Starting mcstransd: [....] Starting file context maintaining daemon: restorecond[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[ 20.123894] random: sshd: uninitialized urandom read (32 bytes read, 32 bits of entropy available) [?25l[?1c7[ ok 8[?25h[?0c. [ 20.615487] random: sshd: uninitialized urandom read (32 bytes read, 32 bits of entropy available) [ 20.796399] random: sshd: uninitialized urandom read (32 bytes read, 34 bits of entropy available) Debian GNU/Linux 7 syzkaller ttyS0 syzkaller login: [ 21.780574] random: nonblocking pool is initialized Warning: Permanently added '10.128.0.7' (ECDSA) to the list of known hosts. 2018/02/20 00:06:31 fuzzer started 2018/02/20 00:06:32 dialing manager at 10.128.0.26:40885 2018/02/20 00:06:35 kcov=true, comps=false 2018/02/20 00:06:35 executing program 1: r0 = syz_open_procfs(0x0, &(0x7f0000000040)='net/icmp\x00') sendfile(r0, r0, &(0x7f000095fff8), 0x401) 2018/02/20 00:06:35 executing program 0: mmap(&(0x7f0000000000/0x7000)=nil, 0x7000, 0x0, 0x18071, 0xffffffffffffffff, 0x0) mremap(&(0x7f0000003000/0x1000)=nil, 0x1000, 0x1000, 0x3, &(0x7f0000001000/0x1000)=nil) remap_file_pages(&(0x7f0000001000/0x4000)=nil, 0x4000, 0x0, 0x0, 0x0) 2018/02/20 00:06:35 executing program 7: syz_emit_ethernet(0x46, &(0x7f00000002c0)={@link_local={0x1, 0x80, 0xc2}, @local={[0xaa, 0xaa, 0xaa, 0xaa], 0xffffffffffffffff, 0xaa}, [], {@ipv6={0x86dd, {0x0, 0x6, "f51e2f", 0x10, 0x2f, 0x0, @local={0xfe, 0x80, [], 0xffffffffffffffff, 0xaa}, @mcast2={0xff, 0x2, [], 0x1}, {[], @gre={{0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x880b, 0x0, 0x0, []}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800, []}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x86dd, []}}}}}}}, &(0x7f0000000000)={0x0, 0x1, [0x0]}) 2018/02/20 00:06:35 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x2, 0x0, []}) ioctl(r0, 0x800008936, &(0x7f0000000000)) 2018/02/20 00:06:35 executing program 3: 2018/02/20 00:06:35 executing program 4: 2018/02/20 00:06:35 executing program 5: 2018/02/20 00:06:35 executing program 6: syz_open_dev$evdev(&(0x7f0000dfdfee)='/dev/input/event#\x00', 0x0, 0x0) readv(0xffffffffffffffff, &(0x7f0000019fe0)=[], 0x0) timer_create(0x0, &(0x7f0000ec5000)={0x0, 0x12, 0x0, @tid}, &(0x7f0000fd7000)) syz_open_dev$evdev(&(0x7f0000fe5fee)='/dev/input/event#\x00', 0x0, 0x6000) [ 31.322846] IPVS: Creating netns size=2552 id=1 [ 31.373206] IPVS: Creating netns size=2552 id=2 [ 31.420385] IPVS: Creating netns size=2552 id=3 [ 31.486421] IPVS: Creating netns size=2552 id=4 [ 31.545409] IPVS: Creating netns size=2552 id=5 [ 31.616395] IPVS: Creating netns size=2552 id=6 [ 31.753393] IPVS: Creating netns size=2552 id=7 [ 31.871157] IPVS: Creating netns size=2552 id=8 [ 34.594230] mmap: syz-executor0 (4858) uses deprecated remap_file_pages() syscall. See Documentation/vm/remap_file_pages.txt. 2018/02/20 00:06:39 executing program 1: 2018/02/20 00:06:39 executing program 7: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r0, &(0x7f0000366000)={0x2, 0x3, @broadcast=0xffffffff}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000f5eff5)='lp\x00', 0x4) sendto$inet(r0, &(0x7f0000fd0000), 0xfffffffffffffec1, 0x20000801, &(0x7f0000deaff0)={0x2, 0x3, @loopback=0x7f000001}, 0x10) recvfrom$inet(r0, &(0x7f0000000000)=""/20, 0x14, 0x0, &(0x7f0000000040)={0x2, 0xffffffffffffffff, @multicast1=0xe0000001}, 0x10) 2018/02/20 00:06:39 executing program 0: 2018/02/20 00:06:39 executing program 2: 2018/02/20 00:06:39 executing program 3: 2018/02/20 00:06:39 executing program 4: 2018/02/20 00:06:39 executing program 6: syz_open_dev$evdev(&(0x7f0000dfdfee)='/dev/input/event#\x00', 0x0, 0x0) readv(0xffffffffffffffff, &(0x7f0000019fe0)=[], 0x0) timer_create(0x0, &(0x7f0000ec5000)={0x0, 0x12, 0x0, @tid}, &(0x7f0000fd7000)) syz_open_dev$evdev(&(0x7f0000fe5fee)='/dev/input/event#\x00', 0x0, 0x6000) 2018/02/20 00:06:39 executing program 5: 2018/02/20 00:06:39 executing program 4: 2018/02/20 00:06:39 executing program 0: 2018/02/20 00:06:39 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f000019cfd9)='reno\x00', 0xfffffffffffffe9c) sendto$inet(r0, &(0x7f0000fa0fff), 0x0, 0x200a0007, &(0x7f0000e97fcf)={0x2, 0xffffffffffffffff, @loopback=0x7f000001}, 0x10) 2018/02/20 00:06:39 executing program 4: 2018/02/20 00:06:39 executing program 3: clone(0x200, &(0x7f0000251dca), &(0x7f0000744000), &(0x7f0000fef000), &(0x7f0000dacfc9)) mknod(&(0x7f0000f80000)='./file0\x00', 0x1040, 0x0) execve(&(0x7f000007b000)='./file0\x00', &(0x7f0000a7bfc8)=[], &(0x7f00006fcff0)=[]) r0 = syz_open_procfs(0x0, &(0x7f000042cff4)='io\x00') readv(r0, &(0x7f00009f4fd0)=[{&(0x7f0000784000)=""/46, 0x2e}], 0x1) lseek(0xffffffffffffffff, 0x0, 0x0) open$dir(&(0x7f0000e9f000)='./file0\x00', 0x26102, 0x0) 2018/02/20 00:06:39 executing program 5: perf_event_open(&(0x7f0000740000)={0x2, 0x78, 0x48, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x3, 0x8972, 0xffffffffffffffff, 0x0) pipe2(&(0x7f0000000ff8)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) mremap(&(0x7f0000a94000/0x1000)=nil, 0x1000, 0xe000, 0x3, &(0x7f0000b18000/0xe000)=nil) ioctl$DRM_IOCTL_RM_MAP(0xffffffffffffffff, 0x4028641b, &(0x7f0000b1d000)={&(0x7f0000a93000/0x3000)=nil, 0x20000002, 0x0, 0x0, &(0x7f0000b1c000/0x4000)=nil}) mprotect(&(0x7f0000b1d000/0x2000)=nil, 0x2000, 0x5) vmsplice(r0, &(0x7f0000b1d000)=[{&(0x7f0000005fe3)}], 0x1, 0x0) 2018/02/20 00:06:39 executing program 1: r0 = syz_open_procfs(0x0, &(0x7f0000d12fa9)='net/arp\x00') readv(r0, &(0x7f000000efa0)=[{&(0x7f00001e7000)=""/204, 0xcc}], 0x1) 2018/02/20 00:06:39 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000232ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004edf8a), 0x1}], &(0x7f000000afd0)=[0x0]}}], 0xffffffffffffff60, 0x0, &(0x7f0000009000)}) 2018/02/20 00:06:39 executing program 2: r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000)='/dev/loop-control\x00', 0x0, 0x0) ioctl$LOOP_CTL_ADD(r0, 0x4c81, 0x0) accept(0xffffffffffffffff, &(0x7f0000000080)=@can, &(0x7f00000000c0)=0x10) fgetxattr(0xffffffffffffffff, &(0x7f0000000100)=@random={'security.', '/dev/loop-control\x00'}, &(0x7f0000000140)=""/11, 0xb) ioctl$LOOP_CTL_REMOVE(r0, 0x4c80, 0x0) 2018/02/20 00:06:39 executing program 6: syz_open_dev$evdev(&(0x7f0000dfdfee)='/dev/input/event#\x00', 0x0, 0x0) readv(0xffffffffffffffff, &(0x7f0000019fe0)=[], 0x0) timer_create(0x0, &(0x7f0000ec5000)={0x0, 0x12, 0x0, @tid}, &(0x7f0000fd7000)) syz_open_dev$evdev(&(0x7f0000fe5fee)='/dev/input/event#\x00', 0x0, 0x6000) 2018/02/20 00:06:39 executing program 7: 2018/02/20 00:06:39 executing program 4: 2018/02/20 00:06:39 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f000019cfd9)='reno\x00', 0xfffffffffffffe9c) bind$inet(r0, &(0x7f0000c16ff0)={0x2, 0x1, @multicast1=0xe0000001}, 0x10) sendto$inet(r0, &(0x7f0000fa0fff), 0x0, 0x200a0007, &(0x7f0000e97fcf)={0x2, 0xffffffffffffffff, @loopback=0x7f000001}, 0x10) 2018/02/20 00:06:39 executing program 5: perf_event_open(&(0x7f0000273f88)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) setrlimit(0x1000000000000007, &(0x7f000068d000)) memfd_create(&(0x7f0000000000)='em1\x00', 0x3) 2018/02/20 00:06:39 executing program 1: r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000)='/dev/loop-control\x00', 0x0, 0x0) ioctl$LOOP_CTL_ADD(r0, 0x4c81, 0x0) r1 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/policy\x00', 0x0, 0x0) r2 = accept(0xffffffffffffffff, &(0x7f0000000080)=@can, &(0x7f00000000c0)=0x10) getsockopt$inet_sctp6_SCTP_CONTEXT(r2, 0x84, 0x11, &(0x7f0000000100)={0x0}, &(0x7f0000000140)=0x8) getsockopt$inet_sctp_SCTP_AUTH_ACTIVE_KEY(r1, 0x84, 0x18, &(0x7f0000000180)={r3, 0x25}, &(0x7f00000001c0)=0x8) setsockopt(r2, 0x3, 0x1, &(0x7f0000000100), 0x0) ioctl$LOOP_CTL_REMOVE(r0, 0x4c80, 0x0) 2018/02/20 00:06:39 executing program 7: r0 = syz_open_dev$tun(&(0x7f0000872000)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000148000)={@generic="ae8cc03376c991ac525746c5466637e4", @ifru_data=&(0x7f0000000040)="5be07594a4d1654f1a704f5b8e653f6c14df62696881b3e959c168f1b319cd94"}) 2018/02/20 00:06:39 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000000)={@multicast2=0xe0000002, @loopback=0x7f000001}, 0xfffffffffffffefd) getsockopt$inet_buf(r0, 0x0, 0x29, &(0x7f0000000000)=""/16, &(0x7f0000ec0000)=0x10) [ 35.066883] audit: type=1400 audit(1519085199.585:5): avc: denied { set_context_mgr } for pid=4965 comm="syz-executor0" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=binder permissive=1 2018/02/20 00:06:39 executing program 7: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) mmap(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0, 0x52, r0, 0x0) ioctl$sock_ifreq(r0, 0x8913, &(0x7f0000e56fea)={@syzn={0x73, 0x79, 0x7a, 0x0}, @ifru_mtu}) 2018/02/20 00:06:39 executing program 5: perf_event_open(&(0x7f0000273f88)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = getpgrp(0x0) capset(&(0x7f0000000040)={0x19980330, r0}, &(0x7f0000000080)={0x0, 0x6, 0x0, 0x0, 0x473, 0x5}) [ 35.108251] audit: type=1400 audit(1519085199.625:6): avc: denied { call } for pid=4965 comm="syz-executor0" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=binder permissive=1 [ 35.142321] binder_alloc: binder_alloc_mmap_handler: 4965 20000000-20002000 already mapped failed -16 [ 35.146887] binder_alloc: 4965: binder_alloc_buf, no vma [ 35.146923] binder: 4965:4974 transaction failed 29189/-3, size 40-8 line 3128 [ 35.152441] capability: warning: `syz-executor5' uses 32-bit capabilities (legacy support in use) [ 35.175940] binder: BINDER_SET_CONTEXT_MGR already set [ 35.182430] binder: 4965:4967 ioctl 40046207 0 returned -16 [ 35.182524] binder_alloc: 4965: binder_alloc_buf, no vma [ 35.182564] binder: 4965:4974 transaction failed 29189/-3, size 40-8 line 3128 2018/02/20 00:06:39 executing program 4: r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000)='/dev/loop-control\x00', 0x0, 0x0) ioctl$LOOP_CTL_ADD(r0, 0x4c81, 0x0) r1 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/policy\x00', 0x0, 0x0) r2 = accept(0xffffffffffffffff, &(0x7f0000000080)=@can, &(0x7f00000000c0)=0x10) getsockopt$inet_sctp6_SCTP_CONTEXT(r2, 0x84, 0x11, &(0x7f0000000100)={0x0}, &(0x7f0000000140)=0x8) getsockopt$inet_sctp_SCTP_AUTH_ACTIVE_KEY(r1, 0x84, 0x18, &(0x7f0000000180)={r3, 0x25}, &(0x7f00000001c0)=0x8) setsockopt(r2, 0x3, 0x1, &(0x7f0000000100), 0x0) ioctl$LOOP_CTL_REMOVE(r0, 0x4c80, 0x0) 2018/02/20 00:06:39 executing program 5: 2018/02/20 00:06:39 executing program 6: syz_open_dev$evdev(&(0x7f0000dfdfee)='/dev/input/event#\x00', 0x0, 0x0) readv(0xffffffffffffffff, &(0x7f0000019fe0)=[], 0x0) timer_create(0x0, &(0x7f0000ec5000)={0x0, 0x12, 0x0, @tid}, &(0x7f0000fd7000)) syz_open_dev$evdev(&(0x7f0000fe5fee)='/dev/input/event#\x00', 0x0, 0x6000) 2018/02/20 00:06:39 executing program 7: 2018/02/20 00:06:39 executing program 0: 2018/02/20 00:06:39 executing program 2: 2018/02/20 00:06:39 executing program 1: r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000)='/dev/loop-control\x00', 0x0, 0x0) ioctl$LOOP_CTL_ADD(r0, 0x4c81, 0x0) r1 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/policy\x00', 0x0, 0x0) r2 = accept(0xffffffffffffffff, &(0x7f0000000080)=@can, &(0x7f00000000c0)=0x10) getsockopt$inet_sctp6_SCTP_CONTEXT(r2, 0x84, 0x11, &(0x7f0000000100)={0x0}, &(0x7f0000000140)=0x8) getsockopt$inet_sctp_SCTP_AUTH_ACTIVE_KEY(r1, 0x84, 0x18, &(0x7f0000000180)={r3, 0x25}, &(0x7f00000001c0)=0x8) setsockopt(r2, 0x3, 0x1, &(0x7f0000000100), 0x0) ioctl$LOOP_CTL_REMOVE(r0, 0x4c80, 0x0) 2018/02/20 00:06:39 executing program 3: 2018/02/20 00:06:39 executing program 5: 2018/02/20 00:06:39 executing program 0: 2018/02/20 00:06:39 executing program 2: 2018/02/20 00:06:39 executing program 7: clone(0x68240000, &(0x7f0000c19f89), &(0x7f00002c6000), &(0x7f0000847000), &(0x7f0000b81000)) 2018/02/20 00:06:39 executing program 3: r0 = syz_open_dev$tun(&(0x7f0000e9b18a)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000a5afd8)={@common='gre0\x00', @ifru_names=@generic="4f54000cc0a1ed4f3a0a1fdc222073b5"}) r1 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8916, &(0x7f00007ff000)={@common='gre0\x00', @ifru_addrs={0x2, 0xffffffffffffffff, @local={0xac, 0x14, 0xffffffffffffffff, 0xaa}}}) dup2(r1, r0) socket$inet(0x2, 0x0, 0x0) 2018/02/20 00:06:39 executing program 0: perf_event_open(&(0x7f0000740000)={0x2, 0x78, 0x48, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x3, 0x8972, 0xffffffffffffffff, 0x0) pipe2(&(0x7f0000000ff8)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) mremap(&(0x7f0000a94000/0x1000)=nil, 0x1000, 0xe000, 0x3, &(0x7f0000b18000/0xe000)=nil) ioctl$DRM_IOCTL_RM_MAP(0xffffffffffffffff, 0x4028641b, &(0x7f0000b1d000)={&(0x7f0000a93000/0x3000)=nil, 0x20000002, 0x0, 0x0, &(0x7f0000b1c000/0x4000)=nil}) mprotect(&(0x7f0000b1d000/0x2000)=nil, 0x2000, 0x5) vmsplice(r0, &(0x7f0000b1d000)=[{&(0x7f0000005fe3)}], 0x1, 0x0) 2018/02/20 00:06:39 executing program 2: r0 = socket$inet6(0xa, 0x400000000001, 0x0) ioctl$sock_inet_SIOCSIFDSTADDR(r0, 0x8918, &(0x7f0000000000)={@generic="fc722923d14a5128a6d82e4cce352609", @ifru_addrs={0x2, 0xffffffffffffffff, @multicast2=0xe0000002}}) 2018/02/20 00:06:39 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00001b4ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETA(r0, 0x5402, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc}) 2018/02/20 00:06:39 executing program 0: perf_event_open(&(0x7f0000aaa000)={0x2, 0x78, 0x47, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mkdir(&(0x7f000082f000)='./control\x00', 0x0) rename(&(0x7f00000001c0)='./control\x00', &(0x7f0000000200)='./control/file0\x00') 2018/02/20 00:06:39 executing program 7: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f00009d6000)={&(0x7f0000de2ff4)={0x10}, 0xc, &(0x7f0000778ff8)={&(0x7f0000f3d000)={0xfffffffffffffff0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, {}, []}, 0x14}, 0x1}, 0x0) 2018/02/20 00:06:39 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f000019cfd9)='reno\x00', 0xfffffffffffffe9c) bind$inet(r0, &(0x7f0000c16ff0)={0x2, 0x1, @multicast1=0xe0000001}, 0x10) sendto$inet(r0, &(0x7f0000fa0fff), 0xffffffffffffff8d, 0x20020007, &(0x7f0000e97fcf)={0x2, 0x1, @loopback=0x7f000001}, 0x10) 2018/02/20 00:06:39 executing program 3: r0 = syz_open_dev$tun(&(0x7f0000e9b18a)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000a5afd8)={@common='gre0\x00', @ifru_names=@generic="4f54000cc0a1ed4f3a0a1fdc222073b5"}) r1 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8916, &(0x7f00007ff000)={@common='gre0\x00', @ifru_addrs={0x2, 0xffffffffffffffff, @local={0xac, 0x14, 0xffffffffffffffff, 0xaa}}}) dup2(r1, r0) socket$inet(0x2, 0x0, 0x0) 2018/02/20 00:06:39 executing program 6: syz_open_dev$evdev(&(0x7f0000dfdfee)='/dev/input/event#\x00', 0x0, 0x0) readv(0xffffffffffffffff, &(0x7f0000019fe0)=[], 0x0) syz_open_dev$evdev(&(0x7f0000fe5fee)='/dev/input/event#\x00', 0x0, 0x6000) 2018/02/20 00:06:39 executing program 1: 2018/02/20 00:06:39 executing program 5: 2018/02/20 00:06:39 executing program 2: 2018/02/20 00:06:39 executing program 1: r0 = socket(0x11, 0x802, 0x0) write(r0, &(0x7f000065cfdc), 0x0) 2018/02/20 00:06:39 executing program 5: pipe2(&(0x7f0000000ff8)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$DRM_IOCTL_RM_MAP(0xffffffffffffffff, 0x4028641b, &(0x7f0000b1d000)={&(0x7f0000a93000/0x3000)=nil, 0x20000002, 0x0, 0x0, &(0x7f0000b1c000/0x4000)=nil}) mprotect(&(0x7f0000b1d000/0x2000)=nil, 0x2000, 0x5) vmsplice(r0, &(0x7f0000000180)=[{&(0x7f0000000040)="575eea0ab345513d67c949093be1fbe95cde8746e94e5d7b063e692b2eac3383fd95d2aa35eb6fedf79296746ca0769f4c666a56ff867d28f951e76fb21aa2045267d17d2d38b25246f9d310fcace61d8cbfedfe2adf37c91e3d41d8e092d60e645c085f89ac8b2ebe782c1fc1901543ede7b865143d6be4565cdf49a0436dae79cc20a1b6ae70b9a7cdedd1d453e40e1640e7a9810b51423e13055bc0c90cafa220a0e28670b452d9028985869557e4a3ee22e7c6adfbc27bfb19e4b9ffd9639b5fbada4ce6a74450bd91b2a3b9dd7dcb42b209c88d58058a7beaa3aef45b82d8057424daffd50896", 0xe9}, {&(0x7f0000001000)="c0", 0x1}], 0x2, 0x0) vmsplice(r0, &(0x7f0000b1d000)=[{&(0x7f0000005fe3)}], 0x1, 0x0) 2018/02/20 00:06:40 executing program 2: syz_emit_ethernet(0x4e, &(0x7f00000002c0)={@link_local={0x1, 0x80, 0xc2}, @local={[0xaa, 0xaa, 0xaa, 0xaa], 0xffffffffffffffff, 0xaa}, [], {@ipv6={0x86dd, {0x0, 0x6, "f51e2f", 0x18, 0x2f, 0x0, @local={0xfe, 