SYSCALL_64_fastpath+0x1e/0x9a [ 1104.636869] Mem-Info: [ 1104.636894] active_anon:70056 inactive_anon:5700 isolated_anon:0 [ 1104.636894] active_file:11182 inactive_file:11777 isolated_file:0 [ 1104.636894] unevictable:0 dirty:47 writeback:0 unstable:0 [ 1104.636894] slab_reclaimable:4389 slab_unreclaimable:63405 [ 1104.636894] mapped:59001 shmem:8152 pagetables:8515 bounce:0 [ 1104.636894] free:1407116 free_pcp:504 free_cma:0 [ 1104.636928] DMA32 free:2577252kB min:4696kB low:5868kB high:7044kB active_anon:127460kB inactive_anon:10284kB active_file:19752kB inactive_file:20788kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:3145324kB managed:3021976kB mlocked:0kB dirty:8kB writeback:0kB mapped:108032kB shmem:14324kB slab_reclaimable:8340kB slab_unreclaimable:112820kB kernel_stack:6304kB pagetables:15204kB unstable:0kB bounce:0kB free_pcp:952kB local_pcp:456kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no [ 1104.636938] lowmem_reserve[]: 0 3504 3504 [ 1104.636972] Normal free:3051212kB min:5580kB low:6972kB high:8368kB active_anon:152764kB inactive_anon:12516kB active_file:24976kB inactive_file:26320kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:4718592kB managed:3588764kB mlocked:0kB dirty:180kB writeback:0kB mapped:127972kB shmem:18284kB slab_reclaimable:9216kB slab_unreclaimable:140800kB kernel_stack:7808kB pagetables:18856kB unstable:0kB bounce:0kB free_pcp:1064kB local_pcp:552kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no [ 1104.636982] lowmem_reserve[]: 0 0 0 12:14:43 executing program 2: openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r0 = creat(&(0x7f0000000700)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x40000006100) ftruncate(r0, 0x208203) r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000008000/0x600000)=nil, 0x600000, 0x800002, 0x11, r1, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r2, &(0x7f0000000180)={0xa, 0x4e24, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) sendmmsg(r2, &(0x7f00000092c0), 0x4ff, 0x0) r3 = open(&(0x7f00000003c0)='./bus\x00', 0x0, 0x0) sendfile(r0, r3, 0x0, 0x8000fffffffe) r4 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r4, 0x1000008912, &(0x7f0000000000)="11dca5055e0acfec7be070") 12:14:43 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) 12:14:43 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) 12:14:43 executing program 0: openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)={'vet\x00\x00\x96T\x00\x00\x00\x00\x00\xbdh \x00', 0x402}) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000180)={'vd\x7f\x00\x16\x00\xf9V\xdbZ\xdd\x91\x80\xd2{\x00', 0x43732e5398417f1e}) close(r0) 12:14:43 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) 12:14:43 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x6, 0x1100082) r1 = memfd_create(&(0x7f0000000080)='t\bnu\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00', 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000340)=[{&(0x7f0000001140)='\'', 0x1}], 0x1, 0x1081804) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendfile(r0, r0, 0x0, 0x200000d) ioctl$LOOP_CLR_FD(r0, 0x4c01) syz_genetlink_get_family_id$tipc(0x0) dup3(r1, r0, 0x0) 12:14:43 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) [ 1104.637045] DMA32: 713*4kB (UME) 381*8kB (UME) 345*16kB (UME) 157*32kB (UME) 51*64kB (ME) 25*128kB (UME) 12*256kB (UM) 5*512kB (M) 1*1024kB (E) 2*2048kB (UE) 621*4096kB (M) = 2577276kB 12:14:43 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) 12:14:43 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) ** 17 printk messages dropped ** [ 1104.731113] Call Trace: [ 1104.731128] [] dump_stack+0xc1/0x120 12:14:44 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) 12:14:44 executing program 0: openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)={'vet\x00\x00\x96T\x00\x00\x00\x00\x00\xbdh \x00', 0x402}) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000180)={'vd\x7f\x00\x16\x00\xf9V\xdbZ\xdd\x91\x80\xd2{\x00', 0x43732e5398417f1e}) close(r0) 12:14:44 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x6, 0x1100082) r1 = memfd_create(&(0x7f0000000080)='t\bnu\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00', 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000340)=[{&(0x7f0000001140)='\'', 0x1}], 0x1, 0x1081804) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendfile(r0, r0, 0x0, 0x200000d) ioctl$LOOP_CLR_FD(r0, 0x4c01) syz_genetlink_get_family_id$tipc(0x0) dup3(r1, r0, 0x0) [ 1104.731140] [] warn_alloc_failed.cold+0x78/0x99 [ 1104.731151] [] ? zone_watermark_ok_safe+0x290/0x290 [ 1104.731161] [] ? sel_write_load+0x9e/0xf90 [ 1104.731173] [] __vmalloc_node_range+0x365/0x650 [ 1104.731184] [] ? check_preemption_disabled+0x3c/0x200 [ 1104.731192] [] ? check_preemption_disabled+0x3c/0x200 [ 1104.731200] [] ? task_has_security+0x130/0x270 [ 1104.731208] [] vmalloc+0x5c/0x70 [ 1104.731216] [] ? sel_write_load+0x119/0xf90 [ 1104.731224] [] sel_write_load+0x119/0xf90 [ 1104.731232] [] ? sel_read_bool+0x240/0x240 [ 1104.731242] [] ? trace_hardirqs_on+0x10/0x10 [ 1104.731250] [] __vfs_write+0x116/0x3d0 [ 1104.731258] [] ? sel_read_bool+0x240/0x240 [ 1104.731266] [] ? __vfs_read+0x3c0/0x3c0 [ 1104.731276] [] ? check_preemption_disabled+0x3c/0x200 [ 1104.731286] [] ? check_preemption_disabled+0x3c/0x200 [ 1104.731300] [] ? rcu_read_lock_sched_held+0x10b/0x130 [ 1104.731310] [] ? rcu_sync_lockdep_assert+0x73/0xb0 [ 1104.731320] [] ? __sb_start_write+0x14f/0x310 [ 1104.731329] [] vfs_write+0x182/0x4e0 [ 1104.731339] [] SyS_write+0xdc/0x1c0 [ 1104.731346] [] ? SyS_read+0x1c0/0x1c0 [ 1104.731357] [] ? lockdep_sys_exit_thunk+0x12/0x14 [ 1104.731367] [] entry_SYSCALL_64_fastpath+0x1e/0x9a [ 1104.731370] Mem-Info: [ 1104.731397] active_anon:70056 inactive_anon:6050 isolated_anon:0 [ 1104.731397] active_file:11182 inactive_file:11777 isolated_file:0 [ 1104.731397] unevictable:0 dirty:47 writeback:0 unstable:0 [ 1104.731397] slab_reclaimable:4389 slab_unreclaimable:63404 [ 1104.731397] mapped:59038 shmem:8522 pagetables:8515 bounce:0 [ 1104.731397] free:1406714 free_pcp:523 free_cma:0 [ 1104.731431] DMA32 free:2576372kB min:4696kB low:5868kB high:7044kB active_anon:127360kB inactive_anon:10884kB active_file:19752kB inactive_file:20788kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:3145324kB managed:3021976kB mlocked:0kB dirty:8kB writeback:0kB mapped:108032kB shmem:14916kB slab_reclaimable:8340kB slab_unreclaimable:112920kB kernel_stack:6304kB pagetables:15352kB unstable:0kB bounce:0kB free_pcp:1044kB local_pcp:544kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no [ 1104.731439] lowmem_reserve[]: 0 3504 3504 [ 1104.731474] Normal free:3050484kB min:5580kB low:6972kB high:8368kB active_anon:152864kB inactive_anon:13316kB active_file:24976kB inactive_file:26320kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:4718592kB managed:3588764kB mlocked:0kB dirty:180kB writeback:0kB mapped:128120kB shmem:19172kB slab_reclaimable:9216kB slab_unreclaimable:140696kB kernel_stack:7808kB pagetables:18708kB unstable:0kB bounce:0kB free_pcp:1020kB local_pcp:444kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no [ 1104.731483] lowmem_reserve[]: 0 0 0 [ 1104.731541] DMA32: 529*4kB (UME) 380*8kB (UME) 345*16kB (UME) 156*32kB (UME) 51*64kB (ME) 24*128kB (UME) 12*256kB (UM) 5*512kB (M) 1*1024kB (E) 2*2048kB (UE) 621*4096kB (M) = 2576372kB [ 1104.731596] Normal: 115*4kB (U) 215*8kB (UME) 282*16kB (UME) 171*32kB (UM) 69*64kB (UME) 34*128kB (UME) 10*256kB (UM) 8*512kB (UME) 4*1024kB (M) 4*2048kB (UME) 735*4096kB (M) = 3050436kB [ 1104.731599] 31480 total pagecache pages [ 1104.731603] 0 pages in swap cache [ 1104.731608] Swap cache stats: add 0, delete 0, find 0/0 [ 1104.731611] Free swap = 0kB [ 1104.731614] Total swap = 0kB [ 1104.731616] 1965979 pages RAM [ 1104.731620] 0 pages HighMem/MovableOnly 12:14:44 executing program 2: openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r0 = creat(&(0x7f0000000700)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x40000006100) ftruncate(r0, 0x208203) r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000008000/0x600000)=nil, 0x600000, 0x800002, 0x11, r1, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r2, &(0x7f0000000180)={0xa, 0x4e24, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) sendmmsg(r2, &(0x7f00000092c0), 0x4ff, 0x0) r3 = open(&(0x7f00000003c0)='./bus\x00', 0x0, 0x0) sendfile(r0, r3, 0x0, 0x8000fffffffe) r4 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r4, 0x1000008912, &(0x7f0000000000)="11dca5055e0acfec7be070") 12:14:44 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) 12:14:44 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) 12:14:44 executing program 0: openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)={'vet\x00\x00\x96T\x00\x00\x00\x00\x00\xbdh \x00', 0x402}) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000180)={'vd\x7f\x00\x16\x00\xf9V\xdbZ\xdd\x91\x80\xd2{\x00', 0x43732e5398417f1e}) close(r0) 12:14:44 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) 12:14:44 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x6, 0x1100082) r1 = memfd_create(&(0x7f0000000080)='t\bnu\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00', 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000340)=[{&(0x7f0000001140)='\'', 0x1}], 0x1, 0x1081804) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendfile(r0, r0, 0x0, 0x200000d) ioctl$LOOP_CLR_FD(r0, 0x4c01) syz_genetlink_get_family_id$tipc(0x0) dup3(r1, r0, 0x0) [ 1104.731622] 313294 pages reserved [ 1104.779353] binder: 18716:18720 transaction failed 29189/-22, size 0-0 line 3014 [ 1104.779550] binder: undelivered TRANSACTION_ERROR: 29189 [ 1105.447372] binder: 18728:18735 transaction failed 29189/-22, size 0-0 line 3014 [ 1105.447599] binder: undelivered TRANSACTION_ERROR: 29189 12:14:44 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) 12:14:44 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) 12:14:44 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) [ 1105.448967] vmalloc: allocation failure: 0 bytes [ 1105.448972] syz-executor.4: page allocation failure: order:0, mode:0x24000c2 12:14:44 executing program 0: openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)={'vet\x00\x00\x96T\x00\x00\x00\x00\x00\xbdh \x00', 0x402}) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000180)={'vd\x7f\x00\x16\x00\xf9V\xdbZ\xdd\x91\x80\xd2{\x00', 0x43732e5398417f1e}) close(r0) [ 1105.448981] CPU: 1 PID: 18736 Comm: syz-executor.4 Not tainted 4.4.174+ #4 [ 1105.448993] 0000000000000000 612305e53fae5b10 ffff8801becc79f0 ffffffff81aad1a1 12:14:44 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) 12:14:44 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) [ 1105.449004] 1ffff10037d98f41 ffff8800a42697c0 00000000024000c2 0000000000000000 [ 1105.449014] ffffffff82895080 ffff8801becc7b00 ffffffff8148c0cb ffffffff00000001 [ 1105.449017] Call Trace: [ 1105.449033] [] dump_stack+0xc1/0x120 [ 1105.449046] [] warn_alloc_failed.cold+0x78/0x99 [ 1105.449058] [] ? zone_watermark_ok_safe+0x290/0x290 [ 1105.449068] [] ? sel_write_load+0x9e/0xf90 [ 1105.449077] [] __vmalloc_node_range+0x365/0x650 [ 1105.449086] [] ? check_preemption_disabled+0x3c/0x200 [ 1105.449094] [] ? check_preemption_disabled+0x3c/0x200 [ 1105.449101] [] ? task_has_security+0x130/0x270 [ 1105.449109] [] vmalloc+0x5c/0x70 [ 1105.449117] [] ? sel_write_load+0x119/0xf90 [ 1105.449124] [] sel_write_load+0x119/0xf90 [ 1105.449132] [] ? sel_read_bool+0x240/0x240 [ 1105.449149] [] ? trace_hardirqs_on+0x10/0x10 [ 1105.449160] [] __vfs_write+0x116/0x3d0 [ 1105.449168] [] ? sel_read_bool+0x240/0x240 [ 1105.449177] [] ? __vfs_read+0x3c0/0x3c0 [ 1105.449187] [] ? check_preemption_disabled+0x3c/0x200 [ 1105.449197] [] ? check_preemption_disabled+0x3c/0x200 [ 1105.449208] [] ? rcu_read_lock_sched_held+0x10b/0x130 [ 1105.449217] [] ? rcu_sync_lockdep_assert+0x73/0xb0 [ 1105.449226] [] ? __sb_start_write+0x14f/0x310 [ 1105.449234] [] vfs_write+0x182/0x4e0 [ 1105.449241] [] SyS_write+0xdc/0x1c0 [ 1105.449249] [] ? SyS_read+0x1c0/0x1c0 [ 1105.449259] [] ? lockdep_sys_exit_thunk+0x12/0x14 [ 1105.449269] [] entry_SYSCALL_64_fastpath+0x1e/0x9a [ 1105.450531] Mem-Info: [ 1105.450560] active_anon:70081 inactive_anon:5725 isolated_anon:0 [ 1105.450560] active_file:11182 inactive_file:11777 isolated_file:0 [ 1105.450560] unevictable:0 dirty:47 writeback:0 unstable:0 [ 1105.450560] slab_reclaimable:4389 slab_unreclaimable:63571 [ 1105.450560] mapped:58964 shmem:8189 pagetables:8478 bounce:0 [ 1105.450560] free:1406994 free_pcp:554 free_cma:0 [ 1105.450599] DMA32 free:2576716kB min:4696kB low:5868kB high:7044kB active_anon:127628kB inactive_anon:10244kB active_file:19752kB inactive_file:20788kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:3145324kB managed:3021976kB mlocked:0kB dirty:8kB writeback:0kB mapped:107824kB shmem:14388kB slab_reclaimable:8340kB slab_unreclaimable:113184kB kernel_stack:6240kB pagetables:15284kB unstable:0kB bounce:0kB free_pcp:1176kB local_pcp:696kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no [ 1105.450610] lowmem_reserve[]: 0 3504 3504 12:14:45 executing program 2: openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r0 = creat(&(0x7f0000000700)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x40000006100) ftruncate(r0, 0x208203) r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000008000/0x600000)=nil, 0x600000, 0x800002, 0x11, r1, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r2, &(0x7f0000000180)={0xa, 0x4e24, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) sendmmsg(r2, &(0x7f00000092c0), 0x4ff, 0x0) r3 = open(&(0x7f00000003c0)='./bus\x00', 0x0, 0x0) sendfile(r0, r3, 0x0, 0x8000fffffffe) r4 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r4, 0x1000008912, &(0x7f0000000000)="11dca5055e0acfec7be070") 12:14:45 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) 12:14:45 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x6, 0x1100082) r1 = memfd_create(&(0x7f0000000080)='t\bnu\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00', 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000340)=[{&(0x7f0000001140)='\'', 0x1}], 0x1, 0x1081804) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendfile(r0, r0, 0x0, 0x200000d) ioctl$LOOP_CLR_FD(r0, 0x4c01) syz_genetlink_get_family_id$tipc(0x0) dup3(r1, r0, 0x0) 12:14:45 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) 12:14:45 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) 12:14:45 executing program 0: openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)={'vet\x00\x00\x96T\x00\x00\x00\x00\x00\xbdh \x00', 0x402}) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000180)={'vd\x7f\x00\x16\x00\xf9V\xdbZ\xdd\x91\x80\xd2{\x00', 0x43732e5398417f1e}) close(r0) [ 1105.450643] Normal free:3051260kB min:5580kB low:6972kB high:8368kB active_anon:152696kB inactive_anon:12656kB active_file:24976kB inactive_file:26320kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:4718592kB managed:3588764kB mlocked:0kB dirty:180kB writeback:0kB mapped:128032kB shmem:18368kB slab_reclaimable:9216kB slab_unreclaimable:141100kB kernel_stack:7872kB pagetables:18628kB unstable:0kB bounce:0kB free_pcp:1040kB local_pcp:484kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no 12:14:45 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) 12:14:45 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) [ 1105.450653] lowmem_reserve[]: 0 0 0 [ 1105.450715] DMA32: 574*4kB (UME) 337*8kB (UME) 345*16kB (UME) 163*32kB (UME) 51*64kB (ME) 25*128kB (UME) 12*256kB (UM) 5*512kB (M) 1*1024kB (E) 2*2048kB (UE) 621*4096kB (M) = 2576560kB 12:14:45 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) 12:14:45 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) 12:14:45 executing program 0: openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)={'vet\x00\x00\x96T\x00\x00\x00\x00\x00\xbdh \x00', 0x402}) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000180)={'vd\x7f\x00\x16\x00\xf9V\xdbZ\xdd\x91\x80\xd2{\x00', 0x43732e5398417f1e}) close(r0) [ 1105.450777] Normal: 251*4kB (UM) 210*8kB (UME) 282*16kB (UME) 183*32kB (UM) 69*64kB (UME) 33*128kB (UME) 10*256kB (UM) 8*512kB (UME) 4*1024kB (M) 4*2048kB (UME) 735*4096kB (M) = 3051196kB 12:14:45 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) [ 1105.450780] 31147 total pagecache pages [ 1105.450784] 0 pages in swap cache [ 1105.450790] Swap cache stats: add 0, delete 0, find 0/0 [ 1105.450793] Free swap = 0kB [ 1105.450796] Total swap = 0kB [ 1105.451718] 1965979 pages RAM [ 1105.451721] 0 pages HighMem/MovableOnly [ 1105.451724] 313294 pages reserved [ 1105.513968] vmalloc: allocation failure: 0 bytes [ 1105.513975] syz-executor.4: page allocation failure: order:0, mode:0x24000c2 [ 1105.513985] CPU: 0 PID: 18746 Comm: syz-executor.4 Not tainted 4.4.174+ #4 [ 1105.513998] 0000000000000000 228a822d1566bfd8 ffff8800a477f9f0 ffffffff81aad1a1 [ 1105.514008] 1ffff100148eff41 ffff8801d14a0000 00000000024000c2 0000000000000000 [ 1105.514017] ffffffff82895080 ffff8800a477fb00 ffffffff8148c0cb ffffffff00000001 [ 1105.514019] Call Trace: [ 1105.514036] [] dump_stack+0xc1/0x120 [ 1105.514050] [] warn_alloc_failed.cold+0x78/0x99 [ 1105.514065] [] ? zone_watermark_ok_safe+0x290/0x290 [ 1105.514074] [] ? sel_write_load+0x9e/0xf90 [ 1105.514086] [] __vmalloc_node_range+0x365/0x650 [ 1105.514096] [] ? check_preemption_disabled+0x3c/0x200 [ 1105.514105] [] ? check_preemption_disabled+0x3c/0x200 [ 1105.514113] [] ? task_has_security+0x130/0x270 [ 1105.514121] [] vmalloc+0x5c/0x70 [ 1105.514128] [] ? sel_write_load+0x119/0xf90 [ 1105.514136] [] sel_write_load+0x119/0xf90 [ 1105.514144] [] ? sel_read_bool+0x240/0x240 [ 1105.514153] [] ? trace_hardirqs_on+0x10/0x10 [ 1105.514162] [] __vfs_write+0x116/0x3d0 [ 1105.514169] [] ? sel_read_bool+0x240/0x240 [ 1105.514176] [] ? __vfs_read+0x3c0/0x3c0 12:14:46 executing program 2: openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r0 = creat(&(0x7f0000000700)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x40000006100) ftruncate(r0, 0x208203) r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000008000/0x600000)=nil, 0x600000, 0x800002, 0x11, r1, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r2, &(0x7f0000000180)={0xa, 0x4e24, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) sendmmsg(r2, &(0x7f00000092c0), 0x4ff, 0x0) r3 = open(&(0x7f00000003c0)='./bus\x00', 0x0, 0x0) sendfile(r0, r3, 0x0, 0x8000fffffffe) r4 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r4, 0x1000008912, &(0x7f0000000000)="11dca5055e0acfec7be070") 12:14:46 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) 12:14:46 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x6, 0x1100082) r1 = memfd_create(&(0x7f0000000080)='t\bnu\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00', 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000340)=[{&(0x7f0000001140)='\'', 0x1}], 0x1, 0x1081804) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendfile(r0, r0, 0x0, 0x200000d) ioctl$LOOP_CLR_FD(r0, 0x4c01) syz_genetlink_get_family_id$tipc(0x0) dup3(r1, r0, 0x0) 12:14:46 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) 12:14:46 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) 12:14:46 executing program 0: openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)={'vet\x00\x00\x96T\x00\x00\x00\x00\x00\xbdh \x00', 0x402}) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000180)={'vd\x7f\x00\x16\x00\xf9V\xdbZ\xdd\x91\x80\xd2{\x00', 0x43732e5398417f1e}) close(r0) [ 1105.514185] [] ? check_preemption_disabled+0x3c/0x200 [ 1105.514192] [] ? check_preemption_disabled+0x3c/0x200 [ 1105.514202] [] ? rcu_read_lock_sched_held+0x10b/0x130 12:14:46 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) 12:14:46 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) [ 1105.514210] [] ? rcu_sync_lockdep_assert+0x73/0xb0 12:14:46 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) 12:14:46 executing program 0: openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)={'vet\x00\x00\x96T\x00\x00\x00\x00\x00\xbdh \x00', 0x402}) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000180)={'vd\x7f\x00\x16\x00\xf9V\xdbZ\xdd\x91\x80\xd2{\x00', 0x43732e5398417f1e}) close(r0) [ 1105.514218] [] ? __sb_start_write+0x14f/0x310 [ 1105.514226] [] vfs_write+0x182/0x4e0 [ 1105.514234] [] SyS_write+0xdc/0x1c0 12:14:46 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x6, 0x1100082) r1 = memfd_create(&(0x7f0000000080)='t\bnu\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00', 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000340)=[{&(0x7f0000001140)='\'', 0x1}], 0x1, 0x1081804) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendfile(r0, r0, 0x0, 0x200000d) ioctl$LOOP_CLR_FD(r0, 0x4c01) syz_genetlink_get_family_id$tipc(0x0) dup3(r1, r0, 0x0) 12:14:46 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) [ 1105.514241] [] ? SyS_read+0x1c0/0x1c0 [ 1105.514251] [] ? lockdep_sys_exit_thunk+0x12/0x14 [ 1105.514260] [] entry_SYSCALL_64_fastpath+0x1e/0x9a [ 1105.514264] Mem-Info: [ 1105.514289] active_anon:70106 inactive_anon:5725 isolated_anon:0 [ 1105.514289] active_file:11182 inactive_file:11777 isolated_file:0 [ 1105.514289] unevictable:0 dirty:47 writeback:0 unstable:0 [ 1105.514289] slab_reclaimable:4389 slab_unreclaimable:63396 [ 1105.514289] mapped:58964 shmem:8189 pagetables:8589 bounce:0 [ 1105.514289] free:1407071 free_pcp:476 free_cma:0 [ 1105.514323] DMA32 free:2576464kB min:4696kB low:5868kB high:7044kB active_anon:127728kB inactive_anon:10244kB active_file:19752kB inactive_file:20788kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:3145324kB managed:3021976kB mlocked:0kB dirty:8kB writeback:0kB mapped:107824kB shmem:14388kB slab_reclaimable:8340kB slab_unreclaimable:113184kB kernel_stack:6240kB pagetables:15728kB unstable:0kB bounce:0kB free_pcp:648kB local_pcp:96kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no [ 1105.514332] lowmem_reserve[]: 0 3504 3504 [ 1105.514367] Normal free:3051820kB min:5580kB low:6972kB high:8368kB active_anon:152696kB inactive_anon:12656kB active_file:24976kB inactive_file:26320kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:4718592kB managed:3588764kB mlocked:0kB dirty:180kB writeback:0kB mapped:128032kB shmem:18368kB slab_reclaimable:9216kB slab_unreclaimable:140400kB kernel_stack:7872kB pagetables:18628kB unstable:0kB bounce:0kB free_pcp:1256kB local_pcp:588kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no [ 1105.514375] lowmem_reserve[]: 0 0 0 [ 1105.514431] DMA32: 572*4kB (UME) 339*8kB (UME) 345*16kB (UME) 159*32kB (UME) 51*64kB (ME) 25*128kB (UME) 12*256kB (UM) 5*512kB (M) 1*1024kB (E) 2*2048kB (UE) 621*4096kB (M) = 2576440kB [ 1105.514487] Normal: 369*4kB (UM) 228*8kB (UME) 282*16kB (UME) 185*32kB (UM) 69*64kB (UME) 33*128kB (UME) 10*256kB (UM) 8*512kB (UME) 4*1024kB (M) 4*2048kB (UME) 735*4096kB (M) = 3051876kB [ 1105.514489] 31147 total pagecache pages [ 1105.514493] 0 pages in swap cache [ 1105.514497] Swap cache stats: add 0, delete 0, find 0/0 [ 1105.514501] Free swap = 0kB [ 1105.514503] Total swap = 0kB [ 1105.514506] 1965979 pages RAM [ 1105.514510] 0 pages HighMem/MovableOnly [ 1105.514512] 313294 pages reserved [ 1105.534682] binder: 18740:18751 transaction failed 29189/-22, size 0-0 line 3014 [ 1105.535005] binder: undelivered TRANSACTION_ERROR: 29189 [ 1105.641543] vmalloc: allocation failure: 0 bytes [ 1105.641549] syz-executor.4: page allocation failure: order:0, mode:0x24000c2 12:14:47 executing program 2: openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r0 = creat(&(0x7f0000000700)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x40000006100) ftruncate(r0, 0x208203) r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000008000/0x600000)=nil, 0x600000, 0x800002, 0x11, r1, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) connect$inet6(r2, &(0x7f0000000180)={0xa, 0x4e24, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) sendmmsg(r2, &(0x7f00000092c0), 0x4ff, 0x0) r3 = open(&(0x7f00000003c0)='./bus\x00', 0x0, 0x0) sendfile(r0, r3, 0x0, 0x8000fffffffe) r4 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r4, 0x1000008912, &(0x7f0000000000)="11dca5055e0acfec7be070") 12:14:47 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) 12:14:47 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) 12:14:47 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) 12:14:47 executing program 0: openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000100)={'vet\x00\x00\x96T\x00\x00\x00\x00\x00\xbdh \x00', 0x402}) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000180)={'vd\x7f\x00\x16\x00\xf9V\xdbZ\xdd\x91\x80\xd2{\x00', 0x43732e5398417f1e}) close(r0) 12:14:47 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x6, 0x1100082) r1 = memfd_create(&(0x7f0000000080)='t\bnu\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00', 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000340)=[{&(0x7f0000001140)='\'', 0x1}], 0x1, 0x1081804) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendfile(r0, r0, 0x0, 0x200000d) ioctl$LOOP_CLR_FD(r0, 0x4c01) syz_genetlink_get_family_id$tipc(0x0) dup3(r1, r0, 0x0) [ 1105.641559] CPU: 1 PID: 18761 Comm: syz-executor.4 Not tainted 4.4.174+ #4 [ 1105.641572] 0000000000000000 48bf767b0cc838f1 ffff8801b8d9f9f0 ffffffff81aad1a1 [ 1105.641584] 1ffff100371b3f41 ffff8801d1c9df00 00000000024000c2 0000000000000000 [ 1105.641595] ffffffff82895080 ffff8801b8d9fb00 ffffffff8148c0cb ffffffff00000001 12:14:47 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) 12:14:47 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) 12:14:47 executing program 1: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)="c0dca5055e") r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper={0x40486311}], 0x0, 0xfffffdfd, 0x0}) [ 1105.641598] Call Trace: [ 1105.641614] [] dump_stack+0xc1/0x120 [ 1105.641626] [] warn_alloc_failed.cold+0x78/0x99 [ 1105.641638] [] ? zone_watermark_ok_safe+0x290/0x290 12:14:47 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x6, 0x1100082) r1 = memfd_create(&(0x7f0000000080)='t\bnu\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00', 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000340)=[{&(0x7f0000001140)='\'', 0x1}], 0x1, 0x1081804) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendfile(r0, r0, 0x0, 0x200000d) ioctl$LOOP_CLR_FD(r0, 0x4c01) syz_genetlink_get_family_id$tipc(0x0) dup3(r1, r0, 0x0) 12:14:47 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(0xffffffffffffffff, 0x0, 0x0) [ 1105.641648] [] ? sel_write_load+0x9e/0xf90 12:14:47 executing program 4: open$dir(&(0x7f0000000400)='./file0\x00', 0x216800, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000002c0)={'filter\x00', 0x0, 0x4, 0x0, [], 0x0, &(0x7f0000000200), 0x0}, &(0x7f0000000340)=0x78) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, 0x0, 0x0) [ 1105.641658] [] __vmalloc_node_range+0x365/0x650 [ 1105.641668] [] ? check_preemption_disabled+0x3c/0x200 [ 1105.641676] [] ? check_preemption_disabled+0x3c/0x200 ** 11 printk messages dropped ** [ 1105.641793] [] ? rcu_read_lock_sched_held+0x10b/0x130 [ 1105.641801] [] ? rcu_sync_lockdep_assert+0x73/0xb0 [ 1105.641812] [] ? __sb_start_write+0x14f/0x310 [ 1105.641820] [] vfs_write+0x182/0x4e0 [ 1105.641829] [] SyS_write+0xdc/0x1c0 [ 1105.641837] [] ? SyS_read+0x1c0/0x1c0 [ 1105.641847] [] ? lockdep_sys_exit_thunk+0x12/0x14 [ 1105.641855] [] entry_SYSCALL_64_fastpath+0x1e/0x9a [ 1105.643602] Mem-Info: [ 1105.643630] active_anon:70156 inactive_anon:6175 isolated_anon:0 [ 1105.643630] active_file:11182 inactive_file:11777 isolated_file:0 [ 1105.643630] unevictable:0 dirty:47 writeback:0 unstable:0 [ 1105.643630] slab_reclaimable:4389 slab_unreclaimable:63421 [ 1105.643630] mapped:59001 shmem:8633 pagetables:8552 bounce:0 [ 1105.643630] free:1406596 free_pcp:384 free_cma:0 [ 1105.643663] DMA32 free:2576024kB min:4696kB low:5868kB high:7044kB active_anon:127728kB inactive_anon:10744kB active_file:19752kB inactive_file:20788kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:3145324kB managed:3021976kB mlocked:0kB dirty:8kB writeback:0kB mapped:107824kB shmem:14832kB slab_reclaimable:8340kB slab_unreclaimable:113184kB kernel_stack:6240kB pagetables:15432kB unstable:0kB bounce:0kB free_pcp:904kB local_pcp:324kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no [ 1105.643673] lowmem_reserve[]: 0 3504 3504 [ 1105.643707] Normal free:3050360kB min:5580kB low:6972kB high:8368kB active_anon:152896kB inactive_anon:13956kB active_file:24976kB inactive_file:26320kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:4718592kB managed:3588764kB mlocked:0kB dirty:180kB writeback:0kB mapped:128180kB shmem:19700kB slab_reclaimable:9216kB slab_unreclaimable:140500kB kernel_stack:7872kB pagetables:18776kB unstable:0kB bounce:0kB free_pcp:632kB local_pcp:268kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no ** 126 printk messages dropped ** [ 1106.405662] [] ? check_preemption_disabled+0x3c/0x200 [ 1106.405671] [] ? task_has_security+0x130/0x270 [ 1106.405678] [] vmalloc+0x5c/0x70 [ 1106.405686] [] ? sel_write_load+0x119/0xf90 [ 1106.405692] [] sel_write_load+0x119/0xf90 [ 1106.405700] [] ? sel_read_bool+0x240/0x240 [ 1106.405710] [] ? trace_hardirqs_on+0x10/0x10 [ 1106.405718] [] __vfs_write+0x116/0x3d0 [ 1106.405725] [] ? sel_read_bool+0x240/0x240 [ 1106.405733] [] ? __vfs_read+0x3c0/0x3c0 [ 1106.405741] [] ? check_preemption_disabled+0x3c/0x200 [ 1106.405749] [] ? check_preemption_disabled+0x3c/0x200 [ 1106.405759] [] ? rcu_read_lock_sched_held+0x10b/0x130 [ 1106.405767] [] ? rcu_sync_lockdep_assert+0x73/0xb0 [ 1106.405775] [] ? __sb_start_write+0x14f/0x310 [ 1106.405783] [] vfs_write+0x182/0x4e0 [ 1106.405791] [] SyS_write+0xdc/0x1c0 [ 1106.405798] [] ? SyS_read+0x1c0/0x1c0 [ 1106.405808] [] ? lockdep_sys_exit_thunk+0x12/0x14 [ 1106.405819] [] entry_SYSCALL_64_fastpath+0x1e/0x9a [ 1106.405822] Mem-Info: [ 1106.405848] active_anon:70064 inactive_anon:6173 isolated_anon:0 [ 1106.405848] active_file:11182 inactive_file:11777 isolated_file:0 [ 1106.405848] unevictable:0 dirty:47 writeback:0 unstable:0 [ 1106.405848] slab_reclaimable:4385 slab_unreclaimable:63319 [ 1106.405848] mapped:58998 shmem:8667 pagetables:8527 bounce:0 [ 1106.405848] free:1406823 free_pcp:312 free_cma:0 [ 1106.405880] DMA32 free:2576632kB min:4696kB low:5868kB high:7044kB active_anon:127616kB inactive_anon:10804kB active_file:19752kB inactive_file:20788kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:3145324kB managed:3021976kB mlocked:0kB dirty:8kB writeback:0kB mapped:107908kB shmem:14896kB slab_reclaimable:8340kB slab_unreclaimable:112828kB kernel_stack:6528kB pagetables:15316kB unstable:0kB bounce:0kB free_pcp:692kB local_pcp:252kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no [ 1106.405890] lowmem_reserve[]: 0 3504 3504 [ 1106.405920] Normal free:3050660kB min:5580kB low:6972kB high:8368kB active_anon:152640kB inactive_anon:13888kB active_file:24976kB inactive_file:26320kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:4718592kB managed:3588764kB mlocked:0kB dirty:180kB writeback:0kB mapped:128084kB shmem:19772kB slab_reclaimable:9200kB slab_unreclaimable:140448kB kernel_stack:8064kB pagetables:18792kB unstable:0kB bounce:0kB free_pcp:552kB local_pcp:208kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no [ 1106.405929] lowmem_reserve[]: 0 0 0 [ 1106.405991] DMA32: 480*4kB (UME) 375*8kB (UME) 348*16kB (UME) 165*32kB (UME) 51*64kB (ME) 25*128kB (UME) 12*256kB (UM) 5*512kB (M) 1*1024kB (E) 2*2048kB (UE) 621*4096kB (M) = 2576600kB [ 1106.406047] Normal: 325*4kB (U) 192*8kB (UME) 283*16kB (UME) 165*32kB (UM) 66*64kB (UME) 33*128kB (UME) 10*256kB (UM) 8*512kB (UME) 4*1024kB (M) 4*2048kB (UME) 735*4096kB (M) = 3050596kB [ 1106.406051] 31625 total pagecache pages [ 1106.406054] 0 pages in swap cache [ 1106.406059] Swap cache stats: add 0, delete 0, find 0/0 [ 1106.406062] Free swap = 0kB [ 1106.406064] Total swap = 0kB [ 1106.406067] 1965979 pages RAM [ 1106.406071] 0 pages HighMem/MovableOnly [ 1106.406073] 313294 pages reserved [ 1107.091725] vmalloc: allocation failure: 0 bytes [ 1107.091731] syz-executor.4: page allocation failure: order:0, mode:0x24000c2 [ 1107.091740] CPU: 0 PID: 18826 Comm: syz-executor.4 Not tainted 4.4.174+ #4 [ 1107.091754] 0000000000000000 8f2dc5d0558a118b ffff8801d4a779f0 ffffffff81aad1a1 [ 1107.091765] 1ffff1003a94ef41 ffff8800a5e7c740 00000000024000c2 0000000000000000 [ 1107.091776] ffffffff82895080 ffff8801d4a77b00 ffffffff8148c0cb ffffffff00000001 [ 1107.091779] Call Trace: [ 1107.091795] [] dump_stack+0xc1/0x120 [ 1107.091809] [] warn_alloc_failed.cold+0x78/0x99 [ 1107.091820] [] ? zone_watermark_ok_safe+0x290/0x290 [ 1107.091830] [] ? sel_write_load+0x9e/0xf90 [ 1107.091841] [] __vmalloc_node_range+0x365/0x650 [ 1107.091854] [] ? check_preemption_disabled+0x3c/0x200 [ 1107.091862] [] ? check_preemption_disabled+0x3c/0x200 [ 1107.091872] [] ? task_has_security+0x130/0x270 [ 1107.091880] [] vmalloc+0x5c/0x70 [ 1107.091887] [] ? sel_write_load+0x119/0xf90 [ 1107.091894] [] sel_write_load+0x119/0xf90 [ 1107.091901] [] ? sel_read_bool+0x240/0x240 [ 1107.091911] [] ? trace_hardirqs_on+0x10/0x10 [ 1107.091919] [] __vfs_write+0x116/0x3d0 [ 1107.091926] [] ? sel_read_bool+0x240/0x240 [ 1107.091945] [] ? __vfs_read+0x3c0/0x3c0 [ 1107.091957] [] ? check_preemption_disabled+0x3c/0x200 [ 1107.091967] [] ? check_preemption_disabled+0x3c/0x200 [ 1107.091978] [] ? rcu_read_lock_sched_held+0x10b/0x130 [ 1107.091987] [] ? rcu_sync_lockdep_assert+0x73/0xb0 [ 1107.091997] [] ? __sb_start_write+0x14f/0x310 [ 1107.092005] [] vfs_write+0x182/0x4e0 [ 1107.092012] [] SyS_write+0xdc/0x1c0 [ 1107.092020] [] ? SyS_read+0x1c0/0x1c0 [ 1107.092029] [] ? lockdep_sys_exit_thunk+0x12/0x14 [ 1107.092040] [] entry_SYSCALL_64_fastpath+0x1e/0x9a [ 1107.092043] Mem-Info: [ 1107.092068] active_anon:70014 inactive_anon:5698 isolated_anon:0 [ 1107.092068] active_file:11182 inactive_file:11777 isolated_file:0 [ 1107.092068] unevictable:0 dirty:47 writeback:0 unstable:0 [ 1107.092068] slab_reclaimable:4385 slab_unreclaimable:63149 [ 1107.092068] mapped:58961 shmem:8149 pagetables:8527 bounce:0 [ 1107.092068] free:1407489 free_pcp:524 free_cma:0 [ 1107.092097] DMA32 free:2577424kB min:4696kB low:5868kB high:7044kB active_anon:127516kB inactive_anon:10204kB active_file:19752kB inactive_file:20788kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:3145324kB managed:3021976kB mlocked:0kB dirty:8kB writeback:0kB mapped:107908kB shmem:14304kB slab_reclaimable:8340kB slab_unreclaimable:112920kB kernel_stack:6528kB pagetables:15168kB unstable:0kB bounce:0kB free_pcp:1088kB local_pcp:536kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no [ 1107.092106] lowmem_reserve[]: 0 3504 3504 [ 1107.092136] Normal free:3052532kB min:5580kB low:6972kB high:8368kB active_anon:152540kB inactive_anon:12588kB active_file:24976kB inactive_file:26320kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:4718592kB managed:3588764kB mlocked:0kB dirty:180kB writeback:0kB mapped:127936kB shmem:18292kB slab_reclaimable:9200kB slab_unreclaimable:139676kB kernel_stack:8064kB pagetables:18940kB unstable:0kB bounce:0kB free_pcp:1008kB local_pcp:412kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no [ 1107.092143] lowmem_reserve[]: 0 0 0 [ 1107.092197] DMA32: 502*4kB (UME) 393*8kB (UME) 349*16kB (UME) 184*32kB (UME) 51*64kB (ME) 24*128kB (UME) 12*256kB (UM) 5*512kB (M) 1*1024kB (E) 2*2048kB (UE) 621*4096kB (M) = 2577328kB [ 1107.092244] Normal: 533*4kB (UM) 251*8kB (UME) 284*16kB (UME) 176*32kB (UM) 66*64kB (UME) 34*128kB (UME) 10*256kB (UM) 8*512kB (UME) 4*1024kB (M) 4*2048kB (UME) 735*4096kB (M) = 3052396kB [ 1107.092247] 31107 total pagecache pages [ 1107.092250] 0 pages in swap cache [ 1107.092255] Swap cache stats: add 0, delete 0, find 0/0 [ 1107.092258] Free swap = 0kB [ 1107.092261] Total