r3 = dup2(r1, r2) r4 = syz_open_dev$random(&(0x7f0000bdc000-0xc)='/dev/random\x00', 0x0, 0x0) dup2(r1, r4) ioctl$int_in(r3, 0x5452, &(0x7f0000e36000-0x8)=0x45) fcntl$setown(r1, 0x8, 0x0) fcntl$setsig(r4, 0xa, 0x12) r5 = gettid() tkill(r5, 0x100000000000016) 2018/02/01 16:22:32 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000fd6000-0x8)='./file0\x00', 0x0) mount(&(0x7f000000a000)='./file0\x00', &(0x7f0000027000-0x8)='./file0\x00', &(0x7f000000c000)='ramfs\x00', 0x0, &(0x7f000000a000)) mount(&(0x7f0000037000)='./file0\x00', &(0x7f0000c50000-0x8)='./file0\x00', &(0x7f000002f000-0x6)='ramfs\x00', 0x100000, &(0x7f0000ce3000)) mount(&(0x7f000052f000)='./file0\x00', &(0x7f00008fd000-0x1)='.', &(0x7f00003a3000-0x6)="00e2660000", 0x1000, 0x0) mount(&(0x7f00002ba000-0x8)='./file0\x00', &(0x7f0000cbf000-0x8)='./file0\x00', &(0x7f0000dcd000)='ramfs\x00', 0x80000, &(0x7f000002f000)) mount(&(0x7f00009b1000)='./file0\x00', &(0x7f0000ae7000-0x8)='./file0\x00', &(0x7f0000226000)='an\x00\x00\x00\x00\x00\x00\x00\afs\x00', 0x100000, &(0x7f0000b64000-0x1000)) open(&(0x7f00006a2000)='./file0\x00', 0x0, 0x0) mount(&(0x7f00001a5000-0xe)='./file0/file0\x00', &(0x7f00002fb000-0x8)='./file0/file0\x00', &(0x7f00002ba000)='\x00v\t', 0x1004, &(0x7f000073b000-0x1)) mount(&(0x7f00005e1000-0x8)='./file0\x00', &(0x7f0000df5000-0x8)='.', &(0x7f0000df4000)='%&t3\x00', 0x2000, &(0x7f00003db000-0x23)) 2018/02/01 16:22:32 executing program 2: 2018/02/01 16:22:32 executing program 6: 2018/02/01 16:22:32 executing program 7: 2018/02/01 16:22:32 executing program 3: 2018/02/01 16:22:32 executing program 0: 2018/02/01 16:22:32 executing program 4: 2018/02/01 16:22:32 executing program 4: 2018/02/01 16:22:32 executing program 0: 2018/02/01 16:22:33 executing program 2: 2018/02/01 16:22:33 executing program 3: 2018/02/01 16:22:33 executing program 0: 2018/02/01 16:22:33 executing program 7: 2018/02/01 16:22:33 executing program 6: 2018/02/01 16:22:33 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) rt_sigtimedwait(&(0x7f0000645000-0x8), &(0x7f0000ded000), &(0x7f000052f000)={0x40000077359400}, 0x8) pipe(&(0x7f0000d8c000-0x8)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000e13000-0x8)={0xffffffffffffffff, 0xffffffffffffffff}) tee(r0, r2, 0x80007387, 0x0) r3 = dup2(r1, r2) r4 = syz_open_dev$random(&(0x7f0000bdc000-0xc)='/dev/random\x00', 0x0, 0x0) dup2(r1, r4) ioctl$int_in(r3, 0x5452, &(0x7f0000e36000-0x8)=0x45) fcntl$setown(r1, 0x8, 0x0) fcntl$setsig(r4, 0xa, 0x12) r5 = gettid() tkill(r5, 0x100000000000016) 2018/02/01 16:22:33 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000fd6000-0x8)='./file0\x00', 0x0) mount(&(0x7f000000a000)='./file0\x00', &(0x7f0000027000-0x8)='./file0\x00', &(0x7f000000c000)='ramfs\x00', 0x0, &(0x7f000000a000)) mount(&(0x7f0000037000)='./file0\x00', &(0x7f0000c50000-0x8)='./file0\x00', &(0x7f000002f000-0x6)='ramfs\x00', 0x100000, &(0x7f0000ce3000)) mount(&(0x7f000052f000)='./file0\x00', &(0x7f00008fd000-0x1)='.', &(0x7f00003a3000-0x6)="00e2660000", 0x1000, 0x0) mount(&(0x7f00002ba000-0x8)='./file0\x00', &(0x7f0000cbf000-0x8)='./file0\x00', &(0x7f0000dcd000)='ramfs\x00', 0x80000, &(0x7f000002f000)) mount(&(0x7f00009b1000)='./file0\x00', &(0x7f0000ae7000-0x8)='./file0\x00', &(0x7f0000226000)='an\x00\x00\x00\x00\x00\x00\x00\afs\x00', 0x100000, &(0x7f0000b64000-0x1000)) mkdirat(0xffffffffffffffff, &(0x7f0000034000-0x8)='./file0\x00', 0x0) mount(&(0x7f00001a5000-0xe)='./file0/file0\x00', &(0x7f00002fb000-0x8)='./file0/file0\x00', &(0x7f00002ba000)='\x00v\t', 0x1004, &(0x7f000073b000-0x1)) mount(&(0x7f00005e1000-0x8)='./file0\x00', &(0x7f0000df5000-0x8)='.', &(0x7f0000df4000)='%&t3\x00', 0x2000, &(0x7f00003db000-0x23)) 2018/02/01 16:22:33 executing program 4: 2018/02/01 16:22:33 executing program 7: 2018/02/01 16:22:33 executing program 3: 2018/02/01 16:22:33 executing program 2: 2018/02/01 16:22:33 executing program 4: 2018/02/01 16:22:33 executing program 6: 2018/02/01 16:22:33 executing program 7: 2018/02/01 16:22:33 executing program 3: 2018/02/01 16:22:33 executing program 0: 2018/02/01 16:22:33 executing program 6: 2018/02/01 16:22:33 executing program 2: 2018/02/01 16:22:33 executing program 4: 2018/02/01 16:22:33 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) rt_sigtimedwait(&(0x7f0000645000-0x8), &(0x7f0000ded000), &(0x7f000052f000)={0x40000077359400}, 0x8) pipe(&(0x7f0000d8c000-0x8)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000e13000-0x8)={0xffffffffffffffff, 0xffffffffffffffff}) tee(r0, r2, 0x80007387, 0x0) r3 = dup2(r1, r2) r4 = syz_open_dev$random(&(0x7f0000bdc000-0xc)='/dev/random\x00', 0x0, 0x0) dup2(r1, r4) ioctl$int_in(r3, 0x5452, &(0x7f0000e36000-0x8)=0x45) fcntl$setown(r1, 0x8, 0x0) fcntl$setsig(r4, 0xa, 0x12) r5 = gettid() tkill(r5, 0x100000000000016) 2018/02/01 16:22:33 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000fd6000-0x8)='./file0\x00', 0x0) mount(&(0x7f000000a000)='./file0\x00', &(0x7f0000027000-0x8)='./file0\x00', &(0x7f000000c000)='ramfs\x00', 0x0, &(0x7f000000a000)) mount(&(0x7f0000037000)='./file0\x00', &(0x7f0000c50000-0x8)='./file0\x00', &(0x7f000002f000-0x6)='ramfs\x00', 0x100000, &(0x7f0000ce3000)) mount(&(0x7f000052f000)='./file0\x00', &(0x7f00008fd000-0x1)='.', &(0x7f00003a3000-0x6)="00e2660000", 0x1000, 0x0) mount(&(0x7f00002ba000-0x8)='./file0\x00', &(0x7f0000cbf000-0x8)='./file0\x00', &(0x7f0000dcd000)='ramfs\x00', 0x80000, &(0x7f000002f000)) mount(&(0x7f00009b1000)='./file0\x00', &(0x7f0000ae7000-0x8)='./file0\x00', &(0x7f0000226000)='an\x00\x00\x00\x00\x00\x00\x00\afs\x00', 0x100000, &(0x7f0000b64000-0x1000)) mkdirat(0xffffffffffffffff, &(0x7f0000034000-0x8)='./file0\x00', 0x0) mount(&(0x7f00001a5000-0xe)='./file0/file0\x00', &(0x7f00002fb000-0x8)='./file0/file0\x00', &(0x7f00002ba000)='\x00v\t', 0x1004, &(0x7f000073b000-0x1)) mount(&(0x7f00005e1000-0x8)='./file0\x00', &(0x7f0000df5000-0x8)='.', &(0x7f0000df4000)='%&t3\x00', 0x2000, &(0x7f00003db000-0x23)) 2018/02/01 16:22:33 executing program 3: 2018/02/01 16:22:33 executing program 6: 2018/02/01 16:22:33 executing program 4: 2018/02/01 16:22:33 executing program 2: 2018/02/01 16:22:33 executing program 0: 2018/02/01 16:22:33 executing program 7: 2018/02/01 16:22:33 executing program 4: 2018/02/01 16:22:33 executing program 0: 2018/02/01 16:22:33 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000fd6000-0x8)='./file0\x00', 0x0) mount(&(0x7f000000a000)='./file0\x00', &(0x7f0000027000-0x8)='./file0\x00', &(0x7f000000c000)='ramfs\x00', 0x0, &(0x7f000000a000)) mount(&(0x7f0000037000)='./file0\x00', &(0x7f0000c50000-0x8)='./file0\x00', &(0x7f000002f000-0x6)='ramfs\x00', 0x100000, &(0x7f0000ce3000)) mount(&(0x7f000052f000)='./file0\x00', &(0x7f00008fd000-0x1)='.', &(0x7f00003a3000-0x6)="00e2660000", 0x1000, 0x0) mount(&(0x7f00002ba000-0x8)='./file0\x00', &(0x7f0000cbf000-0x8)='./file0\x00', &(0x7f0000dcd000)='ramfs\x00', 0x80000, &(0x7f000002f000)) mount(&(0x7f00009b1000)='./file0\x00', &(0x7f0000ae7000-0x8)='./file0\x00', &(0x7f0000226000)='an\x00\x00\x00\x00\x00\x00\x00\afs\x00', 0x100000, &(0x7f0000b64000-0x1000)) mkdirat(0xffffffffffffffff, &(0x7f0000034000-0x8)='./file0\x00', 0x0) mount(&(0x7f00001a5000-0xe)='./file0/file0\x00', &(0x7f00002fb000-0x8)='./file0/file0\x00', &(0x7f00002ba000)='\x00v\t', 0x1004, &(0x7f000073b000-0x1)) mount(&(0x7f00005e1000-0x8)='./file0\x00', &(0x7f0000df5000-0x8)='.', &(0x7f0000df4000)='%&t3\x00', 0x2000, &(0x7f00003db000-0x23)) 2018/02/01 16:22:33 executing program 4: 2018/02/01 16:22:33 executing program 3: 2018/02/01 16:22:34 executing program 2: 2018/02/01 16:22:34 executing program 6: 2018/02/01 16:22:34 executing program 4: 2018/02/01 16:22:34 executing program 7: 2018/02/01 16:22:34 executing program 0: 2018/02/01 16:22:34 executing program 3: 2018/02/01 16:22:34 executing program 5: r0 = gettid() rt_sigtimedwait(&(0x7f0000645000-0x8), &(0x7f0000ded000), &(0x7f000052f000)={0x40000077359400}, 0x8) pipe(&(0x7f0000d8c000-0x8)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000e13000-0x8)={0xffffffffffffffff, 0xffffffffffffffff}) tee(r1, r3, 0x80007387, 0x0) r4 = dup2(r2, r3) r5 = syz_open_dev$random(&(0x7f0000bdc000-0xc)='/dev/random\x00', 0x0, 0x0) dup2(r2, r5) ioctl$int_in(r4, 0x5452, &(0x7f0000e36000-0x8)=0x45) fcntl$setown(r2, 0x8, r0) fcntl$setsig(r5, 0xa, 0x12) r6 = gettid() tkill(r6, 0x100000000000016) 2018/02/01 16:22:34 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000fd6000-0x8)='./file0\x00', 0x0) mount(&(0x7f000000a000)='./file0\x00', &(0x7f0000027000-0x8)='./file0\x00', &(0x7f000000c000)='ramfs\x00', 0x0, &(0x7f000000a000)) mount(&(0x7f0000037000)='./file0\x00', &(0x7f0000c50000-0x8)='./file0\x00', &(0x7f000002f000-0x6)='ramfs\x00', 0x100000, &(0x7f0000ce3000)) mount(&(0x7f000052f000)='./file0\x00', &(0x7f00008fd000-0x1)='.', &(0x7f00003a3000-0x6)="00e2660000", 0x1000, 0x0) mount(&(0x7f00002ba000-0x8)='./file0\x00', &(0x7f0000cbf000-0x8)='./file0\x00', &(0x7f0000dcd000)='ramfs\x00', 0x80000, &(0x7f000002f000)) r0 = open(&(0x7f00006a2000)='./file0\x00', 0x0, 0x0) mkdirat(r0, &(0x7f0000034000-0x8)='./file0\x00', 0x0) mount(&(0x7f00001a5000-0xe)='./file0/file0\x00', &(0x7f00002fb000-0x8)='./file0/file0\x00', &(0x7f00002ba000)='\x00v\t', 0x1004, &(0x7f000073b000-0x1)) mount(&(0x7f00005e1000-0x8)='./file0\x00', &(0x7f0000df5000-0x8)='.', &(0x7f0000df4000)='%&t3\x00', 0x2000, &(0x7f00003db000-0x23)) 2018/02/01 16:22:34 executing program 2: 2018/02/01 16:22:34 executing program 4: 2018/02/01 16:22:34 executing program 3: 2018/02/01 16:22:34 executing program 7: 2018/02/01 16:22:34 executing program 6: 2018/02/01 16:22:34 executing program 0: 2018/02/01 16:22:34 executing program 4: 2018/02/01 16:22:34 executing program 2: 2018/02/01 16:22:34 executing program 7: 2018/02/01 16:22:34 executing program 6: 2018/02/01 16:22:34 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000fd6000-0x8)='./file0\x00', 0x0) mount(&(0x7f000000a000)='./file0\x00', &(0x7f0000027000-0x8)='./file0\x00', &(0x7f000000c000)='ramfs\x00', 0x0, &(0x7f000000a000)) mount(&(0x7f0000037000)='./file0\x00', &(0x7f0000c50000-0x8)='./file0\x00', &(0x7f000002f000-0x6)='ramfs\x00', 0x100000, &(0x7f0000ce3000)) mount(&(0x7f000052f000)='./file0\x00', &(0x7f00008fd000-0x1)='.', &(0x7f00003a3000-0x6)="00e2660000", 0x1000, 0x0) mount(&(0x7f00002ba000-0x8)='./file0\x00', &(0x7f0000cbf000-0x8)='./file0\x00', &(0x7f0000dcd000)='ramfs\x00', 0x80000, &(0x7f000002f000)) r0 = open(&(0x7f00006a2000)='./file0\x00', 0x0, 0x0) mkdirat(r0, &(0x7f0000034000-0x8)='./file0\x00', 0x0) mount(&(0x7f00001a5000-0xe)='./file0/file0\x00', &(0x7f00002fb000-0x8)='./file0/file0\x00', &(0x7f00002ba000)='\x00v\t', 0x1004, &(0x7f000073b000-0x1)) mount(&(0x7f00005e1000-0x8)='./file0\x00', &(0x7f0000df5000-0x8)='.', &(0x7f0000df4000)='%&t3\x00', 0x2000, &(0x7f00003db000-0x23)) 2018/02/01 16:22:34 executing program 0: 2018/02/01 16:22:34 executing program 3: 2018/02/01 16:22:34 executing program 5: r0 = gettid() rt_sigtimedwait(&(0x7f0000645000-0x8), &(0x7f0000ded000), &(0x7f000052f000)={0x40000077359400}, 0x8) pipe(&(0x7f0000d8c000-0x8)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000e13000-0x8)={0xffffffffffffffff, 0xffffffffffffffff}) tee(r1, r3, 0x80007387, 0x0) r4 = dup2(r2, r3) r5 = syz_open_dev$random(&(0x7f0000bdc000-0xc)='/dev/random\x00', 0x0, 0x0) dup2(r2, r5) ioctl$int_in(r4, 0x5452, &(0x7f0000e36000-0x8)=0x45) fcntl$setown(r2, 0x8, r0) fcntl$setsig(r5, 0xa, 0x12) r6 = gettid() tkill(r6, 0x100000000000016) 2018/02/01 16:22:34 executing program 4: 2018/02/01 16:22:34 executing program 2: 2018/02/01 16:22:34 executing program 3: 2018/02/01 16:22:34 executing program 7: [ 201.974088] IPVS: ftp: loaded support on port[0] = 21 [ 202.244077] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready 2018/02/01 16:22:36 executing program 3: 2018/02/01 16:22:36 executing program 2: 2018/02/01 16:22:36 executing program 7: 2018/02/01 16:22:36 executing program 6: 2018/02/01 16:22:36 executing program 4: 2018/02/01 16:22:36 executing program 0: 2018/02/01 16:22:36 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000fd6000-0x8)='./file0\x00', 0x0) mount(&(0x7f000000a000)='./file0\x00', &(0x7f0000027000-0x8)='./file0\x00', &(0x7f000000c000)='ramfs\x00', 0x0, &(0x7f000000a000)) mount(&(0x7f0000037000)='./file0\x00', &(0x7f0000c50000-0x8)='./file0\x00', &(0x7f000002f000-0x6)='ramfs\x00', 0x100000, &(0x7f0000ce3000)) mount(&(0x7f000052f000)='./file0\x00', &(0x7f00008fd000-0x1)='.', &(0x7f00003a3000-0x6)="00e2660000", 0x1000, 0x0) mount(&(0x7f00002ba000-0x8)='./file0\x00', &(0x7f0000cbf000-0x8)='./file0\x00', &(0x7f0000dcd000)='ramfs\x00', 0x80000, &(0x7f000002f000)) r0 = open(&(0x7f00006a2000)='./file0\x00', 0x0, 0x0) mkdirat(r0, &(0x7f0000034000-0x8)='./file0\x00', 0x0) mount(&(0x7f00001a5000-0xe)='./file0/file0\x00', &(0x7f00002fb000-0x8)='./file0/file0\x00', &(0x7f00002ba000)='\x00v\t', 0x1004, &(0x7f000073b000-0x1)) mount(&(0x7f00005e1000-0x8)='./file0\x00', &(0x7f0000df5000-0x8)='.', &(0x7f0000df4000)='%&t3\x00', 0x2000, &(0x7f00003db000-0x23)) 2018/02/01 16:22:36 executing program 5: r0 = gettid() rt_sigtimedwait(&(0x7f0000645000-0x8), &(0x7f0000ded000), &(0x7f000052f000)={0x40000077359400}, 0x8) pipe(&(0x7f0000d8c000-0x8)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000e13000-0x8)={0xffffffffffffffff, 0xffffffffffffffff}) tee(r1, r3, 0x80007387, 0x0) r4 = dup2(r2, r3) r5 = syz_open_dev$random(&(0x7f0000bdc000-0xc)='/dev/random\x00', 0x0, 0x0) dup2(r2, r5) ioctl$int_in(r4, 0x5452, &(0x7f0000e36000-0x8)=0x45) fcntl$setown(r2, 0x8, r0) fcntl$setsig(r5, 0xa, 0x12) r6 = gettid() tkill(r6, 0x100000000000016) 2018/02/01 16:22:37 executing program 0: 2018/02/01 16:22:37 executing program 3: 2018/02/01 16:22:37 executing program 7: 2018/02/01 16:22:37 executing program 0: 2018/02/01 16:22:37 executing program 7: 2018/02/01 16:22:37 executing program 3: 2018/02/01 16:22:37 executing program 6: 2018/02/01 16:22:37 executing program 0: 2018/02/01 16:22:37 executing program 2: 2018/02/01 16:22:37 executing program 4: 2018/02/01 16:22:37 executing program 7: 2018/02/01 16:22:37 executing program 0: 2018/02/01 16:22:37 executing program 4: 2018/02/01 16:22:37 executing program 7: 2018/02/01 16:22:37 executing program 6: 2018/02/01 16:22:37 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000fd6000-0x8)='./file0\x00', 0x0) mount(&(0x7f000000a000)='./file0\x00', &(0x7f0000027000-0x8)='./file0\x00', &(0x7f000000c000)='ramfs\x00', 0x0, &(0x7f000000a000)) mount(&(0x7f0000037000)='./file0\x00', &(0x7f0000c50000-0x8)='./file0\x00', &(0x7f000002f000-0x6)='ramfs\x00', 0x100000, &(0x7f0000ce3000)) mount(&(0x7f000052f000)='./file0\x00', &(0x7f00008fd000-0x1)='.', &(0x7f00003a3000-0x6)="00e2660000", 0x1000, 0x0) mount(&(0x7f00009b1000)='./file0\x00', &(0x7f0000ae7000-0x8)='./file0\x00', &(0x7f0000226000)='an\x00\x00\x00\x00\x00\x00\x00\afs\x00', 0x100000, &(0x7f0000b64000-0x1000)) r0 = open(&(0x7f00006a2000)='./file0\x00', 0x0, 0x0) mkdirat(r0, &(0x7f0000034000-0x8)='./file0\x00', 0x0) mount(&(0x7f00001a5000-0xe)='./file0/file0\x00', &(0x7f00002fb000-0x8)='./file0/file0\x00', &(0x7f00002ba000)='\x00v\t', 0x1004, &(0x7f000073b000-0x1)) mount(&(0x7f00005e1000-0x8)='./file0\x00', &(0x7f0000df5000-0x8)='.', &(0x7f0000df4000)='%&t3\x00', 0x2000, &(0x7f00003db000-0x23)) 2018/02/01 16:22:37 executing program 0: 2018/02/01 16:22:37 executing program 4: 2018/02/01 16:22:37 executing program 7: 2018/02/01 16:22:37 executing program 3: 2018/02/01 16:22:37 executing program 2: 2018/02/01 16:22:37 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x0, 0x32, 0xffffffffffffffff, 0x0) r0 = gettid() rt_sigtimedwait(&(0x7f0000645000-0x8), &(0x7f0000ded000), &(0x7f000052f000)={0x40000077359400}, 0x8) pipe(&(0x7f0000d8c000-0x8)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000e13000-0x8)={0xffffffffffffffff, 0xffffffffffffffff}) tee(r1, r3, 0x80007387, 0x0) r4 = dup2(r2, r3) r5 = syz_open_dev$random(&(0x7f0000bdc000-0xc)='/dev/random\x00', 0x0, 0x0) dup2(r2, r5) ioctl$int_in(r4, 0x5452, &(0x7f0000e36000-0x8)=0x45) fcntl$setown(r2, 0x8, r0) fcntl$setsig(r5, 0xa, 0x12) r6 = gettid() tkill(r6, 0x100000000000016) 2018/02/01 16:22:37 executing program 6: 2018/02/01 16:22:37 executing program 0: 2018/02/01 16:22:37 executing program 2: 2018/02/01 16:22:37 executing program 4: 2018/02/01 16:22:37 executing program 7: 2018/02/01 16:22:37 executing program 3: 2018/02/01 16:22:37 executing program 6: 2018/02/01 16:22:37 executing program 4: 2018/02/01 16:22:37 executing program 2: [ 203.660763] IPVS: ftp: loaded support on port[0] = 21 [ 203.940149] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready 2018/02/01 16:22:38 executing program 0: 2018/02/01 16:22:38 executing program 7: 2018/02/01 16:22:38 executing program 6: 2018/02/01 16:22:38 executing program 4: 2018/02/01 16:22:38 executing program 3: 2018/02/01 16:22:38 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000fd6000-0x8)='./file0\x00', 0x0) mount(&(0x7f000000a000)='./file0\x00', &(0x7f0000027000-0x8)='./file0\x00', &(0x7f000000c000)='ramfs\x00', 0x0, &(0x7f000000a000)) mount(&(0x7f0000037000)='./file0\x00', &(0x7f0000c50000-0x8)='./file0\x00', &(0x7f000002f000-0x6)='ramfs\x00', 0x100000, &(0x7f0000ce3000)) mount(&(0x7f000052f000)='./file0\x00', &(0x7f00008fd000-0x1)='.', &(0x7f00003a3000-0x6)="00e2660000", 0x1000, 0x0) mount(&(0x7f00009b1000)='./file0\x00', &(0x7f0000ae7000-0x8)='./file0\x00', &(0x7f0000226000)='an\x00\x00\x00\x00\x00\x00\x00\afs\x00', 0x100000, &(0x7f0000b64000-0x1000)) r0 = open(&(0x7f00006a2000)='./file0\x00', 0x0, 0x0) mkdirat(r0, &(0x7f0000034000-0x8)='./file0\x00', 0x0) mount(&(0x7f00001a5000-0xe)='./file0/file0\x00', &(0x7f00002fb000-0x8)='./file0/file0\x00', &(0x7f00002ba000)='\x00v\t', 0x1004, &(0x7f000073b000-0x1)) mount(&(0x7f00005e1000-0x8)='./file0\x00', &(0x7f0000df5000-0x8)='.', &(0x7f0000df4000)='%&t3\x00', 0x2000, &(0x7f00003db000-0x23)) 2018/02/01 16:22:38 executing program 2: 2018/02/01 16:22:38 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x0, 0x32, 0xffffffffffffffff, 0x0) r0 = gettid() rt_sigtimedwait(&(0x7f0000645000-0x8), &(0x7f0000ded000), &(0x7f000052f000)={0x40000077359400}, 0x8) pipe(&(0x7f0000d8c000-0x8)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000e13000-0x8)={0xffffffffffffffff, 0xffffffffffffffff}) tee(r1, r3, 0x80007387, 0x0) r4 = dup2(r2, r3) r5 = syz_open_dev$random(&(0x7f0000bdc000-0xc)='/dev/random\x00', 0x0, 0x0) dup2(r2, r5) ioctl$int_in(r4, 0x5452, &(0x7f0000e36000-0x8)=0x45) fcntl$setown(r2, 0x8, r0) fcntl$setsig(r5, 0xa, 0x12) r6 = gettid() tkill(r6, 0x100000000000016) 2018/02/01 16:22:38 executing program 7: 2018/02/01 16:22:38 executing program 3: 2018/02/01 16:22:38 executing program 2: unshare(0x20000000) clone(0x0, &(0x7f000065a000-0x2), &(0x7f00003c7000-0x4), &(0x7f0000a2f000-0x4), &(0x7f00007c4000)) clone(0x0, &(0x7f0000000000), &(0x7f00000cc000-0x4), &(0x7f0000000000), &(0x7f0000001000-0x114)) ioctl$sock_FIOGETOWN(0xffffffffffffff9c, 0x8903, &(0x7f0000001000-0x4)) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f0000002000-0x4)) wait4(0x0, 0x0, 0x80000000, &(0x7f000005b000-0x90)) 2018/02/01 16:22:38 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ifreq(r0, 0x8bf3, &(0x7f00005a6000)={@common='lo\x00', @ifru_flags}) 2018/02/01 16:22:38 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000633000)='/dev/ptmx\x00', 0x0, 0x0) r1 = gettid() socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000a7f000-0x8)={0xffffffffffffffff, 0xffffffffffffffff}) readv(r0, &(0x7f0000dce000-0x10)=[{&(0x7f0000cd8000)=""/1, 0x1}], 0x1) ioctl$int_in(r2, 0x5452, &(0x7f0000b38000)=0x3c) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000d1f000)) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000fb9000)) fcntl$setsig(r2, 0xa, 0x12) poll(&(0x7f0000b2c000)=[{r3}], 0x1, 0xfffffffffffffff8) r4 = dup2(r2, r3) fcntl$setown(r4, 0x8, r1) tkill(r1, 0x16) 2018/02/01 16:22:38 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000010000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00003a3000-0x30)={0x8, 0x0, &(0x7f0000b59000)=[@enter_looper={0x630c}, @register_looper={0x630b}], 0x0, 0x0, &(0x7f0000116000-0xfc)}) 2018/02/01 16:22:38 executing program 7: mmap(&(0x7f0000000000/0xf16000)=nil, 0xf16000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = gettid() r1 = inotify_init() mmap(&(0x7f0000f16000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) readv(r1, &(0x7f0000f17000-0xa0)=[{&(0x7f00008e6000-0xed)=""/237, 0xed}], 0x1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000001000-0x8)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$int_in(r2, 0x5452, &(0x7f0000009000-0x8)=0x3f) fcntl$setsig(r2, 0xa, 0x12) fcntl$setownex(r2, 0xf, &(0x7f000047d000)={0x0, r0}) recvmsg(r3, &(0x7f000095d000-0x38)={&(0x7f0000894000-0x8)=@sco, 0x8, &(0x7f00000a5000-0x50)=[], 0x0, &(0x7f0000b30000)}, 0x0) dup2(r2, r3) mmap(&(0x7f0000f16000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) tkill(r0, 0x15) 2018/02/01 16:22:38 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = memfd_create(&(0x7f00005c6000-0xd)='/dev/net/tun\x00', 0x0) r1 = syz_open_dev$sndseq(&(0x7f0000042000)='/dev/snd/seq\x00', 0x0, 0x802) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_CLIENT(r1, 0x404c534a, &(0x7f0000031000-0x4c)={0x0, 0x0, 0x207}) dup2(r1, r0) write$sndseq(r0, &(0x7f0000001000-0x1b0)=[{0x5, 0x0, 0x0, 0x0, @time={0x0, 0x989680}, {}, {}, @result}], 0x30) 2018/02/01 16:22:38 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x0, 0x0) ioctl$EVIOCGLED(r0, 0x40045109, &(0x7f000061c000)) 2018/02/01 16:22:38 executing program 6: mmap(&(0x7f0000000000/0x5000)=nil, 0x5000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$loop(&(0x7f0000000000)='/dev/loop#\x00', 0x7d, 0x900) ioctl(r0, 0x4400000000001267, &(0x7f0000002000)) 2018/02/01 16:22:38 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000fd6000-0x8)='./file0\x00', 0x0) mount(&(0x7f000000a000)='./file0\x00', &(0x7f0000027000-0x8)='./file0\x00', &(0x7f000000c000)='ramfs\x00', 0x0, &(0x7f000000a000)) mount(&(0x7f0000037000)='./file0\x00', &(0x7f0000c50000-0x8)='./file0\x00', &(0x7f000002f000-0x6)='ramfs\x00', 0x100000, &(0x7f0000ce3000)) mount(&(0x7f000052f000)='./file0\x00', &(0x7f00008fd000-0x1)='.', &(0x7f00003a3000-0x6)="00e2660000", 0x1000, 0x0) mount(&(0x7f00009b1000)='./file0\x00', &(0x7f0000ae7000-0x8)='./file0\x00', &(0x7f0000226000)='an\x00\x00\x00\x00\x00\x00\x00\afs\x00', 0x100000, &(0x7f0000b64000-0x1000)) r0 = open(&(0x7f00006a2000)='./file0\x00', 0x0, 0x0) mkdirat(r0, &(0x7f0000034000-0x8)='./file0\x00', 0x0) mount(&(0x7f00001a5000-0xe)='./file0/file0\x00', &(0x7f00002fb000-0x8)='./file0/file0\x00', &(0x7f00002ba000)='\x00v\t', 0x1004, &(0x7f000073b000-0x1)) mount(&(0x7f00005e1000-0x8)='./file0\x00', &(0x7f0000df5000-0x8)='.', &(0x7f0000df4000)='%&t3\x00', 0x2000, &(0x7f00003db000-0x23)) 2018/02/01 16:22:38 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$evdev(&(0x7f0000d1a000-0x12)='/dev/input/event#\x00', 0x0, 0x2) write$evdev(r0, &(0x7f0000058000-0x60)=[{}, {}], 0xfffffd24) writev(r0, &(0x7f0000c60000)=[{&(0x7f0000ca3000)="62901ce8c874678c7d4879a3186f6842a1cc78d8db", 0x15}], 0x1) execve(&(0x7f000007b000)='./file0\x00', &(0x7f0000a7c000-0x38)=[], &(0x7f00006fd000-0x10)=[]) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) [ 204.462441] binder: 29632:29638 ERROR: BC_REGISTER_LOOPER called after BC_ENTER_LOOPER [ 204.498768] binder: 29632:29655 ERROR: BC_REGISTER_LOOPER called after BC_ENTER_LOOPER 2018/02/01 16:22:38 executing program 6: mmap(&(0x7f0000000000/0x1f000)=nil, 0x1f000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x800000004) sendmsg$nl_generic(r0, &(0x7f0000014000-0x38)={&(0x7f0000000000)={0x10}, 0xc, &(0x7f000001d000-0x10)={&(0x7f0000016000)={0x4c, 0x12, 0x401, 0xffffffffffffffff, 0xffffffffffffffff, {}, [@generic="3715b0b724d934bfbf795ace0a590591571a072be26043acf9da41f8d302122c73bf6402983f5cee7bdeaae794c98c55ae046b651e"]}, 0x4c}, 0x1}, 0x0) 2018/02/01 16:22:38 executing program 4: mmap(&(0x7f0000000000/0x36000)=nil, 0x36000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000035000-0x8)='./file0\x00', 0x0) mount(&(0x7f000000f000-0x8)='./file0\x00', &(0x7f000001c000)='./file0\x00', &(0x7f0000000000)='ramfs\x00', 0x1000013, &(0x7f0000001000-0x1)) creat(&(0x7f000002d000-0xc)='./file0/bus\x00', 0x0) 2018/02/01 16:22:38 executing program 4: mmap(&(0x7f0000000000/0x30000)=nil, 0x30000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndtimer(&(0x7f0000026000)='/dev/snd/timer\x00', 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_SELECT(r0, 0x40345410, &(0x7f0000001000)={{0x100000001}}) r1 = syz_open_dev$sndtimer(&(0x7f0000023000-0xf)='/dev/snd/timer\x00', 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_SELECT(r1, 0x40345410, &(0x7f000000f000-0x34)={{0x100000001}}) ioctl$SNDRV_TIMER_IOCTL_START(r1, 0x54a0) ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r0, 0x54a2) ioctl$SNDRV_TIMER_IOCTL_PAUSE(r1, 0x54a3) 2018/02/01 16:22:39 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x0, 0x32, 0xffffffffffffffff, 0x0) r0 = gettid() rt_sigtimedwait(&(0x7f0000645000-0x8), &(0x7f0000ded000), &(0x7f000052f000)={0x40000077359400}, 0x8) pipe(&(0x7f0000d8c000-0x8)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000e13000-0x8)={0xffffffffffffffff, 0xffffffffffffffff}) tee(r1, r3, 0x80007387, 0x0) r4 = dup2(r2, r3) r5 = syz_open_dev$random(&(0x7f0000bdc000-0xc)='/dev/random\x00', 0x0, 0x0) dup2(r2, r5) ioctl$int_in(r4, 0x5452, &(0x7f0000e36000-0x8)=0x45) fcntl$setown(r2, 0x8, r0) fcntl$setsig(r5, 0xa, 0x12) r6 = gettid() tkill(r6, 0x100000000000016) 2018/02/01 16:22:39 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$evdev(&(0x7f0000d1a000-0x12)='/dev/input/event#\x00', 0x0, 0x2) write$evdev(r0, &(0x7f0000058000-0x60)=[{}, {}], 0xfffffd24) writev(r0, &(0x7f0000c60000)=[{&(0x7f0000ca3000)="62901ce8c874678c7d4879a3186f6842a1cc78d8db", 0x15}], 0x1) execve(&(0x7f000007b000)='./file0\x00', &(0x7f0000a7c000-0x38)=[], &(0x7f00006fd000-0x10)=[]) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) 2018/02/01 16:22:39 executing program 7: mmap(&(0x7f0000000000/0x7000)=nil, 0x7000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$loop(&(0x7f0000000000)='/dev/loop#\x00', 0x7d, 0x0) ioctl(r0, 0x4400000000001267, &(0x7f0000002000)) 2018/02/01 16:22:39 executing program 6: mmap(&(0x7f0000000000/0x8000)=nil, 0x8000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(0xffffffffffffffff, 0xc04064a0, &(0x7f0000004000)={&(0x7f0000002000-0x24)=[], &(0x7f0000007000)=[], &(0x7f0000007000)=[], &(0x7f0000008000-0x1c)=[]}) r0 = socket$packet(0x11, 0x3, 0x300) getsockopt$packet_int(r0, 0x107, 0xb, &(0x7f0000004000), &(0x7f0000002000-0x4)=0x4) 2018/02/01 16:22:39 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000045000-0x8)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f00000bc000)=@abs, 0x8) sendmmsg$unix(r1, &(0x7f00000bd000)=[], 0x80, 0x0) poll(&(0x7f00000d7000-0x50)=[{r0, 0x200}], 0x1, 0x0) 2018/02/01 16:22:39 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000fd6000-0x8)='./file0\x00', 0x0) mount(&(0x7f000000a000)='./file0\x00', &(0x7f0000027000-0x8)='./file0\x00', &(0x7f000000c000)='ramfs\x00', 0x0, &(0x7f000000a000)) mount(&(0x7f0000037000)='./file0\x00', &(0x7f0000c50000-0x8)='./file0\x00', &(0x7f000002f000-0x6)='ramfs\x00', 0x100000, &(0x7f0000ce3000)) mount(&(0x7f00002ba000-0x8)='./file0\x00', &(0x7f0000cbf000-0x8)='./file0\x00', &(0x7f0000dcd000)='ramfs\x00', 0x80000, &(0x7f000002f000)) mount(&(0x7f00009b1000)='./file0\x00', &(0x7f0000ae7000-0x8)='./file0\x00', &(0x7f0000226000)='an\x00\x00\x00\x00\x00\x00\x00\afs\x00', 0x100000, &(0x7f0000b64000-0x1000)) r0 = open(&(0x7f00006a2000)='./file0\x00', 0x0, 0x0) mkdirat(r0, &(0x7f0000034000-0x8)='./file0\x00', 0x0) mount(&(0x7f00001a5000-0xe)='./file0/file0\x00', &(0x7f00002fb000-0x8)='./file0/file0\x00', &(0x7f00002ba000)='\x00v\t', 0x1004, &(0x7f000073b000-0x1)) mount(&(0x7f00005e1000-0x8)='./file0\x00', &(0x7f0000df5000-0x8)='.', &(0x7f0000df4000)='%&t3\x00', 0x2000, &(0x7f00003db000-0x23)) 2018/02/01 16:22:39 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2000000000001, 0x0) setsockopt$inet6_opts(r0, 0x29, 0x3b, &(0x7f0000f33000-0x8)=@dstopts={0x0, 0x0, [], []}, 0x8) close(r0) 2018/02/01 16:22:39 executing program 0: mmap(&(0x7f0000000000/0x24000)=nil, 0x24000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f000001c000-0x38)={&(0x7f0000016000)={0x10}, 0xc, &(0x7f000000b000)={&(0x7f000001f000)=@ipv6_newroute={0x34, 0x18, 0x781a241f, 0xffffffffffffffff, 0xffffffffffffffff, {0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}, [@RTA_MULTIPATH={0x14, 0x9, [{0x9}, {}]}, @RTA_METRICS={0x4, 0x8}]}, 0x34}, 0x1}, 0x0) 2018/02/01 16:22:39 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000fd6000-0x8)='./file0\x00', 0x0) mount(&(0x7f000000a000)='./file0\x00', &(0x7f0000027000-0x8)='./file0\x00', &(0x7f000000c000)='ramfs\x00', 0x0, &(0x7f000000a000)) mount(&(0x7f0000037000)='./file0\x00', &(0x7f0000c50000-0x8)='./file0\x00', &(0x7f000002f000-0x6)='ramfs\x00', 0x100000, &(0x7f0000ce3000)) mount(&(0x7f00002ba000-0x8)='./file0\x00', &(0x7f0000cbf000-0x8)='./file0\x00', &(0x7f0000dcd000)='ramfs\x00', 0x80000, &(0x7f000002f000)) mount(&(0x7f00009b1000)='./file0\x00', &(0x7f0000ae7000-0x8)='./file0\x00', &(0x7f0000226000)='an\x00\x00\x00\x00\x00\x00\x00\afs\x00', 0x100000, &(0x7f0000b64000-0x1000)) r0 = open(&(0x7f00006a2000)='./file0\x00', 0x0, 0x0) mkdirat(r0, &(0x7f0000034000-0x8)='./file0\x00', 0x0) mount(&(0x7f00001a5000-0xe)='./file0/file0\x00', &(0x7f00002fb000-0x8)='./file0/file0\x00', &(0x7f00002ba000)='\x00v\t', 0x1004, &(0x7f000073b000-0x1)) mount(&(0x7f00005e1000-0x8)='./file0\x00', &(0x7f0000df5000-0x8)='.', &(0x7f0000df4000)='%&t3\x00', 0x2000, &(0x7f00003db000-0x23)) 2018/02/01 16:22:39 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) unshare(0x8000400) r0 = mq_open(&(0x7f0000000000)='*GPL[vmnet1@vmnet1{-vmnet@vboxnet0!vboxnet1+M\x00', 0x6e93ebbbcc0884ef, 0x0, &(0x7f0000665000-0x40)={0x0, 0x7, 0x2}) r1 = epoll_create(0x1f) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000005000-0xc)={0xffffefd}) epoll_ctl$EPOLL_CTL_MOD(r1, 0x3, r0, &(0x7f0000ec9000)) epoll_pwait(r1, &(0x7f00006c8000-0xc)=[{}], 0x1, 0x0, &(0x7f000050c000), 0x8) 2018/02/01 16:22:39 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mlockall(0x2) mkdir(&(0x7f0000afc000-0x8)='./file0\x00', 0x0) mount(&(0x7f000000a000)='./file0\x00', &(0x7f0000027000-0x8)='./file0\x00', &(0x7f000000c000)='ramfs\x00', 0x0, &(0x7f000032e000)) chdir(&(0x7f0000f95000)='./file0\x00') r0 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r0, 0x7fff) r1 = open(&(0x7f0000010000-0x6)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x2, 0x11, r1, 0x0) pkey_mprotect(&(0x7f0000004000/0x4000)=nil, 0x4000, 0xe, 0xffffffffffffffff) 2018/02/01 16:22:39 executing program 7: r0 = syz_open_procfs(0x0, &(0x7f0000004000)='map_files\x00') fstat(r0, &(0x7f0000000000)) 2018/02/01 16:22:39 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket(0x10, 0x2, 0x0) sendmsg$nl_route(r0, &(0x7f0000504000)={&(0x7f0000ba3000-0xc)={0x10}, 0xc, &(0x7f0000435000-0x10)={&(0x7f0000da6000)=@newlink={0x3c, 0x10, 0x9, 0xffffffffffffffff, 0xffffffffffffffff, {}, [@IFLA_IFNAME={0x14, 0x3, @syzn={0x73, 0x79, 0x7a, 0x0}}, @IFLA_MASTER={0x8, 0xa}]}, 0x3c}, 0x1}, 0x0) 2018/02/01 16:22:39 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000ff6000-0x18)={0xaa, 0x44}) 2018/02/01 16:22:39 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) rt_sigaction(0x9, &(0x7f0000fcb000), &(0x7f00007b4000), 0x8, &(0x7f00003ed000-0x8)) 2018/02/01 16:22:39 executing program 6: mmap(&(0x7f0000000000/0xaea000)=nil, 0xaea000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$mice(&(0x7f00003a6000-0x10)='/dev/input/mice\x00', 0x0, 0x41) write$tun(r0, &(0x7f0000ae8000)=@pi={0x0, 0x0, @ipv4={{0x5, 0x4, 0x0, 0x0, 0x44, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14}, @multicast2=0xe0000002, {[]}}, @gre={{0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x880b, 0x0, 0x0, []}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800, [], "1640ed933217bf838132cb7dcd41489c1b3d2e7ae060263146155a0db153b0e9"}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x86dd, []}}}}, 0x48) 2018/02/01 16:22:40 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x0, 0xffffffffffffffff, 0x0) r0 = gettid() rt_sigtimedwait(&(0x7f0000645000-0x8), &(0x7f0000ded000), &(0x7f000052f000)={0x40000077359400}, 0x8) pipe(&(0x7f0000d8c000-0x8)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000e13000-0x8)={0xffffffffffffffff, 0xffffffffffffffff}) tee(r1, r3, 0x80007387, 0x0) r4 = dup2(r2, r3) r5 = syz_open_dev$random(&(0x7f0000bdc000-0xc)='/dev/random\x00', 0x0, 0x0) dup2(r2, r5) ioctl$int_in(r4, 0x5452, &(0x7f0000e36000-0x8)=0x45) fcntl$setown(r2, 0x8, r0) fcntl$setsig(r5, 0xa, 0x12) r6 = gettid() tkill(r6, 0x100000000000016) 2018/02/01 16:22:40 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket(0xa, 0x40000000000002, 0x0) connect$inet6(r0, &(0x7f000064f000-0x1c)={0xa, 0xffffffffffffffff, 0x0, @remote={0xfe, 0x80, [], 0xffffffffffffffff, 0xbb}, 0x4}, 0x1c) sendmsg$inet_sctp(r0, &(0x7f00008e5000)={&(0x7f0000e09000)=@in={0x2, 0x0, @multicast1=0xe0000001}, 0x10, &(0x7f0000f0c000)=[]}, 0x10) 2018/02/01 16:22:40 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000e57000-0x18)={0xaa}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000799000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r1 = creat(&(0x7f0000729000)='./file0\x00', 0x0) write$sndseq(r1, &(0x7f0000012000-0x2e)=[{0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @time=@time={0x77359400}}], 0x30) ioctl$UFFDIO_ZEROPAGE(r0, 0x8010aa02, &(0x7f0000002000-0x10)={&(0x7f0000011000/0x3000)=nil, 0x3000}) ioctl$UFFDIO_UNREGISTER(r0, 0x8010aa01, &(0x7f0000bd0000)={&(0x7f0000d16000/0x1000)=nil, 0x1000}) eventfd2(0x0, 0x0) 2018/02/01 16:22:40 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = epoll_create1(0x0) r1 = socket$netlink(0x10, 0x3, 0x0) epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r1, &(0x7f0000028000)={0x4}) epoll_ctl$EPOLL_CTL_MOD(r0, 0x3, r1, &(0x7f0000030000)) epoll_wait(r0, &(0x7f000025b000)=[{}], 0x1, 0x0) 2018/02/01 16:22:40 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000fd6000-0x8)='./file0\x00', 0x0) mount(&(0x7f000000a000)='./file0\x00', &(0x7f0000027000-0x8)='./file0\x00', &(0x7f000000c000)='ramfs\x00', 0x0, &(0x7f000000a000)) mount(&(0x7f0000037000)='./file0\x00', &(0x7f0000c50000-0x8)='./file0\x00', &(0x7f000002f000-0x6)='ramfs\x00', 0x100000, &(0x7f0000ce3000)) mount(&(0x7f00002ba000-0x8)='./file0\x00', &(0x7f0000cbf000-0x8)='./file0\x00', &(0x7f0000dcd000)='ramfs\x00', 0x80000, &(0x7f000002f000)) mount(&(0x7f00009b1000)='./file0\x00', &(0x7f0000ae7000-0x8)='./file0\x00', &(0x7f0000226000)='an\x00\x00\x00\x00\x00\x00\x00\afs\x00', 0x100000, &(0x7f0000b64000-0x1000)) r0 = open(&(0x7f00006a2000)='./file0\x00', 0x0, 0x0) mkdirat(r0, &(0x7f0000034000-0x8)='./file0\x00', 0x0) mount(&(0x7f00001a5000-0xe)='./file0/file0\x00', &(0x7f00002fb000-0x8)='./file0/file0\x00', &(0x7f00002ba000)='\x00v\t', 0x1004, &(0x7f000073b000-0x1)) mount(&(0x7f00005e1000-0x8)='./file0\x00', &(0x7f0000df5000-0x8)='.', &(0x7f0000df4000)='%&t3\x00', 0x2000, &(0x7f00003db000-0x23)) 2018/02/01 16:22:40 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$inet6_int(r0, 0x29, 0x1, &(0x7f000009d000), &(0x7f0000d22000)=0x4) 2018/02/01 16:22:40 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind(r0, &(0x7f00009b3000-0x8)=@sco={0x1f, {0x7fffffff}}, 0x8) 2018/02/01 16:22:40 executing program 6: mmap(&(0x7f0000000000/0xf83000)=nil, 0xf83000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_int(r0, 0x29, 0x19, &(0x7f0000f73000-0x4)=0x621c, 0x4) setsockopt$inet6_int(r0, 0x29, 0x4a, &(0x7f0000f82000)=0x9, 0x4) sendto$inet6(r0, &(0x7f0000f73000-0x31), 0x0, 0x0, &(0x7f0000f5b000-0x1c)={0xa, 0x0, 0x0, @empty}, 0x1c) recvfrom$inet6(r0, &(0x7f00006f4000)=""/246, 0xf6, 0x23fffd, 0x0, 0x0) 2018/02/01 16:22:40 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000fd6000-0x8)='./file0\x00', 0x0) mount(&(0x7f000000a000)='./file0\x00', &(0x7f0000027000-0x8)='./file0\x00', &(0x7f000000c000)='ramfs\x00', 0x0, &(0x7f000000a000)) mount(&(0x7f000052f000)='./file0\x00', &(0x7f00008fd000-0x1)='.', &(0x7f00003a3000-0x6)="00e2660000", 0x1000, 0x0) mount(&(0x7f00002ba000-0x8)='./file0\x00', &(0x7f0000cbf000-0x8)='./file0\x00', &(0x7f0000dcd000)='ramfs\x00', 0x80000, &(0x7f000002f000)) mount(&(0x7f00009b1000)='./file0\x00', &(0x7f0000ae7000-0x8)='./file0\x00', &(0x7f0000226000)='an\x00\x00\x00\x00\x00\x00\x00\afs\x00', 0x100000, &(0x7f0000b64000-0x1000)) r0 = open(&(0x7f00006a2000)='./file0\x00', 0x0, 0x0) mkdirat(r0, &(0x7f0000034000-0x8)='./file0\x00', 0x0) mount(&(0x7f00001a5000-0xe)='./file0/file0\x00', &(0x7f00002fb000-0x8)='./file0/file0\x00', &(0x7f00002ba000)='\x00v\t', 0x1004, &(0x7f000073b000-0x1)) mount(&(0x7f00005e1000-0x8)='./file0\x00', &(0x7f0000df5000-0x8)='.', &(0x7f0000df4000)='%&t3\x00', 0x2000, &(0x7f00003db000-0x23)) 2018/02/01 16:22:40 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x1, 0x0) r1 = dup(r0) setsockopt$inet_tcp_int(r1, 0x6, 0x11, &(0x7f00007b6000-0x4)=0x1, 0x4) bind$inet(r0, &(0x7f000012e000)={0x2, 0x3, @broadcast=0xffffffff}, 0x10) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000e9c000-0x10)={0x1, &(0x7f0000f07000)=[{0x6, 0x0, 0x0, 0x101}]}, 0x10) connect$inet(r0, &(0x7f0000987000)={0x2, 0x3, @empty}, 0x10) sendto$inet(r1, &(0x7f00004ef000-0xf7)="96427feebcc603c266d2a2c2da2644124066d6c52746a66fd07a4a9370b924b494651c3febca0be535e0f30bbafe65b8b859d66972208f558b002bbc2366429da28cdb97727474f32fcce772ce439a1b5785bb74b8680705191a3d28e775b402a04cdf7881cf1c80eb042835db0e8c24fd0e3c0f396da612f44d9999de32f883521dfa4593a5772e19b5c0c27ace555870d7fe3a1819c614a8d9447cfa592c236d96bf255bf3966b0c1c34711ce489df2032a31902ae0742b79d7334ef248790fa0e3787e4b945215cddc03c4f384e6815bab43d34b8c04eb06ff00f10743a0e25f6", 0xe2, 0x4001, &(0x7f0000849000-0x10)={0x2, 0xffffffffffffffff, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}}, 0x10) sendto$inet(r1, &(0x7f0000e65000)='V', 0x1, 0x0, 0x0, 0x0) recvmsg(r1, &(0x7f000047c000-0x1c)={0x0, 0x0, &(0x7f0000ae1000)=[{&(0x7f00005bc000-0xff)=""/255, 0xff}], 0x1, &(0x7f0000aa1000)=""/148, 0x94}, 0x0) sendto$packet(r1, &(0x7f0000d56000)="e6", 0x1, 0x0, &(0x7f000072b000-0x14)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote={[0xaa, 0xaa, 0xaa, 0xaa], 0xffffffffffffffff, 0xbb}}, 0x14) 2018/02/01 16:22:40 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = add_key$keyring(&(0x7f000046c000)='keyring\x00', &(0x7f0000143000-0x5)={0x73, 0x79, 0x7a}, 0x0, 0x0, 0xfffffffffffffffd) keyctl$get_security(0x11, r0, &(0x7f0000df0000-0x4c)=""/76, 0x4c) 2018/02/01 16:22:40 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f000042c000)='/dev/sequencer\x00', 0x2000000a02, 0x0) write$sndseq(r0, &(0x7f0000f50000)=[{0x81, 0x2, 0x0, 0x0, @tick, {}, {}, @quote={{}, 0x0, &(0x7f0000dbe000)={0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @connect}}}], 0x1c) 2018/02/01 16:22:40 executing program 7: mmap(&(0x7f0000000000/0xdc7000)=nil, 0xdc7000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r1, &(0x7f0000001000-0xc)={0x10, 0x0, 0x0}, 0xc) bind$netlink(r0, &(0x7f0000007000)={0x10, 0x0, 0x0}, 0xc) close(r0) [ 206.085174] FAULT_FLAG_ALLOW_RETRY missing 30 [ 206.090128] CPU: 1 PID: 29740 Comm: syz-executor3 Not tainted 