0x80, [], 0xffffffffffffffff, 0xaa}, @mcast2={0xff, 0x2, [], 0x1}, {[@fragment={0x3e}], @gre={{0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x880b, 0x0, 0x0, []}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800, []}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x86dd, []}}}}}}}, &(0x7f0000000000)={0x0, 0x1, [0x0]}) 2018/02/20 00:06:40 executing program 4: r0 = syz_open_procfs(0x0, &(0x7f0000f81000)='net/igmp\x00') preadv(r0, &(0x7f0000ecfff8)=[{&(0x7f0000000000)=""/174, 0xaa82eab534552c5f}], 0x2000000000000360, 0x0) 2018/02/20 00:06:40 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00001b4ff6)='/dev/ptmx\x00', 0x0, 0x0) writev(0xffffffffffffffff, &(0x7f000036bfd0)=[], 0x0) ioctl$TIOCPKT(r0, 0x5420, &(0x7f0000566ffc)=0x7fff) read(r0, &(0x7f00001a4000)=""/1, 0x1) ioctl$TCSETA(r0, 0x5402, &(0x7f0000000000)) 2018/02/20 00:06:40 executing program 0: 2018/02/20 00:06:40 executing program 5: pipe2(&(0x7f0000000ff8)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$DRM_IOCTL_RM_MAP(0xffffffffffffffff, 0x4028641b, &(0x7f0000b1d000)={&(0x7f0000a93000/0x3000)=nil, 0x20000002, 0x0, 0x0, &(0x7f0000b1c000/0x4000)=nil}) mprotect(&(0x7f0000b1d000/0x2000)=nil, 0x2000, 0x5) vmsplice(r0, &(0x7f0000000180)=[{&(0x7f0000000040)="575eea0ab345513d67c949093be1fbe95cde8746e94e5d7b063e692b2eac3383fd95d2aa35eb6fedf79296746ca0769f4c666a56ff867d28f951e76fb21aa2045267d17d2d38b25246f9d310fcace61d8cbfedfe2adf37c91e3d41d8e092d60e645c085f89ac8b2ebe782c1fc1901543ede7b865143d6be4565cdf49a0436dae79cc20a1b6ae70b9a7cdedd1d453e40e1640e7a9810b51423e13055bc0c90cafa220a0e28670b452d9028985869557e4a3ee22e7c6adfbc27bfb19e4b9ffd9639b5fbada4ce6a74450bd91b2a3b9dd7dcb42b209c88d58058a7beaa3aef45b82d8057424daffd50896", 0xe9}, {&(0x7f0000001000)="c0", 0x1}], 0x2, 0x0) vmsplice(r0, &(0x7f0000b1d000)=[{&(0x7f0000005fe3)}], 0x1, 0x0) 2018/02/20 00:06:40 executing program 4: 2018/02/20 00:06:40 executing program 1: [ 35.484662] audit: type=1400 audit(1519085199.995:7): avc: denied { create } for pid=5044 comm="syz-executor7" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_netfilter_socket permissive=1 2018/02/20 00:06:40 executing program 0: 2018/02/20 00:06:40 executing program 4: 2018/02/20 00:06:40 executing program 1: 2018/02/20 00:06:40 executing program 5: pipe2(&(0x7f0000000ff8)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$DRM_IOCTL_RM_MAP(0xffffffffffffffff, 0x4028641b, &(0x7f0000b1d000)={&(0x7f0000a93000/0x3000)=nil, 0x20000002, 0x0, 0x0, &(0x7f0000b1c000/0x4000)=nil}) mprotect(&(0x7f0000b1d000/0x2000)=nil, 0x2000, 0x5) vmsplice(r0, &(0x7f0000000180)=[{&(0x7f0000000040)="575eea0ab345513d67c949093be1fbe95cde8746e94e5d7b063e692b2eac3383fd95d2aa35eb6fedf79296746ca0769f4c666a56ff867d28f951e76fb21aa2045267d17d2d38b25246f9d310fcace61d8cbfedfe2adf37c91e3d41d8e092d60e645c085f89ac8b2ebe782c1fc1901543ede7b865143d6be4565cdf49a0436dae79cc20a1b6ae70b9a7cdedd1d453e40e1640e7a9810b51423e13055bc0c90cafa220a0e28670b452d9028985869557e4a3ee22e7c6adfbc27bfb19e4b9ffd9639b5fbada4ce6a74450bd91b2a3b9dd7dcb42b209c88d58058a7beaa3aef45b82d8057424daffd50896", 0xe9}, {&(0x7f0000001000)="c0", 0x1}], 0x2, 0x0) vmsplice(r0, &(0x7f0000b1d000)=[{&(0x7f0000005fe3)}], 0x1, 0x0) 2018/02/20 00:06:40 executing program 7: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f00009d6000)={&(0x7f0000de2ff4)={0x10}, 0xc, &(0x7f0000778ff8)={&(0x7f0000f3d000)={0xfffffffffffffff0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, {}, []}, 0x14}, 0x1}, 0x0) 2018/02/20 00:06:40 executing program 3: r0 = syz_open_dev$tun(&(0x7f0000e9b18a)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000a5afd8)={@common='gre0\x00', @ifru_names=@generic="4f54000cc0a1ed4f3a0a1fdc222073b5"}) r1 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8916, &(0x7f00007ff000)={@common='gre0\x00', @ifru_addrs={0x2, 0xffffffffffffffff, @local={0xac, 0x14, 0xffffffffffffffff, 0xaa}}}) dup2(r1, r0) socket$inet(0x2, 0x0, 0x0) 2018/02/20 00:06:40 executing program 2: 2018/02/20 00:06:40 executing program 6: syz_open_dev$evdev(&(0x7f0000dfdfee)='/dev/input/event#\x00', 0x0, 0x0) readv(0xffffffffffffffff, &(0x7f0000019fe0)=[], 0x0) syz_open_dev$evdev(&(0x7f0000fe5fee)='/dev/input/event#\x00', 0x0, 0x6000) 2018/02/20 00:06:40 executing program 2: 2018/02/20 00:06:40 executing program 0: socketpair$unix(0x1, 0x2000000000000001, 0x0, &(0x7f000087fff8)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TIOCLINUX7(0xffffffffffffffff, 0x541c, &(0x7f0000000040)={0x7, 0xfffffffffffffffa}) dup3(r1, r0, 0x0) recvmmsg(r1, &(0x7f0000f40000)=[{{&(0x7f0000ee8000)=@nfc_llcp, 0x60, &(0x7f0000d6c000)=[{&(0x7f00004dbfde)=""/34}], 0x0, &(0x7f0000f40000)=""/7, 0x7}}], 0x638, 0x0, &(0x7f0000f40ff0)={0x77359400}) 2018/02/20 00:06:40 executing program 2: creat(&(0x7f000009aff8)='./file0\x00', 0x0) mount(&(0x7f0000434ff8)='./file0\x00', &(0x7f0000000000)='./file0\x00', &(0x7f0000f4c000)='jfs\x00', 0x1023402, 0x0) unlink(&(0x7f00003b3000)='./file0\x00') 2018/02/20 00:06:40 executing program 4: r0 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r0, &(0x7f00004e1000)={0xa, 0xffffffffffffffff, 0x0, @loopback={0x0, 0x1}}, 0x1c) 2018/02/20 00:06:40 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000009000)='/dev/snd/seq\x00', 0x0, 0x2) ppoll(&(0x7f0000000000)=[{r0}], 0x1, &(0x7f0000000040), &(0x7f0000000080), 0x8) 2018/02/20 00:06:40 executing program 4: 2018/02/20 00:06:40 executing program 4: 2018/02/20 00:06:40 executing program 0: 2018/02/20 00:06:40 executing program 0: 2018/02/20 00:06:40 executing program 4: 2018/02/20 00:06:40 executing program 5: pipe2(&(0x7f0000000ff8)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$DRM_IOCTL_RM_MAP(0xffffffffffffffff, 0x4028641b, &(0x7f0000b1d000)={&(0x7f0000a93000/0x3000)=nil, 0x20000002, 0x0, 0x0, &(0x7f0000b1c000/0x4000)=nil}) mprotect(&(0x7f0000b1d000/0x2000)=nil, 0x2000, 0x5) vmsplice(r0, &(0x7f0000000180)=[{&(0x7f0000000040)="575eea0ab345513d67c949093be1fbe95cde8746e94e5d7b063e692b2eac3383fd95d2aa35eb6fedf79296746ca0769f4c666a56ff867d28f951e76fb21aa2045267d17d2d38b25246f9d310fcace61d8cbfedfe2adf37c91e3d41d8e092d60e645c085f89ac8b2ebe782c1fc1901543ede7b865143d6be4565cdf49a0436dae79cc20a1b6ae70b9a7cdedd1d453e40e1640e7a9810b51423e13055bc0c90cafa220a0e28670b452d9028985869557e4a3ee22e7c6adfbc27bfb19e4b9ffd9639b5fbada4ce6a74450bd91b2a3b9dd7dcb42b209c88d58058a7beaa3aef45b82d8057424daffd50896", 0xe9}, {&(0x7f0000001000)="c0", 0x1}], 0x2, 0x0) vmsplice(r0, &(0x7f0000b1d000)=[{&(0x7f0000005fe3)}], 0x1, 0x0) [ 35.611316] audit: type=1400 audit(1519085200.135:8): avc: denied { write } for pid=5086 comm="syz-executor7" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_netfilter_socket permissive=1 2018/02/20 00:06:40 executing program 0: 2018/02/20 00:06:40 executing program 1: getitimer(0x0, &(0x7f0000000000)) 2018/02/20 00:06:40 executing program 4: 2018/02/20 00:06:40 executing program 5: pipe2(&(0x7f0000000ff8)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$DRM_IOCTL_RM_MAP(0xffffffffffffffff, 0x4028641b, &(0x7f0000b1d000)={&(0x7f0000a93000/0x3000)=nil, 0x20000002, 0x0, 0x0, &(0x7f0000b1c000/0x4000)=nil}) mprotect(&(0x7f0000b1d000/0x2000)=nil, 0x2000, 0x5) vmsplice(r0, &(0x7f0000b1d000)=[{&(0x7f0000005fe3)}], 0x1, 0x0) 2018/02/20 00:06:40 executing program 7: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000004ff8)={0x0, 0x0}) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x4d032, 0xffffffffffffffff, 0x0) sendmsg(r0, &(0x7f00009eefc8)={0x0, 0x0, &(0x7f000084a000)=[], 0x0, &(0x7f0000000000)=[{0xc}], 0xc}, 0x0) 2018/02/20 00:06:40 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_MRT6_DEL_MFC_PROXY(r0, 0x29, 0xd3, &(0x7f0000000000)={{0xa, 0xffffffffffffffff, 0x0, @ipv4={[], [0xff, 0xff], @rand_addr=0xfffffffffffffffb}}, {0xa, 0xffffffffffffffff, 0x0, @dev={0xfe, 0x80}}}, 0x5c) 2018/02/20 00:06:40 executing program 2: syz_emit_ethernet(0x3e, &(0x7f000036afbe)={@remote={[0xaa, 0xaa, 0xaa, 0xaa], 0xffffffffffffffff, 0xbb}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, '\x00', 0x8, 0x2c, 0x0, @ipv4={[], [0xff, 0xff], @dev={0xac, 0x14}}, @local={0xfe, 0x80, [], 0xffffffffffffffff, 0xaa}, {[], @udp={0xffffffffffffffff, 0xffffffffffffffff, 0x8}}}}}}, 0x0) 2018/02/20 00:06:40 executing program 6: syz_open_dev$evdev(&(0x7f0000dfdfee)='/dev/input/event#\x00', 0x0, 0x0) readv(0xffffffffffffffff, &(0x7f0000019fe0)=[], 0x0) syz_open_dev$evdev(&(0x7f0000fe5fee)='/dev/input/event#\x00', 0x0, 0x6000) 2018/02/20 00:06:40 executing program 3: r0 = syz_open_dev$tun(&(0x7f0000e9b18a)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000a5afd8)={@common='gre0\x00', @ifru_names=@generic="4f54000cc0a1ed4f3a0a1fdc222073b5"}) r1 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8916, &(0x7f00007ff000)={@common='gre0\x00', @ifru_addrs={0x2, 0xffffffffffffffff, @local={0xac, 0x14, 0xffffffffffffffff, 0xaa}}}) dup2(r1, r0) socket$inet(0x2, 0x0, 0x0) 2018/02/20 00:06:40 executing program 1: perf_event_open(&(0x7f0000940000)={0x2, 0x78, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_nanosleep(0x2, 0x0, &(0x7f0000051ff0)={0x0, 0x989680}, 0x0) seccomp(0x1, 0x0, &(0x7f0000044ff0)={0x1, &(0x7f0000c00ff8)=[{0x6}]}) perf_event_open(&(0x7f0000940000)={0x0, 0x78}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x4, 0x32, 0xffffffffffffffff, 0x0) futex(&(0x7f0000001ffc), 0x86, 0x0, &(0x7f0000001ff0)={0x1f}, &(0x7f0000239000), 0x0) 2018/02/20 00:06:40 executing program 0: r0 = socket$inet(0x2, 0x1, 0x0) r1 = dup(r0) setsockopt$inet_tcp_int(r1, 0x6, 0x11, &(0x7f00007b5ffc)=0x1, 0x4) bind$inet(r0, &(0x7f000012e000)={0x2, 0x3, @broadcast=0xffffffff}, 0x10) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000e9bff0)={0x1, &(0x7f0000be7000)=[{0x6, 0x0, 0x0, 0x101}]}, 0x8) connect$inet(r0, &(0x7f0000281ff0)={0x2, 0x3, @empty}, 0x10) sendto$inet(r1, &(0x7f00004eef09)="96427feebcc603c266d2a2c2da2644124066d6c52746a66fd07a4a9370b924b494651c3febca0be535e0f30bbafe65b8b859d66972208f558b002bbc2366429da28cdb97727474f32fcce772ce439a1b5785bb74b8680705191a3d28e775b402a04cdf7881cf1c80eb042835db0e8c24fd0e3c0f396da612f44d9999de32f883521dfa4593a5772e19b5c0c27ace555870d7fe3a1819c614a8d9447cfa592c236d96bf255bf3966b0c1c34711ce489df2032a31902ae0742b79d7334ef248790fa0e3787e4b945215cddc03c4f384e6815bab43d34b8c04eb06ff00f10743a0e25f6", 0xe2, 0x4001, &(0x7f0000848ff0)={0x2, 0xffffffffffffffff, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}}, 0x10) sendmsg$nl_crypto(r1, &(0x7f0000b5b000)={&(0x7f0000df6000)={0x10}, 0xc, &(0x7f0000fd2ff0)={&(0x7f00009eeef0)=@get={0xe0, 0x13, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, {{'rmd160-generic\x00'}}, []}, 0xe0}, 0x1}, 0x0) sendto$inet(r1, &(0x7f0000e65000)='V', 0x1, 0x0, 0x0, 0x0) sendto$packet(r1, &(0x7f0000d56000)="e6", 0x1, 0x0, &(0x7f000072afec)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote={[0xaa, 0xaa, 0xaa, 0xaa], 0xffffffffffffffff, 0xbb}}, 0x14) 2018/02/20 00:06:40 executing program 4: mount(&(0x7f000026fff8)='./file0\x00', &(0x7f00006fbff8)='./file0\x00', &(0x7f0000ac7ffa)='ncpfs\x00', 0x0, &(0x7f0000ea8f19)) 2018/02/20 00:06:40 executing program 7: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000004ff8)={0x0, 0x0}) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x4d032, 0xffffffffffffffff, 0x0) sendmsg(r0, &(0x7f00009eefc8)={0x0, 0x0, &(0x7f000084a000)=[], 0x0, &(0x7f0000000000)=[{0xc}], 0xc}, 0x0) 2018/02/20 00:06:40 executing program 5: pipe2(&(0x7f0000000ff8)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$DRM_IOCTL_RM_MAP(0xffffffffffffffff, 0x4028641b, &(0x7f0000b1d000)={&(0x7f0000a93000/0x3000)=nil, 0x20000002, 0x0, 0x0, &(0x7f0000b1c000/0x4000)=nil}) mprotect(&(0x7f0000b1d000/0x2000)=nil, 0x2000, 0x5) vmsplice(r0, &(0x7f0000b1d000)=[{&(0x7f0000005fe3)}], 0x1, 0x0) 2018/02/20 00:06:40 executing program 5: pipe2(&(0x7f0000000ff8)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$DRM_IOCTL_RM_MAP(0xffffffffffffffff, 0x4028641b, &(0x7f0000b1d000)={&(0x7f0000a93000/0x3000)=nil, 0x20000002, 0x0, 0x0, &(0x7f0000b1c000/0x4000)=nil}) mprotect(&(0x7f0000b1d000/0x2000)=nil, 0x2000, 0x5) vmsplice(r0, &(0x7f0000b1d000)=[{&(0x7f0000005fe3)}], 0x1, 0x0) 2018/02/20 00:06:40 executing program 4: 2018/02/20 00:06:40 executing program 0: 2018/02/20 00:06:40 executing program 7: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000004ff8)={0x0, 0x0}) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x4d032, 0xffffffffffffffff, 0x0) sendmsg(r0, &(0x7f00009eefc8)={0x0, 0x0, &(0x7f000084a000)=[], 0x0, &(0x7f0000000000)=[{0xc}], 0xc}, 0x0) 2018/02/20 00:06:40 executing program 5: pipe2(&(0x7f0000000ff8)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$DRM_IOCTL_RM_MAP(0xffffffffffffffff, 0x4028641b, &(0x7f0000b1d000)={&(0x7f0000a93000/0x3000)=nil, 0x20000002, 0x0, 0x0, &(0x7f0000b1c000/0x4000)=nil}) vmsplice(r0, &(0x7f0000000180)=[{&(0x7f0000000040)="575eea0ab345513d67c949093be1fbe95cde8746e94e5d7b063e692b2eac3383fd95d2aa35eb6fedf79296746ca0769f4c666a56ff867d28f951e76fb21aa2045267d17d2d38b25246f9d310fcace61d8cbfedfe2adf37c91e3d41d8e092d60e645c085f89ac8b2ebe782c1fc1901543ede7b865143d6be4565cdf49a0436dae79cc20a1b6ae70b9a7cdedd1d453e40e1640e7a9810b51423e13055bc0c90cafa220a0e28670b452d9028985869557e4a3ee22e7c6adfbc27bfb19e4b9ffd9639b5fbada4ce6a74450bd91b2a3b9dd7dcb42b209c88d58058a7beaa3aef45b82d8057424daffd50896", 0xe9}, {&(0x7f0000001000)="c0", 0x1}], 0x2, 0x0) vmsplice(r0, &(0x7f0000b1d000)=[{&(0x7f0000005fe3)}], 0x1, 0x0) 2018/02/20 00:06:40 executing program 4: 2018/02/20 00:06:40 executing program 7: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000004ff8)={0x0, 0x0}) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x4d032, 0xffffffffffffffff, 0x0) sendmsg(r0, &(0x7f00009eefc8)={0x0, 0x0, &(0x7f000084a000)=[], 0x0, &(0x7f0000000000)=[{0xc}], 0xc}, 0x0) 2018/02/20 00:06:40 executing program 2: 2018/02/20 00:06:40 executing program 0: [ 35.768662] audit: type=1326 audit(1519085200.285:9): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 pid=5127 comm="syz-executor1" exe="/root/syz-executor1" sig=31 arch=c000003e syscall=202 compat=0 ip=0x453da9 code=0x0 [ 35.825380] audit: type=1326 audit(1519085200.345:10): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 pid=5127 comm="syz-executor1" exe="/root/syz-executor1" sig=31 arch=c000003e syscall=202 compat=0 ip=0x453da9 code=0x0 2018/02/20 00:06:40 executing program 1: nanosleep(&(0x7f0000d1e000)={0x0, 0x1c9c380}, &(0x7f00005bfff0)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) prctl$intptr(0x29, 0x0) openat$hwrng(0xffffffffffffff9c, &(0x7f0000c3dff5)='/dev/hwrng\x00', 0x0, 0x0) 2018/02/20 00:06:40 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) setsockopt$inet_tcp_int(r0, 0x6, 0x2000000000000014, &(0x7f0000b20000)=0x100000001, 0x331) bind$inet(r0, &(0x7f0000738ff0)={0x2, 0x1, @multicast1=0xe0000001}, 0x10) sendto$inet(r0, &(0x7f0000852000), 0x0, 0x20020003, &(0x7f0000385ff0)={0x2, 0x1, @loopback=0x7f000001}, 0x10) sendmsg(r0, &(0x7f00005c4000)={&(0x7f00006f7ff8)=@sco={0x1f}, 0x8, &(0x7f0000287ff0)=[{&(0x7f0000b82f6c)='A', 0x1}], 0x1, &(0x7f00001cd000)=[]}, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x14, &(0x7f0000f43ffc)=0xfffffffffffffffc, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000f8e000)={0x0, 0x20000000012c6, 0x1000010004}, 0x14) sendto$inet(r0, &(0x7f000089f000)='Q', 0x1, 0x40001, &(0x7f0000278ff0)={0x2, 0xffffffffffffffff, @local={0xac, 0x14, 0xffffffffffffffff, 0xaa}}, 0x10) 2018/02/20 00:06:40 executing program 6: syz_open_dev$evdev(&(0x7f0000dfdfee)='/dev/input/event#\x00', 0x0, 0x0) syz_open_dev$evdev(&(0x7f0000fe5fee)='/dev/input/event#\x00', 0x0, 0x6000) 2018/02/20 00:06:40 executing program 4: 2018/02/20 00:06:40 executing program 7: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000004ff8)={0x0, 0x0}) sendmsg(r0, &(0x7f00009eefc8)={0x0, 0x0, &(0x7f000084a000)=[], 0x0, &(0x7f0000000000)=[{0xc}], 0xc}, 0x0) 2018/02/20 00:06:40 executing program 0: 2018/02/20 00:06:40 executing program 5: pipe2(&(0x7f0000000ff8)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$DRM_IOCTL_RM_MAP(0xffffffffffffffff, 0x4028641b, &(0x7f0000b1d000)={&(0x7f0000a93000/0x3000)=nil, 0x20000002, 0x0, 