swap = 0kB [ 1107.092263] 1965979 pages RAM [ 1107.092267] 0 pages HighMem/MovableOnly [ 1107.092269] 313294 pages reserved [ 1107.092941] binder: 18819:18828 transaction failed 29189/-22, size 0-0 line 3014 [ 1107.093072] binder: undelivered TRANSACTION_ERROR: 29189 [ 1107.144596] binder: 18834:18835 transaction failed 29189/-22, size 0-0 line 3014 [ 1107.144760] binder: undelivered TRANSACTION_ERROR: 29189 [ 1107.245030] binder: 18841:18849 transaction failed 29189/-22, size 0-0 line 3014 [ 1107.245198] binder: undelivered TRANSACTION_ERROR: 29189 [ 1107.323853] binder: 18854:18855 transaction failed 29189/-22, size 0-0 line 3014 [ 1107.324031] binder: undelivered TRANSACTION_ERROR: 29189 [ 1107.989523] binder: 18863:18868 transaction failed 29189/-22, size 0-0 line 3014 [ 1107.989686] binder: undelivered TRANSACTION_ERROR: 29189 [ 1108.092434] binder: 18877:18884 transaction failed 29189/-22, size 0-0 line 3014 [ 1108.092802] binder: undelivered TRANSACTION_ERROR: 29189 [ 1108.199269] binder_alloc: 18888: binder_alloc_buf, no vma [ 1108.199304] binder: 18888:18892 transaction failed 29189/-3, size 0-0 line 3137 [ 1108.200862] binder: undelivered TRANSACTION_ERROR: 29189 [ 1108.820659] binder: 18902:18907 transaction failed 29189/-22, size 0-0 line 3014 [ 1108.821079] binder: undelivered TRANSACTION_ERROR: 29189 [ 1108.975395] binder: 18920:18928 transaction failed 29189/-22, size 0-0 line 3014 [ 1108.975698] binder: undelivered TRANSACTION_ERROR: 29189 [ 1109.830777] warn_alloc_failed: 7 callbacks suppressed [ 1109.830783] vmalloc: allocation failure: 0 bytes [ 1109.830788] syz-executor.4: page allocation failure: order:0, mode:0x24000c2 [ 1109.830797] CPU: 0 PID: 18954 Comm: syz-executor.4 Not tainted 4.4.174+ #4 [ 1109.830810] 0000000000000000 2eab1edd9238b14c ffff8801bee079f0 ffffffff81aad1a1 [ 1109.830820] 1ffff10037dc0f41 ffff8801d81e0000 00000000024000c2 0000000000000000 [ 1109.830832] ffffffff82895080 ffff8801bee07b00 ffffffff8148c0cb ffffffff00000001 [ 1109.830834] Call Trace: [ 1109.830849] [] dump_stack+0xc1/0x120 [ 1109.830862] [] warn_alloc_failed.cold+0x78/0x99 [ 1109.830872] [] ? zone_watermark_ok_safe+0x290/0x290 [ 1109.830883] [] ? sel_write_load+0x9e/0xf90 [ 1109.830893] [] __vmalloc_node_range+0x365/0x650 [ 1109.830901] [] ? check_preemption_disabled+0x3c/0x200 [ 1109.830909] [] ? check_preemption_disabled+0x3c/0x200 [ 1109.830917] [] ? task_has_security+0x130/0x270 [ 1109.830926] [] vmalloc+0x5c/0x70 [ 1109.830934] [] ? sel_write_load+0x119/0xf90 [ 1109.830953] [] sel_write_load+0x119/0xf90 [ 1109.830963] [] ? sel_read_bool+0x240/0x240 [ 1109.830976] [] ? trace_hardirqs_on+0x10/0x10 [ 1109.830985] [] __vfs_write+0x116/0x3d0 [ 1109.830995] [] ? sel_read_bool+0x240/0x240 [ 1109.831003] [] ? __vfs_read+0x3c0/0x3c0 [ 1109.831012] [] ? check_preemption_disabled+0x3c/0x200 [ 1109.831019] [] ? check_preemption_disabled+0x3c/0x200 [ 1109.831029] [] ? rcu_read_lock_sched_held+0x10b/0x130 [ 1109.831037] [] ? rcu_sync_lockdep_assert+0x73/0xb0 [ 1109.831046] [] ? __sb_start_write+0x14f/0x310 [ 1109.831054] [] vfs_write+0x182/0x4e0 [ 1109.831062] [] SyS_write+0xdc/0x1c0 [ 1109.831070] [] ? SyS_read+0x1c0/0x1c0 [ 1109.831080] [] ? lockdep_sys_exit_thunk+0x12/0x14 [ 1109.831090] [] entry_SYSCALL_64_fastpath+0x1e/0x9a [ 1109.831093] Mem-Info: [ 1109.831119] active_anon:70006 inactive_anon:5700 isolated_anon:0 [ 1109.831119] active_file:11182 inactive_file:11777 isolated_file:0 [ 1109.831119] unevictable:0 dirty:47 writeback:0 unstable:0 [ 1109.831119] slab_reclaimable:4389 slab_unreclaimable:63505 [ 1109.831119] mapped:58964 shmem:8152 pagetables:8515 bounce:0 [ 1109.831119] free:1407173 free_pcp:508 free_cma:0 [ 1109.831155] DMA32 free:2576416kB min:4696kB low:5868kB high:7044kB active_anon:127412kB inactive_anon:10236kB active_file:19752kB inactive_file:20788kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:3145324kB managed:3021976kB mlocked:0kB dirty:8kB writeback:0kB mapped:107884kB shmem:14276kB slab_reclaimable:8356kB slab_unreclaimable:113408kB kernel_stack:6368kB pagetables:15284kB unstable:0kB bounce:0kB free_pcp:1316kB local_pcp:520kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no [ 1109.831170] lowmem_reserve[]: 0 3504 3504 [ 1109.831726] Normal free:3052276kB min:5580kB low:6972kB high:8368kB active_anon:152612kB inactive_anon:12564kB active_file:24976kB inactive_file:26320kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:4718592kB managed:3588764kB mlocked:0kB dirty:180kB writeback:0kB mapped:127972kB shmem:18332kB slab_reclaimable:9200kB slab_unreclaimable:140612kB kernel_stack:7808kB pagetables:18776kB unstable:0kB bounce:0kB free_pcp:716kB local_pcp:56kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no [ 1109.831736] lowmem_reserve[]: 0 0 0 [ 1109.831797] DMA32: 378*4kB (UME) 322*8kB (UME) 350*16kB (UME) 182*32kB (UME) 52*64kB (UME) 25*128kB (UME) 12*256kB (UM) 5*512kB (M) 1*1024kB (E) 2*2048kB (UE) 621*4096kB (M) = 2576408kB [ 1109.831848] Normal: 463*4kB (UM) 225*8kB (UME) 285*16kB (UME) 183*32kB (UM) 66*64kB (UME) 34*128kB (UME) 10*256kB (UM) 8*512kB (UME) 4*1024kB (M) 4*2048kB (UME) 735*4096kB (M) = 3052148kB [ 1109.831850] 31110 total pagecache pages [ 1109.831853] 0 pages in swap cache [ 1109.831858] Swap cache stats: add 0, delete 0, find 0/0 [ 1109.831861] Free swap = 0kB [ 1109.831864] Total swap = 0kB [ 1109.831867] 1965979 pages RAM [ 1109.831870] 0 pages HighMem/MovableOnly [ 1109.831874] 313294 pages reserved [ 1109.837753] binder: 18948:18953 transaction failed 29189/-22, size 0-0 line 3014 [ 1109.837884] binder: undelivered TRANSACTION_ERROR: 29189 [ 1109.924922] binder: 18963:18966 transaction failed 29189/-22, size 0-0 line 3014 [ 1109.925104] binder: undelivered TRANSACTION_ERROR: 29189 [ 1109.956657] vmalloc: allocation failure: 0 bytes [ 1109.956663] syz-executor.4: page allocation failure: order:0, mode:0x24000c2 [ 1109.956673] CPU: 0 PID: 18970 Comm: syz-executor.4 Not tainted 4.4.174+ #4 [ 1109.956686] 0000000000000000 fac19758f0b1b38d ffff8801d139f9f0 ffffffff81aad1a1 [ 1109.956697] 1ffff1003a273f41 ffff8801bddcaf80 00000000024000c2 0000000000000000 [ 1109.956708] ffffffff82895080 ffff8801d139fb00 ffffffff8148c0cb ffffffff00000001 [ 1109.956711] Call Trace: [ 1109.956728] [] dump_stack+0xc1/0x120 [ 1109.956740] [] warn_alloc_failed.cold+0x78/0x99 [ 1109.956751] [] ? zone_watermark_ok_safe+0x290/0x290 [ 1109.956760] [] ? sel_write_load+0x9e/0xf90 [ 1109.956772] [] __vmalloc_node_range+0x365/0x650 [ 1109.956782] [] ? check_preemption_disabled+0x3c/0x200 [ 1109.956790] [] ? check_preemption_disabled+0x3c/0x200 [ 1109.956798] [] ? task_has_security+0x130/0x270 [ 1109.956806] [] vmalloc+0x5c/0x70 [ 1109.956814] [] ? sel_write_load+0x119/0xf90 [ 1109.956822] [] sel_write_load+0x119/0xf90 [ 1109.956831] [] ? sel_read_bool+0x240/0x240 [ 1109.956840] [] ? trace_hardirqs_on+0x10/0x10 [ 1109.956849] [] __vfs_write+0x116/0x3d0 [ 1109.956857] [] ? sel_read_bool+0x240/0x240 [ 1109.956864] [] ? __vfs_read+0x3c0/0x3c0 [ 1109.956873] [] ? check_preemption_disabled+0x3c/0x200 [ 1109.956881] [] ? check_preemption_disabled+0x3c/0x200 [ 1109.956891] [] ? rcu_read_lock_sched_held+0x10b/0x130 [ 1109.956900] [] ? rcu_sync_lockdep_assert+0x73/0xb0 [ 1109.956909] [] ? __sb_start_write+0x14f/0x310 [ 1109.956917] [] vfs_write+0x182/0x4e0 [ 1109.956925] [] SyS_write+0xdc/0x1c0 [ 1109.956932] [] ? SyS_read+0x1c0/0x1c0 [ 1109.956957] [] ? lockdep_sys_exit_thunk+0x12/0x14 [ 1109.956969] [] entry_SYSCALL_64_fastpath+0x1e/0x9a [ 1109.956972] Mem-Info: [ 1109.956999] active_anon:70106 inactive_anon:6175 isolated_anon:0 [ 1109.956999] active_file:11182 inactive_file:11777 isolated_file:0 [ 1109.956999] unevictable:0 dirty:47 writeback:0 unstable:0 [ 1109.956999] slab_reclaimable:4389 slab_unreclaimable:63448 [ 1109.956999] mapped:59001 shmem:8633 pagetables:8515 bounce:0 [ 1109.956999] free:1406525 free_pcp:458 free_cma:0 [ 1109.957045] DMA32 free:2575612kB min:4696kB low:5868kB high:7044kB active_anon:127512kB inactive_anon:11136kB active_file:19752kB inactive_file:20788kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:3145324kB managed:3021976kB mlocked:0kB dirty:8kB writeback:0kB mapped:107884kB shmem:15164kB slab_reclaimable:8356kB slab_unreclaimable:113384kB kernel_stack:6368kB pagetables:15284kB unstable:0kB bounce:0kB free_pcp:936kB local_pcp:388kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no [ 1109.959818] lowmem_reserve[]: 0 3504 3504 [ 1109.959854] Normal free:3050688kB min:5580kB low:6972kB high:8368kB active_anon:152912kB inactive_anon:13564kB active_file:24976kB inactive_file:26320kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:4718592kB managed:3588764kB mlocked:0kB dirty:180kB writeback:0kB mapped:128120kB shmem:19368kB slab_reclaimable:9200kB slab_unreclaimable:139908kB kernel_stack:7808kB pagetables:18776kB unstable:0kB bounce:0kB free_pcp:1076kB local_pcp:668kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no [ 1109.959863] lowmem_reserve[]: 0 0 0 [ 1109.959923] DMA32: 207*4kB (UE) 295*8kB (UME) 350*16kB (UME) 184*32kB (UME) 53*64kB (UME) 25*128kB (UME) 12*256kB (UM) 5*512kB (M) 1*1024kB (E) 2*2048kB (UE) 621*4096kB (M) = 2575636kB [ 1109.959991] Normal: 229*4kB (U) 190*8kB (UME) 284*16kB (UME) 185*32kB (UM) 66*64kB (UME) 33*128kB (UME) 10*256kB (UM) 8*512kB (UME) 4*1024kB (M) 4*2048kB (UME) 735*4096kB (M) = 3050852kB [ 1109.959994] 31591 total pagecache pages [ 1109.959999] 0 pages in swap cache [ 1109.960003] Swap cache stats: add 0, delete 0, find 0/0 [ 1109.960006] Free swap = 0kB [ 1109.960008] Total swap = 0kB [ 1109.960011] 1965979 pages RAM [ 1109.960014] 0 pages HighMem/MovableOnly [ 1109.960016] 313294 pages reserved [ 1110.040311] binder: 18976:18977 transaction failed 29189/-22, size 0-0 line 3014 [ 1110.040497] binder: undelivered TRANSACTION_ERROR: 29189 [ 1110.656598] binder: 18989:18996 transaction failed 29189/-22, size 0-0 line 3014 [ 1110.656772] binder: undelivered TRANSACTION_ERROR: 29189 [ 1110.709236] vmalloc: allocation failure: 0 bytes [ 1110.709241] syz-executor.4: page allocation failure: order:0, mode:0x24000c2 [ 1110.709250] CPU: 0 PID: 18993 Comm: syz-executor.4 Not tainted 4.4.174+ #4 [ 1110.709265] 0000000000000000 a976d059abb33f2a ffff8800ba3c79f0 ffffffff81aad1a1 [ 1110.709277] 1ffff10017478f41 ffff8800a62e17c0 00000000024000c2 0000000000000000 [ 1110.709288] ffffffff82895080 ffff8800ba3c7b00 ffffffff8148c0cb ffffffff00000001 [ 1110.709291] Call Trace: [ 1110.709305] [] dump_stack+0xc1/0x120 [ 1110.709319] [] warn_alloc_failed.cold+0x78/0x99 [ 1110.709331] [] ? zone_watermark_ok_safe+0x290/0x290 [ 1110.709340] [] ? sel_write_load+0x9e/0xf90 [ 1110.709351] [] __vmalloc_node_range+0x365/0x650 [ 1110.709361] [] ? check_preemption_disabled+0x3c/0x200 [ 1110.709369] [] ? check_preemption_disabled+0x3c/0x200 [ 1110.709377] [] ? task_has_security+0x130/0x270 [ 1110.709384] [] vmalloc+0x5c/0x70 [ 1110.709392] [] ? sel_write_load+0x119/0xf90 [ 1110.709399] [] sel_write_load+0x119/0xf90 [ 1110.709407] [] ? sel_read_bool+0x240/0x240 [ 1110.709417] [] ? trace_hardirqs_on+0x10/0x10 [ 1110.709425] [] __vfs_write+0x116/0x3d0 [ 1110.709432] [] ? sel_read_bool+0x240/0x240 [ 1110.709439] [] ? __vfs_read+0x3c0/0x3c0 [ 1110.709447] [] ? check_preemption_disabled+0x3c/0x200 [ 1110.709456] [] ? check_preemption_disabled+0x3c/0x200 [ 1110.709466] [] ? rcu_read_lock_sched_held+0x10b/0x130 [ 1110.709476] [] ? rcu_sync_lockdep_assert+0x73/0xb0 [ 1110.709485] [] ? __sb_start_write+0x14f/0x310 [ 1110.709493] [] vfs_write+0x182/0x4e0 [ 1110.709500] [] SyS_write+0xdc/0x1c0 [ 1110.709508] [] ? SyS_read+0x1c0/0x1c0 [ 1110.709518] [] ? lockdep_sys_exit_thunk+0x12/0x14 [ 1110.709528] [] entry_SYSCALL_64_fastpath+0x1e/0x9a [ 1110.709531] Mem-Info: [ 1110.709556] active_anon:70054 inactive_anon:5725 isolated_anon:0 [ 1110.709556] active_file:11182 inactive_file:11777 isolated_file:0 [ 1110.709556] unevictable:0 dirty:47 writeback:0 unstable:0 [ 1110.709556] slab_reclaimable:4389 slab_unreclaimable:63394 [ 1110.709556] mapped:58964 shmem:8189 pagetables:8552 bounce:0 [ 1110.709556] free:1407320 free_pcp:325 free_cma:0 [ 1110.709594] DMA32 free:2576616kB min:4696kB low:5868kB high:7044kB active_anon:127668kB inactive_anon:10284kB active_file:19752kB inactive_file:20788kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:3145324kB managed:3021976kB mlocked:0kB dirty:8kB writeback:0kB mapped:107828kB shmem:14376kB slab_reclaimable:8356kB slab_unreclaimable:113608kB kernel_stack:6272kB pagetables:15288kB unstable:0kB bounce:0kB free_pcp:656kB local_pcp:228kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no [ 1110.709605] lowmem_reserve[]: 0 3504 3504 [ 1110.709641] Normal free:3052664kB min:5580kB low:6972kB high:8368kB active_anon:152548kB inactive_anon:12616kB active_file:24976kB inactive_file:26320kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:4718592kB managed:3588764kB mlocked:0kB dirty:180kB writeback:0kB mapped:128028kB shmem:18380kB slab_reclaimable:9200kB slab_unreclaimable:139968kB kernel_stack:7840kB pagetables:18920kB unstable:0kB bounce:0kB free_pcp:644kB local_pcp:80kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no [ 1110.709649] lowmem_reserve[]: 0 0 0 [ 1110.710227] DMA32: 294*4kB (UME) 329*8kB (UME) 349*16kB (UME) 194*32kB (UME) 53*64kB (UME) 25*128kB (UME) 12*256kB (UM) 5*512kB (M) 1*1024kB (E) 2*2048kB (UE) 621*4096kB (M) = 2576560kB [ 1110.710289] Normal: 548*4kB (UM) 254*8kB (UME) 285*16kB (UME) 184*32kB (UM) 66*64kB (UME) 33*128kB (UME) 10*256kB (UM) 8*512kB (UME) 4*1024kB (M) 4*2048kB (UME) 735*4096kB (M) = 3052624kB [ 1110.710292] 31147 total pagecache pages [ 1110.710296] 0 pages in swap cache [ 1110.710301] Swap cache stats: add 0, delete 0, find 0/0 [ 1110.710305] Free swap = 0kB [ 1110.710307] Total swap = 0kB [ 1110.710310] 1965979 pages RAM [ 1110.710313] 0 pages HighMem/MovableOnly [ 1110.710316] 313294 pages reserved [ 1110.792811] binder: 19010:19013 transaction failed 29189/-22, size 0-0 line 3014 [ 1110.792994] binder: undelivered TRANSACTION_ERROR: 29189 [ 1110.830243] vmalloc: allocation failure: 0 bytes [ 1110.830249] syz-executor.4: page allocation failure: order:0, mode:0x24000c2 [ 1110.830259] CPU: 1 PID: 19018 Comm: syz-executor.4 Not tainted 4.4.174+ #4 [ 1110.830272] 0000000000000000 3fbdc4230561e6ac ffff8801d11ff9f0 ffffffff81aad1a1 [ 1110.830282] 1ffff1003a23ff41 ffff8800bb630000 00000000024000c2 0000000000000000 [ 1110.830292] ffffffff82895080 ffff8801d11ffb00 ffffffff8148c0cb ffffffff00000001 [ 1110.830294] Call Trace: [ 1110.830311] [] dump_stack+0xc1/0x120 [ 1110.830324] [] warn_alloc_failed.cold+0x78/0x99 [ 1110.830337] [] ? zone_watermark_ok_safe+0x290/0x290 [ 1110.830347] [] ? sel_write_load+0x9e/0xf90 [ 1110.830359] [] __vmalloc_node_range+0x365/0x650 [ 1110.830370] [] ? check_preemption_disabled+0x3c/0x200 [ 1110.830378] [] ? check_preemption_disabled+0x3c/0x200 [ 1110.830388] [] ? task_has_security+0x130/0x270 [ 1110.830397] [] vmalloc+0x5c/0x70 [ 1110.830406] [] ? sel_write_load+0x119/0xf90 [ 1110.830413] [] sel_write_load+0x119/0xf90 [ 1110.830421] [] ? sel_read_bool+0x240/0x240 [ 1110.830431] [] ? trace_hardirqs_on+0x10/0x10 [ 1110.830452] [] __vfs_write+0x116/0x3d0 [ 1110.830461] [] ? sel_read_bool+0x240/0x240 [ 1110.830470] [] ? __vfs_read+0x3c0/0x3c0 [ 1110.830479] [] ? check_preemption_disabled+0x3c/0x200 [ 1110.830487] [] ? check_preemption_disabled+0x3c/0x200 [ 1110.830496] [] ? rcu_read_lock_sched_held+0x10b/0x130 [ 1110.830504] [] ? rcu_sync_lockdep_assert+0x73/0xb0 [ 1110.830515] [] ? __sb_start_write+0x14f/0x310 [ 1110.830523] [] vfs_write+0x182/0x4e0 [ 1110.830533] [] SyS_write+0xdc/0x1c0 [ 1110.830543] [] ? SyS_read+0x1c0/0x1c0 [ 1110.830557] [] ? lockdep_sys_exit_thunk+0x12/0x14 [ 1110.830567] [] entry_SYSCALL_64_fastpath+0x1e/0x9a [ 1110.830571] Mem-Info: [ 1110.830597] active_anon:70054 inactive_anon:6200 isolated_anon:0 [ 1110.830597] active_file:11182 inactive_file:11777 isolated_file:0 [ 1110.830597] unevictable:0 dirty:47 writeback:0 unstable:0 [ 1110.830597] slab_reclaimable:4389 slab_unreclaimable:63383 [ 1110.830597] mapped:58964 shmem:8707 pagetables:8552 bounce:0 [ 1110.830597] free:1406645 free_pcp:426 free_cma:0 [ 1110.830631] DMA32 free:2575128kB min:4696kB low:5868kB high:7044kB active_anon:127668kB inactive_anon:11584kB active_file:19752kB inactive_file:20788kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:3145324kB managed:3021976kB mlocked:0kB dirty:8kB writeback:0kB mapped:107828kB shmem:15708kB slab_reclaimable:8356kB slab_unreclaimable:113408kB kernel_stack:6272kB pagetables:15436kB unstable:0kB bounce:0kB free_pcp:924kB local_pcp:472kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no [ 1110.830641] lowmem_reserve[]: 0 3504 3504 [ 1110.830672] Normal free:3051452kB min:5580kB low:6972kB high:8368kB active_anon:152548kB inactive_anon:13216kB active_file:24976kB inactive_file:26320kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:4718592kB managed:3588764kB mlocked:0kB dirty:180kB writeback:0kB mapped:128028kB shmem:19120kB slab_reclaimable:9200kB slab_unreclaimable:140124kB kernel_stack:7840kB pagetables:18772kB unstable:0kB bounce:0kB free_pcp:780kB local_pcp:580kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no [ 1110.830681] lowmem_reserve[]: 0 0 0 [ 1110.830736] DMA32: 118*4kB (UME) 235*8kB (UME) 347*16kB (UME) 199*32kB (UME) 53*64kB (UME) 25*128kB (UME) 12*256kB (UM) 5*512kB (M) 1*1024kB (E) 2*2048kB (UE) 621*4096kB (M) = 2575232kB [ 1110.830789] Normal: 358*4kB (UM) 256*8kB (UME) 285*16kB (UME) 168*32kB (UM) 66*64kB (UME) 33*128kB (UME) 10*256kB (UM) 8*512kB (UME) 4*1024kB (M) 4*2048kB (UME) 735*4096kB (M) = 3051368kB [ 1110.830792] 31665 total pagecache pages [ 1110.830795] 0 pages in swap cache [ 1110.830800] Swap cache stats: add 0, delete 0, find 0/0 [ 1110.830803] Free swap = 0kB [ 1110.830805] Total swap = 0kB [ 1110.830808] 1965979 pages RAM [ 1110.830810] 0 pages HighMem/MovableOnly [ 1110.830813] 313294 pages reserved [ 1110.873146] binder: 19025:19026 transaction failed 29189/-22, size 0-0 line 3014 [ 1110.873358] binder: undelivered TRANSACTION_ERROR: 29189 [ 1111.473242] binder: 19036:19041 transaction failed 29189/-22, size 0-0 line 3014 [ 1111.473421] binder: undelivered TRANSACTION_ERROR: 29189 [ 1111.509776] vmalloc: allocation failure: 0 bytes [ 1111.509783] syz-executor.4: page allocation failure: order:0, mode:0x24000c2 [ 1111.509792] CPU: 0 PID: 19049 Comm: syz-executor.4 Not tainted 4.4.174+ #4 [ 1111.509804] 0000000000000000 ef63b224f71ded32 ffff8800ba3c79f0 ffffffff81aad1a1 [ 1111.509815] 1ffff10017478f41 ffff8800a627af80 00000000024000c2 0000000000000000 [ 1111.509826] ffffffff82895080 ffff8800ba3c7b00 ffffffff8148c0cb ffffffff00000001 [ 1111.509829] Call Trace: [ 1111.509844] [] dump_stack+0xc1/0x120 [ 1111.509858] [] warn_alloc_failed.cold+0x78/0x99 [ 1111.509869] [] ? zone_watermark_ok_safe+0x290/0x290 [ 1111.509879] [] ? sel_write_load+0x9e/0xf90 [ 1111.509889] [] __vmalloc_node_range+0x365/0x650 [ 1111.509897] [] ? check_preemption_disabled+0x3c/0x200 [ 1111.509905] [] ? check_preemption_disabled+0x3c/0x200 [ 1111.509914] [] ? task_has_security+0x130/0x270 [ 1111.509921] [] vmalloc+0x5c/0x70 [ 1111.509928] [] ? sel_write_load+0x119/0xf90 [ 1111.509942] [] sel_write_load+0x119/0xf90 [ 1111.509952] [] ? sel_read_bool+0x240/0x240 [ 1111.509963] [] ? trace_hardirqs_on+0x10/0x10 [ 1111.509973] [] __vfs_write+0x116/0x3d0 [ 1111.509981] [] ? sel_read_bool+0x240/0x240 [ 1111.509991] [] ? __vfs_read+0x3c0/0x3c0 [ 1111.509998] [] ? check_preemption_disabled+0x3c/0x200 [ 1111.510006] [] ? check_preemption_disabled+0x3c/0x200 [ 1111.510015] [] ? rcu_read_lock_sched_held+0x10b/0x130 [ 1111.510023] [] ? rcu_sync_lockdep_assert+0x73/0xb0 [ 1111.510031] [] ? __sb_start_write+0x14f/0x310 [ 1111.510039] [] vfs_write+0x182/0x4e0 [ 1111.510046] [] SyS_write+0xdc/0x1c0 [ 1111.510054] [] ? SyS_read+0x1c0/0x1c0 [ 1111.510064] [] ? lockdep_sys_exit_thunk+0x12/0x14 [ 1111.510073] [] entry_SYSCALL_64_fastpath+0x1e/0x9a [ 1111.510076] Mem-Info: [ 1111.510102] active_anon:70106 inactive_anon:5725 isolated_anon:0 [ 1111.510102] active_file:11182 inactive_file:11777 isolated_file:0 [ 1111.510102] unevictable:0 dirty:47 writeback:0 unstable:0 [ 1111.510102] slab_reclaimable:4389 slab_unreclaimable:63411 [ 1111.510102] mapped:59001 shmem:8152 pagetables:8515 bounce:0 [ 1111.510102] free:1407329 free_pcp:348 free_cma:0 [ 1111.510140] DMA32 free:2576540kB min:4696kB low:5868kB high:7044kB active_anon:127892kB inactive_anon:10296kB active_file:19752kB inactive_file:20788kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:3145324kB managed:3021976kB mlocked:0kB dirty:8kB writeback:0kB mapped:107888kB shmem:14344kB slab_reclaimable:8356kB slab_unreclaimable:113876kB kernel_stack:6304kB pagetables:15156kB unstable:0kB bounce:0kB free_pcp:548kB local_pcp:72kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no [ 1111.510149] lowmem_reserve[]: 0 3504 3504 [ 1111.510177] Normal free:3052776kB min:5580kB low:6972kB high:8368kB active_anon:152532kB inactive_anon:12604kB active_file:24976kB inactive_file:26320kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:4718592kB managed:3588764kB mlocked:0kB dirty:180kB writeback:0kB mapped:128116kB shmem:18264kB slab_reclaimable:9200kB slab_unreclaimable:139768kB kernel_stack:7808kB pagetables:18904kB unstable:0kB bounce:0kB free_pcp:844kB local_pcp:260kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no [ 1111.510185] lowmem_reserve[]: 0 0 0 [ 1111.510240] DMA32: 391*4kB (UME) 319*8kB (UME) 341*16kB (UME) 186*32kB (UME) 54*64kB (UME) 24*128kB (UME) 12*256kB (UM) 5*512kB (M) 1*1024kB (E) 2*2048kB (UE) 621*4096kB (M) = 2576420kB [ 1111.510290] Normal: 476*4kB (UM) 292*8kB (UME) 285*16kB (UME) 187*32kB (UM) 66*64kB (UME) 34*128kB (UME) 10*256kB (UM) 8*512kB (UME) 4*1024kB (M) 4*2048kB (UME) 735*4096kB (M) = 3052864kB [ 1111.510293] 31110 total pagecache pages [ 1111.510297] 0 pages in swap cache [ 1111.510302] Swap cache stats: add 0, delete 0, find 0/0 [ 1111.510305] Free swap = 0kB [ 1111.510308] Total swap = 0kB [ 1111.510311] 1965979 pages RAM [ 1111.510313] 0 pages HighMem/MovableOnly [ 1111.510315] 313294 pages reserved [ 1111.566067] binder: 19053:19055 transaction failed 29189/-22, size 0-0 line 3014 [ 1111.566245] binder: undelivered TRANSACTION_ERROR: 29189 [ 1111.578825] vmalloc: allocation failure: 0 bytes [ 1111.578836] syz-executor.4: page allocation failure: order:0, mode:0x24000c2 [ 1111.579872] CPU: 0 PID: 19060 Comm: syz-executor.4 Not tainted 4.4.174+ #4 [ 1111.579884] 0000000000000000 3fd64184f2cdde0d ffff8800bac179f0 ffffffff81aad1a1 [ 1111.579895] 1ffff10017582f41 ffff8800a4570000 00000000024000c2 0000000000000000 [ 1111.579906] ffffffff82895080 ffff8800bac17b00 ffffffff8148c0cb ffffffff00000001 [ 1111.579908] Call Trace: [ 1111.579922] [] dump_stack+0xc1/0x120 [ 1111.579941] [] warn_alloc_failed.cold+0x78/0x99 [ 1111.579952] [] ? zone_watermark_ok_safe+0x290/0x290 [ 1111.579963] [] ? sel_write_load+0x9e/0xf90 [ 1111.579972] [] __vmalloc_node_range+0x365/0x650 [ 1111.579981] [] ? check_preemption_disabled+0x3c/0x200 [ 1111.579990] [] ? check_preemption_disabled+0x3c/0x200 [ 1111.579999] [] ? task_has_security+0x130/0x270 [ 1111.580007] [] vmalloc+0x5c/0x70 [ 1111.580014] [] ? sel_write_load+0x119/0xf90 [ 1111.580021] [] sel_write_load+0x119/0xf90 [ 1111.580029] [] ? sel_read_bool+0x240/0x240 [ 1111.580039] [] ? trace_hardirqs_on+0x10/0x10 [ 1111.580046] [] __vfs_write+0x116/0x3d0 [ 1111.580053] [] ? sel_read_bool+0x240/0x240 [ 1111.580060] [] ? __vfs_read+0x3c0/0x3c0 [ 1111.580068] [] ? check_preemption_disabled+0x3c/0x200 [ 1111.580076] [] ? check_preemption_disabled+0x3c/0x200 [ 1111.580085] [] ? rcu_read_lock_sched_held+0x10b/0x130 [ 1111.580092] [] ? rcu_sync_lockdep_assert+0x73/0xb0 [ 1111.580100] [] ? __sb_start_write+0x14f/0x310 [ 1111.580108] [] vfs_write+0x182/0x4e0 [ 1111.580115] [] SyS_write+0xdc/0x1c0 [ 1111.580122] [] ? SyS_read+0x1c0/0x1c0 [ 1111.580132] [] ? lockdep_sys_exit_thunk+0x12/0x14 [ 1111.580141] [] entry_SYSCALL_64_fastpath+0x1e/0x9a [ 1111.580144] Mem-Info: [ 1111.580168] active_anon:70081 inactive_anon:5850 isolated_anon:0 [ 1111.580168] active_file:11182 inactive_file:11777 isolated_file:0 [ 1111.580168] unevictable:0 dirty:47 writeback:0 unstable:0 [ 1111.580168] slab_reclaimable:4389 slab_unreclaimable:63261 [ 1111.580168] mapped:58964 shmem:8337 pagetables:8552 bounce:0 [ 1111.580168] free:1407201 free_pcp:295 free_cma:0 [ 1111.580199] DMA32 free:2576296kB min:4696kB low:5868kB high:7044kB active_anon:127692kB inactive_anon:10796kB active_file:19752kB inactive_file:20788kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:3145324kB managed:3021976kB mlocked:0kB dirty:8kB writeback:0kB mapped:107888kB shmem:14936kB slab_reclaimable:8356kB slab_unreclaimable:113776kB kernel_stack:6304kB pagetables:15156kB unstable:0kB bounce:0kB free_pcp:292kB local_pcp:180kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no [ 1111.580209] lowmem_reserve[]: 0 3504 3504 [ 1111.580238] Normal free:3052508kB min:5580kB low:6972kB high:8368kB active_anon:152632kB inactive_anon:12604kB active_file:24976kB inactive_file:26320kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:4718592kB managed:3588764kB mlocked:0kB dirty:180kB writeback:0kB mapped:127968kB shmem:18412kB slab_reclaimable:9200kB slab_unreclaimable:139268kB kernel_stack:7808kB pagetables:19052kB unstable:0kB bounce:0kB free_pcp:888kB local_pcp:456kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no [ 1111.580247] lowmem_reserve[]: 0 0 0 [ 1111.580299] DMA32: 319*4kB (UME) 324*8kB (UME) 341*16kB (UME) 187*32kB (UME) 54*64kB (UME) 24*128kB (UME) 12*256kB (UM) 5*512kB (M) 1*1024kB (E) 2*2048kB (UE) 621*4096kB (M) = 2576204kB [ 1111.580349] Normal: 410*4kB (UM) 304*8kB (UME) 285*16kB (UME) 184*32kB (UM) 66*64kB (UME) 34*128kB (UME) 10*256kB (UM) 8*512kB (UME) 4*1024kB (M) 4*2048kB (UME) 735*4096kB (M) = 3052600kB [ 1111.580351] 31295 total pagecache pages [ 1111.580356] 0 pages in swap cache [ 1111.580360] Swap cache stats: add 0, delete 0, find 0/0 [ 1111.580363] Free swap = 0kB [ 1111.580365] Total swap = 0kB [ 1111.580368] 1965979 pages RAM [ 1111.580371] 0 pages HighMem/MovableOnly [ 1111.580373] 313294 pages reserved [ 1111.663882] binder: 19066:19067 transaction failed 29189/-22, size 0-0 line 3014 [ 1111.664082] binder: undelivered TRANSACTION_ERROR: 29189 [ 1111.712262] vmalloc: allocation failure: 0 bytes [ 1111.712268] syz-executor.4: page allocation failure: order:0, mode:0x24000c2 [ 1111.712279] CPU: 1 PID: 19068 Comm: syz-executor.4 Not tainted 4.4.174+ #4 [ 1111.712292] 0000000000000000 203ddb40cf4a1ff0 ffff8801c03b79f0 ffffffff81aad1a1 [ 1111.712313] 1ffff10038076f41 ffff8801d194df00 00000000024000c2 0000000000000000 [ 1111.712324] ffffffff82895080 ffff8801c03b7b00 ffffffff8148c0cb ffffffff00000001 [ 1111.712327] Call Trace: [ 1111.712341] [] dump_stack+0xc1/0x120 [ 1111.712355] [] warn_alloc_failed.cold+0x78/0x99 [ 1111.712366] [] ? zone_watermark_ok_safe+0x290/0x290 [ 1111.712375] [] ? sel_write_load+0x9e/0xf90 [ 1111.712384] [] __vmalloc_node_range+0x365/0x650 [ 1111.712393] [] ? check_preemption_disabled+0x3c/0x200 [ 1111.712401] [] ? check_preemption_disabled+0x3c/0x200 [ 1111.712409] [] ? task_has_security+0x130/0x270 [ 1111.712417] [] vmalloc+0x5c/0x70 [ 1111.712424] [] ? sel_write_load+0x119/0xf90 [ 1111.712432] [] sel_write_load+0x119/0xf90 [ 1111.712449] [] ? sel_read_bool+0x240/0x240 [ 1111.712461] [] ? trace_hardirqs_on+0x10/0x10 [ 1111.712472] [] __vfs_write+0x116/0x3d0 [ 1111.712480] [] ? sel_read_bool+0x240/0x240 [ 1111.712490] [] ? __vfs_read+0x3c0/0x3c0 [ 1111.712499] [] ? check_preemption_disabled+0x3c/0x200 [ 1111.712507] [] ? check_preemption_disabled+0x3c/0x200 [ 1111.712516] [] ? rcu_read_lock_sched_held+0x10b/0x130 [ 1111.712525] [] ? rcu_sync_lockdep_assert+0x73/0xb0 [ 1111.712533] [] ? __sb_start_write+0x14f/0x310 [ 1111.712540] [] vfs_write+0x182/0x4e0 [ 1111.712548] [] SyS_write+0xdc/0x1c0 [ 1111.712556] [] ? SyS_read+0x1c0/0x1c0 [ 1111.712567] [] ? lockdep_sys_exit_thunk+0x12/0x14 [ 1111.712577] [] entry_SYSCALL_64_fastpath+0x1e/0x9a [ 1111.713114] Mem-Info: [ 1111.713141] active_anon:70081 inactive_anon:6175 isolated_anon:0 [ 1111.713141] active_file:11182 inactive_file:11777 isolated_file:0 [ 1111.713141] unevictable:0 dirty:47 writeback:0 unstable:0 [ 1111.713141] slab_reclaimable:4389 slab_unreclaimable:63318 [ 1111.713141] mapped:59001 shmem:8670 pagetables:8478 bounce:0 [ 1111.713141] free:1406793 free_pcp:460 free_cma:0 [ 1111.713182] DMA32 free:2575072kB min:4696kB low:5868kB high:7044kB active_anon:127692kB inactive_anon:11396kB active_file:19752kB inactive_file:20788kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:3145324kB managed:3021976kB mlocked:0kB dirty:8kB writeback:0kB mapped:107888kB shmem:15528kB slab_reclaimable:8356kB slab_unreclaimable:114004kB kernel_stack:6304kB pagetables:15156kB unstable:0kB bounce:0kB free_pcp:656kB local_pcp:224kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no [ 1111.713192] lowmem_reserve[]: 0 3504 3504 [ 1111.713224] Normal free:3052100kB min:5580kB low:6972kB high:8368kB active_anon:152632kB inactive_anon:13304kB active_file:24976kB inactive_file:26320kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:4718592kB managed:3588764kB mlocked:0kB dirty:180kB writeback:0kB mapped:128116kB shmem:19152kB slab_reclaimable:9200kB slab_unreclaimable:139268kB kernel_stack:7808kB pagetables:18756kB unstable:0kB bounce:0kB free_pcp:1184kB local_pcp:564kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no [ 1111.713231] lowmem_reserve[]: 0 0 0 [ 1111.713284] DMA32: 124*4kB (UME) 314*8kB (UME) 342*16kB (UME) 175*32kB (UME) 54*64kB (UME) 25*128kB (UME) 12*256kB (UM) 5*512kB (M) 1*1024kB (E) 2*2048kB (UE) 621*4096kB (M) = 2575104kB [ 1111.713334] Normal: 365*4kB (UM) 283*8kB (UME) 285*16kB (UME) 181*32kB (UM) 66*64kB (UME) 34*128kB (UME) 10*256kB (UM) 8*512kB (UME) 4*1024kB (M) 4*2048kB (UME) 735*4096kB (M) = 3052156kB [ 1111.713337] 31628 total pagecache pages [ 1111.713340] 0 pages in swap cache [ 1111.713345] Swap cache stats: add 0, delete 0, find 0/0 [ 1111.713348] Free swap = 0kB [ 1111.713350] Total swap = 0kB [ 1111.713353] 1965979 pages RAM [ 1111.713356] 0 pages HighMem/MovableOnly [ 1111.713358] 313294 pages reserved [ 1112.327863] vmalloc: allocation failure: 0 bytes [ 1112.327869] syz-executor.4: page allocation failure: order:0, mode:0x24000c2 [ 1112.327879] CPU: 0 PID: 19090 Comm: syz-executor.4 Not tainted 4.4.174+ #4 [ 1112.327892] 0000000000000000 52a767bee4691572 ffff8801d7e579f0 ffffffff81aad1a1 [ 1112.327903] 1ffff1003afcaf41 ffff8801d01faf80 00000000024000c2 0000000000000000 [ 1112.327914] ffffffff82895080 ffff8801d7e57b00 ffffffff8148c0cb ffffffff00000001 [ 1112.327917] Call Trace: [ 1112.327933] [] dump_stack+0xc1/0x120 [ 1112.327962] [] warn_alloc_failed.cold+0x78/0x99 [ 1112.327974] [] ? zone_watermark_ok_safe+0x290/0x290 [ 1112.327983] [] ? sel_write_load+0x9e/0xf90 [ 1112.327995] [] __vmalloc_node_range+0x365/0x650 [ 1112.328005] [] ? check_preemption_disabled+0x3c/0x200 [ 1112.328014] [] ? check_preemption_disabled+0x3c/0x200 [ 1112.328021] [] ? task_has_security+0x130/0x270 [ 1112.328029] [] vmalloc+0x5c/0x70 [ 1112.328036] [] ? sel_write_load+0x119/0xf90 [ 1112.328044] [] sel_write_load+0x119/0xf90 [ 1112.328052] [] ? sel_read_bool+0x240/0x240 [ 1112.328061] [] ? trace_hardirqs_on+0x10/0x10 [ 1112.328069] [] __vfs_write+0x116/0x3d0 [ 1112.328076] [] ? sel_read_bool+0x240/0x240 [ 1112.328083] [] ? __vfs_read+0x3c0/0x3c0 [ 1112.328092] [] ? check_preemption_disabled+0x3c/0x200 [ 1112.328100] [] ? check_preemption_disabled+0x3c/0x200 [ 1112.328111] [] ? rcu_read_lock_sched_held+0x10b/0x130 [ 1112.328119] [] ? rcu_sync_lockdep_assert+0x73/0xb0 [ 1112.328128] [] ? __sb_start_write+0x14f/0x310 [ 1112.328138] [] vfs_write+0x182/0x4e0 [ 1112.328147] [] SyS_write+0xdc/0x1c0 [ 1112.328156] [] ? SyS_read+0x1c0/0x1c0 [ 1112.328166] [] ? lockdep_sys_exit_thunk+0x12/0x14 [ 1112.328177] [] entry_SYSCALL_64_fastpath+0x1e/0x9a [ 1112.328181] Mem-Info: [ 1112.328208] active_anon:70006 inactive_anon:5700 isolated_anon:0 [ 1112.328208] active_file:11182 inactive_file:11777 isolated_file:0 [ 1112.328208] unevictable:0 dirty:47 writeback:0 unstable:0 [ 1112.328208] slab_reclaimable:4389 slab_unreclaimable:63324 [ 1112.328208] mapped:58972 shmem:8152 pagetables:8515 bounce:0 [ 1112.328208] free:1407483 free_pcp:406 free_cma:0 [ 1112.328246] DMA32 free:2576732kB min:4696kB low:5868kB high:7044kB active_anon:127500kB inactive_anon:10244kB active_file:19752kB inactive_file:20788kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:3145324kB managed:3021976kB mlocked:0kB dirty:8kB writeback:0kB mapped:107920kB shmem:14340kB slab_reclaimable:8356kB slab_unreclaimable:113392kB kernel_stack:6240kB pagetables:15508kB unstable:0kB bounce:0kB free_pcp:988kB local_pcp:340kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no [ 1112.328255] lowmem_reserve[]: 0 3504 3504 [ 1112.328290] Normal free:3053200kB min:5580kB low:6972kB high:8368kB active_anon:152524kB inactive_anon:12556kB active_file:24976kB inactive_file:26320kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:4718592kB managed:3588764kB mlocked:0kB dirty:180kB writeback:0kB mapped:127968kB shmem:18268kB slab_reclaimable:9200kB slab_unreclaimable:139904kB kernel_stack:7872kB pagetables:18552kB unstable:0kB bounce:0kB free_pcp:636kB local_pcp:48kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no [ 1112.328300] lowmem_reserve[]: 0 0 0 [ 1112.329532] DMA32: 221*4kB (UME) 360*8kB (UME) 342*16kB (UME) 200*32kB (UME) 55*64kB (UME) 25*128kB (UME) 12*256kB (UM) 5*512kB (M) 1*1024kB (E) 2*2048kB (UE) 621*4096kB (M) = 2576724kB [ 1112.329590] Normal: 570*4kB (UM) 326*8kB (UME) 284*16kB (UME) 177*32kB (UM) 66*64kB (UME) 33*128kB (UME) 10*256kB (UM) 8*512kB (UME) 4*1024kB (M) 4*2048kB (UME) 735*4096kB (M) = 3053048kB [ 1112.329593] 31110 total pagecache pages [ 1112.329597] 0 pages in swap cache [ 1112.329602] Swap cache stats: add 0, delete 0, find 0/0 [ 1112.329604] Free swap = 0kB [ 1112.329607] Total swap = 0kB [ 1112.329609] 1965979 pages RAM [ 1112.329612] 0 pages HighMem/MovableOnly [ 1112.329614] 313294 pages reserved [ 1112.333762] binder: 19087:19091 transaction failed 29189/-22, size 0-0 line 3014 [ 1112.333888] binder: undelivered TRANSACTION_ERROR: 29189 [ 1112.511114] vmalloc: allocation failure: 0 bytes [ 1112.511121] syz-executor.4: page allocation failure: order:0, mode:0x24000c2 [ 1112.511130] CPU: 1 PID: 19115 Comm: syz-executor.4 Not tainted 4.4.174+ #4 [ 1112.511143] 0000000000000000 f7493711d674eb62 ffff8801bce9f9f0 ffffffff81aad1a1 [ 1112.511151] 1ffff100379d3f41 ffff8800b41117c0 00000000024000c2 0000000000000000 [ 1112.511162] ffffffff82895080 ffff8801bce9fb00 ffffffff8148c0cb ffffffff00000001 [ 1112.511165] Call Trace: [ 1112.511179] [] dump_stack+0xc1/0x120 [ 1112.511192] [] warn_alloc_failed.cold+0x78/0x99 [ 1112.511204] [] ? zone_watermark_ok_safe+0x290/0x290 [ 1112.511214] [] ? sel_write_load+0x9e/0xf90 [ 1112.511224] [] __vmalloc_node_range+0x365/0x650 [ 1112.511233] [] ? check_preemption_disabled+0x3c/0x200 [ 1112.511242] [] ? check_preemption_disabled+0x3c/0x200 [ 1112.511251] [] ? task_has_security+0x130/0x270 [ 1112.511260] [] vmalloc+0x5c/0x70 [ 1112.511280] [] ? sel_write_load+0x119/0xf90 [ 1112.511290] [] sel_write_load+0x119/0xf90 [ 1112.511299] [] ? sel_read_bool+0x240/0x240 [ 1112.511310] [] ? trace_hardirqs_on+0x10/0x10 [ 1112.511319] [] __vfs_write+0x116/0x3d0 [ 1112.511326] [] ? sel_read_bool+0x240/0x240 [ 1112.511334] [] ? __vfs_read+0x3c0/0x3c0 [ 1112.511344] [] ? check_preemption_disabled+0x3c/0x200 [ 1112.511354] [] ? check_preemption_disabled+0x3c/0x200 [ 1112.511363] [] ? rcu_read_lock_sched_held+0x10b/0x130 [ 1112.511371] [] ? rcu_sync_lockdep_assert+0x73/0xb0 [ 1112.511380] [] ? __sb_start_write+0x14f/0x310 [ 1112.511388] [] vfs_write+0x182/0x4e0 [ 1112.511395] [] SyS_write+0xdc/0x1c0 [ 1112.511403] [] ? SyS_read+0x1c0/0x1c0 [ 1112.511413] [] ? lockdep_sys_exit_thunk+0x12/0x14 [ 1112.511422] [] entry_SYSCALL_64_fastpath+0x1e/0x9a [ 1112.512141] binder: 19109:19116 transaction failed 29189/-22, size 0-0 line 3014 [ 1112.512310] binder: undelivered TRANSACTION_ERROR: 29189 [ 1112.512940] Mem-Info: [ 1112.512966] active_anon:70131 inactive_anon:6200 isolated_anon:0 [ 1112.512966] active_file:11182 inactive_file:11777 isolated_file:0 [ 1112.512966] unevictable:0 dirty:47 writeback:0 unstable:0 [ 1112.512966] slab_reclaimable:4389 slab_unreclaimable:63378 [ 1112.512966] mapped:59009 shmem:8670 pagetables:8515 bounce:0 [ 1112.512966] free:1406679 free_pcp:416 free_cma:0 [ 1112.512999] DMA32 free:2575092kB min:4696kB low:5868kB high:7044kB active_anon:127700kB inactive_anon:11544kB active_file:19752kB inactive_file:20788kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:3145324kB managed:3021976kB mlocked:0kB dirty:8kB writeback:0kB mapped:108068kB shmem:15672kB slab_reclaimable:8356kB slab_unreclaimable:113600kB kernel_stack:6240kB pagetables:15212kB unstable:0kB bounce:0kB free_pcp:1084kB local_pcp:484kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no [ 1112.513009] lowmem_reserve[]: 0 3504 3504 [ 1112.513040] Normal free:3051624kB min:5580kB low:6972kB high:8368kB active_anon:152824kB inactive_anon:13256kB active_file:24976kB inactive_file:26320kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:4718592kB managed:3588764kB mlocked:0kB dirty:180kB writeback:0kB mapped:127968kB shmem:19008kB slab_reclaimable:9200kB slab_unreclaimable:139912kB kernel_stack:7872kB pagetables:18848kB unstable:0kB bounce:0kB free_pcp:580kB local_pcp:252kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no [ 1112.513049] lowmem_reserve[]: 0 0 0 [ 1112.513104] DMA32: 21*4kB (UE) 272*8kB (UME) 342*16kB (UME) 195*32kB (UME) 55*64kB (UME) 25*128kB (UME) 12*256kB (UM) 5*512kB (M) 1*1024kB (E) 2*2048kB (UE) 621*4096kB (M) = 2575060kB [ 1112.513158] Normal: 310*4kB (U) 300*8kB (UME) 285*16kB (UME) 165*32kB (UM) 66*64kB (UME) 34*128kB (UME) 10*256kB (UM) 8*512kB (UME) 4*1024kB (M) 4*2048kB (UME) 735*4096kB (M) = 3051560kB [ 1112.513161] 31628 total pagecache pages [ 1112.513164] 0 pages in swap cache [ 1112.513169] Swap cache stats: add 0, delete 0, find 0/0 [ 1112.513172] Free swap = 0kB [ 1112.513174] Total swap = 0kB [ 1112.513177] 1965979 pages RAM [ 1112.513179] 0 pages HighMem/MovableOnly [ 1112.513182] 313294 pages reserved [ 1113.121123] binder: 19128:19129 transaction failed 29189/-22, size 0-0 line 3014 [ 1113.121294] binder: undelivered TRANSACTION_ERROR: 29189 [ 1113.138440] vmalloc: allocation failure: 0 bytes [ 1113.138446] syz-executor.4: page allocation failure: order:0, mode:0x24000c2 [ 1113.138455] CPU: 0 PID: 19133 Comm: syz-executor.4 Not tainted 4.4.174+ #4 [ 1113.138475] 0000000000000000 c3c8a6f0d687a5fd ffff88009f5ef9f0 ffffffff81aad1a1 [ 1113.138486] 1ffff10013ebdf41 ffff8801d8638000 00000000024000c2 0000000000000000 [ 1113.138497] ffffffff82895080 ffff88009f5efb00 ffffffff8148c0cb ffffffff00000001 [ 1113.138500] Call Trace: [ 1113.138513] [] dump_stack+0xc1/0x120 [ 1113.138526] [] warn_alloc_failed.cold+0x78/0x99 [ 1113.138538] [] ? zone_watermark_ok_safe+0x290/0x290 [ 1113.138547] [] ? sel_write_load+0x9e/0xf90 [ 1113.138557] [] __vmalloc_node_range+0x365/0x650 [ 1113.138565] [] ? check_preemption_disabled+0x3c/0x200 [ 1113.138574] [] ? check_preemption_disabled+0x3c/0x200 [ 1113.138581] [] ? task_has_security+0x130/0x270 [ 1113.138588] [] vmalloc+0x5c/0x70 [ 1113.138597] [] ? sel_write_load+0x119/0xf90 [ 1113.138603] [] sel_write_load+0x119/0xf90 [ 1113.138611] [] ? sel_read_bool+0x240/0x240 [ 1113.138620] [] ? trace_hardirqs_on+0x10/0x10 [ 1113.138628] [] __vfs_write+0x116/0x3d0 [ 1113.138635] [] ? sel_read_bool+0x240/0x240 [ 1113.138642] [] ? __vfs_read+0x3c0/0x3c0 [ 1113.138650] [] ? check_preemption_disabled+0x3c/0x200 [ 1113.138657] [] ? check_preemption_disabled+0x3c/0x200 [ 1113.138666] [] ? rcu_read_lock_sched_held+0x10b/0x130 [ 1113.138673] [] ? rcu_sync_lockdep_assert+0x73/0xb0 [ 1113.138681] [] ? __sb_start_write+0x14f/0x310 [ 1113.138689] [] vfs_write+0x182/0x4e0 [ 1113.138696] [] SyS_write+0xdc/0x1c0 [ 1113.138703] [] ? SyS_read+0x1c0/0x1c0 [ 1113.138713] [] ? lockdep_sys_exit_thunk+0x12/0x14 [ 1113.138722] [] entry_SYSCALL_64_fastpath+0x1e/0x9a [ 1113.148909] Mem-Info: [ 1113.148945] active_anon:70031 inactive_anon:5725 isolated_anon:0 [ 1113.148945] active_file:11182 inactive_file:11777 isolated_file:0 [ 1113.148945] unevictable:0 dirty:47 writeback:0 unstable:0 [ 1113.148945] slab_reclaimable:4389 slab_unreclaimable:63569 [ 1113.148945] mapped:58935 shmem:8152 pagetables:8478 bounce:0 [ 1113.148945] free:1407045 free_pcp:575 free_cma:0 [ 1113.148984] DMA32 free:2576268kB min:4696kB low:5868kB high:7044kB active_anon:127600kB inactive_anon:10344kB active_file:19752kB inactive_file:20788kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:3145324kB managed:3021976kB mlocked:0kB dirty:8kB writeback:0kB mapped:107772kB shmem:14340kB slab_reclaimable:8356kB slab_unreclaimable:113700kB kernel_stack:6240kB pagetables:15212kB unstable:0kB bounce:0kB free_pcp:1188kB local_pcp:472kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no [ 1113.148995] lowmem_reserve[]: 0 3504 3504 [ 1113.149025] Normal free:3051912kB min:5580kB low:6972kB high:8368kB active_anon:152524kB inactive_anon:12556kB active_file:24976kB inactive_file:26320kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:4718592kB managed:3588764kB mlocked:0kB dirty:180kB writeback:0kB mapped:127968kB shmem:18268kB slab_reclaimable:9200kB slab_unreclaimable:140576kB kernel_stack:7872kB pagetables:18700kB unstable:0kB bounce:0kB free_pcp:1112kB local_pcp:452kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no [ 1113.149033] lowmem_reserve[]: 0 0 0 [ 1113.149088] DMA32: 243*4kB (UME) 307*8kB (UME) 345*16kB (UME) 194*32kB (UME) 55*64kB (UME) 25*128kB (UME) 12*256kB (UM) 5*512kB (M) 1*1024kB (E) 2*2048kB (UE) 621*4096kB (M) = 2576244kB [ 1113.149142] Normal: 456*4kB (UM) 316*8kB (UME) 284*16kB (UME) 175*32kB (UM) 66*64kB (UME) 29*128kB (UME) 10*256kB (UM) 8*512kB (UME) 4*1024kB (M) 4*2048kB (UME) 735*4096kB (M) = 3051936kB [ 1113.149144] 31110 total pagecache pages [ 1113.149148] 0 pages in swap cache [ 1113.149153] Swap cache stats: add 0, delete 0, find 0/0 [ 1113.149155] Free swap = 0kB [ 1113.149157] Total swap = 0kB [ 1113.149161] 1965979 pages RAM [ 1113.149165] 0 pages HighMem/MovableOnly [ 1113.149169] 313294 pages reserved [ 1113.240911] binder: 19143:19148 transaction failed 29189/-22, size 0-0 line 3014 [ 1113.241075] binder: undelivered TRANSACTION_ERROR: 29189 [ 1113.354450] binder: 19160:19164 transaction failed 29189/-22, size 0-0 line 3014 [ 1113.354585] binder: undelivered TRANSACTION_ERROR: 29189 [ 1114.044885] binder: 19175:19185 transaction failed 29189/-22, size 0-0 line 3014 [ 1114.045008] binder: undelivered TRANSACTION_ERROR: 29189 [ 1114.131957] binder: 19197:19199 transaction failed 29189/-22, size 0-0 line 3014 [ 1114.132130] binder: undelivered TRANSACTION_ERROR: 29189 [ 1114.786239] binder_alloc: 19216: binder_alloc_buf, no vma [ 1114.786442] binder: 19216:19224 transaction failed 29189/-3, size 0-0 line 3137 [ 1114.798449] binder: undelivered TRANSACTION_ERROR: 29189 [ 1114.883592] binder: 19238:19241 transaction failed 29189/-22, size 0-0 line 3014 [ 1114.883728] binder: undelivered TRANSACTION_ERROR: 29189 [ 1115.531551] warn_alloc_failed: 8 callbacks suppressed [ 1115.531558] vmalloc: allocation failure: 0 bytes [ 1115.531563] syz-executor.4: page allocation failure: order:0, mode:0x24000c2 [ 1115.531572] CPU: 1 PID: 19265 Comm: syz-executor.4 Not tainted 4.4.174+ #4 [ 1115.531585] 0000000000000000 a4ea93e5c88cf053 ffff8801d04af9f0 ffffffff81aad1a1 [ 1115.531595] 1ffff1003a095f41 ffff8800b7a0df00 00000000024000c2 0000000000000000 [ 1115.531606] ffffffff82895080 ffff8801d04afb00 ffffffff8148c0cb ffffffff00000001 [ 1115.531608] Call Trace: [ 1115.531622] [] dump_stack+0xc1/0x120 [ 1115.531635] [] warn_alloc_failed.cold+0x78/0x99 [ 1115.531646] [] ? zone_watermark_ok_safe+0x290/0x290 [ 1115.531657] [] ? sel_write_load+0x9e/0xf90 [ 1115.531665] [] __vmalloc_node_range+0x365/0x650 [ 1115.531675] [] ? check_preemption_disabled+0x3c/0x200 [ 1115.531684] [] ? check_preemption_disabled+0x3c/0x200 [ 1115.531693] [] ? task_has_security+0x130/0x270 [ 1115.531702] [] vmalloc+0x5c/0x70 [ 1115.531710] [] ? sel_write_load+0x119/0xf90 [ 1115.531718] [] sel_write_load+0x119/0xf90 [ 1115.531726] [] ? sel_read_bool+0x240/0x240 [ 1115.531735] [] ? trace_hardirqs_on+0x10/0x10 [ 1115.531743] [] __vfs_write+0x116/0x3d0 [ 1115.531753] [] ? sel_read_bool+0x240/0x240 [ 1115.531762] [] ? __vfs_read+0x3c0/0x3c0 [ 1115.531771] [] ? check_preemption_disabled+0x3c/0x200 [ 1115.531778] [] ? check_preemption_disabled+0x3c/0x200 [ 1115.531788] [] ? rcu_read_lock_sched_held+0x10b/0x130 [ 1115.531796] [] ? rcu_sync_lockdep_assert+0x73/0xb0 [ 1115.531805] [] ? __sb_start_write+0x14f/0x310 [ 1115.531812] [] vfs_write+0x182/0x4e0 [ 1115.531820] [] SyS_write+0xdc/0x1c0 [ 1115.531827] [] ? SyS_read+0x1c0/0x1c0 [ 1115.531837] [] ? lockdep_sys_exit_thunk+0x12/0x14 [ 1115.531847] [] entry_SYSCALL_64_fastpath+0x1e/0x9a [ 1115.531850] Mem-Info: [ 1115.531876] active_anon:70004 inactive_anon:5725 isolated_anon:0 [ 1115.531876] active_file:11182 inactive_file:11777 isolated_file:0 [ 1115.531876] unevictable:0 dirty:47 writeback:0 unstable:0 [ 1115.531876] slab_reclaimable:4393 slab_unreclaimable:63548 [ 1115.531876] mapped:58964 shmem:8152 pagetables:8478 bounce:0 [ 1115.531876] free:1407175 free_pcp:502 free_cma:0 [ 1115.531912] DMA32 free:2575944kB min:4696kB low:5868kB high:7044kB active_anon:127436kB inactive_anon:10296kB active_file:19752kB inactive_file:20788kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:3145324kB managed:3021976kB mlocked:0kB dirty:8kB writeback:0kB mapped:107828kB shmem:14336kB slab_reclaimable:8372kB slab_unreclaimable:114272kB kernel_stack:6240kB pagetables:15140kB unstable:0kB bounce:0kB free_pcp:1188kB local_pcp:524kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no [ 1115.531921] lowmem_reserve[]: 0 3504 3504 [ 1115.531952] Normal free:3052756kB min:5580kB low:6972kB high:8368kB active_anon:152580kB inactive_anon:12604kB active_file:24976kB inactive_file:26320kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:4718592kB managed:3588764kB mlocked:0kB dirty:180kB writeback:0kB mapped:128028kB shmem:18272kB slab_reclaimable:9200kB slab_unreclaimable:139920kB kernel_stack:7840kB pagetables:18772kB unstable:0kB bounce:0kB free_pcp:820kB local_pcp:96kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no [ 1115.531961] lowmem_reserve[]: 0 0 0 [ 1115.532023] DMA32: 74*4kB (UME) 325*8kB (UME) 349*16kB (UME) 196*32kB (UME) 57*64kB (UME) 25*128kB (UME) 12*256kB (UM) 5*512kB (M) 1*1024kB (E) 2*2048kB (UE) 621*4096kB (M) = 2575968kB [ 1115.532077] Normal: 667*4kB (UM) 289*8kB (UME) 290*16kB (UME) 175*32kB (UM) 65*64kB (ME) 30*128kB (UME) 10*256kB (UM) 8*512kB (UME) 4*1024kB (M) 4*2048kB (UME) 735*4096kB (M) = 3052724kB [ 1115.532080] 31110 total pagecache pages [ 1115.532084] 0 pages in swap cache [ 1115.532088] Swap cache stats: add 0, delete 0, find 0/0 [ 1115.532091] Free swap = 0kB [ 1115.532093] Total swap = 0kB [ 1115.532096] 1965979 pages RAM [ 1115.532099] 0 pages HighMem/MovableOnly [ 1115.532101] 313294 pages reserved [ 1115.533184] binder: 19260:19266 transaction failed 29189/-22, size 0-0 line 3014 [ 1115.533418] binder: undelivered TRANSACTION_ERROR: 29189 [ 1115.629783] vmalloc: allocation failure: 0 bytes [ 1115.629790] syz-executor.4: page allocation failure: order:0, mode:0x24000c2 [ 1115.629800] CPU: 1 PID: 19282 Comm: syz-executor.4 Not tainted 4.4.174+ #4 [ 1115.629814] 0000000000000000 fb2ce78a7636736f ffff8800b464f9f0 ffffffff81aad1a1 [ 1115.629825] 1ffff100168c9f41 ffff8801bdfac740 00000000024000c2 0000000000000000 [ 1115.629835] ffffffff82895080 ffff8800b464fb00 ffffffff8148c0cb ffffffff00000001 [ 1115.629838] Call Trace: [ 1115.629853] [] dump_stack+0xc1/0x120 [ 1115.629865] [] warn_alloc_failed.cold+0x78/0x99 [ 1115.629877] [] ? zone_watermark_ok_safe+0x290/0x290 [ 1115.629887] [] ? sel_write_load+0x9e/0xf90 [ 1115.629898] [] __vmalloc_node_range+0x365/0x650 [ 1115.629908] [] ? check_preemption_disabled+0x3c/0x200 [ 1115.629915] [] ? check_preemption_disabled+0x3c/0x200 [ 1115.629924] [] ? task_has_security+0x130/0x270 [ 1115.629931] [] vmalloc+0x5c/0x70 [ 1115.629938] [] ? sel_write_load+0x119/0xf90 [ 1115.629946] [] sel_write_load+0x119/0xf90 [ 1115.629956] [] ? sel_read_bool+0x240/0x240 [ 1115.629967] [] ? trace_hardirqs_on+0x10/0x10 [ 1115.629976] [] __vfs_write+0x116/0x3d0 [ 1115.629984] [] ? sel_read_bool+0x240/0x240 [ 1115.629991] [] ? __vfs_read+0x3c0/0x3c0 [ 1115.629999] [] ? check_preemption_disabled+0x3c/0x200 [ 1115.630007] [] ? check_preemption_disabled+0x3c/0x200 [ 1115.630016] [] ? rcu_read_lock_sched_held+0x10b/0x130 [ 1115.630024] [] ? rcu_sync_lockdep_assert+0x73/0xb0 [ 1115.630033] [] ? __sb_start_write+0x14f/0x310 [ 1115.630041] [] vfs_write+0x182/0x4e0 [ 1115.630049] [] SyS_write+0xdc/0x1c0 [ 1115.630057] [] ? SyS_read+0x1c0/0x1c0 [ 1115.630066] [] ? lockdep_sys_exit_thunk+0x12/0x14 [ 1115.630076] [] entry_SYSCALL_64_fastpath+0x1e/0x9a [ 1115.630079] Mem-Info: [ 1115.630105] active_anon:70104 inactive_anon:5700 isolated_anon:0 [ 1115.630105] active_file:11182 inactive_file:11777 isolated_file:0 [ 1115.630105] unevictable:0 dirty:47 writeback:0 unstable:0 [ 1115.630105] slab_reclaimable:4393 slab_unreclaimable:63393 [ 1115.630105] mapped:59038 shmem:8152 pagetables:8552 bounce:0 [ 1115.630105] free:1407094 free_pcp:496 free_cma:0 [ 1115.630140] DMA32 free:2575972kB min:4696kB low:5868kB high:7044kB active_anon:127636kB inactive_anon:10296kB active_file:19752kB inactive_file:20788kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:3145324kB managed:3021976kB mlocked:0kB dirty:8kB writeback:0kB mapped:107976kB shmem:14336kB slab_reclaimable:8372kB slab_unreclaimable:114028kB kernel_stack:6240kB pagetables:15140kB unstable:0kB bounce:0kB free_pcp:1132kB local_pcp:508kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no [ 1115.630150] lowmem_reserve[]: 0 3504 3504 [ 1115.630180] Normal free:3052404kB min:5580kB low:6972kB high:8368kB active_anon:152780kB inactive_anon:12504kB active_file:24976kB inactive_file:26320kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:4718592kB managed:3588764kB mlocked:0kB dirty:180kB writeback:0kB mapped:128176kB shmem:18272kB slab_reclaimable:9200kB slab_unreclaimable:139544kB kernel_stack:7840kB pagetables:19068kB unstable:0kB bounce:0kB free_pcp:852kB local_pcp:288kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no [ 1115.631817] lowmem_reserve[]: 0 0 0 [ 1115.631878] DMA32: 87*4kB (UME) 299*8kB (UME) 348*16kB (UME) 200*32kB (UME) 59*64kB (UME) 24*128kB (UME) 12*256kB (UM) 5*512kB (M) 1*1024kB (E) 2*2048kB (UE) 621*4096kB (M) = 2575924kB [ 1115.631939] Normal: 512*4kB (UM) 287*8kB (UME) 290*16kB (UME) 182*32kB (UM) 65*64kB (ME) 30*128kB (UME) 10*256kB (UM) 8*512kB (UME) 4*1024kB (M) 4*2048kB (UME) 735*4096kB (M) = 3052312kB [ 1115.631942] 31110 total pagecache pages [ 1115.631945] 0 pages in swap cache [ 1115.631949] Swap cache stats: add 0, delete 0, find 0/0 [ 1115.631953] Free swap = 0kB [ 1115.631955] Total swap = 0kB [ 1115.631960] 1965979 pages RAM [ 1115.631963] 0 pages HighMem/MovableOnly [ 1115.631966] 313294 pages reserved [ 1115.653509] binder: 19277:19285 transaction failed 29189/-22, size 0-0 line 3014 [ 1115.653687] binder: undelivered TRANSACTION_ERROR: 29189 [ 1115.788217] vmalloc: allocation failure: 0 bytes [ 1115.788223] syz-executor.4: page allocation failure: order:0, mode:0x24000c2 [ 1115.788232] CPU: 1 PID: 19294 Comm: syz-executor.4 Not tainted 4.4.174+ #4 [ 1115.788245] 0000000000000000 ab6d64daf818e8e6 ffff8801bdbef9f0 ffffffff81aad1a1 [ 1115.788254] 1ffff10037b7df41 ffff8801bddcc740 00000000024000c2 0000000000000000 [ 1115.788264] ffffffff82895080 ffff8801bdbefb00 ffffffff8148c0cb ffffffff00000001 [ 1115.788267] Call Trace: [ 1115.788280] [] dump_stack+0xc1/0x120 [ 1115.788293] [] warn_alloc_failed.cold+0x78/0x99 [ 1115.788305] [] ? zone_watermark_ok_safe+0x290/0x290 [ 1115.788315] [] ? sel_write_load+0x9e/0xf90 [ 1115.788324] [] __vmalloc_node_range+0x365/0x650 [ 1115.788333] [] ? check_preemption_disabled+0x3c/0x200 [ 1115.788340] [] ? check_preemption_disabled+0x3c/0x200 [ 1115.788348] [] ? task_has_security+0x130/0x270 [ 1115.788355] [] vmalloc+0x5c/0x70 [ 1115.788362] [] ? sel_write_load+0x119/0xf90 [ 1115.788368] [] sel_write_load+0x119/0xf90 [ 1115.788377] [] ? sel_read_bool+0x240/0x240 [ 1115.788388] [] ? trace_hardirqs_on+0x10/0x10 [ 1115.788398] [] __vfs_write+0x116/0x3d0 [ 1115.788407] [] ? sel_read_bool+0x240/0x240 [ 1115.788416] [] ? __vfs_read+0x3c0/0x3c0 [ 1115.788424] [] ? check_preemption_disabled+0x3c/0x200 [ 1115.788432] [] ? check_preemption_disabled+0x3c/0x200 [ 1115.788453] [] ? rcu_read_lock_sched_held+0x10b/0x130 [ 1115.788463] [] ? rcu_sync_lockdep_assert+0x73/0xb0 [ 1115.788473] [] ? __sb_start_write+0x14f/0x310 [ 1115.788482] [] vfs_write+0x182/0x4e0 [ 1115.788493] [] SyS_write+0xdc/0x1c0 [ 1115.788503] [] ? SyS_read+0x1c0/0x1c0 [ 1115.788517] [] ? lockdep_sys_exit_thunk+0x12/0x14 [ 1115.788530] [] entry_SYSCALL_64_fastpath+0x1e/0x9a [ 1115.788534] Mem-Info: [ 1115.788562] active_anon:70079 inactive_anon:6175 isolated_anon:0 [ 1115.788562] active_file:11182 inactive_file:11777 isolated_file:0 [ 1115.788562] unevictable:0 dirty:47 writeback:0 unstable:0 [ 1115.788562] slab_reclaimable:4393 slab_unreclaimable:63349 [ 1115.788562] mapped:58964 shmem:8670 pagetables:8478 bounce:0 [ 1115.788562] free:1406820 