4.15.0+ #290 [ 206.097149] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 206.106513] Call Trace: [ 206.109100] dump_stack+0x194/0x257 [ 206.112712] ? arch_local_irq_restore+0x53/0x53 [ 206.117361] ? __lock_acquire+0x664/0x3e00 [ 206.121576] ? handle_userfault+0xb97/0x2500 [ 206.125968] handle_userfault+0xbd9/0x2500 [ 206.130181] ? handle_userfault+0x185a/0x2500 [ 206.134667] ? userfaultfd_ioctl+0x4520/0x4520 [ 206.139226] ? debug_check_no_locks_freed+0x3c0/0x3c0 [ 206.144390] ? trace_hardirqs_on_caller+0x390/0x5c0 [ 206.149383] ? trace_hardirqs_on+0xd/0x10 [ 206.153511] ? depot_save_stack+0x3b5/0x490 [ 206.157811] ? print_irqtrace_events+0x270/0x270 [ 206.162546] ? print_irqtrace_events+0x270/0x270 [ 206.167280] ? save_stack+0xa3/0xd0 [ 206.170886] ? save_stack+0x43/0xd0 [ 206.174489] ? kasan_kmalloc+0xad/0xe0 [ 206.178354] ? kasan_slab_alloc+0x12/0x20 [ 206.182478] ? kmem_cache_alloc+0x12e/0x760 [ 206.186775] ? ptlock_alloc+0x24/0x70 [ 206.190551] ? pte_alloc_one+0x59/0x100 [ 206.194503] ? __pte_alloc+0x2a/0x310 [ 206.198281] ? __handle_mm_fault+0x2d06/0x3ce0 [ 206.202849] ? handle_mm_fault+0x38f/0x930 [ 206.207059] ? __do_page_fault+0x5c9/0xc90 [ 206.211268] ? do_page_fault+0xee/0x720 [ 206.215221] ? page_fault+0x2c/0x60 [ 206.218829] ? iov_iter_fault_in_readable+0x1a7/0x410 [ 206.223996] ? generic_perform_write+0x200/0x600 [ 206.228744] ? __generic_file_write_iter+0x366/0x5b0 [ 206.233835] ? __vfs_write+0x684/0x970 [ 206.237705] ? __lock_acquire+0x664/0x3e00 [ 206.241919] ? __lock_acquire+0x664/0x3e00 [ 206.246130] ? print_irqtrace_events+0x270/0x270 [ 206.250864] ? check_noncircular+0x20/0x20 [ 206.255083] ? debug_check_no_locks_freed+0x3c0/0x3c0 [ 206.260249] ? debug_check_no_locks_freed+0x3c0/0x3c0 [ 206.265422] ? find_held_lock+0x35/0x1d0 [ 206.269471] ? __handle_mm_fault+0x3296/0x3ce0 [ 206.274033] ? lock_downgrade+0x980/0x980 [ 206.278161] ? lock_release+0xa40/0xa40 [ 206.282119] ? do_raw_spin_trylock+0x190/0x190 [ 206.286679] ? userfaultfd_ctx_put+0x720/0x720 [ 206.291245] ? _raw_spin_unlock+0x22/0x30 [ 206.295467] __handle_mm_fault+0x32a3/0x3ce0 [ 206.299861] ? __pmd_alloc+0x4e0/0x4e0 [ 206.303722] ? check_noncircular+0x20/0x20 [ 206.307933] ? print_irqtrace_events+0x270/0x270 [ 206.312672] ? find_held_lock+0x35/0x1d0 [ 206.316720] ? handle_mm_fault+0x2a0/0x930 [ 206.320934] ? lock_downgrade+0x980/0x980 [ 206.325099] handle_mm_fault+0x38f/0x930 [ 206.329138] ? __handle_mm_fault+0x3ce0/0x3ce0 [ 206.333695] ? vmacache_find+0x5f/0x280 [ 206.337648] ? find_vma+0x30/0x150 [ 206.341169] __do_page_fault+0x5c9/0xc90 [ 206.345217] ? mm_fault_error+0x2c0/0x2c0 [ 206.349343] ? lock_release+0xa40/0xa40 [ 206.353303] do_page_fault+0xee/0x720 [ 206.357082] ? __do_page_fault+0xc90/0xc90 [ 206.361301] ? _raw_spin_unlock+0x22/0x30 [ 206.365429] ? __mark_inode_dirty+0x262/0x1170 [ 206.369991] ? __inode_attach_wb+0xf70/0xf70 [ 206.374387] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 206.379216] page_fault+0x2c/0x60 [ 206.382646] RIP: 0010:iov_iter_fault_in_readable+0x1a7/0x410 [ 206.388415] RSP: 0018:ffff8801bd377928 EFLAGS: 00010246 [ 206.393755] RAX: 0000000000010000 RBX: 0000000020011fd2 RCX: ffffffff825adc81 [ 206.401001] RDX: 000000000000010c RSI: ffffc90005e96000 RDI: ffff8801bd377d28 [ 206.408253] RBP: ffff8801bd377a08 R08: 0000000000000000 R09: 1ffff10037a6eed1 [ 206.415499] R10: ffff8801bd377858 R11: 0000000000000003 R12: 1ffff10037a6ef28 [ 206.422746] R13: ffff8801bd3779e0 R14: 0000000000000000 R15: ffff8801bd377d20 [ 206.430009] ? iov_iter_fault_in_readable+0x1a1/0x410 [ 206.435188] ? iov_iter_fault_in_readable+0x1a1/0x410 [ 206.440358] ? iov_iter_revert+0x9d0/0x9d0 [ 206.444574] ? current_kernel_time64+0x122/0x2f0 [ 206.449310] ? trace_hardirqs_on_caller+0x421/0x5c0 [ 206.454303] ? trace_hardirqs_on+0xd/0x10 [ 206.458429] ? current_kernel_time64+0x1d4/0x2f0 [ 206.463166] generic_perform_write+0x200/0x600 [ 206.467726] ? __vfs_getxattr+0x8b/0xc0 [ 206.471694] ? filemap_fdatawait_keep_errors+0xb0/0xb0 [ 206.476962] ? file_update_time+0xd3/0x5b0 [ 206.481178] ? current_time+0xc0/0xc0 [ 206.484952] ? clear_nlink+0xb0/0xb0 [ 206.488655] ? down_write+0x87/0x120 [ 206.492352] __generic_file_write_iter+0x366/0x5b0 [ 206.497265] generic_file_write_iter+0x399/0x790 [ 206.502001] ? __generic_file_write_iter+0x5b0/0x5b0 [ 206.507090] ? iov_iter_init+0xaf/0x1d0 [ 206.511046] __vfs_write+0x684/0x970 [ 206.514736] ? lock_acquire+0x1d5/0x580 [ 206.518689] ? kernel_read+0x120/0x120 [ 206.522577] ? rcu_sync_lockdep_assert+0x6d/0xb0 [ 206.527308] ? __sb_start_write+0x209/0x2a0 [ 206.531609] vfs_write+0x189/0x510 [ 206.535128] SyS_write+0xef/0x220 [ 206.538559] ? SyS_read+0x220/0x220 [ 206.542161] ? trace_hardirqs_on_caller+0x421/0x5c0 [ 206.547156] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 206.551898] entry_SYSCALL_64_fastpath+0x29/0xa0 [ 206.556630] RIP: 0033:0x453299 [ 206.559794] RSP: 002b:00007f382d677c58 EFLAGS: 00000212 ORIG_RAX: 0000000000000001 [ 206.567476] RAX: ffffffffffffffda RBX: 000000000071bea0 RCX: 0000000000453299 [ 206.574721] RDX: 0000000000000030 RSI: 0000000020011fd2 RDI: 0000000000000014 2018/02/01 16:22:40 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$loop(&(0x7f00001b7000-0xb)='/dev/loop#\x00', 0x40, 0x0) ioctl(r0, 0x400000000000125e, &(0x7f0000177000-0x80)) 2018/02/01 16:22:40 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x0, 0xffffffffffffffff, 0x0) r0 = gettid() rt_sigtimedwait(&(0x7f0000645000-0x8), &(0x7f0000ded000), &(0x7f000052f000)={0x40000077359400}, 0x8) pipe(&(0x7f0000d8c000-0x8)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000e13000-0x8)={0xffffffffffffffff, 0xffffffffffffffff}) tee(r1, r3, 0x80007387, 0x0) r4 = dup2(r2, r3) r5 = syz_open_dev$random(&(0x7f0000bdc000-0xc)='/dev/random\x00', 0x0, 0x0) dup2(r2, r5) ioctl$int_in(r4, 0x5452, &(0x7f0000e36000-0x8)=0x45) fcntl$setown(r2, 0x8, r0) fcntl$setsig(r5, 0xa, 0x12) r6 = gettid() tkill(r6, 0x100000000000016) 2018/02/01 16:22:40 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f000014b000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003ba000-0x24)) ioctl$TCXONC(r0, 0x540a, 0x2) r1 = syz_open_pts(r0, 0x0) ioctl$TCXONC(r1, 0x540a, 0x0) 2018/02/01 16:22:40 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000fd6000-0x8)='./file0\x00', 0x0) mount(&(0x7f000000a000)='./file0\x00', &(0x7f0000027000-0x8)='./file0\x00', &(0x7f000000c000)='ramfs\x00', 0x0, &(0x7f000000a000)) mount(&(0x7f000052f000)='./file0\x00', &(0x7f00008fd000-0x1)='.', &(0x7f00003a3000-0x6)="00e2660000", 0x1000, 0x0) mount(&(0x7f00002ba000-0x8)='./file0\x00', &(0x7f0000cbf000-0x8)='./file0\x00', &(0x7f0000dcd000)='ramfs\x00', 0x80000, &(0x7f000002f000)) mount(&(0x7f00009b1000)='./file0\x00', &(0x7f0000ae7000-0x8)='./file0\x00', &(0x7f0000226000)='an\x00\x00\x00\x00\x00\x00\x00\afs\x00', 0x100000, &(0x7f0000b64000-0x1000)) r0 = open(&(0x7f00006a2000)='./file0\x00', 0x0, 0x0) mkdirat(r0, &(0x7f0000034000-0x8)='./file0\x00', 0x0) mount(&(0x7f00001a5000-0xe)='./file0/file0\x00', &(0x7f00002fb000-0x8)='./file0/file0\x00', &(0x7f00002ba000)='\x00v\t', 0x1004, &(0x7f000073b000-0x1)) mount(&(0x7f00005e1000-0x8)='./file0\x00', &(0x7f0000df5000-0x8)='.', &(0x7f0000df4000)='%&t3\x00', 0x2000, &(0x7f00003db000-0x23)) 2018/02/01 16:22:40 executing program 7: mmap(&(0x7f0000000000/0xf23000)=nil, 0xf23000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x2, 0x2000000088) connect$inet(r0, &(0x7f0000f20000)={0x2, 0xffffffffffffffff, @remote={0xac, 0x14, 0x0, 0xbb}}, 0x10) sendto$inet(r0, &(0x7f0000f22000-0xf), 0x3d, 0x48000, &(0x7f00000a9000-0x10)={0x2, 0x3, @multicast1=0xe0000001}, 0x10) writev(r0, &(0x7f0000cf8000-0x40)=[{&(0x7f0000f23000)="a0", 0x1}], 0x1) 2018/02/01 16:22:40 executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_buf(r0, 0x29, 0x39, &(0x7f0000eb3000), 0x0) 2018/02/01 16:22:40 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = inotify_init1(0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000bcd000-0xc)={0x0}, &(0x7f0000fc0000)=0xc) fcntl$setown(r0, 0x8, r1) fcntl$getownex(r0, 0x10, &(0x7f0000fc1000-0x8)={0x0, 0x0}) ptrace$setopts(0x4206, r2, 0x0, 0x0) ptrace(0x4207, r2) ptrace$setsig(0x4203, r2, 0x0, &(0x7f0000fbe000)) 2018/02/01 16:22:40 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqn(r0, 0x0, 0x27, &(0x7f0000f97000)={@multicast1=0xe0000001, @dev={0xac, 0x14, 0x0}}, 0xc) 2018/02/01 16:22:40 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000f4f000-0x8)='./file0\x00', 0x0) mount(&(0x7f000000a000)='./file0\x00', &(0x7f000000b000-0x8)='./file0\x00', &(0x7f000000c000)='ramfs\x00', 0x0, &(0x7f000001c000)) mkdir(&(0x7f0000156000-0xe)='./file0/file0\x00', 0x0) rename(&(0x7f0000b2a000)='./file0/file0\x00', &(0x7f0000ab4000-0x10)='./file0/control\x00') [ 206.581968] RBP: 000000000000031c R08: 0000000000000000 R09: 0000000000000000 [ 206.589215] R10: 0000000000000000 R11: 0000000000000212 R12: 00000000006f3b40 [ 206.596459] R13: 00000000ffffffff R14: 00007f382d6786d4 R15: 0000000000000000 2018/02/01 16:22:40 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) request_key(&(0x7f0000464000)='dns_resolver\x00', &(0x7f00009a7000-0x5)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000ffb000)='@\',-{\x00', 0xfffffffffffffffc) [ 206.653188] ptrace attach of "/root/syz-executor0"[4064] was attempted by "/root/syz-executor0"[29772] 2018/02/01 16:22:41 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x0, 0xffffffffffffffff, 0x0) r0 = gettid() rt_sigtimedwait(&(0x7f0000645000-0x8), &(0x7f0000ded000), &(0x7f000052f000)={0x40000077359400}, 0x8) pipe(&(0x7f0000d8c000-0x8)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000e13000-0x8)={0xffffffffffffffff, 0xffffffffffffffff}) tee(r1, r3, 0x80007387, 0x0) r4 = dup2(r2, r3) r5 = syz_open_dev$random(&(0x7f0000bdc000-0xc)='/dev/random\x00', 0x0, 0x0) dup2(r2, r5) ioctl$int_in(r4, 0x5452, &(0x7f0000e36000-0x8)=0x45) fcntl$setown(r2, 0x8, r0) fcntl$setsig(r5, 0xa, 0x12) r6 = gettid() tkill(r6, 0x100000000000016) 2018/02/01 16:22:41 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) rt_sigprocmask(0x0, &(0x7f0000033000-0x8)={0xfffffffffffffffe}, 0x0, 0x8) setrlimit(0x1, &(0x7f0000011000)) mkdir(&(0x7f0000551000)='./file0\x00', 0x0) mount(&(0x7f0000018000)='./file0\x00', &(0x7f000049c000-0x8)='./file0\x00', &(0x7f0000019000-0x6)='ramfs\x00', 0x0, &(0x7f000000a000)) creat(&(0x7f0000016000-0xc)='./file0/bus\x00', 0x0) truncate(&(0x7f0000006000)='./file0/bus\x00', 0x9) 2018/02/01 16:22:41 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) socket$packet(0x11, 0x2, 0x300) r0 = syz_open_procfs(0x0, &(0x7f0000ab4000)='net/packet\x00') sendfile(r0, r0, &(0x7f000004b000), 0xdc) 2018/02/01 16:22:41 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000fd6000-0x8)='./file0\x00', 0x0) mount(&(0x7f000000a000)='./file0\x00', &(0x7f0000027000-0x8)='./file0\x00', &(0x7f000000c000)='ramfs\x00', 0x0, &(0x7f000000a000)) mount(&(0x7f000052f000)='./file0\x00', &(0x7f00008fd000-0x1)='.', &(0x7f00003a3000-0x6)="00e2660000", 0x1000, 0x0) mount(&(0x7f00002ba000-0x8)='./file0\x00', &(0x7f0000cbf000-0x8)='./file0\x00', &(0x7f0000dcd000)='ramfs\x00', 0x80000, &(0x7f000002f000)) mount(&(0x7f00009b1000)='./file0\x00', &(0x7f0000ae7000-0x8)='./file0\x00', &(0x7f0000226000)='an\x00\x00\x00\x00\x00\x00\x00\afs\x00', 0x100000, &(0x7f0000b64000-0x1000)) r0 = open(&(0x7f00006a2000)='./file0\x00', 0x0, 0x0) mkdirat(r0, &(0x7f0000034000-0x8)='./file0\x00', 0x0) mount(&(0x7f00001a5000-0xe)='./file0/file0\x00', &(0x7f00002fb000-0x8)='./file0/file0\x00', &(0x7f00002ba000)='\x00v\t', 0x1004, &(0x7f000073b000-0x1)) mount(&(0x7f00005e1000-0x8)='./file0\x00', &(0x7f0000df5000-0x8)='.', &(0x7f0000df4000)='%&t3\x00', 0x2000, &(0x7f00003db000-0x23)) 2018/02/01 16:22:41 executing program 3: mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000003000-0xe8)={{{@in=@rand_addr, @in=@remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xa}, {}, {}, 0x0, 0x8}, {{@in=@dev={0xac, 0x14}}, 0x0, @in=@multicast2=0xe0000002}}, 0xe8) 2018/02/01 16:22:41 executing program 0: mmap(&(0x7f0000000000/0x7f9000)=nil, 0x7f9000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$key(0xa, 0x2, 0x88) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000008000)={0xa, 0x0, 0x0, 0x4, 0x3, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, [@sadb_x_nat_t_port={0x1}]}, 0x18}, 0x1}, 0x0) 2018/02/01 16:22:41 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000fd6000-0x8)='./file0\x00', 0x0) mount(&(0x7f000052c000)='./file0\x00', &(0x7f000035e000)='./file0\x00', &(0x7f00005c2000)='fusectl\x00', 0x0, &(0x7f000041c000-0xd)) 2018/02/01 16:22:41 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) clock_adjtime(0x0, &(0x7f000037f000)={0x7fffffff}) 2018/02/01 16:22:41 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqn(r0, 0x0, 0x27, &(0x7f0000000000)={@multicast2=0xe0000002, @loopback=0x7f000001}, 0xc) setsockopt$inet_msfilter(r0, 0x0, 0x29, &(0x7f0000888000)={@multicast2=0xe0000002, @loopback=0x7f000001, 0x0, 0x3, [@loopback=0x7f000001, @empty, @local={0xac, 0x14, 0xffffffffffffffff, 0xaa}]}, 0x1c) r1 = dup(r0) setsockopt$inet_mreqsrc(r1, 0x0, 0x25, &(0x7f00007ac000)={@multicast2=0xe0000002, @dev={0xac, 0x14, 0x0, 0xe}, @loopback=0x7f000001}, 0xc) 2018/02/01 16:22:41 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xd25000)=nil, 0xd25000, 0x1000001, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sg(&(0x7f0000e3a000-0x9)='/dev/sg#\x00', 0x0, 0x142) write(r0, &(0x7f000023b000)="ddc1c992757ba20660367e97d8d9ad86f4b78974721e09ead46d4ccccfd6b790014ff2bd2ca43e7c50a9", 0x2a) r1 = fcntl$dupfd(r0, 0x0, r0) ppoll(&(0x7f0000d63000)=[{r1}], 0x1, &(0x7f0000676000)={0x77359400}, &(0x7f000011e000-0x8), 0x8) 2018/02/01 16:22:41 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000ba3000)={@syzn={0x73, 0x79, 0x7a, 0x0}, &(0x7f0000b33000-0x40a2)=@ethtool_per_queue_op={0x4b}}) 2018/02/01 16:22:41 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000fd6000-0x8)='./file0\x00', 0x0) mount(&(0x7f0000037000)='./file0\x00', &(0x7f0000c50000-0x8)='./file0\x00', &(0x7f000002f000-0x6)='ramfs\x00', 0x100000, &(0x7f0000ce3000)) mount(&(0x7f000052f000)='./file0\x00', &(0x7f00008fd000-0x1)='.', &(0x7f00003a3000-0x6)="00e2660000", 0x1000, 0x0) mount(&(0x7f00002ba000-0x8)='./file0\x00', &(0x7f0000cbf000-0x8)='./file0\x00', &(0x7f0000dcd000)='ramfs\x00', 0x80000, &(0x7f000002f000)) mount(&(0x7f00009b1000)='./file0\x00', &(0x7f0000ae7000-0x8)='./file0\x00', &(0x7f0000226000)='an\x00\x00\x00\x00\x00\x00\x00\afs\x00', 0x100000, &(0x7f0000b64000-0x1000)) r0 = open(&(0x7f00006a2000)='./file0\x00', 0x0, 0x0) mkdirat(r0, &(0x7f0000034000-0x8)='./file0\x00', 0x0) mount(&(0x7f00001a5000-0xe)='./file0/file0\x00', &(0x7f00002fb000-0x8)='./file0/file0\x00', &(0x7f00002ba000)='\x00v\t', 0x1004, &(0x7f000073b000-0x1)) mount(&(0x7f00005e1000-0x8)='./file0\x00', &(0x7f0000df5000-0x8)='.', &(0x7f0000df4000)='%&t3\x00', 0x2000, &(0x7f00003db000-0x23)) 2018/02/01 16:22:41 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x2, &(0x7f0000ed4000)=0x7b, 0x4) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x3, @broadcast=0xffffffff}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000f2000-0x5)='yeah\x00', 0x1000000b8) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000d26000)={0x1, &(0x7f0000818000)=[{0x6, 0x0, 0x0, 0x100}]}, 0x10) sendto$inet(r0, &(0x7f0000618000-0x37), 0x0, 0x20000000, &(0x7f0000deb000-0x10)={0x2, 0x3, @loopback=0x7f000001}, 0x10) sendto$inet(r0, &(0x7f0000203000)="59c39b3ffda32e60e3b3f0575061f1f2085409d2f6bc043a5e70350c450a2bc0436bfc1f2246192dd89214ba7b10c1a0b74caf5bf66ba628084b20051b2d011e0d1c84512180ae36180285db43c2cbfa85f04d1bbcf99fa457733e315b5f0e3dd33dccf77a87e15bf02c16be41b28c26683cbdc0fbe8132c39f9e0d0e5c320b6a8a6687c654e8383fe3bcd912f5acb925dce98e64ae28c1a6c9273aa3d6f7c1f95e2e98f9d1f31116b1e7e617ee27bba01232240e64fc3150e0153442dc2610b2ccf50d942a6844bc571ccc787a5a93b087a342cc6752178d0bcdf0795d38837d3afa31de40b14bf19ace3fa71bb9f9793afd75e15d5eca1403556dc5346ac0ea419ef0d73490e479b1b73bffc63a22fc7a6d698fbdaebfb8f29ac60cfdd6fbc017031bc443a766067457a6ec995fd4b7df3c85d636175f5041a42b6a84393f730c12bd79f07397bd93240c428b21e875381644ca34f8ab845ee80a0c2e5a0557b5aee08a08fd084230301951f84400b0501c358383ec0b2065b8e4e88ca592740294c9936e6123ff5a9a13294404d860b81c460e075b4e8b14815ceb53c08016631632e46f16a4ec31ce333d0c51ff6eda291fb2855618379019ff76965eb8478dfa7f1597a4e0e9a9d006fffa89e904f5952cbde2363c84f41e94c9e0ddf3cd56a73f8550484fa07dfdf2b5e2e4ce1588f86423406a089a9334ceffaf3057f196a2eb1d8ff9b8aee52ae67c98aae024bbc7303183627d03149c17893538551a3fcfcf665954085ac683a2a90b8ab44515a47dd36071298ca77eb4a37a8dc70b17d6c550b2f86081ba728d5114edbe32f5fca3905b3a7e73b271274c65287784aeec162efd2af6d6c3645d102b3d7a8a9842ce5c4a4ca2ff5590f47a04a4583770220e69e526b98451a160a5f496b1174ef844305dd0e1a8a16aebd60965f5ba390d3e5e08eacccea3623589080378df2b34d1f27e595c2c2014d3f92de02f334b99a0c820ab051af8fbfe1aaf68b54c0369fa3da6ca788087b6ee632205f4636b7d6b81a61a761041cd218a6699f3c0a6d51bddbe11ff08c7a8a1c9bdb4ee2c4411e236165170ba82895cbd175ad07a23caa15009b14a98c4196dc2a2a96dbd19b95b5a99d81ec42fd10491d3d8e8dccd829c26b860e11418c6fcffe18ef7ff3f4772ce84bc72b45ad725c05d73f702088dc822af8d0c63d72837b1cbd5c80fc1f6d3e8214fb4302aee60ed868824e1f2187bd3cdacd3f97199615af7170d919da4171203b05327470c7d8dd9d96c3773f608348144770b387d1be4ef3409bd2a0c7244a3e59e74ccbdad66f7e1db2dc07dc77356b47f2bb6bd7e63e31d5b2e8e0bbedaff86ab9c5c4976cc3d3ea08f4f811d24a43bdb7ad3ddd48ab031ecb7d0dcfd689edac9d31a9ad02277fa76ac8fa17b62ece4a59a919ea8855ae6b066e6d9c97af4630e30c70ad5ae1bbd13b85553c4779c2e9900d4720ff30bdf926e64a2e038f4faaaf478cb19585c8bae534236773d90c65d02e2b4aaf56fd7964f83fd07fc7efa5ab4b0635b7880132fdfae380a1a96d45", 0x457, 0x0, &(0x7f0000581000)={0x2, 0xffffffffffffffff, @multicast2=0xe0000002}, 0x10) 2018/02/01 16:22:41 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f000092e000)='./file0\x00', 0x0) r1 = open(&(0x7f0000f15000-0x8)='./file0\x00', 0x0, 0x0) fcntl$setlease(r0, 0x400, 0x0) ioctl$int_out(r1, 0xc0189436, &(0x7f000000a000)) 2018/02/01 16:22:41 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x80002, 0x88) recvfrom$inet6(r0, &(0x7f0000fbf000-0x93)=""/185, 0xffffffffffffff89, 0x0, 0x0, 0xffffffffffffff8f) bind$inet6(r0, &(0x7f00008a8000)={0xa, 0x3, 0x0, @empty}, 0x1c) r1 = socket$inet6(0xa, 0x8000000000000802, 0x88) sendmsg$inet_sctp(r1, &(0x7f0000a29000)={&(0x7f0000150000)=@in6={0xa, 0x3, 0x0, @loopback={0x0, 0x1}}, 0x397, &(0x7f0000fc8000)=[]}, 0x8002) sendto$inet6(r1, &(0x7f0000b0d000-0x92), 0xffed, 0x0, &(0x7f000001b000)={0xa, 0xffffffffffffffff, 0x0, @empty}, 0x1c) 2018/02/01 16:22:41 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = gettid() rt_sigtimedwait(&(0x7f0000645000-0x8), &(0x7f0000ded000), &(0x7f000052f000)={0x40000077359400}, 0x8) pipe(&(0x7f0000d8c000-0x8)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000e13000-0x8)={0xffffffffffffffff, 0xffffffffffffffff}) tee(0xffffffffffffffff, r3, 0x80007387, 0x0) r4 = dup2(r2, r3) r5 = syz_open_dev$random(&(0x7f0000bdc000-0xc)='/dev/random\x00', 0x0, 0x0) dup2(r2, r5) ioctl$int_in(r4, 0x5452, &(0x7f0000e36000-0x8)=0x45) fcntl$setown(r2, 0x8, r0) fcntl$setsig(r5, 0xa, 0x12) r6 = gettid() tkill(r6, 0x100000000000016) 2018/02/01 16:22:41 executing program 2: mmap(&(0x7f0000000000/0x17000)=nil, 0x17000, 0x3, 0x32, 0xffffffffffffffff, 0x0) seccomp(0x1, 0x0, &(0x7f0000017000-0x8)={0x5, &(0x7f0000017000-0x28)=[{}, {}, {}, {}, {0xb7e}]}) 2018/02/01 16:22:41 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000000a000)={0x0, 0x78}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$evdev(&(0x7f000063a000)='/dev/input/event#\x00', 0x2, 0x0) ioctl$EVIOCGREP(r0, 0x80084503, &(0x7f0000001000)) 2018/02/01 16:22:41 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f00004ad000-0x4), 0x4) sendto$inet(r0, &(0x7f0000589000-0x1), 0xfffffffffffffea7, 0x20020006, &(0x7f0000386000-0x10)={0x2, 0xffffffffffffffff, @loopback=0x7f000001}, 0x10) 2018/02/01 16:22:41 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000fd6000-0x8)='./file0\x00', 0x0) mount(&(0x7f0000037000)='./file0\x00', &(0x7f0000c50000-0x8)='./file0\x00', &(0x7f000002f000-0x6)='ramfs\x00', 0x100000, &(0x7f0000ce3000)) mount(&(0x7f000052f000)='./file0\x00', &(0x7f00008fd000-0x1)='.', &(0x7f00003a3000-0x6)="00e2660000", 0x1000, 0x0) mount(&(0x7f00002ba000-0x8)='./file0\x00', &(0x7f0000cbf000-0x8)='./file0\x00', &(0x7f0000dcd000)='ramfs\x00', 0x80000, &(0x7f000002f000)) mount(&(0x7f00009b1000)='./file0\x00', &(0x7f0000ae7000-0x8)='./file0\x00', &(0x7f0000226000)='an\x00\x00\x00\x00\x00\x00\x00\afs\x00', 0x100000, &(0x7f0000b64000-0x1000)) r0 = open(&(0x7f00006a2000)='./file0\x00', 0x0, 0x0) mkdirat(r0, &(0x7f0000034000-0x8)='./file0\x00', 0x0) mount(&(0x7f00001a5000-0xe)='./file0/file0\x00', &(0x7f00002fb000-0x8)='./file0/file0\x00', &(0x7f00002ba000)='\x00v\t', 0x1004, &(0x7f000073b000-0x1)) mount(&(0x7f00005e1000-0x8)='./file0\x00', &(0x7f0000df5000-0x8)='.', &(0x7f0000df4000)='%&t3\x00', 0x2000, &(0x7f00003db000-0x23)) 2018/02/01 16:22:41 executing program 4: mmap(&(0x7f0000000000/0x19000)=nil, 0x19000, 0x3, 0x32, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000013000)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000005000-0x10)={0x2, &(0x7f0000017000-0x10)=[{0x3c}, {0x6}]}, 0x8) writev(r1, &(0x7f0000009000)=[{&(0x7f000000f000-0x1000)="8f", 0x1}], 0x1) 2018/02/01 16:22:41 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) clone(0x200, &(0x7f0000251000+0xdca), &(0x7f0000744000), &(0x7f0000fef000), &(0x7f0000dad000-0x37)) mknod(&(0x7f00008db000-0x8)='./file0\x00', 0x0, 0x0) syz_open_dev$mice(&(0x7f00009ef000-0x10)='/dev/input/mice\x00', 0x0, 0x6400) 2018/02/01 16:22:42 executing program 2: prlimit64(0x0, 0x0, &(0x7f0000006000-0x8), &(0x7f0000009000-0x8)) 2018/02/01 16:22:42 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = add_key(&(0x7f0000de1000-0x5)='user\x00', &(0x7f000000f000)={0x73, 0x79, 0x7a}, &(0x7f0000ea7000)='?', 0x1, 0xfffffffffffffffd) add_key$user(&(0x7f0000d01000-0x5)='user\x00', &(0x7f0000435000-0x5)={0x73, 0x79, 0x7a}, &(0x7f00000b0000-0xb5), 0x0, r0) 2018/02/01 16:22:42 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = memfd_create(&(0x7f0000978000)='ppp1\x00', 0x0) ftruncate(r0, 0xffff) write(r0, &(0x7f00007fc000-0x3)='H', 0x1) sendfile(r0, r0, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x4, 0x11, r0, 0x0) quotactl(0x0, &(0x7f0000001000)='./file0\x00', 0x0, &(0x7f0000001000-0x85)) 2018/02/01 16:22:42 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) openat$rtc(0xffffffffffffff9c, &(0x7f0000596000-0x2)='/dev/rtc\x00', 0x0, 0x0) r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000d17000)='/dev/sequencer2\x00', 0x0, 0x0) ioctl$sock_SIOCGPGRP(r0, 0xc004510e, &(0x7f00005ce000)) 2018/02/01 16:22:42 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008ff000-0x10)={&(0x7f0000301000-0x40)={0x2, 0x1, 0x0, 0x3, 0x8, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, [@sadb_address={0x3, 0x6, 0x0, 0x0, 0x0, @in={0x2, 0xffffffffffffffff, @dev={0xac, 0x14}}}, @sadb_address={0x3, 0x5, 0x0, 0x0, 0x0, @in={0x2, 0xffffffffffffffff, @multicast1=0xe0000001}}]}, 0x40}, 0x1}, 0x0) 2018/02/01 16:22:42 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x1, 0x0) r1 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f00004ad000-0x4)={0x0, 0x6}, 0x4) connect$inet(r0, &(0x7f0000987000)={0x2, 0xffffffffffffffff, @empty}, 0x10) 2018/02/01 16:22:42 executing program 4: mmap(&(0x7f0000000000/0x1f000)=nil, 0x1f000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f0000005000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000014000-0x30)={0x8, 0x0, &(0x7f0000014000-0x8)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000012000)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000e000-0x30)={0x10, 0x0, &(0x7f000001d000-0x10)=[@increfs={0x40046304}, @release={0x40046306}], 0x0, 0x0, &(0x7f000001c000)}) [ 207.832177] binder: BINDER_SET_CONTEXT_MGR already set [ 207.851969] binder: 29857:29862 ioctl 40046207 0 returned -16 [ 209.037952] IPVS: ftp: loaded support on port[0] = 21 [ 209.303584] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready 2018/02/01 16:22:44 executing program 3: r0 = socket$inet6(0xa, 0x802, 0x0) setsockopt$inet6_buf(r0, 0x29, 0x49, &(0x7f0000f6e000), 0x0) 2018/02/01 16:22:44 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = inotify_init1(0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000b04000-0xc)={0x0}, &(0x7f000067b000+0xa27)=0xc) fcntl$setown(r0, 0x8, r1) fcntl$getownex(r0, 0x10, &(0x7f0000d64000)={0x0, 0x0}) tkill(r2, 0x0) 2018/02/01 16:22:44 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000f8b000)={{{@in6=@loopback={0x0, 0x1}, @in=@remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x2}}, {{@in=@multicast1=0xe0000001}, 0x0, @in=@multicast1=0xe0000001, 0xffffffffffffffff, 0x0, 0x0, 0xfffffffffffffffd}}, 0xe8) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f00001c6000)={0x0, 0x0, &(0x7f0000416000-0x8)={&(0x7f000069a000)={0x2, 0x12, 0x0, 0x0, 0x2, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, []}, 0x10}, 0x1}, 0x0) 2018/02/01 16:22:44 executing program 0: r0 = socket(0x18, 0x0, 0x1) mmap(&(0x7f0000000000/0x95c000)=nil, 0x95c000, 0x0, 0x0, 0xffffffffffffffff, 0x0) getsockopt$inet_sctp6_SCTP_CONTEXT(r0, 0x111, 0x11, &(0x7f00004a2000-0x8), &(0x7f0000972000)=0xffffffffffffff6c) 2018/02/01 16:22:44 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = memfd_create(&(0x7f000054d000)='em0\x00', 0x0) write$eventfd(r0, &(0x7f0000b8e000), 0xfffffffffffffdb9) 2018/02/01 16:22:44 executing program 4: mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x0) ioctl$EVIOCSKEYCODE(r0, 0x40084504, &(0x7f0000003000-0x4)) 2018/02/01 16:22:44 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000fd6000-0x8)='./file0\x00', 0x0) mount(&(0x7f0000037000)='./file0\x00', &(0x7f0000c50000-0x8)='./file0\x00', &(0x7f000002f000-0x6)='ramfs\x00', 0x100000, &(0x7f0000ce3000)) mount(&(0x7f000052f000)='./file0\x00', &(0x7f00008fd000-0x1)='.', &(0x7f00003a3000-0x6)="00e2660000", 0x1000, 0x0) mount(&(0x7f00002ba000-0x8)='./file0\x00', &(0x7f0000cbf000-0x8)='./file0\x00', &(0x7f0000dcd000)='ramfs\x00', 0x80000, &(0x7f000002f000)) mount(&(0x7f00009b1000)='./file0\x00', &(0x7f0000ae7000-0x8)='./file0\x00', &(0x7f0000226000)='an\x00\x00\x00\x00\x00\x00\x00\afs\x00', 0x100000, &(0x7f0000b64000-0x1000)) r0 = open(&(0x7f00006a2000)='./file0\x00', 0x0, 0x0) mkdirat(r0, &(0x7f0000034000-0x8)='./file0\x00', 0x0) mount(&(0x7f00001a5000-0xe)='./file0/file0\x00', &(0x7f00002fb000-0x8)='./file0/file0\x00', &(0x7f00002ba000)='\x00v\t', 0x1004, &(0x7f000073b000-0x1)) mount(&(0x7f00005e1000-0x8)='./file0\x00', &(0x7f0000df5000-0x8)='.', &(0x7f0000df4000)='%&t3\x00', 0x2000, &(0x7f00003db000-0x23)) 2018/02/01 16:22:44 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = gettid() rt_sigtimedwait(&(0x7f0000645000-0x8), &(0x7f0000ded000), &(0x7f000052f000)={0x40000077359400}, 0x8) pipe(&(0x7f0000d8c000-0x8)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000e13000-0x8)={0xffffffffffffffff, 0xffffffffffffffff}) tee(0xffffffffffffffff, r3, 0x80007387, 0x0) r4 = dup2(r2, r3) r5 = syz_open_dev$random(&(0x7f0000bdc000-0xc)='/dev/random\x00', 0x0, 0x0) dup2(r2, r5) ioctl$int_in(r4, 0x5452, &(0x7f0000e36000-0x8)=0x45) fcntl$setown(r2, 0x8, r0) fcntl$setsig(r5, 0xa, 0x12) r6 = gettid() tkill(r6, 0x100000000000016) 2018/02/01 16:22:44 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket(0x10, 0x2, 0x0) capset(&(0x7f00001b5000-0x8)={0x19980330}, &(0x7f0000780000-0x18)) sendmsg$nl_route(r0, &(0x7f0000504000)={&(0x7f0000ba3000-0xc)={0x10}, 0xc, &(0x7f0000435000-0x10)={&(0x7f0000ff8000)=@newlink={0x20, 0x10, 0x9, 0xffffffffffffffff, 0xffffffffffffffff, {}, []}, 0x20}, 0x1}, 0x0) 2018/02/01 16:22:44 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f00001ff000-0x1c)={0xa, 0x2, 0x0, @empty}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000fb4000), 0x0, 0x20000004, &(0x7f00007aa000)={0xa, 0x2, 0x0, @empty}, 0x1c) r2 = accept4(r1, &(0x7f0000219000-0x58)=@alg, &(0x7f0000db5000-0x4)=0x58, 0x0) shutdown(r0, 0x1) sendmsg$nl_crypto(r2, &(0x7f0000485000-0x38)={&(0x7f0000816000)={0x10}, 0xc, &(0x7f0000c37000)={&(0x7f0000fa3000)=@get={0xe0, 0x13, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, {{'cbc-aes-aesni\x00'}}, []}, 0x10176}, 0x1}, 0x0) 2018/02/01 16:22:44 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000b7a000-0xa)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003ba000-0x24)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000fdd000)=0x3) ioctl$PIO_UNISCRNMAP(r1, 0x80047437, &(0x7f00007da000-0x7a)) 2018/02/01 16:22:44 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = memfd_create(&(0x7f0000b2e000-0x4)='dev ', 0x0) write(r0, &(0x7f00009b9000)="b93377b140ee109bf030f775071ef68c2618a248aa7315", 0x17) sendfile(r0, r0, &(0x7f0000001000), 0xfe9) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x4, 0x11, r0, 0x0) symlink(&(0x7f0000001000)='./file0\x00', &(0x7f0000002000)='./file0\x00') 2018/02/01 16:22:44 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) keyctl$set_reqkey_keyring(0xe, 0x0) mkdir(&(0x7f00000e8000-0x8)='./file0\x00', 0x0) mount(&(0x7f000000a000)='./file0\x00', &(0x7f0000027000-0x8)='./file0\x00', &(0x7f000000c000)='ramfs\x00', 0x0, &(0x7f000000a000)) mount(&(0x7f0000d04000)='./file0\x00', &(0x7f0000903000)='./file0\x00', &(0x7f0000812000-0x6)='bdev\x00', 0x100000, &(0x7f0000444000)) mount(&(0x7f0000aa0000-0x8)='./file0\x00', &(0x7f0000ffa000-0x1)='.', &(0x7f0000fdb000)='ubifs\x00', 0x1000, 0x0) mount(&(0x7f00002ba000-0x8)='./file0\x00', &(0x7f0000cbf000-0x8)='./file0\x00', &(0x7f00005f8000-0x6)='ramfs\x00', 0x80000, &(0x7f000002f000)) mount(&(0x7f0000378000-0x8)='.', &(0x7f0000188000-0x8)='.', &(0x7f0000753000)='mslos\x00', 0x5010, &(0x7f00000e7000)) mount(&(0x7f0000add000-0x8)='./file0\x00', &(0x7f0000e09000-0x1)='.', &(0x7f00005e9000)='cifs\x00', 0x803000, &(0x7f0000ed0000)) umount2(&(0x7f0000f45000)='.', 0x0) 2018/02/01 16:22:44 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mount(&(0x7f000000a000)='./file0\x00', &(0x7f0000027000-0x8)='./file0\x00', &(0x7f000000c000)='ramfs\x00', 0x0, &(0x7f000000a000)) mount(&(0x7f0000037000)='./file0\x00', &(0x7f0000c50000-0x8)='./file0\x00', &(0x7f000002f000-0x6)='ramfs\x00', 0x100000, &(0x7f0000ce3000)) mount(&(0x7f000052f000)='./file0\x00', &(0x7f00008fd000-0x1)='.', &(0x7f00003a3000-0x6)="00e2660000", 0x1000, 0x0) mount(&(0x7f00002ba000-0x8)='./file0\x00', &(0x7f0000cbf000-0x8)='./file0\x00', &(0x7f0000dcd000)='ramfs\x00', 0x80000, &(0x7f000002f000)) mount(&(0x7f00009b1000)='./file0\x00', &(0x7f0000ae7000-0x8)='./file0\x00', &(0x7f0000226000)='an\x00\x00\x00\x00\x00\x00\x00\afs\x00', 0x100000, &(0x7f0000b64000-0x1000)) r0 = open(&(0x7f00006a2000)='./file0\x00', 0x0, 0x0) mkdirat(r0, &(0x7f0000034000-0x8)='./file0\x00', 0x0) mount(&(0x7f00001a5000-0xe)='./file0/file0\x00', &(0x7f00002fb000-0x8)='./file0/file0\x00', &(0x7f00002ba000)='\x00v\t', 0x1004, &(0x7f000073b000-0x1)) mount(&(0x7f00005e1000-0x8)='./file0\x00', &(0x7f0000df5000-0x8)='.', &(0x7f0000df4000)='%&t3\x00', 0x2000, &(0x7f00003db000-0x23)) 2018/02/01 16:22:44 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mkdir(&(0x7f000082f000)='./control\x00', 0x0) r0 = open(&(0x7f0000a08000)='./control\x00', 0x0, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) symlinkat(&(0x7f00007ae000-0x8)='./file0\x00', r0, &(0x7f0000a31000-0xa)='./control\x00') r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000e4c000)={0xaa}) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000044000-0x20)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r2 = creat(&(0x7f00000df000)='./file0\x00', 0x0) write$sndseq(r2, &(0x7f0000012000-0x2e)=[{0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @time=@time={0x77359400}}], 0x30) link(&(0x7f0000b40000-0xa)='./file0\x00', &(0x7f00006b4000-0x10)='./control/file0\x00') utimensat(r0, &(0x7f0000e03000-0x10)='./control/file0\x00', &(0x7f00003e7000-0x10)={{}, {0x0, 0x2710}}, 0x0) 2018/02/01 16:22:44 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000e4e000-0xf)='/dev/sequencer\x00', 0xa202, 0x0) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00005a8000)='/dev/sequencer2\x00', 0x0, 0x0) write$sndseq(r0, &(0x7f000078a000-0x30)=[{0x0, 0x0, 0x0, 0x0, @tick, {0x4}, {}, @raw8={"7a88d654f95067fe68d2359f"}}], 0x30) ioctl$TCSETA(r1, 0x5402, &(0x7f000032d000-0x14)) close(r1) write$sndseq(r0, &(0x7f00006c3000)=[{0x40081, 0x4, 0x0, 0x0, @tick, {}, {}, @time=@tick}], 0x30) 2018/02/01 16:22:44 executing program 3: mmap(&(0x7f0000000000/0x16000)=nil, 0x16000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000005000-0x38)={0x0, 0x0, &(0x7f0000010000-0x10)=[{&(0x7f000000f000-0x24)="240000002400030f07fffd946fa283bc0a0000400300000000000000000000000397737e", 0x24}], 0x1}, 0x0) 2018/02/01 16:22:44 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00000d6000)='/dev/sequencer2\x00', 0x10000000c0082, 0x0) ioctl$TCSETS(r0, 0x5402, &(0x7f0000b6c000-0x24)) pwrite64(r0, &(0x7f0000706000)="94000bfff3d40060", 0x8, 0x0) 2018/02/01 16:22:44 executing program 3: mmap(&(0x7f0000000000/0xf82000)=nil, 0xf82000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_int(r0, 0x29, 0x19, &(0x7f0000f7c000)=0x7, 0x4) sendto$inet6(r0, &(0x7f000062c000-0x1)='8', 0x1, 0x0, &(0x7f0000f81000-0x1c)={0xa, 0x0, 0x0, @empty, 0xfffffffffffffffd}, 0x1c) recvfrom$inet6(r0, &(0x7f00006f4000)=""/246, 0x44f, 0x23fffd, 0x0, 0x0) ioctl$sock_netrom_SIOCGSTAMP(r0, 0x8906, &(0x7f00006dd000)) 2018/02/01 16:22:44 executing program 0: mmap(&(0x7f0000000000/0xfd5000)=nil, 0xfd5000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x0) ioctl$EVIOCSMASK(r0, 0x40104593, &(0x7f00008d0000)={0x0, 0x0, &(0x7f0000fd6000+0xedd)}) ioctl$EVIOCGMASK(r0, 0x80104592, &(0x7f0000772000-0x10)={0x0, 0x0, &(0x7f0000fd7000)}) [ 210.663383] IPVS: ftp: loaded support on port[0] = 21 [ 210.931844] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready 2018/02/01 16:22:45 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00007f6000)=0x9) clone(0x28004100, &(0x7f0000001000-0xf7), &(0x7f0000001000-0x1), &(0x7f0000ace000-0x4), &(0x7f0000001000-0x65)) 2018/02/01 16:22:45 executing program 3: mmap(&(0x7f0000000000/0x24000)=nil, 0x24000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndtimer(&(0x7f0000014000)='/dev/snd/timer\x00', 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_TREAD(r0, 0x40045402, &(0x7f000001e000-0x4)=0x1) ioctl$SNDRV_TIMER_IOCTL_SELECT(r0, 0x40345410, &(0x7f0000001000)={{0x100000001}}) read(r0, &(0x7f0000022000-0x20)=""/32, 0x20) ioctl$SNDRV_TIMER_IOCTL_PARAMS(r0, 0x40505412, &(0x7f000001d000-0x50)={0x0, 0x1, 0x0, 0x0, 0xf}) ioctl$SNDRV_TIMER_IOCTL_START(r0, 0x54a0) 2018/02/01 16:22:45 executing program 2: mmap(&(0x7f0000000000/0xfe1000)=nil, 0xfe1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003ba000-0x24)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000011000-0x4)=0x800000003) dup3(r1, r0, 0x0) 2018/02/01 16:22:45 executing program 7: r0 = request_key(&(0x7f00004df000)='rxrpc_s\x00', &(0x7f0000537000)={0x73, 0x79, 0x7a}, &(0x7f00009fd000)='keyring,\x00', 0xfffffffffffffffe) r1 = request_key(&(0x7f0000381000)='encrypted\x00', &(0x7f00001fe000-0x4)={0x73, 0x79, 0x7a}, &(0x7f0000e2b000-0x1)='\x00', 0xfffffffffffffffa) keyctl$link(0x8, r0, r1) 2018/02/01 16:22:45 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000010000+0x7d8)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000004000)={0x44, 0x0, &(0x7f0000012000-0xbc)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f000000f000-0x50)=[], &(0x7f0000011000)=[]}}], 0x0, 0x0, &(0x7f0000012000-0x5d)}) 2018/02/01 16:22:45 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mount(&(0x7f000000a000)='./file0\x00', &(0x7f0000027000-0x8)='./file0\x00', &(0x7f000000c000)='ramfs\x00', 0x0, &(0x7f000000a000)) mount(&(0x7f0000037000)='./file0\x00', &(0x7f0000c50000-0x8)='./file0\x00', &(0x7f000002f000-0x6)='ramfs\x00', 0x100000, &(0x7f0000ce3000)) mount(&(0x7f000052f000)='./file0\x00', &(0x7f00008fd000-0x1)='.', &(0x7f00003a3000-0x6)="00e2660000", 0x1000, 0x0) mount(&(0x7f00002ba000-0x8)='./file0\x00', &(0x7f0000cbf000-0x8)='./file0\x00', &(0x7f0000dcd000)='ramfs\x00', 0x80000, &(0x7f000002f000)) mount(&(0x7f00009b1000)='./file0\x00', &(0x7f0000ae7000-0x8)='./file0\x00', &(0x7f0000226000)='an\x00\x00\x00\x00\x00\x00\x00\afs\x00', 0x100000, &(0x7f0000b64000-0x1000)) r0 = open(&(0x7f00006a2000)='./file0\x00', 0x0, 0x0) mkdirat(r0, &(0x7f0000034000-0x8)='./file0\x00', 0x0) mount(&(0x7f00001a5000-0xe)='./file0/file0\x00', &(0x7f00002fb000-0x8)='./file0/file0\x00', &(0x7f00002ba000)='\x00v\t', 0x1004, &(0x7f000073b000-0x1)) mount(&(0x7f00005e1000-0x8)='./file0\x00', &(0x7f0000df5000-0x8)='.', &(0x7f0000df4000)='%&t3\x00', 0x2000, &(0x7f00003db000-0x23)) 2018/02/01 16:22:45 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = gettid() rt_sigtimedwait(&(0x7f0000645000-0x8), &(0x7f0000ded000), &(0x7f000052f000)={0x40000077359400}, 0x8) pipe(&(0x7f0000d8c000-0x8)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000e13000-0x8)={0xffffffffffffffff, 0xffffffffffffffff}) tee(0xffffffffffffffff, r3, 0x80007387, 0x0) r4 = dup2(r2, r3) r5 = syz_open_dev$random(&(0x7f0000bdc000-0xc)='/dev/random\x00', 0x0, 0x0) dup2(r2, r5) ioctl$int_in(r4, 0x5452, &(0x7f0000e36000-0x8)=0x45) fcntl$setown(r2, 0x8, r0) fcntl$setsig(r5, 0xa, 0x12) r6 = gettid() tkill(r6, 0x100000000000016) 2018/02/01 16:22:45 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mkdir(&(0x7f000082f000)='./control\x00', 0x0) r0 = open(&(0x7f0000a08000)='./control\x00', 0x0, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) symlinkat(&(0x7f00007ae000-0x8)='./file0\x00', r0, &(0x7f0000a31000-0xa)='./control\x00') r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000e4c000)={0xaa}) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000044000-0x20)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r2 = creat(&(0x7f00000df000)='./file0\x00', 0x0) write$sndseq(r2, &(0x7f0000012000-0x2e)=[{0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @time=@time={0x77359400}}], 0x30) link(&(0x7f0000b40000-0xa)='./file0\x00', &(0x7f00006b4000-0x10)='./control/file0\x00') utimensat(r0, &(0x7f0000e03000-0x10)='./control/file0\x00', &(0x7f00003e7000-0x10)={{}, {0x0, 0x2710}}, 0x0) 2018/02/01 16:22:45 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_generic(r0, &(0x7f0000282000)={&(0x7f0000190000)={0x10}, 0xc, &(0x7f0000461000)={&(0x7f0000013000-0x14)={0x14, 0x26, 0x301, 0xffffffffffffffff, 0xffffffffffffffff, {}, []}, 0x14}, 0x1}, 0x0) r1 = syz_open_dev$tun(&(0x7f0000a9e000-0xd)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000f32000)={@common='eql\x00', @ifru_mtu=0x3}) recvmsg(r0, &(0x7f0000005000)={0x0, 0x0, &(0x7f0000012000-0x90)=[], 0x0, &(0x7f0000003000-0x13)=""/87, 0x57}, 0x0) 2018/02/01 16:22:45 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mount(&(0x7f000000a000)='./file0\x00', &(0x7f0000027000-0x8)='./file0\x00', &(0x7f000000c000)='ramfs\x00', 0x0, &(0x7f000000a000)) mount(&(0x7f0000037000)='./file0\x00', &(0x7f0000c50000-0x8)='./file0\x00', &(0x7f000002f000-0x6)='ramfs\x00', 0x100000, &(0x7f0000ce3000)) mount(&(0x7f000052f000)='./file0\x00', &(0x7f00008fd000-0x1)='.', &(0x7f00003a3000-0x6)="00e2660000", 0x1000, 0x0) mount(&(0x7f00002ba000-0x8)='./file0\x00', &(0x7f0000cbf000-0x8)='./file0\x00', &(0x7f0000dcd000)='ramfs\x00', 