0x0, &(0x7f0000b1c000/0x4000)=nil}) vmsplice(r0, &(0x7f0000000180)=[{&(0x7f0000000040)="575eea0ab345513d67c949093be1fbe95cde8746e94e5d7b063e692b2eac3383fd95d2aa35eb6fedf79296746ca0769f4c666a56ff867d28f951e76fb21aa2045267d17d2d38b25246f9d310fcace61d8cbfedfe2adf37c91e3d41d8e092d60e645c085f89ac8b2ebe782c1fc1901543ede7b865143d6be4565cdf49a0436dae79cc20a1b6ae70b9a7cdedd1d453e40e1640e7a9810b51423e13055bc0c90cafa220a0e28670b452d9028985869557e4a3ee22e7c6adfbc27bfb19e4b9ffd9639b5fbada4ce6a74450bd91b2a3b9dd7dcb42b209c88d58058a7beaa3aef45b82d8057424daffd50896", 0xe9}, {&(0x7f0000001000)="c0", 0x1}], 0x2, 0x0) vmsplice(r0, &(0x7f0000b1d000)=[{&(0x7f0000005fe3)}], 0x1, 0x0) 2018/02/20 00:06:40 executing program 2: r0 = socket$inet(0xf, 0x3, 0x2) sendmsg(r0, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000001ff0)=[{&(0x7f0000007ff0)="021000090200000000ef37ca22768596", 0x10}], 0x1}, 0x0) 2018/02/20 00:06:40 executing program 4: getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000002000)={0x0, 0x0}, &(0x7f0000000ffc)=0xc) stat(&(0x7f0000001ff8)='./file0\x00', &(0x7f0000002000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) keyctl$chown(0x4, 0x0, r0, r1) 2018/02/20 00:06:40 executing program 0: openat$autofs(0xffffffffffffff9c, &(0x7f0000112000)='/dev/autofs\x00', 0x2a000, 0x0) 2018/02/20 00:06:40 executing program 5: pipe2(&(0x7f0000000ff8)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$DRM_IOCTL_RM_MAP(0xffffffffffffffff, 0x4028641b, &(0x7f0000b1d000)={&(0x7f0000a93000/0x3000)=nil, 0x20000002, 0x0, 0x0, &(0x7f0000b1c000/0x4000)=nil}) vmsplice(r0, &(0x7f0000000180)=[{&(0x7f0000000040)="575eea0ab345513d67c949093be1fbe95cde8746e94e5d7b063e692b2eac3383fd95d2aa35eb6fedf79296746ca0769f4c666a56ff867d28f951e76fb21aa2045267d17d2d38b25246f9d310fcace61d8cbfedfe2adf37c91e3d41d8e092d60e645c085f89ac8b2ebe782c1fc1901543ede7b865143d6be4565cdf49a0436dae79cc20a1b6ae70b9a7cdedd1d453e40e1640e7a9810b51423e13055bc0c90cafa220a0e28670b452d9028985869557e4a3ee22e7c6adfbc27bfb19e4b9ffd9639b5fbada4ce6a74450bd91b2a3b9dd7dcb42b209c88d58058a7beaa3aef45b82d8057424daffd50896", 0xe9}, {&(0x7f0000001000)="c0", 0x1}], 0x2, 0x0) vmsplice(r0, &(0x7f0000b1d000)=[{&(0x7f0000005fe3)}], 0x1, 0x0) 2018/02/20 00:06:40 executing program 7: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000004ff8)={0x0, 0x0}) sendmsg(r0, &(0x7f00009eefc8)={0x0, 0x0, &(0x7f000084a000)=[], 0x0, &(0x7f0000000000)=[{0xc}], 0xc}, 0x0) 2018/02/20 00:06:40 executing program 7: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000004ff8)={0x0, 0x0}) sendmsg(r0, &(0x7f00009eefc8)={0x0, 0x0, &(0x7f000084a000)=[], 0x0, &(0x7f0000000000)=[{0xc}], 0xc}, 0x0) 2018/02/20 00:06:40 executing program 0: r0 = socket(0x800000000000000a, 0x1, 0x0) ioctl$sock_ifreq(r0, 0x89b0, &(0x7f0000863fb0)={@syzn={0x73, 0x79, 0x7a, 0x0}, @ifru_data=&(0x7f0000246fe0)="008000000000006a01000007000500ff00000004000000004200e7003072a901"}) 2018/02/20 00:06:40 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f00003c2ff8)=[{&(0x7f000095efd7)="2900000020001900013d00101b0000f60200001615de0005000000040d000a00051700000000000008", 0x29}], 0x1) 2018/02/20 00:06:40 executing program 3: r0 = socket$unix(0x1, 0x3, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000bcd000)='net/softnet_stat\x00') sendfile(r0, r1, &(0x7f00008eb000), 0xfa80) 2018/02/20 00:06:40 executing program 1: nanosleep(&(0x7f0000d1e000)={0x0, 0x1c9c380}, &(0x7f00005bfff0)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) prctl$intptr(0x29, 0x0) openat$hwrng(0xffffffffffffff9c, &(0x7f0000c3dff5)='/dev/hwrng\x00', 0x0, 0x0) 2018/02/20 00:06:40 executing program 7: mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x4d032, 0xffffffffffffffff, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00009eefc8)={0x0, 0x0, &(0x7f000084a000)=[], 0x0, &(0x7f0000000000)=[{0xc}], 0xc}, 0x0) 2018/02/20 00:06:40 executing program 6: syz_open_dev$evdev(&(0x7f0000dfdfee)='/dev/input/event#\x00', 0x0, 0x0) syz_open_dev$evdev(&(0x7f0000fe5fee)='/dev/input/event#\x00', 0x0, 0x6000) 2018/02/20 00:06:40 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_ifreq(r0, 0x8990, &(0x7f0000ea6000)={@common='tunl0\x00', @ifru_map={0xffffffff00000001}}) 2018/02/20 00:06:40 executing program 7: mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x4d032, 0xffffffffffffffff, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00009eefc8)={0x0, 0x0, &(0x7f000084a000)=[], 0x0, &(0x7f0000000000)=[{0xc}], 0xc}, 0x0) 2018/02/20 00:06:40 executing program 5: pipe2(&(0x7f0000000ff8)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) mprotect(&(0x7f0000b1d000/0x2000)=nil, 0x2000, 0x5) vmsplice(r0, &(0x7f0000000180)=[{&(0x7f0000000040)="575eea0ab345513d67c949093be1fbe95cde8746e94e5d7b063e692b2eac3383fd95d2aa35eb6fedf79296746ca0769f4c666a56ff867d28f951e76fb21aa2045267d17d2d38b25246f9d310fcace61d8cbfedfe2adf37c91e3d41d8e092d60e645c085f89ac8b2ebe782c1fc1901543ede7b865143d6be4565cdf49a0436dae79cc20a1b6ae70b9a7cdedd1d453e40e1640e7a9810b51423e13055bc0c90cafa220a0e28670b452d9028985869557e4a3ee22e7c6adfbc27bfb19e4b9ffd9639b5fbada4ce6a74450bd91b2a3b9dd7dcb42b209c88d58058a7beaa3aef45b82d8057424daffd50896", 0xe9}, {&(0x7f0000001000)="c0", 0x1}], 0x2, 0x0) vmsplice(r0, &(0x7f0000b1d000)=[{&(0x7f0000005fe3)}], 0x1, 0x0) 2018/02/20 00:06:40 executing program 0: r0 = syz_open_dev$tun(&(0x7f0000e2f000)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00004c8fd8)={@generic="30609402000000000000067d08cebd5c", @ifru_names=@generic="8e11f1052996e56f7ff6b6d55cee091d"}) r1 = syz_open_dev$tun(&(0x7f0000124ff3)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000198000)={@generic="30609402000000000000067d08cebd5c", @ifru_names=@generic="8e11f1052996e56f5ff6b6d564ee091d"}) dup3(r1, r0, 0x0) 2018/02/20 00:06:40 executing program 4: r0 = socket(0x10, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000f62000)={@syzn={0x73, 0x79, 0x7a, 0x0}, 0x0}) sendmsg$nl_route(r0, &(0x7f0000504000)={&(0x7f0000ba2ff4)={0x10}, 0xc, &(0x7f0000434ff0)={&(0x7f0000ff8000)=@newlink={0x28, 0x10, 0x9, 0xffffffffffffffff, 0xffffffffffffffff, {0x0, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x1a, [{}]}]}, 0x28}, 0x1}, 0x0) 2018/02/20 00:06:40 executing program 3: socketpair$unix(0x1, 0x8000000003, 0x0, &(0x7f0000d12000)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x8) r2 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r1, &(0x7f0000b82000)={0x10000004}) sendmmsg$unix(r1, &(0x7f00000bd000)=[], 0x80, 0x0) epoll_wait(r2, &(0x7f0000a66000)=[{}], 0x1, 0x0) recvmmsg(r0, &(0x7f000030efc4)=[{{&(0x7f00009ef000)=@hci, 0x6, &(0x7f0000b60000)=[], 0x0, &(0x7f00004f9000)}}], 0x1, 0x0, 0x0) 2018/02/20 00:06:40 executing program 2: r0 = syz_open_dev$sndtimer(&(0x7f0000d3fff1)='/dev/snd/timer\x00', 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_SELECT(r0, 0x40345410, &(0x7f0000326000)={{0x0, 0x2}}) ioctl$SNDRV_TIMER_IOCTL_INFO(r0, 0x80e05411, &(0x7f0000a55f5a)=""/166) 2018/02/20 00:06:40 executing program 5: pipe2(&(0x7f0000000ff8)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) mprotect(&(0x7f0000b1d000/0x2000)=nil, 0x2000, 0x5) vmsplice(r0, &(0x7f0000000180)=[{&(0x7f0000000040)="575eea0ab345513d67c949093be1fbe95cde8746e94e5d7b063e692b2eac3383fd95d2aa35eb6fedf79296746ca0769f4c666a56ff867d28f951e76fb21aa2045267d17d2d38b25246f9d310fcace61d8cbfedfe2adf37c91e3d41d8e092d60e645c085f89ac8b2ebe782c1fc1901543ede7b865143d6be4565cdf49a0436dae79cc20a1b6ae70b9a7cdedd1d453e40e1640e7a9810b51423e13055bc0c90cafa220a0e28670b452d9028985869557e4a3ee22e7c6adfbc27bfb19e4b9ffd9639b5fbada4ce6a74450bd91b2a3b9dd7dcb42b209c88d58058a7beaa3aef45b82d8057424daffd50896", 0xe9}, {&(0x7f0000001000)="c0", 0x1}], 0x2, 0x0) vmsplice(r0, &(0x7f0000b1d000)=[{&(0x7f0000005fe3)}], 0x1, 0x0) 2018/02/20 00:06:40 executing program 4: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f00003d1fe4)={0xa, 0xffffffffffffffff, 0x0, @mcast1={0xff, 0x1, [], 0x1}, 0x2}, 0x1c) getsockopt$inet6_buf(r0, 0x29, 0x3d, &(0x7f0000c88000)=""/192, &(0x7f0000e0bffc)=0xfffffffffffffeae) 2018/02/20 00:06:40 executing program 7: mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x4d032, 0xffffffffffffffff, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00009eefc8)={0x0, 0x0, &(0x7f000084a000)=[], 0x0, &(0x7f0000000000)=[{0xc}], 0xc}, 0x0) 2018/02/20 00:06:40 executing program 5: pipe2(&(0x7f0000000ff8)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) mprotect(&(0x7f0000b1d000/0x2000)=nil, 0x2000, 0x5) vmsplice(r0, &(0x7f0000000180)=[{&(0x7f0000000040)="575eea0ab345513d67c949093be1fbe95cde8746e94e5d7b063e692b2eac3383fd95d2aa35eb6fedf79296746ca0769f4c666a56ff867d28f951e76fb21aa2045267d17d2d38b25246f9d310fcace61d8cbfedfe2adf37c91e3d41d8e092d60e645c085f89ac8b2ebe782c1fc1901543ede7b865143d6be4565cdf49a0436dae79cc20a1b6ae70b9a7cdedd1d453e40e1640e7a9810b51423e13055bc0c90cafa220a0e28670b452d9028985869557e4a3ee22e7c6adfbc27bfb19e4b9ffd9639b5fbada4ce6a74450bd91b2a3b9dd7dcb42b209c88d58058a7beaa3aef45b82d8057424daffd50896", 0xe9}, {&(0x7f0000001000)="c0", 0x1}], 0x2, 0x0) vmsplice(r0, &(0x7f0000b1d000)=[{&(0x7f0000005fe3)}], 0x1, 0x0) 2018/02/20 00:06:40 executing program 2: r0 = socket$inet(0x2, 0x1, 0x0) r1 = dup(r0) ioctl$sock_inet_SIOCSIFDSTADDR(r1, 0x8918, &(0x7f00007ef000)={@common='lo\x00', @ifru_addrs={0x2, 0xffffffffffffffff, @loopback=0x7f000001}}) 2018/02/20 00:06:40 executing program 7: socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000004ff8)={0x0, 0x0}) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x4d032, 0xffffffffffffffff, 0x0) sendmsg(r0, &(0x7f00009eefc8)={0x0, 0x0, &(0x7f000084a000)=[], 0x0, &(0x7f0000000000)=[{0xc}], 0xc}, 0x0) 2018/02/20 00:06:40 executing program 1: request_key(&(0x7f0000819ff6)='blacklist\x00', &(0x7f0000e6cffb)={0x73, 0x79, 0x7a}, &(0x7f00008cf000)='posix_acl_access\x00', 0xfffffffffffffffa) 2018/02/20 00:06:40 executing program 4: r0 = syz_open_procfs(0x0, &(0x7f00006f3ffd)='ns\x00') getdents(r0, &(0x7f00000b2000)=""/4096, 0x1000) getdents64(r0, &(0x7f0000a1bfda)=""/38, 0x26) 2018/02/20 00:06:40 executing program 6: syz_open_dev$evdev(&(0x7f0000dfdfee)='/dev/input/event#\x00', 0x0, 0x0) syz_open_dev$evdev(&(0x7f0000fe5fee)='/dev/input/event#\x00', 0x0, 0x6000) 2018/02/20 00:06:40 executing program 5: ioctl$DRM_IOCTL_RM_MAP(0xffffffffffffffff, 0x4028641b, &(0x7f0000b1d000)={&(0x7f0000a93000/0x3000)=nil, 0x20000002, 0x0, 0x0, &(0x7f0000b1c000/0x4000)=nil}) mprotect(&(0x7f0000b1d000/0x2000)=nil, 0x2000, 0x5) vmsplice(0xffffffffffffffff, &(0x7f0000000180)=[{&(0x7f0000000040)="575eea0ab345513d67c949093be1fbe95cde8746e94e5d7b063e692b2eac3383fd95d2aa35eb6fedf79296746ca0769f4c666a56ff867d28f951e76fb21aa2045267d17d2d38b25246f9d310fcace61d8cbfedfe2adf37c91e3d41d8e092d60e645c085f89ac8b2ebe782c1fc1901543ede7b865143d6be4565cdf49a0436dae79cc20a1b6ae70b9a7cdedd1d453e40e1640e7a9810b51423e13055bc0c90cafa220a0e28670b452d9028985869557e4a3ee22e7c6adfbc27bfb19e4b9ffd9639b5fbada4ce6a74450bd91b2a3b9dd7dcb42b209c88d58058a7beaa3aef45b82d8057424daffd50896", 0xe9}, {&(0x7f0000001000)="c0", 0x1}], 0x2, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000b1d000)=[{&(0x7f0000005fe3)}], 0x1, 0x0) 2018/02/20 00:06:40 executing program 7: socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000004ff8)={0x0, 0x0}) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x4d032, 0xffffffffffffffff, 0x0) sendmsg(r0, &(0x7f00009eefc8)={0x0, 0x0, &(0x7f000084a000)=[], 0x0, &(0x7f0000000000)=[{0xc}], 0xc}, 0x0) 2018/02/20 00:06:40 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000265fd8)={@syzn={0x73, 0x79, 0x7a, 0x0}, &(0x7f000086a000)=@ethtool_cmd={0x16}}) 2018/02/20 00:06:40 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f000048cfd8)={@common='lo\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000873000)={&(0x7f000094f000)={0x10}, 0xc, &(0x7f0000452000)={&(0x7f0000434000)=@ipv6_newaddr={0x40, 0x14, 0x101, 0xffffffffffffffff, 0xffffffffffffffff, {0xa, 0x0, 0x0, 0x0, r1}, [@IFA_LOCAL={0x14, 0x2, @loopback={0x0, 0x1}}, @IFA_CACHEINFO={0x14, 0x6, {0x3, 0x4}}]}, 0x40}, 0x1}, 0x0) 2018/02/20 00:06:40 executing program 4: socketpair$unix(0x1, 0x1, 0x0, &(0x7f00006db000)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setstatus(r1, 0x4, 0x200000000003ffe) shutdown(r0, 0x1000000000000002) 2018/02/20 00:06:40 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$sock_SIOCETHTOOL(r1, 0x8946, &(0x7f000083afd8)={@syzn={0x73, 0x79, 0x7a, 0x0}, &(0x7f000071af30)=@ethtool_rxnfc={0x32, 0x0, 0x0, {0x0, @usr_ip4_spec={@broadcast=0xffffffff, @multicast2=0xe0000002, 0x0, 0x0, 0x1}, {'\b%', @empty}, @udp_ip4_spec={@multicast2=0xe0000002, @broadcast=0xffffffff}, {"f9e7", @local={[0xaa, 0xaa, 0xaa, 0xaa], 0xffffffffffffffff, 0xaa}}}, 0x0, []}}) 2018/02/20 00:06:40 executing program 0: r0 = syz_open_dev$tun(&(0x7f0000e2f000)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00004c8fd8)={@generic="30609402000000000000067d08cebd5c", @ifru_names=@generic="8e11f1052996e56f7ff6b6d55cee091d"}) r1 = syz_open_dev$tun(&(0x7f0000124ff3)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000198000)={@generic="30609402000000000000067d08cebd5c", @ifru_names=@generic="8e11f1052996e56f5ff6b6d564ee091d"}) dup3(r1, r0, 0x0) 2018/02/20 00:06:40 executing program 2: r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000d34ff0)='/dev/sequencer2\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(r0, 0x40085112, &(0x7f0000feafb0)={{0xffffff92}}) 2018/02/20 00:06:40 executing program 3: r0 = openat$autofs(0xffffffffffffff9c, &(0x7f00003f4fff)='/dev/autofs\x00', 0xc03, 0x0) flock(r0, 0x0) 2018/02/20 00:06:40 executing program 4: r0 = signalfd(0xffffffffffffffff, &(0x7f00007aeff8), 0x8) mkdir(&(0x7f0000508ff6)='./control\x00', 0x0) read(r0, &(0x7f0000e6d000)=""/384, 0x180) r1 = inotify_init1(0x0) dup2(r1, r0) fcntl$setstatus(r1, 0x4, 0x72109c5fef5d34d3) r2 = gettid() fcntl$setown(r1, 0x8, r2) rt_sigprocmask(0x0, &(0x7f000003b000)={0xbffffffffffffffe}, 0x0, 0x8) fcntl$setsig(r1, 0xa, 0x20) inotify_add_watch(r1, &(0x7f00007a7000)='./control\x00', 0xa4000960) open(&(0x7f000003d000)='./control\x00', 0x0, 0x0) 2018/02/20 00:06:40 executing program 5: ioctl$DRM_IOCTL_RM_MAP(0xffffffffffffffff, 0x4028641b, &(0x7f0000b1d000)={&(0x7f0000a93000/0x3000)=nil, 0x20000002, 0x0, 0x0, &(0x7f0000b1c000/0x4000)=nil}) mprotect(&(0x7f0000b1d000/0x2000)=nil, 0x2000, 0x5) vmsplice(0xffffffffffffffff, &(0x7f0000000180)=[{&(0x7f0000000040)="575eea0ab345513d67c949093be1fbe95cde8746e94e5d7b063e692b2eac3383fd95d2aa35eb6fedf79296746ca0769f4c666a56ff867d28f951e76fb21aa2045267d17d2d38b25246f9d310fcace61d8cbfedfe2adf37c91e3d41d8e092d60e645c085f89ac8b2ebe782c1fc1901543ede7b865143d6be4565cdf49a0436dae79cc20a1b6ae70b9a7cdedd1d453e40e1640e7a9810b51423e13055bc0c90cafa220a0e28670b452d9028985869557e4a3ee22e7c6adfbc27bfb19e4b9ffd9639b5fbada4ce6a74450bd91b2a3b9dd7dcb42b209c88d58058a7beaa3aef45b82d8057424daffd50896", 0xe9}, {&(0x7f0000001000)="c0", 0x1}], 0x2, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000b1d000)=[{&(0x7f0000005fe3)}], 0x1, 0x0) 2018/02/20 00:06:40 executing program 7: socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000004ff8)={0x0, 0x0}) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x4d032, 0xffffffffffffffff, 0x0) sendmsg(r0, &(0x7f00009eefc8)={0x0, 0x0, &(0x7f000084a000)=[], 0x0, &(0x7f0000000000)=[{0xc}], 0xc}, 0x0) 2018/02/20 00:06:40 executing program 3: r0 = syz_open_dev$evdev(&(0x7f0000072fee)='/dev/input/event#\x00', 0x0, 0x800000002) read(r0, &(0x7f00001f9fe8)=""/24, 0x18) write$evdev(r0, &(0x7f0000057fa0)=[{{}, 0x0, 0x100000001}, {}], 0x30) 2018/02/20 00:06:40 executing program 2: r0 = socket(0x10, 0x802, 0x0) write(r0, &(0x7f00008f0000)="240000001a0025f00000000401111f0e0a0b00000004bf00000009ec0800030005000000", 0x24) 2018/02/20 00:06:40 executing program 5: ioctl$DRM_IOCTL_RM_MAP(0xffffffffffffffff, 0x4028641b, &(0x7f0000b1d000)={&(0x7f0000a93000/0x3000)=nil, 0x20000002, 0x0, 0x0, &(0x7f0000b1c000/0x4000)=nil}) mprotect(&(0x7f0000b1d000/0x2000)=nil, 0x2000, 0x5) vmsplice(0xffffffffffffffff, &(0x7f0000000180)=[{&(0x7f0000000040)="575eea0ab345513d67c949093be1fbe95cde8746e94e5d7b063e692b2eac3383fd95d2aa35eb6fedf79296746ca0769f4c666a56ff867d28f951e76fb21aa2045267d17d2d38b25246f9d310fcace61d8cbfedfe2adf37c91e3d41d8e092d60e645c085f89ac8b2ebe782c1fc1901543ede7b865143d6be4565cdf49a0436dae79cc20a1b6ae70b9a7cdedd1d453e40e1640e7a9810b51423e13055bc0c90cafa220a0e28670b452d9028985869557e4a3ee22e7c6adfbc27bfb19e4b9ffd9639b5fbada4ce6a74450bd91b2a3b9dd7dcb42b209c88d58058a7beaa3aef45b82d8057424daffd50896", 0xe9}, {&(0x7f0000001000)="c0", 