free_pcp:585 free_cma:0 [ 1115.788601] DMA32 free:2575712kB min:4696kB low:5868kB high:7044kB active_anon:127736kB inactive_anon:10496kB active_file:19752kB inactive_file:20788kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:3145324kB managed:3021976kB mlocked:0kB dirty:8kB writeback:0kB mapped:107828kB shmem:14632kB slab_reclaimable:8372kB slab_unreclaimable:114132kB kernel_stack:6240kB pagetables:15140kB unstable:0kB bounce:0kB free_pcp:1172kB local_pcp:696kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no [ 1115.788612] lowmem_reserve[]: 0 3504 3504 [ 1115.788648] Normal free:3051568kB min:5580kB low:6972kB high:8368kB active_anon:152580kB inactive_anon:14204kB active_file:24976kB inactive_file:26320kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:4718592kB managed:3588764kB mlocked:0kB dirty:180kB writeback:0kB mapped:128028kB shmem:20048kB slab_reclaimable:9200kB slab_unreclaimable:139264kB kernel_stack:7840kB pagetables:18772kB unstable:0kB bounce:0kB free_pcp:1168kB local_pcp:552kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no [ 1115.788656] lowmem_reserve[]: 0 0 0 [ 1115.788721] DMA32: 64*4kB (UME) 296*8kB (UME) 351*16kB (UME) 189*32kB (UME) 59*64kB (UME) 25*128kB (UME) 12*256kB (UM) 5*512kB (M) 1*1024kB (E) 2*2048kB (UE) 621*4096kB (M) = 2575632kB [ 1115.788776] Normal: 430*4kB (UM) 235*8kB (UME) 290*16kB (UME) 184*32kB (UM) 65*64kB (ME) 30*128kB (UME) 10*256kB (UM) 8*512kB (UME) 4*1024kB (M) 4*2048kB (UME) 735*4096kB (M) = 3051632kB [ 1115.788778] 31628 total pagecache pages [ 1115.788782] 0 pages in swap cache [ 1115.788787] Swap cache stats: add 0, delete 0, find 0/0 [ 1115.788790] Free swap = 0kB [ 1115.788793] Total swap = 0kB [ 1115.788796] 1965979 pages RAM [ 1115.788799] 0 pages HighMem/MovableOnly [ 1115.788802] 313294 pages reserved [ 1116.300749] vmalloc: allocation failure: 0 bytes [ 1116.300775] syz-executor.4: page allocation failure: order:0, mode:0x24000c2 [ 1116.300786] CPU: 0 PID: 19309 Comm: syz-executor.4 Not tainted 4.4.174+ #4 [ 1116.300799] 0000000000000000 c38023753963beb8 ffff8800a43b79f0 ffffffff81aad1a1 [ 1116.300810] 1ffff10014876f41 ffff8800b8825f00 00000000024000c2 0000000000000000 [ 1116.300821] ffffffff82895080 ffff8800a43b7b00 ffffffff8148c0cb ffffffff00000001 [ 1116.300823] Call Trace: [ 1116.300838] [] dump_stack+0xc1/0x120 [ 1116.300850] [] warn_alloc_failed.cold+0x78/0x99 [ 1116.300862] [] ? zone_watermark_ok_safe+0x290/0x290 [ 1116.300870] [] ? sel_write_load+0x9e/0xf90 [ 1116.300882] [] __vmalloc_node_range+0x365/0x650 [ 1116.300893] [] ? check_preemption_disabled+0x3c/0x200 [ 1116.300902] [] ? check_preemption_disabled+0x3c/0x200 [ 1116.300913] [] ? task_has_security+0x130/0x270 [ 1116.300921] [] vmalloc+0x5c/0x70 [ 1116.300931] [] ? sel_write_load+0x119/0xf90 [ 1116.300948] [] sel_write_load+0x119/0xf90 [ 1116.300957] [] ? sel_read_bool+0x240/0x240 [ 1116.300967] [] ? trace_hardirqs_on+0x10/0x10 [ 1116.300977] [] __vfs_write+0x116/0x3d0 [ 1116.300985] [] ? sel_read_bool+0x240/0x240 [ 1116.300993] [] ? __vfs_read+0x3c0/0x3c0 [ 1116.301001] [] ? check_preemption_disabled+0x3c/0x200 [ 1116.301010] [] ? check_preemption_disabled+0x3c/0x200 [ 1116.301022] [] ? rcu_read_lock_sched_held+0x10b/0x130 [ 1116.301039] [] ? rcu_sync_lockdep_assert+0x73/0xb0 [ 1116.301050] [] ? __sb_start_write+0x14f/0x310 [ 1116.301059] [] vfs_write+0x182/0x4e0 [ 1116.301069] [] SyS_write+0xdc/0x1c0 [ 1116.301077] [] ? SyS_read+0x1c0/0x1c0 [ 1116.301087] [] ? lockdep_sys_exit_thunk+0x12/0x14 [ 1116.301097] [] entry_SYSCALL_64_fastpath+0x1e/0x9a [ 1116.301252] Mem-Info: [ 1116.301278] active_anon:70027 inactive_anon:5685 isolated_anon:0 [ 1116.301278] active_file:11182 inactive_file:11777 isolated_file:0 [ 1116.301278] unevictable:0 dirty:47 writeback:0 unstable:0 [ 1116.301278] slab_reclaimable:4393 slab_unreclaimable:63628 [ 1116.301278] mapped:58948 shmem:8143 pagetables:8511 bounce:0 [ 1116.301278] free:1406967 free_pcp:536 free_cma:0 [ 1116.301312] DMA32 free:2575816kB min:4696kB low:5868kB high:7044kB active_anon:127636kB inactive_anon:10208kB active_file:19752kB inactive_file:20788kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:3145324kB managed:3021976kB mlocked:0kB dirty:8kB writeback:0kB mapped:107824kB shmem:14288kB slab_reclaimable:8372kB slab_unreclaimable:114368kB kernel_stack:6304kB pagetables:15348kB unstable:0kB bounce:0kB free_pcp:940kB local_pcp:684kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no [ 1116.301322] lowmem_reserve[]: 0 3504 3504 [ 1116.301356] Normal free:3052052kB min:5580kB low:6972kB high:8368kB active_anon:152472kB inactive_anon:12532kB active_file:24976kB inactive_file:26320kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:4718592kB managed:3588764kB mlocked:0kB dirty:180kB writeback:0kB mapped:127968kB shmem:18284kB slab_reclaimable:9200kB slab_unreclaimable:140144kB kernel_stack:7840kB pagetables:18696kB unstable:0kB bounce:0kB free_pcp:1204kB local_pcp:700kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no [ 1116.301366] lowmem_reserve[]: 0 0 0 [ 1116.301428] DMA32: 92*4kB (ME) 313*8kB (UME) 351*16kB (UME) 186*32kB (UME) 59*64kB (UME) 25*128kB (UME) 12*256kB (UM) 5*512kB (M) 1*1024kB (E) 2*2048kB (UE) 621*4096kB (M) = 2575784kB [ 1116.301484] Normal: 531*4kB (UM) 287*8kB (UME) 289*16kB (UME) 175*32kB (UM) 65*64kB (ME) 29*128kB (UME) 10*256kB (UM) 8*512kB (UME) 4*1024kB (M) 4*2048kB (UME) 735*4096kB (M) = 3052020kB [ 1116.301487] 31101 total pagecache pages [ 1116.301492] 0 pages in swap cache [ 1116.301497] Swap cache stats: add 0, delete 0, find 0/0 [ 1116.301500] Free swap = 0kB [ 1116.301504] Total swap = 0kB [ 1116.301507] 1965979 pages RAM [ 1116.301509] 0 pages HighMem/MovableOnly [ 1116.301512] 313294 pages reserved [ 1116.303087] binder: 19301:19310 transaction failed 29189/-22, size 0-0 line 3014 [ 1116.303250] binder: undelivered TRANSACTION_ERROR: 29189 [ 1116.394199] vmalloc: allocation failure: 0 bytes [ 1116.394206] syz-executor.4: page allocation failure: order:0, mode:0x24000c2 [ 1116.394215] CPU: 0 PID: 19319 Comm: syz-executor.4 Not tainted 4.4.174+ #4 [ 1116.394227] 0000000000000000 808947ff1bc4da89 ffff8800b65c79f0 ffffffff81aad1a1 [ 1116.394238] 1ffff10016cb8f41 ffff8800b972c740 00000000024000c2 0000000000000000 [ 1116.394249] ffffffff82895080 ffff8800b65c7b00 ffffffff8148c0cb ffffffff00000001 [ 1116.394252] Call Trace: [ 1116.394266] [] dump_stack+0xc1/0x120 [ 1116.394280] [] warn_alloc_failed.cold+0x78/0x99 [ 1116.394292] [] ? zone_watermark_ok_safe+0x290/0x290 [ 1116.394302] [] ? sel_write_load+0x9e/0xf90 [ 1116.394313] [] __vmalloc_node_range+0x365/0x650 [ 1116.394324] [] ? check_preemption_disabled+0x3c/0x200 [ 1116.394333] [] ? check_preemption_disabled+0x3c/0x200 [ 1116.394341] [] ? task_has_security+0x130/0x270 [ 1116.394348] [] vmalloc+0x5c/0x70 [ 1116.394356] [] ? sel_write_load+0x119/0xf90 [ 1116.394363] [] sel_write_load+0x119/0xf90 [ 1116.394371] [] ? sel_read_bool+0x240/0x240 [ 1116.394380] [] ? trace_hardirqs_on+0x10/0x10 [ 1116.394389] [] __vfs_write+0x116/0x3d0 [ 1116.394397] [] ? sel_read_bool+0x240/0x240 [ 1116.394404] [] ? __vfs_read+0x3c0/0x3c0 [ 1116.394412] [] ? check_preemption_disabled+0x3c/0x200 [ 1116.394420] [] ? check_preemption_disabled+0x3c/0x200 [ 1116.394430] [] ? rcu_read_lock_sched_held+0x10b/0x130 [ 1116.394439] [] ? rcu_sync_lockdep_assert+0x73/0xb0 [ 1116.394452] [] ? __sb_start_write+0x14f/0x310 [ 1116.394462] [] vfs_write+0x182/0x4e0 [ 1116.394471] [] SyS_write+0xdc/0x1c0 [ 1116.394497] [] ? SyS_read+0x1c0/0x1c0 [ 1116.394521] [] ? lockdep_sys_exit_thunk+0x12/0x14 [ 1116.394533] [] entry_SYSCALL_64_fastpath+0x1e/0x9a [ 1116.394536] Mem-Info: [ 1116.394562] active_anon:70052 inactive_anon:5685 isolated_anon:0 [ 1116.394562] active_file:11182 inactive_file:11777 isolated_file:0 [ 1116.394562] unevictable:0 dirty:47 writeback:0 unstable:0 [ 1116.394562] slab_reclaimable:4393 slab_unreclaimable:63539 [ 1116.394562] mapped:58948 shmem:8143 pagetables:8511 bounce:0 [ 1116.394562] free:1407092 free_pcp:509 free_cma:0 [ 1116.394603] DMA32 free:2575812kB min:4696kB low:5868kB high:7044kB active_anon:127636kB inactive_anon:10208kB active_file:19752kB inactive_file:20788kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:3145324kB managed:3021976kB mlocked:0kB dirty:8kB writeback:0kB mapped:107824kB shmem:14288kB slab_reclaimable:8372kB slab_unreclaimable:114140kB kernel_stack:6304kB pagetables:15348kB unstable:0kB bounce:0kB free_pcp:836kB local_pcp:688kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no [ 1116.394615] lowmem_reserve[]: 0 3504 3504 [ 1116.394650] Normal free:3052556kB min:5580kB low:6972kB high:8368kB active_anon:152572kB inactive_anon:12532kB active_file:24976kB inactive_file:26320kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:4718592kB managed:3588764kB mlocked:0kB dirty:180kB writeback:0kB mapped:127968kB shmem:18284kB slab_reclaimable:9200kB slab_unreclaimable:140016kB kernel_stack:7840kB pagetables:18696kB unstable:0kB bounce:0kB free_pcp:1200kB local_pcp:728kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no [ 1116.394658] lowmem_reserve[]: 0 0 0 [ 1116.394717] DMA32: 97*4kB (UME) 289*8kB (UME) 351*16kB (UME) 189*32kB (UME) 59*64kB (UME) 25*128kB (UME) 12*256kB (UM) 5*512kB (M) 1*1024kB (E) 2*2048kB (UE) 621*4096kB (M) = 2575708kB [ 1116.394770] Normal: 585*4kB (UM) 292*8kB (UME) 290*16kB (UME) 181*32kB (UM) 65*64kB (ME) 30*128kB (UME) 10*256kB (UM) 8*512kB (UME) 4*1024kB (M) 4*2048kB (UME) 735*4096kB (M) = 3052612kB [ 1116.394773] 31101 total pagecache pages [ 1116.394777] 0 pages in swap cache [ 1116.394782] Swap cache stats: add 0, delete 0, find 0/0 [ 1116.394785] Free swap = 0kB [ 1116.394787] Total swap = 0kB [ 1116.394790] 1965979 pages RAM [ 1116.394792] 0 pages HighMem/MovableOnly [ 1116.394794] 313294 pages reserved [ 1116.437729] binder: 19325:19328 transaction failed 29189/-22, size 0-0 line 3014 [ 1116.437900] binder: undelivered TRANSACTION_ERROR: 29189 [ 1116.462574] vmalloc: allocation failure: 0 bytes [ 1116.462581] syz-executor.4: page allocation failure: order:0, mode:0x24000c2 [ 1116.462590] CPU: 1 PID: 19329 Comm: syz-executor.4 Not tainted 4.4.174+ #4 [ 1116.462606] 0000000000000000 b8fc33d98b25e9c3 ffff8801c048f9f0 ffffffff81aad1a1 [ 1116.462619] 1ffff10038091f41 ffff8801d500af80 00000000024000c2 0000000000000000 [ 1116.462630] ffffffff82895080 ffff8801c048fb00 ffffffff8148c0cb ffffffff00000001 [ 1116.462632] Call Trace: [ 1116.462648] [] dump_stack+0xc1/0x120 [ 1116.462663] [] warn_alloc_failed.cold+0x78/0x99 [ 1116.462676] [] ? zone_watermark_ok_safe+0x290/0x290 [ 1116.462686] [] ? sel_write_load+0x9e/0xf90 [ 1116.462697] [] __vmalloc_node_range+0x365/0x650 [ 1116.462707] [] ? check_preemption_disabled+0x3c/0x200 [ 1116.462714] [] ? check_preemption_disabled+0x3c/0x200 [ 1116.462728] [] ? task_has_security+0x130/0x270 [ 1116.462736] [] vmalloc+0x5c/0x70 [ 1116.462743] [] ? sel_write_load+0x119/0xf90 [ 1116.462750] [] sel_write_load+0x119/0xf90 [ 1116.462760] [] ? sel_read_bool+0x240/0x240 [ 1116.462770] [] ? trace_hardirqs_on+0x10/0x10 [ 1116.462777] [] __vfs_write+0x116/0x3d0 [ 1116.462784] [] ? sel_read_bool+0x240/0x240 [ 1116.462793] [] ? __vfs_read+0x3c0/0x3c0 [ 1116.462802] [] ? check_preemption_disabled+0x3c/0x200 [ 1116.462812] [] ? check_preemption_disabled+0x3c/0x200 [ 1116.462823] [] ? rcu_read_lock_sched_held+0x10b/0x130 [ 1116.462833] [] ? rcu_sync_lockdep_assert+0x73/0xb0 [ 1116.462842] [] ? __sb_start_write+0x14f/0x310 [ 1116.462850] [] vfs_write+0x182/0x4e0 [ 1116.462858] [] SyS_write+0xdc/0x1c0 [ 1116.462866] [] ? SyS_read+0x1c0/0x1c0 [ 1116.462876] [] ? lockdep_sys_exit_thunk+0x12/0x14 [ 1116.462886] [] entry_SYSCALL_64_fastpath+0x1e/0x9a [ 1116.462889] Mem-Info: [ 1116.462922] active_anon:70052 inactive_anon:6160 isolated_anon:0 [ 1116.462922] active_file:11182 inactive_file:11777 isolated_file:0 [ 1116.462922] unevictable:0 dirty:47 writeback:0 unstable:0 [ 1116.462922] slab_reclaimable:4393 slab_unreclaimable:63451 [ 1116.462922] mapped:58948 shmem:8661 pagetables:8511 bounce:0 [ 1116.462922] free:1406716 free_pcp:400 free_cma:0 [ 1116.463351] DMA32 free:2575168kB min:4696kB low:5868kB high:7044kB active_anon:127536kB inactive_anon:11308kB active_file:19752kB inactive_file:20788kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:3145324kB managed:3021976kB mlocked:0kB dirty:8kB writeback:0kB mapped:107824kB shmem:15472kB slab_reclaimable:8372kB slab_unreclaimable:114140kB kernel_stack:6304kB pagetables:15200kB unstable:0kB bounce:0kB free_pcp:536kB local_pcp:36kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no [ 1116.463382] lowmem_reserve[]: 0 3504 3504 [ 1116.463419] Normal free:3051696kB min:5580kB low:6972kB high:8368kB active_anon:152672kB inactive_anon:13332kB active_file:24976kB inactive_file:26320kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:4718592kB managed:3588764kB mlocked:0kB dirty:180kB writeback:0kB mapped:127968kB shmem:19172kB slab_reclaimable:9200kB slab_unreclaimable:139664kB kernel_stack:7840kB pagetables:18844kB unstable:0kB bounce:0kB free_pcp:1008kB local_pcp:388kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no [ 1116.463429] lowmem_reserve[]: 0 0 0 [ 1116.463499] DMA32: 63*4kB (UME) 213*8kB (UME) 351*16kB (UME) 196*32kB (UME) 60*64kB (UME) 25*128kB (UME) 12*256kB (UM) 5*512kB (M) 1*1024kB (E) 2*2048kB (UE) 621*4096kB (M) = 2575252kB [ 1116.463559] Normal: 340*4kB (UM) 271*8kB (UME) 290*16kB (UME) 189*32kB (UM) 65*64kB (ME) 30*128kB (UME) 10*256kB (UM) 8*512kB (UME) 4*1024kB (M) 4*2048kB (UME) 735*4096kB (M) = 3051720kB [ 1116.463562] 31619 total pagecache pages [ 1116.463567] 0 pages in swap cache [ 1116.463572] Swap cache stats: add 0, delete 0, find 0/0 [ 1116.463575] Free swap = 0kB [ 1116.463578] Total swap = 0kB [ 1116.463581] 1965979 pages RAM [ 1116.463583] 0 pages HighMem/MovableOnly [ 1116.463586] 313294 pages reserved [ 1117.108809] binder: 19346:19352 transaction failed 29189/-22, size 0-0 line 3014 [ 1117.109414] binder: undelivered TRANSACTION_ERROR: 29189 [ 1117.117140] vmalloc: allocation failure: 0 bytes [ 1117.117145] syz-executor.4: page allocation failure: order:0, mode:0x24000c2 [ 1117.117155] CPU: 0 PID: 19354 Comm: syz-executor.4 Not tainted 4.4.174+ #4 [ 1117.117168] 0000000000000000 a625ff174af89e75 ffff8800b5fa79f0 ffffffff81aad1a1 [ 1117.117179] 1ffff10016bf4f41 ffff8800b6bc8000 00000000024000c2 0000000000000000 [ 1117.117189] ffffffff82895080 ffff8800b5fa7b00 ffffffff8148c0cb ffffffff00000001 [ 1117.117191] Call Trace: [ 1117.117204] [] dump_stack+0xc1/0x120 [ 1117.117216] [] warn_alloc_failed.cold+0x78/0x99 [ 1117.117227] [] ? zone_watermark_ok_safe+0x290/0x290 [ 1117.117237] [] ? sel_write_load+0x9e/0xf90 [ 1117.117249] [] __vmalloc_node_range+0x365/0x650 [ 1117.117259] [] ? check_preemption_disabled+0x3c/0x200 [ 1117.117267] [] ? check_preemption_disabled+0x3c/0x200 [ 1117.117277] [] ? task_has_security+0x130/0x270 [ 1117.117286] [] vmalloc+0x5c/0x70 [ 1117.117295] [] ? sel_write_load+0x119/0xf90 [ 1117.117303] [] sel_write_load+0x119/0xf90 [ 1117.117311] [] ? sel_read_bool+0x240/0x240 [ 1117.117328] [] ? trace_hardirqs_on+0x10/0x10 [ 1117.117340] [] __vfs_write+0x116/0x3d0 [ 1117.117348] [] ? sel_read_bool+0x240/0x240 [ 1117.117355] [] ? __vfs_read+0x3c0/0x3c0 [ 1117.117363] [] ? check_preemption_disabled+0x3c/0x200 [ 1117.117371] [] ? check_preemption_disabled+0x3c/0x200 [ 1117.117381] [] ? rcu_read_lock_sched_held+0x10b/0x130 [ 1117.117389] [] ? rcu_sync_lockdep_assert+0x73/0xb0 [ 1117.117398] [] ? __sb_start_write+0x14f/0x310 [ 1117.117405] [] vfs_write+0x182/0x4e0 [ 1117.117414] [] SyS_write+0xdc/0x1c0 [ 1117.117422] [] ? SyS_read+0x1c0/0x1c0 [ 1117.117434] [] ? lockdep_sys_exit_thunk+0x12/0x14 [ 1117.117446] [] entry_SYSCALL_64_fastpath+0x1e/0x9a [ 1117.118922] Mem-Info: [ 1117.118956] active_anon:70052 inactive_anon:5685 isolated_anon:0 [ 1117.118956] active_file:11182 inactive_file:11777 isolated_file:0 [ 1117.118956] unevictable:0 dirty:47 writeback:0 unstable:0 [ 1117.118956] slab_reclaimable:4393 slab_unreclaimable:63501 [ 1117.118956] mapped:58985 shmem:8143 pagetables:8474 bounce:0 [ 1117.118956] free:1407174 free_pcp:539 free_cma:0 [ 1117.118996] DMA32 free:2575548kB min:4696kB low:5868kB high:7044kB active_anon:127636kB inactive_anon:10208kB active_file:19752kB inactive_file:20788kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:3145324kB managed:3021976kB mlocked:0kB dirty:8kB writeback:0kB mapped:107972kB shmem:14288kB slab_reclaimable:8372kB slab_unreclaimable:114356kB kernel_stack:6304kB pagetables:15348kB unstable:0kB bounce:0kB free_pcp:1100kB local_pcp:408kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no [ 1117.119006] lowmem_reserve[]: 0 3504 3504 [ 1117.119038] Normal free:3053148kB min:5580kB low:6972kB high:8368kB active_anon:152572kB inactive_anon:12532kB active_file:24976kB inactive_file:26320kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:4718592kB managed:3588764kB mlocked:0kB dirty:180kB writeback:0kB mapped:127968kB shmem:18284kB slab_reclaimable:9200kB slab_unreclaimable:139648kB kernel_stack:7840kB pagetables:18548kB unstable:0kB bounce:0kB free_pcp:1056kB local_pcp:408kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no [ 1117.119048] lowmem_reserve[]: 0 0 0 [ 1117.119196] DMA32: 177*4kB (UME) 269*8kB (UME) 351*16kB (UME) 177*32kB (UME) 60*64kB (UME) 25*128kB (UME) 12*256kB (UM) 5*512kB (M) 1*1024kB (E) 2*2048kB (UE) 621*4096kB (M) = 2575548kB [ 1117.119760] Normal: 539*4kB (UM) 302*8kB (UME) 290*16kB (UME) 202*32kB (UM) 65*64kB (ME) 30*128kB (UME) 10*256kB (UM) 8*512kB (UME) 4*1024kB (M) 4*2048kB (UME) 735*4096kB (M) = 3053180kB [ 1117.119764] 31101 total pagecache pages [ 1117.119767] 0 pages in swap cache [ 1117.119772] Swap cache stats: add 0, delete 0, find 0/0 [ 1117.119775] Free swap = 0kB [ 1117.119777] Total swap = 0kB [ 1117.119780] 1965979 pages RAM [ 1117.119782] 0 pages HighMem/MovableOnly [ 