0x80000, &(0x7f000002f000)) mount(&(0x7f00009b1000)='./file0\x00', &(0x7f0000ae7000-0x8)='./file0\x00', &(0x7f0000226000)='an\x00\x00\x00\x00\x00\x00\x00\afs\x00', 0x100000, &(0x7f0000b64000-0x1000)) r0 = open(&(0x7f00006a2000)='./file0\x00', 0x0, 0x0) mkdirat(r0, &(0x7f0000034000-0x8)='./file0\x00', 0x0) mount(&(0x7f00001a5000-0xe)='./file0/file0\x00', &(0x7f00002fb000-0x8)='./file0/file0\x00', &(0x7f00002ba000)='\x00v\t', 0x1004, &(0x7f000073b000-0x1)) mount(&(0x7f00005e1000-0x8)='./file0\x00', &(0x7f0000df5000-0x8)='.', &(0x7f0000df4000)='%&t3\x00', 0x2000, &(0x7f00003db000-0x23)) 2018/02/01 16:22:45 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$tun(&(0x7f0000481000)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000928000-0x28)={@common='tunl0\x00', @ifru_map={0x7}}) 2018/02/01 16:22:45 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000c53000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$KDSKBMETA(r1, 0x4b63, &(0x7f00008f0000-0x4)) [ 211.385177] binder: 30190:30194 transaction failed 29189/-22, size 0-0 line 2788 [ 211.419218] binder: 30190:30210 transaction failed 29189/-22, size 0-0 line 2788 2018/02/01 16:22:45 executing program 0: mmap(&(0x7f0000000000/0xd27000)=nil, 0xd27000, 0x3, 0x32, 0xffffffffffffffff, 0x0) getrusage(0x0, &(0x7f0000d25000-0xb)) 2018/02/01 16:22:45 executing program 1: mkdir(&(0x7f0000fd6000-0x8)='./file0\x00', 0x0) mount(&(0x7f000000a000)='./file0\x00', &(0x7f0000027000-0x8)='./file0\x00', &(0x7f000000c000)='ramfs\x00', 0x0, &(0x7f000000a000)) mount(&(0x7f0000037000)='./file0\x00', &(0x7f0000c50000-0x8)='./file0\x00', &(0x7f000002f000-0x6)='ramfs\x00', 0x100000, &(0x7f0000ce3000)) mount(&(0x7f000052f000)='./file0\x00', &(0x7f00008fd000-0x1)='.', &(0x7f00003a3000-0x6)="00e2660000", 0x1000, 0x0) mount(&(0x7f00002ba000-0x8)='./file0\x00', &(0x7f0000cbf000-0x8)='./file0\x00', &(0x7f0000dcd000)='ramfs\x00', 0x80000, &(0x7f000002f000)) mount(&(0x7f00009b1000)='./file0\x00', &(0x7f0000ae7000-0x8)='./file0\x00', &(0x7f0000226000)='an\x00\x00\x00\x00\x00\x00\x00\afs\x00', 0x100000, &(0x7f0000b64000-0x1000)) r0 = open(&(0x7f00006a2000)='./file0\x00', 0x0, 0x0) mkdirat(r0, &(0x7f0000034000-0x8)='./file0\x00', 0x0) mount(&(0x7f00001a5000-0xe)='./file0/file0\x00', &(0x7f00002fb000-0x8)='./file0/file0\x00', &(0x7f00002ba000)='\x00v\t', 0x1004, &(0x7f000073b000-0x1)) mount(&(0x7f00005e1000-0x8)='./file0\x00', &(0x7f0000df5000-0x8)='.', &(0x7f0000df4000)='%&t3\x00', 0x2000, &(0x7f00003db000-0x23)) 2018/02/01 16:22:45 executing program 7: mmap(&(0x7f0000000000/0x12000)=nil, 0x12000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000010000)={0x0, 0x0, &(0x7f0000004000)=[{&(0x7f000000d000)="2f00000019000300000000001a0000000206000000000000000000c9080001000000737e0beeffff005867855e7fa5", 0x2f}], 0x1}, 0x0) [ 211.457631] binder: undelivered TRANSACTION_ERROR: 29189 [ 211.464097] binder: undelivered TRANSACTION_ERROR: 29189 2018/02/01 16:22:46 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000c53000)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_PORT_INFO(r0, 0xc0a45322, &(0x7f000020e000-0xa8)) 2018/02/01 16:22:46 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mkdir(&(0x7f000082f000)='./control\x00', 0x0) r0 = open(&(0x7f0000a08000)='./control\x00', 0x0, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) symlinkat(&(0x7f00007ae000-0x8)='./file0\x00', r0, &(0x7f0000a31000-0xa)='./control\x00') r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000e4c000)={0xaa}) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000044000-0x20)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r2 = creat(&(0x7f00000df000)='./file0\x00', 0x0) write$sndseq(r2, &(0x7f0000012000-0x2e)=[{0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @time=@time={0x77359400}}], 0x30) link(&(0x7f0000b40000-0xa)='./file0\x00', &(0x7f00006b4000-0x10)='./control/file0\x00') utimensat(r0, &(0x7f0000e03000-0x10)='./control/file0\x00', &(0x7f00003e7000-0x10)={{}, {0x0, 0x2710}}, 0x0) 2018/02/01 16:22:46 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket(0x10, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000e89000-0x28)={@syzn={0x73, 0x79, 0x7a, 0x0}, 0x0}) r2 = gettid() sendmsg$nl_route(r0, &(0x7f0000504000)={&(0x7f0000ba3000-0xc)={0x10}, 0xc, &(0x7f0000435000-0x10)={&(0x7f0000745000)=@newlink={0x30, 0x10, 0x9, 0xffffffffffffffff, 0xffffffffffffffff, {0x0, 0x0, 0x0, r1}, [@IFLA_NET_NS_PID={0x8, 0x13, r2}, @IFLA_PORT_SELF={0x8, 0x19, [@nested={0x4, 0x1, []}]}]}, 0x30}, 0x1}, 0x0) 2018/02/01 16:22:46 executing program 1: mkdir(&(0x7f0000fd6000-0x8)='./file0\x00', 0x0) mount(&(0x7f000000a000)='./file0\x00', &(0x7f0000027000-0x8)='./file0\x00', &(0x7f000000c000)='ramfs\x00', 0x0, &(0x7f000000a000)) mount(&(0x7f0000037000)='./file0\x00', &(0x7f0000c50000-0x8)='./file0\x00', &(0x7f000002f000-0x6)='ramfs\x00', 0x100000, &(0x7f0000ce3000)) mount(&(0x7f000052f000)='./file0\x00', &(0x7f00008fd000-0x1)='.', &(0x7f00003a3000-0x6)="00e2660000", 0x1000, 0x0) mount(&(0x7f00002ba000-0x8)='./file0\x00', &(0x7f0000cbf000-0x8)='./file0\x00', &(0x7f0000dcd000)='ramfs\x00', 0x80000, &(0x7f000002f000)) mount(&(0x7f00009b1000)='./file0\x00', &(0x7f0000ae7000-0x8)='./file0\x00', &(0x7f0000226000)='an\x00\x00\x00\x00\x00\x00\x00\afs\x00', 0x100000, &(0x7f0000b64000-0x1000)) r0 = open(&(0x7f00006a2000)='./file0\x00', 0x0, 0x0) mkdirat(r0, &(0x7f0000034000-0x8)='./file0\x00', 0x0) mount(&(0x7f00001a5000-0xe)='./file0/file0\x00', &(0x7f00002fb000-0x8)='./file0/file0\x00', &(0x7f00002ba000)='\x00v\t', 0x1004, &(0x7f000073b000-0x1)) mount(&(0x7f00005e1000-0x8)='./file0\x00', &(0x7f0000df5000-0x8)='.', &(0x7f0000df4000)='%&t3\x00', 0x2000, &(0x7f00003db000-0x23)) 2018/02/01 16:22:46 executing program 3: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)={0xaa}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000012000/0x2000)=nil, 0x2000}, 0x1}) mmap(&(0x7f0000003000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r1 = creat(&(0x7f0000004000-0x8)='./file0\x00', 0x0) write$sndseq(r1, &(0x7f0000012000-0x2e)=[{0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @connect}], 0x30) lstat(&(0x7f0000195000-0x8)='./file1\x00', &(0x7f0000c69000)) mmap(&(0x7f0000000000/0x2a000)=nil, 0x2a000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$UFFDIO_ZEROPAGE(r0, 0x8010aa02, &(0x7f0000002000-0x10)={&(0x7f0000011000/0x3000)=nil, 0x3000}) 2018/02/01 16:22:46 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndtimer(&(0x7f00001f1000)='/dev/snd/timer\x00', 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_SELECT(r0, 0x40345410, &(0x7f00007e6000-0x34)={{0x100000001}}) ioctl$SNDRV_TIMER_IOCTL_PARAMS(r0, 0x40505412, &(0x7f000001d000-0x50)={0xfefffffffffffffc, 0xb}) readv(r0, &(0x7f0000491000-0x10)=[{&(0x7f0000950000)=""/230, 0xe6}], 0x1) 2018/02/01 16:22:46 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = gettid() rt_sigtimedwait(&(0x7f0000645000-0x8), &(0x7f0000ded000), &(0x7f000052f000)={0x40000077359400}, 0x8) pipe(&(0x7f0000d8c000-0x8)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000e13000-0x8)={0xffffffffffffffff, 0xffffffffffffffff}) tee(r1, 0xffffffffffffffff, 0x80007387, 0x0) r4 = dup2(r2, r3) r5 = syz_open_dev$random(&(0x7f0000bdc000-0xc)='/dev/random\x00', 0x0, 0x0) dup2(r2, r5) ioctl$int_in(r4, 0x5452, &(0x7f0000e36000-0x8)=0x45) fcntl$setown(r2, 0x8, r0) fcntl$setsig(r5, 0xa, 0x12) r6 = gettid() tkill(r6, 0x100000000000016) 2018/02/01 16:22:46 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r0, &(0x7f0000887000-0x10)={0x2, 0x3, @broadcast=0xffffffff}, 0x10) setsockopt$sock_int(r0, 0x1, 0x7, &(0x7f0000cd5000-0x4), 0x4) sendto$inet(r0, &(0x7f0000d5a000-0x73), 0xfffffcf6, 0x20000804, &(0x7f0000e1e000)={0x2, 0x3, @loopback=0x7f000001}, 0x10) shutdown(r0, 0x1) 2018/02/01 16:22:46 executing program 1: mkdir(&(0x7f0000fd6000-0x8)='./file0\x00', 0x0) mount(&(0x7f000000a000)='./file0\x00', &(0x7f0000027000-0x8)='./file0\x00', &(0x7f000000c000)='ramfs\x00', 0x0, &(0x7f000000a000)) mount(&(0x7f0000037000)='./file0\x00', &(0x7f0000c50000-0x8)='./file0\x00', &(0x7f000002f000-0x6)='ramfs\x00', 0x100000, &(0x7f0000ce3000)) mount(&(0x7f000052f000)='./file0\x00', &(0x7f00008fd000-0x1)='.', &(0x7f00003a3000-0x6)="00e2660000", 0x1000, 0x0) mount(&(0x7f00002ba000-0x8)='./file0\x00', &(0x7f0000cbf000-0x8)='./file0\x00', &(0x7f0000dcd000)='ramfs\x00', 0x80000, &(0x7f000002f000)) mount(&(0x7f00009b1000)='./file0\x00', &(0x7f0000ae7000-0x8)='./file0\x00', &(0x7f0000226000)='an\x00\x00\x00\x00\x00\x00\x00\afs\x00', 0x100000, &(0x7f0000b64000-0x1000)) r0 = open(&(0x7f00006a2000)='./file0\x00', 0x0, 0x0) mkdirat(r0, &(0x7f0000034000-0x8)='./file0\x00', 0x0) mount(&(0x7f00001a5000-0xe)='./file0/file0\x00', &(0x7f00002fb000-0x8)='./file0/file0\x00', &(0x7f00002ba000)='\x00v\t', 0x1004, &(0x7f000073b000-0x1)) mount(&(0x7f00005e1000-0x8)='./file0\x00', &(0x7f0000df5000-0x8)='.', &(0x7f0000df4000)='%&t3\x00', 0x2000, &(0x7f00003db000-0x23)) 2018/02/01 16:22:46 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) sendto$inet6(r0, &(0x7f0000a78000-0x69b)="d6", 0x1, 0x47ffc, &(0x7f0000e3f000-0x1c)={0xa, 0x2, 0x0, @mcast2={0xff, 0x2, [], 0x1}}, 0x1c) 2018/02/01 16:22:46 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x0, 0x32, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000fd6000-0x8)='./file0\x00', 0x0) mount(&(0x7f000000a000)='./file0\x00', &(0x7f0000027000-0x8)='./file0\x00', &(0x7f000000c000)='ramfs\x00', 0x0, &(0x7f000000a000)) mount(&(0x7f0000037000)='./file0\x00', &(0x7f0000c50000-0x8)='./file0\x00', &(0x7f000002f000-0x6)='ramfs\x00', 0x100000, &(0x7f0000ce3000)) mount(&(0x7f000052f000)='./file0\x00', &(0x7f00008fd000-0x1)='.', &(0x7f00003a3000-0x6)="00e2660000", 0x1000, 0x0) mount(&(0x7f00002ba000-0x8)='./file0\x00', &(0x7f0000cbf000-0x8)='./file0\x00', &(0x7f0000dcd000)='ramfs\x00', 0x80000, &(0x7f000002f000)) mount(&(0x7f00009b1000)='./file0\x00', &(0x7f0000ae7000-0x8)='./file0\x00', &(0x7f0000226000)='an\x00\x00\x00\x00\x00\x00\x00\afs\x00', 0x100000, &(0x7f0000b64000-0x1000)) r0 = open(&(0x7f00006a2000)='./file0\x00', 0x0, 0x0) mkdirat(r0, &(0x7f0000034000-0x8)='./file0\x00', 0x0) mount(&(0x7f00001a5000-0xe)='./file0/file0\x00', &(0x7f00002fb000-0x8)='./file0/file0\x00', &(0x7f00002ba000)='\x00v\t', 0x1004, &(0x7f000073b000-0x1)) mount(&(0x7f00005e1000-0x8)='./file0\x00', &(0x7f0000df5000-0x8)='.', &(0x7f0000df4000)='%&t3\x00', 0x2000, &(0x7f00003db000-0x23)) 2018/02/01 16:22:46 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket(0x10, 0x802, 0x0) sendmsg$nl_route(r0, &(0x7f00005bc000)={&(0x7f0000508000)={0x10}, 0xc, &(0x7f0000fa0000-0x10)={&(0x7f00004d5000)=@getlink={0x34, 0x12, 0xb, 0xffffffffffffffff, 0xffffffffffffffff, {}, [@IFLA_IFNAME={0x14, 0x3, @common='eql\x00'}]}, 0x34}, 0x1}, 0x0) [ 211.967743] netlink: 'syz-executor4': attribute type 1 has an invalid length. [ 211.984463] A link change request failed with some changes committed already. Interface syz4 may have been left with an inconsistent configuration, please check. 2018/02/01 16:22:46 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mkdir(&(0x7f00002a7000)='./file0\x00', 0x0) mount(&(0x7f000000a000)='./file0\x00', &(0x7f00001a1000)='./file0\x00', &(0x7f000000c000)='ramfs\x00', 0x0, &(0x7f0000807000)) chdir(&(0x7f0000e6a000-0x8)='./file0\x00') umount2(&(0x7f0000b1d000)='.', 0x2) umount2(&(0x7f0000b1d000-0x1)='.', 0x0) [ 212.019563] netlink: 'syz-executor4': attribute type 1 has an invalid length. [ 212.036818] A link change request failed with some changes committed already. Interface syz4 may have been left with an inconsistent configuration, please check. 2018/02/01 16:22:46 executing program 7: mmap(&(0x7f0000000000/0xb2d000)=nil, 0xb2d000, 0x3, 0x32, 0xffffffffffffffff, 0x0) pipe2(&(0x7f0000a93000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) vmsplice(r1, &(0x7f0000b1d000)=[{&(0x7f00002ee000), 0xffffffffffffff00}], 0x383, 0x0) readv(r0, &(0x7f0000b2c000-0x8)=[{&(0x7f0000b2c000-0xc8)=""/200, 0xc8}], 0x1) 2018/02/01 16:22:46 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = gettid() rt_sigtimedwait(&(0x7f0000645000-0x8), &(0x7f0000ded000), &(0x7f000052f000)={0x40000077359400}, 0x8) pipe(&(0x7f0000d8c000-0x8)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000e13000-0x8)={0xffffffffffffffff, 0xffffffffffffffff}) tee(r1, 0xffffffffffffffff, 0x80007387, 0x0) r4 = dup2(r2, r3) r5 = syz_open_dev$random(&(0x7f0000bdc000-0xc)='/dev/random\x00', 0x0, 0x0) dup2(r2, r5) ioctl$int_in(r4, 0x5452, &(0x7f0000e36000-0x8)=0x45) fcntl$setown(r2, 0x8, r0) fcntl$setsig(r5, 0xa, 0x12) r6 = gettid() tkill(r6, 0x100000000000016) 2018/02/01 16:22:46 executing program 0: mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = add_key$keyring(&(0x7f0000000000)='keyring\x00', &(0x7f0000002000)={0x73, 0x79, 0x7a}, 0x0, 0x0, 0xfffffffffffffffd) keyctl$assume_authority(0x10, r0) 2018/02/01 16:22:46 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x0, 0x32, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000fd6000-0x8)='./file0\x00', 0x0) mount(&(0x7f000000a000)='./file0\x00', &(0x7f0000027000-0x8)='./file0\x00', &(0x7f000000c000)='ramfs\x00', 0x0, &(0x7f000000a000)) mount(&(0x7f0000037000)='./file0\x00', &(0x7f0000c50000-0x8)='./file0\x00', &(0x7f000002f000-0x6)='ramfs\x00', 0x100000, &(0x7f0000ce3000)) mount(&(0x7f000052f000)='./file0\x00', &(0x7f00008fd000-0x1)='.', &(0x7f00003a3000-0x6)="00e2660000", 0x1000, 0x0) mount(&(0x7f00002ba000-0x8)='./file0\x00', &(0x7f0000cbf000-0x8)='./file0\x00', &(0x7f0000dcd000)='ramfs\x00', 0x80000, &(0x7f000002f000)) mount(&(0x7f00009b1000)='./file0\x00', &(0x7f0000ae7000-0x8)='./file0\x00', &(0x7f0000226000)='an\x00\x00\x00\x00\x00\x00\x00\afs\x00', 0x100000, &(0x7f0000b64000-0x1000)) r0 = open(&(0x7f00006a2000)='./file0\x00', 0x0, 0x0) mkdirat(r0, &(0x7f0000034000-0x8)='./file0\x00', 0x0) mount(&(0x7f00001a5000-0xe)='./file0/file0\x00', &(0x7f00002fb000-0x8)='./file0/file0\x00', &(0x7f00002ba000)='\x00v\t', 0x1004, &(0x7f000073b000-0x1)) mount(&(0x7f00005e1000-0x8)='./file0\x00', &(0x7f0000df5000-0x8)='.', &(0x7f0000df4000)='%&t3\x00', 0x2000, &(0x7f00003db000-0x23)) 2018/02/01 16:22:46 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket(0x10, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000e89000-0x28)={@syzn={0x73, 0x79, 0x7a, 0x0}, 0x0}) r2 = gettid() sendmsg$nl_route(r0, &(0x7f0000504000)={&(0x7f0000ba3000-0xc)={0x10}, 0xc, &(0x7f0000435000-0x10)={&(0x7f0000745000)=@newlink={0x30, 0x10, 0x9, 0xffffffffffffffff, 0xffffffffffffffff, {0x0, 0x0, 0x0, r1}, [@IFLA_NET_NS_PID={0x8, 0x13, r2}, @IFLA_PORT_SELF={0x8, 0x19, [@nested={0x4, 0x1, []}]}]}, 0x30}, 0x1}, 0x0) 2018/02/01 16:22:46 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x1, 0x0) r1 = dup(r0) bind$inet(r0, &(0x7f000012e000)={0x2, 0x3, @broadcast=0xffffffff}, 0x10) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000e9c000-0x10)={0x1, &(0x7f0000f07000)=[{0x6, 0x0, 0x0, 0x101}]}, 0x10) connect$inet(r0, &(0x7f0000987000)={0x2, 0x3, @empty}, 0x10) sendto$inet(r1, &(0x7f00004ef000-0xf7)="96427feebcc603c266d2a2c2da2644124066d6c52746a66fd07a4a9370b924b494651c3febca0be535e0f30bbafe65b8b859d66972208f558b002bbc2366429da28cdb97727474f32fcce772ce439a1b5785bb74b8680705191a3d28e775b402a04cdf7881cf1c80eb042835db0e8c24fd0e3c0f396da612f44d9999de32f883521dfa4593a5772e19b5c0c27ace555870d7fe3a1819c614a8d9447cfa592c236d96bf255bf3966b0c1c34711ce489df2032a31902ae0742b79d7334ef248790fa0e3787e4b945215cddc03c4f384e6815bab43d34b8c04eb06ff00f10743a0e25f6", 0xe2, 0x4001, &(0x7f0000849000-0x10)={0x2, 0xffffffffffffffff, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}}, 0x10) sendmmsg(r0, &(0x7f00001c1000)=[{{&(0x7f0000874000)=@can={0x1d}, 0x10, &(0x7f0000dc4000)=[{&(0x7f00004e1000-0xbf)="7f", 0x1}], 0x1}}], 0x1, 0x0) sendmsg$key(r1, &(0x7f0000e97000-0x38)={0x0, 0x0, &(0x7f00009df000)={&(0x7f00007cc000)={0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, [@sadb_x_kmaddress={0x5, 0x19, 0x0, @in={0x2, 0xffffffffffffffff, @empty}, @in={0x2, 0xffffffffffffffff, @local={0xac, 0x14, 0xffffffffffffffff, 0xaa}}}, @sadb_x_sec_ctx={0x1a, 0x18, 0x0, 0x0, 0xc1, "76cbd5f680433059c2b551abea6d36bf507cea6489c34add75bcef1822ef862dab9094673d3270d0fb0e6c05dc68a1f1819ae9b0edde85c586dadc0c6678d0f8013d316eaf1ec51fa894fbff145df65233a0dc9bc66694bae49129ca8aa1b5b3efc96e363b4eeadf2f7c99d42b2dc9d4107cbd93e9ae2fbceef6e98f5a53aba6d069ab3e4d7e8277ed67a524c85e9c4c5dd4cc0838c31e0d7cd9fda4ccb6bebd74c6247a38085ff9434d5a113fc0d49e9b5804acaac37fa1eee19f4e4163c01bda"}]}, 0x108}, 0x1}, 0x0) write$selinux_context(r1, &(0x7f0000d30000)='system_u:object_r:sound_device_t:s0\x00', 0x24) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f0000267000-0x4), 0x4) sendmsg$key(r1, &(0x7f0000351000)={0x0, 0x0, &(0x7f0000886000)={&(0x7f0000dd7000+0x99)={0x2, 0x0, 0x0, 0x0, 0x56, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, []}, 0x98}, 0x1}, 0x40001) recvfrom$inet6(r1, &(0x7f000034e000)=""/239, 0xef, 0x100, &(0x7f0000277000-0x1c)={0xa, 0xffffffffffffffff, 0x0, @ipv4={[], [0xff, 0xff], @local={0xac, 0x14, 0xffffffffffffffff, 0xaa}}}, 0x1c) shutdown(r1, 0x1) 2018/02/01 16:22:46 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mkdir(&(0x7f000082f000)='./control\x00', 0x0) r0 = open(&(0x7f0000a08000)='./control\x00', 0x0, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) symlinkat(&(0x7f00007ae000-0x8)='./file0\x00', r0, &(0x7f0000a31000-0xa)='./control\x00') r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000e4c000)={0xaa}) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000044000-0x20)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r2 = creat(&(0x7f00000df000)='./file0\x00', 0x0) write$sndseq(r2, &(0x7f0000012000-0x2e)=[{0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @time=@time={0x77359400}}], 0x30) link(&(0x7f0000b40000-0xa)='./file0\x00', &(0x7f00006b4000-0x10)='./control/file0\x00') utimensat(r0, &(0x7f0000e03000-0x10)='./control/file0\x00', &(0x7f00003e7000-0x10)={{}, {0x0, 0x2710}}, 0x0) 2018/02/01 16:22:46 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x3, @broadcast=0xffffffff}, 0x10) sendto$inet(r0, &(0x7f0000fd0000), 0x0, 0x200007ff, &(0x7f0000deb000-0x10)={0x2, 0x3, @loopback=0x7f000001}, 0x10) recvmmsg(r0, &(0x7f0000331000)=[{{&(0x7f00007b8000)=@ethernet={0x0, @local}, 0x10, &(0x7f00004a8000)=[], 0x0, &(0x7f00001d1000)=""/184, 0xb8}}], 0x1, 0x10040, &(0x7f00000c0000-0x8)) 2018/02/01 16:22:46 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x0, 0x32, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000fd6000-0x8)='./file0\x00', 0x0) mount(&(0x7f000000a000)='./file0\x00', &(0x7f0000027000-0x8)='./file0\x00', &(0x7f000000c000)='ramfs\x00', 0x0, &(0x7f000000a000)) mount(&(0x7f0000037000)='./file0\x00', &(0x7f0000c50000-0x8)='./file0\x00', &(0x7f000002f000-0x6)='ramfs\x00', 0x100000, &(0x7f0000ce3000)) mount(&(0x7f000052f000)='./file0\x00', &(0x7f00008fd000-0x1)='.', &(0x7f00003a3000-0x6)="00e2660000", 0x1000, 0x0) mount(&(0x7f00002ba000-0x8)='./file0\x00', &(0x7f0000cbf000-0x8)='./file0\x00', &(0x7f0000dcd000)='ramfs\x00', 0x80000, &(0x7f000002f000)) mount(&(0x7f00009b1000)='./file0\x00', &(0x7f0000ae7000-0x8)='./file0\x00', &(0x7f0000226000)='an\x00\x00\x00\x00\x00\x00\x00\afs\x00', 0x100000, &(0x7f0000b64000-0x1000)) r0 = open(&(0x7f00006a2000)='./file0\x00', 0x0, 0x0) mkdirat(r0, &(0x7f0000034000-0x8)='./file0\x00', 0x0) mount(&(0x7f00001a5000-0xe)='./file0/file0\x00', &(0x7f00002fb000-0x8)='./file0/file0\x00', &(0x7f00002ba000)='\x00v\t', 0x1004, &(0x7f000073b000-0x1)) mount(&(0x7f00005e1000-0x8)='./file0\x00', &(0x7f0000df5000-0x8)='.', &(0x7f0000df4000)='%&t3\x00', 0x2000, &(0x7f00003db000-0x23)) 2018/02/01 16:22:46 executing program 0: mmap(&(0x7f0000000000/0xfe1000)=nil, 0xfe1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00002cd000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003ba000-0x24)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000e40000+0x56c)=0x3) ppoll(&(0x7f0000531000)=[{r1}], 0x1, &(0x7f0000fdf000-0x10)={0x0, 0x1c9c380}, &(0x7f0000fde000), 0x8) 2018/02/01 16:22:46 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f000001c000-0x38)={&(0x7f0000016000)={0x10}, 0xc, &(0x7f000000b000)={&(0x7f000000d000)=@dellink={0x34, 0x11, 0x209, 0xffffffffffffffff, 0xffffffffffffffff, {}, [@IFLA_IFNAME={0x14, 0x3, @common='ip6_vti0\x00'}]}, 0x34}, 0x1}, 0x0) 2018/02/01 16:22:46 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket(0x10, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000e89000-0x28)={@syzn={0x73, 0x79, 0x7a, 0x0}, 0x0}) r2 = gettid() sendmsg$nl_route(r0, &(0x7f0000504000)={&(0x7f0000ba3000-0xc)={0x10}, 0xc, &(0x7f0000435000-0x10)={&(0x7f0000745000)=@newlink={0x30, 0x10, 0x9, 0xffffffffffffffff, 0xffffffffffffffff, {0x0, 0x0, 0x0, r1}, [@IFLA_NET_NS_PID={0x8, 0x13, r2}, @IFLA_PORT_SELF={0x8, 0x19, [@nested={0x4, 0x1, []}]}]}, 0x30}, 0x1}, 0x0) 2018/02/01 16:22:46 executing program 7: mmap(&(0x7f0000000000/0xfeb000)=nil, 0xfeb000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSLCKTRMIOS(r0, 0x5457, &(0x7f0000fea000-0x24)) 2018/02/01 16:22:46 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x0, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000fd6000-0x8)='./file0\x00', 0x0) mount(&(0x7f000000a000)='./file0\x00', &(0x7f0000027000-0x8)='./file0\x00', &(0x7f000000c000)='ramfs\x00', 0x0, &(0x7f000000a000)) mount(&(0x7f0000037000)='./file0\x00', &(0x7f0000c50000-0x8)='./file0\x00', &(0x7f000002f000-0x6)='ramfs\x00', 0x100000, &(0x7f0000ce3000)) mount(&(0x7f000052f000)='./file0\x00', &(0x7f00008fd000-0x1)='.', &(0x7f00003a3000-0x6)="00e2660000", 0x1000, 0x0) mount(&(0x7f00002ba000-0x8)='./file0\x00', &(0x7f0000cbf000-0x8)='./file0\x00', &(0x7f0000dcd000)='ramfs\x00', 0x80000, &(0x7f000002f000)) mount(&(0x7f00009b1000)='./file0\x00', &(0x7f0000ae7000-0x8)='./file0\x00', &(0x7f0000226000)='an\x00\x00\x00\x00\x00\x00\x00\afs\x00', 0x100000, &(0x7f0000b64000-0x1000)) r0 = open(&(0x7f00006a2000)='./file0\x00', 0x0, 0x0) mkdirat(r0, &(0x7f0000034000-0x8)='./file0\x00', 0x0) mount(&(0x7f00001a5000-0xe)='./file0/file0\x00', &(0x7f00002fb000-0x8)='./file0/file0\x00', &(0x7f00002ba000)='\x00v\t', 0x1004, &(0x7f000073b000-0x1)) mount(&(0x7f00005e1000-0x8)='./file0\x00', &(0x7f0000df5000-0x8)='.', &(0x7f0000df4000)='%&t3\x00', 0x2000, &(0x7f00003db000-0x23)) [ 212.573226] netlink: 'syz-executor4': attribute type 1 has an invalid length. [ 212.585581] A link change request failed with some changes committed already. Interface syz4 may have been left with an inconsistent configuration, please check. 2018/02/01 16:22:46 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mkdir(&(0x7f000082f000)='./control\x00', 0x0) r0 = open(&(0x7f0000a08000)='./control\x00', 0x0, 0x0) symlinkat(&(0x7f00007ae000-0x8)='./file0\x00', r0, &(0x7f0000a31000-0xa)='./control\x00') r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000e4c000)={0xaa}) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000044000-0x20)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r2 = creat(&(0x7f00000df000)='./file0\x00', 0x0) write$sndseq(r2, &(0x7f0000012000-0x2e)=[{0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @time=@time={0x77359400}}], 0x30) link(&(0x7f0000b40000-0xa)='./file0\x00', &(0x7f00006b4000-0x10)='./control/file0\x00') utimensat(r0, &(0x7f0000e03000-0x10)='./control/file0\x00', &(0x7f00003e7000-0x10)={{}, {0x0, 0x2710}}, 0x0) 2018/02/01 16:22:46 executing program 2: mmap(&(0x7f0000000000/0xb60000)=nil, 0xb60000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = add_key(&(0x7f000019f000-0x8)='keyring\x00', &(0x7f000001d000)={0x73, 0x79, 0x7a, 0x0}, 0x0, 0x0, 0xffffffffffffffff) keyctl$setperm(0x5, r0, 0xc0810) keyctl$search(0xa, r0, &(0x7f0000028000-0x8)='keyring\x00', &(0x7f000003e000-0x5)={0x73, 0x79, 0x7a, 0x0}, r0) [ 212.663846] netlink: 'syz-executor4': attribute type 1 has an invalid length. [ 212.691727] A link change request failed with some changes committed already. Interface syz4 may have been left with an inconsistent configuration, please check. 2018/02/01 16:22:47 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x2, &(0x7f0000ed4000)=0x7b, 0x4) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x3, @broadcast=0xffffffff}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000664000)='vegas\x00', 0x6) sendto$inet(r0, &(0x7f0000618000-0x37), 0x0, 0x20000000, &(0x7f0000deb000-0x10)={0x2, 0x3, @loopback=0x7f000001}, 0x10) writev(r0, &(0x7f0000548000)=[{&(0x7f0000679000-0x1000)="a018848721981213eac15bfdc719e63fdc7f4b8239bf0729cf45d7d63296b92c538c76b0d0e06e23797472a1dcd5f21b8cce4d5feb19b12eea8045137bd0831df4f00df94c4a8d34d24a7d3efaa94dc53ff99af6364301dfb4d6ec87151fab469b761b99c8dc54c954a3e4c49926fc023e0cbea19dc4d752c2846dac6e574d7bc6ef102bbc9529b2c830280b31c4f95713dff88c6f69662793cca62f3a173e91c317992e85ce9b2168fe958c3ab245a2544ef7a9a52011fa7fba13838c8e549e6efead846f4ad9f9ef74d0349b0b4d7b9d5d3be846a3b3c7a1af54f56c054037804dc4e0bedea598238272e2729a214fa721d1ce4fb4567d277f5afa7fe82544ac4f3c148767d9367956793c0ea4e541adbdcbfb1e9bef2b8586702bad253772c6206f8b152229ddb6a864acdf62ad8fb572f83791d67e02bcf73685998afcf2dacfe62c304f61a6074f4ec718073dbfd2bb4dc8588ad710f3418d6c430a7e706cbf53378ee57ecc24bd113d7035891875e2a321310209805bcb83610e99f0c24a7d8fe9c65eb55e0d1b95e40a3cab25ad3e4fa0a55f98e377bd243a94b3a45f1de7b7df94854d09094eb7b04971c8e58bb52240686a75b40f06ba0786e1529556986192dbd005d75f2fefaefd8dec1b7abf88510ad90dfafeb7cdb0632c42e1c931c07d0eff5e59eafe55feef58f4233cdfbca21ff1140c2f58917cdeabc4b1a19cd36ee01143605fb44b94ad5c03f7e3ad948115f051db4f9c973aeac1e7d0ef58c6c5f7fd0eb53bb23b5d", 0x22c}], 0x1) 2018/02/01 16:22:47 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000da7000-0xa)='/dev/ptmx\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x0, 0x32, 0xffffffffffffffff, 0x0) ioctl$TCGETA(r0, 0x5405, &(0x7f00003ae000)) 2018/02/01 16:22:47 executing program 3: mmap(&(0x7f0000000000/0xfd3000)=nil, 0xfd3000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x8000000000000802, 0x0) sendmsg$inet_sctp(r0, &(0x7f0000a29000)={&(0x7f0000fc2000-0x1c)=@in6={0xa, 0x1, 0x0, @mcast1={0xff, 0x1, [], 0x1}}, 0x1c, &(0x7f000065b000)=[]}, 0x8000) write(r0, &(0x7f0000fcd000-0x1000)='c', 0x1) 2018/02/01 16:22:47 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f000056b000)='/dev/vga_arbiter\x00', 0x0, 0x0) ppoll(&(0x7f0000702000)=[{r0, 0x1}], 0x1, &(0x7f00000ff000)={0x77359400}, &(0x7f0000657000), 0x8) 2018/02/01 16:22:47 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mkdir(&(0x7f000082f000)='./control\x00', 0x0) r0 = open(&(0x7f0000a08000)='./control\x00', 0x0, 0x0) symlinkat(&(0x7f00007ae000-0x8)='./file0\x00', r0, &(0x7f0000a31000-0xa)='./control\x00') r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000e4c000)={0xaa}) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000044000-0x20)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r2 = creat(&(0x7f00000df000)='./file0\x00', 0x0) write$sndseq(r2, &(0x7f0000012000-0x2e)=[{0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @time=@time={0x77359400}}], 0x30) link(&(0x7f0000b40000-0xa)='./file0\x00', &(0x7f00006b4000-0x10)='./control/file0\x00') utimensat(r0, &(0x7f0000e03000-0x10)='./control/file0\x00', &(0x7f00003e7000-0x10)={{}, {0x0, 0x2710}}, 0x0) 2018/02/01 16:22:47 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = gettid() rt_sigtimedwait(&(0x7f0000645000-0x8), &(0x7f0000ded000), &(0x7f000052f000)={0x40000077359400}, 0x8) pipe(&(0x7f0000d8c000-0x8)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000e13000-0x8)={0xffffffffffffffff, 0xffffffffffffffff}) tee(r1, 0xffffffffffffffff, 0x80007387, 0x0) r4 = dup2(r2, r3) r5 = syz_open_dev$random(&(0x7f0000bdc000-0xc)='/dev/random\x00', 0x0, 0x0) dup2(r2, r5) ioctl$int_in(r4, 0x5452, &(0x7f0000e36000-0x8)=0x45) fcntl$setown(r2, 0x8, r0) fcntl$setsig(r5, 0xa, 0x12) r6 = gettid() tkill(r6, 0x100000000000016) 2018/02/01 16:22:47 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x0, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000fd6000-0x8)='./file0\x00', 0x0) mount(&(0x7f000000a000)='./file0\x00', &(0x7f0000027000-0x8)='./file0\x00', &(0x7f000000c000)='ramfs\x00', 0x0, &(0x7f000000a000)) mount(&(0x7f0000037000)='./file0\x00', &(0x7f0000c50000-0x8)='./file0\x00', &(0x7f000002f000-0x6)='ramfs\x00', 0x100000, &(0x7f0000ce3000)) mount(&(0x7f000052f000)='./file0\x00', &(0x7f00008fd000-0x1)='.', &(0x7f00003a3000-0x6)="00e2660000", 0x1000, 0x0) mount(&(0x7f00002ba000-0x8)='./file0\x00', &(0x7f0000cbf000-0x8)='./file0\x00', &(0x7f0000dcd000)='ramfs\x00', 0x80000, &(0x7f000002f000)) mount(&(0x7f00009b1000)='./file0\x00', &(0x7f0000ae7000-0x8)='./file0\x00', &(0x7f0000226000)='an\x00\x00\x00\x00\x00\x00\x00\afs\x00', 0x100000, &(0x7f0000b64000-0x1000)) r0 = open(&(0x7f00006a2000)='./file0\x00', 0x0, 0x0) mkdirat(r0, &(0x7f0000034000-0x8)='./file0\x00', 0x0) mount(&(0x7f00001a5000-0xe)='./file0/file0\x00', &(0x7f00002fb000-0x8)='./file0/file0\x00', &(0x7f00002ba000)='\x00v\t', 0x1004, &(0x7f000073b000-0x1)) mount(&(0x7f00005e1000-0x8)='./file0\x00', &(0x7f0000df5000-0x8)='.', &(0x7f0000df4000)='%&t3\x00', 0x2000, &(0x7f00003db000-0x23)) 2018/02/01 16:22:47 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket(0x10, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000e89000-0x28)={@syzn={0x73, 0x79, 0x7a, 0x0}, 0x0}) r2 = gettid() sendmsg$nl_route(r0, &(0x7f0000504000)={&(0x7f0000ba3000-0xc)={0x10}, 0xc, &(0x7f0000435000-0x10)={&(0x7f0000745000)=@newlink={0x30, 0x10, 0x9, 0xffffffffffffffff, 0xffffffffffffffff, {0x0, 0x0, 0x0, r1}, [@IFLA_NET_NS_PID={0x8, 0x13, r2}, @IFLA_PORT_SELF={0x8, 0x19, [@nested={0x4, 0x1, []}]}]}, 0x30}, 0x1}, 0x0) 2018/02/01 16:22:47 executing program 7: mmap(&(0x7f0000000000/0xffd000)=nil, 0xffd000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x2, 0x0) sendto$inet(r0, &(0x7f0000865000), 0xffe4, 0x0, &(0x7f0000fda000-0x10)={0x2, 0x0, @rand_addr}, 0x10) 2018/02/01 16:22:47 executing program 3: mmap(&(0x7f0000000000/0xfed000)=nil, 0xfed000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000fec000-0xa)='/dev/ptmx\x00', 0x0, 0x0) r1 = epoll_create(0x10007fff) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003ba000-0x24)) r2 = syz_open_pts(r0, 0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r2, &(0x7f0000fe2000-0xc)) epoll_ctl$EPOLL_CTL_MOD(r1, 0x3, r2, &(0x7f0000fea000)) 2018/02/01 16:22:47 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x0, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000fd6000-0x8)='./file0\x00', 0x0) mount(&(0x7f000000a000)='./file0\x00', &(0x7f0000027000-0x8)='./file0\x00', &(0x7f000000c000)='ramfs\x00', 0x0, &(0x7f000000a000)) mount(&(0x7f0000037000)='./file0\x00', &(0x7f0000c50000-0x8)='./file0\x00', &(0x7f000002f000-0x6)='ramfs\x00', 0x100000, &(0x7f0000ce3000)) mount(&(0x7f000052f000)='./file0\x00', &(0x7f00008fd000-0x1)='.', &(0x7f00003a3000-0x6)="00e2660000", 0x1000, 0x0) mount(&(0x7f00002ba000-0x8)='./file0\x00', &(0x7f0000cbf000-0x8)='./file0\x00', &(0x7f0000dcd000)='ramfs\x00', 0x80000, &(0x7f000002f000)) mount(&(0x7f00009b1000)='./file0\x00', &(0x7f0000ae7000-0x8)='./file0\x00', &(0x7f0000226000)='an\x00\x00\x00\x00\x00\x00\x00\afs\x00', 0x100000, &(0x7f0000b64000-0x1000)) r0 = open(&(0x7f00006a2000)='./file0\x00', 0x0, 0x0) mkdirat(r0, &(0x7f0000034000-0x8)='./file0\x00', 0x0) mount(&(0x7f00001a5000-0xe)='./file0/file0\x00', &(0x7f00002fb000-0x8)='./file0/file0\x00', &(0x7f00002ba000)='\x00v\t', 0x1004, &(0x7f000073b000-0x1)) mount(&(0x7f00005e1000-0x8)='./file0\x00', &(0x7f0000df5000-0x8)='.', &(0x7f0000df4000)='%&t3\x00', 0x2000, &(0x7f00003db000-0x23)) 2018/02/01 16:22:47 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) socket$inet(0x2, 0xa, 0x0) r0 = socket(0x10002000000011, 0x8000000080003, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f000086d000)={@syzn={0x73, 0x79, 0x7a, 0x0}, 0x0}) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000ea0000)={@syzn={0x73, 0x79, 0x7a, 0x0}, @ifru_flags}) r2 = dup3(r0, 0xffffffffffffffff, 0x40000) bind$packet(r0, &(0x7f00008b7000-0x14)={0x11, 0x2, r1, 0x1, 0x0, 0x6, @empty}, 0x14) userfaultfd(0x0) ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f0000005000)={{&(0x7f0000001000/0x4000)=nil, 0x4000}, 0x1}) socket$inet_udp(0x2, 0x2, 0x0) getsockopt$inet_sctp_SCTP_AUTH_ACTIVE_KEY(r2, 0x84, 0x18, &(0x7f00001b7000)={0x0, 0x39c7}, &(0x7f00002bb000)=0x6) 2018/02/01 16:22:47 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mkdir(&(0x7f000082f000)='./control\x00', 0x0) r0 = open(&(0x7f0000a08000)='./control\x00', 0x0, 0x0) symlinkat(&(0x7f00007ae000-0x8)='./file0\x00', r0, &(0x7f0000a31000-0xa)='./control\x00') r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000e4c000)={0xaa}) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000044000-0x20)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r2 = creat(&(0x7f00000df000)='./file0\x00', 0x0) write$sndseq(r2, &(0x7f0000012000-0x2e)=[{0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @time=@time={0x77359400}}], 0x30) link(&(0x7f0000b40000-0xa)='./file0\x00', &(0x7f00006b4000-0x10)='./control/file0\x00') utimensat(r0, &(0x7f0000e03000-0x10)='./control/file0\x00', &(0x7f00003e7000-0x10)={{}, {0x0, 0x2710}}, 0x0) 2018/02/01 16:22:47 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000fd6000-0x8)='./file0\x00', 0x0) mount(&(0x7f000000a000)='./file0\x00', &(0x7f0000027000-0x8)='./file0\x00', &(0x7f000000c000)='ramfs\x00', 0x0, &(0x7f000000a000)) mount(&(0x7f0000037000)='./file0\x00', &(0x7f0000c50000-0x8)='./file0\x00', &(0x7f000002f000-0x6)='ramfs\x00', 0x0, &(0x7f0000ce3000)) mount(&(0x7f000052f000)='./file0\x00', &(0x7f00008fd000-0x1)='.', &(0x7f00003a3000-0x6)="00e2660000", 0x1000, 0x0) mount(&(0x7f00002ba000-0x8)='./file0\x00', &(0x7f0000cbf000-0x8)='./file0\x00', &(0x7f0000dcd000)='ramfs\x00', 0x80000, &(0x7f000002f000)) mount(&(0x7f00009b1000)='./file0\x00', &(0x7f0000ae7000-0x8)='./file0\x00', &(0x7f0000226000)='an\x00\x00\x00\x00\x00\x00\x00\afs\x00', 0x100000, &(0x7f0000b64000-0x1000)) r0 = open(&(0x7f00006a2000)='./file0\x00', 0x0, 0x0) mkdirat(r0, &(0x7f0000034000-0x8)='./file0\x00', 0x0) mount(&(0x7f00001a5000-0xe)='./file0/file0\x00', &(0x7f00002fb000-0x8)='./file0/file0\x00', &(0x7f00002ba000)='\x00v\t', 0x1004, &(0x7f000073b000-0x1)) mount(&(0x7f00005e1000-0x8)='./file0\x00', &(0x7f0000df5000-0x8)='.', &(0x7f0000df4000)='%&t3\x00', 0x2000, &(0x7f00003db000-0x23)) 2018/02/01 16:22:47 executing program 2: mmap(&(0x7f0000000000/0xd99000)=nil, 0xd99000, 0x4, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000a8b000)={@syzn={0x73, 0x79, 0x7a}, &(0x7f0000939000-0x5)=@ethtool_sfeatures={0x3b, 0x0, []}}) 2018/02/01 16:22:47 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x4000000000000001, 0x0) ioctl$sock_inet_SIOCSARP(r0, 0x8955, &(0x7f00008c6000-0x44)={{0x2, 0xffffffffffffffff, @dev={0xac, 0x14}}, {0x1, @link_local={0x1, 0x80, 0xc2}}, 0x2, {0x2, 0xffffffffffffffff, @empty}, @syzn={0x73, 0x79, 0x7a, 0x0}}) 2018/02/01 16:22:47 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x1, 0x0) setsockopt$inet6_opts(r0, 0x29, 0x37, &(0x7f0000717000-0x88)=@routing={0x0, 0x8, 0x0, 0x0, 0x0, [@empty, @dev={0xfe, 0x80}, @dev={0xfe, 0x80}, @mcast2={0xff, 0x2, [], 0x1}]}, 0x48) sendto$inet6(r0, &(0x7f0000a9c000), 0x0, 0xfffffefffffffffe, &(0x7f0000f63000-0x1c)={0xa, 0xffffffffffffffff, 0x0, @loopback={0x0, 0x1}}, 0x1c) [ 213.169887] netlink: 'syz-executor4': attribute type 1 has an invalid length. [ 213.202059] A link change request failed with some changes committed already. Interface syz4 may have been left with an inconsistent configuration, please check. 