0x1}], 0x2, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000b1d000)=[{&(0x7f0000005fe3)}], 0x1, 0x0) 2018/02/20 00:06:41 executing program 6: syz_open_dev$evdev(&(0x7f0000fe5fee)='/dev/input/event#\x00', 0x0, 0x6000) 2018/02/20 00:06:41 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000001000)={0xffffffffffffffff, 0xffffffffffffffff}) poll(&(0x7f0000b1dff8)=[{r0}], 0x1, 0xfffffdfffffff370) writev(r0, &(0x7f0000002f70)=[{&(0x7f0000002000)='u', 0x1}], 0x1) connect$unix(r1, &(0x7f0000002000)=@abs, 0x8) 2018/02/20 00:06:41 executing program 4: r0 = syz_open_procfs(0x0, &(0x7f0000027fea)='net/igmp\x00') ioctl$int_out(r0, 0x5460, &(0x7f00000d8000)) 2018/02/20 00:06:41 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000f53000)='net/snmp\x00') pread64(r0, &(0x7f00001f8000)=""/129, 0x81, 0x0) 2018/02/20 00:06:41 executing program 7: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000004ff8)={0x0, 0x0}) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg(r0, &(0x7f00009eefc8)={0x0, 0x0, &(0x7f000084a000)=[], 0x0, &(0x7f0000000000)=[{0xc}], 0xc}, 0x0) 2018/02/20 00:06:41 executing program 2: syz_open_dev$random(&(0x7f0000009000)='/dev/random\x00', 0x0, 0x0) syz_open_dev$sg(&(0x7f00000b9ff7)='/dev/sg#\x00', 0x0, 0x204800) epoll_create1(0x0) pselect6(0x40, &(0x7f0000f33fc0)={0x3ffffd}, &(0x7f0000768000), &(0x7f0000086000), &(0x7f0000349000), &(0x7f0000f14000)={&(0x7f0000a65ff8), 0x8}) 2018/02/20 00:06:41 executing program 5: pipe2(&(0x7f0000000ff8)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$DRM_IOCTL_RM_MAP(0xffffffffffffffff, 0x4028641b, &(0x7f0000b1d000)={&(0x7f0000a93000/0x3000)=nil, 0x0, 0x0, 0x0, &(0x7f0000b1c000/0x4000)=nil}) mprotect(&(0x7f0000b1d000/0x2000)=nil, 0x2000, 0x5) vmsplice(r0, &(0x7f0000000180)=[{&(0x7f0000000040)="575eea0ab345513d67c949093be1fbe95cde8746e94e5d7b063e692b2eac3383fd95d2aa35eb6fedf79296746ca0769f4c666a56ff867d28f951e76fb21aa2045267d17d2d38b25246f9d310fcace61d8cbfedfe2adf37c91e3d41d8e092d60e645c085f89ac8b2ebe782c1fc1901543ede7b865143d6be4565cdf49a0436dae79cc20a1b6ae70b9a7cdedd1d453e40e1640e7a9810b51423e13055bc0c90cafa220a0e28670b452d9028985869557e4a3ee22e7c6adfbc27bfb19e4b9ffd9639b5fbada4ce6a74450bd91b2a3b9dd7dcb42b209c88d58058a7beaa3aef45b82d8057424daffd50896", 0xe9}, {&(0x7f0000001000)="c0", 0x1}], 0x2, 0x0) vmsplice(r0, &(0x7f0000b1d000)=[{&(0x7f0000005fe3)}], 0x1, 0x0) 2018/02/20 00:06:41 executing program 1: r0 = socket$packet(0x11, 0x2, 0x300) setsockopt$sock_int(r0, 0x1, 0x29, &(0x7f0000027ffc)=0x81, 0x4) 2018/02/20 00:06:41 executing program 3: r0 = socket(0x10, 0x2, 0x0) write(r0, &(0x7f0000dd2f63)="240000002400ffdd3200000800367700fbffffff0100000000008c00ffffffff0100ff10", 0x24) 2018/02/20 00:06:41 executing program 7: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000004ff8)={0x0, 0x0}) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg(r0, &(0x7f00009eefc8)={0x0, 0x0, &(0x7f000084a000)=[], 0x0, &(0x7f0000000000)=[{0xc}], 0xc}, 0x0) 2018/02/20 00:06:41 executing program 5: pipe2(&(0x7f0000000ff8)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$DRM_IOCTL_RM_MAP(0xffffffffffffffff, 0x4028641b, &(0x7f0000b1d000)={&(0x7f0000a93000/0x3000)=nil, 0x0, 0x0, 0x0, &(0x7f0000b1c000/0x4000)=nil}) mprotect(&(0x7f0000b1d000/0x2000)=nil, 0x2000, 0x5) vmsplice(r0, &(0x7f0000000180)=[{&(0x7f0000000040)="575eea0ab345513d67c949093be1fbe95cde8746e94e5d7b063e692b2eac3383fd95d2aa35eb6fedf79296746ca0769f4c666a56ff867d28f951e76fb21aa2045267d17d2d38b25246f9d310fcace61d8cbfedfe2adf37c91e3d41d8e092d60e645c085f89ac8b2ebe782c1fc1901543ede7b865143d6be4565cdf49a0436dae79cc20a1b6ae70b9a7cdedd1d453e40e1640e7a9810b51423e13055bc0c90cafa220a0e28670b452d9028985869557e4a3ee22e7c6adfbc27bfb19e4b9ffd9639b5fbada4ce6a74450bd91b2a3b9dd7dcb42b209c88d58058a7beaa3aef45b82d8057424daffd50896", 0xe9}, {&(0x7f0000001000)="c0", 0x1}], 0x2, 0x0) vmsplice(r0, &(0x7f0000b1d000)=[{&(0x7f0000005fe3)}], 0x1, 0x0) 2018/02/20 00:06:41 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = socket$inet(0x2, 0x1, 0x0) r2 = syz_open_dev$tun(&(0x7f0000481000)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000927fd8)={@common='gre0\x00', @ifru_mtu=0xef3a}) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f000062ffe0)={@common='gre0\x00\x00\x00\x00\x00\x00\b\x00', @ifru_flags=0x2fd}) ioctl$TUNSETTXFILTER(r2, 0x400454d1, &(0x7f000033e000)={0x0, 0x2, [@local={[0xaa, 0xaa, 0xaa, 0xaa], 0xffffffffffffffff, 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff]]}) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000970ff0)=@common='gre0\x00', 0x10) sendto$inet(r0, &(0x7f00009e9000), 0x0, 0x20000040, &(0x7f0000d17000)={0x2, 0xffffffffffffffff, @loopback=0x7f000001}, 0x10) 2018/02/20 00:06:41 executing program 4: r0 = request_key(&(0x7f0000000000)='keyring\x00', &(0x7f0000005000)={0x73, 0x79, 0x7a}, &(0x7f0000005fe7)='/selinux/avc/cache_stats\x00', 0xfffffffffffffffd) keyctl$link(0x8, 0x0, r0) clone(0x0, &(0x7f0000fbf000), &(0x7f0000744000), &(0x7f0000f8b000), &(0x7f0000804000)) 2018/02/20 00:06:41 executing program 5: pipe2(&(0x7f0000000ff8)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$DRM_IOCTL_RM_MAP(0xffffffffffffffff, 0x4028641b, &(0x7f0000b1d000)={&(0x7f0000a93000/0x3000)=nil, 0x0, 0x0, 0x0, &(0x7f0000b1c000/0x4000)=nil}) mprotect(&(0x7f0000b1d000/0x2000)=nil, 0x2000, 0x5) vmsplice(r0, &(0x7f0000000180)=[{&(0x7f0000000040)="575eea0ab345513d67c949093be1fbe95cde8746e94e5d7b063e692b2eac3383fd95d2aa35eb6fedf79296746ca0769f4c666a56ff867d28f951e76fb21aa2045267d17d2d38b25246f9d310fcace61d8cbfedfe2adf37c91e3d41d8e092d60e645c085f89ac8b2ebe782c1fc1901543ede7b865143d6be4565cdf49a0436dae79cc20a1b6ae70b9a7cdedd1d453e40e1640e7a9810b51423e13055bc0c90cafa220a0e28670b452d9028985869557e4a3ee22e7c6adfbc27bfb19e4b9ffd9639b5fbada4ce6a74450bd91b2a3b9dd7dcb42b209c88d58058a7beaa3aef45b82d8057424daffd50896", 0xe9}, {&(0x7f0000001000)="c0", 0x1}], 0x2, 0x0) vmsplice(r0, &(0x7f0000b1d000)=[{&(0x7f0000005fe3)}], 0x1, 0x0) 2018/02/20 00:06:41 executing program 2: syz_open_dev$random(&(0x7f0000009000)='/dev/random\x00', 0x0, 0x0) syz_open_dev$sg(&(0x7f00000b9ff7)='/dev/sg#\x00', 0x0, 0x204800) epoll_create1(0x0) pselect6(0x40, &(0x7f0000f33fc0)={0x3ffffd}, &(0x7f0000768000), &(0x7f0000086000), &(0x7f0000349000), &(0x7f0000f14000)={&(0x7f0000a65ff8), 0x8}) 2018/02/20 00:06:41 executing program 0: syz_open_procfs(0x0, &(0x7f0000eee000)='net/xfrm_stat\x00') 2018/02/20 00:06:41 executing program 6: syz_open_dev$evdev(&(0x7f0000fe5fee)='/dev/input/event#\x00', 0x0, 0x6000) 2018/02/20 00:06:41 executing program 1: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000000)={0xaa}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000fe0)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) ioctl$UFFDIO_ZEROPAGE(r0, 0xc020aa04, &(0x7f0000012ff0)={&(0x7f0000011000/0x1000)=nil, 0x1000}) ioctl$UFFDIO_ZEROPAGE(r0, 0x8010aa02, &(0x7f0000000000)={&(0x7f0000011000/0x3000)=nil, 0x3000}) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$UFFDIO_ZEROPAGE(r0, 0x8010aa02, &(0x7f00000c0ff0)={&(0x7f0000011000/0x3000)=nil, 0x3000}) 2018/02/20 00:06:41 executing program 7: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000004ff8)={0x0, 0x0}) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg(r0, &(0x7f00009eefc8)={0x0, 0x0, &(0x7f000084a000)=[], 0x0, &(0x7f0000000000)=[{0xc}], 0xc}, 0x0) 2018/02/20 00:06:41 executing program 5: pipe2(&(0x7f0000000ff8)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$DRM_IOCTL_RM_MAP(0xffffffffffffffff, 0x4028641b, &(0x7f0000b1d000)={&(0x7f0000a93000/0x3000)=nil, 0x20000002, 0x0, 0x0, &(0x7f0000b1c000/0x4000)=nil}) mprotect(&(0x7f0000b1d000/0x2000)=nil, 0x2000, 0x0) vmsplice(r0, &(0x7f0000000180)=[{&(0x7f0000000040)="575eea0ab345513d67c949093be1fbe95cde8746e94e5d7b063e692b2eac3383fd95d2aa35eb6fedf79296746ca0769f4c666a56ff867d28f951e76fb21aa2045267d17d2d38b25246f9d310fcace61d8cbfedfe2adf37c91e3d41d8e092d60e645c085f89ac8b2ebe782c1fc1901543ede7b865143d6be4565cdf49a0436dae79cc20a1b6ae70b9a7cdedd1d453e40e1640e7a9810b51423e13055bc0c90cafa220a0e28670b452d9028985869557e4a3ee22e7c6adfbc27bfb19e4b9ffd9639b5fbada4ce6a74450bd91b2a3b9dd7dcb42b209c88d58058a7beaa3aef45b82d8057424daffd50896", 0xe9}, {&(0x7f0000001000)="c0", 0x1}], 0x2, 0x0) vmsplice(r0, &(0x7f0000b1d000)=[{&(0x7f0000005fe3)}], 0x1, 0x0) 2018/02/20 00:06:41 executing program 4: r0 = request_key(&(0x7f0000000000)='keyring\x00', &(0x7f0000005000)={0x73, 0x79, 0x7a}, &(0x7f0000005fe7)='/selinux/avc/cache_stats\x00', 0xfffffffffffffffd) keyctl$link(0x8, 0x0, r0) clone(0x0, &(0x7f0000fbf000), &(0x7f0000744000), &(0x7f0000f8b000), &(0x7f0000804000)) 2018/02/20 00:06:41 executing program 2: syz_open_dev$random(&(0x7f0000009000)='/dev/random\x00', 0x0, 0x0) syz_open_dev$sg(&(0x7f00000b9ff7)='/dev/sg#\x00', 0x0, 0x204800) epoll_create1(0x0) pselect6(0x40, &(0x7f0000f33fc0)={0x3ffffd}, &(0x7f0000768000), &(0x7f0000086000), &(0x7f0000349000), &(0x7f0000f14000)={&(0x7f0000a65ff8), 0x8}) 2018/02/20 00:06:41 executing program 3: r0 = syz_open_dev$sndseq(&(0x7f0000b39000)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r0, 0xc08c5332, &(0x7f0000b0bf74)={0x0, 0x0, 0x0, 'queue0\x00'}) r1 = memfd_create(&(0x7f000003e000)='\'', 0x0) r2 = syz_open_dev$sndseq(&(0x7f0000d82000)='/dev/snd/seq\x00', 0x0, 0x8000000040102) r3 = dup2(r2, r1) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r3, 0x40605346, &(0x7f000013e000)={0x0, 0x0, {0x0, 0x1}}) write$sndseq(r1, &(0x7f0000e6ffd0)=[{0x1e, 0x0, 0x0, 0x3fd, @time, {}, {}, @note}], 0x30) 2018/02/20 00:06:41 executing program 0: mkdir(&(0x7f0000a39ff8)='./file0\x00', 0x0) mount(&(0x7f000000a000)='./file0\x00', &(0x7f000000aff8)='./file0\x00', &(0x7f000000c000)='ramfs\x00', 0xcc1d, &(0x7f000001c000)) rename(&(0x7f000001cff2)='./file0/file0\x00', &(0x7f000001c000)='./file0/control\x00') 2018/02/20 00:06:41 executing program 7: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000004ff8)={0x0, 0x0}) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x4d032, 0xffffffffffffffff, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00009eefc8)={0x0, 0x0, &(0x7f000084a000)=[], 0x0, &(0x7f0000000000)=[{0xc}], 0xc}, 0x0) 2018/02/20 00:06:41 executing program 4: r0 = syz_open_dev$sndtimer(&(0x7f0000496000)='/dev/snd/timer\x00', 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_NEXT_DEVICE(r0, 0xc0145401, &(0x7f0000000000)={0x3, 0x0, 0x0, 0x0, 0xfffffffffffffffc}) 2018/02/20 00:06:41 executing program 0: mkdir(&(0x7f0000a39ff8)='./file0\x00', 0x0) mount(&(0x7f000000a000)='./file0\x00', &(0x7f000000aff8)='./file0\x00', &(0x7f000000c000)='ramfs\x00', 0xcc1d, &(0x7f000001c000)) rename(&(0x7f000001cff2)='./file0/file0\x00', &(0x7f000001c000)='./file0/control\x00') 2018/02/20 00:06:41 executing program 2: syz_open_dev$random(&(0x7f0000009000)='/dev/random\x00', 0x0, 0x0) syz_open_dev$sg(&(0x7f00000b9ff7)='/dev/sg#\x00', 0x0, 0x204800) epoll_create1(0x0) pselect6(0x40, &(0x7f0000f33fc0)={0x3ffffd}, &(0x7f0000768000), &(0x7f0000086000), &(0x7f0000349000), &(0x7f0000f14000)={&(0x7f0000a65ff8), 0x8}) 2018/02/20 00:06:41 executing program 5: pipe2(&(0x7f0000000ff8)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$DRM_IOCTL_RM_MAP(0xffffffffffffffff, 0x4028641b, &(0x7f0000b1d000)={&(0x7f0000a93000/0x3000)=nil, 0x20000002, 0x0, 0x0, &(0x7f0000b1c000/0x4000)=nil}) mprotect(&(0x7f0000b1d000/0x2000)=nil, 0x2000, 0x5) vmsplice(0xffffffffffffffff, &(0x7f0000000180)=[{&(0x7f0000000040)="575eea0ab345513d67c949093be1fbe95cde8746e94e5d7b063e692b2eac3383fd95d2aa35eb6fedf79296746ca0769f4c666a56ff867d28f951e76fb21aa2045267d17d2d38b25246f9d310fcace61d8cbfedfe2adf37c91e3d41d8e092d60e645c085f89ac8b2ebe782c1fc1901543ede7b865143d6be4565cdf49a0436dae79cc20a1b6ae70b9a7cdedd1d453e40e1640e7a9810b51423e13055bc0c90cafa220a0e28670b452d9028985869557e4a3ee22e7c6adfbc27bfb19e4b9ffd9639b5fbada4ce6a74450bd91b2a3b9dd7dcb42b209c88d58058a7beaa3aef45b82d8057424daffd50896", 0xe9}, {&(0x7f0000001000)="c0", 0x1}], 0x2, 0x0) vmsplice(r0, &(0x7f0000b1d000)=[{&(0x7f0000005fe3)}], 0x1, 0x0) 2018/02/20 00:06:41 executing program 7: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000004ff8)={0x0, 0x0}) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x4d032, 0xffffffffffffffff, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00009eefc8)={0x0, 0x0, &(0x7f000084a000)=[], 0x0, &(0x7f0000000000)=[{0xc}], 0xc}, 0x0) 2018/02/20 00:06:41 executing program 3: r0 = syz_open_dev$sndseq(&(0x7f0000b39000)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r0, 0xc08c5332, &(0x7f0000b0bf74)={0x0, 0x0, 0x0, 'queue0\x00'}) r1 = memfd_create(&(0x7f000003e000)='\'', 0x0) r2 = syz_open_dev$sndseq(&(0x7f0000d82000)='/dev/snd/seq\x00', 0x0, 0x8000000040102) r3 = dup2(r2, r1) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r3, 0x40605346, &(0x7f000013e000)={0x0, 0x0, {0x0, 0x1}}) write$sndseq(r1, &(0x7f0000e6ffd0)=[{0x1e, 0x0, 0x0, 0x3fd, @time, {}, {}, @note}], 0x30) 2018/02/20 00:06:41 executing program 5: pipe2(&(0x7f0000000ff8)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$DRM_IOCTL_RM_MAP(0xffffffffffffffff, 0x4028641b, &(0x7f0000b1d000)={&(0x7f0000a93000/0x3000)=nil, 0x20000002, 0x0, 0x0, &(0x7f0000b1c000/0x4000)=nil}) mprotect(&(0x7f0000b1d000/0x2000)=nil, 0x2000, 0x5) vmsplice(0xffffffffffffffff, &(0x7f0000000180)=[{&(0x7f0000000040)="575eea0ab345513d67c949093be1fbe95cde8746e94e5d7b063e692b2eac3383fd95d2aa35eb6fedf79296746ca0769f4c666a56ff867d28f951e76fb21aa2045267d17d2d38b25246f9d310fcace61d8cbfedfe2adf37c91e3d41d8e092d60e645c085f89ac8b2ebe782c1fc1901543ede7b865143d6be4565cdf49a0436dae79cc20a1b6ae70b9a7cdedd1d453e40e1640e7a9810b51423e13055bc0c90cafa220a0e28670b452d9028985869557e4a3ee22e7c6adfbc27bfb19e4b9ffd9639b5fbada4ce6a74450bd91b2a3b9dd7dcb42b209c88d58058a7beaa3aef45b82d8057424daffd50896", 0xe9}, {&(0x7f0000001000)="c0", 0x1}], 0x2, 0x0) vmsplice(r0, &(0x7f0000b1d000)=[{&(0x7f0000005fe3)}], 0x1, 0x0) [ 36.673112] FAULT_FLAG_ALLOW_RETRY missing 30 [ 36.677729] CPU: 0 PID: 5323 Comm: syz-executor1 Not tainted 4.4.115-g55a366596 #14 [ 36.685530] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 36.694887] 0000000000000000 a06b543d7fff4873 ffff8800abd476d0 ffffffff81d03d8d [ 36.702986] ffff8800ac8ca000 1ffff100157a8ee7 ffff8800abd47858 0000000000000000 [ 36.711040] 0000000000000000 ffff8800abd47880 ffffffff816072d5 ffffffff81237470 [ 36.719103] Call Trace: [ 36.721724] [] dump_stack+0xc1/0x124 [ 36.727086] [] handle_userfault+0x715/0xf50 [ 36.733061] [] ? debug_check_no_locks_freed+0x2c0/0x2c0 [ 36.740091] [] ? userfaultfd_ioctl+0x2040/0x2040 [ 36.746521] [] ? update_stats_wait_end+0x4c5/0xa30 [ 36.753113] [] ? __enqueue_entity+0x134/0x230 [ 36.759272] [] ? handle_mm_fault+0xb5d/0x3190 [ 36.765405] [] ? userfaultfd_poll+0x180/0x180 [ 36.771527] [] ? handle_mm_fault+0x291e/0x3190 [ 36.777732] [] handle_mm_fault+0x2938/0x3190 [ 36.783762] [] ? _raw_spin_unlock_irq+0x38/0x50 [ 36.790057] [] ? finish_task_switch+0x1e7/0x4e0 [ 36.796385] [] ? copy_page_range+0x1480/0x1480 [ 36.802593] [] ? __do_page_fault+0x780/0xa00 [ 36.808625] [] ? vmacache_find+0x57/0x290 [ 36.814394] [] __do_page_fault+0x35b/0xa00 [ 36.820252] [] do_page_fault+0x27/0x30 [ 36.825764] [] page_fault+0x28/0x30 [ 36.831019] [] ? copy_user_generic_unrolled+0x86/0xc0 [ 36.837831] [] ? userfaultfd_ioctl+0x80a/0x2040 [ 36.844126] [] ? hash_futex+0x210/0x210 [ 36.849719] [] ? entry_SYSCALL_64_fastpath+0x1c/0x98 [ 36.856443] [] ? userfaultfd_release+0x5a0/0x5a0 [ 36.862827] [] ? do_futex+0x3f4/0x15d0 [ 36.868348] [] ? debug_check_no_locks_freed+0x2c0/0x2c0 [ 36.875334] [] ? save_stack_trace+0x26/0x50 [ 36.881294] [] ? debug_check_no_locks_freed+0x2c0/0x2c0 [ 36.888283] [] ? kasan_kmalloc+0xad/0xe0 [ 36.893968] [] ? lockdep_init_map+0xeb/0x1690 [ 36.900086] [] ? kasan_slab_alloc+0x12/0x20 [ 36.906030] [] ? userfaultfd_release+0x5a0/0x5a0 [ 36.912407] [] do_vfs_ioctl+0x7aa/0xee0 [ 36.918002] [] ? ioctl_preallocate+0x1f0/0x1f0 2018/02/20 00:06:41 executing program 6: syz_open_dev$evdev(&(0x7f0000fe5fee)='/dev/input/event#\x00', 0x0, 0x6000) 2018/02/20 00:06:41 executing program 0: r0 = socket$inet(0x2, 0x1, 0x0) r1 = dup(r0) setsockopt$sock_linger(r1, 0x1, 0xd, &(0x7f0000414ff8)={0x9}, 0x8) 2018/02/20 00:06:41 executing program 7: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000004ff8)={0x0, 0x0}) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x4d032, 