1117.119785] 313294 pages reserved [ 1117.164304] binder_alloc: 19362: binder_alloc_buf, no vma [ 1117.164347] binder: 19362:19363 transaction failed 29189/-3, size 0-0 line 3137 [ 1117.168807] binder: undelivered TRANSACTION_ERROR: 29189 [ 1117.220348] vmalloc: allocation failure: 0 bytes [ 1117.220354] syz-executor.4: page allocation failure: order:0, mode:0x24000c2 [ 1117.220364] CPU: 0 PID: 19371 Comm: syz-executor.4 Not tainted 4.4.174+ #4 [ 1117.220376] 0000000000000000 f88af75826725414 ffff8801bda3f9f0 ffffffff81aad1a1 [ 1117.220387] 1ffff10037b47f41 ffff8800b955af80 00000000024000c2 0000000000000000 [ 1117.220398] ffffffff82895080 ffff8801bda3fb00 ffffffff8148c0cb ffffffff00000001 [ 1117.220401] Call Trace: [ 1117.220416] [] dump_stack+0xc1/0x120 [ 1117.220429] [] warn_alloc_failed.cold+0x78/0x99 [ 1117.220442] [] ? zone_watermark_ok_safe+0x290/0x290 [ 1117.220454] [] ? sel_write_load+0x9e/0xf90 [ 1117.220465] [] __vmalloc_node_range+0x365/0x650 [ 1117.220477] [] ? check_preemption_disabled+0x3c/0x200 [ 1117.220485] [] ? check_preemption_disabled+0x3c/0x200 [ 1117.220495] [] ? task_has_security+0x130/0x270 [ 1117.220503] [] vmalloc+0x5c/0x70 [ 1117.220513] [] ? sel_write_load+0x119/0xf90 [ 1117.220521] [] sel_write_load+0x119/0xf90 [ 1117.220531] [] ? sel_read_bool+0x240/0x240 [ 1117.220542] [] ? trace_hardirqs_on+0x10/0x10 [ 1117.220550] [] __vfs_write+0x116/0x3d0 [ 1117.220557] [] ? sel_read_bool+0x240/0x240 [ 1117.220565] [] ? __vfs_read+0x3c0/0x3c0 [ 1117.220572] [] ? check_preemption_disabled+0x3c/0x200 [ 1117.220579] [] ? check_preemption_disabled+0x3c/0x200 [ 1117.220589] [] ? rcu_read_lock_sched_held+0x10b/0x130 [ 1117.220597] [] ? rcu_sync_lockdep_assert+0x73/0xb0 [ 1117.220605] [] ? __sb_start_write+0x14f/0x310 [ 1117.220613] [] vfs_write+0x182/0x4e0 [ 1117.220631] [] SyS_write+0xdc/0x1c0 [ 1117.220640] [] ? SyS_read+0x1c0/0x1c0 [ 1117.220654] [] ? lockdep_sys_exit_thunk+0x12/0x14 [ 1117.220663] [] entry_SYSCALL_64_fastpath+0x1e/0x9a [ 1117.220729] Mem-Info: [ 1117.220755] active_anon:70102 inactive_anon:5735 isolated_anon:0 [ 1117.220755] active_file:11182 inactive_file:11777 isolated_file:0 [ 1117.220755] unevictable:0 dirty:47 writeback:0 unstable:0 [ 1117.220755] slab_reclaimable:4393 slab_unreclaimable:63383 [ 1117.220755] mapped:59022 shmem:8217 pagetables:8511 bounce:0 [ 1117.220755] free:1407091 free_pcp:462 free_cma:0 [ 1117.220789] DMA32 free:2575456kB min:4696kB low:5868kB high:7044kB active_anon:127636kB inactive_anon:10208kB active_file:19752kB inactive_file:20788kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:3145324kB managed:3021976kB mlocked:0kB dirty:8kB writeback:0kB mapped:107972kB shmem:14288kB slab_reclaimable:8372kB slab_unreclaimable:114244kB kernel_stack:6304kB pagetables:15496kB unstable:0kB bounce:0kB free_pcp:1280kB local_pcp:572kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no [ 1117.220798] lowmem_reserve[]: 0 3504 3504 [ 1117.220827] Normal free:3052908kB min:5580kB low:6972kB high:8368kB active_anon:152772kB inactive_anon:12832kB active_file:24976kB inactive_file:26320kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:4718592kB managed:3588764kB mlocked:0kB dirty:180kB writeback:0kB mapped:128116kB shmem:18580kB slab_reclaimable:9200kB slab_unreclaimable:139288kB kernel_stack:7840kB pagetables:18548kB unstable:0kB bounce:0kB free_pcp:540kB local_pcp:364kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no [ 1117.220897] lowmem_reserve[]: 0 0 0 [ 1117.220965] DMA32: 178*4kB (UME) 253*8kB (UME) 351*16kB (UME) 182*32kB (UME) 60*64kB (UME) 25*128kB (UME) 12*256kB (UM) 5*512kB (M) 1*1024kB (E) 2*2048kB (UE) 621*4096kB (M) = 2575584kB [ 1117.221018] Normal: 477*4kB (UM) 301*8kB (UME) 289*16kB (UME) 205*32kB (UM) 66*64kB (UME) 29*128kB (UME) 10*256kB (UM) 8*512kB (UME) 4*1024kB (M) 4*2048kB (UME) 735*4096kB (M) = 3052940kB [ 1117.221021] 31175 total pagecache pages [ 1117.221025] 0 pages in swap cache [ 1117.221031] Swap cache stats: add 0, delete 0, find 0/0 [ 1117.221033] Free swap = 0kB [ 1117.221036] Total swap = 0kB [ 1117.221040] 1965979 pages RAM [ 1117.221042] 0 pages HighMem/MovableOnly [ 1117.221045] 313294 pages reserved [ 1117.234535] binder: 19368:19372 transaction failed 29189/-22, size 0-0 line 3014 [ 1117.234664] binder: undelivered TRANSACTION_ERROR: 29189 [ 1117.334270] vmalloc: allocation failure: 0 bytes [ 1117.334277] syz-executor.4: page allocation failure: order:0, mode:0x24000c2 [ 1117.334287] CPU: 1 PID: 19382 Comm: syz-executor.4 Not tainted 4.4.174+ #4 [ 1117.334303] 0000000000000000 145321aa2a1a93bc ffff8800b448f9f0 ffffffff81aad1a1 [ 1117.334315] 1ffff10016891f41 ffff8801d725c740 00000000024000c2 0000000000000000 [ 1117.334326] ffffffff82895080 ffff8800b448fb00 ffffffff8148c0cb ffffffff00000001 [ 1117.334329] Call Trace: [ 1117.334344] [] dump_stack+0xc1/0x120 [ 1117.334358] [] warn_alloc_failed.cold+0x78/0x99 [ 1117.334371] [] ? zone_watermark_ok_safe+0x290/0x290 [ 1117.334381] [] ? sel_write_load+0x9e/0xf90 [ 1117.334392] [] __vmalloc_node_range+0x365/0x650 [ 1117.334401] [] ? check_preemption_disabled+0x3c/0x200 [ 1117.334408] [] ? check_preemption_disabled+0x3c/0x200 [ 1117.334417] [] ? task_has_security+0x130/0x270 [ 1117.334424] [] vmalloc+0x5c/0x70 [ 1117.334432] [] ? sel_write_load+0x119/0xf90 [ 1117.334448] [] sel_write_load+0x119/0xf90 [ 1117.334459] [] ? sel_read_bool+0x240/0x240 [ 1117.334469] [] ? trace_hardirqs_on+0x10/0x10 [ 1117.334479] [] __vfs_write+0x116/0x3d0 [ 1117.334486] [] ? sel_read_bool+0x240/0x240 [ 1117.334494] [] ? __vfs_read+0x3c0/0x3c0 [ 1117.334502] [] ? check_preemption_disabled+0x3c/0x200 [ 1117.334511] [] ? check_preemption_disabled+0x3c/0x200 [ 1117.334520] [] ? rcu_read_lock_sched_held+0x10b/0x130 [ 1117.334528] [] ? rcu_sync_lockdep_assert+0x73/0xb0 [ 1117.334536] [] ? __sb_start_write+0x14f/0x310 [ 1117.334544] [] vfs_write+0x182/0x4e0 [ 1117.334551] [] SyS_write+0xdc/0x1c0 [ 1117.334559] [] ? SyS_read+0x1c0/0x1c0 [ 1117.334569] [] ? lockdep_sys_exit_thunk+0x12/0x14 [ 1117.334579] [] entry_SYSCALL_64_fastpath+0x1e/0x9a [ 1117.334582] Mem-Info: [ 1117.334607] active_anon:70048 inactive_anon:6184 isolated_anon:0 [ 1117.334607] active_file:11182 inactive_file:11777 isolated_file:0 [ 1117.334607] unevictable:0 dirty:47 writeback:0 unstable:0 [ 1117.334607] slab_reclaimable:4393 slab_unreclaimable:63279 [ 1117.334607] mapped:59030 shmem:8665 pagetables:8528 bounce:0 [ 1117.334607] free:1406968 free_pcp:428 free_cma:0 [ 1117.334646] DMA32 free:2575540kB min:4696kB low:5868kB high:7044kB active_anon:127640kB inactive_anon:10984kB active_file:19752kB inactive_file:20788kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:3145324kB managed:3021976kB mlocked:0kB dirty:8kB writeback:0kB mapped:107888kB shmem:15120kB slab_reclaimable:8372kB slab_unreclaimable:113948kB kernel_stack:6464kB pagetables:15368kB unstable:0kB bounce:0kB free_pcp:956kB local_pcp:316kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no [ 1117.334656] lowmem_reserve[]: 0 3504 3504 [ 1117.334687] Normal free:3052332kB min:5580kB low:6972kB high:8368kB active_anon:152552kB inactive_anon:13752kB active_file:24976kB inactive_file:26320kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:4718592kB managed:3588764kB mlocked:0kB dirty:180kB writeback:0kB mapped:128232kB shmem:19540kB slab_reclaimable:9200kB slab_unreclaimable:139168kB kernel_stack:8096kB pagetables:18744kB unstable:0kB bounce:0kB free_pcp:756kB local_pcp:180kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no [ 1117.334695] lowmem_reserve[]: 0 0 0 [ 1117.334751] DMA32: 123*4kB (UME) 265*8kB (UME) 351*16kB (UME) 186*32kB (UME) 60*64kB (UME) 25*128kB (UME) 12*256kB (UM) 5*512kB (M) 1*1024kB (E) 2*2048kB (UE) 621*4096kB (M) = 2575588kB [ 1117.334804] Normal: 376*4kB (UM) 243*8kB (UME) 290*16kB (UME) 210*32kB (UM) 66*64kB (UME) 30*128kB (UME) 10*256kB (UM) 8*512kB (UME) 4*1024kB (M) 4*2048kB (UME) 735*4096kB (M) = 3052376kB [ 1117.334806] 31623 total pagecache pages [ 1117.334810] 0 pages in swap cache [ 1117.334815] Swap cache stats: add 0, delete 0, find 0/0 [ 1117.334817] Free swap = 0kB [ 1117.334820] Total swap = 0kB [ 1117.334822] 1965979 pages RAM [ 1117.334825] 0 pages HighMem/MovableOnly [ 1117.334827] 313294 pages reserved [ 1117.918781] binder: 19393:19401 transaction failed 29189/-22, size 0-0 line 3014 [ 1117.920086] binder: undelivered TRANSACTION_ERROR: 29189 [ 1117.932693] vmalloc: allocation failure: 0 bytes [ 1117.932699] syz-executor.4: page allocation failure: order:0, mode:0x24000c2 [ 1117.932709] CPU: 0 PID: 19403 Comm: syz-executor.4 Not tainted 4.4.174+ #4 [ 1117.932722] 0000000000000000 57c252282b5f090a ffff8800a44ff9f0 ffffffff81aad1a1 [ 1117.932733] 1ffff1001489ff41 ffff8800b4215f00 00000000024000c2 0000000000000000 [ 1117.932745] ffffffff82895080 ffff8800a44ffb00 ffffffff8148c0cb ffffffff00000001 [ 1117.932747] Call Trace: [ 1117.932762] [] dump_stack+0xc1/0x120 [ 1117.932776] [] warn_alloc_failed.cold+0x78/0x99 [ 1117.932790] [] ? zone_watermark_ok_safe+0x290/0x290 [ 1117.932801] [] ? sel_write_load+0x9e/0xf90 [ 1117.932814] [] __vmalloc_node_range+0x365/0x650 [ 1117.932825] [] ? check_preemption_disabled+0x3c/0x200 [ 1117.932834] [] ? check_preemption_disabled+0x3c/0x200 [ 1117.932843] [] ? task_has_security+0x130/0x270 [ 1117.932853] [] vmalloc+0x5c/0x70 [ 1117.932863] [] ? sel_write_load+0x119/0xf90 [ 1117.932871] [] sel_write_load+0x119/0xf90 [ 1117.932882] [] ? sel_read_bool+0x240/0x240 [ 1117.932891] [] ? trace_hardirqs_on+0x10/0x10 [ 1117.932901] [] __vfs_write+0x116/0x3d0 [ 1117.932909] [] ? sel_read_bool+0x240/0x240 [ 1117.932916] [] ? __vfs_read+0x3c0/0x3c0 [ 1117.932925] [] ? check_preemption_disabled+0x3c/0x200 [ 1117.932934] [] ? check_preemption_disabled+0x3c/0x200 [ 1117.932953] [] ? rcu_read_lock_sched_held+0x10b/0x130 [ 1117.932962] [] ? rcu_sync_lockdep_assert+0x73/0xb0 [ 1117.932972] [] ? __sb_start_write+0x14f/0x310 [ 1117.932981] [] vfs_write+0x182/0x4e0 [ 1117.932989] [] SyS_write+0xdc/0x1c0 [ 1117.932996] [] ? SyS_read+0x1c0/0x1c0 [ 1117.933008] [] ? lockdep_sys_exit_thunk+0x12/0x14 [ 1117.933020] [] entry_SYSCALL_64_fastpath+0x1e/0x9a [ 1117.933023] Mem-Info: [ 1117.933049] active_anon:70073 inactive_anon:5734 isolated_anon:0 [ 1117.933049] active_file:11182 inactive_file:11777 isolated_file:0 [ 1117.933049] unevictable:0 dirty:47 writeback:0 unstable:0 [ 1117.933049] slab_reclaimable:4393 slab_unreclaimable:63394 [ 1117.933049] mapped:58993 shmem:8184 pagetables:8528 bounce:0 [ 1117.933049] free:1407137 free_pcp:608 free_cma:0 [ 1117.933086] DMA32 free:2575372kB min:4696kB low:5868kB high:7044kB active_anon:127740kB inactive_anon:10284kB active_file:19752kB inactive_file:20788kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:3145324kB managed:3021976kB mlocked:0kB dirty:8kB writeback:0kB mapped:107888kB shmem:14380kB slab_reclaimable:8372kB slab_unreclaimable:114696kB kernel_stack:6464kB pagetables:15220kB unstable:0kB bounce:0kB free_pcp:1064kB local_pcp:484kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no [ 1117.933096] lowmem_reserve[]: 0 3504 3504 [ 1117.933130] Normal free:3053176kB min:5580kB low:6972kB high:8368kB active_anon:152552kB inactive_anon:12652kB active_file:24976kB inactive_file:26320kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:4718592kB managed:3588764kB mlocked:0kB dirty:180kB writeback:0kB mapped:128084kB shmem:18356kB slab_reclaimable:9200kB slab_unreclaimable:138880kB kernel_stack:8096kB pagetables:18892kB unstable:0kB bounce:0kB free_pcp:1364kB local_pcp:672kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no [ 1117.933139] lowmem_reserve[]: 0 0 0 [ 1117.933192] DMA32: 134*4kB (UME) 275*8kB (UME) 350*16kB (UME) 177*32kB (UME) 60*64kB (UME) 24*128kB (UME) 12*256kB (UM) 5*512kB (M) 1*1024kB (E) 2*2048kB (UE) 621*4096kB (M) = 2575280kB [ 1117.933244] Normal: 568*4kB (UM) 269*8kB (UME) 291*16kB (UME) 205*32kB (UM) 66*64kB (UME) 30*128kB (UME) 10*256kB (UM) 8*512kB (UME) 4*1024kB (M) 4*2048kB (UME) 735*4096kB (M) = 3053208kB [ 1117.933247] 31142 total pagecache pages [ 1117.933250] 0 pages in swap cache [ 1117.933255] Swap cache stats: add 0, delete 0, find 0/0 [ 1117.933258] Free swap = 0kB [ 1117.933260] Total swap = 0kB [ 1117.933263] 1965979 pages RAM [ 1117.933265] 0 pages HighMem/MovableOnly [ 1117.933267] 313294 pages reserved [ 1118.024901] binder: 19408:19416 transaction failed 29189/-22, size 0-0 line 3014 [ 1118.025037] binder: undelivered TRANSACTION_ERROR: 29189 [ 1118.758323] binder: 19442:19446 transaction failed 29189/-22, size 0-0 line 3014 [ 1118.758665] binder: undelivered TRANSACTION_ERROR: 29189 [ 1118.888962] binder: 19458:19462 transaction failed 29189/-22, size 0-0 line 3014 [ 1118.889136] binder: undelivered TRANSACTION_ERROR: 29189 [ 1118.967657] binder: 19472:19473 transaction failed 29189/-22, size 0-0 line 3014 [ 1118.967845] binder: undelivered TRANSACTION_ERROR: 29189 [ 1119.548405] binder: 19480:19488 transaction failed 29189/-22, size 0-0 line 3014 [ 1119.565117] binder: undelivered TRANSACTION_ERROR: 29189 [ 1119.622213] binder: 19494:19498 transaction failed 29189/-22, size 0-0 line 3014 [ 1119.622344] binder: undelivered TRANSACTION_ERROR: 29189 [ 1119.760284] binder: 19512:19515 transaction failed 29189/-22, size 0-0 line 3014 [ 1119.761464] binder: undelivered TRANSACTION_ERROR: 29189 [ 1120.264293] binder: 19525:19533 transaction failed 29189/-22, size 0-0 line 3014 [ 1120.264893] binder: undelivered TRANSACTION_ERROR: 29189 [ 1120.399319] binder_alloc: 19548: binder_alloc_buf, no vma [ 1120.399362] binder: 19548:19552 transaction failed 29189/-3, size 0-0 line 3137 [ 1120.399496] binder: undelivered TRANSACTION_ERROR: 29189 [ 1121.085043] binder: 19574:19579 transaction failed 29189/-22, size 0-0 line 3014 [ 1121.085205] binder: undelivered TRANSACTION_ERROR: 29189 [ 1121.096012] warn_alloc_failed: 8 callbacks suppressed [ 1121.096018] vmalloc: allocation failure: 0 bytes [ 1121.096024] syz-executor.4: page allocation failure: order:0, mode:0x24000c2 [ 1121.096034] CPU: 1 PID: 19578 Comm: syz-executor.4 Not tainted 4.4.174+ #4 [ 1121.096048] 0000000000000000 9dbe9a80a9f0a2b1 ffff8801b89af9f0 ffffffff81aad1a1 [ 1121.096059] 1ffff10037135f41 ffff8800b4cfaf80 00000000024000c2 0000000000000000 [ 1121.096071] ffffffff82895080 ffff8801b89afb00 ffffffff8148c0cb ffffffff00000001 [ 1121.096073] Call Trace: [ 1121.096090] [] dump_stack+0xc1/0x120 [ 1121.096102] [] warn_alloc_failed.cold+0x78/0x99 [ 1121.096112] [] ? zone_watermark_ok_safe+0x290/0x290 [ 1121.096123] [] ? sel_write_load+0x9e/0xf90 [ 1121.096134] [] __vmalloc_node_range+0x365/0x650 [ 1121.096144] [] ? check_preemption_disabled+0x3c/0x200 [ 1121.096154] [] ? check_preemption_disabled+0x3c/0x200 [ 1121.096163] [] ? task_has_security+0x130/0x270 [ 1121.096172] [] vmalloc+0x5c/0x70 [ 1121.096181] [] ? sel_write_load+0x119/0xf90 [ 1121.096191] [] sel_write_load+0x119/0xf90 [ 1121.096200] [] ? sel_read_bool+0x240/0x240 [ 1121.096209] [] ? trace_hardirqs_on+0x10/0x10 [ 1121.096218] [] __vfs_write+0x116/0x3d0 [ 1121.096225] [] ? sel_read_bool+0x240/0x240 [ 1121.096233] [] ? __vfs_read+0x3c0/0x3c0 [ 1121.096242] [] ? check_preemption_disabled+0x3c/0x200 [ 1121.096250] [] ? check_preemption_disabled+0x3c/0x200 [ 1121.096259] [] ? rcu_read_lock_sched_held+0x10b/0x130 [ 1121.096268] [] ? rcu_sync_lockdep_assert+0x73/0xb0 [ 1121.096277] [] ? __sb_start_write+0x14f/0x310 [ 1121.096293] [] vfs_write+0x182/0x4e0 [ 1121.096304] [] SyS_write+0xdc/0x1c0 [ 1121.096314] [] ? SyS_read+0x1c0/0x1c0 [ 1121.096327] [] ? lockdep_sys_exit_thunk+0x12/0x14 [ 1121.096338] [] entry_SYSCALL_64_fastpath+0x1e/0x9a [ 1121.097552] Mem-Info: [ 1121.097578] active_anon:70079 inactive_anon:5726 isolated_anon:0 [ 1121.097578] active_file:11182 inactive_file:11777 isolated_file:0 [ 1121.097578] unevictable:0 dirty:47 writeback:0 unstable:0 [ 1121.097578] slab_reclaimable:4385 slab_unreclaimable:63669 [ 1121.097578] mapped:58985 shmem:8149 pagetables:8549 bounce:0 [ 1121.097578] free:1406986 free_pcp:520 free_cma:0 [ 1121.097614] DMA32 free:2573652kB min:4696kB low:5868kB high:7044kB active_anon:127604kB inactive_anon:10296kB active_file:19752kB inactive_file:20788kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:3145324kB managed:3021976kB mlocked:0kB dirty:8kB writeback:0kB mapped:107824kB shmem:14280kB slab_reclaimable:8340kB slab_unreclaimable:116664kB kernel_stack:6336kB pagetables:15284kB unstable:0kB bounce:0kB free_pcp:812kB local_pcp:256kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no [ 1121.097623] lowmem_reserve[]: 0 3504 3504 [ 1121.097654] Normal free:3054292kB min:5580kB low:6972kB high:8368kB active_anon:152712kB inactive_anon:12608kB active_file:24976kB inactive_file:26320kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:4718592kB managed:3588764kB mlocked:0kB dirty:180kB writeback:0kB mapped:128116kB shmem:18316kB slab_reclaimable:9200kB slab_unreclaimable:138012kB kernel_stack:8000kB pagetables:18912kB unstable:0kB bounce:0kB free_pcp:1268kB local_pcp:608kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no [ 1121.097664] lowmem_reserve[]: 0 0 0 [ 1121.097726] DMA32: 169*4kB (UME) 88*8kB (ME) 347*16kB (UME) 158*32kB (UME) 66*64kB (UME) 24*128kB (UME) 12*256kB (UM) 5*512kB (M) 1*1024kB (E) 2*2048kB (UE) 621*4096kB (M) = 2573652kB [ 1121.097784] Normal: 521*4kB (UM) 254*8kB (UME) 296*16kB (UME) 231*32kB (UM) 73*64kB (UME) 30*128kB (UME) 10*256kB (UM) 8*512kB (UME) 4*1024kB (M) 4*2048kB (UME) 735*4096kB (M) = 3054260kB [ 1121.097787] 31107 total pagecache pages [ 1121.097790] 0 pages in swap cache [ 1121.097797] Swap cache stats: add 0, delete 0, find 0/0 [ 1121.097799] Free swap = 0kB [ 1121.097802] Total swap = 0kB [ 1121.097805] 1965979 pages RAM [ 1121.097808] 0 pages HighMem/MovableOnly [ 1121.097811] 313294 pages reserved [ 1121.161652] vmalloc: allocation failure: 0 bytes [ 1121.161658] syz-executor.4: page allocation failure: order:0, mode:0x24000c2 [ 