2018/02/01 16:22:48 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = gettid() rt_sigtimedwait(&(0x7f0000645000-0x8), &(0x7f0000ded000), &(0x7f000052f000)={0x40000077359400}, 0x8) pipe(&(0x7f0000d8c000-0x8)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000e13000-0x8)={0xffffffffffffffff, 0xffffffffffffffff}) tee(r1, r3, 0x0, 0x0) r4 = dup2(r2, r3) r5 = syz_open_dev$random(&(0x7f0000bdc000-0xc)='/dev/random\x00', 0x0, 0x0) dup2(r2, r5) ioctl$int_in(r4, 0x5452, &(0x7f0000e36000-0x8)=0x45) fcntl$setown(r2, 0x8, r0) fcntl$setsig(r5, 0xa, 0x12) r6 = gettid() tkill(r6, 0x100000000000016) 2018/02/01 16:22:48 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$unix(0x1, 0x1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000419000)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$unix(r1, &(0x7f0000001000-0x38)={&(0x7f0000239000-0x8)=@abs={0x0, 0x0, 0x0}, 0x8, &(0x7f0000008000)=[], 0x0, &(0x7f0000001000-0x10)=[@rights={0x200, 0x1, 0x1, [r0]}], 0x1}, 0x0) fcntl$setstatus(r0, 0x4, 0x400) recvmsg(r2, &(0x7f000000e000)={0x0, 0x0, &(0x7f000008b000)=[], 0x0, &(0x7f000000c000), 0xfc13}, 0x0) 2018/02/01 16:22:48 executing program 7: r0 = socket(0x2, 0x3, 0x6) ioctl$sock_proto_private(r0, 0x89e1, &(0x7f0000008000)) 2018/02/01 16:22:48 executing program 2: 2018/02/01 16:22:48 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$unix(0x1, 0x2, 0x0) getsockopt$sock_int(r0, 0x1, 0x2a, &(0x7f0000001000-0x4), &(0x7f0000000000)=0x4) 2018/02/01 16:22:48 executing program 0: mmap(&(0x7f0000000000/0xfdb000)=nil, 0xfdb000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x5, &(0x7f0000c18000), 0x4) 2018/02/01 16:22:48 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000fd6000-0x8)='./file0\x00', 0x0) mount(&(0x7f000000a000)='./file0\x00', &(0x7f0000027000-0x8)='./file0\x00', &(0x7f000000c000)='ramfs\x00', 0x0, &(0x7f000000a000)) mount(&(0x7f0000037000)='./file0\x00', &(0x7f0000c50000-0x8)='./file0\x00', &(0x7f000002f000-0x6)='ramfs\x00', 0x0, &(0x7f0000ce3000)) mount(&(0x7f000052f000)='./file0\x00', &(0x7f00008fd000-0x1)='.', &(0x7f00003a3000-0x6)="00e2660000", 0x1000, 0x0) mount(&(0x7f00002ba000-0x8)='./file0\x00', &(0x7f0000cbf000-0x8)='./file0\x00', &(0x7f0000dcd000)='ramfs\x00', 0x80000, &(0x7f000002f000)) mount(&(0x7f00009b1000)='./file0\x00', &(0x7f0000ae7000-0x8)='./file0\x00', &(0x7f0000226000)='an\x00\x00\x00\x00\x00\x00\x00\afs\x00', 0x100000, &(0x7f0000b64000-0x1000)) r0 = open(&(0x7f00006a2000)='./file0\x00', 0x0, 0x0) mkdirat(r0, &(0x7f0000034000-0x8)='./file0\x00', 0x0) mount(&(0x7f00001a5000-0xe)='./file0/file0\x00', &(0x7f00002fb000-0x8)='./file0/file0\x00', &(0x7f00002ba000)='\x00v\t', 0x1004, &(0x7f000073b000-0x1)) mount(&(0x7f00005e1000-0x8)='./file0\x00', &(0x7f0000df5000-0x8)='.', &(0x7f0000df4000)='%&t3\x00', 0x2000, &(0x7f00003db000-0x23)) 2018/02/01 16:22:48 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mkdir(&(0x7f000082f000)='./control\x00', 0x0) r0 = open(&(0x7f0000a08000)='./control\x00', 0x0, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) symlinkat(&(0x7f00007ae000-0x8)='./file0\x00', r0, &(0x7f0000a31000-0xa)='./control\x00') r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000e4c000)={0xaa}) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000044000-0x20)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r2 = creat(&(0x7f00000df000)='./file0\x00', 0x0) write$sndseq(r2, &(0x7f0000012000-0x2e)=[{0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @time=@time={0x77359400}}], 0x30) utimensat(r0, &(0x7f0000e03000-0x10)='./control/file0\x00', &(0x7f00003e7000-0x10)={{}, {0x0, 0x2710}}, 0x0) 2018/02/01 16:22:48 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000bfe000)='/dev/sequencer\x00', 0x40202, 0x0) write$sndseq(r0, &(0x7f00007a0000-0x1b0)=[{0x81, 0x1, 0x0, 0x0, @tick, {}, {}, @queue}], 0x30) 2018/02/01 16:22:48 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000698000-0xa)='reno\x00', 0x3e0) sendto$inet(r0, &(0x7f0000fd0000), 0xfffffffffffffd6c, 0x200007ff, &(0x7f0000deb000-0x10)={0x2, 0xffffffffffffffff, @loopback=0x7f000001}, 0x10) 2018/02/01 16:22:48 executing program 0: r0 = socket$inet(0x2, 0x2, 0x0) setsockopt$inet_opts(r0, 0x0, 0x12, &(0x7f0000ee9000), 0x0) 2018/02/01 16:22:48 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000fd6000-0x8)='./file0\x00', 0x0) mount(&(0x7f000000a000)='./file0\x00', &(0x7f0000027000-0x8)='./file0\x00', &(0x7f000000c000)='ramfs\x00', 0x0, &(0x7f000000a000)) mount(&(0x7f0000037000)='./file0\x00', &(0x7f0000c50000-0x8)='./file0\x00', &(0x7f000002f000-0x6)='ramfs\x00', 0x0, &(0x7f0000ce3000)) mount(&(0x7f000052f000)='./file0\x00', &(0x7f00008fd000-0x1)='.', &(0x7f00003a3000-0x6)="00e2660000", 0x1000, 0x0) mount(&(0x7f00002ba000-0x8)='./file0\x00', &(0x7f0000cbf000-0x8)='./file0\x00', &(0x7f0000dcd000)='ramfs\x00', 0x80000, &(0x7f000002f000)) mount(&(0x7f00009b1000)='./file0\x00', &(0x7f0000ae7000-0x8)='./file0\x00', &(0x7f0000226000)='an\x00\x00\x00\x00\x00\x00\x00\afs\x00', 0x100000, &(0x7f0000b64000-0x1000)) r0 = open(&(0x7f00006a2000)='./file0\x00', 0x0, 0x0) mkdirat(r0, &(0x7f0000034000-0x8)='./file0\x00', 0x0) mount(&(0x7f00001a5000-0xe)='./file0/file0\x00', &(0x7f00002fb000-0x8)='./file0/file0\x00', &(0x7f00002ba000)='\x00v\t', 0x1004, &(0x7f000073b000-0x1)) mount(&(0x7f00005e1000-0x8)='./file0\x00', &(0x7f0000df5000-0x8)='.', &(0x7f0000df4000)='%&t3\x00', 0x2000, &(0x7f00003db000-0x23)) 2018/02/01 16:22:48 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = inotify_init1(0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000fa1000)={0x0}, &(0x7f0000fa1000)=0xc) fcntl$setown(r0, 0x8, r1) fcntl$getownex(r0, 0x10, &(0x7f0000762000-0x8)={0x0, 0x0}) ptrace$setopts(0x4206, r2, 0x0, 0x0) ptrace(0x4207, r2) ptrace(0x8, r2) 2018/02/01 16:22:48 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$packet(0x11, 0x3, 0x300) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x3, @broadcast=0xffffffff}, 0x10) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000b86000)={0x1, &(0x7f00006dc000)=[{0x6, 0x0, 0x0, 0xa1}]}, 0x10) sendto$inet(r1, &(0x7f0000fd0000), 0x0, 0x200007ff, &(0x7f0000deb000-0x10)={0x2, 0x3, @loopback=0x7f000001}, 0x10) r2 = dup2(r1, r1) sendmsg$nl_netfilter(r2, &(0x7f00004e1000)={&(0x7f0000f5f000)={0x10}, 0xc, &(0x7f00001ff000)={&(0x7f000095a000)={0x5b4, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, {}, [@generic="c0c394aa9be317fa7c9f1fea5f3c4631be63f79247f36688ea81a015d263021526c63f3a0aaa9c8555451a1479cc9229b3e0fa8399322f5cb66e02e5464ea0401e0d88bd3d67a5c1cd187849522131695bb5d9875e82d9bc4a57e90e705f2a2511678faee3a2f72c3c3fa42c0c88662262bb04daf2e66d935233482d223a183a251292c707bfb03ae7923f009175911f4fb5de6f2324d54c070877cfadb1607f3c1585a4745df8a48c29e9fb557f267007dd532e99ec23d1e7f27bbe4e54dadd19d4b249ea12d60bc67e78ca139242efcc0738bc4cfad6bf199c2b7b1dc16338c54b882f30d962642bf730b84f012fa4f685ec770158b8db01c18a574b0a05495afe7b1f552928741cb0ae8dde32a0ea556311d2cfd9aa0faf19e320370ec54446240df1819bbc7cdb1210dbf6ae86287a2d540fe11a7afa88ce00ec0b7b73706d896330e38312acc67a443f476939caa3d0e5161ef7002b3aa891241c1ca53eeb787388ae15d085e03bfc446452e7bd08378b0ac6ca5a454fa16f30e817bb6ad22f77b690dd06704e66d4d9457c1780b0266563ae13a22fee10d3b82d12444396e71eb3744ef04fd7e8ae4ca5ca35296877dac02219b178e59b1813877c0942e61e20affba3c689aed34982aa21ca543321600f63e527df8b6da5df728a1bfdce9b7f457e2b8cff9051d55cd66692f9f888b7c79bd515224e3fc42dabba03ee1286a052488d7037d3c6bbb083b5440892d35c873e5d9a65d3e683854972b4990a027bb81282691838e5a2c5c07a93e323556823aadf54de1d71ae17ba633960509a1630a8d1eed6acff74bcbfad521ae43c4d33c0c3b81b19eefa34aea230fa8d387a81f935f27cca5a92f160624d63a1e30aba7b149eba068051cfa766670d83487295b4634fb08b69b6e8fc7a406f4accb311e8bf3abcdf514b1b28e5bd358e39e3a2ca53d56f47675a26da5e7ca0f96f6f7c354e0a3aa7c1f61facd0f04691f826bd631946edb889c7259ced9f6bfdeaf91395693619bcf6006cbcc35bf066c6e968ce14200e71cb6d365504a96ab2ac0ba269547793070721830e37e5ce0e7e2d2b249379a14c383a1aacd22b0acc66b53a3f6c5e582a4e840a045d925edd451d4799156861e34bb197178c6281a043bec8b2e84282b56460bf8623b3582eab8599fd0c4480d54e2afd18ea082fe63c12188860adf0973757c0c6c5f6ac185f5ca35de937d5cbc87cd8674f8d865e9f0a4a5aa345a295ae7aca0025a79488afd58c5638917acc175c487e2d8fe13bd85754af2f5dd77e8c55c26470ebaef8aefd9694fb6b00372391938462b0600674500199cb7f1018d98b7642809d67186cf71e9205d3eb76a3055b71938df87e1c02ed88be5f958f27baaf3c5858719a75a089f09bd9857f90d046e8d3440c16cb29977c71430f1f45849b4999473f52d15f7ff15aa34f7cb654c64e43604e46e93e5045d60b5e3d644cc297b5141128ed15b1dd06f50d2b74d02f2bcfb2c6803e54812dc0f5f4ce892b24213289311c1f893cf33fe7d2d38ac13726181cace1e673206e122e92bf9a7bd5b81bd91ab6878f5ba5f99880b653e7da750bcd897f75e69b00f74e0bbc4e4dc64a1be89889d9571cccc3bc7d8837733b459309cbeaf1d37f6bab16afeb7b2e17abb78ee07c510800269e050ad7f348156fb68acfea45e2be5a4d1685ef31583f36b55d3e9980f549378c474a6aabcbebd990e43f4b2327733230bfda6bc873acc2d9a11041f1b2b750d76eeaff460fb62a7dc7a33e4d8689492a58b8d7cbabf92ca509d246f96df4eb52e08a76796b5ef9c63a40afc24d95cdfb944b1072d500963e8af2466ca7a26a8bc3c3e80489e8b0372012fb2100ab1a141fb2042be08df387bf198d69a723954dcf67c03bbf8028ca9d3cde27c2f2916bd2eed9f50dcf6e0ce72b2a0e1198b4e7b47bcbfab528a8e325a5806bc1cfc70351c3cf3b5dec380769aace9dbc7fb0695832576de66452ad9c89dc48a10a050e4671e2e9f7fa5e"]}, 0x5b4}, 0x1}, 0x0) 2018/02/01 16:22:48 executing program 2: mmap(&(0x7f0000000000/0xd2000)=nil, 0xd2000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_IPSEC_POLICY(r0, 0x29, 0x1a, &(0x7f00000c6000)={{{@in=@broadcast=0xffffffff, @in=@rand_addr}}, {{@in=@local={0xac, 0x14, 0xffffffffffffffff, 0xaa}}, 0x0, @in6=@remote={0xfe, 0x80, [], 0xffffffffffffffff, 0xbb}}}, 0xe8) bind$inet6(r0, &(0x7f00000d2000-0x1c)={0xa, 0xffffffffffffffff, 0x0, @ipv4={[], [0xff, 0xff], @local={0xac, 0x14, 0xffffffffffffffff, 0xaa}}}, 0x1c) 2018/02/01 16:22:48 executing program 3: mmap(&(0x7f0000000000/0xc30000)=nil, 0xc30000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = inotify_init1(0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000c2d000)={0x0}, &(0x7f0000c2e000-0x4)=0xfec0) r2 = getpgid(r1) fcntl$setown(r0, 0x8, r2) fcntl$getownex(r0, 0x10, &(0x7f0000c24000)={0x0, 0x0}) ptrace$setopts(0x4206, r3, 0x0, 0x0) ptrace(0x4207, r3) ptrace(0x11, r3) [ 213.802244] ptrace attach of "/root/syz-executor4"[4075] was attempted by "/root/syz-executor4"[30382] [ 213.822103] ptrace attach of "/root/syz-executor3"[15129] was attempted by "/root/syz-executor3"[30389] [ 213.835449] ptrace attach of "/root/syz-executor3"[15129] was attempted by "/root/syz-executor3"[30390] 2018/02/01 16:22:48 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000fd6000-0x8)='./file0\x00', 0x0) mount(&(0x7f000000a000)='./file0\x00', &(0x7f0000027000-0x8)='./file0\x00', &(0x7f000000c000)='ramfs\x00', 0x0, &(0x7f000000a000)) mount(&(0x7f0000037000)='./file0\x00', &(0x7f0000c50000-0x8)='./file0\x00', &(0x7f000002f000-0x6)='ramfs\x00', 0x100000, &(0x7f0000ce3000)) mount(&(0x7f000052f000)='./file0\x00', &(0x7f00008fd000-0x1)='.', &(0x7f00003a3000-0x6)="00e2660000", 0x0, 0x0) mount(&(0x7f00002ba000-0x8)='./file0\x00', &(0x7f0000cbf000-0x8)='./file0\x00', &(0x7f0000dcd000)='ramfs\x00', 0x80000, &(0x7f000002f000)) mount(&(0x7f00009b1000)='./file0\x00', &(0x7f0000ae7000-0x8)='./file0\x00', &(0x7f0000226000)='an\x00\x00\x00\x00\x00\x00\x00\afs\x00', 0x100000, &(0x7f0000b64000-0x1000)) r0 = open(&(0x7f00006a2000)='./file0\x00', 0x0, 0x0) mkdirat(r0, &(0x7f0000034000-0x8)='./file0\x00', 0x0) mount(&(0x7f00001a5000-0xe)='./file0/file0\x00', &(0x7f00002fb000-0x8)='./file0/file0\x00', &(0x7f00002ba000)='\x00v\t', 0x1004, &(0x7f000073b000-0x1)) mount(&(0x7f00005e1000-0x8)='./file0\x00', &(0x7f0000df5000-0x8)='.', &(0x7f0000df4000)='%&t3\x00', 0x2000, &(0x7f00003db000-0x23)) 2018/02/01 16:22:48 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = gettid() rt_sigtimedwait(&(0x7f0000645000-0x8), &(0x7f0000ded000), &(0x7f000052f000)={0x40000077359400}, 0x8) pipe(&(0x7f0000d8c000-0x8)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000e13000-0x8)={0xffffffffffffffff, 0xffffffffffffffff}) tee(r1, r3, 0x0, 0x0) r4 = dup2(r2, r3) r5 = syz_open_dev$random(&(0x7f0000bdc000-0xc)='/dev/random\x00', 0x0, 0x0) dup2(r2, r5) ioctl$int_in(r4, 0x5452, &(0x7f0000e36000-0x8)=0x45) fcntl$setown(r2, 0x8, r0) fcntl$setsig(r5, 0xa, 0x12) r6 = gettid() tkill(r6, 0x100000000000016) 2018/02/01 16:22:48 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000b60000-0x8)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000e6d000-0x8)=@abs, 0x8) sendmmsg$unix(r1, &(0x7f00000bd000)=[], 0x80, 0xc0) close(r1) 2018/02/01 16:22:48 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mkdir(&(0x7f000082f000)='./control\x00', 0x0) r0 = open(&(0x7f0000a08000)='./control\x00', 0x0, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) symlinkat(&(0x7f00007ae000-0x8)='./file0\x00', r0, &(0x7f0000a31000-0xa)='./control\x00') r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000e4c000)={0xaa}) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000044000-0x20)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r2 = creat(&(0x7f00000df000)='./file0\x00', 0x0) write$sndseq(r2, &(0x7f0000012000-0x2e)=[{0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @time=@time={0x77359400}}], 0x30) utimensat(r0, &(0x7f0000e03000-0x10)='./control/file0\x00', &(0x7f00003e7000-0x10)={{}, {0x0, 0x2710}}, 0x0) 2018/02/01 16:22:48 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) sendto$inet(r0, &(0x7f0000ed7000-0x33), 0x0, 0x400c000, &(0x7f000083b000)={0x2, 0x2, @empty}, 0x10) r1 = syz_open_procfs(0x0, &(0x7f0000011000)='net/udp\x00') sendfile(r0, r1, &(0x7f0000493000), 0xff) 2018/02/01 16:22:48 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_MRT6_ADD_MIF(r0, 0x29, 0xca, &(0x7f0000460000)={0xfffffffffffffffe}, 0xc) 2018/02/01 16:22:48 executing program 4: mmap(&(0x7f0000000000/0xe7a000)=nil, 0xe7a000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000e77000)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x2, @rand_addr=0xfffffffffffffffe}, 0x1, 0x0, 0x2}}, 0x2e) sendmsg$nl_crypto(r1, &(0x7f0000380000-0x38)={&(0x7f00009dd000)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00002cf000-0x10)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x200, 0x1, 0x3, "", []}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81) 2018/02/01 16:22:48 executing program 3: r0 = socket(0x11, 0x800000003, 0x0) getsockname(r0, &(0x7f00008e6000-0x1c)=@in6={0x0, 0xffffffffffffffff, 0x0, @empty}, &(0x7f0000f54000-0x4)=0x1c) 2018/02/01 16:22:48 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_opts(r0, 0x29, 0x39, &(0x7f000042d000)=@routing={0x0, 0x2, 0x2, 0x80000001, 0x0, [@mcast1={0xff, 0x1, [], 0x1}]}, 0x18) setsockopt$inet6_opts(r0, 0x29, 0x37, &(0x7f00002da000-0x8)=@fragment, 0x8) sendto$inet6(r0, &(0x7f0000fdf000), 0x0, 0x0, &(0x7f00003e1000-0x1c)={0xa, 0x1, 0x0, @loopback={0x0, 0x1}}, 0x1c) 2018/02/01 16:22:48 executing program 3: rt_tgsigqueueinfo(0x0, 0x0, 0x0, &(0x7f0000003000-0x10)) 2018/02/01 16:22:48 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000fd6000-0x8)='./file0\x00', 0x0) mount(&(0x7f000000a000)='./file0\x00', &(0x7f0000027000-0x8)='./file0\x00', &(0x7f000000c000)='ramfs\x00', 0x0, &(0x7f000000a000)) mount(&(0x7f0000037000)='./file0\x00', &(0x7f0000c50000-0x8)='./file0\x00', &(0x7f000002f000-0x6)='ramfs\x00', 0x100000, &(0x7f0000ce3000)) mount(&(0x7f000052f000)='./file0\x00', &(0x7f00008fd000-0x1)='.', &(0x7f00003a3000-0x6)="00e2660000", 0x0, 0x0) mount(&(0x7f00002ba000-0x8)='./file0\x00', &(0x7f0000cbf000-0x8)='./file0\x00', &(0x7f0000dcd000)='ramfs\x00', 0x80000, &(0x7f000002f000)) mount(&(0x7f00009b1000)='./file0\x00', &(0x7f0000ae7000-0x8)='./file0\x00', &(0x7f0000226000)='an\x00\x00\x00\x00\x00\x00\x00\afs\x00', 0x100000, &(0x7f0000b64000-0x1000)) r0 = open(&(0x7f00006a2000)='./file0\x00', 0x0, 0x0) mkdirat(r0, &(0x7f0000034000-0x8)='./file0\x00', 0x0) mount(&(0x7f00001a5000-0xe)='./file0/file0\x00', &(0x7f00002fb000-0x8)='./file0/file0\x00', &(0x7f00002ba000)='\x00v\t', 0x1004, &(0x7f000073b000-0x1)) mount(&(0x7f00005e1000-0x8)='./file0\x00', &(0x7f0000df5000-0x8)='.', &(0x7f0000df4000)='%&t3\x00', 0x2000, &(0x7f00003db000-0x23)) 2018/02/01 16:22:48 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x0, 0x0) r1 = epoll_create(0x6) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c3c000-0xc)) ioctl$TIOCPKT(r0, 0x5420, &(0x7f0000462000)=0x4000000000000009) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003ba000-0x24)) r2 = syz_open_pts(r0, 0x0) ioctl$TCSETAF(0xffffffffffffffff, 0x5408, &(0x7f00008c2000)) ioctl$TCXONC(r2, 0x540a, 0x0) 2018/02/01 16:22:48 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x80a, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00008a4000-0x20)={@common='lo\x00', @ifru_flags=0xfffffffffffffffd}) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00008a4000-0x20)={@common='lo\x00', @ifru_addrs={0x2, 0xffffffffffffffff, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}}}) r1 = socket$inet6(0xa, 0x2000000000001, 0x0) sendto$inet6(r1, &(0x7f00007a9000-0x1), 0x0, 0xfffffefffffffffe, &(0x7f0000f63000-0x1c)={0xa, 0xffffffffffffffff, 0x0, @loopback={0x0, 0x1}}, 0x1c) 2018/02/01 16:22:48 executing program 0: mmap(&(0x7f0000000000/0xf92000)=nil, 0xf92000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x1, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000f8b000)={{{@in6=@dev={0xfe, 0x80}, @in=@dev={0xac, 0x14}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xa}, {}, {}, 0x0, 0xffffffffffffffff, 0x1}, {{@in6=@remote={0xfe, 0x80, [], 0xffffffffffffffff, 0xbb}}, 0x0, @in6=@mcast1={0xff, 0x1, [], 0x1}}}, 0xe8) close(r0) 2018/02/01 16:22:48 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mkdir(&(0x7f000082f000)='./control\x00', 0x0) r0 = open(&(0x7f0000a08000)='./control\x00', 0x0, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) symlinkat(&(0x7f00007ae000-0x8)='./file0\x00', r0, &(0x7f0000a31000-0xa)='./control\x00') r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000e4c000)={0xaa}) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000044000-0x20)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r2 = creat(&(0x7f00000df000)='./file0\x00', 0x0) write$sndseq(r2, &(0x7f0000012000-0x2e)=[{0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @time=@time={0x77359400}}], 0x30) utimensat(r0, &(0x7f0000e03000-0x10)='./control/file0\x00', &(0x7f00003e7000-0x10)={{}, {0x0, 0x2710}}, 0x0) 2018/02/01 16:22:48 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) sendmsg(r0, &(0x7f0000018000)={&(0x7f000026a000)=@in6={0xa, 0x0, 0x0, @loopback={0x0, 0x1}}, 0x1c, &(0x7f0000a04000)=[], 0x0, &(0x7f000049a000)=[{0x10, 0x29, 0x43, "0b84"}], 0x10}, 0x0) 2018/02/01 16:22:48 executing program 0: mmap(&(0x7f0000000000/0xd25000)=nil, 0xd25000, 0x1000001, 0x32, 0xffffffffffffffff, 0x0) rt_sigqueueinfo(0x0, 0x0, &(0x7f0000a45000-0x10)) [ 214.409225] device lo entered promiscuous mode [ 214.420906] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 214.435586] device lo left promiscuous mode [ 214.453384] device lo entered promiscuous mode [ 214.459770] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 214.468262] device lo left promiscuous mode 2018/02/01 16:22:49 executing program 4: mmap(&(0x7f0000fbe000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000fbe000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETA(r0, 0x5406, &(0x7f00009bf000-0x14)) 2018/02/01 16:22:49 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000a76000-0xd)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f0000010000-0xd)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000006000-0x2c)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000002000)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000004000-0x30)={0x10, 0x0, &(0x7f000000f000)=[@request_death={0x400c630e}], 0x0, 0x0, &(0x7f000000c000-0xe1)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000fed000)={0x8, 0x0, &(0x7f00006f1000-0x9c)=[@release={0x40046306}], 0x0, 0x0, &(0x7f00000e1000-0xd7)}) 2018/02/01 16:22:49 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000fd6000-0x8)='./file0\x00', 0x0) mount(&(0x7f000000a000)='./file0\x00', &(0x7f0000027000-0x8)='./file0\x00', &(0x7f000000c000)='ramfs\x00', 0x0, &(0x7f000000a000)) mount(&(0x7f0000037000)='./file0\x00', &(0x7f0000c50000-0x8)='./file0\x00', &(0x7f000002f000-0x6)='ramfs\x00', 0x100000, &(0x7f0000ce3000)) mount(&(0x7f000052f000)='./file0\x00', &(0x7f00008fd000-0x1)='.', &(0x7f00003a3000-0x6)="00e2660000", 0x0, 0x0) mount(&(0x7f00002ba000-0x8)='./file0\x00', &(0x7f0000cbf000-0x8)='./file0\x00', &(0x7f0000dcd000)='ramfs\x00', 0x80000, &(0x7f000002f000)) mount(&(0x7f00009b1000)='./file0\x00', &(0x7f0000ae7000-0x8)='./file0\x00', &(0x7f0000226000)='an\x00\x00\x00\x00\x00\x00\x00\afs\x00', 0x100000, &(0x7f0000b64000-0x1000)) r0 = open(&(0x7f00006a2000)='./file0\x00', 0x0, 0x0) mkdirat(r0, &(0x7f0000034000-0x8)='./file0\x00', 0x0) mount(&(0x7f00001a5000-0xe)='./file0/file0\x00', &(0x7f00002fb000-0x8)='./file0/file0\x00', &(0x7f00002ba000)='\x00v\t', 0x1004, &(0x7f000073b000-0x1)) mount(&(0x7f00005e1000-0x8)='./file0\x00', &(0x7f0000df5000-0x8)='.', &(0x7f0000df4000)='%&t3\x00', 0x2000, &(0x7f00003db000-0x23)) 2018/02/01 16:22:49 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000d2d000-0x8)='environ\x00') read(r0, &(0x7f0000d5d000), 0x77) 2018/02/01 16:22:49 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mkdir(&(0x7f000082f000)='./control\x00', 0x0) r0 = open(&(0x7f0000a08000)='./control\x00', 0x0, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) symlinkat(&(0x7f00007ae000-0x8)='./file0\x00', r0, &(0x7f0000a31000-0xa)='./control\x00') r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000e4c000)={0xaa}) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000044000-0x20)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) creat(&(0x7f00000df000)='./file0\x00', 0x0) link(&(0x7f0000b40000-0xa)='./file0\x00', &(0x7f00006b4000-0x10)='./control/file0\x00') utimensat(r0, &(0x7f0000e03000-0x10)='./control/file0\x00', &(0x7f00003e7000-0x10)={{}, {0x0, 0x2710}}, 0x0) 2018/02/01 16:22:49 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = gettid() rt_sigtimedwait(&(0x7f0000645000-0x8), &(0x7f0000ded000), &(0x7f000052f000)={0x40000077359400}, 0x8) pipe(&(0x7f0000d8c000-0x8)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000e13000-0x8)={0xffffffffffffffff, 0xffffffffffffffff}) tee(r1, r3, 0x0, 0x0) r4 = dup2(r2, r3) r5 = syz_open_dev$random(&(0x7f0000bdc000-0xc)='/dev/random\x00', 0x0, 0x0) dup2(r2, r5) ioctl$int_in(r4, 0x5452, &(0x7f0000e36000-0x8)=0x45) fcntl$setown(r2, 0x8, r0) fcntl$setsig(r5, 0xa, 0x12) r6 = gettid() tkill(r6, 0x100000000000016) 2018/02/01 16:22:49 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(r0, 0x29, 0xc9, &(0x7f00005ee000), 0x4) 2018/02/01 16:22:49 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sg(&(0x7f00003e6000-0x9)='/dev/sg#\x00', 0x0, 0x0) ioctl(r0, 0x2271, &(0x7f000003a000-0x2)) 2018/02/01 16:22:49 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mkdir(&(0x7f000082f000)='./control\x00', 0x0) r0 = open(&(0x7f0000a08000)='./control\x00', 0x0, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) symlinkat(&(0x7f00007ae000-0x8)='./file0\x00', r0, &(0x7f0000a31000-0xa)='./control\x00') r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000e4c000)={0xaa}) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000044000-0x20)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) creat(&(0x7f00000df000)='./file0\x00', 0x0) link(&(0x7f0000b40000-0xa)='./file0\x00', &(0x7f00006b4000-0x10)='./control/file0\x00') utimensat(r0, &(0x7f0000e03000-0x10)='./control/file0\x00', &(0x7f00003e7000-0x10)={{}, {0x0, 0x2710}}, 0x0) 2018/02/01 16:22:49 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000531000)='setgroups\x00') sendfile(r0, r0, &(0x7f00003a7000), 0x400000ff) 2018/02/01 16:22:49 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f000000d000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$int_in(r0, 0x5452, &(0x7f0000009000-0x8)=0x3f) recvfrom$unix(r0, &(0x7f0000b7d000), 0xfffffdb5, 0x0, &(0x7f0000a15000)=@abs, 0x8) dup2(r0, r1) 2018/02/01 16:22:49 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000fd6000-0x8)='./file0\x00', 0x0) mount(&(0x7f000000a000)='./file0\x00', &(0x7f0000027000-0x8)='./file0\x00', &(0x7f000000c000)='ramfs\x00', 0x0, &(0x7f000000a000)) mount(&(0x7f0000037000)='./file0\x00', &(0x7f0000c50000-0x8)='./file0\x00', &(0x7f000002f000-0x6)='ramfs\x00', 0x100000, &(0x7f0000ce3000)) mount(&(0x7f000052f000)='./file0\x00', &(0x7f00008fd000-0x1)='.', &(0x7f00003a3000-0x6)="00e2660000", 0x1000, 0x0) mount(&(0x7f00002ba000-0x8)='./file0\x00', &(0x7f0000cbf000-0x8)='./file0\x00', &(0x7f0000dcd000)='ramfs\x00', 0x0, &(0x7f000002f000)) mount(&(0x7f00009b1000)='./file0\x00', &(0x7f0000ae7000-0x8)='./file0\x00', &(0x7f0000226000)='an\x00\x00\x00\x00\x00\x00\x00\afs\x00', 0x100000, &(0x7f0000b64000-0x1000)) r0 = open(&(0x7f00006a2000)='./file0\x00', 0x0, 0x0) mkdirat(r0, &(0x7f0000034000-0x8)='./file0\x00', 0x0) mount(&(0x7f00001a5000-0xe)='./file0/file0\x00', &(0x7f00002fb000-0x8)='./file0/file0\x00', &(0x7f00002ba000)='\x00v\t', 0x1004, &(0x7f000073b000-0x1)) mount(&(0x7f00005e1000-0x8)='./file0\x00', &(0x7f0000df5000-0x8)='.', &(0x7f0000df4000)='%&t3\x00', 0x2000, &(0x7f00003db000-0x23)) 2018/02/01 16:22:49 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) ppoll(&(0x7f00000ce000)=[{r0}], 0x1, &(0x7f00006ab000), &(0x7f0000ee1000-0x8), 0x8) 2018/02/01 16:22:49 executing program 3: mmap(&(0x7f0000000000/0xfcc000)=nil, 0xfcc000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x402c542b, &(0x7f00003ba000-0x24)) 2018/02/01 16:22:49 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mkdir(&(0x7f000082f000)='./control\x00', 0x0) r0 = open(&(0x7f0000a08000)='./control\x00', 0x0, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) symlinkat(&(0x7f00007ae000-0x8)='./file0\x00', r0, &(0x7f0000a31000-0xa)='./control\x00') r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000e4c000)={0xaa}) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000044000-0x20)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) creat(&(0x7f00000df000)='./file0\x00', 0x0) link(&(0x7f0000b40000-0xa)='./file0\x00', &(0x7f00006b4000-0x10)='./control/file0\x00') utimensat(r0, &(0x7f0000e03000-0x10)='./control/file0\x00', &(0x7f00003e7000-0x10)={{}, {0x0, 0x2710}}, 0x0) [ 214.951967] binder: BINDER_SET_CONTEXT_MGR already set [ 214.986278] binder: 30447:30464 ioctl 40046207 0 returned -16 2018/02/01 16:22:49 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mkdir(&(0x7f000082f000)='./control\x00', 0x0) r0 = open(&(0x7f0000a08000)='./control\x00', 0x0, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) symlinkat(&(0x7f00007ae000-0x8)='./file0\x00', r0, &(0x7f0000a31000-0xa)='./control\x00') r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000e4c000)={0xaa}) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000044000-0x20)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) write$sndseq(0xffffffffffffffff, &(0x7f0000012000-0x2e)=[{0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @time=@time={0x77359400}}], 0x30) link(&(0x7f0000b40000-0xa)='./file0\x00', &(0x7f00006b4000-0x10)='./control/file0\x00') utimensat(r0, &(0x7f0000e03000-0x10)='./control/file0\x00', &(0x7f00003e7000-0x10)={{}, {0x0, 0x2710}}, 0x0) 2018/02/01 16:22:49 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) timer_create(0xffbfffdffffffff4, &(0x7f00000a3000)={0x0, 0x32, 0x0, @thr={&(0x7f00009e3000), &(0x7f0000204000)}}, &(0x7f0000fe1000)) 2018/02/01 16:22:49 executing program 0: mmap(&(0x7f0000000000/0x106000)=nil, 0x106000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000f5000-0x38)={&(0x7f0000005000)={0x10}, 0xc, &(0x7f00000ee000-0x10)={&(0x7f0000067000-0x3590)=@bridge_getneigh={0x28, 0x1e, 0xa21, 0xffffffffffffffff, 0xffffffffffffffff, {0x7}, [@IFLA_MASTER={0x8, 0xa, 0x4}]}, 0x28}, 0x1}, 0x0) 2018/02/01 16:22:49 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000fd6000-0x8)='./file0\x00', 0x0) mount(&(0x7f000000a000)='./file0\x00', &(0x7f0000027000-0x8)='./file0\x00', &(0x7f000000c000)='ramfs\x00', 0x0, &(0x7f000000a000)) mount(&(0x7f0000037000)='./file0\x00', &(0x7f0000c50000-0x8)='./file0\x00', &(0x7f000002f000-0x6)='ramfs\x00', 0x100000, &(0x7f0000ce3000)) mount(&(0x7f000052f000)='./file0\x00', &(0x7f00008fd000-0x1)='.', &(0x7f00003a3000-0x6)="00e2660000", 0x1000, 0x0) mount(&(0x7f00002ba000-0x8)='./file0\x00', &(0x7f0000cbf000-0x8)='./file0\x00', &(0x7f0000dcd000)='ramfs\x00', 0x0, &(0x7f000002f000)) mount(&(0x7f00009b1000)='./file0\x00', &(0x7f0000ae7000-0x8)='./file0\x00', &(0x7f0000226000)='an\x00\x00\x00\x00\x00\x00\x00\afs\x00', 0x100000, &(0x7f0000b64000-0x1000)) r0 = open(&(0x7f00006a2000)='./file0\x00', 0x0, 0x0) mkdirat(r0, &(0x7f0000034000-0x8)='./file0\x00', 0x0) mount(&(0x7f00001a5000-0xe)='./file0/file0\x00', &(0x7f00002fb000-0x8)='./file0/file0\x00', &(0x7f00002ba000)='\x00v\t', 0x1004, &(0x7f000073b000-0x1)) mount(&(0x7f00005e1000-0x8)='./file0\x00', &(0x7f0000df5000-0x8)='.', &(0x7f0000df4000)='%&t3\x00', 0x2000, &(0x7f00003db000-0x23)) 2018/02/01 16:22:49 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000a77000)='net/dev_mcast\x00') r1 = syz_open_dev$mice(&(0x7f0000c21000)='/dev/input/mice\x00', 0x0, 0x800a0841) sendfile(r1, r0, &(0x7f00001f7000-0x8), 0x401) 2018/02/01 16:22:49 executing program 2: mmap(&(0x7f0000000000/0xcb1000)=nil, 0xcb1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000cab000-0x5)={0x0, 0x0}, &(0x7f0000cab000)=0xc) setresuid(r1, 0x0, 0x0) [ 214.993708] binder: 30447:30457 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 214.994790] binder: 30447:30470 Release 1 refcount change on invalid ref 0 ret -22 2018/02/01 16:22:49 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) timerfd_settime(0xffffffffffffff9c, 0x0, &(0x7f0000c65000-0x20), &(0x7f0000e5a000)={{0x0}}) nanosleep(&(0x7f00009d5000-0x10)={r0}, &(0x7f0000bda000-0x10)) 2018/02/01 16:22:49 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000982000-0x8)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = epoll_create(0x948) epoll_pwait(r1, &(0x7f0000c22000-0x24)=[{}], 0x1, 0xcc, &(0x7f00007bc000-0x8), 0x8) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f00005d6000)={0x200c}) 2018/02/01 16:22:49 executing program 3: mmap(&(0x7f0000000000/0x8000)=nil, 0x8000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000005000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000009000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mlock2(&(0x7f0000001000/0x2000)=nil, 0x2000, 0x1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000006000-0x2c)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f0000002000)}) mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0) 2018/02/01 16:22:49 executing program 0: mmap(&(0x7f0000000000/0xf73000)=nil, 0xf73000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$inet_tcp_int(r0, 0x6, 0x14, &(0x7f0000a4a000+0xeaa), &(0x7f000005f000)=0x4) 2018/02/01 16:22:49 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000f56000)={0x0, 0x0, &(0x7f0000576000-0x10)={&(0x7f0000334000-0x78)={0x2, 0x3, 0x0, 0x9, 0xa, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, [@sadb_address={0x3, 0x40000000000006, 0x0, 0x0, 0x0, @in={0x2, 0xffffffffffffffff, @loopback=0x7f000001}}, @sadb_sa={0x2, 0x1, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x2, 0xfffffffb}, @sadb_address={0x3, 0x20000000000005, 0x0, 0x0, 0x0, @in={0x2, 0xffffffffffffffff, @broadcast=0xffffffff}}]}, 0x50}, 0x1}, 0x0) 2018/02/01 16:22:49 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = gettid() rt_sigtimedwait(&(0x7f0000645000-0x8), &(0x7f0000ded000), &(0x7f000052f000)={0x40000077359400}, 0x8) pipe(&(0x7f0000d8c000-0x8)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000e13000-0x8)={0xffffffffffffffff, 0xffffffffffffffff}) tee(r1, r3, 0x80007387, 0x0) r4 = dup2(0xffffffffffffffff, r3) r5 = syz_open_dev$random(&(0x7f0000bdc000-0xc)='/dev/random\x00', 0x0, 0x0) dup2(r2, r5) ioctl$int_in(r4, 0x5452, &(0x7f0000e36000-0x8)=0x45) fcntl$setown(r2, 0x8, r0) fcntl$setsig(r5, 0xa, 0x12) r6 = gettid() tkill(r6, 0x100000000000016) 2018/02/01 16:22:49 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mkdir(&(0x7f000082f000)='./control\x00', 0x0) r0 = open(&(0x7f0000a08000)='./control\x00', 0x0, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) symlinkat(&(0x7f00007ae000-0x8)='./file0\x00', r0, &(0x7f0000a31000-0xa)='./control\x00') r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000e4c000)={0xaa}) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000044000-0x20)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) write$sndseq(0xffffffffffffffff, &(0x7f0000012000-0x2e)=[{0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @time=@time={0x77359400}}], 0x30) link(&(0x7f0000b40000-0xa)='./file0\x00', &(0x7f00006b4000-0x10)='./control/file0\x00') utimensat(r0, &(0x7f0000e03000-0x10)='./control/file0\x00', &(0x7f00003e7000-0x10)={{}, {0x0, 0x2710}}, 0x0) 2018/02/01 16:22:49 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000fd6000-0x8)='./file0\x00', 0x0) mount(&(0x7f000000a000)='./file0\x00', &(0x7f0000027000-0x8)='./file0\x00', &(0x7f000000c000)='ramfs\x00', 0x0, &(0x7f000000a000)) mount(&(0x7f0000037000)='./file0\x00', &(0x7f0000c50000-0x8)='./file0\x00', &(0x7f000002f000-0x6)='ramfs\x00', 0x100000, &(0x7f0000ce3000)) mount(&(0x7f000052f000)='./file0\x00', &(0x7f00008fd000-0x1)='.', &(0x7f00003a3000-0x6)="00e2660000", 0x1000, 0x0) mount(&(0x7f00002ba000-0x8)='./file0\x00', &(0x7f0000cbf000-0x8)='./file0\x00', &(0x7f0000dcd000)='ramfs\x00', 0x0, &(0x7f000002f000)) mount(&(0x7f00009b1000)='./file0\x00', &(0x7f0000ae7000-0x8)='./file0\x00', &(0x7f0000226000)='an\x00\x00\x00\x00\x00\x00\x00\afs\x00', 0x100000, &(0x7f0000b64000-0x1000)) r0 = open(&(0x7f00006a2000)='./file0\x00', 0x0, 0x0) mkdirat(r0, &(0x7f0000034000-0x8)='./file0\x00', 0x0) mount(&(0x7f00001a5000-0xe)='./file0/file0\x00', &(0x7f00002fb000-0x8)='./file0/file0\x00', &(0x7f00002ba000)='\x00v\t', 0x1004, &(0x7f000073b000-0x1)) mount(&(0x7f00005e1000-0x8)='./file0\x00', &(0x7f0000df5000-0x8)='.', &(0x7f0000df4000)='%&t3\x00', 0x2000, &(0x7f00003db000-0x23)) 2018/02/01 16:22:49 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mkdir(&(0x7f000082f000)='./control\x00', 0x0) r0 = open(&(0x7f0000a08000)='./control\x00', 0x0, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) symlinkat(&(0x7f00007ae000-0x8)='./file0\x00', r0, &(0x7f0000a31000-0xa)='./control\x00') r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000e4c000)={0xaa}) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000044000-0x20)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) write$sndseq(0xffffffffffffffff, &(0x7f0000012000-0x2e)=[{0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @time=@time={0x77359400}}], 0x30) link(&(0x7f0000b40000-0xa)='./file0\x00', &(0x7f00006b4000-0x10)='./control/file0\x00') utimensat(r0, &(0x7f0000e03000-0x10)='./control/file0\x00', &(0x7f00003e7000-0x10)={{}, {0x0, 0x2710}}, 0x0) 2018/02/01 16:22:49 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) openat$pfkey(0xffffffffffffff9c, &(0x7f0000137000)='/proc/self/net/pfkey\x00', 0x200000, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = syz_open_dev$tun(&(0x7f0000c7f000-0xd)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00006b0000-0x28)={@common='gre0\x00', @ifru_addrs=@ethernet={0x306, @random="3e7596f732f4"}}) ioctl$sock_inet_SIOCSIFADDR(r0, 0x8916, &(0x7f0000769000-0x20)={@common='gre0\x00', @ifru_addrs={0x2, 0xffffffffffffffff, @local={0xac, 0x14, 0xffffffffffffffff, 0xaa}}}) connect$inet(r0, &(0x7f0000561000)={0x2, 0xffffffffffffffff, @local={0xac, 0x14, 0xffffffffffffffff, 0xaa}}, 0x10) sendto$inet(r0, &(0x7f0000763000-0x1), 0x0, 0x0, &(0x7f000057c000-0x10)={0x2, 0x0, @multicast1=0xe0000001}, 0x10) close(r1) getsockopt$inet6_buf(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000002000)=""/30, &(0x7f0000000000)=0x1e) recvmmsg(r0, &(0x7f00008c9000)=[{{&(0x7f0000e45000+0x42)=@sco, 0x8, &(0x7f00001e3000)=[], 0x0, &(0x7f0000477000)=""/189, 0xbd}, 0x4}, {{&(0x7f00002f6000-0x58)=@nfc_llcp, 0x58, &(0x7f000048e000-0x40)=[{&(0x7f0000747000)=""/188, 0xbc}, {&(0x7f0000aaa000-0x44)=""/68, 0x44}], 0x2, &(0x7f0000239000)=""/75, 0x4b}}], 0x2, 0x0, &(0x7f000089b000-0x8)) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(0xffffffffffffffff, 0x84, 0x1d, &(0x7f00008fe000-0xc)={0x1, [0x0]}, &(0x7f00006f1000-0x4)=0x8) 2018/02/01 16:22:49 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mkdir(&(0x7f00007b5000-0x8)='./file0\x00', 0x0) mount(&(0x7f000000a000)='./file0\x00', &(0x7f0000268000)='./file0\x00', &(0x7f000000c000)='ramfs\x00', 0x1, &(0x7f0000bda000-0x1)) sync() [ 215.532741] binder_alloc: 30503: binder_alloc_buf failed to map page at 20000000 in userspace [ 215.544507] binder: 30503:30511 transaction failed 29201/-12, size 0-0 line 2903 [ 215.569490] binder: BINDER_SET_CONTEXT_MGR already set [ 215.575221] binder_alloc: binder_alloc_mmap_handler: 30503 20000000-20002000 already mapped failed -16 [ 215.588200] binder: 30503:30519 ioctl 40046207 0 returned -16 [ 215.598907] binder_alloc: 30503: binder_alloc_buf, no vma [ 215.598941] binder: 30503:30526 transaction failed 29189/-3, size 0-0 line 2903 [ 215.616130] binder: undelivered TRANSACTION_ERROR: 29189 [ 215.621765] binder: undelivered TRANSACTION_ERROR: 29201 2018/02/01 16:22:50 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000f56000)={0x0, 0x0, &(0x7f0000576000-0x10)={&(0x7f0000334000-0x78)={0x2, 0x3, 0x0, 0x9, 0xa, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, [@sadb_address={0x3, 0x40000000000006, 0x0, 0x0, 0x0, @in={0x2, 0xffffffffffffffff, @loopback=0x7f000001}}, @sadb_sa={0x2, 0x1, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x2, 0xfffffffb}, @sadb_address={0x3, 0x20000000000005, 0x0, 0x0, 0x0, @in={0x2, 0xffffffffffffffff, @broadcast=0xffffffff}}]}, 0x50}, 0x1}, 0x0) 2018/02/01 16:22:50 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000fd6000-0x8)='./file0\x00', 0x0) mount(&(0x7f000000a000)='./file0\x00', &(0x7f0000027000-0x8)='./file0\x00', &(0x7f000000c000)='ramfs\x00', 0x0, &(0x7f000000a000)) mount(&(0x7f0000037000)='./file0\x00', &(0x7f0000c50000-0x8)='./file0\x00', &(0x7f000002f000-0x6)='ramfs\x00', 0x100000, &(0x7f0000ce3000)) mount(&(0x7f000052f000)='./file0\x00', &(0x7f00008fd000-0x1)='.', &(0x7f00003a3000-0x6)="00e2660000", 0x1000, 0x0) mount(&(0x7f00002ba000-0x8)='./file0\x00', &(0x7f0000cbf000-0x8)='./file0\x00', &(0x7f0000dcd000)='ramfs\x00', 0x80000, &(0x7f000002f000)) mount(&(0x7f00009b1000)='./file0\x00', &(0x7f0000ae7000-0x8)='./file0\x00', &(0x7f0000226000)='an\x00\x00\x00\x00\x00\x00\x00\afs\x00', 0x0, &(0x7f0000b64000-0x1000)) r0 = open(&(0x7f00006a2000)='./file0\x00', 0x0, 0x0) mkdirat(r0, &(0x7f0000034000-0x8)='./file0\x00', 0x0) mount(&(0x7f00001a5000-0xe)='./file0/file0\x00', &(0x7f00002fb000-0x8)='./file0/file0\x00', &(0x7f00002ba000)='\x00v\t', 0x1004, &(0x7f000073b000-0x1)) mount(&(0x7f00005e1000-0x8)='./file0\x00', &(0x7f0000df5000-0x8)='.', &(0x7f0000df4000)='%&t3\x00', 0x2000, &(0x7f00003db000-0x23)) 2018/02/01 16:22:50 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mkdir(&(0x7f000082f000)='./control\x00', 0x0) r0 = open(&(0x7f0000a08000)='./control\x00', 0x0, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) symlinkat(&(0x7f00007ae000-0x8)='./file0\x00', r0, &(0x7f0000a31000-0xa)='./control\x00') r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000e4c000)={0xaa}) r2 = creat(&(0x7f00000df000)='./file0\x00', 0x0) write$sndseq(r2, &(0x7f0000012000-0x2e)=[{0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @time=@time={0x77359400}}], 0x30) link(&(0x7f0000b40000-0xa)='./file0\x00', &(0x7f00006b4000-0x10)='./control/file0\x00') utimensat(r0, &(0x7f0000e03000-0x10)='./control/file0\x00', &(0x7f00003e7000-0x10)={{}, {0x0, 0x2710}}, 0x0) 2018/02/01 16:22:50 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) pselect6(0x40, &(0x7f00004c8000-0x40), &(0x7f0000001000-0x40)={0x7}, &(0x7f0000b01000-0x40), &(0x7f0000001000-0x8), &(0x7f0000001000-0x8)={&(0x7f0000001000-0x8), 0x8}) 2018/02/01 16:22:50 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) pipe2(&(0x7f0000d2e000-0x8), 0x0) r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f000026c000)=[], &(0x7f000000b000-0x30)=[]}}], 0x0, 0x0, &(0x7f0000009000)}) syz_open_dev$sg(&(0x7f00007da000-0x9)='/dev/sg#\x00', 0x0, 0x0) pselect6(0x40, &(0x7f00000ac000-0x40)={0x3ffffd}, &(0x7f0000768000), &(0x7f0000086000), &(0x7f0000dee000-0x8)={0x0, 0x989680}, &(0x7f0000f14000)={&(0x7f00001da000), 0x8}) 2018/02/01 16:22:50 executing program 3: mmap(&(0x7f0000000000/0x8000)=nil, 0x8000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000005000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000009000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mlock2(&(0x7f0000001000/0x2000)=nil, 0x2000, 0x1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000006000-0x2c)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f0000002000)}) mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0) 2018/02/01 16:22:50 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = gettid() rt_sigtimedwait(&(0x7f0000645000-0x8), &(0x7f0000ded000), &(0x7f000052f000)={0x40000077359400}, 0x8) pipe(&(0x7f0000d8c000-0x8)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000e13000-0x8)={0xffffffffffffffff, 0xffffffffffffffff}) tee(r1, r3, 0x80007387, 0x0) r4 = dup2(0xffffffffffffffff, r3) r5 = syz_open_dev$random(&(0x7f0000bdc000-0xc)='/dev/random\x00', 0x0, 0x0) dup2(r2, r5) ioctl$int_in(r4, 0x5452, &(0x7f0000e36000-0x8)=0x45) fcntl$setown(r2, 0x8, r0) fcntl$setsig(r5, 0xa, 0x12) r6 = gettid() tkill(r6, 0x100000000000016) 2018/02/01 16:22:50 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000588000-0xc)={0x0}, &(0x7f000035e000)=0xc) r1 = syz_open_procfs(r0, &(0x7f0000ad9000)='attr/current\x00') sendfile(r1, r1, &(0x7f0000dc1000), 0x27) preadv(r1, &(0x7f00009c2000)=[{&(0x7f0000d35000-0x75)=""/117, 0x75}], 0x1, 0x0) 2018/02/01 16:22:50 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mkdir(&(0x7f000082f000)='./control\x00', 0x0) r0 = open(&(0x7f0000a08000)='./control\x00', 0x0, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) symlinkat(&(0x7f00007ae000-0x8)='./file0\x00', r0, &(0x7f0000a31000-0xa)='./control\x00') r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000e4c000)={0xaa}) r2 = creat(&(0x7f00000df000)='./file0\x00', 0x0) write$sndseq(r2, &(0x7f0000012000-0x2e)=[{0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @time=@time={0x77359400}}], 0x30) link(&(0x7f0000b40000-0xa)='./file0\x00', &(0x7f00006b4000-0x10)='./control/file0\x00') utimensat(r0, &(0x7f0000e03000-0x10)='./control/file0\x00', &(0x7f00003e7000-0x10)={{}, {0x0, 0x2710}}, 0x0) 2018/02/01 16:22:50 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000f56000)={0x0, 0x0, &(0x7f0000576000-0x10)={&(0x7f0000334000-0x78)={0x2, 0x3, 0x0, 0x9, 0xa, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, [@sadb_address={0x3, 0x40000000000006, 0x0, 0x0, 0x0, @in={0x2, 0xffffffffffffffff, @loopback=0x7f000001}}, @sadb_sa={0x2, 0x1, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x2, 