0xffffffffffffffff, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00009eefc8)={0x0, 0x0, &(0x7f000084a000)=[], 0x0, &(0x7f0000000000)=[{0xc}], 0xc}, 0x0) 2018/02/20 00:06:41 executing program 4: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x3, @broadcast=0xffffffff}, 0x10) sendto$inet(r0, &(0x7f0000fd0000), 0x0, 0x200007ff, &(0x7f0000deaff0)={0x2, 0x3, @loopback=0x7f000001}, 0x10) sendto$inet(r0, &(0x7f00006fd000)="c3", 0x1, 0x81, &(0x7f0000e66000)={0x2, 0xffffffffffffffff, @rand_addr}, 0x10) recvmmsg(r0, &(0x7f000060bfc9)=[{{&(0x7f00004b1000)=@pppol2tpv3in6={0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, @empty}}}, 0x3a, &(0x7f0000b16fa0)=[{&(0x7f0000bf3f68)=""/152, 0x98}], 0x1}}], 0x1, 0x3, &(0x7f00006ff000)) 2018/02/20 00:06:41 executing program 2: syz_open_dev$random(&(0x7f0000009000)='/dev/random\x00', 0x0, 0x0) syz_open_dev$sg(&(0x7f00000b9ff7)='/dev/sg#\x00', 0x0, 0x204800) pselect6(0x40, &(0x7f0000f33fc0)={0x3ffffd}, &(0x7f0000768000), &(0x7f0000086000), &(0x7f0000349000), &(0x7f0000f14000)={&(0x7f0000a65ff8), 0x8}) 2018/02/20 00:06:41 executing program 3: r0 = syz_open_dev$sndseq(&(0x7f0000b39000)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r0, 0xc08c5332, &(0x7f0000b0bf74)={0x0, 0x0, 0x0, 'queue0\x00'}) r1 = memfd_create(&(0x7f000003e000)='\'', 0x0) r2 = syz_open_dev$sndseq(&(0x7f0000d82000)='/dev/snd/seq\x00', 0x0, 0x8000000040102) r3 = dup2(r2, r1) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r3, 0x40605346, &(0x7f000013e000)={0x0, 0x0, {0x0, 0x1}}) write$sndseq(r1, &(0x7f0000e6ffd0)=[{0x1e, 0x0, 0x0, 0x3fd, @time, {}, {}, @note}], 0x30) 2018/02/20 00:06:41 executing program 1: r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f000070ffe3)={0xa, 0x0, 0x0, @empty}, 0x1c) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000f59ffc)=0x5, 0x4) connect$inet6(r0, &(0x7f0000dd6000)={0xa, 0xffffffffffffffff, 0x0, @empty}, 0x1c) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r1, 0x1, 0xf, &(0x7f0000452ffc)=0x3, 0x4) bind$inet6(r1, &(0x7f0000f5dfe4)={0xa, 0xffffffffffffffff, 0x0, @empty}, 0x1c) connect$inet6(r1, &(0x7f0000f6afe4)={0xa, 0xffffffffffffffff, 0x0, @loopback={0x0, 0x1}}, 0x1c) 2018/02/20 00:06:41 executing program 5: pipe2(&(0x7f0000000ff8)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$DRM_IOCTL_RM_MAP(0xffffffffffffffff, 0x4028641b, &(0x7f0000b1d000)={&(0x7f0000a93000/0x3000)=nil, 0x20000002, 0x0, 0x0, &(0x7f0000b1c000/0x4000)=nil}) mprotect(&(0x7f0000b1d000/0x2000)=nil, 0x2000, 0x5) vmsplice(0xffffffffffffffff, &(0x7f0000000180)=[{&(0x7f0000000040)="575eea0ab345513d67c949093be1fbe95cde8746e94e5d7b063e692b2eac3383fd95d2aa35eb6fedf79296746ca0769f4c666a56ff867d28f951e76fb21aa2045267d17d2d38b25246f9d310fcace61d8cbfedfe2adf37c91e3d41d8e092d60e645c085f89ac8b2ebe782c1fc1901543ede7b865143d6be4565cdf49a0436dae79cc20a1b6ae70b9a7cdedd1d453e40e1640e7a9810b51423e13055bc0c90cafa220a0e28670b452d9028985869557e4a3ee22e7c6adfbc27bfb19e4b9ffd9639b5fbada4ce6a74450bd91b2a3b9dd7dcb42b209c88d58058a7beaa3aef45b82d8057424daffd50896", 0xe9}, {&(0x7f0000001000)="c0", 0x1}], 0x2, 0x0) vmsplice(r0, &(0x7f0000b1d000)=[{&(0x7f0000005fe3)}], 0x1, 0x0) [ 36.924204] [] ? __fget+0x20b/0x3b0 [ 36.929452] [] ? __fget+0x232/0x3b0 [ 36.934700] [] ? __fget+0x47/0x3b0 [ 36.939864] [] ? security_file_ioctl+0x89/0xb0 [ 36.946066] [] SyS_ioctl+0x8f/0xc0 [ 36.951232] [] entry_SYSCALL_64_fastpath+0x1c/0x98 2018/02/20 00:06:41 executing program 7: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000004ff8)={0x0, 0x0}) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x4d032, 0xffffffffffffffff, 0x0) sendmsg(r0, &(0x7f00009eefc8)={0x0, 0x0, &(0x7f000084a000)=[], 0x0, &(0x7f0000000000)=[]}, 0x0) 2018/02/20 00:06:41 executing program 2: syz_open_dev$random(&(0x7f0000009000)='/dev/random\x00', 0x0, 0x0) epoll_create1(0x0) pselect6(0x40, &(0x7f0000f33fc0)={0x3ffffd}, &(0x7f0000768000), &(0x7f0000086000), &(0x7f0000349000), &(0x7f0000f14000)={&(0x7f0000a65ff8), 0x8}) 2018/02/20 00:06:41 executing program 4: r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000357000)={{{@in=@remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @in=@rand_addr}}, {{@in6=@ipv4={[], [0xff, 0xff], @broadcast=0xffffffff}}, 0x0, @in=@empty}}, 0xe8) 2018/02/20 00:06:41 executing program 3: r0 = syz_open_dev$sndseq(&(0x7f0000b39000)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r0, 0xc08c5332, &(0x7f0000b0bf74)={0x0, 0x0, 0x0, 'queue0\x00'}) r1 = memfd_create(&(0x7f000003e000)='\'', 0x0) r2 = syz_open_dev$sndseq(&(0x7f0000d82000)='/dev/snd/seq\x00', 0x0, 0x8000000040102) r3 = dup2(r2, r1) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r3, 0x40605346, &(0x7f000013e000)={0x0, 0x0, {0x0, 0x1}}) write$sndseq(r1, &(0x7f0000e6ffd0)=[{0x1e, 0x0, 0x0, 0x3fd, @time, {}, {}, @note}], 0x30) 2018/02/20 00:06:41 executing program 5: pipe2(&(0x7f0000000ff8)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$DRM_IOCTL_RM_MAP(0xffffffffffffffff, 0x4028641b, &(0x7f0000b1d000)={&(0x7f0000a93000/0x3000)=nil, 0x20000002, 0x0, 0x0, &(0x7f0000b1c000/0x4000)=nil}) mprotect(&(0x7f0000b1d000/0x2000)=nil, 0x2000, 0x5) vmsplice(r0, &(0x7f0000000180)=[{&(0x7f0000001000)="c0", 0x1}], 0x1, 0x0) vmsplice(r0, &(0x7f0000b1d000)=[{&(0x7f0000005fe3)}], 0x1, 0x0) 2018/02/20 00:06:41 executing program 1: ioctl$sock_inet_SIOCGIFDSTADDR(0xffffffffffffffff, 0x8917, &(0x7f0000000fe0)={@generic="be051abe36fe9162389fa7320c514077", @ifru_flags}) mmap(&(0x7f0000000000/0xd000)=nil, 0xd000, 0x3, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000004fc8)={0x0, 0x0, &(0x7f0000004000)=[{&(0x7f0000006000)="130000003200030207fffd946fa283bc0aeee6", 0x13}], 0x1}, 0x0) 2018/02/20 00:06:41 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_msfilter(r0, 0x0, 0x29, &(0x7f000016afe0)={@dev={0xac, 0x14}, @loopback=0x7f000001, 0x0, 0x40000000000003b1, [@local={0xac, 0x14, 0xffffffffffffffff, 0xaa}, @empty, @local={0xac, 0x14, 0xffffffffffffffff, 0xaa}, @empty]}, 0x10) 2018/02/20 00:06:41 executing program 7: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000004ff8)={0x0, 0x0}) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x4d032, 0xffffffffffffffff, 0x0) sendmsg(r0, &(0x7f00009eefc8)={0x0, 0x0, &(0x7f000084a000)=[], 0x0, &(0x7f0000000000)=[]}, 0x0) 2018/02/20 00:06:41 executing program 6: syz_open_dev$evdev(&(0x7f0000dfdfee)='/dev/input/event#\x00', 0x0, 0x0) syz_open_dev$evdev(&(0x7f0000fe5fee)='/dev/input/event#\x00', 0x0, 0x0) 2018/02/20 00:06:41 executing program 3: r0 = syz_open_dev$sndseq(&(0x7f0000b39000)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r0, 0xc08c5332, &(0x7f0000b0bf74)={0x0, 0x0, 0x0, 'queue0\x00'}) r1 = memfd_create(&(0x7f000003e000)='\'', 0x0) r2 = syz_open_dev$sndseq(&(0x7f0000d82000)='/dev/snd/seq\x00', 0x0, 0x8000000040102) r3 = dup2(r2, r1) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r3, 0x40605346, &(0x7f000013e000)={0x0, 0x0, {0x0, 0x1}}) 2018/02/20 00:06:41 executing program 2: syz_open_dev$sg(&(0x7f00000b9ff7)='/dev/sg#\x00', 0x0, 0x204800) epoll_create1(0x0) pselect6(0x40, &(0x7f0000f33fc0)={0x3ffffd}, &(0x7f0000768000), &(0x7f0000086000), &(0x7f0000349000), &(0x7f0000f14000)={&(0x7f0000a65ff8), 0x8}) 2018/02/20 00:06:41 executing program 4: r0 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/commit_pending_bools\x00', 0x1, 0x0) write$eventfd(r0, &(0x7f0000000ff8), 0xffffffffffffff39) 2018/02/20 00:06:41 executing program 5: pipe2(&(0x7f0000000ff8)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$DRM_IOCTL_RM_MAP(0xffffffffffffffff, 0x4028641b, &(0x7f0000b1d000)={&(0x7f0000a93000/0x3000)=nil, 0x20000002, 0x0, 0x0, &(0x7f0000b1c000/0x4000)=nil}) mprotect(&(0x7f0000b1d000/0x2000)=nil, 0x2000, 0x5) vmsplice(r0, &(0x7f0000000180)=[{&(0x7f0000001000)="c0", 0x1}], 0x1, 0x0) vmsplice(r0, &(0x7f0000b1d000)=[{&(0x7f0000005fe3)}], 0x1, 0x0) 2018/02/20 00:06:41 executing program 0: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)={0xaa}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000fe0)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r1 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000013000)=@syzn={0x73, 0x79, 0x7a}, 0x10) ioctl$UFFDIO_ZEROPAGE(r0, 0x8010aa02, &(0x7f0000000000)={&(0x7f0000011000/0x3000)=nil, 0x3000}) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$UFFDIO_ZEROPAGE(r0, 0x8010aa02, &(0x7f0000fef000)={&(0x7f0000011000/0x3000)=nil, 0x3000}) 2018/02/20 00:06:41 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) ioctl$TCSETS(r0, 0x5402, &(0x7f0000856000)={0x0, 0x0, 0x1000}) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000fdd000)=0x3) 2018/02/20 00:06:41 executing program 7: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000004ff8)={0x0, 0x0}) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x4d032, 0xffffffffffffffff, 0x0) sendmsg(r0, &(0x7f00009eefc8)={0x0, 0x0, &(0x7f000084a000)=[], 0x0, &(0x7f0000000000)=[]}, 0x0) [ 37.068805] tc_dump_action: action bad kind 2018/02/20 00:06:41 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f000039c000)=0x400000000000001, 0x4) setsockopt$inet_tcp_int(r0, 0x6, 0x14, &(0x7f00000b2000)=0xffffffffffffffff, 0x4) bind$inet(r0, &(0x7f0000b55000)={0x2, 0x2, @empty}, 0x10) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f000094d000)={0x0}, &(0x7f0000cdcffc)=0xc) fcntl$lock(r0, 0x5, &(0x7f00008406cb)={0x1, 0x4, 0x9, 0x5, r1}) r2 = syz_open_dev$usbmon(&(0x7f0000241000)='/dev/usbmon#\x00', 0x4, 0x200202) ioctl$DRM_IOCTL_ADD_CTX(0xffffffffffffff9c, 0xc0086420, &(0x7f000088aff8)={0x0}) ioctl$DRM_IOCTL_RM_CTX(r2, 0xc0086421, &(0x7f000007e000)={r3, 0x3}) r4 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000c38ff4)='/dev/rfkill\x00', 0x80400, 0x0) flock(r4, 0xa) ioctl$TCSETA(r4, 0x5406, &(0x7f00002bd000)={0x401, 0x0, 0x78, 0x7, 0x0, 0x0, 0x1, 0x6, 0x5, 0x1000}) ioctl$sock_ifreq(0xffffffffffffff9c, 0x0, &(0x7f00002ecfb0)={@common='bcsh0\x00', @ifru_settings={0xb2b8, 0x7, @sync=&(0x7f00004ac000)={0xde1, 0x65, 0x5}}}) r5 = add_key$user(&(0x7f0000575ffb)='user\x00', &(0x7f0000f7e000)={0x73, 0x79, 0x7a, 0x3}, &(0x7f00006e8fb4)="acd65f826b809eeda83e45754a7de1b9186b3a89fa64cc2ff33217cec57933ffaed711b390d3855f5022d54bb1c912c584f4d64fb281d91d70a55fba57f74abdc6a45dceb612e99453cd9d35", 0x4c, 0x0) r6 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f000074e000)='/dev/vga_arbiter\x00', 0x80, 0x0) ioctl$SNDRV_TIMER_IOCTL_PVERSION(r6, 0x80045400, &(0x7f0000323000)) ioctl$ASHMEM_GET_NAME(r6, 0x81007702, &(0x7f0000e8ffec)=""/20) keyctl$get_keyring_id(0x0, r5, 0x40) sendto$inet(r0, &(0x7f00005c9000), 0x252, 0x800000020000000, &(0x7f0000303000)={0x2, 0x2, @loopback=0x7f000001}, 0x10) ioctl$DRM_IOCTL_ADD_CTX(r6, 0xc0086420, &(0x7f0000b30000)) socketpair$inet6(0xa, 0x0, 0x80200, &(0x7f00002bfff8)) socket$inet(0x2, 0x0, 0x20000000000001) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000965fec)={0x40000004, 0x800000000000852b, 0xffff, 0x10000007fffffff}, 0x14) writev(r0, &(0x7f00002d3f70)=[{&(0x7f0000fe5ff0)='p', 0x1}], 0x1) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f000020affc), 0x4) shutdown(r0, 0x1) 2018/02/20 00:06:41 executing program 5: pipe2(&(0x7f0000000ff8)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$DRM_IOCTL_RM_MAP(0xffffffffffffffff, 0x4028641b, &(0x7f0000b1d000)={&(0x7f0000a93000/0x3000)=nil, 0x20000002, 0x0, 0x0, &(0x7f0000b1c000/0x4000)=nil}) mprotect(&(0x7f0000b1d000/0x2000)=nil, 0x2000, 0x5) vmsplice(r0, &(0x7f0000000180)=[{&(0x7f0000001000)="c0", 0x1}], 0x1, 0x0) vmsplice(r0, &(0x7f0000b1d000)=[{&(0x7f0000005fe3)}], 0x1, 0x0) 2018/02/20 00:06:41 executing program 2: syz_open_dev$random(&(0x7f0000009000)='/dev/random\x00', 0x0, 0x0) syz_open_dev$sg(&(0x7f00000b9ff7)='/dev/sg#\x00', 0x0, 0x0) epoll_create1(0x0) pselect6(0x40, &(0x7f0000f33fc0)={0x3ffffd}, &(0x7f0000768000), &(0x7f0000086000), &(0x7f0000349000), &(0x7f0000f14000)={&(0x7f0000a65ff8), 0x8}) 2018/02/20 00:06:41 executing program 3: r0 = syz_open_dev$sndseq(&(0x7f0000b39000)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r0, 0xc08c5332, &(0x7f0000b0bf74)={0x0, 0x0, 0x0, 'queue0\x00'}) memfd_create(&(0x7f000003e000)='\'', 0x0) syz_open_dev$sndseq(&(0x7f0000d82000)='/dev/snd/seq\x00', 0x0, 0x8000000040102) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(0xffffffffffffffff, 0x40605346, &(0x7f000013e000)={0x0, 0x0, {0x0, 0x1}}) 2018/02/20 00:06:41 executing program 7: r0 = gettid() unshare(0x28060400) exit(0x0) syz_open_procfs(r0, &(0x7f000000b000)='ns/uts\x00') 2018/02/20 00:06:41 executing program 1: mmap(&(0x7f0000000000/0x30000)=nil, 0x30000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000026000)='./file0\x00', 0x0, 0x0) getdents64(r0, &(0x7f0000029fd4)=""/48, 0x30) 2018/02/20 00:06:41 executing program 3: r0 = syz_open_dev$sndseq(&(0x7f0000b39000)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r0, 0xc08c5332, &(0x7f0000b0bf74)={0x0, 0x0, 0x0, 'queue0\x00'}) r1 = memfd_create(&(0x7f000003e000)='\'', 0x0) r2 = dup2(0xffffffffffffffff, r1) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r2, 0x40605346, &(0x7f000013e000)={0x0, 0x0, {0x0, 0x1}}) [ 37.152440] FAULT_FLAG_ALLOW_RETRY missing 30 [ 37.157081] CPU: 1 PID: 5404 Comm: syz-executor0 Not tainted 4.4.115-g55a366596 #14 [ 37.164872] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 37.174221] 0000000000000000 b8099d903bb41121 ffff8800b0637870 ffffffff81d03d8d [ 37.182268] ffff8801cdc96000 1ffff100160c6f1b ffff8800b06379f8 0000000000000000 [ 37.190318] 0000000000000000 ffff8800b0637a20 ffffffff816072d5 ffffffff81237470 [ 37.198394] Call Trace: 2018/02/20 00:06:41 executing program 3: r0 = syz_open_dev$sndseq(&(0x7f0000b39000)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r0, 0xc08c5332, &(0x7f0000b0bf74)={0x0, 0x0, 0x0, 'queue0\x00'}) r1 = syz_open_dev$sndseq(&(0x7f0000d82000)='/dev/snd/seq\x00', 0x0, 0x8000000040102) r2 = dup2(r1, 0xffffffffffffffff) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r2, 0x40605346, &(0x7f000013e000)={0x0, 0x0, {0x0, 0x1}}) [ 37.200982] [] dump_stack+0xc1/0x124 [ 37.206345] [] handle_userfault+0x715/0xf50 [ 37.212319] [] ? debug_check_no_locks_freed+0x2c0/0x2c0 [ 37.219338] [] ? userfaultfd_ioctl+0x2040/0x2040 [ 37.225749] [] ? __schedule+0xac8/0x1ca0 [ 37.231477] [] ? handle_mm_fault+0xb5d/0x3190 [ 37.237662] [] ? userfaultfd_poll+0x180/0x180 [ 37.243808] [] ? handle_mm_fault+0x291e/0x3190 [ 37.250021] [] handle_mm_fault+0x2938/0x3190 [ 37.256057] [] ? avc_has_perm_noaudit+0xa2/0x460 [ 37.262447] [] ? copy_page_range+0x1480/0x1480 [ 37.268656] [] ? __do_page_fault+0x780/0xa00 [ 37.274688] [] ? vmacache_find+0x57/0x290 [ 37.280464] [] __do_page_fault+0x35b/0xa00 [ 37.286321] [] do_page_fault+0x27/0x30 [ 37.291835] [] page_fault+0x28/0x30 [ 37.297087] [] ? copy_user_generic_unrolled+0x86/0xc0 [ 37.303900] [] ? sock_setsockopt+0x216/0x14e0 [ 37.310017] [] ? sock_has_perm+0x9f/0x400 [ 37.315786] [] ? sock_enable_timestamp+0xc0/0xc0 [ 37.322176] [] ? selinux_netlbl_socket_setsockopt+0x117/0x320 [ 37.329683] [] ? selinux_netlbl_sock_rcv_skb+0x400/0x400 [ 37.336758] [] ? security_socket_setsockopt+0x89/0xb0 [ 37.343573] [] SyS_setsockopt+0x216/0x250 [ 37.349516] [] ? SyS_recv+0x40/0x40 [ 37.354767] [] ? move_addr_to_kernel+0x50/0x50 [ 37.360973] [] ? lockdep_sys_exit_thunk+0x12/0x14 [ 37.367439] [] entry_SYSCALL_64_fastpath+0x1c/0x98 2018/02/20 00:06:41 executing program 6: syz_open_dev$evdev(&(0x7f0000dfdfee)='/dev/input/event#\x00', 0x0, 0x0) syz_open_dev$evdev(&(0x7f0000fe5fee)='/dev/input/event#\x00', 0x0, 0x0) 2018/02/20 00:06:41 executing program 7: r0 = socket(0x18, 0x0, 0x1) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(0xffffffffffffffff, 0x6, 0x16, &(0x7f0000002000)=[{}, {}, {}, {}, {0x1}], 0x5) sendmmsg(0xffffffffffffffff, &(0x7f0000005000)=[{{&(0x7f0000007000)=@in6={0xa, 0xffffffffffffffff, 0x0, @remote={0xfe, 0x80, [], 0xffffffffffffffff, 0xbb}}, 0x1c, &(0x7f0000004fa0)=[{&(0x7f0000002000)="4c5614c00401a0dbf8a669ebdedd102c4f7a79e606457dfdf09e2ec2ed253b", 0x1f}], 0x1, &(0x7f0000008bc8)=[]}}], 0x1, 0x0) connect(r0, &(0x7f0000002000)=@sco={0x1f, {0x1}}, 0x26) setsockopt(r0, 0x111, 0x0, &(0x7f000000cfa2)="00000002", 0x4) 2018/02/20 00:06:41 executing program 3: syz_open_dev$sndseq(&(0x7f0000b39000)='/dev/snd/seq\x00', 0x0, 0x0) r0 = memfd_create(&(0x7f000003e000)='\'', 0x0) r1 = syz_open_dev$sndseq(&(0x7f0000d82000)='/dev/snd/seq\x00', 0x0, 0x8000000040102) r2 = dup2(r1, r0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r2, 0x40605346, &(0x7f000013e000)={0x0, 0x0, {0x0, 0x1}}) 2018/02/20 00:06:41 executing program 2: syz_open_dev$random(&(0x7f0000009000)='/dev/random\x00', 0x0, 0x0) syz_open_dev$sg(&(0x7f00000b9ff7)='/dev/sg#\x00', 0x0, 0x0) epoll_create1(0x0) pselect6(0x40, &(0x7f0000f33fc0)={0x3ffffd}, &(0x7f0000768000), &(0x7f0000086000), &(0x7f0000349000), &(0x7f0000f14000)={&(0x7f0000a65ff8), 0x8}) 2018/02/20 00:06:41 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f000014dfc8)={&(0x7f000059cff4)={0x10}, 0xc, &(0x7f0000397000)={&(0x7f0000cd9000)=@updpolicy={0xb8, 0x19, 0x401, 0xffffffffffffffff, 0xffffffffffffffff, {{@in=@broadcast=0xffffffff, @in=@dev={0xac, 0x14}}}, []}, 0xb8}, 0x1}, 0x0) 2018/02/20 00:06:41 executing program 1: r0 = syz_open_procfs(0x0, &(0x7f00000e5000)='clear_refs\x00') r1 = syz_open_procfs(0x0, &(0x7f0000ed8ff2)='oom_score_adj\x00') sendfile(r0, r1, &(0x7f0000c73ff8), 0xff) 2018/02/20 00:06:41 executing program 5: pipe2(&(0x7f0000000ff8)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$DRM_IOCTL_RM_MAP(0xffffffffffffffff, 0x4028641b, &(0x7f0000b1d000)={&(0x7f0000a93000/0x3000)=nil, 0x20000002, 0x0, 0x0, &(0x7f0000b1c000/0x4000)=nil}) mprotect(&(0x7f0000b1d000/0x2000)=nil, 0x2000, 0x5) vmsplice(r0, &(0x7f0000000180)=[{&(0x7f0000000040)}, {&(0x7f0000001000)="c0", 0x1}], 0x2, 0x0) vmsplice(r0, &(0x7f0000b1d000)=[{&(0x7f0000005fe3)}], 0x1, 0x0) 2018/02/20 00:06:41 executing program 0: r0 = syz_open_dev$sndtimer(&(0x7f0000061000)='/dev/snd/timer\x00', 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_SELECT(r0, 0x40345410, &(0x7f000060c000)={{0x100000001}}) 2018/02/20 00:06:42 executing program 5: pipe2(&(0x7f0000000ff8)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$DRM_IOCTL_RM_MAP(0xffffffffffffffff, 0x4028641b, &(0x7f0000b1d000)={&(0x7f0000a93000/0x3000)=nil, 0x20000002, 0x0, 0x0, &(0x7f0000b1c000/0x4000)=nil}) mprotect(&(0x7f0000b1d000/0x2000)=nil, 0x2000, 0x5) vmsplice(r0, &(0x7f0000000180)=[{&(0x7f0000000040)}, {&(0x7f0000001000)="c0", 0x1}], 0x2, 0x0) vmsplice(r0, &(0x7f0000b1d000)=[{&(0x7f0000005fe3)}], 0x1, 0x0) 2018/02/20 00:06:42 executing program 3: ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(0xffffffffffffffff, 0xc08c5332, &(0x7f0000b0bf74)={0x0, 0x0, 0x0, 'queue0\x00'}) r0 = memfd_create(&(0x7f000003e000)='\'', 0x0) r1 = syz_open_dev$sndseq(&(0x7f0000d82000)='/dev/snd/seq\x00', 0x0, 0x8000000040102) r2 = dup2(r1, r0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r2, 0x40605346, &(0x7f000013e000)={0x0, 0x0, {0x0, 0x1}}) 2018/02/20 00:06:42 executing program 2: syz_open_dev$random(&(0x7f0000009000)='/dev/random\x00', 0x0, 0x0) syz_open_dev$sg(&(0x7f00000b9ff7)='/dev/sg#\x00', 0x0, 0x0) epoll_create1(0x0) pselect6(0x40, &(0x7f0000f33fc0)={0x3ffffd}, &(0x7f0000768000), &(0x7f0000086000), &(0x7f0000349000), &(0x7f0000f14000)={&(0x7f0000a65ff8), 0x8}) 2018/02/20 00:06:42 executing program 5: pipe2(&(0x7f0000000ff8)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$DRM_IOCTL_RM_MAP(0xffffffffffffffff, 0x4028641b, &(0x7f0000b1d000)={&(0x7f0000a93000/0x3000)=nil, 0x20000002, 0x0, 0x0, &(0x7f0000b1c000/0x4000)=nil}) mprotect(&(0x7f0000b1d000/0x2000)=nil, 0x2000, 0x5) vmsplice(r0, &(0x7f0000000180)=[{&(0x7f0000000040)}, {&(0x7f0000001000)="c0", 0x1}], 0x2, 0x0) vmsplice(r0, &(0x7f0000b1d000)=[{&(0x7f0000005fe3)}], 0x1, 0x0) 2018/02/20 00:06:42 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCGIFNETMASK(r0, 0x891b, &(0x7f0000d07fe0)={@syzn={0x73, 0x79, 0x7a, 0x0}, @ifru_addrs={0x2, 0xffffffffffffffff, @local={0xac, 0x14, 0xffffffffffffffff, 0xaa}}}) 2018/02/20 00:06:42 executing program 7: r0 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$inet_buf(r0, 0x0, 0x485, &(0x7f00009cb000)=""/24, &(0x7f0000f08ffc)=0x12) 2018/02/20 00:06:42 executing program 0: r0 = open(&(0x7f00003b6ff8)='./file0\x00', 0x10000000080040, 0x0) fcntl$setflags(r0, 0x2, 0x0) 2018/02/20 00:06:42 executing program 4: pipe2(&(0x7f0000edeff8)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r2 = userfaultfd(0x0) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000bc8000)={0xaa}) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000d62fe0)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) write$sndseq(r1, &(0x7f0000011fd2)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @quote={{}, 0x0, &(0x7f0000fd0000)={0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @raw32}}}], 0xffffff46) ioctl$sock_inet6_tcp_SIOCINQ(r1, 0x541b, &(0x7f0000aa7000)) dup2(r0, r2) 2018/02/20 00:06:42 executing program 6: syz_open_dev$evdev(&(0x7f0000dfdfee)='/dev/input/event#\x00', 0x0, 0x0) syz_open_dev$evdev(&(0x7f0000fe5fee)='/dev/input/event#\x00', 0x0, 0x0) 2018/02/20 00:06:42 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_ifreq(r0, 0x89b0, &(0x7f00005ce000)={@common='tunl0\x00\x00\x00\x00\x00\x00\b\x00', @ifru_names=@generic="a426fe9b323ecc7f883be5f2f8d6d8d5"}) 2018/02/20 00:06:42 executing program 1: r0 = memfd_create(&(0x7f0000002901)='dev ', 0x0) ftruncate(r0, 0xffff) 2018/02/20 00:06:42 executing program 2: syz_open_dev$random(&(0x7f0000009000)='/dev/random\x00', 0x0, 0x0) syz_open_dev$sg(&(0x7f00000b9ff7)='/dev/sg#\x00', 0x0, 0x204800) epoll_create1(0x0) pselect6(0x40, &(0x7f0000f33fc0), &(0x7f0000768000), &(0x7f0000086000), &(0x7f0000349000), &(0x7f0000f14000)={&(0x7f0000a65ff8), 0x8}) 2018/02/20 00:06:42 executing program 3: r0 = syz_open_dev$sndseq(&(0x7f0000b39000)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(0xffffffffffffffff, 0xc08c5332, &(0x7f0000b0bf74)={0x0, 0x0, 0x0, 'queue0\x00'}) r1 = memfd_create(&(0x7f000003e000)='\'', 0x0) r2 = syz_open_dev$sndseq(&(0x7f0000d82000)='/dev/snd/seq\x00', 0x0, 0x8000000040102) r3 = dup2(r2, r1) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r3, 0x40605346, &(0x7f000013e000)={0x0, 0x0, {0x0, 0x1}}) 2018/02/20 00:06:42 executing program 0: r0 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8918, &(0x7f000000cfd8)={@generic="1a0eb77bd6464d95877d1621ee3a4dd4"}) 2018/02/20 00:06:42 executing program 7: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_generic(r0, &(0x7f0000282000)={&(0x7f0000190000)={0x10}, 0xc, &(0x7f0000461000)={&(0x7f0000012fec)={0x14, 0x26, 0x301, 0xffffffffffffffff, 0xffffffffffffffff, {}, []}, 0x14}, 0x1}, 0x0) 2018/02/20 00:06:42 executing program 5: pipe2(&(0x7f0000000ff8)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$DRM_IOCTL_RM_MAP(0xffffffffffffffff, 0x4028641b, &(0x7f0000b1d000)={&(0x7f0000a93000/0x3000)=nil, 0x20000002, 0x0, 0x0, &(0x7f0000b1c000/0x4000)=nil}) mprotect(&(0x7f0000b1d000/0x2000)=nil, 0x2000, 0x5) vmsplice(r0, &(0x7f0000000180)=[{&(0x7f0000000040)="575eea0ab345513d67c949093be1fbe95cde8746e94e5d7b063e692b2eac3383fd95d2aa35eb6fedf79296746ca0769f4c666a56ff867d28f951e76fb21aa2045267d17d2d38b25246f9d310fcace61d8cbfedfe2adf37c91e3d41d8e092d60e645c085f89ac8b2ebe782c1fc1901543ede7b86514", 0x75}, {&(0x7f0000001000)="c0", 0x1}], 0x2, 0x0) vmsplice(r0, &(0x7f0000b1d000)=[{&(0x7f0000005fe3)}], 0x1, 0x0) 2018/02/20 00:06:42 executing program 3: r0 = syz_open_dev$sndseq(&(0x7f0000b39000)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r0, 0xc08c5332, &(0x7f0000b0bf74)={0x0, 0x0, 0x0, 'queue0\x00'}) r1 = memfd_create(&(0x7f000003e000)='\'', 0x0) r2 = syz_open_dev$sndseq(&(0x7f0000d82000)='/dev/snd/seq\x00', 0x0, 0x0) r3 = dup2(r2, r1) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r3, 0x40605346, &(0x7f000013e000)={0x0, 0x0, {0x0, 0x1}}) 2018/02/20 00:06:42 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x1b, &(0x7f000074c000)=0x2, 0x4) 2018/02/20 00:06:42 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqn(r0, 0x0, 0x27, &(0x7f0000683ff4)={@multicast2=0xe0000002, @loopback=0x7f000001}, 0xc) setsockopt$inet_msfilter(r0, 0x0, 0x29, &(0x7f00002b9fd4)={@multicast2=0xe0000002, @loopback=0x7f000001, 0x0, 0x1, [@loopback=0x7f000001]}, 0x14) setsockopt$inet_mreqsrc(r0, 0x0, 0x25, &(0x7f0000c26000)={@multicast2=0xe0000002, @dev={0xac, 0x14, 0x0, 0x16}, @broadcast=0xffffffff}, 0xc) 2018/02/20 00:06:42 executing program 0: r0 = socket(0x10, 0x2, 0x10) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(r0, 0x10e, 0x1, &(0x7f000016fffc)=0x4, 0x4) 2018/02/20 00:06:42 executing program 3: r0 = syz_open_dev$sndseq(&(0x7f0000b39000)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r0, 0xc08c5332, &(0x7f0000b0bf74)={0x0, 0x0, 0x0, 'queue0\x00'}) r1 = memfd_create(&(0x7f000003e000)='\'', 0x0) r2 = syz_open_dev$sndseq(&(0x7f0000d82000)='/dev/snd/seq\x00', 0x0, 0x0) r3 = dup2(0xffffffffffffffff, r1) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r3, 0x40605346, &(0x7f000013e000)={0x0, 0x0, {0x0, 0x1}}) 2018/02/20 00:06:42 executing program 2: syz_open_dev$random(&(0x7f0000009000)='/dev/random\x00', 0x0, 0x0) syz_open_dev$sg(&(0x7f00000b9ff7)='/dev/sg#\x00', 0x0, 0x204800) epoll_create1(0x0) pselect6(0x40, &(0x7f0000f33fc0), &(0x7f0000768000), &(0x7f0000086000), &(0x7f0000349000), &(0x7f0000f14000)={&(0x7f0000a65ff8), 0x8}) 2018/02/20 00:06:42 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000f57000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000004fbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f000026c000)=[], &(0x7f000000afd0)=[]}}], 0x0, 0x0, &(0x7f0000009000)}) 2018/02/20 00:06:42 executing program 5: pipe2(&(0x7f0000000ff8)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$DRM_IOCTL_RM_MAP(0xffffffffffffffff, 0x4028641b, &(0x7f0000b1d000)={&(0x7f0000a93000/0x3000)=nil, 0x20000002, 0x0, 0x0, &(0x7f0000b1c000/0x4000)=nil}) mprotect(&(0x7f0000b1d000/0x2000)=nil, 0x2000, 0x5) vmsplice(r0, &(0x7f0000000180)=[{&(0x7f0000000040)='W', 0x1}, {&(0x7f0000001000)="c0", 0x1}], 0x2, 0x0) vmsplice(r0, &(0x7f0000b1d000)=[{&(0x7f0000005fe3)}], 0x1, 0x0) [ 37.665366] audit: type=1400 audit(1519085202.185:11): avc: denied { create } for pid=5493 comm="syz-executor0" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1 [ 37.676285] binder: 5502:5503 transaction failed 29189/-22, size 0-0 line 3005 [ 37.697097] binder: undelivered TRANSACTION_ERROR: 29189 2018/02/20 00:06:42 executing program 3: r0 = syz_open_dev$sndseq(&(0x7f0000b39000)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r0, 0xc08c5332, &(0x7f0000b0bf74)={0x0, 0x0, 0x0, 'queue0\x00'}) r1 = memfd_create(&(0x7f000003e000)='\'', 0x0) r2 = syz_open_dev$sndseq(&(0x7f0000d82000)='/dev/snd/seq\x00', 0x0, 0x0) r3 = dup2(r2, 0xffffffffffffffff) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r3, 0x40605346, &(0x7f000013e000)={0x0, 0x0, {0x0, 0x1}}) 2018/02/20 00:06:42 executing program 7: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) getsockopt$sock_int(r0, 0x1, 0xe, &(0x7f0000bc8000), &(0x7f0000257000)=0x4) 2018/02/20 00:06:42 executing program 4: openat$rtc(0xffffffffffffff9c, &(0x7f00009ffff7)='/dev/rtc\x00', 0x60001, 0x0) 2018/02/20 00:06:42 executing program 1: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x2, &(0x7f0000ed4000)=0x7b, 0x4) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x3, @broadcast=0xffffffff}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000f33ff7)='scalable\x00', 0x100000449) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000d26000)={0x1, &(0x7f0000818000)=[{0x6, 0x0, 0x0, 0x100}]}, 0x10) sendto$inet(r0, &(0x7f0000617fc9)="03", 0x1, 0x20000000, &(0x7f0000deaff0)={0x2, 0x3, @loopback=0x7f000001}, 0x10) writev(r0, &(0x7f0000e93000)=[{&(0x7f00006c3000)}], 0x1) sendmsg(r0, &(0x7f0000012fc8)={&(0x7f0000015000)=@in={0x2, 0xffffffffffffffff, @dev={0xac, 0x14}}, 0x10, &(0x7f000072a000)=[{&(0x7f000059f000)="a29d5b69624f02c4b47bfdad4625488d51579b87ffaeffb33d06b6fd1c9a90b8a5eac163d5418bacdbe68e7006c2835b890f78517148edf2547c3f58dea9750cff9b497cc9a2661b275741d4f9b2cb51f3a931e70ee886ead297fb89727e8ad2c700203aab8070bae3a5dc1b561e38745af1baed3980c403ba0c8402716c0631fa4e5644d30a887d94cbc69c7ea91d00883f56742998a38d5a59090ccb3e8c82e7e1cc8a7fbc9a130d070ecbe4ee207b1f50406f5de484e9a49556c297da689e305ff714f3a40bf8817e4d1f72d960cebbd44d262856604c5765bcf6a9f50a366c2701bbea9ed08c4fd9c9ec8675a8c14ccde6c8ed6500378700c9610fe912b2ee205acc3993805ee311618ca2ad073ae233896d5302e9ed9f7a5a5890a96e18ef6d91a76d810219f814f21c1a707a9e7531da51f56ad70efbc82ef8407d08eedb830ebb9b142f00f9d9e06156977128d17db1a9c092f3bb05dfad244b3ace83926210a3e10c0b23bdc7c5d28710977bd9f7c507628f2748e1467e753fe3a4d541623d9f989b1948b01a0dc1eb47f9af29fb77bc9396408bc334aa8c9aa090d773b7a09a9641d2cf2caa8cc0b6a867990261adfc5f000d390c4b68828807680bd9c35a954a7ef6bf55d43049dd2c22a9507448c0a45c3ff8bf979a3cf70c849e8ddbbfbc180a6b2bc763f41bf852588c4e4a9a222d20c7f2f13e628c5d5dd917791493e4dca5b365ad95e5cce92d905e9695835da3f48c76b9b175f2853553466224f620528b7fe05cbbf9f940f92abf9476807f53e021407bdf3c4ed2bad04995116ecdfc81f4d274634e01d9587f616f6c9e3b7e185fa84fa6c4cd2b948214c62de714f8c256a837038cf34993c71fdb2de91051e1c0492a74c4e26d17c93c669b5a9b48ed3b032e6fb68538c23f2ee4bab4afe8868e6ec4ef72eb6a6053f94a7377405ffab268e20508a33f65f28481a49fae831c2ca4662834ff3e417b2f9a239c597dd0baf0dfe867bfa1c17bc2fd94b193160e81b1ccd9d7a1b5e45e1cf7a7b91cca2dd9d3c4863318e6150c0cdee450e854bc97c685d070bf5985d53f6d1bd41adfc733d5f90009477b7dd9f968b984f1c9608e58fb03587da752ccc0bd8ea97602afed0ef506d1e7cce5030e1aaf4a1e77b3d8d74519b1a3ee4b3097e695326b1e246c711a44cbc2c37a7c1d167cd95c32fcb97cd33dc55deaeb0b6e81c938d8cfff7643bab132667b32cf6547509a3a17e2aff522915b1d9cb8acb78c6cd5569154fbb85d1d90df53e8b63f6d41ec500620fb37cb5c68f60341b01ab2f2764fc418868747a450c982dc892576fc1c37d352b5b847902a53dd0de884e6914881bb8e40ea6c2cfbbb0fd6bc5526602afee8a5189c365e5ea6a24596bd253b34492f2f5632cbd99bc2e9af9387186f644db30bb89d076e13ceb976ec7fc47f7fe62a278bc47111912668c11fd8a11b17341aec0140216282924ee389b3bcc24fce6fbf20e32d2b4d35aacafb1c35064e4ed341a7ada59042c8f3508490ead96c6329e3df9f3b3a34aaf547d77fe181b75f8be5165eb07dd129209c92f532aa61b501e6626612b90aae8b7b4aa2030527dccc5c7630f52fa3b89bce7831893e71edc696c20cb11c8a9c16c778402e0dec2837b3957698996b639a23314c50dc0ee9d1fbf2709b1a5e414f82a22087512ef56724c1d62e0b727c5e04f04f535d1115f929fbedbbd48373e6a52dc4b2d0a29a637bd86a5e300f68d3d91223f080fc72eb24a8470cece39669e2747a78daea1ccfbd9e1b213ec405223da8defa8fb0c34766739aa310115234acfa6d24642d020356cbf2eca511cf67e3f0b9fb3d759505d5dde02888212354caa686476d5665ddf170ecbd04cd021908e6f3c3ee23197bad156b34d9a929dd005d63753ac2c01fc1a96470abfa8e2fcb86459ab69b9727bfba105ebac44ca7f995faaeb69b2a168f3f5d6a6a36b101573c0830ad7b2a8bba6a6b37c617709e9fdd92e1d35ce8a19e6d082563bf79e8475e5fd660780a4da425b0bb635c2edd164148c9293840e58b77c6ad6078492d5af024eac029fef4de677b876172eeae2d69389fee9728f7a91f1d7e17f11f2c935dba30872634ef5f343687ef1062508a188064ddd00293e75c74a474e3e6d71afc266dee2aae345645e5c0720747e1ab621eda16c68316fd1eba2acd63ef5f1c30e1ff6de5e9914340371fe76121a624391619263b5e3a1d71133e872fc469ea88ccc17bb7859534233cc558c7b6b1ad8fff62273bd624344b1dd947a8629fca7f21e2f421ece7ab851a7601d1634f4ea32861b2ebb68328ffdb72e14d123030ac52bdfd850bea36736c88b7a0e17bfd73710f7efb4f6c326710fb7a8e0ac1232fc76c4d3686cc803ea9435a0db5c0bfc640e08ebf04ef6302d52d8d8d7ccb6f0b73f22adf392747f1897fb80f03c577fdf429129cf65a6a0e5caa2b190ebc265ef37611db5ebfbab5d03909b408e7a5d38bc71caf5ee785d6ccd0f352aa8682d7685c72c6a2fd8657f78e02b53369793a84789ce491d2f52d74f132ee654cd1fbb67bec2cc0ac11eada8eae414a948ce1e2b1a107496569ae9f682e5035fab847299716992683e2657e00221d99a6dd6500a6ac988743334f457a8a5eeaf3598b898e12eb833c98cfee2deb99dc0e9a38a38510f62443b39e71bf87d139473f089f65d647f08c600828649405a1ddd7b7f4c0136262fc5b23317056babae962f03760329777fc819e9be9a5a36c0b1e86a5012e0e564775e4ae543ee83d80470561f67c25e7c4aa73608ff1da3476616aba2a8e55f6c966a55cf4b669105a017f2da1a53c28b0c5d64622c19bb8ad9ab940c6d3f97dfc2dc3db34f9829d4f4504aaeb4027fc020d3591302c2130c0c7cba09295b3ac2d744c0558074ce28e599e2544a19ad8703a71b4d564219d92b60a9ba413142369cc2e69f280ce6eddf2461169d8d6f7a89a9f358e7890a1c01239ab0767182c0ddf5609f2e408f5b3a304d3efd05bcddd88190fb881d23f96567866a0559501805b52fabb90daf9f83f7b37106bfa876883ebbd5921a8775e805622c5a135810dfe7447b094596e8b65a3796f7799f7961f97e98a380c6b677861525f9c09bcab479e77e2910742378a3f6999231bf602cc8f5aaf26a1388b246f6614e133a90fc485e641dd040a6522b327b8af993f2c3dd22e139597e50dce738fac9df4a85b17d5d2c0b1cc5ddbdd61268efd59c6fd3bd6063541ae425c1686e538ab45166004e2631fbea9eda0cc3abdca72cedbf41ffecbbd670b115a8b4dc737e197f5437f961be0ef73ddc4f1a980ac8071d4de1e9c6872a688b513b17d0e2e1936bd7c7e666f28e0231623977b961ecd0a15b265d7e50ca817716fee287c6fd3622ec30afc0b42a6e71e11920df452cd1542126a35e1a8fcdb6f85da212dd918b45ff1162253eba957a330", 