1121.161668] CPU: 1 PID: 19588 Comm: syz-executor.4 Not tainted 4.4.174+ #4 [ 1121.161682] 0000000000000000 852f1c2bcb374776 ffff8801d0a5f9f0 ffffffff81aad1a1 [ 1121.161693] 1ffff1003a14bf41 ffff8801d49cc740 00000000024000c2 0000000000000000 [ 1121.161705] ffffffff82895080 ffff8801d0a5fb00 ffffffff8148c0cb ffffffff00000001 [ 1121.161708] Call Trace: [ 1121.161724] [] dump_stack+0xc1/0x120 [ 1121.161737] [] warn_alloc_failed.cold+0x78/0x99 [ 1121.161748] [] ? zone_watermark_ok_safe+0x290/0x290 [ 1121.161757] [] ? sel_write_load+0x9e/0xf90 [ 1121.161768] [] __vmalloc_node_range+0x365/0x650 [ 1121.161779] [] ? check_preemption_disabled+0x3c/0x200 [ 1121.161787] [] ? check_preemption_disabled+0x3c/0x200 [ 1121.161795] [] ? task_has_security+0x130/0x270 [ 1121.161803] [] vmalloc+0x5c/0x70 [ 1121.161810] [] ? sel_write_load+0x119/0xf90 [ 1121.161818] [] sel_write_load+0x119/0xf90 [ 1121.161826] [] ? sel_read_bool+0x240/0x240 [ 1121.161836] [] ? trace_hardirqs_on+0x10/0x10 [ 1121.161854] [] __vfs_write+0x116/0x3d0 [ 1121.161864] [] ? sel_read_bool+0x240/0x240 [ 1121.161873] [] ? __vfs_read+0x3c0/0x3c0 [ 1121.161882] [] ? check_preemption_disabled+0x3c/0x200 [ 1121.161890] [] ? check_preemption_disabled+0x3c/0x200 [ 1121.161899] [] ? rcu_read_lock_sched_held+0x10b/0x130 [ 1121.161906] [] ? rcu_sync_lockdep_assert+0x73/0xb0 [ 1121.161917] [] ? __sb_start_write+0x14f/0x310 [ 1121.161926] [] vfs_write+0x182/0x4e0 [ 1121.161936] [] SyS_write+0xdc/0x1c0 [ 1121.161946] [] ? SyS_read+0x1c0/0x1c0 [ 1121.161955] [] ? lockdep_sys_exit_thunk+0x12/0x14 [ 1121.161967] [] entry_SYSCALL_64_fastpath+0x1e/0x9a [ 1121.162031] Mem-Info: [ 1121.162058] active_anon:70054 inactive_anon:5726 isolated_anon:0 [ 1121.162058] active_file:11182 inactive_file:11777 isolated_file:0 [ 1121.162058] unevictable:0 dirty:47 writeback:0 unstable:0 [ 1121.162058] slab_reclaimable:4385 slab_unreclaimable:63637 [ 1121.162058] mapped:58985 shmem:8149 pagetables:8586 bounce:0 [ 1121.162058] free:1407009 free_pcp:532 free_cma:0 [ 1121.162094] DMA32 free:2573652kB min:4696kB low:5868kB high:7044kB active_anon:127504kB inactive_anon:10296kB active_file:19752kB inactive_file:20788kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:3145324kB managed:3021976kB mlocked:0kB dirty:8kB writeback:0kB mapped:107824kB shmem:14280kB slab_reclaimable:8340kB slab_unreclaimable:116664kB kernel_stack:6336kB pagetables:15284kB unstable:0kB bounce:0kB free_pcp:1212kB local_pcp:568kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no [ 1121.162103] lowmem_reserve[]: 0 3504 3504 [ 1121.162134] Normal free:3054384kB min:5580kB low:6972kB high:8368kB active_anon:152712kB inactive_anon:12608kB active_file:24976kB inactive_file:26320kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:4718592kB managed:3588764kB mlocked:0kB dirty:180kB writeback:0kB mapped:128116kB shmem:18316kB slab_reclaimable:9200kB slab_unreclaimable:137884kB kernel_stack:8000kB pagetables:19060kB unstable:0kB bounce:0kB free_pcp:916kB local_pcp:388kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no [ 1121.162143] lowmem_reserve[]: 0 0 0 [ 1121.162206] DMA32: 169*4kB (UME) 88*8kB (ME) 347*16kB (UME) 160*32kB (UME) 66*64kB (UME) 24*128kB (UME) 12*256kB (UM) 5*512kB (M) 1*1024kB (E) 2*2048kB (UE) 621*4096kB (M) = 2573716kB [ 1121.162261] Normal: 482*4kB (UM) 258*8kB (UME) 296*16kB (UME) 234*32kB (UM) 73*64kB (UME) 30*128kB (UME) 10*256kB (UM) 8*512kB (UME) 4*1024kB (M) 4*2048kB (UME) 735*4096kB (M) = 3054232kB [ 1121.162264] 31107 total pagecache pages [ 1121.162268] 0 pages in swap cache [ 1121.162272] Swap cache stats: add 0, delete 0, find 0/0 [ 1121.162276] Free swap = 0kB [ 1121.162278] Total swap = 0kB [ 1121.162281] 1965979 pages RAM [ 1121.162285] 0 pages HighMem/MovableOnly [ 1121.162287] 313294 pages reserved [ 1121.219707] binder: 19590:19598 transaction failed 29189/-22, size 0-0 line 3014 [ 1121.219839] binder: undelivered TRANSACTION_ERROR: 29189 [ 1121.310902] vmalloc: allocation failure: 0 bytes [ 1121.310908] syz-executor.4: page allocation failure: order:0, mode:0x24000c2 [ 1121.310918] CPU: 1 PID: 19605 Comm: syz-executor.4 Not tainted 4.4.174+ #4 [ 1121.310930] 0000000000000000 222e1f992b3c7264 ffff8801d68a79f0 ffffffff81aad1a1 [ 1121.310941] 1ffff1003ad14f41 ffff8800a44317c0 00000000024000c2 0000000000000000 [ 1121.310954] ffffffff82895080 ffff8801d68a7b00 ffffffff8148c0cb ffffffff00000001 [ 1121.310957] Call Trace: [ 1121.310970] [] dump_stack+0xc1/0x120 [ 1121.310982] [] warn_alloc_failed.cold+0x78/0x99 [ 1121.310994] [] ? zone_watermark_ok_safe+0x290/0x290 [ 1121.311006] [] ? sel_write_load+0x9e/0xf90 [ 1121.311017] [] __vmalloc_node_range+0x365/0x650 [ 1121.311029] [] ? check_preemption_disabled+0x3c/0x200 [ 1121.311039] [] ? check_preemption_disabled+0x3c/0x200 [ 1121.311049] [] ? task_has_security+0x130/0x270 [ 1121.311056] [] vmalloc+0x5c/0x70 [ 1121.311064] [] ? sel_write_load+0x119/0xf90 [ 1121.311071] [] sel_write_load+0x119/0xf90 [ 1121.311081] [] ? sel_read_bool+0x240/0x240 [ 1121.311093] [] ? trace_hardirqs_on+0x10/0x10 [ 1121.311103] [] __vfs_write+0x116/0x3d0 [ 1121.311112] [] ? sel_read_bool+0x240/0x240 [ 1121.311122] [] ? __vfs_read+0x3c0/0x3c0 [ 1121.311139] [] ? check_preemption_disabled+0x3c/0x200 [ 1121.311149] [] ? check_preemption_disabled+0x3c/0x200 [ 1121.311160] [] ? rcu_read_lock_sched_held+0x10b/0x130 [ 1121.311167] [] ? rcu_sync_lockdep_assert+0x73/0xb0 [ 1121.311178] [] ? __sb_start_write+0x14f/0x310 [ 1121.311188] [] vfs_write+0x182/0x4e0 [ 1121.311198] [] SyS_write+0xdc/0x1c0 [ 1121.311207] [] ? SyS_read+0x1c0/0x1c0 [ 1121.311221] [] ? lockdep_sys_exit_thunk+0x12/0x14 [ 1121.311233] [] entry_SYSCALL_64_fastpath+0x1e/0x9a [ 1121.321254] Mem-Info: [ 1121.321282] active_anon:70050 inactive_anon:6174 isolated_anon:0 [ 1121.321282] active_file:11182 inactive_file:11777 isolated_file:0 [ 1121.321282] unevictable:0 dirty:47 writeback:0 unstable:0 [ 1121.321282] slab_reclaimable:4385 slab_unreclaimable:63479 [ 1121.321282] mapped:58982 shmem:8668 pagetables:8496 bounce:0 [ 1121.321282] free:1406669 free_pcp:510 free_cma:0 [ 1121.321315] DMA32 free:2572224kB min:4696kB low:5868kB high:7044kB active_anon:127576kB inactive_anon:11596kB active_file:19752kB inactive_file:20788kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:3145324kB managed:3021976kB mlocked:0kB dirty:8kB writeback:0kB mapped:107864kB shmem:15764kB slab_reclaimable:8340kB slab_unreclaimable:116660kB kernel_stack:6464kB pagetables:15240kB unstable:0kB bounce:0kB free_pcp:916kB local_pcp:492kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no [ 1121.321327] lowmem_reserve[]: 0 3504 3504 [ 1121.321363] Normal free:3054452kB min:5580kB low:6972kB high:8368kB active_anon:152624kB inactive_anon:13100kB active_file:24976kB inactive_file:26320kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:4718592kB managed:3588764kB mlocked:0kB dirty:180kB writeback:0kB mapped:128064kB shmem:18908kB slab_reclaimable:9200kB slab_unreclaimable:137256kB kernel_stack:8096kB pagetables:18744kB unstable:0kB bounce:0kB free_pcp:1124kB local_pcp:624kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no [ 1121.321372] lowmem_reserve[]: 0 0 0 [ 1121.321433] DMA32: 6*4kB (UE) 30*8kB (UME) 335*16kB (UME) 155*32kB (UME) 66*64kB (UME) 25*128kB (UME) 12*256kB (UM) 5*512kB (M) 1*1024kB (E) 2*2048kB (UE) 621*4096kB (M) = 2572376kB [ 1121.321499] Normal: 519*4kB (UM) 280*8kB (UME) 297*16kB (UME) 230*32kB (UM) 73*64kB (UME) 30*128kB (UME) 10*256kB (UM) 8*512kB (UME) 4*1024kB (M) 4*2048kB (UME) 735*4096kB (M) = 3054444kB [ 1121.321502] 31626 total pagecache pages [ 1121.321506] 0 pages in swap cache [ 1121.321512] Swap cache stats: add 0, delete 0, find 0/0 [ 1121.321515] Free swap = 0kB [ 1121.321517] Total swap = 0kB [ 1121.321520] 1965979 pages RAM [ 1121.321523] 0 pages HighMem/MovableOnly [ 1121.321525] 313294 pages reserved [ 1121.604539] INFO: task init:5327 blocked for more than 140 seconds. [ 1121.604545] Not tainted 4.4.174+ #4 [ 1121.604547] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 1121.604569] init D ffff8800b9c4f718 29280 5327 1 0x00000000 [ 1121.604581] ffff8800b9c4f718 ffff8801d73bc740 ed8d7b8409c0a5d6 ffff8801d73bc740 [ 1121.604591] 0000000000000000 ffff8801d73bd000 ffff8801db61f180 ffff8801db61f1a8 [ 1121.604601] ffff8801db61e898 ffff8801d6a14740 ffff8801d73bc740 ffffed0017389001 [ 1121.604603] Call Trace: [ 1121.604618] [] schedule+0x99/0x1d0 [ 1121.604627] [] schedule_preempt_disabled+0x13/0x20 [ 1121.604636] [] mutex_lock_nested+0x3c2/0xb80 [ 1121.604646] [] ? tty_open+0x56a/0xf50 [ 1121.604654] [] ? assoc_array_gc+0x1233/0x12e0 [ 1121.604662] [] ? mutex_trylock+0x500/0x500 [ 1121.604671] [] ? kmem_cache_alloc_trace+0x123/0x2d0 [ 1121.604679] [] tty_open+0x56a/0xf50 [ 1121.604687] [] ? tty_init_dev+0x420/0x420 [ 1121.604696] [] ? chrdev_open+0xca/0x630 [ 1121.604705] [] ? tty_init_dev+0x420/0x420 [ 1121.604712] [] chrdev_open+0x230/0x630 [ 1121.604720] [] ? cdev_put.part.0+0x50/0x50 [ 1121.604730] [] do_dentry_open+0x38f/0xbd0 [ 1121.604738] [] ? __inode_permission2+0x9e/0x250 [ 1121.604746] [] ? cdev_put.part.0+0x50/0x50 [ 1121.604753] [] vfs_open+0x10b/0x210 [ 1121.604761] [] ? may_open.isra.0+0xe7/0x210 [ 1121.604768] [] path_openat+0x136f/0x4470 [ 1121.604776] [] ? kasan_kmalloc.part.0+0xc6/0xf0 [ 1121.604784] [] ? may_open.isra.0+0x210/0x210 [ 1121.604794] [] ? trace_hardirqs_on+0x10/0x10 [ 1121.604802] [] do_filp_open+0x1a1/0x270 [ 1121.604810] [] ? getname_flags+0xcc/0x550 [ 1121.604818] [] ? user_path_mountpoint_at+0x50/0x50 [ 1121.604827] [] ? __alloc_fd+0x1ea/0x490 [ 1121.604835] [] ? _raw_spin_unlock+0x2d/0x50 [ 1121.604842] [] do_sys_open+0x2f8/0x600 [ 1121.604849] [] ? filp_open+0x70/0x70 [ 1121.604858] [] ? trace_hardirqs_on_caller+0x385/0x5a0 [ 1121.604865] [] SyS_open+0x2d/0x40 [ 1121.604873] [] entry_SYSCALL_64_fastpath+0x1e/0x9a [ 1121.604879] 1 lock held by init/5327: [ 1121.604897] #0: (tty_mutex){+.+.+.}, at: [] tty_open+0x56a/0xf50 [ 1121.604902] Sending NMI to all CPUs: [ 1121.606199] NMI backtrace for cpu 0 [ 1121.606203] CPU: 0 PID: 19584 Comm: syz-executor.2 Not tainted 4.4.174+ #4 [ 1121.606207] task: ffff8801da648000 task.stack: ffff8800b5e30000 [ 1121.606211] RIP: 0010:[] [] __module_text_address+0x6/0x140 [ 1121.606214] RSP: 0018:ffff8800b5e36be8 EFLAGS: 00000297 [ 1121.606217] RAX: 0000000000000402 RBX: ffff8801da6488c8 RCX: 0000000000000000 [ 1121.606221] RDX: 0000000000000000 RSI: ffff8801da6488c8 RDI: ffff8801da6488c8 [ 1121.606224] RBP: ffff8800b5e36bf0 R08: ffff8800b5e36d30 R09: 0000000000000000 [ 1121.606228] R10: ffff8800b5e37278 R11: 0000000000000000 R12: ffff8801da6488c8 [ 1121.606232] R13: ffff8800b5e36d30 R14: ffff8800b5e37ff8 R15: ffff8800b5e30000 [ 1121.606235] FS: 00007f7733af2700(0000) GS:ffff8801db600000(0000) knlGS:0000000000000000 [ 1121.606239] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1121.606242] CR2: 00007ffff0af9f48 CR3: 00000001bfeff000 CR4: 00000000001606b0 [ 1121.606246] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 1121.606249] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 1121.606251] Stack: [ 1121.606255] ffff8801da6488c8 ffff8800b5e36c08 ffffffff812aef7b 0000000000000000 [ 1121.606259] ffff8800b5e36c20 ffffffff8112f548 ffff8800b5e37168 ffff8800b5e36c78 [ 1121.606262] ffffffff81013549 ffff8801da6488c8 ffff8800b5e37278 ffff8800b5e37278 [ 1121.606264] Call Trace: [ 1121.606268] [] is_module_text_address+0x1b/0x50 [ 1121.606271] [] __kernel_text_address+0x68/0xa0 [ 1121.606274] [] print_context_stack+0x59/0xd0 [ 1121.606276] [] dump_trace+0x179/0x390 [ 1121.606279] [] save_stack_trace+0x26/0x50 [ 1121.606282] [] kasan_slab_free+0xb0/0x190 [ 1121.606285] [] ? save_stack_trace+0x26/0x50 [ 1121.606288] [] ? kasan_slab_free+0xb0/0x190 [ 1121.606291] [] ? kmem_cache_free+0xbe/0x350 [ 1121.606295] [] ? kfree_skbmem+0xf6/0x110 [ 1121.606298] [] ? consume_skb+0xfb/0x3f0 [ 1121.606301] [] ? packet_rcv+0xe0/0x1120 [ 1121.606304] [] ? dev_hard_start_xmit+0x654/0x11e0 [ 1121.606307] [] ? __dev_queue_xmit+0x164b/0x1bb0 [ 1121.606310] [] ? debug_lockdep_rcu_enabled+0x71/0xa0 [ 1121.606314] [] ? debug_check_no_obj_freed+0x159/0x6e0 [ 1121.606317] [] ? _raw_spin_unlock_irqrestore+0x5a/0x70 [ 1121.606320] [] ? trace_hardirqs_on_caller+0x260/0x5a0 [ 1121.606324] [] ? _raw_spin_unlock_irqrestore+0x45/0x70 [ 1121.606327] [] ? debug_check_no_obj_freed+0x2b9/0x6e0 [ 1121.606331] [] ? debug_object_active_state+0x380/0x380 [ 1121.606334] [] ? kmem_cache_free+0x9e/0x350 [ 1121.606337] [] ? kfree_skbmem+0xf6/0x110 [ 1121.606340] [] ? kfree_skbmem+0xf6/0x110 [ 1121.606343] [] kmem_cache_free+0xbe/0x350 [ 1121.606346] [] kfree_skbmem+0xf6/0x110 [ 1121.606349] [] consume_skb+0xfb/0x3f0 [ 1121.606352] [] packet_rcv+0xe0/0x1120 [ 1121.606355] [] ? dev_hard_start_xmit+0x5b5/0x11e0 [ 1121.606358] [] ? run_filter+0x290/0x290 [ 1121.606361] [] dev_hard_start_xmit+0x654/0x11e0 [ 1121.606365] [] ? dev_hard_start_xmit+0xb3/0x11e0 [ 1121.606368] [] __dev_queue_xmit+0x164b/0x1bb0 [ 1121.606371] [] ? __dev_queue_xmit+0x1d7/0x1bb0 [ 1121.606374] [] ? trace_hardirqs_on+0x10/0x10 [ 1121.606377] [] ? netdev_pick_tx+0x2f0/0x2f0 [ 1121.606380] [] ? nf_ct_deliver_cached_events+0x393/0x5f0 [ 1121.606384] [] ? nf_ct_deliver_cached_events+0x8a/0x5f0 [ 1121.606387] [] ? check_preemption_disabled+0x3c/0x200 [ 1121.606391] [] ? check_preemption_disabled+0x3c/0x200 [ 1121.606394] [] dev_queue_xmit+0x18/0x20 [ 1121.606397] [] neigh_direct_output+0x16/0x20 [ 1121.606400] [] ip_finish_output2+0x6a2/0x1280 [ 1121.606403] [] ? ip_finish_output2+0x20b/0x1280 [ 1121.606406] [] ? nf_hook_slow+0x1dc/0x340 [ 1121.606409] [] ? ip_send_check+0xb0/0xb0 [ 1121.606412] [] ? nf_hook_slow+0x203/0x340 [ 1121.606415] [] ip_finish_output+0x8b2/0xc60 [ 1121.606418] [] ip_mc_output+0x251/0xae0 [ 1121.606421] [] ? ip_queue_xmit+0x1ab0/0x1ab0 [ 1121.606425] [] ? ip_make_skb+0x116/0x210 [ 1121.606428] [] ? ip_fragment.constprop.0+0x200/0x200 [ 1121.606433] [] ? ip_flush_pending_f [ 1121.606442] NMI backtrace for cpu 1 [ 1121.606446] CPU: 1 PID: 20 Comm: khungtaskd Not tainted 4.4.174+ #4 [ 1121.606449] task: ffff8801da6c4740 task.stack: ffff8801d9ef0000 [ 1121.606453] RIP: 0010:[] [] flat_send_IPI_mask+0xf7/0x1b0 [ 1121.606456] RSP: 0018:ffff8801d9ef7c88 EFLAGS: 00000046 [ 1121.606459] RAX: 0000000000000000 RBX: 0000000000000c00 RCX: 0000000000000000 [ 1121.606463] RDX: 0000000000000c00 RSI: 0000000000000000 RDI: ffffffffff5fc300 [ 1121.606466] RBP: ffff8801d9ef7cb8 R08: 0000000000000018 R09: 0000000000000000 [ 1121.606470] R10: 0000000000000001 R11: 0000000000000001 R12: 0000000000000246 [ 1121.606474] R13: 0000000003000000 R14: ffffffff82e5f2e0 R15: 0000000000000002 [ 1121.606478] FS: 0000000000000000(0000) GS:ffff8801db700000(0000) knlGS:0000000000000000 [ 1121.606481] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1121.606484] CR2: 0000000001b7d018 CR3: 00000000b673c000 CR4: 00000000001606b0 [ 1121.606488] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 1121.606491] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 1121.606493] Stack: [ 1121.606497] 0000000000000001 ffffffff82e5f2e0 ffffffff831a6ac0 fffffbfff0634c34 [ 1121.606500] 000000000001b6c0 0000000000000008 ffff8801d9ef7cd8 ffffffff81092bee [ 1121.606504] 0000000000000008 ffffffff82924260 ffff8801d9ef7d30 ffffffff81ab8252 [ 1121.606506] Call Trace: [ 1121.606509] [] nmi_raise_cpu_backtrace+0x5e/0x80 [ 1121.606513] [] nmi_trigger_all_cpu_backtrace.cold+0xa1/0xae [ 1121.606516] [] ? print_lock+0xa8/0xab [ 1121.606519] [] ? irq_force_complete_move+0x330/0x330 [ 1121.606523] [] arch_trigger_all_cpu_backtrace+0x14/0x20 [ 1121.606526] [] watchdog.cold+0xd3/0xee [ 1121.606529] [] ? watchdog+0xac/0xa00 [ 1121.606532] [] ? reset_hung_task_detector+0x20/0x20 [ 1121.606535] [] kthread+0x273/0x310 [ 1121.606538] [] ? kthread_create_on_node+0x4c0/0x4c0 [ 1121.606541] [] ? _raw_spin_unlock_irq+0x39/0x60 [ 1121.606544] [] ? finish_task_switch+0x1e1/0x660 [ 1121.606548] [] ? finish_task_switch+0x1b3/0x660 [ 1121.606550] [] ? __schedule+0x7af/0x1ee0 [ 1121.606553] [] ? __schedule+0x7a3/0x1ee0 [ 1121.606556] [] ? __schedule+0x7af/0x1ee0 [ 1121.606560] [] ? kthread_create_on_node+0x4c0/0x4c0 [ 1121.606563] [] ret_from_fork+0x55/0x80 [ 1121.606566] [] ? kthread_create_on_node+0x4c0/0x4c0 [ 1121.606573] Code: 00 c3 5f ff 80 e6 10 75 e1 41 c1 e5 18 44 89 2c 25 10 c3 5f ff 44 89 fa 09 da 80 cf 04 41 83 ff 02 0f 44 d3 89 14 25 00 c3 5f ff <41> f7 c4 00 02 00 00 75 1e 4c 89 e7 57 9d 0f 1f 44 00 00 e8 f1 [ 1121.606685] Kernel panic - not syncing: hung_task: blocked tasks [ 1121.606693] CPU: 1 PID: 20 Comm: khungtaskd Not tainted 4.4.174+ #4 [ 1121.606703] 0000000000000000 7bdb0ed0431ea75c ffff8801d9ef7c60 ffffffff81aad1a1 [ 1121.606712] ffff8801d73bc740 ffffffff82872120 dffffc0000000000 0000000000000002 [ 1121.606721] 00000000003ffe51 ffff8801d9ef7d40 ffffffff813a48c2 0000000041b58ab3 [ 1121.606723] Call Trace: [ 1121.606732] [] dump_stack+0xc1/0x120 [ 1121.606741] [] panic+0x1b9/0x37b [ 1121.606750] [] ? add_taint.cold+0x16/0x16 [ 1121.606758] [] ? find_next_bit+0x44/0x50 [ 1121.606767] [] ? nmi_trigger_all_cpu_backtrace+0x3c6/0x490 [ 1121.606776] [] ? nmi_trigger_all_cpu_backtrace+0x3c6/0x490 [ 1121.606784] [] watchdog.cold+0xe4/0xee [ 1121.606791] [] ? watchdog+0xac/0xa00 [ 1121.606799] [] ? reset_hung_task_detector+0x20/0x20 [ 1121.606807] [] kthread+0x273/0x310 [ 1121.606816] [] ? kthread_create_on_node+0x4c0/0x4c0 [ 1121.606824] [] ? _raw_spin_unlock_irq+0x39/0x60 [ 1121.606831] [] ? finish_task_switch+0x1e1/0x660 [ 1121.606838] [] ? finish_task_switch+0x1b3/0x660 [ 1121.606846] [] ? __schedule+0x7af/0x1ee0 [ 1121.606853] [] ? __schedule+0x7a3/0x1ee0 [ 1121.606860] [] ? __schedule+0x7af/0x1ee0 [ 1121.606869] [] ? kthread_create_on_node+0x4c0/0x4c0 [ 1121.606876] [] ret_from_fork+0x55/0x80 [ 1121.606885] [] ? kthread_create_on_node+0x4c0/0x4c0 [ 1121.607233] Kernel Offset: disabled [ 1133.494940] Rebooting in 86400 seconds..