0xfffffffb}, @sadb_address={0x3, 0x20000000000005, 0x0, 0x0, 0x0, @in={0x2, 0xffffffffffffffff, @broadcast=0xffffffff}}]}, 0x50}, 0x1}, 0x0) 2018/02/01 16:22:50 executing program 4: mmap(&(0x7f0000000000/0xd25000)=nil, 0xd25000, 0x1000001, 0x32, 0xffffffffffffffff, 0x0) futimesat(0xffffffffffffffff, &(0x7f00005a0000)='./file0\x00', &(0x7f0000d1f000-0xc)={{0x77359400}}) [ 216.169675] binder_alloc: 30536: binder_alloc_buf failed to map page at 20000000 in userspace [ 216.185130] audit: type=1400 audit(1517502170.475:141): avc: denied { dyntransition } for pid=30539 comm="syz-executor0" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0 tclass=process permissive=1 [ 216.220468] binder: 30536:30541 transaction failed 29201/-12, size 0-0 line 2903 [ 216.228131] binder_alloc: 30536: binder_alloc_buf failed to map page at 20000000 in userspace [ 216.228176] binder: 30535:30540 transaction failed 29201/-12, size 0-0 line 2903 [ 216.240078] binder_alloc: 30536: binder_alloc_buf failed to map page at 20000000 in userspace [ 216.248644] binder: 30535:30540 transaction failed 29201/-12, size 0-0 line 2903 [ 216.261345] binder: undelivered TRANSACTION_ERROR: 29201 [ 216.261481] binder: undelivered TRANSACTION_ERROR: 29201 [ 216.289937] binder: undelivered TRANSACTION_ERROR: 29201 2018/02/01 16:22:51 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000854000-0xe8)={{{@in6=@local, @in=@multicast1}}, {{@in=@local}, 0x0, @in6=@loopback}}, &(0x7f0000c62000)=0xfffffd89) 2018/02/01 16:22:51 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mkdir(&(0x7f000082f000)='./control\x00', 0x0) r0 = open(&(0x7f0000a08000)='./control\x00', 0x0, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) symlinkat(&(0x7f00007ae000-0x8)='./file0\x00', r0, &(0x7f0000a31000-0xa)='./control\x00') r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000e4c000)={0xaa}) r2 = creat(&(0x7f00000df000)='./file0\x00', 0x0) write$sndseq(r2, &(0x7f0000012000-0x2e)=[{0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @time=@time={0x77359400}}], 0x30) link(&(0x7f0000b40000-0xa)='./file0\x00', &(0x7f00006b4000-0x10)='./control/file0\x00') utimensat(r0, &(0x7f0000e03000-0x10)='./control/file0\x00', &(0x7f00003e7000-0x10)={{}, {0x0, 0x2710}}, 0x0) 2018/02/01 16:22:51 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000f56000)={0x0, 0x0, &(0x7f0000576000-0x10)={&(0x7f0000334000-0x78)={0x2, 0x3, 0x0, 0x9, 0xa, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, [@sadb_address={0x3, 0x40000000000006, 0x0, 0x0, 0x0, @in={0x2, 0xffffffffffffffff, @loopback=0x7f000001}}, @sadb_sa={0x2, 0x1, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x2, 0xfffffffb}, @sadb_address={0x3, 0x20000000000005, 0x0, 0x0, 0x0, @in={0x2, 0xffffffffffffffff, @broadcast=0xffffffff}}]}, 0x50}, 0x1}, 0x0) 2018/02/01 16:22:51 executing program 0: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x4, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000001000-0x8)='keyring\x00', &(0x7f0000012000)={0x73, 0x79, 0x7a}, &(0x7f0000001000-0x1b), 0x0, 0xfffffffffffffffc) 2018/02/01 16:22:51 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000fd6000-0x8)='./file0\x00', 0x0) mount(&(0x7f000000a000)='./file0\x00', &(0x7f0000027000-0x8)='./file0\x00', &(0x7f000000c000)='ramfs\x00', 0x0, &(0x7f000000a000)) mount(&(0x7f0000037000)='./file0\x00', &(0x7f0000c50000-0x8)='./file0\x00', &(0x7f000002f000-0x6)='ramfs\x00', 0x100000, &(0x7f0000ce3000)) mount(&(0x7f000052f000)='./file0\x00', &(0x7f00008fd000-0x1)='.', &(0x7f00003a3000-0x6)="00e2660000", 0x1000, 0x0) mount(&(0x7f00002ba000-0x8)='./file0\x00', &(0x7f0000cbf000-0x8)='./file0\x00', &(0x7f0000dcd000)='ramfs\x00', 0x80000, &(0x7f000002f000)) mount(&(0x7f00009b1000)='./file0\x00', &(0x7f0000ae7000-0x8)='./file0\x00', &(0x7f0000226000)='an\x00\x00\x00\x00\x00\x00\x00\afs\x00', 0x0, &(0x7f0000b64000-0x1000)) r0 = open(&(0x7f00006a2000)='./file0\x00', 0x0, 0x0) mkdirat(r0, &(0x7f0000034000-0x8)='./file0\x00', 0x0) mount(&(0x7f00001a5000-0xe)='./file0/file0\x00', &(0x7f00002fb000-0x8)='./file0/file0\x00', &(0x7f00002ba000)='\x00v\t', 0x1004, &(0x7f000073b000-0x1)) mount(&(0x7f00005e1000-0x8)='./file0\x00', &(0x7f0000df5000-0x8)='.', &(0x7f0000df4000)='%&t3\x00', 0x2000, &(0x7f00003db000-0x23)) 2018/02/01 16:22:51 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = gettid() rt_sigtimedwait(&(0x7f0000645000-0x8), &(0x7f0000ded000), &(0x7f000052f000)={0x40000077359400}, 0x8) pipe(&(0x7f0000d8c000-0x8)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000e13000-0x8)={0xffffffffffffffff, 0xffffffffffffffff}) tee(r1, r3, 0x80007387, 0x0) r4 = dup2(0xffffffffffffffff, r3) r5 = syz_open_dev$random(&(0x7f0000bdc000-0xc)='/dev/random\x00', 0x0, 0x0) dup2(r2, r5) ioctl$int_in(r4, 0x5452, &(0x7f0000e36000-0x8)=0x45) fcntl$setown(r2, 0x8, r0) fcntl$setsig(r5, 0xa, 0x12) r6 = gettid() tkill(r6, 0x100000000000016) 2018/02/01 16:22:51 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000002000-0x1d)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) read$eventfd(r0, &(0x7f0000004000-0x8), 0x8) 2018/02/01 16:22:51 executing program 3: mmap(&(0x7f0000000000/0x8000)=nil, 0x8000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000005000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000009000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mlock2(&(0x7f0000001000/0x2000)=nil, 0x2000, 0x1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000006000-0x2c)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f0000002000)}) mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0) 2018/02/01 16:22:51 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000557000-0x10)='/dev/sequencer2\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(r0, 0x40085112, &(0x7f0000de3000)={{0x4000001ff, 0x2010000080000a}, {}, 0xfffffffffffffffe}) 2018/02/01 16:22:51 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) r1 = syz_open_dev$tun(&(0x7f0000434000-0xd)='/dev/net/tun\x00', 0x0, 0xa) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000a5b000-0x28)={@common='gre0\x00', @ifru_names=@generic="4f54000cc0a1ed4f3a0a1fdc222073b5"}) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000630000-0x20)={@common='gre0\x00', @ifru_flags=0x301}) write$tun(r1, &(0x7f000044a000)=@hdr={0x40000000000001, 0x0, 0x0, 0x0, 0x0, 0x0, @ipv4={{0x5, 0x4, 0x0, 0x0, 0xfc0, 0xffffffffffffffff, 0x0, 0x0, 0x11, 0x0, @empty, @broadcast=0xffffffff, {[]}}, @gre={{0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x880b, 0x0, 0x0, []}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800, []}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x86dd, [], "b8474d7f9626861a42764ba17178034cfee960d4fdf6c589a40abb36cafe53ab82fefa3c09cddba6e23c04dbdce508711ca2041f700930caef01697486a107603fee1c887ad9df62133c215e23c638d113ca075f8b1f0c4231f52e43ac5f499f31b2fb9e1953c74cdb57f0b60033fb8dcf47cacf1b5475657878145f9a9fa5f2e0ae8832952832fa0ab0af95b70726a86a27e4a0f11384488d8893acd09301096fb70fcbe2a9424ddcffed34388ac7d703f921298124ff071dfc86cc8f61f2f6e47802a27d81758a8661bb458e242eaf8edcab9e2a83a2ea515fa10585f6c9e5d3bf01cab18ab1b27e45f9b209e3629736939f77ee56fe0ee99a41faa3ff45c97d9649b3774de09f7cecb42dc447783bea9541586aa793c13a0066152bb4c131e2fbc71b5874a1d3b5655a03eb05d41b9a864c506e7d41d13408a11651c2ca8ffc899fa6a8fc7dc486c62ce1290495a852cecd214528aa4253cb010fb339da1cb68994c75001df9033c691b3cc695acca40e15e9bd27dc372ac230f06d0eaeb5e04062eb14de161f79bf3b839bc8394562c59c02c89085ef93916e4b368a2f1720ab8b7cfcf55e8d05b5d17de1ab52a39600c513455f00ce949ae64ac6cb1b7b194555caed013428181ab98cea5224338551cbefef2fbf474a6413602fed353c9c51cd52b23f95b01135bf691bc93c2c9071e5915d16a76f1c1c7513ee6df96b1f23ae81c9d00c403807e8ed584a335676aa3aeff29095d39538965d8a8f3e5317bc56c2461892b2543d3f05a0fb604cf8c7ee12cb1514397217d30efc9be0a4655e1de4b81d344ecd61d71c1de889e08c70e202bd7d1f457e1e6aba12dbee4eef9f4e6447cc42ecb89e6c7288b786d806175e91be158a849beffc5cb21f15ddca9e4a1fb799cdbe732e9d0cd6767fca57e560d3f545a80520e334c124a32979347e4d17dca7f3992bb5f091116e5c43e1280b169c09388f8334f87edd2b4b8356919edf670dabdc258551e77dc158ebc2e315711f6267aca02d79542c904405e20e8461182229caf7f9facb6755959f6381f1be6537882339a4e18ffc1cd3abe49f3cc73b9f64846e0a50ad9db545fc65404c2fa6c9d72a3dbfd3784f4a4017ce784db870681a1b34507d2482b93ecd30c25b8046e802e311f542c5fc69e0340cf991a09c7cc8937f6bcaddf15f337a3704d60c3bb62b1de90e5b7b1c63b20777d5245a4f9d1d9c31334b2f028b16d9e331f8b80cdb8e7dec1eb4982749e968d4ce32b6055fe93fe9f5f3e762873baf6416efb89cf96a02c71445efcfa0057c54f78b08d072092fcc4dc45ec6ba4b7b48029f933f86e946642cc5a4cbec8b13cd76ef5b177b996b5514e7c5e838f8ef916c7b5c064345d69e5575bef52c77382c25cf2a4f3582e06cdbb0141c66d6a6ca7f104cf29e12bd5b66443055966cb64beefeeeb4c3c48dd80b22c33b4ec069acaab382263c6df91e55541678b9315e42ba0a3931daf1f044f64cbecb747ec56899683ce730af647f47b0ac11b7f5db1efd140ec0db991318d15e5e8e389671a5f18befb644ece5aff47fb84aeacb523ae6859fdc47f76424d2fcb4c550b928b2b2c516eae571b2d4c790d6be40df2e9639f33fd09e8de2ba2b2454938896e230c3e0fdcc1a995b56bd03ef83432ba00e81fba7d5d14838649e3162d7588192ec37f94885efb7874e3708d639b5083a1b9666e7608172a2e5d19f4d5b51c5922a2b07ae71a1ff345b51719ae5fd15c38edc8b33f5d302b9043c624c3575f7ce1d8cf8c46ff83ba3c3a19dd4b746df0b241896edf3e5373d724bf7569fb2d94dde56059af7ec5347c1d189ffef86d217fb4b891a90d218927e6f3dd2d8d1a5f442582c2a9c9987921dbd4b784f0f7960d4edfb805f11faa75e79121701a757595d10bc7a4548fed2b7fa605b7a61e47b11e2b9c68e1ac85bef00a11c6e90e7309287162b69b4723423f84b4cfe056787a1ff6a367e0400a50252ec138ffd0d0ff1f1b93928d2829fd8fcf020be74bca2dbc2647c1794ad18c7219af54eb65a62a5e48e365e00ef3246c01a4ec58960f968109149e6a28ce9bb99660a61508eeb6b134e72c2eefe5ec1996ac69744ba9a605ce20d0e5ae0e92a4e39d42120ad79d97d94282d5fd6c9ce492b31ed3af14bc6a994c836792807f087ff648f02c1270ec4abd573dd2b9c6a37efc3432ac5a7c3ceb21c159058a85ca9967138e775648377a78f5dd5a8b7e8f42e32fe4f0ad11912827b601e79f46dcdd267de25b644dfe439ed1f71cf560da2a968ae6d5da2485bfe703d0ad6d7dddabd9baa3bcb9125c464e002fc14e7b143171ad6a0ee2aeb9dc147065ba4b62b6fb716c07ccbd021093c52672e697fedb3fefdcb84d92b0d06ff7915c1e59b70375a7f5954e6619367b11ac167795d0c46d9e5e0190995482a846b7e556514044374df9e7eb212ab2d277c2e575461b14c70254a407e25245f521f1150d1b98ae5edfe4f2d26ea5d405aae27a7b637a62e3ebc174dc1bcfbd4256afa75973a68ffac038a6eccde83bff219b8ee01763ef95e3919973ddcbd75ab0c57e67f116d09854b1509bcf0d2cb7c24be15c4b3face447b6f4daa03400eaa9d635f8eadf44b4063a7f51e285e12d6f2749bc13d950ba289aebe31db5c76d22dd256af42a205f9481b88bb3bf94df5f65d915298a867daac227c52c6dcaedef5b21b8f9256ee16efec7c94318217c85de08dedc27476e806263add9fbd1c8a9b6462d6c7f800ca00a422de363cca8045c214949d95d192d5e13ecff7444d2e3f3589c2685dae634875c74a9b1c5e56ee20f089880d4f9072e5060653121564a6802efd57b39d5fff2257508016de997af194efa9b57b06ab730bcf02adc1bdd543d5bf7d5841238d7372af66a18a0b836be9a7defa824e718deb6834ef1409d9bc45d8bc10a503c08aa882a9f00ce76dfa564540aad7d01c90d0a31d4db5d88a7e9ffeef0233a2669c1dc78481d537d7fd3a295cf71f7d2d9e9941e4d2f2db0d6b9da3b2c5956f318c6fe63f9f084b460afef3197992c83d73e12f7f09ab690a86b539af413ed9129497e0d63d843e3ccb5bd278878520143ff64dae440593287b5a815b9046dec72cdc7fbd84f709a90c33b8e36aa269786d02c526913b3abe5098eb7277536d3d11accff5bba92d313c497074ac74c939e864f13539dda65c49c4a7b5f8c56651efb1d7275c4e67cbd4eaaeeb0ab29b2b84fb835d751658af3cd72f60e110fb5f00596d636a5edc7e3cbc32ccc3322703a77c07f89125f589d8d0feac226e62ecef3ffd13621690373111a7890880ca4e0009cda708432bf9becb0fd02697d61f49b6ba015da864003134d6a51d41f0b9b35ed9c259a73f314d9574915ca323089c6a77c4a4c50c94fc6c13e2ab24ce89c9ca4ca4b44b14a32c8a0f6023ffddde4630d1024b86d027204b69347d86ba49603f9b20e5e821a29b5908c6c3c7e9c80a5e1fabc11af707c33d98166732d08c865eb8db335624dc00bb755ae964eb8400293dbf738731984fa23094da51008fb96473aba49a9ee04ccbdcc762c264b5b57c96744c023a87e937871b2be1cc8c8bcd509544e7eacb2dabb1a7ebd5b23f4d6232c027f65c1ac3d175c53174e6dc9dd050b1b0989e1207ff25907b267b9ccbf11823580614157a62590cfcb2e148f3f6921029c7bc11662e685b276880eca65179e486a2be1d8dad75c54c2c43492b18b967c31a7da7d5f1b22fe640ce632c62c47a4d642aaa1bf5736f14ab14b0f3049f66d9ad9ec8d9d4292487afe458314b733db19cb90ef972cbb938f41b6eaee94d1eb723104ec61e3a6b681fec576627c31df61cc01edcc4b6ffe641f587614b43f19e9c2862a467ef5eacd6645dfc6c9e57e37f9d2fdaf3d5efedb2a15e662fa8476bdd92b84d895172d2b46494279a3ab12fe2d6693b1e44634d83d7a4ac032bda79df2ab6e26a93176109a8f8690a8ad58c4e91f7ffe68e1c49544e20411388c4fb62b4acb2af44ec189fb1f7896dc50c5addc9da5c7774d10545606301bc265101fe435eda211751d16203d0f9ca1eef5e909291fc1419730dc29304e82aaeeffbde51faf5bd0e56d6478b44a2997c23c69f98ba6408be75620d4476df335b55a042ee037a1aa296dd769804f0f117027d6ae5cfd9805e31a551fee562fff37c80dd9677da0843f1510e14652469ebaac61c2342839dc357ad58d99fb53fea1cc4354e0eb3515613a30a4991f2d810e7b6aa3025cfb8499b827a602d27491152a3f822cab9ea54f8eecb90e78f3731f3cd3b04b203b6bdcff88dfdc4d3c2bb2099518572c344e5082a364ce202cbafecf570e6eef37b81fa4a32962f5721e6be2cb12a92b27441778034d94e497fd2fc4b2dfa034fe2431e3e182e6a5bfd1869a6f9be15a6383fd6946afb16e0973172533c852d95613c42339dee8f9e495f62d7485cc03caebb0548c002e1671bead6e557f814cc6a8240cbbc242914f34b2dbc64b1a0ba8999399cddaa0f67f757b33db4586865d3269e49bfbf8bfa830140c93a7b4bfe42dc859a253ea536dbe4791e3efa232550ce8f1e95583f7eded1aec544c3f93436cdaa987cbc05027ab93780eedf690327c06abeb7bb3d96923fe99554730af9f9ddd04b67d392799b86c2ef5c071b3c85a48dec0a393fd1dc56e917dd89cbd03e2225eee5e563ec97e0b13d596f62377a44cc4920bead2d45bd4e881dd38b55e3d92dd1af8f929bf579ca3dc9e0058688642e2a21933f7ef2c63dd9dde5478da15516d2a2ad560496ae484c7d62f934ea9b8c5a6c0ea71a0b71aa527ef2689829799e4cdc96579a281fecb0683f5ba6cbca055a96e044f4f0dfe6399904aac410579adf7cb4ae96d900a50b853f0e182e5b9e7ffc41abcc8e4958b1811232897c25f8004d90b856187360d15ccc776018b5e9482d2a27cfe5cadf576f39f0e133a7a4d7aad9fbd8fa02974d5eff2701f2ab2fb8dcf29c395ed05a7a6ef25983a5be9ee157bbab2ead95bd537b244d8b582b8222494d35916d17069f85d4e2248077f59c016f5ea8bc871d053b200d699496cf7ec8859aa3d6b3a4e68b6723b38d8ee7d693b1b1863e2d73f9b942a3449e7e5ca831ddb7dcac481cc25f939aefda8153f9ba092277b0e69478de8fe9fe4a704ea4cf678119bfb64799d1ef263d1af2c6c2a64e1073c9f8661b386ce6e31a24c3d0b60bee7981e74b9ddafbf2d0e7434a3a34e52ac3c7ec2a13339d538d072f96b30de70fabaf42a69fc99be6465705f0087a122142fd009d9437aea894c6bf5895efdd2e02b67b4aa82e1c08251c1dfeaa4a0e9142babcaf365083055b63737261fcd4edee2327befcffffbab19a2c480d62ec5a9490110d0ed2d7572daa44075da0e2b62e2fee5ef7cfc7238f67dec5a861ee831176e735459aa9f932f210958bf440ed3c796a4d61c9345443363f2f4b3bce88145d0e3493c5f46b4b74f84d9e91d04743c627c2c86cc33c9c216fcac47cc45652626f3779c97ad02093676e5d32f9dbffce9afe7102aa602720705f3389335318f971f3a1083326a182e63ce781547c5631188184eec4c1cabd48f6726076a7e3f24b24147ee081d2b7f9a7d1eff623"}}}}, 0xfca) 2018/02/01 16:22:51 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000406000)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_UNSUBSCRIBE_PORT(r0, 0x40505331, &(0x7f0000dea000)={{}, {0x0, 0xfff}}) 2018/02/01 16:22:51 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000f56000)={0x0, 0x0, &(0x7f0000576000-0x10)={&(0x7f0000334000-0x78)={0x2, 0x3, 0x0, 0x9, 0xa, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, [@sadb_address={0x3, 0x40000000000006, 0x0, 0x0, 0x0, @in={0x2, 0xffffffffffffffff, @loopback=0x7f000001}}, @sadb_sa={0x2, 0x1, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x2, 0xfffffffb}, @sadb_address={0x3, 0x20000000000005, 0x0, 0x0, 0x0, @in={0x2, 0xffffffffffffffff, @broadcast=0xffffffff}}]}, 0x50}, 0x1}, 0x0) [ 216.813371] binder_alloc: 30562: binder_alloc_buf failed to map page at 20000000 in userspace 2018/02/01 16:22:51 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mkdir(&(0x7f000082f000)='./control\x00', 0x0) r0 = open(&(0x7f0000a08000)='./control\x00', 0x0, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) symlinkat(&(0x7f00007ae000-0x8)='./file0\x00', r0, &(0x7f0000a31000-0xa)='./control\x00') r1 = userfaultfd(0x0) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000044000-0x20)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r2 = creat(&(0x7f00000df000)='./file0\x00', 0x0) write$sndseq(r2, &(0x7f0000012000-0x2e)=[{0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @time=@time={0x77359400}}], 0x30) link(&(0x7f0000b40000-0xa)='./file0\x00', &(0x7f00006b4000-0x10)='./control/file0\x00') utimensat(r0, &(0x7f0000e03000-0x10)='./control/file0\x00', &(0x7f00003e7000-0x10)={{}, {0x0, 0x2710}}, 0x0) 2018/02/01 16:22:51 executing program 0: r0 = add_key(&(0x7f00007e0000)='dead\x00', &(0x7f0000f0c000)={0x73, 0x79, 0x7a}, &(0x7f0000c8a000-0xaf), 0x0, 0xffffffffffffffff) keyctl$setperm(0x5, r0, 0x10000) keyctl$describe(0x6, r0, &(0x7f00005a8000), 0x0) 2018/02/01 16:22:51 executing program 2: mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_mreq(r0, 0x29, 0x15, &(0x7f0000001000)={@mcast1={0xff, 0x1, [], 0x1}}, 0x14) 2018/02/01 16:22:51 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCDARP(r0, 0x8953, &(0x7f00000b3000)={{0x2, 0xffffffffffffffff, @remote={0xac, 0x14, 0x0, 0xbb}}, {0x0, @dev={[0xaa, 0xaa, 0xaa, 0xaa]}}, 0x0, {0x2, 0xffffffffffffffff, @empty}, @syzn={0x73, 0x79, 0x7a, 0x0}}) 2018/02/01 16:22:51 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f0000576000-0x10)={&(0x7f0000334000-0x78)={0x2, 0x3, 0x0, 0x9, 0xa, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, [@sadb_address={0x3, 0x40000000000006, 0x0, 0x0, 0x0, @in={0x2, 0xffffffffffffffff, @loopback=0x7f000001}}, @sadb_sa={0x2, 0x1, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x2, 0xfffffffb}, @sadb_address={0x3, 0x20000000000005, 0x0, 0x0, 0x0, @in={0x2, 0xffffffffffffffff, @broadcast=0xffffffff}}]}, 0x50}, 0x1}, 0x0) [ 216.865282] binder: 30562:30565 transaction failed 29201/-12, size 0-0 line 2903 2018/02/01 16:22:51 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$TUNSETQUEUE(0xffffffffffffffff, 0x400454d9, &(0x7f0000002000)={@generic="6b0b9e000000071ea9367a030900", @ifru_settings={0x4, 0x4c, @te1=&(0x7f000000c000-0x10)}}) r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000003000-0x9)='/dev/rtc\x00', 0x0, 0x0) epoll_ctl$EPOLL_CTL_MOD(0xffffffffffffffff, 0x3, 0xffffffffffffffff, &(0x7f0000002000)) getsockname(0xffffffffffffffff, &(0x7f0000008000-0x8)=@sco, &(0x7f0000002000-0x4)=0x8) ioctl$sock_inet_tcp_SIOCATMARK(r0, 0x4028700f, &(0x7f0000002000-0x4)) 2018/02/01 16:22:51 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mkdir(&(0x7f000082f000)='./control\x00', 0x0) r0 = open(&(0x7f0000a08000)='./control\x00', 0x0, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) symlinkat(&(0x7f00007ae000-0x8)='./file0\x00', r0, &(0x7f0000a31000-0xa)='./control\x00') r1 = userfaultfd(0x0) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000044000-0x20)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r2 = creat(&(0x7f00000df000)='./file0\x00', 0x0) write$sndseq(r2, &(0x7f0000012000-0x2e)=[{0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @time=@time={0x77359400}}], 0x30) link(&(0x7f0000b40000-0xa)='./file0\x00', &(0x7f00006b4000-0x10)='./control/file0\x00') utimensat(r0, &(0x7f0000e03000-0x10)='./control/file0\x00', &(0x7f00003e7000-0x10)={{}, {0x0, 0x2710}}, 0x0) 2018/02/01 16:22:51 executing program 0: mmap(&(0x7f0000000000/0x9000)=nil, 0x9000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mq_open(&(0x7f0000007000)='self.mime_type[mime_typewlan0\x00', 0x840, 0x0, &(0x7f0000006000+0x632)) [ 216.925914] binder: undelivered TRANSACTION_ERROR: 29201 [ 218.127615] IPVS: ftp: loaded support on port[0] = 21 [ 218.389858] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready 2018/02/01 16:22:53 executing program 4: mmap(&(0x7f0000000000/0xdd2000)=nil, 0xdd2000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCDARP(r0, 0x8953, &(0x7f0000dd0000)={{0x2, 0xffffffffffffffff, @dev={0xac, 0x14}}, {0x1, @local={[0xaa, 0xaa, 0xaa, 0xaa], 0xffffffffffffffff, 0xaa}}, 0x0, {0x2, 0xffffffffffffffff, @multicast1=0xe0000001}, @syzn={0x73, 0x79, 0x7a, 0x0}}) 2018/02/01 16:22:53 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = gettid() rt_sigtimedwait(&(0x7f0000645000-0x8), &(0x7f0000ded000), &(0x7f000052f000)={0x40000077359400}, 0x8) pipe(&(0x7f0000d8c000-0x8)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000e13000-0x8)={0xffffffffffffffff, 0xffffffffffffffff}) tee(r1, r3, 0x80007387, 0x0) r4 = dup2(r2, 0xffffffffffffffff) r5 = syz_open_dev$random(&(0x7f0000bdc000-0xc)='/dev/random\x00', 0x0, 0x0) dup2(r2, r5) ioctl$int_in(r4, 0x5452, &(0x7f0000e36000-0x8)=0x45) fcntl$setown(r2, 0x8, r0) fcntl$setsig(r5, 0xa, 0x12) r6 = gettid() tkill(r6, 0x100000000000016) 2018/02/01 16:22:53 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) rt_sigprocmask(0x1, &(0x7f0000b88000), 0x0, 0x8) 2018/02/01 16:22:53 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) setsockopt$inet6_buf(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000003000-0x1000)="24b38b20d0ef3254115223ef6cf758327575c041e002a8089496079b1b45009349041eca724fdec73fab9b04e4a4a5af1d03000000000000007faa62b9c0d263274f4a010c4f93ef85516b042511f32764171ba9bd278cbe360c22f184073fe215dee02fe37161246323ee9c82c790add905b90a64adab9fef855d72abb637d460fc6fb5a9eec5535b119c9dfbde3f76323a5af634e4235a33d57e226460104ca0dedf1f0e8365cd43d106c41d009976034d6557bf8917cad630598f6e58fd1770012d78aabb64ffff", 0xc9) setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0xffffffffffffffff, 0x0, @empty}, {0xa, 0xffffffffffffffff, 0x0, @empty, 0xdf}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x0, 0x9}, 0x14) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(r0, 0x29, 0x40, &(0x7f0000001000+0xfde), 0x4) 2018/02/01 16:22:53 executing program 0: clock_gettime(0xffeffffffffffff9, &(0x7f0000d38000)) 2018/02/01 16:22:53 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f0000576000-0x10)={&(0x7f0000334000-0x78)={0x2, 0x3, 0x0, 0x9, 0xa, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, [@sadb_address={0x3, 0x40000000000006, 0x0, 0x0, 0x0, @in={0x2, 0xffffffffffffffff, @loopback=0x7f000001}}, @sadb_sa={0x2, 0x1, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x2, 0xfffffffb}, @sadb_address={0x3, 0x20000000000005, 0x0, 0x0, 0x0, @in={0x2, 0xffffffffffffffff, @broadcast=0xffffffff}}]}, 0x50}, 0x1}, 0x0) 2018/02/01 16:22:53 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mkdir(&(0x7f000082f000)='./control\x00', 0x0) r0 = open(&(0x7f0000a08000)='./control\x00', 0x0, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) symlinkat(&(0x7f00007ae000-0x8)='./file0\x00', r0, &(0x7f0000a31000-0xa)='./control\x00') r1 = userfaultfd(0x0) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000044000-0x20)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r2 = creat(&(0x7f00000df000)='./file0\x00', 0x0) write$sndseq(r2, &(0x7f0000012000-0x2e)=[{0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @time=@time={0x77359400}}], 0x30) link(&(0x7f0000b40000-0xa)='./file0\x00', &(0x7f00006b4000-0x10)='./control/file0\x00') utimensat(r0, &(0x7f0000e03000-0x10)='./control/file0\x00', &(0x7f00003e7000-0x10)={{}, {0x0, 0x2710}}, 0x0) 2018/02/01 16:22:53 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000fd6000-0x8)='./file0\x00', 0x0) mount(&(0x7f000000a000)='./file0\x00', &(0x7f0000027000-0x8)='./file0\x00', &(0x7f000000c000)='ramfs\x00', 0x0, &(0x7f000000a000)) mount(&(0x7f0000037000)='./file0\x00', &(0x7f0000c50000-0x8)='./file0\x00', &(0x7f000002f000-0x6)='ramfs\x00', 0x100000, &(0x7f0000ce3000)) mount(&(0x7f000052f000)='./file0\x00', &(0x7f00008fd000-0x1)='.', &(0x7f00003a3000-0x6)="00e2660000", 0x1000, 0x0) mount(&(0x7f00002ba000-0x8)='./file0\x00', &(0x7f0000cbf000-0x8)='./file0\x00', &(0x7f0000dcd000)='ramfs\x00', 0x80000, &(0x7f000002f000)) mount(&(0x7f00009b1000)='./file0\x00', &(0x7f0000ae7000-0x8)='./file0\x00', &(0x7f0000226000)='an\x00\x00\x00\x00\x00\x00\x00\afs\x00', 0x0, &(0x7f0000b64000-0x1000)) r0 = open(&(0x7f00006a2000)='./file0\x00', 0x0, 0x0) mkdirat(r0, &(0x7f0000034000-0x8)='./file0\x00', 0x0) mount(&(0x7f00001a5000-0xe)='./file0/file0\x00', &(0x7f00002fb000-0x8)='./file0/file0\x00', &(0x7f00002ba000)='\x00v\t', 0x1004, &(0x7f000073b000-0x1)) mount(&(0x7f00005e1000-0x8)='./file0\x00', &(0x7f0000df5000-0x8)='.', &(0x7f0000df4000)='%&t3\x00', 0x2000, &(0x7f00003db000-0x23)) 2018/02/01 16:22:53 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) seccomp(0x1, 0x0, &(0x7f000005e000)={0x93, &(0x7f00009ea000)=[{0x200000000035, 0x0, 0xfffffffffffffffd}, {}]}) 2018/02/01 16:22:53 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f0000576000-0x10)={&(0x7f0000334000-0x78)={0x2, 0x3, 0x0, 0x9, 0xa, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, [@sadb_address={0x3, 0x40000000000006, 0x0, 0x0, 0x0, @in={0x2, 0xffffffffffffffff, @loopback=0x7f000001}}, @sadb_sa={0x2, 0x1, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x2, 0xfffffffb}, @sadb_address={0x3, 0x20000000000005, 0x0, 0x0, 0x0, @in={0x2, 0xffffffffffffffff, @broadcast=0xffffffff}}]}, 0x50}, 0x1}, 0x0) 2018/02/01 16:22:53 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f000000e000)={0x2, 0x0, @broadcast=0xffffffff}, 0x10) perf_event_open(&(0x7f0000940000)={0x2, 0x78, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_DISABLE(0xffffffffffffffff, 0x2401, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000015000-0x4)=0x80000001, 0x4) r1 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r1, 0x1, 0x400000000f, &(0x7f000048e000-0x4)=0x5, 0x4) bind$inet6(r1, &(0x7f0000f31000)={0xa, 0x0, 0x0, @empty}, 0x1c) 2018/02/01 16:22:53 executing program 3: mmap(&(0x7f0000000000/0xd000)=nil, 0xd000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x2, 0x0) connect$inet(r0, &(0x7f0000002000-0x10)={0x2, 0xffffffffffffffff, @empty}, 0x10) connect$inet(r0, &(0x7f0000000000)={0x2, 0xffffffffffffffff, @dev={0xac, 0x14}}, 0x10) sendmsg(r0, &(0x7f0000009000)={0x0, 0x0, &(0x7f0000009000)=[], 0x0, &(0x7f0000005000)=[]}, 0x0) 2018/02/01 16:22:53 executing program 0: r0 = socket$inet6(0xa, 0x80002, 0x0) r1 = dup2(r0, r0) ioctl$sock_inet_sctp_SIOCINQ(r1, 0x541b, &(0x7f0000052000-0x4)) 2018/02/01 16:22:53 executing program 2: mmap(&(0x7f0000000000/0x12000)=nil, 0x12000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket(0x18, 0x0, 0x1) sendmmsg(0xffffffffffffffff, &(0x7f0000005000-0x3c)=[{{&(0x7f0000003000)=@in6={0xa, 0xffffffffffffffff, 0x0, @remote={0xfe, 0x80, [], 0xffffffffffffffff, 0xbb}}, 0x1c, &(0x7f0000005000-0x60)=[{&(0x7f0000002000)="4c5614c00401a0dbf8a669ebdedd102c4f7a79e606457dfdf09e2ec2ed253b", 0x1f}], 0x1, &(0x7f0000003000-0x2d0)=[]}}], 0x1, 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000002000)={0x0, 0x0, 0x0, 0x0, 0x1, [{0xf03f}]}) r1 = socket(0x18, 0x0, 0x1) dup2(r1, r0) connect(r1, &(0x7f0000002000)=@sco={0x1f, {0x1}}, 0x26) ioctl$PPPIOCGMRU(r0, 0x80047453, &(0x7f000000c000)) 2018/02/01 16:22:53 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000fd6000-0x8)='./file0\x00', 0x0) mount(&(0x7f000000a000)='./file0\x00', &(0x7f0000027000-0x8)='./file0\x00', &(0x7f000000c000)='ramfs\x00', 0x0, &(0x7f000000a000)) mount(&(0x7f0000037000)='./file0\x00', &(0x7f0000c50000-0x8)='./file0\x00', &(0x7f000002f000-0x6)='ramfs\x00', 0x100000, &(0x7f0000ce3000)) mount(&(0x7f000052f000)='./file0\x00', &(0x7f00008fd000-0x1)='.', &(0x7f00003a3000-0x6)="00e2660000", 0x1000, 0x0) mount(&(0x7f00002ba000-0x8)='./file0\x00', &(0x7f0000cbf000-0x8)='./file0\x00', &(0x7f0000dcd000)='ramfs\x00', 0x80000, &(0x7f000002f000)) mount(&(0x7f00009b1000)='./file0\x00', &(0x7f0000ae7000-0x8)='./file0\x00', &(0x7f0000226000)='an\x00\x00\x00\x00\x00\x00\x00\afs\x00', 0x100000, &(0x7f0000b64000-0x1000)) r0 = open(&(0x7f00006a2000)='./file0\x00', 0x0, 0x0) mkdirat(0xffffffffffffffff, &(0x7f0000034000-0x8)='./file0\x00', 0x0) mount(&(0x7f00001a5000-0xe)='./file0/file0\x00', &(0x7f00002fb000-0x8)='./file0/file0\x00', &(0x7f00002ba000)='\x00v\t', 0x1004, &(0x7f000073b000-0x1)) mount(&(0x7f00005e1000-0x8)='./file0\x00', &(0x7f0000df5000-0x8)='.', &(0x7f0000df4000)='%&t3\x00', 0x2000, &(0x7f00003db000-0x23)) 2018/02/01 16:22:53 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mkdir(&(0x7f000082f000)='./control\x00', 0x0) r0 = open(&(0x7f0000a08000)='./control\x00', 0x0, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) symlinkat(&(0x7f00007ae000-0x8)='./file0\x00', r0, &(0x7f0000a31000-0xa)='./control\x00') ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f0000e4c000)={0xaa}) ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f0000044000-0x20)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r1 = creat(&(0x7f00000df000)='./file0\x00', 0x0) write$sndseq(r1, &(0x7f0000012000-0x2e)=[{0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @time=@time={0x77359400}}], 0x30) link(&(0x7f0000b40000-0xa)='./file0\x00', &(0x7f00006b4000-0x10)='./control/file0\x00') utimensat(r0, &(0x7f0000e03000-0x10)='./control/file0\x00', &(0x7f00003e7000-0x10)={{}, {0x0, 0x2710}}, 0x0) 2018/02/01 16:22:53 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) setsockopt$inet_sctp_SCTP_ENABLE_STREAM_RESET(0xffffffffffffffff, 0x84, 0x76, &(0x7f00005c7000-0x8), 0x8) mremap(&(0x7f00003fb000/0x400000)=nil, 0x400000, 0x400000, 0x3, &(0x7f0000bec000/0x400000)=nil) 2018/02/01 16:22:53 executing program 7: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000f56000)={0x0, 0x0, &(0x7f0000576000-0x10)={&(0x7f0000334000-0x78)={0x2, 0x3, 0x0, 0x9, 0xa, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, [@sadb_address={0x3, 0x40000000000006, 0x0, 0x0, 0x0, @in={0x2, 0xffffffffffffffff, @loopback=0x7f000001}}, @sadb_sa={0x2, 0x1, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x2, 0xfffffffb}, @sadb_address={0x3, 0x20000000000005, 0x0, 0x0, 0x0, @in={0x2, 0xffffffffffffffff, @broadcast=0xffffffff}}]}, 0x50}, 0x1}, 0x0) [ 219.748119] IPVS: ftp: loaded support on port[0] = 21 [ 219.999605] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready 2018/02/01 16:22:54 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000fd6000-0x8)='./file0\x00', 0x0) mount(&(0x7f000000a000)='./file0\x00', &(0x7f0000027000-0x8)='./file0\x00', &(0x7f000000c000)='ramfs\x00', 0x0, &(0x7f000000a000)) mount(&(0x7f0000037000)='./file0\x00', &(0x7f0000c50000-0x8)='./file0\x00', &(0x7f000002f000-0x6)='ramfs\x00', 0x100000, &(0x7f0000ce3000)) mount(&(0x7f000052f000)='./file0\x00', &(0x7f00008fd000-0x1)='.', &(0x7f00003a3000-0x6)="00e2660000", 0x1000, 0x0) mount(&(0x7f00002ba000-0x8)='./file0\x00', &(0x7f0000cbf000-0x8)='./file0\x00', &(0x7f0000dcd000)='ramfs\x00', 0x80000, &(0x7f000002f000)) mount(&(0x7f00009b1000)='./file0\x00', &(0x7f0000ae7000-0x8)='./file0\x00', &(0x7f0000226000)='an\x00\x00\x00\x00\x00\x00\x00\afs\x00', 0x100000, &(0x7f0000b64000-0x1000)) r0 = open(&(0x7f00006a2000)='./file0\x00', 0x0, 0x0) mkdirat(0xffffffffffffffff, &(0x7f0000034000-0x8)='./file0\x00', 0x0) mount(&(0x7f00001a5000-0xe)='./file0/file0\x00', &(0x7f00002fb000-0x8)='./file0/file0\x00', &(0x7f00002ba000)='\x00v\t', 0x1004, &(0x7f000073b000-0x1)) mount(&(0x7f00005e1000-0x8)='./file0\x00', &(0x7f0000df5000-0x8)='.', &(0x7f0000df4000)='%&t3\x00', 0x2000, &(0x7f00003db000-0x23)) 2018/02/01 16:22:54 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$KDSETLED(0xffffffffffffffff, 0x4b32, 0x6) socket$inet_udp(0x2, 0x2, 0x0) r0 = syz_open_dev$tun(&(0x7f0000c7f000-0xd)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00006b0000-0x28)={@common='gre0\x00', @ifru_addrs=@ethernet={0x306, @random="3e7596f732f4"}}) connect$inet(0xffffffffffffffff, &(0x7f0000561000)={0x2, 0xffffffffffffffff, @local={0xac, 0x14, 0xffffffffffffffff, 0xaa}}, 0x10) close(r0) openat$rtc(0xffffffffffffff9c, &(0x7f0000002000)='/dev/rtc\x00', 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$inet6_buf(r1, 0x29, 0x45, &(0x7f0000002000)=""/30, &(0x7f0000000000)=0x1e) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000008000-0x30)={0x4, 0x0, &(0x7f00000be000)=[@register_looper={0x630b}], 0x0, 0x0, &(0x7f000000d000-0xa5)}) 2018/02/01 16:22:54 executing program 7: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000f56000)={0x0, 0x0, &(0x7f0000576000-0x10)={&(0x7f0000334000-0x78)={0x2, 0x3, 0x0, 0x9, 0xa, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, [@sadb_address={0x3, 0x40000000000006, 0x0, 0x0, 0x0, @in={0x2, 0xffffffffffffffff, @loopback=0x7f000001}}, @sadb_sa={0x2, 0x1, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x2, 0xfffffffb}, @sadb_address={0x3, 0x20000000000005, 0x0, 0x0, 0x0, @in={0x2, 0xffffffffffffffff, @broadcast=0xffffffff}}]}, 0x50}, 0x1}, 0x0) 2018/02/01 16:22:54 executing program 2: mmap(&(0x7f0000000000/0x12000)=nil, 0x12000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket(0x18, 0x0, 0x1) sendmmsg(0xffffffffffffffff, &(0x7f0000005000-0x3c)=[{{&(0x7f0000003000)=@in6={0xa, 0xffffffffffffffff, 0x0, @remote={0xfe, 0x80, [], 0xffffffffffffffff, 0xbb}}, 0x1c, &(0x7f0000005000-0x60)=[{&(0x7f0000002000)="4c5614c00401a0dbf8a669ebdedd102c4f7a79e606457dfdf09e2ec2ed253b", 0x1f}], 0x1, &(0x7f0000003000-0x2d0)=[]}}], 0x1, 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000002000)={0x0, 0x0, 0x0, 0x0, 0x1, [{0xf03f}]}) r1 = socket(0x18, 0x0, 0x1) dup2(r1, r0) connect(r1, &(0x7f0000002000)=@sco={0x1f, {0x1}}, 0x26) ioctl$PPPIOCGMRU(r0, 0x80047453, &(0x7f000000c000)) 2018/02/01 16:22:54 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mkdir(&(0x7f000082f000)='./control\x00', 0x0) r0 = open(&(0x7f0000a08000)='./control\x00', 0x0, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) symlinkat(&(0x7f00007ae000-0x8)='./file0\x00', r0, &(0x7f0000a31000-0xa)='./control\x00') ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f0000e4c000)={0xaa}) ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f0000044000-0x20)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r1 = creat(&(0x7f00000df000)='./file0\x00', 0x0) write$sndseq(r1, &(0x7f0000012000-0x2e)=[{0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @time=@time={0x77359400}}], 0x30) link(&(0x7f0000b40000-0xa)='./file0\x00', &(0x7f00006b4000-0x10)='./control/file0\x00') utimensat(r0, &(0x7f0000e03000-0x10)='./control/file0\x00', &(0x7f00003e7000-0x10)={{}, {0x0, 0x2710}}, 0x0) 2018/02/01 16:22:54 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000004000)={0x4, 0x0, &(0x7f000009b000)=[@enter_looper={0x630c}], 0x0, 0x0, &(0x7f00004c1000)}) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000-0x30)={0x0, 0x0, &(0x7f0000004000)=[], 0x1, 0x0, &(0x7f000000d000)='b'}) mmap$binder(&(0x7f0000932000/0x4000)=nil, 0x4000, 0x0, 0x12, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x13, 0x0, &(0x7f0000006000-0x2c)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f0000260000)}) 2018/02/01 16:22:54 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = gettid() rt_sigtimedwait(&(0x7f0000645000-0x8), &(0x7f0000ded000), &(0x7f000052f000)={0x40000077359400}, 0x8) pipe(&(0x7f0000d8c000-0x8)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000e13000-0x8)={0xffffffffffffffff, 0xffffffffffffffff}) tee(r1, r3, 0x80007387, 0x0) r4 = dup2(r2, 0xffffffffffffffff) r5 = syz_open_dev$random(&(0x7f0000bdc000-0xc)='/dev/random\x00', 0x0, 0x0) dup2(r2, r5) ioctl$int_in(r4, 0x5452, &(0x7f0000e36000-0x8)=0x45) fcntl$setown(r2, 0x8, r0) fcntl$setsig(r5, 0xa, 0x12) r6 = gettid() tkill(r6, 0x100000000000016) 2018/02/01 16:22:54 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000f57000-0x8)='keyring\x00', &(0x7f0000767000)={0x73, 0x79, 0x7a}, &(0x7f0000c66000-0x54), 0x0, 0x52e2f637490a4e7f) 2018/02/01 16:22:54 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000f57000-0x8)='keyring\x00', &(0x7f0000767000)={0x73, 0x79, 0x7a}, &(0x7f0000c66000-0x54), 0x0, 0x52e2f637490a4e7f) 2018/02/01 16:22:54 executing program 2: mmap(&(0x7f0000000000/0x12000)=nil, 0x12000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket(0x18, 0x0, 0x1) sendmmsg(0xffffffffffffffff, &(0x7f0000005000-0x3c)=[{{&(0x7f0000003000)=@in6={0xa, 0xffffffffffffffff, 0x0, @remote={0xfe, 0x80, [], 0xffffffffffffffff, 0xbb}}, 0x1c, &(0x7f0000005000-0x60)=[{&(0x7f0000002000)="4c5614c00401a0dbf8a669ebdedd102c4f7a79e606457dfdf09e2ec2ed253b", 0x1f}], 0x1, &(0x7f0000003000-0x2d0)=[]}}], 0x1, 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000002000)={0x0, 0x0, 0x0, 0x0, 0x1, [{0xf03f}]}) r1 = socket(0x18, 0x0, 0x1) dup2(r1, r0) connect(r1, &(0x7f0000002000)=@sco={0x1f, {0x1}}, 0x26) ioctl$PPPIOCGMRU(r0, 0x80047453, &(0x7f000000c000)) 2018/02/01 16:22:54 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mkdir(&(0x7f000082f000)='./control\x00', 0x0) r0 = open(&(0x7f0000a08000)='./control\x00', 0x0, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) symlinkat(&(0x7f00007ae000-0x8)='./file0\x00', r0, &(0x7f0000a31000-0xa)='./control\x00') ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f0000e4c000)={0xaa}) ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f0000044000-0x20)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r1 = creat(&(0x7f00000df000)='./file0\x00', 0x0) write$sndseq(r1, &(0x7f0000012000-0x2e)=[{0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @time=@time={0x77359400}}], 0x30) link(&(0x7f0000b40000-0xa)='./file0\x00', &(0x7f00006b4000-0x10)='./control/file0\x00') utimensat(r0, &(0x7f0000e03000-0x10)='./control/file0\x00', &(0x7f00003e7000-0x10)={{}, {0x0, 0x2710}}, 0x0) 2018/02/01 16:22:54 executing program 7: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000f56000)={0x0, 0x0, &(0x7f0000576000-0x10)={&(0x7f0000334000-0x78)={0x2, 0x3, 0x0, 0x9, 0xa, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, [@sadb_address={0x3, 0x40000000000006, 0x0, 0x0, 0x0, @in={0x2, 0xffffffffffffffff, @loopback=0x7f000001}}, @sadb_sa={0x2, 0x1, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x2, 0xfffffffb}, @sadb_address={0x3, 0x20000000000005, 0x0, 0x0, 0x0, @in={0x2, 0xffffffffffffffff, @broadcast=0xffffffff}}]}, 0x50}, 0x1}, 0x0) 2018/02/01 16:22:54 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000f57000-0x8)='keyring\x00', &(0x7f0000767000)={0x73, 0x79, 0x7a}, &(0x7f0000c66000-0x54), 0x0, 0x52e2f637490a4e7f) [ 220.452227] binder: 30921 RLIMIT_NICE not set 2018/02/01 16:22:54 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mkdir(&(0x7f000082f000)='./control\x00', 0x0) r0 = open(&(0x7f0000a08000)='./control\x00', 0x0, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000e4c000)={0xaa}) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000044000-0x20)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r2 = creat(&(0x7f00000df000)='./file0\x00', 0x0) write$sndseq(r2, &(0x7f0000012000-0x2e)=[{0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @time=@time={0x77359400}}], 0x30) link(&(0x7f0000b40000-0xa)='./file0\x00', &(0x7f00006b4000-0x10)='./control/file0\x00') utimensat(r0, &(0x7f0000e03000-0x10)='./control/file0\x00', &(0x7f00003e7000-0x10)={{}, {0x0, 0x2710}}, 0x0) [ 220.482683] binder: 30921 RLIMIT_NICE not set [ 220.503745] binder: BINDER_SET_CONTEXT_MGR already set [ 220.512770] binder: 30919:30921 ioctl 40046207 0 returned -16 [ 220.513475] binder_alloc: 30919: binder_alloc_buf, no vma [ 220.513500] binder: 30919:30946 transaction failed 29189/-3, size 0-0 line 2903 [ 220.545645] binder: undelivered TRANSACTION_ERROR: 29189 [ 220.551286] binder: release 30919:30921 transaction 479 in, still active [ 220.558187] binder: send failed reply for transaction 479 to 30919:30935 [ 220.565069] binder: undelivered TRANSACTION_COMPLETE [ 220.570192] binder: undelivered TRANSACTION_ERROR: 29189 2018/02/01 16:22:55 executing program 2: mmap(&(0x7f0000000000/0x12000)=nil, 0x12000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket(0x18, 