0x99d}], 0x1, &(0x7f000002a000)=[]}, 0x0) 2018/02/20 00:06:42 executing program 6: mkdir(&(0x7f0000639000)='./file0\x00', 0x0) r0 = creat(&(0x7f0000df1000)='./file0/bus\x00', 0x0) fcntl$lock(r0, 0x7, &(0x7f0000027000)={0x1}) unshare(0x40600) fcntl$lock(r0, 0x7, &(0x7f0000876000)={0x1}) r1 = gettid() timer_create(0x0, &(0x7f000083afa0)={0x0, 0x12, 0x0, @tid}, &(0x7f0000fd7000)) timer_settime(0x0, 0x0, &(0x7f0000d07000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x0, 0x32, 0xffffffffffffffff, 0x0) tkill(r1, 0x1000000000016) 2018/02/20 00:06:42 executing program 0: r0 = syz_open_procfs(0x0, &(0x7f0000314f8c)="6d6f756e74696e666f004388f750c83d14c4a3a9ac1488a477660ae763891738ac656bb3e891941f02f1265047502f6c2dd9f655ef7131eabf3110d638f0d2e6a49a2bc4a08d63e2da7af47e6c37972352875f125bcf3ea7f04b7b505b6a06beedb2a86e30a86bc0d37a6438b99a45ea22b1f4fb") open(&(0x7f0000000000)='./file0\x00', 0xc0, 0x0) mount(&(0x7f0000f28ff8)='./file0\x00', &(0x7f0000f89ff8)='./file0\x00', &(0x7f0000fb2ffd)='\x00v\t', 0x3000, &(0x7f00000b2000)) readv(r0, &(0x7f000005a000)=[{&(0x7f0000d1d000)=""/203, 0x52e}], 0x1) mount(&(0x7f00007ffff2)='./file0/file0\x00', &(0x7f00007fb000)='./file0\x00', &(0x7f0000c06000)='mqueue\x00', 0x20, &(0x7f0000d1cfff)="d6") 2018/02/20 00:06:42 executing program 2: syz_open_dev$random(&(0x7f0000009000)='/dev/random\x00', 0x0, 0x0) syz_open_dev$sg(&(0x7f00000b9ff7)='/dev/sg#\x00', 0x0, 0x204800) epoll_create1(0x0) pselect6(0x40, &(0x7f0000f33fc0), &(0x7f0000768000), &(0x7f0000086000), &(0x7f0000349000), &(0x7f0000f14000)={&(0x7f0000a65ff8), 0x8}) 2018/02/20 00:06:42 executing program 5: pipe2(&(0x7f0000000ff8)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$DRM_IOCTL_RM_MAP(0xffffffffffffffff, 0x4028641b, &(0x7f0000b1d000)={&(0x7f0000a93000/0x3000)=nil, 0x20000002, 0x0, 0x0, &(0x7f0000b1c000/0x4000)=nil}) mprotect(&(0x7f0000b1d000/0x2000)=nil, 0x2000, 0x5) vmsplice(r0, &(0x7f0000000180)=[{&(0x7f0000000040)}, {&(0x7f0000001000)="c0", 0x1}], 0x2, 0x0) vmsplice(r0, &(0x7f0000b1d000)=[{&(0x7f0000005fe3)}], 0x1, 0x0) 2018/02/20 00:06:42 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000058000)={0xffffffffffffffff, 0xffffffffffffffff}) shutdown(r0, 0x0) 2018/02/20 00:06:42 executing program 5: pipe2(&(0x7f0000000ff8)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$DRM_IOCTL_RM_MAP(0xffffffffffffffff, 0x4028641b, &(0x7f0000b1d000)={&(0x7f0000a93000/0x3000)=nil, 0x20000002, 0x0, 0x0, &(0x7f0000b1c000/0x4000)=nil}) mprotect(&(0x7f0000b1d000/0x2000)=nil, 0x2000, 0x5) vmsplice(r0, &(0x7f0000000180)=[{&(0x7f0000000040)}, {&(0x7f0000001000)="c0", 0x1}], 0x2, 0x0) vmsplice(r0, &(0x7f0000b1d000)=[{&(0x7f0000005fe3)}], 0x1, 0x0) [ 37.757001] sock: process `syz-executor7' is using obsolete getsockopt SO_BSDCOMPAT [ 37.788442] SELinux: unknown mount option [ 37.798515] SELinux: unknown mount option 2018/02/20 00:06:42 executing program 3: r0 = syz_open_dev$sndseq(&(0x7f0000b39000)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r0, 0xc08c5332, &(0x7f0000b0bf74)={0x0, 0x0, 0x0, 'queue0\x00'}) r1 = memfd_create(&(0x7f000003e000)='\'', 0x0) r2 = syz_open_dev$sndseq(&(0x7f0000d82000)='/dev/snd/seq\x00', 0x0, 0x0) r3 = dup2(r2, r1) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(0xffffffffffffffff, 0x40605346, &(0x7f000013e000)={0x0, 0x0, {0x0, 0x1}}) 2018/02/20 00:06:42 executing program 1: setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x0, &(0x7f00007b1000), 0x4) r0 = gettid() sched_getattr(r0, &(0x7f0000784fd0), 0x30, 0x0) 2018/02/20 00:06:42 executing program 0: openat$hwrng(0xffffffffffffff9c, &(0x7f000081cff5)='/dev/hwrng\x00', 0x801, 0x0) 2018/02/20 00:06:42 executing program 5: pipe2(&(0x7f0000000ff8)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$DRM_IOCTL_RM_MAP(0xffffffffffffffff, 0x4028641b, &(0x7f0000b1d000)={&(0x7f0000a93000/0x3000)=nil, 0x20000002, 0x0, 0x0, &(0x7f0000b1c000/0x4000)=nil}) mprotect(&(0x7f0000b1d000/0x2000)=nil, 0x2000, 0x5) vmsplice(r0, &(0x7f0000000180)=[{&(0x7f0000000040)}, {&(0x7f0000001000)="c0", 0x1}], 0x2, 0x0) vmsplice(r0, &(0x7f0000b1d000)=[{&(0x7f0000005fe3)}], 0x1, 0x0) 2018/02/20 00:06:42 executing program 7: r0 = openat$selinux_member(0xffffffffffffff9c, &(0x7f000006a000)='/selinux/member\x00', 0x2, 0x0) write$selinux_access(r0, &(0x7f0000ad3fcb)={'system_u:object_r:insmod_exec_t:-0', 0x20, '/sbin/dhclient', 0x20}, 0x35) 2018/02/20 00:06:42 executing program 4: unshare(0x8000400) r0 = mq_open(&(0x7f0000000000)='*GPL[vmnet1@vmnet1{-vmnet@vboxnet0!vboxnet1+M\x00', 0x6e93ebbbcc0884ef, 0x0, &(0x7f0000664fc0)={0x0, 0x7, 0x2}) r1 = epoll_create(0x1f) r2 = fcntl$dupfd(r1, 0x0, r0) getdents64(r2, &(0x7f00001e0fbc)=""/68, 0x44) 2018/02/20 00:06:42 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000fef000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$int_in(r1, 0x5452, &(0x7f0000866ff8)=0x80000001) setsockopt$sock_int(r1, 0x1, 0x7, &(0x7f0000387000), 0x4) sendmmsg$unix(r1, &(0x7f00000bd000)=[], 0x80, 0x0) close(r0) 2018/02/20 00:06:42 executing program 6: r0 = socket$inet(0x2, 0xa, 0x0) connect$unix(r0, &(0x7f00008f9ff8)=@abs, 0x8) 2018/02/20 00:06:42 executing program 1: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f00000d7000)={0xa, 0xffffffffffffffff, 0x0, @mcast2={0xff, 0x5, [], 0x1}}, 0x1c) 2018/02/20 00:06:42 executing program 5: pipe2(&(0x7f0000000ff8)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$DRM_IOCTL_RM_MAP(0xffffffffffffffff, 0x4028641b, &(0x7f0000b1d000)={&(0x7f0000a93000/0x3000)=nil, 0x20000002, 0x0, 0x0, &(0x7f0000b1c000/0x4000)=nil}) mprotect(&(0x7f0000b1d000/0x2000)=nil, 0x2000, 0x5) vmsplice(r0, &(0x7f0000000180)=[{&(0x7f0000000040)='W', 0x1}], 0x1, 0x0) vmsplice(r0, &(0x7f0000b1d000)=[{&(0x7f0000005fe3)}], 0x1, 0x0) 2018/02/20 00:06:42 executing program 3: r0 = syz_open_dev$sndseq(&(0x7f0000b39000)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r0, 0xc08c5332, &(0x7f0000b0bf74)={0x0, 0x0, 0x0, 'queue0\x00'}) r1 = memfd_create(&(0x7f000003e000)='\'', 0x0) r2 = syz_open_dev$sndseq(&(0x7f0000d82000)='/dev/snd/seq\x00', 0x0, 0x0) r3 = dup2(r2, r1) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r3, 0x40605346, &(0x7f000013e000)) 2018/02/20 00:06:42 executing program 7: mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x0, 0xffffffffffffffff, 0x0) syz_open_dev$evdev(&(0x7f0000000fee)='/dev/input/event#\x00', 0x2, 0x4000) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$key(0xf, 0x3, 0x2) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000004000/0xffb000)=nil, 0xffb000, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f0000aba000)={&(0x7f0000791000)={0x10}, 0xc, &(0x7f0000e2a000)={&(0x7f0000831000)={0x14, 0x1, 0xa, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, {}, []}, 0x14}, 0x1}, 0x0) 2018/02/20 00:06:42 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_int(r0, 0x29, 0x11, &(0x7f0000f89000)=0x690, 0x4) 2018/02/20 00:06:42 executing program 5: pipe2(&(0x7f0000000ff8)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$DRM_IOCTL_RM_MAP(0xffffffffffffffff, 0x4028641b, &(0x7f0000b1d000)={&(0x7f0000a93000/0x3000)=nil, 0x20000002, 0x0, 0x0, &(0x7f0000b1c000/0x4000)=nil}) mprotect(&(0x7f0000b1d000/0x2000)=nil, 0x2000, 0x5) vmsplice(r0, &(0x7f0000000180)=[{&(0x7f0000000040)='W', 0x1}], 0x1, 0x0) vmsplice(r0, &(0x7f0000b1d000)=[{&(0x7f0000005fe3)}], 0x1, 0x0) 2018/02/20 00:06:42 executing program 0: r0 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r0, &(0x7f0000b43000)={0x2, 0x0, @empty}, 0x6e) sendto$inet(r0, &(0x7f0000d38f95), 0x0, 0x0, &(0x7f0000fa2000)={0x2, 0x0, @empty}, 0x10) recvmmsg(r0, &(0x7f000049afc0)=[{{&(0x7f00003abff0)=@llc={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @dev}, 0x10, &(0x7f0000247000)=[], 0x0, &(0x7f000056afbe)=""/66, 0x42}}], 0x1, 0x20, 0x0) 2018/02/20 00:06:42 executing program 1: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000024ff8)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$sock_int(r0, 0x1, 0x22, &(0x7f0000013ffc)=0x8, 0x4) 2018/02/20 00:06:42 executing program 3: r0 = socket$key(0xf, 0x3, 0x2) readv(r0, &(0x7f0000049000)=[{&(0x7f0000af5000)=""/4096, 0x1000}], 0x1) sendmsg$key(r0, &(0x7f000010bfc8)={0x0, 0x0, &(0x7f0000a8fff0)={&(0x7f0000e16000)={0x2, 0xb, 0x0, 0x1, 0x2, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, []}, 0x10}, 0x1}, 0x0) 2018/02/20 00:06:42 executing program 5: pipe2(&(0x7f0000000ff8)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$DRM_IOCTL_RM_MAP(0xffffffffffffffff, 0x4028641b, &(0x7f0000b1d000)={&(0x7f0000a93000/0x3000)=nil, 0x20000002, 0x0, 0x0, &(0x7f0000b1c000/0x4000)=nil}) mprotect(&(0x7f0000b1d000/0x2000)=nil, 0x2000, 0x5) vmsplice(r0, &(0x7f0000000180)=[{&(0x7f0000000040)='W', 0x1}], 0x1, 0x0) vmsplice(r0, &(0x7f0000b1d000)=[{&(0x7f0000005fe3)}], 0x1, 0x0) [ 37.859558] syz-executor6 uses obsolete (PF_INET,SOCK_PACKET) [ 37.883508] ALSA: seq fatal error: cannot create timer (-22) 2018/02/20 00:06:42 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000001000)='/dev/sg#\x00', 0x0, 0x2) ppoll(&(0x7f0000e9cfd0)=[{r0}], 0x1, &(0x7f000012fff8)={0x77359400}, &(0x7f0000aa1ff8), 0x8) ioctl(r0, 0x2283, &(0x7f0000826fff)='g') write$evdev(r0, &(0x7f0000093000)=[{{0x77359400}}, {}, {}, {{0x77359400}}, {}, {{0x77359400}}], 0x90) 2018/02/20 00:06:42 executing program 1: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000064fe4)={&(0x7f0000bd7ff4)={0x10}, 0xc, &(0x7f0000d0cff8)={&(0x7f0000ec9fec)={0x14, 0x0, 0xfffffffffffffffd, 0xfffffffffffffffb, 0xffffffffffffffff, 0xffffffffffffffff, {}, []}, 0x14}, 0x1}, 0x0) 2018/02/20 00:06:42 executing program 4: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000001000)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$lock(r0, 0x7, &(0x7f0000002000)={0x1, 0x0, 0x0, 0x8}) fcntl$lock(r0, 0x7, &(0x7f00008c4000)={0x0, 0x0, 0xdb}) 2018/02/20 00:06:42 executing program 5: pipe2(&(0x7f0000000ff8)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$DRM_IOCTL_RM_MAP(0xffffffffffffffff, 0x4028641b, &(0x7f0000b1d000)={&(0x7f0000a93000/0x3000)=nil, 0x20000002, 0x0, 0x0, &(0x7f0000b1c000/0x4000)=nil}) mprotect(&(0x7f0000b1d000/0x2000)=nil, 0x2000, 0x5) vmsplice(r0, &(0x7f0000000180)=[{&(0x7f0000000040)='W', 0x1}], 0x1, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000b1d000)=[{&(0x7f0000005fe3)}], 0x1, 0x0) 2018/02/20 00:06:42 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000007ff7)='/dev/sg#\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x59000)=nil, 0x59000, 0x0, 0x32, 0xffffffffffffffff, 0x0) ioctl(r0, 0x2283, &(0x7f0000007000)) 2018/02/20 00:06:42 executing program 6: r0 = syz_open_procfs(0x0, &(0x7f0000b6cff6)='net/udp\x00') r1 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r1, &(0x7f0000f15ff0)={0x2, 0xffffffffffffffff, @rand_addr}, 0x10) r2 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_int(r2, 0x29, 0x1a, &(0x7f000004c000)=0x23, 0x4) bind$inet6(r2, &(0x7f0000f13000)={0xa, 0x2, 0x0, @empty}, 0x1c) preadv(r0, &(0x7f0000331000)=[{&(0x7f0000723f20)=""/127, 0xfd4a}], 0x1, 0x0) 2018/02/20 00:06:42 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) recvmsg(r0, &(0x7f0000000000)={&(0x7f0000001000)=@pppol2tpv3in6={0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, @dev}}}, 0x3a, &(0x7f0000001000)=[], 0x0, &(0x7f0000001000)=""/127, 0x7f}, 0x40002042) 2018/02/20 00:06:42 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r2, &(0x7f000000e000)={0x2, 0x0, @multicast2=0xe0000002}, 0x10) setsockopt$sock_int(r2, 0x1, 0xf, &(0x7f0000015000)=0x4, 0x4) bind$inet(r1, &(0x7f0000011ff0)={0x2, 0x0, @broadcast=0xffffffff}, 0x10) listen(r0, 0x0) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000006000)=@syzn={0x73, 0x79, 0x7a, 0x0}, 0x10) listen(r2, 0x0) 2018/02/20 00:06:42 executing program 7: socketpair$unix(0x1, 0x5, 0x0, &(0x7f000001a000)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000ab9ff0)={0x2, &(0x7f000039a000)=[{0x20, 0x0, 0x0, 0xfffffffffffff004}, {0x6}]}, 0x8) 2018/02/20 00:06:42 executing program 5: pipe2(&(0x7f0000000ff8)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$DRM_IOCTL_RM_MAP(0xffffffffffffffff, 0x4028641b, &(0x7f0000b1d000)={&(0x7f0000a93000/0x3000)=nil, 0x20000002, 0x0, 0x0, &(0x7f0000b1c000/0x4000)=nil}) mprotect(&(0x7f0000b1d000/0x2000)=nil, 0x2000, 0x5) vmsplice(r0, &(0x7f0000000180)=[{&(0x7f0000000040)='W', 0x1}], 0x1, 0x0) vmsplice(r0, &(0x7f0000b1d000)=[], 0x0, 0x0) 2018/02/20 00:06:42 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$unix(0x1, 0x1, 0x0) r1 = socket$unix(0x1, 0x1, 0x0) bind$unix(r1, &(0x7f0000366000)=@file={0x1, "e91f7189591e9233614b"}, 0xc) listen(r1, 0x0) connect$unix(r0, &(0x7f0000932000)=@file={0x1, "e91f7189591e9233614b"}, 0xc) connect(r0, &(0x7f0000931ff4)=@un=@file={0x1, "e91f7189591e9233614b"}, 0xc) shutdown(r1, 0x0) r2 = gettid() socketpair$unix(0x1, 0x1000000005, 0x0, &(0x7f000087fff8)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$int_in(r3, 0x5452, &(0x7f0000b3b000)=0x3f) fcntl$setsig(r3, 0xa, 0x12) fcntl$setownex(r3, 0xf, &(0x7f00000ff000)={0x0, r2}) recvmsg(r4, &(0x7f0000172fc8)={&(0x7f0000b3aff8)=@sco, 0x8, &(0x7f00000a4fb0)=[], 0x0, &(0x7f0000b36000)}, 0x0) dup2(r3, r4) r5 = gettid() tkill(r5, 0x16) 2018/02/20 00:06:42 executing program 1: r0 = socket(0x10, 0x3, 0x0) r1 = syz_open_dev$tun(&(0x7f00006f2ff3)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFINDEX(r1, 0x400454da, &(0x7f0000316000)=0x101) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000533000)={@generic="02000000040000000004008000e9bc22", @ifru_settings={0x10001, 0x0, @raw_hdlc=&(0x7f00008a6ffc)}}) write(r0, &(0x7f0000fd3000)="260000005e0009000000eaf83a000000000000000100006705ffff001e08db00e9ff4435eade", 0x26) 2018/02/20 00:06:42 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000004000)={0x4, 0x0, &(0x7f000000cf90)=[@enter_looper={0x630c}], 0x0, 0x0, &(0x7f0000005000)}) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007fd0)={0x0, 0x0, &(0x7f0000004000)=[], 0x48, 0x0, &(0x7f000000d000)="62164b44a5c310affb2298c023c7036e8915400419dae89cc59e3878ffffff00000000f7d7000003000000070718d1fc0e41a052600c828100000000000000bf244f0f2cc508303a"}) r1 = mmap$binder(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x0, 0x12, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f0000002000)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002fd0)={0xc, 0x0, &(0x7f0000004f98)=[@free_buffer={0x40086303, r1}], 0x0, 0x0, &(0x7f0000002000)}) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) [ 38.196240] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=94 sclass=netlink_route_socket [ 38.208243] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=94 sclass=netlink_route_socket [ 38.219299] binder: release 5605:5611 transaction 6 in, still active [ 38.225816] binder: send failed reply for transaction 6 to 5605:5613 [ 38.233599] binder: BINDER_SET_CONTEXT_MGR already set [ 38.238963] binder: 5605:5613 ioctl 40046207 0 returned -16 [ 38.248002] binder: 5605:5617 BC_FREE_BUFFER u0000000020000000 no match [ 38.248145] binder_alloc: 5605: binder_alloc_buf, no vma [ 38.248179] binder: 5605:5613 transaction failed 29189/-3, size 0-0 line 3128 [ 38.271477] binder: undelivered TRANSACTION_ERROR: 29189 [ 38.280273] binder: undelivered TRANSACTION_COMPLETE [ 38.285429] binder: undelivered TRANSACTION_ERROR: 29189 2018/02/20 00:06:43 executing program 0: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000005fc8)={&(0x7f0000005000)=@in={0x2, 0xffffffffffffffff, @dev={0xac, 0x14}}, 0x10, &(0x7f0000000000)=[], 0x0, &(0x7f0000002000)=[{0x10, 0x1, 0x1}], 0x10}, 0x0) 2018/02/20 00:06:43 executing program 6: r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_ifreq(r0, 0x89f0, &(0x7f0000009000)={@common='sit0\x00', @ifru_data=&(0x7f0000007fe0)="6b6be70000000070000d00a472ca66ee00000000bc0c8941c13f06b4cb9d3cb0"}) 2018/02/20 00:06:43 executing program 7: r0 = syz_open_dev$loop(&(0x7f00001f2000)='/dev/loop#\x00', 0x0, 0xc00) ioctl(r0, 0x440000000000127f, &(0x7f0000af4000)) 2018/02/20 00:06:43 executing program 5: pipe2(&(0x7f0000000ff8)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$DRM_IOCTL_RM_MAP(0xffffffffffffffff, 0x4028641b, &(0x7f0000b1d000)={&(0x7f0000a93000/0x3000)=nil, 0x20000002, 0x0, 