0x0, 0x1) sendmmsg(0xffffffffffffffff, &(0x7f0000005000-0x3c)=[{{&(0x7f0000003000)=@in6={0xa, 0xffffffffffffffff, 0x0, @remote={0xfe, 0x80, [], 0xffffffffffffffff, 0xbb}}, 0x1c, &(0x7f0000005000-0x60)=[{&(0x7f0000002000)="4c5614c00401a0dbf8a669ebdedd102c4f7a79e606457dfdf09e2ec2ed253b", 0x1f}], 0x1, &(0x7f0000003000-0x2d0)=[]}}], 0x1, 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000002000)={0x0, 0x0, 0x0, 0x0, 0x1, [{0xf03f}]}) r1 = socket(0x18, 0x0, 0x1) dup2(r1, r0) connect(r1, &(0x7f0000002000)=@sco={0x1f, {0x1}}, 0x26) ioctl$PPPIOCGMRU(r0, 0x80047453, &(0x7f000000c000)) 2018/02/01 16:22:55 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000fd6000-0x8)='./file0\x00', 0x0) mount(&(0x7f000000a000)='./file0\x00', &(0x7f0000027000-0x8)='./file0\x00', &(0x7f000000c000)='ramfs\x00', 0x0, &(0x7f000000a000)) mount(&(0x7f0000037000)='./file0\x00', &(0x7f0000c50000-0x8)='./file0\x00', &(0x7f000002f000-0x6)='ramfs\x00', 0x100000, &(0x7f0000ce3000)) mount(&(0x7f000052f000)='./file0\x00', &(0x7f00008fd000-0x1)='.', &(0x7f00003a3000-0x6)="00e2660000", 0x1000, 0x0) mount(&(0x7f00002ba000-0x8)='./file0\x00', &(0x7f0000cbf000-0x8)='./file0\x00', &(0x7f0000dcd000)='ramfs\x00', 0x80000, &(0x7f000002f000)) mount(&(0x7f00009b1000)='./file0\x00', &(0x7f0000ae7000-0x8)='./file0\x00', &(0x7f0000226000)='an\x00\x00\x00\x00\x00\x00\x00\afs\x00', 0x100000, &(0x7f0000b64000-0x1000)) r0 = open(&(0x7f00006a2000)='./file0\x00', 0x0, 0x0) mkdirat(0xffffffffffffffff, &(0x7f0000034000-0x8)='./file0\x00', 0x0) mount(&(0x7f00001a5000-0xe)='./file0/file0\x00', &(0x7f00002fb000-0x8)='./file0/file0\x00', &(0x7f00002ba000)='\x00v\t', 0x1004, &(0x7f000073b000-0x1)) mount(&(0x7f00005e1000-0x8)='./file0\x00', &(0x7f0000df5000-0x8)='.', &(0x7f0000df4000)='%&t3\x00', 0x2000, &(0x7f00003db000-0x23)) 2018/02/01 16:22:55 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x0, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000f56000)={0x0, 0x0, &(0x7f0000576000-0x10)={&(0x7f0000334000-0x78)={0x2, 0x3, 0x0, 0x9, 0xa, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, [@sadb_address={0x3, 0x40000000000006, 0x0, 0x0, 0x0, @in={0x2, 0xffffffffffffffff, @loopback=0x7f000001}}, @sadb_sa={0x2, 0x1, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x2, 0xfffffffb}, @sadb_address={0x3, 0x20000000000005, 0x0, 0x0, 0x0, @in={0x2, 0xffffffffffffffff, @broadcast=0xffffffff}}]}, 0x50}, 0x1}, 0x0) 2018/02/01 16:22:55 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000f57000-0x8)='keyring\x00', &(0x7f0000767000)={0x73, 0x79, 0x7a}, &(0x7f0000c66000-0x54), 0x0, 0x52e2f637490a4e7f) 2018/02/01 16:22:55 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000002000)={0x0}, &(0x7f0000001000-0x4)=0xc) r1 = syz_open_procfs(r0, &(0x7f0000001000)='comm\x00') fchmod(r1, 0x143) execveat(r1, &(0x7f000000a000)='./file0\x00', &(0x7f0000003000-0x48)=[], &(0x7f0000001000-0xe)=[&(0x7f000000a000)='\x00'], 0x1000) 2018/02/01 16:22:55 executing program 0: mmap(&(0x7f0000000000/0xdcc000)=nil, 0xdcc000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket(0xa, 0x1, 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000000)={0x0, 0xffffffff, 0x41, 0x1, 0x0, []}) ioctl(r0, 0x8916, &(0x7f0000000000)) ioctl(r0, 0x8936, &(0x7f0000000000)) 2018/02/01 16:22:55 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = gettid() rt_sigtimedwait(&(0x7f0000645000-0x8), &(0x7f0000ded000), &(0x7f000052f000)={0x40000077359400}, 0x8) pipe(&(0x7f0000d8c000-0x8)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000e13000-0x8)={0xffffffffffffffff, 0xffffffffffffffff}) tee(r1, r3, 0x80007387, 0x0) r4 = dup2(r2, 0xffffffffffffffff) r5 = syz_open_dev$random(&(0x7f0000bdc000-0xc)='/dev/random\x00', 0x0, 0x0) dup2(r2, r5) ioctl$int_in(r4, 0x5452, &(0x7f0000e36000-0x8)=0x45) fcntl$setown(r2, 0x8, r0) fcntl$setsig(r5, 0xa, 0x12) r6 = gettid() tkill(r6, 0x100000000000016) 2018/02/01 16:22:55 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mkdir(&(0x7f000082f000)='./control\x00', 0x0) r0 = open(&(0x7f0000a08000)='./control\x00', 0x0, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000e4c000)={0xaa}) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000044000-0x20)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r2 = creat(&(0x7f00000df000)='./file0\x00', 0x0) write$sndseq(r2, &(0x7f0000012000-0x2e)=[{0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @time=@time={0x77359400}}], 0x30) link(&(0x7f0000b40000-0xa)='./file0\x00', &(0x7f00006b4000-0x10)='./control/file0\x00') utimensat(r0, &(0x7f0000e03000-0x10)='./control/file0\x00', &(0x7f00003e7000-0x10)={{}, {0x0, 0x2710}}, 0x0) 2018/02/01 16:22:55 executing program 2: mmap(&(0x7f0000000000/0x12000)=nil, 0x12000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket(0x18, 0x0, 0x1) sendmmsg(0xffffffffffffffff, &(0x7f0000005000-0x3c)=[{{&(0x7f0000003000)=@in6={0xa, 0xffffffffffffffff, 0x0, @remote={0xfe, 0x80, [], 0xffffffffffffffff, 0xbb}}, 0x1c, &(0x7f0000005000-0x60)=[{&(0x7f0000002000)="4c5614c00401a0dbf8a669ebdedd102c4f7a79e606457dfdf09e2ec2ed253b", 0x1f}], 0x1, &(0x7f0000003000-0x2d0)=[]}}], 0x1, 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000002000)={0x0, 0x0, 0x0, 0x0, 0x1, [{0xf03f}]}) r1 = socket(0x18, 0x0, 0x1) dup2(r1, r0) connect(r1, &(0x7f0000002000)=@sco={0x1f, {0x1}}, 0x26) ioctl$PPPIOCGMRU(r0, 0x80047453, &(0x7f000000c000)) 2018/02/01 16:22:55 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000fd6000-0x8)='./file0\x00', 0x0) mount(&(0x7f000000a000)='./file0\x00', &(0x7f0000027000-0x8)='./file0\x00', &(0x7f000000c000)='ramfs\x00', 0x0, &(0x7f000000a000)) mount(&(0x7f0000037000)='./file0\x00', &(0x7f0000c50000-0x8)='./file0\x00', &(0x7f000002f000-0x6)='ramfs\x00', 0x100000, &(0x7f0000ce3000)) mount(&(0x7f000052f000)='./file0\x00', &(0x7f00008fd000-0x1)='.', &(0x7f00003a3000-0x6)="00e2660000", 0x1000, 0x0) mount(&(0x7f00002ba000-0x8)='./file0\x00', &(0x7f0000cbf000-0x8)='./file0\x00', &(0x7f0000dcd000)='ramfs\x00', 0x80000, &(0x7f000002f000)) mount(&(0x7f00009b1000)='./file0\x00', &(0x7f0000ae7000-0x8)='./file0\x00', &(0x7f0000226000)='an\x00\x00\x00\x00\x00\x00\x00\afs\x00', 0x100000, &(0x7f0000b64000-0x1000)) r0 = open(&(0x7f00006a2000)='./file0\x00', 0x0, 0x0) mkdirat(r0, &(0x7f0000034000-0x8)='./file0\x00', 0x0) mount(&(0x7f00001a5000-0xe)='./file0/file0\x00', &(0x7f00002fb000-0x8)='./file0/file0\x00', &(0x7f00002ba000)='\x00v\t', 0x0, &(0x7f000073b000-0x1)) mount(&(0x7f00005e1000-0x8)='./file0\x00', &(0x7f0000df5000-0x8)='.', &(0x7f0000df4000)='%&t3\x00', 0x2000, &(0x7f00003db000-0x23)) 2018/02/01 16:22:55 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000f57000-0x8)='keyring\x00', &(0x7f0000767000)={0x73, 0x79, 0x7a}, &(0x7f0000c66000-0x54), 0x0, 0x52e2f637490a4e7f) 2018/02/01 16:22:55 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x0, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000f56000)={0x0, 0x0, &(0x7f0000576000-0x10)={&(0x7f0000334000-0x78)={0x2, 0x3, 0x0, 0x9, 0xa, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, [@sadb_address={0x3, 0x40000000000006, 0x0, 0x0, 0x0, @in={0x2, 0xffffffffffffffff, @loopback=0x7f000001}}, @sadb_sa={0x2, 0x1, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x2, 0xfffffffb}, @sadb_address={0x3, 0x20000000000005, 0x0, 0x0, 0x0, @in={0x2, 0xffffffffffffffff, @broadcast=0xffffffff}}]}, 0x50}, 0x1}, 0x0) 2018/02/01 16:22:55 executing program 2: mmap(&(0x7f0000000000/0x12000)=nil, 0x12000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket(0x18, 0x0, 0x1) sendmmsg(0xffffffffffffffff, &(0x7f0000005000-0x3c)=[{{&(0x7f0000003000)=@in6={0xa, 0xffffffffffffffff, 0x0, @remote={0xfe, 0x80, [], 0xffffffffffffffff, 0xbb}}, 0x1c, &(0x7f0000005000-0x60)=[{&(0x7f0000002000)="4c5614c00401a0dbf8a669ebdedd102c4f7a79e606457dfdf09e2ec2ed253b", 0x1f}], 0x1, &(0x7f0000003000-0x2d0)=[]}}], 0x1, 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000002000)={0x0, 0x0, 0x0, 0x0, 0x1, [{0xf03f}]}) r1 = socket(0x18, 0x0, 0x1) dup2(r1, r0) ioctl$PPPIOCGMRU(r0, 0x80047453, &(0x7f000000c000)) 2018/02/01 16:22:55 executing program 4: add_key(&(0x7f0000f57000-0x8)='keyring\x00', &(0x7f0000767000)={0x73, 0x79, 0x7a}, &(0x7f0000c66000-0x54), 0x0, 0x52e2f637490a4e7f) 2018/02/01 16:22:55 executing program 0: mmap(&(0x7f0000000000/0xf6c000)=nil, 0xf6c000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket(0x10, 0x2, 0x0) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000610000-0x10)={0x2, &(0x7f0000f69000)=[{0xb1}, {0x6}]}, 0x10) [ 221.052463] audit: type=1400 audit(1517502175.343:142): avc: denied { setattr } for pid=30951 comm="syz-executor3" name="comm" dev="proc" ino=53291 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=file permissive=1 [ 221.128929] audit: type=1400 audit(1517502175.379:143): avc: denied { execute } for pid=30951 comm="syz-executor3" name="comm" dev="proc" ino=53291 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=file permissive=1 2018/02/01 16:22:55 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x0, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000f56000)={0x0, 0x0, &(0x7f0000576000-0x10)={&(0x7f0000334000-0x78)={0x2, 0x3, 0x0, 0x9, 0xa, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, [@sadb_address={0x3, 0x40000000000006, 0x0, 0x0, 0x0, @in={0x2, 0xffffffffffffffff, @loopback=0x7f000001}}, @sadb_sa={0x2, 0x1, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x2, 0xfffffffb}, @sadb_address={0x3, 0x20000000000005, 0x0, 0x0, 0x0, @in={0x2, 0xffffffffffffffff, @broadcast=0xffffffff}}]}, 0x50}, 0x1}, 0x0) 2018/02/01 16:22:55 executing program 4: add_key(&(0x7f0000f57000-0x8)='keyring\x00', &(0x7f0000767000)={0x73, 0x79, 0x7a}, &(0x7f0000c66000-0x54), 0x0, 0x52e2f637490a4e7f) 2018/02/01 16:22:55 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f00001ff000-0x1c)={0xa, 0x2, 0x0, @empty}, 0x1c) bind$inet6(r0, &(0x7f0000d13000)={0xa, 0xffffffffffffffff, 0x0, @ipv4={[], [0xff, 0xff], @remote={0xac, 0x14, 0x0, 0xbb}}}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000fb4000), 0x0, 0x20000004, &(0x7f00007aa000)={0xa, 0x2, 0x0, @empty}, 0x1c) r2 = accept4(r1, &(0x7f0000219000-0x58)=@alg, &(0x7f0000db5000-0x4)=0x58, 0x0) shutdown(r0, 0x1) sendmsg$nl_crypto(r2, &(0x7f0000485000-0x38)={&(0x7f0000816000)={0x10}, 0xc, &(0x7f0000c37000)={&(0x7f0000fa3000)=@get={0xe0, 0x13, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, {{'cbc-aes-aesni\x00'}}, []}, 0x10176}, 0x1}, 0x0) 2018/02/01 16:22:55 executing program 2: mmap(&(0x7f0000000000/0x12000)=nil, 0x12000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket(0x18, 0x0, 0x1) sendmmsg(0xffffffffffffffff, &(0x7f0000005000-0x3c)=[{{&(0x7f0000003000)=@in6={0xa, 0xffffffffffffffff, 0x0, @remote={0xfe, 0x80, [], 0xffffffffffffffff, 0xbb}}, 0x1c, &(0x7f0000005000-0x60)=[{&(0x7f0000002000)="4c5614c00401a0dbf8a669ebdedd102c4f7a79e606457dfdf09e2ec2ed253b", 0x1f}], 0x1, &(0x7f0000003000-0x2d0)=[]}}], 0x1, 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000002000)={0x0, 0x0, 0x0, 0x0, 0x1, [{0xf03f}]}) r1 = socket(0x18, 0x0, 0x1) dup2(r1, r0) ioctl$PPPIOCGMRU(r0, 0x80047453, &(0x7f000000c000)) 2018/02/01 16:22:55 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000fd6000-0x8)='./file0\x00', 0x0) mount(&(0x7f000000a000)='./file0\x00', &(0x7f0000027000-0x8)='./file0\x00', &(0x7f000000c000)='ramfs\x00', 0x0, &(0x7f000000a000)) mount(&(0x7f0000037000)='./file0\x00', &(0x7f0000c50000-0x8)='./file0\x00', &(0x7f000002f000-0x6)='ramfs\x00', 0x100000, &(0x7f0000ce3000)) mount(&(0x7f000052f000)='./file0\x00', &(0x7f00008fd000-0x1)='.', &(0x7f00003a3000-0x6)="00e2660000", 0x1000, 0x0) mount(&(0x7f00002ba000-0x8)='./file0\x00', &(0x7f0000cbf000-0x8)='./file0\x00', &(0x7f0000dcd000)='ramfs\x00', 0x80000, &(0x7f000002f000)) mount(&(0x7f00009b1000)='./file0\x00', &(0x7f0000ae7000-0x8)='./file0\x00', &(0x7f0000226000)='an\x00\x00\x00\x00\x00\x00\x00\afs\x00', 0x100000, &(0x7f0000b64000-0x1000)) r0 = open(&(0x7f00006a2000)='./file0\x00', 0x0, 0x0) mkdirat(r0, &(0x7f0000034000-0x8)='./file0\x00', 0x0) mount(&(0x7f00001a5000-0xe)='./file0/file0\x00', &(0x7f00002fb000-0x8)='./file0/file0\x00', &(0x7f00002ba000)='\x00v\t', 0x0, &(0x7f000073b000-0x1)) mount(&(0x7f00005e1000-0x8)='./file0\x00', &(0x7f0000df5000-0x8)='.', &(0x7f0000df4000)='%&t3\x00', 0x2000, &(0x7f00003db000-0x23)) 2018/02/01 16:22:55 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mkdir(&(0x7f000082f000)='./control\x00', 0x0) r0 = open(&(0x7f0000a08000)='./control\x00', 0x0, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000e4c000)={0xaa}) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000044000-0x20)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r2 = creat(&(0x7f00000df000)='./file0\x00', 0x0) write$sndseq(r2, &(0x7f0000012000-0x2e)=[{0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @time=@time={0x77359400}}], 0x30) link(&(0x7f0000b40000-0xa)='./file0\x00', &(0x7f00006b4000-0x10)='./control/file0\x00') utimensat(r0, &(0x7f0000e03000-0x10)='./control/file0\x00', &(0x7f00003e7000-0x10)={{}, {0x0, 0x2710}}, 0x0) 2018/02/01 16:22:55 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = gettid() rt_sigtimedwait(&(0x7f0000645000-0x8), &(0x7f0000ded000), &(0x7f000052f000)={0x40000077359400}, 0x8) pipe(&(0x7f0000d8c000-0x8)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000e13000-0x8)={0xffffffffffffffff, 0xffffffffffffffff}) tee(r1, r3, 0x80007387, 0x0) r4 = dup2(r2, r3) r5 = syz_open_dev$random(&(0x7f0000bdc000-0xc)='/dev/random\x00', 0x0, 0x0) dup2(0xffffffffffffffff, r5) ioctl$int_in(r4, 0x5452, &(0x7f0000e36000-0x8)=0x45) fcntl$setown(r2, 0x8, r0) fcntl$setsig(r5, 0xa, 0x12) r6 = gettid() tkill(r6, 0x100000000000016) 2018/02/01 16:22:55 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000d1d000)={&(0x7f0000d8a000-0xc)={0x10}, 0xc, &(0x7f0000445000-0x10)={&(0x7f00008a4000)=@ipv6_newaddr={0x10, 0x14, 0xb, 0xffffffffffffffff, 0xffffffffffffffff, {0xa}, [@IFA_LOCAL={0x14, 0x2, @dev={0xfe, 0x80}}]}, 0x2c}, 0x1}, 0x0) 2018/02/01 16:22:55 executing program 4: add_key(&(0x7f0000f57000-0x8)='keyring\x00', &(0x7f0000767000)={0x73, 0x79, 0x7a}, &(0x7f0000c66000-0x54), 0x0, 0x52e2f637490a4e7f) 2018/02/01 16:22:55 executing program 2: mmap(&(0x7f0000000000/0x12000)=nil, 0x12000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket(0x18, 0x0, 0x1) sendmmsg(0xffffffffffffffff, &(0x7f0000005000-0x3c)=[{{&(0x7f0000003000)=@in6={0xa, 0xffffffffffffffff, 0x0, @remote={0xfe, 0x80, [], 0xffffffffffffffff, 0xbb}}, 0x1c, &(0x7f0000005000-0x60)=[{&(0x7f0000002000)="4c5614c00401a0dbf8a669ebdedd102c4f7a79e606457dfdf09e2ec2ed253b", 0x1f}], 0x1, &(0x7f0000003000-0x2d0)=[]}}], 0x1, 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000002000)={0x0, 0x0, 0x0, 0x0, 0x1, [{0xf03f}]}) r1 = socket(0x18, 0x0, 0x1) dup2(r1, r0) ioctl$PPPIOCGMRU(r0, 0x80047453, &(0x7f000000c000)) 2018/02/01 16:22:56 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000f56000)={0x0, 0x0, &(0x7f0000576000-0x10)={&(0x7f0000334000-0x78)={0x2, 0x3, 0x0, 0x9, 0xa, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, [@sadb_address={0x3, 0x40000000000006, 0x0, 0x0, 0x0, @in={0x2, 0xffffffffffffffff, @loopback=0x7f000001}}, @sadb_sa={0x2, 0x1, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x2, 0xfffffffb}, @sadb_address={0x3, 0x20000000000005, 0x0, 0x0, 0x0, @in={0x2, 0xffffffffffffffff, @broadcast=0xffffffff}}]}, 0x50}, 0x1}, 0x0) 2018/02/01 16:22:56 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x0, 0x32, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000f57000-0x8)='keyring\x00', &(0x7f0000767000)={0x73, 0x79, 0x7a}, &(0x7f0000c66000-0x54), 0x0, 0x52e2f637490a4e7f) 2018/02/01 16:22:56 executing program 2: mmap(&(0x7f0000000000/0x12000)=nil, 0x12000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket(0x18, 0x0, 0x1) sendmmsg(0xffffffffffffffff, &(0x7f0000005000-0x3c)=[{{&(0x7f0000003000)=@in6={0xa, 0xffffffffffffffff, 0x0, @remote={0xfe, 0x80, [], 0xffffffffffffffff, 0xbb}}, 0x1c, &(0x7f0000005000-0x60)=[{&(0x7f0000002000)="4c5614c00401a0dbf8a669ebdedd102c4f7a79e606457dfdf09e2ec2ed253b", 0x1f}], 0x1, &(0x7f0000003000-0x2d0)=[]}}], 0x1, 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000002000)={0x0, 0x0, 0x0, 0x0, 0x1, [{0xf03f}]}) r1 = socket(0x18, 0x0, 0x1) connect(r1, &(0x7f0000002000)=@sco={0x1f, {0x1}}, 0x26) ioctl$PPPIOCGMRU(r0, 0x80047453, &(0x7f000000c000)) 2018/02/01 16:22:56 executing program 0: mmap(&(0x7f0000000000/0x20000)=nil, 0x20000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) sendto$inet(0xffffffffffffffff, &(0x7f0000016000)="22d3b13cdb1c050c6a7f91890bd82f9d2d5b58221927224e12a9", 0x1a, 0x0, &(0x7f0000005000)={0x2, 0xffffffffffffffff, @dev={0xac, 0x14}}, 0x10) sendmsg$nl_generic(r0, &(0x7f0000005000)={&(0x7f0000000000)={0x10}, 0xc, &(0x7f0000013000-0x10)={&(0x7f0000016000)={0x1c, 0x52, 0x401, 0xffffffffffffffff, 0xffffffffffffffff, {0xa}, [@nested={0x8, 0x1, [@generic="02"]}]}, 0x1c}, 0x1}, 0x0) 2018/02/01 16:22:56 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x0, 0x32, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000f57000-0x8)='keyring\x00', &(0x7f0000767000)={0x73, 0x79, 0x7a}, &(0x7f0000c66000-0x54), 0x0, 0x52e2f637490a4e7f) 2018/02/01 16:22:56 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000f56000)={0x0, 0x0, &(0x7f0000576000-0x10)={&(0x7f0000334000-0x78)={0x2, 0x3, 0x0, 0x9, 0xa, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, [@sadb_address={0x3, 0x40000000000006, 0x0, 0x0, 0x0, @in={0x2, 0xffffffffffffffff, @loopback=0x7f000001}}, @sadb_sa={0x2, 0x1, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x2, 0xfffffffb}, @sadb_address={0x3, 0x20000000000005, 0x0, 0x0, 0x0, @in={0x2, 0xffffffffffffffff, @broadcast=0xffffffff}}]}, 0x50}, 0x1}, 0x0) 2018/02/01 16:22:56 executing program 0: mmap(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x3, 0x8972, 0xffffffffffffffff, 0x0) mlock2(&(0x7f0000a93000/0x2000)=nil, 0x2000, 0x0) clone(0x0, &(0x7f0000003000-0xc9), &(0x7f0000a96000-0x4), &(0x7f0000b25000-0x4), &(0x7f0000002000)) mmap(&(0x7f0000000000/0xfea000)=nil, 0xfea000, 0x0, 0x32, 0xffffffffffffffff, 0x0) 2018/02/01 16:22:56 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x0, 0x32, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000f57000-0x8)='keyring\x00', &(0x7f0000767000)={0x73, 0x79, 0x7a}, &(0x7f0000c66000-0x54), 0x0, 0x52e2f637490a4e7f) 2018/02/01 16:22:56 executing program 2: mmap(&(0x7f0000000000/0x12000)=nil, 0x12000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket(0x18, 0x0, 0x1) sendmmsg(0xffffffffffffffff, &(0x7f0000005000-0x3c)=[{{&(0x7f0000003000)=@in6={0xa, 0xffffffffffffffff, 0x0, @remote={0xfe, 0x80, [], 0xffffffffffffffff, 0xbb}}, 0x1c, &(0x7f0000005000-0x60)=[{&(0x7f0000002000)="4c5614c00401a0dbf8a669ebdedd102c4f7a79e606457dfdf09e2ec2ed253b", 0x1f}], 0x1, &(0x7f0000003000-0x2d0)=[]}}], 0x1, 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000002000)={0x0, 0x0, 0x0, 0x0, 0x1, [{0xf03f}]}) r1 = socket(0x18, 0x0, 0x1) connect(r1, &(0x7f0000002000)=@sco={0x1f, {0x1}}, 0x26) ioctl$PPPIOCGMRU(r0, 0x80047453, &(0x7f000000c000)) 2018/02/01 16:22:56 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000fd6000-0x8)='./file0\x00', 0x0) mount(&(0x7f000000a000)='./file0\x00', &(0x7f0000027000-0x8)='./file0\x00', &(0x7f000000c000)='ramfs\x00', 0x0, &(0x7f000000a000)) mount(&(0x7f0000037000)='./file0\x00', &(0x7f0000c50000-0x8)='./file0\x00', &(0x7f000002f000-0x6)='ramfs\x00', 0x100000, &(0x7f0000ce3000)) mount(&(0x7f000052f000)='./file0\x00', &(0x7f00008fd000-0x1)='.', &(0x7f00003a3000-0x6)="00e2660000", 0x1000, 0x0) mount(&(0x7f00002ba000-0x8)='./file0\x00', &(0x7f0000cbf000-0x8)='./file0\x00', &(0x7f0000dcd000)='ramfs\x00', 0x80000, &(0x7f000002f000)) mount(&(0x7f00009b1000)='./file0\x00', &(0x7f0000ae7000-0x8)='./file0\x00', &(0x7f0000226000)='an\x00\x00\x00\x00\x00\x00\x00\afs\x00', 0x100000, &(0x7f0000b64000-0x1000)) r0 = open(&(0x7f00006a2000)='./file0\x00', 0x0, 0x0) mkdirat(r0, &(0x7f0000034000-0x8)='./file0\x00', 0x0) mount(&(0x7f00001a5000-0xe)='./file0/file0\x00', &(0x7f00002fb000-0x8)='./file0/file0\x00', &(0x7f00002ba000)='\x00v\t', 0x0, &(0x7f000073b000-0x1)) mount(&(0x7f00005e1000-0x8)='./file0\x00', &(0x7f0000df5000-0x8)='.', &(0x7f0000df4000)='%&t3\x00', 0x2000, &(0x7f00003db000-0x23)) 2018/02/01 16:22:56 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000f56000)={0x0, 0x0, &(0x7f0000576000-0x10)={&(0x7f0000334000-0x78)={0x2, 0x3, 0x0, 0x9, 0xa, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, [@sadb_address={0x3, 0x40000000000006, 0x0, 0x0, 0x0, @in={0x2, 0xffffffffffffffff, @loopback=0x7f000001}}, @sadb_sa={0x2, 0x1, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x2, 0xfffffffb}, @sadb_address={0x3, 0x20000000000005, 0x0, 0x0, 0x0, @in={0x2, 0xffffffffffffffff, @broadcast=0xffffffff}}]}, 0x50}, 0x1}, 0x0) 2018/02/01 16:22:56 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x0, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000f57000-0x8)='keyring\x00', &(0x7f0000767000)={0x73, 0x79, 0x7a}, &(0x7f0000c66000-0x54), 0x0, 0x52e2f637490a4e7f) 2018/02/01 16:22:56 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mkdir(&(0x7f000082f000)='./control\x00', 0x0) r0 = open(&(0x7f0000a08000)='./control\x00', 0x0, 0x0) symlinkat(&(0x7f00007ae000-0x8)='./file0\x00', r0, &(0x7f0000a31000-0xa)='./control\x00') r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000e4c000)={0xaa}) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000044000-0x20)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r2 = creat(&(0x7f00000df000)='./file0\x00', 0x0) write$sndseq(r2, &(0x7f0000012000-0x2e)=[{0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @time=@time={0x77359400}}], 0x30) link(&(0x7f0000b40000-0xa)='./file0\x00', &(0x7f00006b4000-0x10)='./control/file0\x00') utimensat(r0, &(0x7f0000e03000-0x10)='./control/file0\x00', &(0x7f00003e7000-0x10)={{}, {0x0, 0x2710}}, 0x0) 2018/02/01 16:22:56 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x1, 0x0) r1 = dup(r0) setsockopt$inet_tcp_int(r1, 0x6, 0x2, &(0x7f0000b10000)=0xc2, 0x6677bbc4) bind$inet(r0, &(0x7f00000f1000-0x10)={0x2, 0x3, @multicast2=0xe0000002}, 0x10) setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x1a, &(0x7f0000e9c000-0x10)={0x1, &(0x7f0000f07000)=[{0x6, 0x0, 0x0, 0x101}]}, 0x10) connect$inet(r0, &(0x7f0000987000)={0x2, 0x3, @empty}, 0x10) write$evdev(r1, &(0x7f0000708000-0xd8)=[{{0x0, 0x7530}}], 0x18) sendmsg$nl_xfrm(r1, &(0x7f0000f1c000)={&(0x7f0000834000)={0x10}, 0xc, &(0x7f00007fb000-0x10)={&(0x7f0000687000)=@acquire={0x128, 0x17, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, {{@in=@loopback=0x7f000001}, @in=@multicast1=0xe0000001, {@in=@remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @in=@empty}, {{@in=@multicast1=0xe0000001, @in6=@mcast1={0xff, 0x1, [], 0x1}}}}, []}, 0x128}, 0x1}, 0x0) sendmsg(r1, &(0x7f0000247000)={&(0x7f000058d000-0x3a)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0xffffffffffffffff, 0x0, @local={0xfe, 0x80, [], 0xffffffffffffffff, 0xaa}}}}, 0x3a, &(0x7f0000a58000-0x20)=[{&(0x7f0000787000-0x1000)="43c552ade9499f006b837d34e3d59b5e2b05d0f1fb5cd3a933bbe36d13b79f3e297ec03e39f5c78a098e87104eefbe48d4ebefbd25aeff6015522455e1752492b914e6c9cfdba4876af4a110543d98ea7adb436387a4c9e140c18d8085e7c93ba89bc871b0e6c95a53aba09bba817fb29ebaf4d276f6b4042bed7b7a31e439df237ac88120e38e6b466bae4ca0b9c44478abbb7fc744ae4a4942b7969c43d4d5fc2a48f8f6baf9182def6950d631d898bc000952396e6e4b8a796431b75a7ecfbce48ccc294baed5d8f71d1deae7d2c6d0868f7919a5677ec01ac04bb5370734681305261aec26b9f309ddf8c4cb8f7a32181a41722af15009ecd0f0080d3b55ec7f4338a45f8c3b976b36f8f21e1b612763db6213864fdde6f3c114471844c7e5cd22a7922be21fc9984a403682c8407c059810f0f715a8a5d56e640486589bac4d88a79ef15437423caeb1b2c506ae14de606d627fce1fdc6f6d3907a670d93e6ece58cb79150b8844c4a312b1d4589178a9526fe1f446ed69a4d141a9ea1b7dd87ee3c38e24f468566c9e72193f226c4d3b730b5cfd10032841b1f4ab66d74ccb8c9b1d8587aaed160b170792a181d5d275c922ea41d617bdc133e6653ab0ad5c30c1e167dcd67ff7c876be9b4e0621bdca83967caba37fe9ff310b9e70c829558269cf64c279cb7b4e8200936098eddfde3326d3f70d9ef9d699005e38bdcc5efecfa32c14f5ea23d2b0c2010bcaee37f4ae90c95e6a114fd70752df56e7b48ce3a902caf714c2ba85f55b9ca2d777dfe226b7b9b5e8f00fbc91baf5a5de8b6546bb10d156b37d0ad2df0edccbdcf87e316b1c14194f90f7e2ef8e4c484a74678b4ab702803aa259a3500ea3049cde0e60c9b49f2248c76cb2d75bb2f0fed652b6e347366bfed5757af2c100f1bf066c95a492c2ee3a468cac4d1497acf93752170a4fb0e46705a43895ee8d95e1b2902f1440e767c76b7a9790fed0cd4a1d9d4425afec459581b8597bb46518d96aa12fa6b7966b08c4fb72f95bf87a7281e93fea6624e7f20f2e35a0ebcfe2e973e4d54aad7dae0bbb8312ebc6d5685dc335d7d5ed1fec24fd084aaccad8f7f4bed6b0383d12789f6e4f548a0b40d0c7ae7a031efa3e9e37622e6cc1ee25a6276d4406fd4f6948b72f83063b2c62d10bea7d05fc12dd73a9f2ce08805c4a6fd8f7a5a7b8e602225fa04efbdbed4a31b75b3bb6d5caa84fb1bac6f0d50ea9ad6fad4fc99fd007df672d636eeb68536aea6a01b5f2f497beece012ace85a23f26d036f63a7db5ddf11d443da7f78199c9e0c8f143395e6fa3077f53d5e131b45c1d897c079891dcfc1d672de403b5f66d34f80e8fa8d55f2ef0c301eaa42d3285fc2c7efb306a43332fe25899b249f8195b1e885f234dc8ad35f3099e5139b1be6bfbc5d4b466435eb1a50e02a4c51a62fb5ff80f3cf35289c22c79b197d67573e3038fef9bf2ff503e2be3b30110588a451ee98919f1ae9f89736c513255947f18578fd999aa6e21e206160785f5fedcf7cf0aed56111e314337e0506ce8dfbbeeac8b12cd00aeb12a3c86808de94083c36f6744ae5fbf70d8373febedcf8141fee50ea469e2913610092ce43b4659062fc91f8cc69c71ba221b259c9880b2ae2ca4c276cacaa80affc9ca367deff027ed34a2b737831105c1ca723e85b44f5941c3efa3048af358a2859e5ccab5b65b92964e2777c0a57711b79c3ede340fb45e2af4a9d99af9eb95cbe08795d33d1ffb279aa37ea72a308a778174a9b165e8702468d17b52317d1600b", 0x4fa}], 0x1, &(0x7f0000f89000-0x80)=[]}, 0x0) sendto$inet(r1, &(0x7f00007e2000)="90", 0x1, 0x1, &(0x7f0000eba000-0x10)={0x2, 0xffffffffffffffff, @empty}, 0x10) 2018/02/01 16:22:56 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = gettid() rt_sigtimedwait(&(0x7f0000645000-0x8), &(0x7f0000ded000), &(0x7f000052f000)={0x40000077359400}, 0x8) pipe(&(0x7f0000d8c000-0x8)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000e13000-0x8)={0xffffffffffffffff, 0xffffffffffffffff}) tee(r1, r3, 0x80007387, 0x0) r4 = dup2(r2, r3) r5 = syz_open_dev$random(&(0x7f0000bdc000-0xc)='/dev/random\x00', 0x0, 0x0) dup2(0xffffffffffffffff, r5) ioctl$int_in(r4, 0x5452, &(0x7f0000e36000-0x8)=0x45) fcntl$setown(r2, 0x8, r0) fcntl$setsig(r5, 0xa, 0x12) r6 = gettid() tkill(r6, 0x100000000000016) 2018/02/01 16:22:56 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000aaa000)={0x2, 0x78, 0x47, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket(0x11, 0x2, 0x0) setsockopt(r0, 0x107, 0x1, &(0x7f0000dfb000-0x10)="010000000300060000071a00009139cc", 0x10) close(r0) 2018/02/01 16:22:56 executing program 2: mmap(&(0x7f0000000000/0x12000)=nil, 0x12000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket(0x18, 0x0, 0x1) sendmmsg(0xffffffffffffffff, &(0x7f0000005000-0x3c)=[{{&(0x7f0000003000)=@in6={0xa, 0xffffffffffffffff, 0x0, @remote={0xfe, 0x80, [], 0xffffffffffffffff, 0xbb}}, 0x1c, &(0x7f0000005000-0x60)=[{&(0x7f0000002000)="4c5614c00401a0dbf8a669ebdedd102c4f7a79e606457dfdf09e2ec2ed253b", 0x1f}], 0x1, &(0x7f0000003000-0x2d0)=[]}}], 0x1, 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000002000)={0x0, 0x0, 0x0, 0x0, 0x1, [{0xf03f}]}) r1 = socket(0x18, 0x0, 0x1) connect(r1, &(0x7f0000002000)=@sco={0x1f, {0x1}}, 0x26) ioctl$PPPIOCGMRU(r0, 0x80047453, &(0x7f000000c000)) 2018/02/01 16:22:56 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f0000576000-0x10)={&(0x7f0000334000-0x78)={0x2, 0x3, 0x0, 0x9, 0xa, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, [@sadb_address={0x3, 0x40000000000006, 0x0, 0x0, 0x0, @in={0x2, 0xffffffffffffffff, @loopback=0x7f000001}}, @sadb_sa={0x2, 0x1, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x2, 0xfffffffb}, @sadb_address={0x3, 0x20000000000005, 0x0, 0x0, 0x0, @in={0x2, 0xffffffffffffffff, @broadcast=0xffffffff}}]}, 0x50}, 0x1}, 0x0) 2018/02/01 16:22:56 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x0, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000f57000-0x8)='keyring\x00', &(0x7f0000767000)={0x73, 0x79, 0x7a}, &(0x7f0000c66000-0x54), 0x0, 0x52e2f637490a4e7f) 2018/02/01 16:22:56 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mkdir(&(0x7f000082f000)='./control\x00', 0x0) r0 = open(&(0x7f0000a08000)='./control\x00', 0x0, 0x0) symlinkat(&(0x7f00007ae000-0x8)='./file0\x00', r0, &(0x7f0000a31000-0xa)='./control\x00') r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000e4c000)={0xaa}) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000044000-0x20)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r2 = creat(&(0x7f00000df000)='./file0\x00', 0x0) write$sndseq(r2, &(0x7f0000012000-0x2e)=[{0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @time=@time={0x77359400}}], 0x30) link(&(0x7f0000b40000-0xa)='./file0\x00', &(0x7f00006b4000-0x10)='./control/file0\x00') utimensat(r0, &(0x7f0000e03000-0x10)='./control/file0\x00', &(0x7f00003e7000-0x10)={{}, {0x0, 0x2710}}, 0x0) [ 221.827880] device lo entered promiscuous mode 2018/02/01 16:22:56 executing program 2: mmap(&(0x7f0000000000/0x12000)=nil, 0x12000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket(0x18, 0x0, 0x1) sendmmsg(0xffffffffffffffff, &(0x7f0000005000-0x3c)=[{{&(0x7f0000003000)=@in6={0xa, 0xffffffffffffffff, 0x0, @remote={0xfe, 0x80, [], 0xffffffffffffffff, 0xbb}}, 0x1c, &(0x7f0000005000-0x60)=[{&(0x7f0000002000)="4c5614c00401a0dbf8a669ebdedd102c4f7a79e606457dfdf09e2ec2ed253b", 0x1f}], 0x1, &(0x7f0000003000-0x2d0)=[]}}], 0x1, 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000002000)={0x0, 0x0, 0x0, 0x0, 0x1, [{0xf03f}]}) dup2(0xffffffffffffffff, r0) connect(0xffffffffffffffff, &(0x7f0000002000)=@sco={0x1f, {0x1}}, 0x26) ioctl$PPPIOCGMRU(r0, 0x80047453, &(0x7f000000c000)) 2018/02/01 16:22:56 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f0000576000-0x10)={&(0x7f0000334000-0x78)={0x2, 0x3, 0x0, 0x9, 0xa, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, [@sadb_address={0x3, 0x40000000000006, 0x0, 0x0, 0x0, @in={0x2, 0xffffffffffffffff, @loopback=0x7f000001}}, @sadb_sa={0x2, 0x1, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x2, 0xfffffffb}, @sadb_address={0x3, 0x20000000000005, 0x0, 0x0, 0x0, @in={0x2, 0xffffffffffffffff, @broadcast=0xffffffff}}]}, 0x50}, 0x1}, 0x0) 2018/02/01 16:22:56 executing program 3: mmap(&(0x7f0000000000/0x2a000)=nil, 0x2a000, 0x3, 0x32, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x2, 0x78}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000001000-0xa)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x80045430, &(0x7f00003ba000-0x24)) 2018/02/01 16:22:56 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mkdir(&(0x7f000082f000)='./control\x00', 0x0) r0 = open(&(0x7f0000a08000)='./control\x00', 0x0, 0x0) symlinkat(&(0x7f00007ae000-0x8)='./file0\x00', r0, &(0x7f0000a31000-0xa)='./control\x00') r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000e4c000)={0xaa}) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000044000-0x20)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r2 = creat(&(0x7f00000df000)='./file0\x00', 0x0) write$sndseq(r2, &(0x7f0000012000-0x2e)=[{0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @time=@time={0x77359400}}], 0x30) link(&(0x7f0000b40000-0xa)='./file0\x00', &(0x7f00006b4000-0x10)='./control/file0\x00') utimensat(r0, &(0x7f0000e03000-0x10)='./control/file0\x00', &(0x7f00003e7000-0x10)={{}, {0x0, 0x2710}}, 0x0) [ 221.862350] device lo left promiscuous mode 2018/02/01 16:22:56 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x0, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000f57000-0x8)='keyring\x00', &(0x7f0000767000)={0x73, 0x79, 0x7a}, &(0x7f0000c66000-0x54), 0x0, 0x52e2f637490a4e7f) 2018/02/01 16:22:56 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = gettid() rt_sigtimedwait(&(0x7f0000645000-0x8), &(0x7f0000ded000), &(0x7f000052f000)={0x40000077359400}, 0x8) pipe(&(0x7f0000d8c000-0x8)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000e13000-0x8)={0xffffffffffffffff, 0xffffffffffffffff}) tee(r1, r3, 0x80007387, 0x0) r4 = dup2(r2, r3) r5 = syz_open_dev$random(&(0x7f0000bdc000-0xc)='/dev/random\x00', 0x0, 0x0) dup2(0xffffffffffffffff, r5) ioctl$int_in(r4, 0x5452, &(0x7f0000e36000-0x8)=0x45) fcntl$setown(r2, 0x8, r0) fcntl$setsig(r5, 0xa, 0x12) r6 = gettid() tkill(r6, 0x100000000000016) 2018/02/01 16:22:56 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000fd6000-0x8)='./file0\x00', 0x0) mount(&(0x7f000000a000)='./file0\x00', &(0x7f0000027000-0x8)='./file0\x00', &(0x7f000000c000)='ramfs\x00', 0x0, &(0x7f000000a000)) mount(&(0x7f0000037000)='./file0\x00', &(0x7f0000c50000-0x8)='./file0\x00', &(0x7f000002f000-0x6)='ramfs\x00', 0x100000, &(0x7f0000ce3000)) mount(&(0x7f000052f000)='./file0\x00', &(0x7f00008fd000-0x1)='.', &(0x7f00003a3000-0x6)="00e2660000", 0x1000, 0x0) mount(&(0x7f00002ba000-0x8)='./file0\x00', &(0x7f0000cbf000-0x8)='./file0\x00', &(0x7f0000dcd000)='ramfs\x00', 0x80000, &(0x7f000002f000)) mount(&(0x7f00009b1000)='./file0\x00', &(0x7f0000ae7000-0x8)='./file0\x00', &(0x7f0000226000)='an\x00\x00\x00\x00\x00\x00\x00\afs\x00', 0x100000, &(0x7f0000b64000-0x1000)) r0 = open(&(0x7f00006a2000)='./file0\x00', 0x0, 0x0) mkdirat(r0, &(0x7f0000034000-0x8)='./file0\x00', 0x0) mount(&(0x7f00001a5000-0xe)='./file0/file0\x00', &(0x7f00002fb000-0x8)='./file0/file0\x00', &(0x7f00002ba000)='\x00v\t', 0x1004, &(0x7f000073b000-0x1)) mount(&(0x7f00005e1000-0x8)='./file0\x00', &(0x7f0000df5000-0x8)='.', &(0x7f0000df4000)='%&t3\x00', 0x0, &(0x7f00003db000-0x23)) 2018/02/01 16:22:56 executing program 2: mmap(&(0x7f0000000000/0x12000)=nil, 0x12000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket(0x18, 0x0, 0x1) sendmmsg(0xffffffffffffffff, &(0x7f0000005000-0x3c)=[{{&(0x7f0000003000)=@in6={0xa, 0xffffffffffffffff, 0x0, @remote={0xfe, 0x80, [], 0xffffffffffffffff, 0xbb}}, 0x1c, &(0x7f0000005000-0x60)=[{&(0x7f0000002000)="4c5614c00401a0dbf8a669ebdedd102c4f7a79e606457dfdf09e2ec2ed253b", 0x1f}], 0x1, &(0x7f0000003000-0x2d0)=[]}}], 0x1, 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000002000)={0x0, 0x0, 0x0, 0x0, 0x1, [{0xf03f}]}) dup2(0xffffffffffffffff, r0) connect(0xffffffffffffffff, &(0x7f0000002000)=@sco={0x1f, {0x1}}, 0x26) ioctl$PPPIOCGMRU(r0, 0x80047453, &(0x7f000000c000)) 2018/02/01 16:22:56 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) connect$inet(r0, &(0x7f0000828000)={0x2, 0xffffffffffffffff, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}}, 0x10) 2018/02/01 16:22:56 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000aaa000)={0x2, 0x78, 0x47, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r1, 0x29, 0x20, &(0x7f000097e000)={@loopback={0x0, 0x1}, 0x400, 0x0, 0x2, 0x1}, 0x20) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000e00000-0x20)={@loopback={0x0, 0x1}, 0x400, 0x0, 0x840200000000101}, 0x20) 2018/02/01 16:22:56 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(0xffffffffffffffff, &(0x7f0000f56000)={0x0, 0x0, &(0x7f0000576000-0x10)={&(0x7f0000334000-0x78)={0x2, 0x3, 0x0, 0x9, 0xa, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, [@sadb_address={0x3, 0x40000000000006, 0x0, 0x0, 0x0, @in={0x2, 0xffffffffffffffff, @loopback=0x7f000001}}, @sadb_sa={0x2, 0x1, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x2, 0xfffffffb}, @sadb_address={0x3, 0x20000000000005, 0x0, 0x0, 0x0, @in={0x2, 0xffffffffffffffff, @broadcast=0xffffffff}}]}, 0x50}, 0x1}, 0x0) 2018/02/01 16:22:56 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mkdir(&(0x7f000082f000)='./control\x00', 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) symlinkat(&(0x7f00007ae000-0x8)='./file0\x00', 0xffffffffffffffff, &(0x7f0000a31000-0xa)='./control\x00') r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000e4c000)={0xaa}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000044000-0x20)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r1 = creat(&(0x7f00000df000)='./file0\x00', 0x0) write$sndseq(r1, &(0x7f0000012000-0x2e)=[{0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @time=@time={0x77359400}}], 0x30) link(&(0x7f0000b40000-0xa)='./file0\x00', &(0x7f00006b4000-0x10)='./control/file0\x00') utimensat(0xffffffffffffffff, &(0x7f0000e03000-0x10)='./control/file0\x00', &(0x7f00003e7000-0x10)={{}, {0x0, 0x2710}}, 0x0) [ 221.891943] device lo entered promiscuous mode [ 221.896982] device lo left promiscuous mode 2018/02/01 16:22:56 executing program 4: mmap(&(0x7f0000000000/0x21000)=nil, 0x21000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) sendmsg(r0, &(0x7f000000b000)={&(0x7f000000c000-0x1c)=@in6={0xa, 0x0, 0x0, @empty}, 0x129, &(0x7f0000010000)=[], 0x0, &(0x7f000000d000)=[]}, 0x0) 2018/02/01 16:22:56 executing program 2: mmap(&(0x7f0000000000/0x12000)=nil, 0x12000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket(0x18, 0x0, 0x1) sendmmsg(0xffffffffffffffff, &(0x7f0000005000-0x3c)=[{{&(0x7f0000003000)=@in6={0xa, 0xffffffffffffffff, 0x0, @remote={0xfe, 0x80, [], 0xffffffffffffffff, 0xbb}}, 0x1c, &(0x7f0000005000-0x60)=[{&(0x7f0000002000)="4c5614c00401a0dbf8a669ebdedd102c4f7a79e606457dfdf09e2ec2ed253b", 0x1f}], 0x1, &(0x7f0000003000-0x2d0)=[]}}], 0x1, 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000002000)={0x0, 0x0, 0x0, 0x0, 0x1, [{0xf03f}]}) dup2(0xffffffffffffffff, r0) connect(0xffffffffffffffff, &(0x7f0000002000)=@sco={0x1f, {0x1}}, 0x26) ioctl$PPPIOCGMRU(r0, 0x80047453, &(0x7f000000c000)) 2018/02/01 16:22:56 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000f56000)={0x0, 0x0, &(0x7f0000576000-0x10)={&(0x7f0000334000-0x78)={0x2, 0x0, 0x0, 0x9, 0xa, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, [@sadb_address={0x3, 0x40000000000006, 0x0, 0x0, 0x0, @in={0x2, 0xffffffffffffffff, @loopback=0x7f000001}}, @sadb_sa={0x2, 0x1, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x2, 0xfffffffb}, @sadb_address={0x3, 0x20000000000005, 0x0, 0x0, 0x0, @in={0x2, 0xffffffffffffffff, @broadcast=0xffffffff}}]}, 0x50}, 0x1}, 0x0) 2018/02/01 16:22:56 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000045000-0x8)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000a36000-0x8)=@abs, 0x41) sendmmsg$unix(r1, &(0x7f00000bd000)=[], 0x80, 0x0) perf_event_open(&(0x7f0000740000)={0x2, 0x78, 0x47, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) poll(&(0x7f0000085000-0x10)=[{r1, 0xc1a6}], 0x1, 0x0) dup2(r1, r0) 2018/02/01 16:22:56 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = syz_open_dev$tun(&(0x7f0000c7f000-0xd)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00006b0000-0x28)={@common='gre0\x00', @ifru_map={0x2}}) ioctl$sock_inet_SIOCSIFADDR(r0, 0x8916, &(0x7f0000769000-0x20)={@common='gre0\x00', @ifru_addrs={0x2, 0xffffffffffffffff, @local={0xac, 0x14, 0x0, 0xaa}}}) connect$inet(r0, &(0x7f0000561000)={0x2, 0xffffffffffffffff, @local={0xac, 0x14, 0x0, 0xaa}}, 0x10) sendto$inet(r0, &(0x7f0000d05000)="e6699acdf73cc6394c13b7e31a47ac40a0783296ed71d87293c899deda9c77757a22d53bff3d831c5d915d6dff00a89d2c2ad0630b6f2a7180fb3a983533b6e5354d29890cc73f10cae2445e78d8a548ceccb7f2a63eb69180a84d0e257995f45a51e8a6dd16e8567e271ddf7807d7aaa25217de818bb34bf18055bbff922c4a7ccaef3562e386ec6696c18c315c62237d88cc4764f238f1da324da2cdee002b112c9805b31857d96ad880791c37d9d4fa7b9d813f2ff7cbb9d94a27d624d122ffc5c072c8ef9e8d1215da7e02f041c48598032df86e51f2ad58b8e9060372a3a951994eb48fe3e644f9b8e14dfe56d139b7aeb5e3962fe248b491b7a157159151114a1c08dba40c4c33f117201ac42c6a610c17e8e726256475735c017ba7140d738d948e5a45d0288b2c31e89f68b4a4947aaa4529ba51ef84d175b7e65728f5db2d3e3e4aa8be31b0fe0be74856c3d81ae2bb7a5c54c3e650781a47b45f014b9c46b00f1626ad4bcbada8292375dfe5c282e11746fdb6aaf1d2c3316413ea2339826b642345cfe7424c8975b10113426fa47bb80e0d9c659ab14f22fec6eb9dff288bf2c68c6f90e5a3b3ebe946d919f64048836622a4a5e462499a52db97e16b7cb91765c519a38228832b231906c34f5131b1f007a15f0e167703991abcf81226ba6debeafe61e3ac5c0f1fba9c507d50f012bff1d31a2133be91d7b05993e0d90fed6a8cd42d15517567e5900590d238de175f205212b07273d74bce198940893039e05dbfd9c0eab55023e9dde05ba8cdbea78ce8bfb542d74b45f7217b6a7143cd44adb2131ca214c46faec631e1e51369328c7e999cfe04001e6e3d2c72e7d9f84195a1d69e339362f3f4007a7d323322e888b975e4aa8745a198ef02bbfe811f9a625b48075ed2c4d9014015f49c8eda8f95c5ca22da82bd2c9636606bf8b142f81fd87eaaf92a27c84794b855f2cfcaa8570d18dde2c92d81dda02b029c1d5f6cbca0cbc2c3db5071fc7ee9f849fd44cab1b69af93d2816576e96d1b385b31437dd6d38219b48d365bc9844c5598aada5dcc431ae85794a104bccc8e88203096a985bab9b9b50f56aabaad43161183fe53645ad773c2899380790ca504400cdb5ec3267ec2f7463191053b28d6d819f8bd20a1891a9f1b9c3c6922f7aa95c5da18dd1e178978fd5a11630d9292054dafd26f566a4d4436cd90000d87bfdedee0d3ed9b18ab31e1ec44ad99f398ad0c11fddfa164afb350e090801740812c08e67b8b144a2169327ad553d837d6544abd9ec52df197d15b81c01f71b4232dad8834dc676c92ec2cb14ef6e504227730d96bb0528f7c540de87ca9230fe0602e5f056a3d9c5860beca261c363ade3b4645c2366929e86f440635b20b76c64ae21899a98f9e783b3d9176bb005752e3ec222d44208e970bd479a515a986d514b5039156da9d562716291ea64c20931066a2cfd3e3f0ee435a2d1028d1551ea797d05fedac7d6fb674bb23fcae01b81f6f1d5574c417d64320e7ed50965d848da6c898a33eec4eeb91174000000000000000975a8f21537286685faaa10b2390dbf66d2530ab81a3b28fdde91d2105a154d0f5f518a23fd8b6aedddd4192969c4b01edfb7ba01004c58f7e7e85c1cd6d0671a4f7866867961d91ecfd0a7f5c03388588bff6f822e418467e333d800559b0d6501e66274cd2ee039521ce1381c1fb5a33792a45c8b2734d2884410623228ea6ea9cc88834dcbad8491647f612f024ec7b76c6ef0704bce42a4711453fb3eb64f65bbd46a40df6f4dcb1cfe277036e1fa53ed011398858e2e0aaf8b3d1bf4a8462d4a8c9e8ff3403215665f26907326cdda0003ea35a69f4feb865f4f2f442ebc99d305fe11bfba48107d65cf962ece438f6ddcc63898ca171acebf62f580494dbbe2733d39ca5c4128ff92837327b4aa20438d652c931230cfdc72ca79f3f6ac7fcb46e0b3732f8ea8e1171127ca3942c63eb99861a57a408f6287aa084f8329f74963f2ba0f1f8a166206793372f5eb31f1fe164f02", 0x5ac, 0x8000, &(0x7f0000030000-0x10)={0x2, 0x0, @multicast1=0xe0000001}, 0x10) sendmmsg(r0, &(0x7f0000f4e000)=[{{&(0x7f0000cd8000-0x60)=@nfc_llcp={0x27, 0x0, 0x0, 0x0, 0x0, 0x0, "d526326c0b3b78b78a507be193da132ebe67f55c5b43b66cb15438108fbbf329a25e6b5bcca2b09c3a429d72be2de37fd9617ecb235b9472e3dda72c4186d8"}, 0x60, &(0x7f0000b32000-0x10)=[], 0x0, &(0x7f0000fdc000)=[]}}], 0x1, 0x0) 2018/02/01 16:22:56 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000fd6000-0x8)='./file0\x00', 0x0) mount(&(0x7f000000a000)='./file0\x00', &(0x7f0000027000-0x8)='./file0\x00', &(0x7f000000c000)='ramfs\x00', 0x0, &(0x7f000000a000)) mount(&(0x7f0000037000)='./file0\x00', &(0x7f0000c50000-0x8)='./file0\x00', &(0x7f000002f000-0x6)='ramfs\x00', 0x100000, &(0x7f0000ce3000)) mount(&(0x7f000052f000)='./file0\x00', &(0x7f00008fd000-0x1)='.', &(0x7f00003a3000-0x6)="00e2660000", 0x1000, 0x0) mount(&(0x7f00002ba000-0x8)='./file0\x00', &(0x7f0000cbf000-0x8)='./file0\x00', &(0x7f0000dcd000)='ramfs\x00', 0x80000, &(0x7f000002f000)) mount(&(0x7f00009b1000)='./file0\x00', &(0x7f0000ae7000-0x8)='./file0\x00', &(0x7f0000226000)='an\x00\x00\x00\x00\x00\x00\x00\afs\x00', 0x100000, &(0x7f0000b64000-0x1000)) r0 = open(&(0x7f00006a2000)='./file0\x00', 0x0, 0x0) mkdirat(r0, &(0x7f0000034000-0x8)='./file0\x00', 0x0) mount(&(0x7f00001a5000-0xe)='./file0/file0\x00', &(0x7f00002fb000-0x8)='./file0/file0\x00', &(0x7f00002ba000)='\x00v\t', 0x1004, &(0x7f000073b000-0x1)) mount(&(0x7f00005e1000-0x8)='./file0\x00', &(0x7f0000df5000-0x8)='.', &(0x7f0000df4000)='%&t3\x00', 0x0, &(0x7f00003db000-0x23)) 2018/02/01 16:22:56 executing program 2: mmap(&(0x7f0000000000/0x12000)=nil, 0x12000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket(0x18, 0x0, 0x1) sendmmsg(0xffffffffffffffff, &(0x7f0000005000-0x3c)=[{{&(0x7f0000003000)=@in6={0xa, 0xffffffffffffffff, 0x0, @remote={0xfe, 0x80, [], 0xffffffffffffffff, 0xbb}}, 0x1c, &(0x7f0000005000-0x60)=[{&(0x7f0000002000)="4c5614c00401a0dbf8a669ebdedd102c4f7a79e606457dfdf09e2ec2ed253b", 0x1f}], 0x1, &(0x7f0000003000-0x2d0)=[]}}], 0x1, 0x0) r1 = socket(0x18, 0x0, 0x1) dup2(r1, r0) connect(r1, &(0x7f0000002000)=@sco={0x1f, {0x1}}, 0x26) ioctl$PPPIOCGMRU(r0, 0x80047453, &(0x7f000000c000)) 2018/02/01 16:22:56 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000f56000)={0x0, 0x0, &(0x7f0000576000-0x10)={&(0x7f0000334000-0x78)={0x2, 0x0, 0x0, 0x9, 0xa, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, [@sadb_address={0x3, 0x40000000000006, 0x0, 0x0, 0x0, @in={0x2, 0xffffffffffffffff, @loopback=0x7f000001}}, @sadb_sa={0x2, 0x1, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x2, 0xfffffffb}, @sadb_address={0x3, 0x20000000000005, 0x0, 0x0, 0x0, @in={0x2, 0xffffffffffffffff, @broadcast=0xffffffff}}]}, 0x50}, 0x1}, 0x0) 2018/02/01 16:22:56 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mkdir(&(0x7f000082f000)='./control\x00', 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) symlinkat(&(0x7f00007ae000-0x8)='./file0\x00', 0xffffffffffffffff, &(0x7f0000a31000-0xa)='./control\x00') r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000e4c000)={0xaa}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000044000-0x20)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r1 = creat(&(0x7f00000df000)='./file0\x00', 0x0) write$sndseq(r1, &(0x7f0000012000-0x2e)=[{0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @time=@time={0x77359400}}], 0x30) link(&(0x7f0000b40000-0xa)='./file0\x00', &(0x7f00006b4000-0x10)='./control/file0\x00') utimensat(0xffffffffffffffff, &(0x7f0000e03000-0x10)='./control/file0\x00', &(0x7f00003e7000-0x10)={{}, {0x0, 0x2710}}, 0x0) 2018/02/01 16:22:56 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = gettid() rt_sigtimedwait(&(0x7f0000645000-0x8), &(0x7f0000ded000), &(0x7f000052f000)={0x40000077359400}, 0x8) pipe(&(0x7f0000d8c000-0x8)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000e13000-0x8)={0xffffffffffffffff, 0xffffffffffffffff}) tee(r1, r3, 0x80007387, 0x0) r4 = dup2(r2, r3) r5 = syz_open_dev$random(&(0x7f0000bdc000-0xc)='/dev/random\x00', 0x0, 0x0) dup2(r2, 0xffffffffffffffff) ioctl$int_in(r4, 0x5452, &(0x7f0000e36000-0x8)=0x45) fcntl$setown(r2, 0x8, r0) fcntl$setsig(r5, 0xa, 0x12) r6 = gettid() tkill(r6, 0x100000000000016) 2018/02/01 16:22:56 executing program 2: mmap(&(0x7f0000000000/0x12000)=nil, 0x12000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket(0x18, 0x0, 0x1) sendmmsg(0xffffffffffffffff, &(0x7f0000005000-0x3c)=[{{&(0x7f0000003000)=@in6={0xa, 0xffffffffffffffff, 0x0, @remote={0xfe, 0x80, [], 0xffffffffffffffff, 0xbb}}, 0x1c, &(0x7f0000005000-0x60)=[{&(0x7f0000002000)="4c5614c00401a0dbf8a669ebdedd102c4f7a79e606457dfdf09e2ec2ed253b", 0x1f}], 0x1, &(0x7f0000003000-0x2d0)=[]}}], 0x1, 0x0) r1 = socket(0x18, 0x0, 0x1) dup2(r1, r0) connect(r1, &(0x7f0000002000)=@sco={0x1f, {0x1}}, 0x26) ioctl$PPPIOCGMRU(r0, 0x80047453, &(0x7f000000c000)) 2018/02/01 16:22:56 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) msgrcv(0x0, &(0x7f0000497000-0x8), 0x8, 0x0, 0x3000) msgsnd(0x0, &(0x7f000010d000)={0x3}, 0x8, 0x0) 2018/02/01 16:22:56 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = syz_open_dev$tun(&(0x7f0000c7f000-0xd)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00006b0000-0x28)={@common='gre0\x00', @ifru_addrs=@ethernet={0x306, @random="3e7596f732f4"}}) ioctl$sock_inet_SIOCSIFADDR(r0, 0x8916, &(0x7f0000769000-0x20)={@common='gre0\x00', @ifru_addrs={0x2, 0xffffffffffffffff, @local={0xac, 0x14, 0xffffffffffffffff, 0xaa}}}) close(r1) 2018/02/01 16:22:56 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = open(&(0x7f000000d000-0x8)='./file0\x00', 0x80040, 0x0) fcntl$setlease(r0, 0x400, 0x0) prctl$seccomp(0x16, 0x1, &(0x7f0000d3d000-0x8)={0x0, &(0x7f0000549000-0x50)=[]}) rt_sigtimedwait(&(0x7f00005a1000), &(0x7f0000dd8000-0x10), &(0x7f000003a000-0x10)={0x0, 0x8000000}, 0x8) fcntl$setlease(r0, 0x400, 0x2) 2018/02/01 16:22:56 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000fd6000-0x8)='./file0\x00', 0x0) mount(&(0x7f000000a000)='./file0\x00', &(0x7f0000027000-0x8)='./file0\x00', &(0x7f000000c000)='ramfs\x00', 0x0, &(0x7f000000a000)) mount(&(0x7f0000037000)='./file0\x00', &(0x7f0000c50000-0x8)='./file0\x00', &(0x7f000002f000-0x6)='ramfs\x00', 0x100000, &(0x7f0000ce3000)) mount(&(0x7f000052f000)='./file0\x00', &(0x7f00008fd000-0x1)='.', &(0x7f00003a3000-0x6)="00e2660000", 0x1000, 0x0) mount(&(0x7f00002ba000-0x8)='./file0\x00', &(0x7f0000cbf000-0x8)='./file0\x00', &(0x7f0000dcd000)='ramfs\x00', 0x80000, &(0x7f000002f000)) mount(&(0x7f00009b1000)='./file0\x00', &(0x7f0000ae7000-0x8)='./file0\x00', &(0x7f0000226000)='an\x00\x00\x00\x00\x00\x00\x00\afs\x00', 0x100000, &(0x7f0000b64000-0x1000)) r0 = open(&(0x7f00006a2000)='./file0\x00', 0x0, 0x0) mkdirat(r0, &(0x7f0000034000-0x8)='./file0\x00', 0x0) mount(&(0x7f00001a5000-0xe)='./file0/file0\x00', &(0x7f00002fb000-0x8)='./file0/file0\x00', &(0x7f00002ba000)='\x00v\t', 0x1004, &(0x7f000073b000-0x1)) mount(&(0x7f00005e1000-0x8)='./file0\x00', &(0x7f0000df5000-0x8)='.', &(0x7f0000df4000)='%&t3\x00', 0x0, &(0x7f00003db000-0x23)) 2018/02/01 16:22:56 executing program 2: mmap(&(0x7f0000000000/0x12000)=nil, 0x12000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket(0x18, 0x0, 0x1) sendmmsg(0xffffffffffffffff, &(0x7f0000005000-0x3c)=[{{&(0x7f0000003000)=@in6={0xa, 0xffffffffffffffff, 0x0, @remote={0xfe, 0x80, [], 0xffffffffffffffff, 0xbb}}, 0x1c, &(0x7f0000005000-0x60)=[{&(0x7f0000002000)="4c5614c00401a0dbf8a669ebdedd102c4f7a79e606457dfdf09e2ec2ed253b", 0x1f}], 0x1, &(0x7f0000003000-0x2d0)=[]}}], 0x1, 0x0) r1 = socket(0x18, 0x0, 0x1) dup2(r1, r0) connect(r1, &(0x7f0000002000)=@sco={0x1f, {0x1}}, 0x26) ioctl$PPPIOCGMRU(r0, 0x80047453, &(0x7f000000c000)) 2018/02/01 16:22:56 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000f56000)={0x0, 0x0, &(0x7f0000576000-0x10)={&(0x7f0000334000-0x78)={0x2, 0x0, 0x0, 0x9, 0xa, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, [@sadb_address={0x3, 0x40000000000006, 0x0, 0x0, 0x0, @in={0x2, 0xffffffffffffffff, @loopback=0x7f000001}}, @sadb_sa={0x2, 0x1, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x2, 0xfffffffb}, @sadb_address={0x3, 0x20000000000005, 0x0, 0x0, 0x0, @in={0x2, 0xffffffffffffffff, @broadcast=0xffffffff}}]}, 0x50}, 0x1}, 0x0) 2018/02/01 16:22:56 executing program 2: mmap(&(0x7f0000000000/0x12000)=nil, 0x12000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket(0x18, 0x0, 0x1) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000002000)={0x0, 0x0, 0x0, 0x0, 0x1, [{0xf03f}]}) r1 = socket(0x18, 0x0, 0x1) dup2(r1, r0) connect(r1, &(0x7f0000002000)=@sco={0x1f, {0x1}}, 0x26) ioctl$PPPIOCGMRU(r0, 0x80047453, &(0x7f000000c000)) [ 222.098763] audit: type=1326 audit(1517502176.389:144): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 pid=31116 comm="syz-executor4" exe="/root/syz-executor4" sig=9 arch=c000003e syscall=202 compat=0 ip=0x453299 code=0x0 2018/02/01 16:22:56 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000f56000)={0x0, 0x0, &(0x7f0000576000-0x10)={&(0x7f0000334000-0x78)={0x2, 0x3, 0x0, 0x0, 0xa, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, [@sadb_address={0x3, 0x40000000000006, 0x0, 0x0, 0x0, @in={0x2, 0xffffffffffffffff, @loopback=0x7f000001}}, @sadb_sa={0x2, 0x1, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x2, 0xfffffffb}, @sadb_address={0x3, 0x20000000000005, 0x0, 0x0, 0x0, @in={0x2, 0xffffffffffffffff, @broadcast=0xffffffff}}]}, 0x50}, 0x1}, 0x0) 2018/02/01 16:22:56 executing program 3: mmap(&(0x7f0000000000/0xae4000)=nil, 0xae4000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x2000000000000022, &(0x7f0000356000)=0x1, 0x4) sendto$inet6(r0, &(0x7f0000ae4000-0x47)="f6", 0x1, 0x200408d5, &(0x7f0000341000-0x1c)={0xa, 0xffffffffffffffff, 0x0, @loopback={0x0, 0x1}, 0x80000}, 0x1c) 2018/02/01 16:22:56 executing program 2: mmap(&(0x7f0000000000/0x12000)=nil, 0x12000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket(0x18, 0x0, 0x1) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000002000)={0x0, 0x0, 0x0, 0x0, 0x1, [{0xf03f}]}) r1 = socket(0x18, 0x0, 0x1) dup2(r1, r0) connect(r1, &(0x7f0000002000)=@sco={0x1f, {0x1}}, 0x26) ioctl$PPPIOCGMRU(r0, 0x80047453, &(0x7f000000c000)) 2018/02/01 16:22:56 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) msgrcv(0x0, &(0x7f0000497000-0x8), 0x8, 0x0, 0x3000) msgsnd(0x0, &(0x7f000010d000)={0x3}, 0x8, 0x0) 2018/02/01 16:22:56 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mkdir(&(0x7f000082f000)='./control\x00', 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) symlinkat(&(0x7f00007ae000-0x8)='./file0\x00', 0xffffffffffffffff, &(0x7f0000a31000-0xa)='./control\x00') r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000e4c000)={0xaa}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000044000-0x20)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r1 = creat(&(0x7f00000df000)='./file0\x00', 0x0) write$sndseq(r1, &(0x7f0000012000-0x2e)=[{0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @time=@time={0x77359400}}], 0x30) link(&(0x7f0000b40000-0xa)='./file0\x00', &(0x7f00006b4000-0x10)='./control/file0\x00') utimensat(0xffffffffffffffff, &(0x7f0000e03000-0x10)='./control/file0\x00', &(0x7f00003e7000-0x10)={{}, {0x0, 0x2710}}, 0x0) 2018/02/01 16:22:56 executing program 2: mmap(&(0x7f0000000000/0x12000)=nil, 0x12000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket(0x18, 0x0, 0x1) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000002000)={0x0, 0x0, 0x0, 0x0, 0x1, [{0xf03f}]}) r1 = socket(0x18, 0x0, 0x1) dup2(r1, r0) connect(r1, &(0x7f0000002000)=@sco={0x1f, {0x1}}, 0x26) ioctl$PPPIOCGMRU(r0, 0x80047453, &(0x7f000000c000)) 2018/02/01 16:22:56 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000b6e000-0x38)={0x0, 0x0, &(0x7f00008ff000-0x10)={&(0x7f0000328000-0x98)={0x2, 0x400000000000003, 0x0, 0x0, 0x13, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, [@sadb_address={0x5, 0x6, 0x0, 0x0, 0x0, @in6={0xa, 0xffffffffffffffff, 0x0, @ipv4={[], [0xff, 0xff], @rand_addr}}}, @sadb_address={0x5, 0x9, 0x0, 0x0, 0x0, @in6={0xa, 0xffffffffffffffff, 0x0, @remote={0xfe, 0x80, [], 0xffffffffffffffff, 0xbb}}}, @sadb_sa={0x2, 0x1, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0xb}, @sadb_address={0x5, 0x5, 0x0, 0x0, 0x0, @in6={0xa, 0xffffffffffffffff, 0x0, @mcast2={0xff, 0x2, [], 0x1}}}]}, 0x98}, 0x1}, 0x0) [ 222.183406] audit: type=1326 audit(1517502176.474:145): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 pid=31116 comm="syz-executor4" exe="/root/syz-executor4" sig=9 arch=c000003e syscall=202 compat=0 ip=0x453299 code=0x0 [ 222.926419] IPVS: ftp: loaded support on port[0] = 21 [ 223.184060] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready 2018/02/01 16:22:57 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000f56000)={0x0, 0x0, &(0x7f0000576000-0x10)={&(0x7f0000334000-0x78)={0x2, 0x3, 0x0, 0x0, 0xa, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, [@sadb_address={0x3, 0x40000000000006, 0x0, 0x0, 0x0, @in={0x2, 0xffffffffffffffff, @loopback=0x7f000001}}, @sadb_sa={0x2, 0x1, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x2, 0xfffffffb}, @sadb_address={0x3, 0x20000000000005, 0x0, 0x0, 0x0, @in={0x2, 0xffffffffffffffff, @broadcast=0xffffffff}}]}, 0x50}, 0x1}, 0x0) 2018/02/01 16:22:57 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = gettid() rt_sigtimedwait(&(0x7f0000645000-0x8), &(0x7f0000ded000), &(0x7f000052f000)={0x40000077359400}, 0x8) pipe(&(0x7f0000d8c000-0x8)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000e13000-0x8)={0xffffffffffffffff, 0xffffffffffffffff}) tee(r1, r3, 0x80007387, 0x0) r4 = dup2(r2, r3) r5 = syz_open_dev$random(&(0x7f0000bdc000-0xc)='/dev/random\x00', 0x0, 0x0) dup2(r2, 0xffffffffffffffff) ioctl$int_in(r4, 0x5452, &(0x7f0000e36000-0x8)=0x45) fcntl$setown(r2, 0x8, r0) fcntl$setsig(r5, 0xa, 0x12) r6 = gettid() tkill(r6, 0x100000000000016) 2018/02/01 16:22:57 executing program 2: mmap(&(0x7f0000000000/0x12000)=nil, 0x12000, 0x3, 0x32, 0xffffffffffffffff, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000005000-0x3c)=[{{&(0x7f0000003000)=@in6={0xa, 0xffffffffffffffff, 0x0, @remote={0xfe, 0x80, [], 0xffffffffffffffff, 0xbb}}, 0x1c, &(0x7f0000005000-0x60)=[{&(0x7f0000002000)="4c5614c00401a0dbf8a669ebdedd102c4f7a79e606457dfdf09e2ec2ed253b", 0x1f}], 0x1, &(0x7f0000003000-0x2d0)=[]}}], 0x1, 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000002000)={0x0, 0x0, 0x0, 0x0, 0x1, [{0xf03f}]}) r0 = socket(0x18, 0x0, 0x1) dup2(r0, 0xffffffffffffffff) connect(r0, &(0x7f0000002000)=@sco={0x1f, {0x1}}, 0x26) ioctl$PPPIOCGMRU(0xffffffffffffffff, 0x80047453, &(0x7f000000c000)) 2018/02/01 16:22:57 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x1, 0x0) r1 = dup(r0) bind$inet(r0, &(0x7f00000f1000-0x10)={0x2, 0x3, @multicast2=0xe0000002}, 0x10) connect$inet(r0, &(0x7f0000987000)={0x2, 0x3, @empty}, 0x10) sendmsg(0xffffffffffffffff, &(0x7f0000247000)={&(0x7f000058d000-0x3a)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0xffffffffffffffff, 0x0, @local={0xfe, 0x80, [], 0xffffffffffffffff, 0xaa}}}}, 0x3a, &(0x7f0000a58000-0x20)=[], 0x0, &(0x7f0000f89000-0x80)=[]}, 0x0) readv(r1, &(0x7f0000aae000)=[{&(0x7f0000b8c000-0xb1)=""/177, 0xb1}], 0x1) readv(r0, &(0x7f0000db1000-0x30)=[{&(0x7f00008e1000-0x1000)=""/4096, 0x1000}], 0x1) shutdown(r1, 0x1) 2018/02/01 16:22:57 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = open(&(0x7f0000a08000)='./control\x00', 0x0, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) symlinkat(&(0x7f00007ae000-0x8)='./file0\x00', r0, &(0x7f0000a31000-0xa)='./control\x00') r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000e4c000)={0xaa}) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000044000-0x20)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r2 = creat(&(0x7f00000df000)='./file0\x00', 0x0) write$sndseq(r2, &(0x7f0000012000-0x2e)=[{0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @time=@time={0x77359400}}], 0x30) link(&(0x7f0000b40000-0xa)='./file0\x00', &(0x7f00006b4000-0x10)='./control/file0\x00') utimensat(r0, &(0x7f0000e03000-0x10)='./control/file0\x00', &(0x7f00003e7000-0x10)={{}, {0x0, 0x2710}}, 0x0) 2018/02/01 16:22:57 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) msgrcv(0x0, &(0x7f0000497000-0x8), 0x8, 0x0, 0x3000) msgsnd(0x0, &(0x7f000010d000)={0x3}, 0x8, 0x0) 2018/02/01 16:22:57 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000b6e000-0x38)={0x0, 0x0, &(0x7f00008ff000-0x10)={&(0x7f0000328000-0x98)={0x2, 0x400000000000003, 0x0, 0x0, 0x13, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, [@sadb_address={0x5, 0x6, 0x0, 0x0, 0x0, @in6={0xa, 0xffffffffffffffff, 0x0, @ipv4={[], [0xff, 0xff], @rand_addr}}}, @sadb_address={0x5, 0x9, 0x0, 0x0, 0x0, @in6={0xa, 0xffffffffffffffff, 0x0, @remote={0xfe, 0x80, [], 0xffffffffffffffff, 0xbb}}}, @sadb_sa={0x2, 0x1, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0xb}, @sadb_address={0x5, 0x5, 0x0, 0x0, 0x0, @in6={0xa, 0xffffffffffffffff, 0x0, @mcast2={0xff, 0x2, [], 0x1}}}]}, 0x98}, 0x1}, 0x0) 2018/02/01 16:22:57 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) msgsnd(0x0, &(0x7f0000293000-0x8), 0x8, 0x0) msgrcv(0x0, &(0x7f0000f2c000-0x8), 0x211, 0x0, 0xf3fe46df64025912) 2018/02/01 16:22:57 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000f56000)={0x0, 0x0, &(0x7f0000576000-0x10)={&(0x7f0000334000-0x78)={0x2, 0x3, 0x0, 0x0, 0xa, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, [@sadb_address={0x3, 0x40000000000006, 0x0, 0x0, 0x0, @in={0x2, 0xffffffffffffffff, @loopback=0x7f000001}}, @sadb_sa={0x2, 0x1, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x2, 0xfffffffb}, @sadb_address={0x3, 0x20000000000005, 0x0, 0x0, 0x0, @in={0x2, 0xffffffffffffffff, @broadcast=0xffffffff}}]}, 0x50}, 0x1}, 0x0) 2018/02/01 16:22:57 executing program 2: mmap(&(0x7f0000000000/0x12000)=nil, 0x12000, 0x3, 0x32, 0xffffffffffffffff, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000005000-0x3c)=[{{&(0x7f0000003000)=@in6={0xa, 0xffffffffffffffff, 0x0, @remote={0xfe, 0x80, [], 0xffffffffffffffff, 0xbb}}, 0x1c, &(0x7f0000005000-0x60)=[{&(0x7f0000002000)="4c5614c00401a0dbf8a669ebdedd102c4f7a79e606457dfdf09e2ec2ed253b", 0x1f}], 0x1, &(0x7f0000003000-0x2d0)=[]}}], 0x1, 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000002000)={0x0, 0x0, 0x0, 0x0, 0x1, [{0xf03f}]}) r0 = socket(0x18, 0x0, 0x1) dup2(r0, 0xffffffffffffffff) connect(r0, &(0x7f0000002000)=@sco={0x1f, {0x1}}, 0x26) ioctl$PPPIOCGMRU(0xffffffffffffffff, 0x80047453, &(0x7f000000c000)) 2018/02/01 16:22:57 executing program 1: r0 = socket$inet6(0xa, 0x802, 0x0) setsockopt$inet6_udp_int(r0, 0x11, 0x0, &(0x7f000073c000-0x4), 0x4) 2018/02/01 16:22:57 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) setsockopt$inet_tcp_int(r0, 0x6, 0x14, &(0x7f0000789000-0x4)=0x100000001, 0x4) bind$inet(r0, &(0x7f0000739000-0x10)={0x2, 0x1, @multicast1=0xe0000001}, 0x10) sendto$inet(r0, &(0x7f0000852000), 0x0, 0x20020003, &(0x7f0000386000-0x10)={0x2, 0x1, @loopback=0x7f000001}, 0x10) sendmsg(r0, &(0x7f0000ca7000)={&(0x7f000029d000)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local={[0xaa, 0xaa, 0xaa, 0xaa], 0xffffffffffffffff, 0xaa}}, 0x14, &(0x7f0000870000)=[{&(0x7f0000b83000-0x94)='A', 0x1}], 0x1, &(0x7f00001cd000)=[]}, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x14, &(0x7f0000f44000-0x4)=0xfffffffffffffffc, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000f8e000)={0x0, 0x20000000012c6, 0x1000010006}, 0x14) sendmmsg(r0, &(0x7f0000278000)=[{{&(0x7f00002b8000)=@ethernet={0x0, @remote={[0xaa, 0xaa, 0xaa, 0xaa], 0xffffffffffffffff, 0xbb}}, 0x10, &(0x7f0000283000-0x70)=[{&(0x7f0000e0c000)="7708688ada9810b08b393b4ee81f72e3fdc78286b874a2dfa0994387de7044caa827593abaeeb56cb854ddf964f1b3b9af8afaf5163a984f1cadf50810e8a9eb00249388d92a958e32e0ffca0a22483dd9758562ba702c8f440e309b9a819c518080c7909f6e5c76d9a654700c22ebbac1b42a323390d97b14ddbf609f64f1d9b0fc95ac2027e476846a11edfeda8f17bec634419c078e28bc1ee819204e0ad3d473ca09413ea6915f1626256216360f783ab1133f446eaf1f76831fb11caaefde82b03d9bbb06dc6c49d1eb923bb1fd0d951202979ac33fc47ba6d4dba4e394372e2ee8a4f5ed6a375174b6c56899a39937d7abb675af79ba55c58a44a283888c3f5b390c2c6d7492679f826b6c93f50c88ced248679752e74ce42350cc4c5b8a17339742992d6444922b9d4922a622aa98172098284c394e3503e268ed813f172df3f31eaee20f51d92e7ca846e21c11e7a1a6615597989457defd846cee70aefb10df6b906b676567e27cda272e35e91bbbb11b60ff3743b8684beef4978b0ea04c2de2bfd99b38832f8a843aea4579ffd819c3d19856fdcda7bb12c87fa1191523b72fd4143a2530135bd4b0aeda40b1116b37c3593930d313fb06869fbc8c66c78a0d7c1c591e8e7ec06e112fff9df7a5878cafab7594aaaaa6b6d452bb8729e0040af74708144e1009826c6a941907d6e03fa147ddc32ce9e337db56104d458fb4eda3ddb0dce11feead9855bc7899ed5c2fef34f9360a", 0x21a}], 0x1, &(0x7f0000943000-0x1e0)=[]}}], 0x1, 0x0) 2018/02/01 16:22:57 executing program 4: 2018/02/01 16:22:57 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = open(&(0x7f0000a08000)='./control\x00', 0x0, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) symlinkat(&(0x7f00007ae000-0x8)='./file0\x00', r0, &(0x7f0000a31000-0xa)='./control\x00') r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000e4c000)={0xaa}) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000044000-0x20)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r2 = creat(&(0x7f00000df000)='./file0\x00', 0x0) write$sndseq(r2, &(0x7f0000012000-0x2e)=[{0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @time=@time={0x77359400}}], 0x30) link(&(0x7f0000b40000-0xa)='./file0\x00', &(0x7f00006b4000-0x10)='./control/file0\x00') utimensat(r0, &(0x7f0000e03000-0x10)='./control/file0\x00', &(0x7f00003e7000-0x10)={{}, {0x0, 0x2710}}, 0x0) 2018/02/01 16:22:57 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) msgrcv(0x0, &(0x7f0000497000-0x8), 0x8, 0x0, 0x3000) msgsnd(0x0, &(0x7f000010d000)={0x3}, 0x8, 0x0) 2018/02/01 16:22:58 executing program 4: 2018/02/01 16:22:58 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000f56000)={0x0, 0x0, &(0x7f0000576000-0x10)={&(0x7f0000334000-0x78)={0x2, 0x3, 0x0, 0x9, 0x7, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, [@sadb_sa={0x2, 0x1, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x2, 0xfffffffb}, @sadb_address={0x3, 0x20000000000005, 0x0, 0x0, 0x0, @in={0x2, 0xffffffffffffffff, @broadcast=0xffffffff}}]}, 0x38}, 0x1}, 0x0) [ 224.497437] IPVS: ftp: loaded support on port[0] = 21 [ 224.752849] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready 2018/02/01 16:22:59 executing program 2: mmap(&(0x7f0000000000/0x12000)=nil, 0x12000, 0x3, 0x32, 0xffffffffffffffff, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000005000-0x3c)=[{{&(0x7f0000003000)=@in6={0xa, 0xffffffffffffffff, 0x0, @remote={0xfe, 0x80, [], 0xffffffffffffffff, 0xbb}}, 0x1c, &(0x7f0000005000-0x60)=[{&(0x7f0000002000)="4c5614c00401a0dbf8a669ebdedd102c4f7a79e606457dfdf09e2ec2ed253b", 0x1f}], 0x1, &(0x7f0000003000-0x2d0)=[]}}], 0x1, 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000002000)={0x0, 0x0, 0x0, 0x0, 0x1, [{0xf03f}]}) r0 = socket(0x18, 0x0, 0x1) dup2(r0, 0xffffffffffffffff) connect(r0, &(0x7f0000002000)=@sco={0x1f, {0x1}}, 0x26) ioctl$PPPIOCGMRU(0xffffffffffffffff, 0x80047453, &(0x7f000000c000)) 2018/02/01 16:22:59 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = gettid() rt_sigtimedwait(&(0x7f0000645000-0x8), &(0x7f0000ded000), &(0x7f000052f000)={0x40000077359400}, 0x8) pipe(&(0x7f0000d8c000-0x8)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000e13000-0x8)={0xffffffffffffffff, 0xffffffffffffffff}) tee(r1, r3, 0x80007387, 0x0) r4 = dup2(r2, r3) r5 = syz_open_dev$random(&(0x7f0000bdc000-0xc)='/dev/random\x00', 0x0, 0x0) dup2(r2, 0xffffffffffffffff) ioctl$int_in(r4, 0x5452, &(0x7f0000e36000-0x8)=0x45) fcntl$setown(r2, 0x8, r0) fcntl$setsig(r5, 0xa, 0x12) r6 = gettid() tkill(r6, 0x100000000000016) 2018/02/01 16:22:59 executing program 4: 2018/02/01 16:22:59 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000f56000)={0x0, 0x0, &(0x7f0000576000-0x10)={&(0x7f0000334000-0x78)={0x2, 0x3, 0x0, 0x9, 0x7, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, [@sadb_sa={0x2, 0x1, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x2, 0xfffffffb}, @sadb_address={0x3, 0x20000000000005, 0x0, 0x0, 0x0, @in={0x2, 0xffffffffffffffff, @broadcast=0xffffffff}}]}, 0x38}, 0x1}, 0x0) 2018/02/01 16:22:59 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) msgrcv(0x0, &(0x7f0000497000-0x8), 0x8, 0x0, 0x3000) msgsnd(0x0, &(0x7f000010d000)={0x3}, 0x8, 0x0) 2018/02/01 16:22:59 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = open(&(0x7f0000a08000)='./control\x00', 0x0, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) symlinkat(&(0x7f00007ae000-0x8)='./file0\x00', r0, &(0x7f0000a31000-0xa)='./control\x00') r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000e4c000)={0xaa}) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000044000-0x20)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r2 = creat(&(0x7f00000df000)='./file0\x00', 0x0) write$sndseq(r2, &(0x7f0000012000-0x2e)=[{0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @time=@time={0x77359400}}], 0x30) link(&(0x7f0000b40000-0xa)='./file0\x00', &(0x7f00006b4000-0x10)='./control/file0\x00') utimensat(r0, &(0x7f0000e03000-0x10)='./control/file0\x00', &(0x7f00003e7000-0x10)={{}, {0x0, 0x2710}}, 0x0) 2018/02/01 16:22:59 executing program 1: 2018/02/01 16:22:59 executing program 3: 2018/02/01 16:22:59 executing program 1: 2018/02/01 16:22:59 executing program 3: 2018/02/01 16:22:59 executing program 4: 2018/02/01 16:22:59 executing program 2: r0 = socket(0x18, 0x0, 0x1) sendmmsg(0xffffffffffffffff, &(0x7f0000005000-0x3c)=[{{&(0x7f0000003000)=@in6={0xa, 0xffffffffffffffff, 0x0, @remote={0xfe, 0x80, [], 0xffffffffffffffff, 0xbb}}, 0x1c, &(0x7f0000005000-0x60)=[{&(0x7f0000002000)="4c5614c00401a0dbf8a669ebdedd102c4f7a79e606457dfdf09e2ec2ed253b", 0x1f}], 0x1, &(0x7f0000003000-0x2d0)=[]}}], 0x1, 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000002000)={0x0, 0x0, 0x0, 0x0, 0x1, [{0xf03f}]}) r1 = socket(0x18, 0x0, 0x1) dup2(r1, r0) connect(r1, &(0x7f0000002000)=@sco={0x1f, {0x1}}, 0x26) ioctl$PPPIOCGMRU(r0, 0x80047453, &(0x7f000000c000)) 2018/02/01 16:22:59 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_IPSEC_POLICY(r0, 0x29, 0x4b, &(0x7f00000c6000)={{{@in=@rand_addr=0x6, @in=@rand_addr}}, {{@in=@local={0xac, 0x14, 0xffffffffffffffff, 0xaa}}, 0x0, @in6=@remote={0xfe, 0x80, [], 0xffffffffffffffff, 0xbb}}}, 0xe8) connect$inet6(r0, &(0x7f00000d2000-0x1c)={0xa, 0xffffffffffffffff, 0x0, @ipv4={[], [0xff, 0xff], @empty}}, 0x1c) 2018/02/01 16:22:59 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$evdev(&(0x7f0000e8c000)='/dev/input/event#\x00', 0x0, 0x0) ioctl$EVIOCGRAB(r0, 0x40044590, &(0x7f00002d1000-0x4)) r1 = syz_open_dev$evdev(&(0x7f0000e8c000)='/dev/input/event#\x00', 0x0, 0x0) ioctl$EVIOCGRAB(r1, 0x40044590, &(0x7f00002d1000-0x4)) 2018/02/01 16:22:59 executing program 4: mmap(&(0x7f0000000000/0x1f000)=nil, 0x1f000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_generic(r0, &(0x7f000001a000-0x38)={&(0x7f000001e000-0xc)={0x10}, 0xc, &(0x7f000000d000+0x379)={&(0x7f0000007000)={0x14, 0x1c, 0x401, 0xffffffffffffffff, 0xffffffffffffffff, {}, []}, 0x14}, 0x1}, 0x0) 2018/02/01 16:22:59 executing program 2: r0 = socket(0x18, 0x0, 0x1) sendmmsg(0xffffffffffffffff, &(0x7f0000005000-0x3c)=[{{&(0x7f0000003000)=@in6={0xa, 0xffffffffffffffff, 0x0, @remote={0xfe, 0x80, [], 0xffffffffffffffff, 0xbb}}, 0x1c, &(0x7f0000005000-0x60)=[{&(0x7f0000002000)="4c5614c00401a0dbf8a669ebdedd102c4f7a79e606457dfdf09e2ec2ed253b", 0x1f}], 0x1, &(0x7f0000003000-0x2d0)=[]}}], 0x1, 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000002000)={0x0, 0x0, 0x0, 0x0, 0x1, [{0xf03f}]}) r1 = socket(0x18, 0x0, 0x1) dup2(r1, r0) connect(r1, &(0x7f0000002000)=@sco={0x1f, {0x1}}, 0x26) ioctl$PPPIOCGMRU(r0, 0x80047453, &(0x7f000000c000)) 2018/02/01 16:22:59 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000f56000)={0x0, 0x0, &(0x7f0000576000-0x10)={&(0x7f0000334000-0x78)={0x2, 0x3, 0x0, 0x9, 0x7, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, [@sadb_sa={0x2, 0x1, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x2, 0xfffffffb}, @sadb_address={0x3, 0x20000000000005, 0x0, 0x0, 0x0, @in={0x2, 0xffffffffffffffff, @broadcast=0xffffffff}}]}, 0x38}, 0x1}, 0x0) 2018/02/01 16:22:59 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) msgrcv(0x0, &(0x7f0000497000-0x8), 0x8, 0x0, 0x3000) 2018/02/01 16:22:59 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = gettid() rt_sigtimedwait(&(0x7f0000645000-0x8), &(0x7f0000ded000), &(0x7f000052f000)={0x40000077359400}, 0x8) pipe(&(0x7f0000d8c000-0x8)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000e13000-0x8)={0xffffffffffffffff, 0xffffffffffffffff}) tee(r1, r3, 0x80007387, 0x0) r4 = dup2(r2, r3) r5 = syz_open_dev$random(&(0x7f0000bdc000-0xc)='/dev/random\x00', 0x0, 0x0) dup2(r2, r5) ioctl$int_in(0xffffffffffffffff, 0x5452, &(0x7f0000e36000-0x8)=0x45) fcntl$setown(r2, 0x8, r0) fcntl$setsig(r5, 0xa, 0x12) r6 = gettid() tkill(r6, 0x100000000000016) 2018/02/01 16:22:59 executing program 6: mkdir(&(0x7f000082f000)='./control\x00', 0x0) r0 = open(&(0x7f0000a08000)='./control\x00', 0x0, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) symlinkat(&(0x7f00007ae000-0x8)='./file0\x00', r0, &(0x7f0000a31000-0xa)='./control\x00') r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000e4c000)={0xaa}) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000044000-0x20)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r2 = creat(&(0x7f00000df000)='./file0\x00', 0x0) write$sndseq(r2, &(0x7f0000012000-0x2e)=[{0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @time=@time={0x77359400}}], 0x30) link(&(0x7f0000b40000-0xa)='./file0\x00', &(0x7f00006b4000-0x10)='./control/file0\x00') utimensat(r0, &(0x7f0000e03000-0x10)='./control/file0\x00', &(0x7f00003e7000-0x10)={{}, {0x0, 0x2710}}, 0x0) 2018/02/01 16:22:59 executing program 1: mmap(&(0x7f0000000000/0x48000)=nil, 0x48000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mkdir(&(0x7f000002a000-0xa)='./control\x00', 0x0) r0 = inotify_init1(0x0) mount(&(0x7f0000039000)='./control\x00', &(0x7f000003a000-0xa)='./control\x00', &(0x7f0000039000)='ramfs\x00', 0x0, &(0x7f0000040000)) inotify_add_watch(r0, &(0x7f0000006000)='./control\x00', 0xa4000001) r1 = open(&(0x7f0000035000)='./control\x00', 0x0, 0x0) getdents(r1, &(0x7f000003f000), 0x0) 2018/02/01 16:22:59 executing program 2: r0 = socket(0x18, 0x0, 0x1) sendmmsg(0xffffffffffffffff, &(0x7f0000005000-0x3c)=[{{&(0x7f0000003000)=@in6={0xa, 0xffffffffffffffff, 0x0, @remote={0xfe, 0x80, [], 0xffffffffffffffff, 0xbb}}, 0x1c, &(0x7f0000005000-0x60)=[{&(0x7f0000002000)="4c5614c00401a0dbf8a669ebdedd102c4f7a79e606457dfdf09e2ec2ed253b", 0x1f}], 0x1, &(0x7f0000003000-0x2d0)=[]}}], 0x1, 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000002000)={0x0, 0x0, 0x0, 0x0, 0x1, [{0xf03f}]}) r1 = socket(0x18, 0x0, 0x1) dup2(r1, r0) connect(r1, &(0x7f0000002000)=@sco={0x1f, {0x1}}, 0x26) ioctl$PPPIOCGMRU(r0, 0x80047453, &(0x7f000000c000)) 2018/02/01 16:22:59 executing program 6: mkdir(&(0x7f000082f000)='./control\x00', 0x0) r0 = open(&(0x7f0000a08000)='./control\x00', 0x0, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) symlinkat(&(0x7f00007ae000-0x8)='./file0\x00', r0, &(0x7f0000a31000-0xa)='./control\x00') r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000e4c000)={0xaa}) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000044000-0x20)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r2 = creat(&(0x7f00000df000)='./file0\x00', 0x0) write$sndseq(r2, &(0x7f0000012000-0x2e)=[{0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @time=@time={0x77359400}}], 0x30) link(&(0x7f0000b40000-0xa)='./file0\x00', &(0x7f00006b4000-0x10)='./control/file0\x00') utimensat(r0, &(0x7f0000e03000-0x10)='./control/file0\x00', &(0x7f00003e7000-0x10)={{}, {0x0, 0x2710}}, 0x0) 2018/02/01 16:22:59 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000f56000)={0x0, 0x0, &(0x7f0000576000-0x10)={&(0x7f0000334000-0x78)={0x2, 0x3, 0x0, 0x9, 0xa, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, [@sadb_address={0x3, 0x0, 0x0, 0x0, 0x0, @in={0x2, 0xffffffffffffffff, @loopback=0x7f000001}}, @sadb_sa={0x2, 0x1, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x2, 0xfffffffb}, @sadb_address={0x3, 0x20000000000005, 0x0, 0x0, 0x0, @in={0x2, 0xffffffffffffffff, @broadcast=0xffffffff}}]}, 0x50}, 0x1}, 0x0) 2018/02/01 16:22:59 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000873000)={&(0x7f00006b2000-0xc)={0x10}, 0xc, &(0x7f0000712000-0x10)={&(0x7f00006b7000)=@newlink={0x28, 0x10, 0x9, 0xffffffffffffffff, 0xffffffffffffffff, {}, [@IFLA_GROUP={0x8, 0x1b}]}, 0x28}, 0x1}, 0x0) readv(0xffffffffffffffff, &(0x7f0000ebf000)=[{&(0x7f0000c6e000)=""/216, 0xd8}], 0x1) 2018/02/01 16:22:59 executing program 2: mmap(&(0x7f0000000000/0x12000)=nil, 0x12000, 0x0, 0x32, 0xffffffffffffffff, 0x0) r0 = socket(0x18, 0x0, 0x1) sendmmsg(0xffffffffffffffff, &(0x7f0000005000-0x3c)=[{{&(0x7f0000003000)=@in6={0xa, 0xffffffffffffffff, 0x0, @remote={0xfe, 0x80, [], 0xffffffffffffffff, 0xbb}}, 0x1c, &(0x7f0000005000-0x60)=[{&(0x7f0000002000)="4c5614c00401a0dbf8a669ebdedd102c4f7a79e606457dfdf09e2ec2ed253b", 0x1f}], 0x1, &(0x7f0000003000-0x2d0)=[]}}], 0x1, 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000002000)={0x0, 0x0, 0x0, 0x0, 0x1, [{0xf03f}]}) r1 = socket(0x18, 0x0, 0x1) dup2(r1, r0) connect(r1, &(0x7f0000002000)=@sco={0x1f, {0x1}}, 0x26) ioctl$PPPIOCGMRU(r0, 0x80047453, &(0x7f000000c000)) 2018/02/01 16:22:59 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) msgrcv(0x0, &(0x7f0000497000-0x8), 0x8, 0x0, 0x3000) 2018/02/01 16:22:59 executing program 6: mkdir(&(0x7f000082f000)='./control\x00', 0x0) r0 = open(&(0x7f0000a08000)='./control\x00', 0x0, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) symlinkat(&(0x7f00007ae000-0x8)='./file0\x00', r0, &(0x7f0000a31000-0xa)='./control\x00') r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000e4c000)={0xaa}) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000044000-0x20)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r2 = creat(&(0x7f00000df000)='./file0\x00', 0x0) write$sndseq(r2, &(0x7f0000012000-0x2e)=[{0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @time=@time={0x77359400}}], 0x30) link(&(0x7f0000b40000-0xa)='./file0\x00', &(0x7f00006b4000-0x10)='./control/file0\x00') utimensat(r0, &(0x7f0000e03000-0x10)='./control/file0\x00', &(0x7f00003e7000-0x10)={{}, {0x0, 0x2710}}, 0x0) 2018/02/01 16:22:59 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x0, 0x32, 0xffffffffffffffff, 0x0) mkdir(&(0x7f000082f000)='./control\x00', 0x0) r0 = open(&(0x7f0000a08000)='./control\x00', 0x0, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) symlinkat(&(0x7f00007ae000-0x8)='./file0\x00', r0, &(0x7f0000a31000-0xa)='./control\x00') r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000e4c000)={0xaa}) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000044000-0x20)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r2 = creat(&(0x7f00000df000)='./file0\x00', 0x0) write$sndseq(r2, &(0x7f0000012000-0x2e)=[{0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @time=@time={0x77359400}}], 0x30) link(&(0x7f0000b40000-0xa)='./file0\x00', &(0x7f00006b4000-0x10)='./control/file0\x00') utimensat(r0, &(0x7f0000e03000-0x10)='./control/file0\x00', &(0x7f00003e7000-0x10)={{}, {0x0, 0x2710}}, 0x0) 2018/02/01 16:22:59 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000430000)={{{@in6=@loopback={0x0, 0x1}, @in6=@empty, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xa, 0x0, 0x2}, {}, {}, 0x0, 0xffffffffffffffff, 0x1}, {{@in=@multicast2=0xe0000002}, 0x0, @in=@multicast1=0xe0000001}}, 0xe8) sendto$inet6(r0, &(0x7f0000504000-0x90), 0x0, 0x0, &(0x7f00001e7000-0x1c)={0xa, 0x3, 0x0, @local={0xfe, 0x80, [], 0xffffffffffffffff, 0xaa}}, 0x1c) 2018/02/01 16:22:59 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000f56000)={0x0, 0x0, &(0x7f0000576000-0x10)={&(0x7f0000334000-0x78)={0x2, 0x3, 0x0, 0x9, 0xa, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, [@sadb_address={0x3, 0x0, 0x0, 0x0, 0x0, @in={0x2, 0xffffffffffffffff, @loopback=0x7f000001}}, @sadb_sa={0x2, 0x1, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x2, 0xfffffffb}, @sadb_address={0x3, 0x20000000000005, 0x0, 0x0, 0x0, @in={0x2, 0xffffffffffffffff, @broadcast=0xffffffff}}]}, 0x50}, 0x1}, 0x0) 2018/02/01 16:22:59 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000248000)={{{@in6=@mcast2={0xff, 0x2, [], 0x1}, @in6=@remote={0xfe, 0x80, [], 0xffffffffffffffff, 0xbb}, 0xffffffffffffffff, 0x3, 0xffffffffffffffff, 0x0, 0x2}, {}, {}, 0x0, 0xffffffffffffffff, 0x1}, {{@in6=@remote={0xfe, 0x80, [], 0xffffffffffffffff, 0xbb}}, 0x0, @in=@rand_addr}}, 0xe8) sendmsg(r0, &(0x7f00001f1000)={&(0x7f0000843000-0x1c)=@in6={0x2, 0x3, 0x0, @remote={0xfe, 0x80, [], 0xffffffffffffffff, 0xbb}}, 0x1c, &(0x7f0000367000-0x80)=[], 0x0, &(0x7f0000147000)=[]}, 0x0) 2018/02/01 16:22:59 executing program 2: mmap(&(0x7f0000000000/0x12000)=nil, 0x12000, 0x0, 0x32, 0xffffffffffffffff, 0x0) r0 = socket(0x18, 