0x0, &(0x7f0000b1c000/0x4000)=nil}) mprotect(&(0x7f0000b1d000/0x2000)=nil, 0x2000, 0x5) vmsplice(r0, &(0x7f0000000180)=[{&(0x7f0000000040)='W', 0x1}], 0x1, 0x0) vmsplice(r0, &(0x7f0000b1d000)=[], 0x0, 0x0) 2018/02/20 00:06:43 executing program 2: r0 = socket$inet6(0xa, 0x8000000000000802, 0x0) bind$inet6(r0, &(0x7f000015c000)={0xa, 0x0, 0x0, @empty}, 0x1c) r1 = socket$inet6(0xa, 0x2, 0x0) sendto$inet6(r1, &(0x7f0000252f1d), 0x0, 0x0, &(0x7f0000f5afe4)={0xa, 0x0, 0x0, @empty}, 0x1c) sendmsg$inet_sctp(r0, &(0x7f0000a29000)={&(0x7f0000685ff0)=@in={0x2, 0x0, @empty}, 0x10, &(0x7f0000fc6fa0)=[]}, 0x8000) setsockopt$inet6_udp_int(r0, 0x11, 0x1, &(0x7f00009f0ffc), 0x4) 2018/02/20 00:06:43 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000004000)={0x4, 0x0, &(0x7f000000cf90)=[@enter_looper={0x630c}], 0x0, 0x0, &(0x7f0000005000)}) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007fd0)={0x0, 0x0, &(0x7f0000004000)=[], 0x48, 0x0, &(0x7f000000d000)="62164b44a5c310affb2298c023c7036e8915400419dae89cc59e3878ffffff00000000f7d7000003000000070718d1fc0e41a052600c828100000000000000bf244f0f2cc508303a"}) r1 = mmap$binder(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x0, 0x12, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f0000002000)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002fd0)={0xc, 0x0, &(0x7f0000004f98)=[@free_buffer={0x40086303, r1}], 0x0, 0x0, &(0x7f0000002000)}) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) 2018/02/20 00:06:43 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000004000)={0x4, 0x0, &(0x7f000000cf90)=[@enter_looper={0x630c}], 0x0, 0x0, &(0x7f0000005000)}) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007fd0)={0x0, 0x0, &(0x7f0000004000)=[], 0x48, 0x0, &(0x7f000000d000)="62164b44a5c310affb2298c023c7036e8915400419dae89cc59e3878ffffff00000000f7d7000003000000070718d1fc0e41a052600c828100000000000000bf244f0f2cc508303a"}) r1 = mmap$binder(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x0, 0x12, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f0000002000)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002fd0)={0xc, 0x0, &(0x7f0000004f98)=[@free_buffer={0x40086303, r1}], 0x0, 0x0, &(0x7f0000002000)}) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) 2018/02/20 00:06:43 executing program 1: r0 = socket(0x10, 0x3, 0x0) r1 = syz_open_dev$tun(&(0x7f00006f2ff3)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFINDEX(r1, 0x400454da, &(0x7f0000316000)=0x101) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000533000)={@generic="02000000040000000004008000e9bc22", @ifru_settings={0x10001, 0x0, @raw_hdlc=&(0x7f00008a6ffc)}}) write(r0, &(0x7f0000fd3000)="260000005e0009000000eaf83a000000000000000100006705ffff001e08db00e9ff4435eade", 0x26) 2018/02/20 00:06:43 executing program 5: pipe2(&(0x7f0000000ff8)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$DRM_IOCTL_RM_MAP(0xffffffffffffffff, 0x4028641b, &(0x7f0000b1d000)={&(0x7f0000a93000/0x3000)=nil, 0x20000002, 0x0, 0x0, &(0x7f0000b1c000/0x4000)=nil}) mprotect(&(0x7f0000b1d000/0x2000)=nil, 0x2000, 0x5) vmsplice(r0, &(0x7f0000000180)=[{&(0x7f0000000040)='W', 0x1}], 0x1, 0x0) vmsplice(r0, &(0x7f0000b1d000)=[], 0x0, 0x0) 2018/02/20 00:06:43 executing program 0: fstat(0xffffffffffffffff, &(0x7f0000001fbc)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) lstat(&(0x7f0000002000)='./file0\x00', &(0x7f0000000fbc)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) setregid(r0, r1) 2018/02/20 00:06:43 executing program 6: r0 = socket$inet6(0xa, 0x802, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000bbeff4)={0x400000000002000}) shutdown(r0, 0x0) ppoll(&(0x7f0000bc0fd0)=[{r1}], 0x1, &(0x7f0000c03ff0), &(0x7f0000a1bff8), 0x8) 2018/02/20 00:06:43 executing program 2: r0 = socket$inet6(0xa, 0x8000000000000802, 0x0) bind$inet6(r0, &(0x7f000015c000)={0xa, 0x0, 0x0, @empty}, 0x1c) r1 = socket$inet6(0xa, 0x2, 0x0) sendto$inet6(r1, &(0x7f0000252f1d), 0x0, 0x0, &(0x7f0000f5afe4)={0xa, 0x0, 0x0, @empty}, 0x1c) sendmsg$inet_sctp(r0, &(0x7f0000a29000)={&(0x7f0000685ff0)=@in={0x2, 0x0, @empty}, 0x10, &(0x7f0000fc6fa0)=[]}, 0x8000) setsockopt$inet6_udp_int(r0, 0x11, 0x1, &(0x7f00009f0ffc), 0x4) 2018/02/20 00:06:43 executing program 7: rename(&(0x7f0000057000)='./file0\x00', &(0x7f000000c000)='.') 2018/02/20 00:06:43 executing program 5: r0 = syz_open_procfs(0x0, &(0x7f0000024ff8)='net/tcp\x00') read(r0, &(0x7f000001ffbe)=""/174, 0xffffffffffffff8b) read$eventfd(r0, &(0x7f0000008ff8), 0x57a) 2018/02/20 00:06:43 executing program 0: r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_mtu(r0, 0x0, 0xa, &(0x7f0000dfcffc)=0x3, 0x4) sendto$inet(r0, &(0x7f0000ed6fcd), 0x0, 0x400c000, &(0x7f000083b000)={0x2, 0x2, @empty}, 0x10) r1 = syz_open_procfs(0x0, &(0x7f0000011000)='net/udp\x00') sendfile(r0, r1, &(0x7f0000493000), 0x100ff) [ 38.794442] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=94 sclass=netlink_route_socket [ 38.812319] binder: release 5625:5631 transaction 9 in, still active [ 38.822612] binder: send failed reply for transaction 9 to 5625:5638 [ 38.828225] binder: BINDER_SET_CONTEXT_MGR already set [ 38.828234] binder: 5634:5637 ioctl 40046207 0 returned -16 2018/02/20 00:06:43 executing program 6: r0 = socket(0x11, 0x8020400000000803, 0x0) bind(r0, &(0x7f0000ed6f80)=@generic={0x11, "0000010000000000080044944eeba71a496ae252922cb18f722e2ada000000012e0b3836005404b0e00100000014f26effffffffffffff67b100800000000000000101013c5804459e15775027ecce66fd792bbf0e5bf5ff1b080000dad11c000100fff6000000004974000000030000000000000000076d3a09ffc2c654"}, 0x80) sendmsg$key(r0, &(0x7f000090b000)={0x0, 0x0, &(0x7f0000250ff0)={&(0x7f00007d2000)={0x2, 0x0, 0x0, 0x0, 0x2, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, []}, 0xfda9}, 0x1}, 0x0) 2018/02/20 00:06:43 executing program 5: r0 = syz_open_procfs(0x0, &(0x7f0000024ff8)='net/tcp\x00') read(r0, &(0x7f000001ffbe)=""/174, 0xffffffffffffff8b) read$eventfd(r0, &(0x7f0000008ff8), 0x57a) 2018/02/20 00:06:43 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000004000)={0x4, 0x0, &(0x7f000000cf90)=[@enter_looper={0x630c}], 0x0, 0x0, &(0x7f0000005000)}) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007fd0)={0x0, 0x0, &(0x7f0000004000)=[], 0x48, 0x0, &(0x7f000000d000)="62164b44a5c310affb2298c023c7036e8915400419dae89cc59e3878ffffff00000000f7d7000003000000070718d1fc0e41a052600c828100000000000000bf244f0f2cc508303a"}) r1 = mmap$binder(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x0, 0x12, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f0000002000)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002fd0)={0xc, 0x0, &(0x7f0000004f98)=[@free_buffer={0x40086303, r1}], 0x0, 0x0, &(0x7f0000002000)}) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) 2018/02/20 00:06:43 executing program 2: r0 = socket$inet6(0xa, 0x8000000000000802, 0x0) bind$inet6(r0, &(0x7f000015c000)={0xa, 0x0, 0x0, @empty}, 0x1c) r1 = socket$inet6(0xa, 0x2, 0x0) sendto$inet6(r1, &(0x7f0000252f1d), 0x0, 0x0, &(0x7f0000f5afe4)={0xa, 0x0, 0x0, @empty}, 0x1c) sendmsg$inet_sctp(r0, &(0x7f0000a29000)={&(0x7f0000685ff0)=@in={0x2, 0x0, @empty}, 0x10, &(0x7f0000fc6fa0)=[]}, 0x8000) setsockopt$inet6_udp_int(r0, 0x11, 0x1, &(0x7f00009f0ffc), 0x4) 2018/02/20 00:06:43 executing program 7: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000516ff0)={0x2, 0xffffffffffffffff, @rand_addr}, 0x10) [ 38.852664] binder: undelivered TRANSACTION_COMPLETE [ 38.857814] binder: undelivered TRANSACTION_ERROR: 29189 [ 38.866458] binder: 5634:5651 transaction failed 29189/-22, size 0-0 line 3005 [ 38.886507] binder: undelivered TRANSACTION_ERROR: 29189 2018/02/20 00:06:43 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x3, @broadcast=0xffffffff}, 0x10) sendto$inet(r0, &(0x7f0000fd0000), 0xfffffffffffffec1, 0x20000801, &(0x7f0000deaff0)={0x2, 0x3, @loopback=0x7f000001}, 0x10) clone(0x40000000, &(0x7f00008a2000), &(0x7f0000d6cffc), &(0x7f0000ca4000), &(0x7f0000ab5f60)) shutdown(r0, 0x1) 2018/02/20 00:06:43 executing program 5: mkdir(&(0x7f000000e000)='./control\x00', 0x0) mount(&(0x7f0000039000)='./control/file0\x00', &(0x7f0000041ff6)='./control\x00', &(0x7f000002fff9)='mqueue\x00', 0x0, &(0x7f0000041000)) r0 = open(&(0x7f0000021000)='./control\x00', 0x0, 0x0) mknodat(r0, &(0x7f0000008ff6)='./control\x00', 0x0, 0x0) 2018/02/20 00:06:43 executing program 2: r0 = socket$inet6(0xa, 0x8000000000000802, 0x0) bind$inet6(r0, &(0x7f000015c000)={0xa, 0x0, 0x0, @empty}, 0x1c) r1 = socket$inet6(0xa, 0x2, 0x0) sendto$inet6(r1, &(0x7f0000252f1d), 0x0, 0x0, &(0x7f0000f5afe4)={0xa, 0x0, 0x0, @empty}, 0x1c) sendmsg$inet_sctp(r0, &(0x7f0000a29000)={&(0x7f0000685ff0)=@in={0x2, 0x0, @empty}, 0x10, &(0x7f0000fc6fa0)=[]}, 0x8000) setsockopt$inet6_udp_int(r0, 0x11, 0x1, &(0x7f00009f0ffc), 0x4) 2018/02/20 00:06:43 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x3, @broadcast=0xffffffff}, 0x10) sendto$inet(r0, &(0x7f0000fd0000), 0xfffffffffffffec1, 0x20000801, &(0x7f0000deaff0)={0x2, 0x3, @loopback=0x7f000001}, 0x10) shutdown(r0, 0x1) ppoll(&(0x7f000030b000)=[{r1}], 0x1, &(0x7f0000143ff8), &(0x7f0000216000), 0x8) 2018/02/20 00:06:43 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000222000)='/dev/loop#\x00', 0x0, 0x181800) ioctl(r0, 0x4000000000001269, &(0x7f00001d6fff)) 2018/02/20 00:06:43 executing program 7: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f00005f5000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f000080e000)={0x2, 0xe, 0x0, 0x0, 0x14, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, [@sadb_address={0x5, 0x6, 0x0, 0x80, 0x0, @in6={0xa, 0xffffffffffffffff, 0x0, @empty}}, @sadb_x_policy={0x8, 0x12, 0x0, 0x2, 0x0, 0xffffffffffffffff, 0x0, {0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @in=@remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @in=@dev={0xac, 0x14}}}, @sadb_address={0x5, 0x5, 0x0, 0x80, 0x0, @in6={0xa, 0xffffffffffffffff, 0x0, @local={0xfe, 0x80, [], 0xffffffffffffffff, 0xaa}}}]}, 0xa0}, 0x1}, 0x0) sendmsg$key(r0, &(0x7f0000d17000)={0x0, 0x0, &(0x7f00007e1ff8)={&(0x7f0000243fd0)={0x2, 0x13, 0x0, 0x0, 0x2, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, []}, 0x10}, 0x1}, 0x0) 2018/02/20 00:06:43 executing program 6: mkdir(&(0x7f0000afbff8)='./file0\x00', 0x0) mount(&(0x7f000000a000)='./file0\x00', &(0x7f0000026ff8)='./file0\x00', &(0x7f000000c000)='ramfs\x00', 0x0, &(0x7f000032e000)) chdir(&(0x7f0000f95000)='./file0\x00') r0 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x2, 0x11, r0, 0x0) 2018/02/20 00:06:43 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000004000)={0x4, 0x0, &(0x7f000000cf90)=[@enter_looper={0x630c}], 0x0, 0x0, &(0x7f0000005000)}) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007fd0)={0x0, 0x0, &(0x7f0000004000)=[], 0x48, 0x0, &(0x7f000000d000)="62164b44a5c310affb2298c023c7036e8915400419dae89cc59e3878ffffff00000000f7d7000003000000070718d1fc0e41a052600c828100000000000000bf244f0f2cc508303a"}) r1 = mmap$binder(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x0, 0x12, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f0000002000)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000002fd0)={0xc, 0x0, &(0x7f0000004f98)=[@free_buffer={0x40086303, r1}], 0x0, 0x0, &(0x7f0000002000)}) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) [ 38.919905] binder: release 5653:5658 transaction 12 in, still active [ 38.926892] binder: send failed reply for transaction 12 to 5653:5665 [ 38.937153] binder: undelivered TRANSACTION_COMPLETE [ 38.943410] binder: undelivered TRANSACTION_ERROR: 29189 2018/02/20 00:06:43 executing program 2: r0 = socket$inet6(0xa, 0x8000000000000802, 0x0) bind$inet6(r0, &(0x7f000015c000)={0xa, 0x0, 0x0, @empty}, 0x1c) r1 = socket$inet6(0xa, 0x2, 0x0) sendto$inet6(r1, &(0x7f0000252f1d), 0x0, 0x0, &(0x7f0000f5afe4)={0xa, 0x0, 0x0, @empty}, 0x1c) setsockopt$inet6_udp_int(r0, 0x11, 0x1, &(0x7f00009f0ffc), 0x4) 2018/02/20 00:06:43 executing program 5: r0 = syz_open_dev$tun(&(0x7f0000000000)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f000000e000)={@syzn={0x73, 0x79, 0x7a}, @ifru_mtu=0x6}) 2018/02/20 00:06:43 executing program 2: r0 = socket$inet6(0xa, 0x8000000000000802, 0x0) bind$inet6(r0, &(0x7f000015c000)={0xa, 0x0, 0x0, @empty}, 0x1c) r1 = socket$inet6(0xa, 0x2, 0x0) sendto$inet6(r1, &(0x7f0000252f1d), 0x0, 0x0, &(0x7f0000f5afe4)={0xa, 0x0, 0x0, @empty}, 0x1c) setsockopt$inet6_udp_int(r0, 0x11, 0x1, &(0x7f00009f0ffc), 0x4) [ 39.043672] IPVS: Creating netns size=2552 id=9 [ 39.062048] binder: release 5676:5684 transaction 14 in, still active [ 39.069140] binder: send failed reply for transaction 14 to 5676:5694 [ 39.085928] binder: undelivered TRANSACTION_COMPLETE [ 39.091556] binder: undelivered TRANSACTION_ERROR: 29189 [ 39.107325] pktgen: kernel_thread() failed for cpu 0 [ 39.112688] pktgen: Cannot create thread for cpu 0 (-4) [ 39.118071] pktgen: kernel_thread() failed for cpu 1 [ 39.123294] pktgen: Cannot create thread for cpu 1 (-4) [ 39.128664] pktgen: Initialization failed for all threads [ 39.191201] kasan: CONFIG_KASAN_INLINE enabled [ 39.195629] kasan: GPF could be caused by NULL-ptr deref or user memory accessgeneral protection fault: 0000 [#1] PREEMPT SMP KASAN [ 39.208603] Dumping ftrace buffer: [ 39.212115] (ftrace buffer empty) [ 39.215809] Modules linked in: [ 39.219117] CPU: 1 PID: 5696 Comm: syz-executor1 Not tainted 4.4.115-g55a366596 #14 [ 39.226890] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 39.236215] task: ffff8800b2e43000 task.stack: ffff8801c4e48000 [ 39.242245] RIP: 0010:[] [] nfqnl_nf_hook_drop+0x190/0x3a0 [ 39.251185] RSP: 0018:ffff8801c4e4f998 EFLAGS: 00010202 [ 39.256619] RAX: 0000000000000007 RBX: 0000000000000003 RCX: ffffffff82f9d209 [ 39.263864] RDX: 0000000000010000 RSI: ffffc90000f7a000 RDI: ffffffff84418180 [ 39.271105] RBP: ffff8801c4e4f9c8 R08: 0000000000000000 R09: 0000000000000000 [ 39.278347] R10: ffffffff83844400 R11: 1ffff100389c9efe R12: dffffc0000000000 [ 39.285616] R13: ffff8801c6310368 R14: 0000000000000038 R15: 00000000000000b8 [ 39.292864] FS: 00007fafc7cfb700(0000) GS:ffff8801db300000(0000) knlGS:0000000000000000 [ 39.301070] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 39.306934] CR2: 00000000006fc274 CR3: 00000000aca42000 CR4: 0000000000160670 [ 39.314208] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 39.321464] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 39.328703] Stack: [ 39.330833] ffffffff82f9d180 ffffffff83cc6720 ffff8801c3d99e00 ffff8801c6310368 [ 39.338808] ffff8801c6310368 ffff8801c6310360 ffff8801c4e4f9f8 ffffffff82f950ce [ 39.346789] ffffffff82f95010 ffffffff843e37e0 ffff8801c3d9a8b8 dffffc0000000000 [ 39.354768] Call Trace: [ 39.357338] [] ? nfqnl_nf_hook_drop+0x100/0x3a0 [ 39.363631] [] nf_queue_nf_hook_drop+0xbe/0x1d0 [ 39.369925] [] ? nf_queue_entry_release_refs+0x150/0x150 [ 39.377000] [] nf_unregister_net_hook+0x2ab/0x350 [ 39.383463] [] netfilter_net_exit+0x40/0xb0 [ 39.389935] [] ? nf_unregister_net_hooks+0x60/0x60 [ 39.396488] [] ops_exit_list.isra.4+0xae/0x150 [ 39.403396] [] setup_net+0x221/0x3e0 [ 39.408734] [] ? ops_init+0x3a0/0x3a0 [ 39.414160] [] ? kasan_slab_alloc+0x12/0x20 [ 39.420120] [] copy_net_ns+0xd2/0x190 [ 39.425545] [] create_new_namespaces+0x2f6/0x610 [ 39.431923] [] copy_namespaces+0x291/0x320 [ 39.437781] [] ? copy_namespaces+0x3e/0x320 [ 39.443722] [] copy_process+0x1d98/0x6120 [ 39.449490] [] ? __cleanup_sighand+0x50/0x50 [ 39.455518] [] ? fput+0x20/0x150 [ 39.460506] [] ? SYSC_bind+0x1ad/0x280 [ 39.466022] [] ? kcov_close+0x20/0x20 [ 39.471445] [] ? move_addr_to_kernel.part.12+0x110/0x110 [ 39.478515] [] _do_fork+0x151/0xe00 [ 39.483763] [] ? fork_idle+0x270/0x270 [ 39.489284] [] ? do_futex+0x15d0/0x15d0 [ 39.494889] [] ? security_file_ioctl+0x89/0xb0 [ 39.501121] [] SyS_clone+0x37/0x50 [ 39.506286] [] entry_SYSCALL_64_fastpath+0x1c/0x98 [ 39.512845] Code: df 83 01 00 0f 84 d8 00 00 00 4d 8d 77 38 49 bc 00 00 00 00 00 fc ff df 49 81 c7 b8 00 00 00 e8 67 3b 3c fe 4c 89 f0 48 c1 e8 03 <42> 80 3c 20 00 0f 85 f4 01 00 00 49 8b 1e e8 7d 8c 2e fe 48 85 [ 39.539565] RIP [] nfqnl_nf_hook_drop+0x190/0x3a0 [ 39.546159] RSP [ 39.550048] ---[ end trace 599dcebc3891a284 ]--- [ 39.554791] Kernel panic - not syncing: Fatal exception [ 39.560585] Dumping ftrace buffer: [ 39.564103] (ftrace buffer empty) [ 39.567786] Kernel Offset: disabled [ 39.571382] Rebooting in 86400 seconds..