0x0, 0x1) sendmmsg(0xffffffffffffffff, &(0x7f0000005000-0x3c)=[{{&(0x7f0000003000)=@in6={0xa, 0xffffffffffffffff, 0x0, @remote={0xfe, 0x80, [], 0xffffffffffffffff, 0xbb}}, 0x1c, &(0x7f0000005000-0x60)=[{&(0x7f0000002000)="4c5614c00401a0dbf8a669ebdedd102c4f7a79e606457dfdf09e2ec2ed253b", 0x1f}], 0x1, &(0x7f0000003000-0x2d0)=[]}}], 0x1, 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000002000)={0x0, 0x0, 0x0, 0x0, 0x1, [{0xf03f}]}) r1 = socket(0x18, 0x0, 0x1) dup2(r1, r0) connect(r1, &(0x7f0000002000)=@sco={0x1f, {0x1}}, 0x26) ioctl$PPPIOCGMRU(r0, 0x80047453, &(0x7f000000c000)) 2018/02/01 16:22:59 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x0, 0x32, 0xffffffffffffffff, 0x0) mkdir(&(0x7f000082f000)='./control\x00', 0x0) r0 = open(&(0x7f0000a08000)='./control\x00', 0x0, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) symlinkat(&(0x7f00007ae000-0x8)='./file0\x00', r0, &(0x7f0000a31000-0xa)='./control\x00') r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000e4c000)={0xaa}) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000044000-0x20)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r2 = creat(&(0x7f00000df000)='./file0\x00', 0x0) write$sndseq(r2, &(0x7f0000012000-0x2e)=[{0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @time=@time={0x77359400}}], 0x30) link(&(0x7f0000b40000-0xa)='./file0\x00', &(0x7f00006b4000-0x10)='./control/file0\x00') utimensat(r0, &(0x7f0000e03000-0x10)='./control/file0\x00', &(0x7f00003e7000-0x10)={{}, {0x0, 0x2710}}, 0x0) [ 225.316629] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 225.341236] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready 2018/02/01 16:23:00 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) ioctl(r0, 0x227e, &(0x7f0000001000)) 2018/02/01 16:23:00 executing program 2: mmap(&(0x7f0000000000/0x12000)=nil, 0x12000, 0x0, 0x32, 0xffffffffffffffff, 0x0) r0 = socket(0x18, 0x0, 0x1) sendmmsg(0xffffffffffffffff, &(0x7f0000005000-0x3c)=[{{&(0x7f0000003000)=@in6={0xa, 0xffffffffffffffff, 0x0, @remote={0xfe, 0x80, [], 0xffffffffffffffff, 0xbb}}, 0x1c, &(0x7f0000005000-0x60)=[{&(0x7f0000002000)="4c5614c00401a0dbf8a669ebdedd102c4f7a79e606457dfdf09e2ec2ed253b", 0x1f}], 0x1, &(0x7f0000003000-0x2d0)=[]}}], 0x1, 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000002000)={0x0, 0x0, 0x0, 0x0, 0x1, [{0xf03f}]}) r1 = socket(0x18, 0x0, 0x1) dup2(r1, r0) connect(r1, &(0x7f0000002000)=@sco={0x1f, {0x1}}, 0x26) ioctl$PPPIOCGMRU(r0, 0x80047453, &(0x7f000000c000)) 2018/02/01 16:23:00 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000f56000)={0x0, 0x0, &(0x7f0000576000-0x10)={&(0x7f0000334000-0x78)={0x2, 0x3, 0x0, 0x9, 0xa, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, [@sadb_address={0x3, 0x0, 0x0, 0x0, 0x0, @in={0x2, 0xffffffffffffffff, @loopback=0x7f000001}}, @sadb_sa={0x2, 0x1, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x2, 0xfffffffb}, @sadb_address={0x3, 0x20000000000005, 0x0, 0x0, 0x0, @in={0x2, 0xffffffffffffffff, @broadcast=0xffffffff}}]}, 0x50}, 0x1}, 0x0) 2018/02/01 16:23:00 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) msgrcv(0x0, &(0x7f0000497000-0x8), 0x8, 0x0, 0x3000) 2018/02/01 16:23:00 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x0, 0x32, 0xffffffffffffffff, 0x0) mkdir(&(0x7f000082f000)='./control\x00', 0x0) r0 = open(&(0x7f0000a08000)='./control\x00', 0x0, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) symlinkat(&(0x7f00007ae000-0x8)='./file0\x00', r0, &(0x7f0000a31000-0xa)='./control\x00') r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000e4c000)={0xaa}) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000044000-0x20)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r2 = creat(&(0x7f00000df000)='./file0\x00', 0x0) write$sndseq(r2, &(0x7f0000012000-0x2e)=[{0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @time=@time={0x77359400}}], 0x30) link(&(0x7f0000b40000-0xa)='./file0\x00', &(0x7f00006b4000-0x10)='./control/file0\x00') utimensat(r0, &(0x7f0000e03000-0x10)='./control/file0\x00', &(0x7f00003e7000-0x10)={{}, {0x0, 0x2710}}, 0x0) 2018/02/01 16:23:00 executing program 3: mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x4, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000001000-0x18)={0xaa}) r1 = epoll_create1(0x0) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000012000/0x2000)=nil, 0x2000}, 0x1}) r2 = socket$inet_tcp(0x2, 0x1, 0x0) r3 = fcntl$dupfd(r2, 0x0, r2) getsockopt$inet6_tcp_int(r3, 0x6, 0x400000000d, &(0x7f0000012000-0x4), &(0x7f0000013000-0x4)=0x4) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) dup3(r1, r0, 0x0) 2018/02/01 16:23:00 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = gettid() rt_sigtimedwait(&(0x7f0000645000-0x8), &(0x7f0000ded000), &(0x7f000052f000)={0x40000077359400}, 0x8) pipe(&(0x7f0000d8c000-0x8)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000e13000-0x8)={0xffffffffffffffff, 0xffffffffffffffff}) tee(r1, r3, 0x80007387, 0x0) r4 = dup2(r2, r3) r5 = syz_open_dev$random(&(0x7f0000bdc000-0xc)='/dev/random\x00', 0x0, 0x0) dup2(r2, r5) ioctl$int_in(0xffffffffffffffff, 0x5452, &(0x7f0000e36000-0x8)=0x45) fcntl$setown(r2, 0x8, r0) fcntl$setsig(r5, 0xa, 0x12) r6 = gettid() tkill(r6, 0x100000000000016) 2018/02/01 16:23:00 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000d30000)={&(0x7f0000126000-0xc)={0x10}, 0xc, &(0x7f0000d00000-0x10)={&(0x7f0000bbe000-0x44)=@getsa={0x28, 0x12, 0x201, 0xffffffffffffffff, 0xffffffffffffffff, {@in=@remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}}, []}, 0x28}, 0x1}, 0x0) recvmmsg(r0, &(0x7f00002b9000)=[{{&(0x7f0000b2b000)=@ax25, 0x10, &(0x7f00009b8000)=[], 0x0, &(0x7f0000f82000)=""/128, 0x1b}}], 0x1, 0x0, &(0x7f0000187000)) 2018/02/01 16:23:00 executing program 2: mmap(&(0x7f0000000000/0x12000)=nil, 0x12000, 0x3, 0x0, 0xffffffffffffffff, 0x0) r0 = socket(0x18, 0x0, 0x1) sendmmsg(0xffffffffffffffff, &(0x7f0000005000-0x3c)=[{{&(0x7f0000003000)=@in6={0xa, 0xffffffffffffffff, 0x0, @remote={0xfe, 0x80, [], 0xffffffffffffffff, 0xbb}}, 0x1c, &(0x7f0000005000-0x60)=[{&(0x7f0000002000)="4c5614c00401a0dbf8a669ebdedd102c4f7a79e606457dfdf09e2ec2ed253b", 0x1f}], 0x1, &(0x7f0000003000-0x2d0)=[]}}], 0x1, 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000002000)={0x0, 0x0, 0x0, 0x0, 0x1, [{0xf03f}]}) r1 = socket(0x18, 0x0, 0x1) dup2(r1, r0) connect(r1, &(0x7f0000002000)=@sco={0x1f, {0x1}}, 0x26) ioctl$PPPIOCGMRU(r0, 0x80047453, &(0x7f000000c000)) 2018/02/01 16:23:00 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000f56000)={0x0, 0x0, &(0x7f0000576000-0x10)={&(0x7f0000334000-0x78)={0x2, 0x3, 0x0, 0x9, 0x8, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, [@sadb_address={0x3, 0x40000000000006, 0x0, 0x0, 0x0, @in={0x2, 0xffffffffffffffff, @loopback=0x7f000001}}, @sadb_address={0x3, 0x20000000000005, 0x0, 0x0, 0x0, @in={0x2, 0xffffffffffffffff, @broadcast=0xffffffff}}]}, 0x40}, 0x1}, 0x0) 2018/02/01 16:23:00 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x0, 0xffffffffffffffff, 0x0) mkdir(&(0x7f000082f000)='./control\x00', 0x0) r0 = open(&(0x7f0000a08000)='./control\x00', 0x0, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) symlinkat(&(0x7f00007ae000-0x8)='./file0\x00', r0, &(0x7f0000a31000-0xa)='./control\x00') r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000e4c000)={0xaa}) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000044000-0x20)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r2 = creat(&(0x7f00000df000)='./file0\x00', 0x0) write$sndseq(r2, &(0x7f0000012000-0x2e)=[{0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @time=@time={0x77359400}}], 0x30) link(&(0x7f0000b40000-0xa)='./file0\x00', &(0x7f00006b4000-0x10)='./control/file0\x00') utimensat(r0, &(0x7f0000e03000-0x10)='./control/file0\x00', &(0x7f00003e7000-0x10)={{}, {0x0, 0x2710}}, 0x0) 2018/02/01 16:23:00 executing program 2: mmap(&(0x7f0000000000/0x12000)=nil, 0x12000, 0x3, 0x0, 0xffffffffffffffff, 0x0) r0 = socket(0x18, 0x0, 0x1) sendmmsg(0xffffffffffffffff, &(0x7f0000005000-0x3c)=[{{&(0x7f0000003000)=@in6={0xa, 0xffffffffffffffff, 0x0, @remote={0xfe, 0x80, [], 0xffffffffffffffff, 0xbb}}, 0x1c, &(0x7f0000005000-0x60)=[{&(0x7f0000002000)="4c5614c00401a0dbf8a669ebdedd102c4f7a79e606457dfdf09e2ec2ed253b", 0x1f}], 0x1, &(0x7f0000003000-0x2d0)=[]}}], 0x1, 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000002000)={0x0, 0x0, 0x0, 0x0, 0x1, [{0xf03f}]}) r1 = socket(0x18, 0x0, 0x1) dup2(r1, r0) connect(r1, &(0x7f0000002000)=@sco={0x1f, {0x1}}, 0x26) ioctl$PPPIOCGMRU(r0, 0x80047453, &(0x7f000000c000)) 2018/02/01 16:23:00 executing program 0: msgrcv(0x0, &(0x7f0000497000-0x8), 0x8, 0x0, 0x3000) msgsnd(0x0, &(0x7f000010d000)={0x3}, 0x8, 0x0) 2018/02/01 16:23:00 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x0, 0xffffffffffffffff, 0x0) mkdir(&(0x7f000082f000)='./control\x00', 0x0) r0 = open(&(0x7f0000a08000)='./control\x00', 0x0, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) symlinkat(&(0x7f00007ae000-0x8)='./file0\x00', r0, &(0x7f0000a31000-0xa)='./control\x00') r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000e4c000)={0xaa}) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000044000-0x20)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r2 = creat(&(0x7f00000df000)='./file0\x00', 0x0) write$sndseq(r2, &(0x7f0000012000-0x2e)=[{0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @time=@time={0x77359400}}], 0x30) link(&(0x7f0000b40000-0xa)='./file0\x00', &(0x7f00006b4000-0x10)='./control/file0\x00') utimensat(r0, &(0x7f0000e03000-0x10)='./control/file0\x00', &(0x7f00003e7000-0x10)={{}, {0x0, 0x2710}}, 0x0) 2018/02/01 16:23:00 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000f56000)={0x0, 0x0, &(0x7f0000576000-0x10)={&(0x7f0000334000-0x78)={0x2, 0x3, 0x0, 0x9, 0x8, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, [@sadb_address={0x3, 0x40000000000006, 0x0, 0x0, 0x0, @in={0x2, 0xffffffffffffffff, @loopback=0x7f000001}}, @sadb_address={0x3, 0x20000000000005, 0x0, 0x0, 0x0, @in={0x2, 0xffffffffffffffff, @broadcast=0xffffffff}}]}, 0x40}, 0x1}, 0x0) 2018/02/01 16:23:00 executing program 4: clone(0x0, &(0x7f0000b6c000), &(0x7f00008a3000), &(0x7f000057c000), &(0x7f000006b000)) readahead(0xffffffffffffffff, 0x0, 0x0) 2018/02/01 16:23:00 executing program 2: mmap(&(0x7f0000000000/0x12000)=nil, 0x12000, 0x3, 0x0, 0xffffffffffffffff, 0x0) r0 = socket(0x18, 0x0, 0x1) sendmmsg(0xffffffffffffffff, &(0x7f0000005000-0x3c)=[{{&(0x7f0000003000)=@in6={0xa, 0xffffffffffffffff, 0x0, @remote={0xfe, 0x80, [], 0xffffffffffffffff, 0xbb}}, 0x1c, &(0x7f0000005000-0x60)=[{&(0x7f0000002000)="4c5614c00401a0dbf8a669ebdedd102c4f7a79e606457dfdf09e2ec2ed253b", 0x1f}], 0x1, &(0x7f0000003000-0x2d0)=[]}}], 0x1, 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000002000)={0x0, 0x0, 0x0, 0x0, 0x1, [{0xf03f}]}) r1 = socket(0x18, 0x0, 0x1) dup2(r1, r0) connect(r1, &(0x7f0000002000)=@sco={0x1f, {0x1}}, 0x26) ioctl$PPPIOCGMRU(r0, 0x80047453, &(0x7f000000c000)) 2018/02/01 16:23:00 executing program 1: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x0, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)={0xaa}) mprotect(&(0x7f0000012000/0x2000)=nil, 0x2000, 0x2) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) getitimer(0x0, &(0x7f0000013000-0x20)) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$UFFDIO_ZEROPAGE(r0, 0xc020aa04, &(0x7f0000001000)={&(0x7f0000013000/0x1000)=nil, 0x1000}) 2018/02/01 16:23:00 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x0, 0xffffffffffffffff, 0x0) mkdir(&(0x7f000082f000)='./control\x00', 0x0) r0 = open(&(0x7f0000a08000)='./control\x00', 0x0, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) symlinkat(&(0x7f00007ae000-0x8)='./file0\x00', r0, &(0x7f0000a31000-0xa)='./control\x00') r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000e4c000)={0xaa}) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000044000-0x20)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r2 = creat(&(0x7f00000df000)='./file0\x00', 0x0) write$sndseq(r2, &(0x7f0000012000-0x2e)=[{0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @time=@time={0x77359400}}], 0x30) link(&(0x7f0000b40000-0xa)='./file0\x00', &(0x7f00006b4000-0x10)='./control/file0\x00') utimensat(r0, &(0x7f0000e03000-0x10)='./control/file0\x00', &(0x7f00003e7000-0x10)={{}, {0x0, 0x2710}}, 0x0) [ 225.878440] netlink: 24 bytes leftover after parsing attributes in process `syz-executor1'. [ 225.910745] netlink: 24 bytes leftover after parsing attributes in process `syz-executor1'. 2018/02/01 16:23:00 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000f56000)={0x0, 0x0, &(0x7f0000576000-0x10)={&(0x7f0000334000-0x78)={0x2, 0x3, 0x0, 0x9, 0x8, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, [@sadb_address={0x3, 0x40000000000006, 0x0, 0x0, 0x0, @in={0x2, 0xffffffffffffffff, @loopback=0x7f000001}}, @sadb_address={0x3, 0x20000000000005, 0x0, 0x0, 0x0, @in={0x2, 0xffffffffffffffff, @broadcast=0xffffffff}}]}, 0x40}, 0x1}, 0x0) 2018/02/01 16:23:00 executing program 0: msgrcv(0x0, &(0x7f0000497000-0x8), 0x8, 0x0, 0x3000) msgsnd(0x0, &(0x7f000010d000)={0x3}, 0x8, 0x0) 2018/02/01 16:23:00 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket(0x10, 0x803, 0x0) sendto(r0, &(0x7f0000cff000-0x12)="120000001200e7ff00ffe90009144a000ae9", 0x12, 0x0, 0x0, 0x0) recvfrom(r0, &(0x7f00002f2000)=""/97, 0x61, 0x0, &(0x7f0000e46000)=@l2={0x1f}, 0xe) 2018/02/01 16:23:00 executing program 4: mmap(&(0x7f0000000000/0xfea000)=nil, 0xfea000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mlock2(&(0x7f0000a93000/0x2000)=nil, 0x2000, 0x0) mremap(&(0x7f0000a93000/0x1000)=nil, 0x1000, 0xe000, 0x3, &(0x7f0000b18000/0xe000)=nil) clone(0x0, &(0x7f0000000000), &(0x7f0000000000), &(0x7f0000ce4000), &(0x7f0000000000)) mmap(&(0x7f0000000000/0xfea000)=nil, 0xfea000, 0x0, 0x32, 0xffffffffffffffff, 0x0) 2018/02/01 16:23:00 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = gettid() rt_sigtimedwait(&(0x7f0000645000-0x8), &(0x7f0000ded000), &(0x7f000052f000)={0x40000077359400}, 0x8) pipe(&(0x7f0000d8c000-0x8)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000e13000-0x8)={0xffffffffffffffff, 0xffffffffffffffff}) tee(r1, r3, 0x80007387, 0x0) r4 = dup2(r2, r3) r5 = syz_open_dev$random(&(0x7f0000bdc000-0xc)='/dev/random\x00', 0x0, 0x0) dup2(r2, r5) ioctl$int_in(0xffffffffffffffff, 0x5452, &(0x7f0000e36000-0x8)=0x45) fcntl$setown(r2, 0x8, r0) fcntl$setsig(r5, 0xa, 0x12) r6 = gettid() tkill(r6, 0x100000000000016) 2018/02/01 16:23:00 executing program 2: mmap(&(0x7f0000000000/0x12000)=nil, 0x12000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket(0x0, 0x0, 0x1) sendmmsg(0xffffffffffffffff, &(0x7f0000005000-0x3c)=[{{&(0x7f0000003000)=@in6={0xa, 0xffffffffffffffff, 0x0, @remote={0xfe, 0x80, [], 0xffffffffffffffff, 0xbb}}, 0x1c, &(0x7f0000005000-0x60)=[{&(0x7f0000002000)="4c5614c00401a0dbf8a669ebdedd102c4f7a79e606457dfdf09e2ec2ed253b", 0x1f}], 0x1, &(0x7f0000003000-0x2d0)=[]}}], 0x1, 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000002000)={0x0, 0x0, 0x0, 0x0, 0x1, [{0xf03f}]}) r1 = socket(0x18, 0x0, 0x1) dup2(r1, r0) connect(r1, &(0x7f0000002000)=@sco={0x1f, {0x1}}, 0x26) ioctl$PPPIOCGMRU(r0, 0x80047453, &(0x7f000000c000)) 2018/02/01 16:23:00 executing program 3: mmap(&(0x7f0000000000/0xaff000)=nil, 0xaff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00004c9000)={0xaa}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r1 = creat(&(0x7f000090b000-0x8)='./file0\x00', 0x0) write$sndseq(r1, &(0x7f0000012000-0x2e)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @time=@time={0x0, 0x989680}}], 0x1c) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mount(&(0x7f00003cb000)='./file0\x00', &(0x7f00004bc000-0x8)='./file0\x00', &(0x7f0000775000+0x6ff)='f2fs\x00', 0x2002, 0x0) lchown(&(0x7f0000f9f000-0x8)='./file0\x00', 0x0, 0x0) ioctl$UFFDIO_ZEROPAGE(r0, 0x8010aa02, &(0x7f0000002000-0x10)={&(0x7f0000011000/0x3000)=nil, 0x3000}) 2018/02/01 16:23:00 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000f56000)={0x0, 0x0, &(0x7f0000576000-0x10)={&(0x7f0000334000-0x78)={0x2, 0x3, 0x0, 0x9, 0xa, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, [@sadb_address={0x3, 0x40000000000006, 0x0, 0x0, 0x0, @in={0x2, 0xffffffffffffffff, @loopback=0x7f000001}}, @sadb_sa={0x2, 0x1, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0xfffffffb}, @sadb_address={0x3, 0x20000000000005, 0x0, 0x0, 0x0, @in={0x2, 0xffffffffffffffff, @broadcast=0xffffffff}}]}, 0x50}, 0x1}, 0x0) 2018/02/01 16:23:00 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mkdir(&(0x7f000082f000)='./control\x00', 0x0) r0 = open(&(0x7f0000a08000)='./control\x00', 0x0, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x0, 0x32, 0xffffffffffffffff, 0x0) symlinkat(&(0x7f00007ae000-0x8)='./file0\x00', r0, &(0x7f0000a31000-0xa)='./control\x00') r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000e4c000)={0xaa}) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000044000-0x20)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r2 = creat(&(0x7f00000df000)='./file0\x00', 0x0) write$sndseq(r2, &(0x7f0000012000-0x2e)=[{0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @time=@time={0x77359400}}], 0x30) link(&(0x7f0000b40000-0xa)='./file0\x00', &(0x7f00006b4000-0x10)='./control/file0\x00') utimensat(r0, &(0x7f0000e03000-0x10)='./control/file0\x00', &(0x7f00003e7000-0x10)={{}, {0x0, 0x2710}}, 0x0) 2018/02/01 16:23:00 executing program 0: msgrcv(0x0, &(0x7f0000497000-0x8), 0x8, 0x0, 0x3000) msgsnd(0x0, &(0x7f000010d000)={0x3}, 0x8, 0x0) 2018/02/01 16:23:00 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$DRM_IOCTL_DMA(0xffffffffffffffff, 0xc0406429, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000f79000)=[], &(0x7f0000000000)=[0x0], 0x0, 0x2, 0x0, &(0x7f0000001000-0x10)=[0x0, 0x2], &(0x7f0000885000)=[0x8]}) r0 = syz_open_procfs(0x0, &(0x7f00008f7000-0x7)='mounts\x00') r1 = epoll_create(0x6) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000faf000-0xc)) clock_gettime(0x0, &(0x7f0000d56000)={0x0, 0x0}) ppoll(&(0x7f0000a18000)=[{r1}, {r0}], 0x2, &(0x7f000071d000)={0x0, r2+10000000}, &(0x7f0000e33000), 0x8) mount(&(0x7f0000a39000-0x8)='./file0\x00', &(0x7f0000852000)='.', &(0x7f0000a60000)='ramfs\x00', 0x0, &(0x7f00008a7000)) epoll_ctl$EPOLL_CTL_DEL(r1, 0x2, r0) umount2(&(0x7f0000d5c000-0x1)='.', 0x0) 2018/02/01 16:23:00 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mkdir(&(0x7f000082f000)='./control\x00', 0x0) r0 = open(&(0x7f0000a08000)='./control\x00', 0x0, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x0, 0x32, 0xffffffffffffffff, 0x0) symlinkat(&(0x7f00007ae000-0x8)='./file0\x00', r0, &(0x7f0000a31000-0xa)='./control\x00') r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000e4c000)={0xaa}) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000044000-0x20)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r2 = creat(&(0x7f00000df000)='./file0\x00', 0x0) write$sndseq(r2, &(0x7f0000012000-0x2e)=[{0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @time=@time={0x77359400}}], 0x30) link(&(0x7f0000b40000-0xa)='./file0\x00', &(0x7f00006b4000-0x10)='./control/file0\x00') utimensat(r0, &(0x7f0000e03000-0x10)='./control/file0\x00', &(0x7f00003e7000-0x10)={{}, {0x0, 0x2710}}, 0x0) 2018/02/01 16:23:00 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000f56000)={0x0, 0x0, &(0x7f0000576000-0x10)={&(0x7f0000334000-0x78)={0x2, 0x3, 0x0, 0x9, 0xa, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, [@sadb_address={0x3, 0x40000000000006, 0x0, 0x0, 0x0, @in={0x2, 0xffffffffffffffff, @loopback=0x7f000001}}, @sadb_sa={0x2, 0x1, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0xfffffffb}, @sadb_address={0x3, 0x20000000000005, 0x0, 0x0, 0x0, @in={0x2, 0xffffffffffffffff, @broadcast=0xffffffff}}]}, 0x50}, 0x1}, 0x0) 2018/02/01 16:23:00 executing program 2: mmap(&(0x7f0000000000/0x12000)=nil, 0x12000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket(0x0, 0x0, 0x1) sendmmsg(0xffffffffffffffff, &(0x7f0000005000-0x3c)=[{{&(0x7f0000003000)=@in6={0xa, 0xffffffffffffffff, 0x0, @remote={0xfe, 0x80, [], 0xffffffffffffffff, 0xbb}}, 0x1c, &(0x7f0000005000-0x60)=[{&(0x7f0000002000)="4c5614c00401a0dbf8a669ebdedd102c4f7a79e606457dfdf09e2ec2ed253b", 0x1f}], 0x1, &(0x7f0000003000-0x2d0)=[]}}], 0x1, 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000002000)={0x0, 0x0, 0x0, 0x0, 0x1, [{0xf03f}]}) r1 = socket(0x18, 0x0, 0x1) dup2(r1, r0) connect(r1, &(0x7f0000002000)=@sco={0x1f, {0x1}}, 0x26) ioctl$PPPIOCGMRU(r0, 0x80047453, &(0x7f000000c000)) 2018/02/01 16:23:00 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x0, 0x32, 0xffffffffffffffff, 0x0) msgrcv(0x0, &(0x7f0000497000-0x8), 0x8, 0x0, 0x3000) msgsnd(0x0, &(0x7f000010d000)={0x3}, 0x8, 0x0) 2018/02/01 16:23:01 executing program 4: mmap(&(0x7f0000000000/0xfea000)=nil, 0xfea000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mlock2(&(0x7f0000a93000/0x2000)=nil, 0x2000, 0x0) mremap(&(0x7f0000a93000/0x1000)=nil, 0x1000, 0xe000, 0x3, &(0x7f0000b18000/0xe000)=nil) clone(0x0, &(0x7f0000000000), &(0x7f0000000000), &(0x7f0000ce4000), &(0x7f0000000000)) mmap(&(0x7f0000000000/0xfea000)=nil, 0xfea000, 0x0, 0x32, 0xffffffffffffffff, 0x0) 2018/02/01 16:23:01 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mkdir(&(0x7f000082f000)='./control\x00', 0x0) r0 = open(&(0x7f0000a08000)='./control\x00', 0x0, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x0, 0x32, 0xffffffffffffffff, 0x0) symlinkat(&(0x7f00007ae000-0x8)='./file0\x00', r0, &(0x7f0000a31000-0xa)='./control\x00') r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000e4c000)={0xaa}) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000044000-0x20)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r2 = creat(&(0x7f00000df000)='./file0\x00', 0x0) write$sndseq(r2, &(0x7f0000012000-0x2e)=[{0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @time=@time={0x77359400}}], 0x30) link(&(0x7f0000b40000-0xa)='./file0\x00', &(0x7f00006b4000-0x10)='./control/file0\x00') utimensat(r0, &(0x7f0000e03000-0x10)='./control/file0\x00', &(0x7f00003e7000-0x10)={{}, {0x0, 0x2710}}, 0x0) 2018/02/01 16:23:01 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000f56000)={0x0, 0x0, &(0x7f0000576000-0x10)={&(0x7f0000334000-0x78)={0x2, 0x3, 0x0, 0x9, 0xa, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, [@sadb_address={0x3, 0x40000000000006, 0x0, 0x0, 0x0, @in={0x2, 0xffffffffffffffff, @loopback=0x7f000001}}, @sadb_sa={0x2, 0x1, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0xfffffffb}, @sadb_address={0x3, 0x20000000000005, 0x0, 0x0, 0x0, @in={0x2, 0xffffffffffffffff, @broadcast=0xffffffff}}]}, 0x50}, 0x1}, 0x0) 2018/02/01 16:23:01 executing program 2: mmap(&(0x7f0000000000/0x12000)=nil, 0x12000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket(0x0, 0x0, 0x1) sendmmsg(0xffffffffffffffff, &(0x7f0000005000-0x3c)=[{{&(0x7f0000003000)=@in6={0xa, 0xffffffffffffffff, 0x0, @remote={0xfe, 0x80, [], 0xffffffffffffffff, 0xbb}}, 0x1c, &(0x7f0000005000-0x60)=[{&(0x7f0000002000)="4c5614c00401a0dbf8a669ebdedd102c4f7a79e606457dfdf09e2ec2ed253b", 0x1f}], 0x1, &(0x7f0000003000-0x2d0)=[]}}], 0x1, 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000002000)={0x0, 0x0, 0x0, 0x0, 0x1, [{0xf03f}]}) r1 = socket(0x18, 0x0, 0x1) dup2(r1, r0) connect(r1, &(0x7f0000002000)=@sco={0x1f, {0x1}}, 0x26) ioctl$PPPIOCGMRU(r0, 0x80047453, &(0x7f000000c000)) 2018/02/01 16:23:01 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x0, 0x32, 0xffffffffffffffff, 0x0) msgrcv(0x0, &(0x7f0000497000-0x8), 0x8, 0x0, 0x3000) msgsnd(0x0, &(0x7f000010d000)={0x3}, 0x8, 0x0) 2018/02/01 16:23:01 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = add_key$user(&(0x7f00008d7000-0x5)='user\x00', &(0x7f0000117000-0x5)={0x73, 0x79, 0x7a}, &(0x7f0000ed1000-0x97)="b4", 0x1, 0xfffffffffffffffc) keyctl$update(0x2, r0, 0x0, 0x0) 2018/02/01 16:23:01 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = gettid() rt_sigtimedwait(&(0x7f0000645000-0x8), &(0x7f0000ded000), &(0x7f000052f000)={0x40000077359400}, 0x8) pipe(&(0x7f0000d8c000-0x8)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000e13000-0x8)={0xffffffffffffffff, 0xffffffffffffffff}) tee(r1, r3, 0x80007387, 0x0) r4 = dup2(r2, r3) r5 = syz_open_dev$random(&(0x7f0000bdc000-0xc)='/dev/random\x00', 0x0, 0x0) dup2(r2, r5) ioctl$int_in(r4, 0x0, &(0x7f0000e36000-0x8)=0x45) fcntl$setown(r2, 0x8, r0) fcntl$setsig(r5, 0xa, 0x12) r6 = gettid() tkill(r6, 0x100000000000016) 2018/02/01 16:23:01 executing program 3: mmap(&(0x7f0000000000/0x18000)=nil, 0x18000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000016000)={&(0x7f0000018000-0xc)={0x10}, 0xc, &(0x7f0000017000)={&(0x7f0000003000+0xe90)=@getae={0x40, 0x1f, 0x1, 0xffffffffffffffff, 0xffffffffffffffff, {{@in6=@mcast2={0xff, 0x2, [], 0x1}}, @in=@dev={0xac, 0x14}}, []}, 0x40}, 0x1}, 0x0) 2018/02/01 16:23:01 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mkdir(&(0x7f000082f000)='./control\x00', 0x0) r0 = open(&(0x7f0000a08000)='./control\x00', 0x0, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x0, 0xffffffffffffffff, 0x0) symlinkat(&(0x7f00007ae000-0x8)='./file0\x00', r0, &(0x7f0000a31000-0xa)='./control\x00') r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000e4c000)={0xaa}) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000044000-0x20)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r2 = creat(&(0x7f00000df000)='./file0\x00', 0x0) write$sndseq(r2, &(0x7f0000012000-0x2e)=[{0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @time=@time={0x77359400}}], 0x30) link(&(0x7f0000b40000-0xa)='./file0\x00', &(0x7f00006b4000-0x10)='./control/file0\x00') utimensat(r0, &(0x7f0000e03000-0x10)='./control/file0\x00', &(0x7f00003e7000-0x10)={{}, {0x0, 0x2710}}, 0x0) 2018/02/01 16:23:01 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mkdir(&(0x7f000082f000)='./control\x00', 0x0) r0 = open(&(0x7f000080e000-0xa)='./control\x00', 0x0, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000bc8000)={0xaa}) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000d63000-0x20)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r2 = creat(&(0x7f000078e000-0x8)='./file0\x00', 0x0) write$sndseq(r2, &(0x7f0000012000-0x2e)=[{0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @time=@time={0x77359400}}], 0x1c) link(&(0x7f0000f3c000-0x8)='./file0\x00', &(0x7f00006b4000-0x10)='./control/file0\x00') getdents(r0, &(0x7f0000351000), 0x0) clone(0x0, &(0x7f0000251000+0xdca), &(0x7f0000744000), &(0x7f00008c8000), &(0x7f0000dad000-0x37)) dup2(r0, r1) 2018/02/01 16:23:01 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000f56000)={0x0, 0x0, &(0x7f0000576000-0x10)={&(0x7f0000334000-0x78)={0x2, 0x3, 0x0, 0x9, 0xa, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, [@sadb_address={0x3, 0x40000000000006, 0x0, 0x0, 0x0, @in={0x2, 0xffffffffffffffff, @loopback=0x7f000001}}, @sadb_sa={0x2, 0x1, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x2}, @sadb_address={0x3, 0x20000000000005, 0x0, 0x0, 0x0, @in={0x2, 0xffffffffffffffff, @broadcast=0xffffffff}}]}, 0x50}, 0x1}, 0x0) 2018/02/01 16:23:01 executing program 1: clock_adjtime(0x400, &(0x7f00004b2000-0xd0)) 2018/02/01 16:23:01 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$usbmon(&(0x7f0000fd1000-0xd)='/dev/usbmon#\x00', 0x0, 0x0) ioctl$KDSKBSENT(0xffffffffffffffff, 0x4b49, &(0x7f0000ddd000)="266b5d967b9a95bfa9e22cec1d685e20510fe95c") ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_TEMPO(r0, 0x40189206, &(0x7f0000ddd000)) 2018/02/01 16:23:01 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x0, 0x32, 0xffffffffffffffff, 0x0) msgrcv(0x0, &(0x7f0000497000-0x8), 0x8, 0x0, 0x3000) msgsnd(0x0, &(0x7f000010d000)={0x3}, 0x8, 0x0) 2018/02/01 16:23:01 executing program 2: mmap(&(0x7f0000000000/0x12000)=nil, 0x12000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket(0x18, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000005000-0x3c)=[{{&(0x7f0000003000)=@in6={0xa, 0xffffffffffffffff, 0x0, @remote={0xfe, 0x80, [], 0xffffffffffffffff, 0xbb}}, 0x1c, &(0x7f0000005000-0x60)=[{&(0x7f0000002000)="4c5614c00401a0dbf8a669ebdedd102c4f7a79e606457dfdf09e2ec2ed253b", 0x1f}], 0x1, &(0x7f0000003000-0x2d0)=[]}}], 0x1, 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000002000)={0x0, 0x0, 0x0, 0x0, 0x1, [{0xf03f}]}) r1 = socket(0x18, 0x0, 0x1) dup2(r1, r0) connect(r1, &(0x7f0000002000)=@sco={0x1f, {0x1}}, 0x26) ioctl$PPPIOCGMRU(r0, 0x80047453, &(0x7f000000c000)) 2018/02/01 16:23:01 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) futex(&(0x7f000000d000-0x4)=0x4, 0x80000000000b, 0x4, &(0x7f000000b000)={0x77359400}, &(0x7f0000048000), 0x0) futex(&(0x7f000000d000-0x4), 0x0, 0x0, &(0x7f000004a000-0x10), &(0x7f0000048000), 0x0) r0 = gettid() rt_sigsuspend(&(0x7f0000a94000), 0x8) socketpair$unix(0x1, 0x1, 0x0, &(0x7f000000d000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$int_in(r1, 0x5452, &(0x7f0000009000-0x8)=0x3f) recvfrom(r2, &(0x7f0000013000-0x8d), 0x0, 0x0, &(0x7f0000013000-0x10)=@ax25={0x6, {"2d13d4162d9f33"}}, 0x10) fcntl$setown(r1, 0x8, r0) fcntl$setsig(r1, 0xa, 0x12) dup2(r1, r2) tkill(r0, 0x16) 2018/02/01 16:23:01 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000f56000)={0x0, 0x0, &(0x7f0000576000-0x10)={&(0x7f0000334000-0x78)={0x2, 0x3, 0x0, 0x9, 0x7, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, [@sadb_address={0x3, 0x40000000000006, 0x0, 0x0, 0x0, @in={0x2, 0xffffffffffffffff, @loopback=0x7f000001}}, @sadb_sa={0x2, 0x1, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x2}]}, 0x38}, 0x1}, 0x0) 2018/02/01 16:23:01 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mkdir(&(0x7f000082f000)='./control\x00', 0x0) r0 = open(&(0x7f0000a08000)='./control\x00', 0x0, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x0, 0xffffffffffffffff, 0x0) symlinkat(&(0x7f00007ae000-0x8)='./file0\x00', r0, &(0x7f0000a31000-0xa)='./control\x00') r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000e4c000)={0xaa}) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000044000-0x20)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r2 = creat(&(0x7f00000df000)='./file0\x00', 0x0) write$sndseq(r2, &(0x7f0000012000-0x2e)=[{0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @time=@time={0x77359400}}], 0x30) link(&(0x7f0000b40000-0xa)='./file0\x00', &(0x7f00006b4000-0x10)='./control/file0\x00') utimensat(r0, &(0x7f0000e03000-0x10)='./control/file0\x00', &(0x7f00003e7000-0x10)={{}, {0x0, 0x2710}}, 0x0) 2018/02/01 16:23:01 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000a81000-0xa)='/dev/ptmx\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfda000)=nil, 0xfda000, 0x4, 0x31, 0xffffffffffffffff, 0x0) ioctl$int_in(r0, 0x80000000005406, &(0x7f000024a000-0x5)) 2018/02/01 16:23:01 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = gettid() rt_sigtimedwait(&(0x7f0000645000-0x8), &(0x7f0000ded000), &(0x7f000052f000)={0x40000077359400}, 0x8) pipe(&(0x7f0000d8c000-0x8)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000e13000-0x8)={0xffffffffffffffff, 0xffffffffffffffff}) tee(r1, r3, 0x80007387, 0x0) r4 = dup2(r2, r3) r5 = syz_open_dev$random(&(0x7f0000bdc000-0xc)='/dev/random\x00', 0x0, 0x0) dup2(r2, r5) ioctl$int_in(r4, 0x0, &(0x7f0000e36000-0x8)=0x45) fcntl$setown(r2, 0x8, r0) fcntl$setsig(r5, 0xa, 0x12) r6 = gettid() tkill(r6, 0x100000000000016) 2018/02/01 16:23:01 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mkdir(&(0x7f000082f000)='./control\x00', 0x0) r0 = open(&(0x7f000080e000-0xa)='./control\x00', 0x0, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000bc8000)={0xaa}) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000d63000-0x20)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r2 = creat(&(0x7f000078e000-0x8)='./file0\x00', 0x0) write$sndseq(r2, &(0x7f0000012000-0x2e)=[{0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @time=@time={0x77359400}}], 0x1c) link(&(0x7f0000f3c000-0x8)='./file0\x00', &(0x7f00006b4000-0x10)='./control/file0\x00') getdents(r0, &(0x7f0000351000), 0x0) clone(0x0, &(0x7f0000251000+0xdca), &(0x7f0000744000), &(0x7f00008c8000), &(0x7f0000dad000-0x37)) dup2(r0, r1) 2018/02/01 16:23:01 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mkdir(&(0x7f000082f000)='./control\x00', 0x0) r0 = open(&(0x7f0000a08000)='./control\x00', 0x0, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x0, 0xffffffffffffffff, 0x0) symlinkat(&(0x7f00007ae000-0x8)='./file0\x00', r0, &(0x7f0000a31000-0xa)='./control\x00') r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000e4c000)={0xaa}) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000044000-0x20)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r2 = creat(&(0x7f00000df000)='./file0\x00', 0x0) write$sndseq(r2, &(0x7f0000012000-0x2e)=[{0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @time=@time={0x77359400}}], 0x30) link(&(0x7f0000b40000-0xa)='./file0\x00', &(0x7f00006b4000-0x10)='./control/file0\x00') utimensat(r0, &(0x7f0000e03000-0x10)='./control/file0\x00', &(0x7f00003e7000-0x10)={{}, {0x0, 0x2710}}, 0x0) 2018/02/01 16:23:01 executing program 2: mmap(&(0x7f0000000000/0x12000)=nil, 0x12000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket(0x18, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000005000-0x3c)=[], 0x0, 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000002000)={0x0, 0x0, 0x0, 0x0, 0x1, [{0xf03f}]}) r1 = socket(0x18, 0x0, 0x1) dup2(r1, r0) connect(r1, &(0x7f0000002000)=@sco={0x1f, {0x1}}, 0x26) ioctl$PPPIOCGMRU(r0, 0x80047453, &(0x7f000000c000)) 2018/02/01 16:23:01 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000f56000)={0x0, 0x0, &(0x7f0000576000-0x10)={&(0x7f0000334000-0x78)={0x2, 0x3, 0x0, 0x9, 0x7, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, [@sadb_address={0x3, 0x40000000000006, 0x0, 0x0, 0x0, @in={0x2, 0xffffffffffffffff, @loopback=0x7f000001}}, @sadb_sa={0x2, 0x1, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x2}]}, 0x38}, 0x1}, 0x0) 2018/02/01 16:23:02 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2000000000001, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000687000)=0x5c802861, 0x4) setsockopt$inet6_int(r0, 0x29, 0xb, &(0x7f0000ffc000)=0xbd, 0x4) bind$inet6(r0, &(0x7f0000402000)={0xa, 0x0, 0x0, @loopback={0x0, 0x1}}, 0x1c) sendto$inet6(r0, &(0x7f00007a9000-0x1), 0x0, 0xfffffefffffffffe, &(0x7f0000f63000-0x1c)={0xa, 0x0, 0x0, @loopback={0x0, 0x1}}, 0x1c) getsockopt$inet6_buf(r0, 0x29, 0x6, &(0x7f0000501000)=""/95, &(0x7f0000f12000)=0x5f) 2018/02/01 16:23:02 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mkdir(&(0x7f000082f000)='./control\x00', 0x0) r0 = open(&(0x7f0000a08000)='./control\x00', 0x0, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) symlinkat(&(0x7f00007ae000-0x8)='./file0\x00', 0xffffffffffffffff, &(0x7f0000a31000-0xa)='./control\x00') r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000e4c000)={0xaa}) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000044000-0x20)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r2 = creat(&(0x7f00000df000)='./file0\x00', 0x0) write$sndseq(r2, &(0x7f0000012000-0x2e)=[{0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @time=@time={0x77359400}}], 0x30) link(&(0x7f0000b40000-0xa)='./file0\x00', &(0x7f00006b4000-0x10)='./control/file0\x00') utimensat(r0, &(0x7f0000e03000-0x10)='./control/file0\x00', &(0x7f00003e7000-0x10)={{}, {0x0, 0x2710}}, 0x0) 2018/02/01 16:23:02 executing program 2: mmap(&(0x7f0000000000/0x12000)=nil, 0x12000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket(0x18, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000005000-0x3c)=[], 0x0, 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000002000)={0x0, 0x0, 0x0, 0x0, 0x1, [{0xf03f}]}) r1 = socket(0x18, 0x0, 0x1) dup2(r1, r0) connect(r1, &(0x7f0000002000)=@sco={0x1f, {0x1}}, 0x26) ioctl$PPPIOCGMRU(r0, 0x80047453, &(0x7f000000c000)) 2018/02/01 16:23:02 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x0, 0xffffffffffffffff, 0x0) msgrcv(0x0, &(0x7f0000497000-0x8), 0x8, 0x0, 0x3000) msgsnd(0x0, &(0x7f000010d000)={0x3}, 0x8, 0x0) 2018/02/01 16:23:02 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000f56000)={0x0, 0x0, &(0x7f0000576000-0x10)={&(0x7f0000334000-0x78)={0x2, 0x3, 0x0, 0x9, 0x7, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, [@sadb_address={0x3, 0x40000000000006, 0x0, 0x0, 0x0, @in={0x2, 0xffffffffffffffff, @loopback=0x7f000001}}, @sadb_sa={0x2, 0x1, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x2}]}, 0x38}, 0x1}, 0x0) 2018/02/01 16:23:02 executing program 2: mmap(&(0x7f0000000000/0x12000)=nil, 0x12000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket(0x18, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000005000-0x3c)=[], 0x0, 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000002000)={0x0, 0x0, 0x0, 0x0, 0x1, [{0xf03f}]}) r1 = socket(0x18, 0x0, 0x1) dup2(r1, r0) connect(r1, &(0x7f0000002000)=@sco={0x1f, {0x1}}, 0x26) ioctl$PPPIOCGMRU(r0, 0x80047453, &(0x7f000000c000)) 2018/02/01 16:23:02 executing program 2: mmap(&(0x7f0000000000/0x12000)=nil, 0x12000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket(0x18, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000005000-0x3c)=[{{&(0x7f0000003000)=@in6={0xa, 0xffffffffffffffff, 0x0, @remote={0xfe, 0x80, [], 0xffffffffffffffff, 0xbb}}, 0x1c, &(0x7f0000005000-0x60)=[], 0x0, &(0x7f0000003000-0x2d0)=[]}}], 0x1, 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000002000)={0x0, 0x0, 0x0, 0x0, 0x1, [{0xf03f}]}) r1 = socket(0x18, 0x0, 0x1) dup2(r1, r0) connect(r1, &(0x7f0000002000)=@sco={0x1f, {0x1}}, 0x26) ioctl$PPPIOCGMRU(r0, 0x80047453, &(0x7f000000c000)) 2018/02/01 16:23:02 executing program 4: clone(0x0, &(0x7f0000428000-0x26), &(0x7f0000fa4000), &(0x7f0000ec1000-0x4), &(0x7f000066b000)) getrandom(&(0x7f0000001000-0x52)=""/82, 0x52, 0x0) 2018/02/01 16:23:02 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x0, 0xffffffffffffffff, 0x0) msgrcv(0x0, &(0x7f0000497000-0x8), 0x8, 0x0, 0x3000) msgsnd(0x0, &(0x7f000010d000)={0x3}, 0x8, 0x0) 2018/02/01 16:23:02 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = gettid() rt_sigtimedwait(&(0x7f0000645000-0x8), &(0x7f0000ded000), &(0x7f000052f000)={0x40000077359400}, 0x8) pipe(&(0x7f0000d8c000-0x8)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000e13000-0x8)={0xffffffffffffffff, 0xffffffffffffffff}) tee(r1, r3, 0x80007387, 0x0) r4 = dup2(r2, r3) r5 = syz_open_dev$random(&(0x7f0000bdc000-0xc)='/dev/random\x00', 0x0, 0x0) dup2(r2, r5) ioctl$int_in(r4, 0x0, &(0x7f0000e36000-0x8)=0x45) fcntl$setown(r2, 0x8, r0) fcntl$setsig(r5, 0xa, 0x12) r6 = gettid() tkill(r6, 0x100000000000016) 2018/02/01 16:23:02 executing program 2: mmap(&(0x7f0000000000/0x12000)=nil, 0x12000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket(0x18, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000005000-0x3c)=[{{&(0x7f0000003000)=@in6={0xa, 0xffffffffffffffff, 0x0, @remote={0xfe, 0x80, [], 0xffffffffffffffff, 0xbb}}, 0x1c, &(0x7f0000005000-0x60)=[], 0x0, &(0x7f0000003000-0x2d0)=[]}}], 0x1, 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000002000)={0x0, 0x0, 0x0, 0x0, 0x1, [{0xf03f}]}) r1 = socket(0x18, 0x0, 0x1) dup2(r1, r0) connect(r1, &(0x7f0000002000)=@sco={0x1f, {0x1}}, 0x26) ioctl$PPPIOCGMRU(r0, 0x80047453, &(0x7f000000c000)) 2018/02/01 16:23:02 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mkdir(&(0x7f000082f000)='./control\x00', 0x0) r0 = open(&(0x7f0000a08000)='./control\x00', 0x0, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) symlinkat(&(0x7f00007ae000-0x8)='./file0\x00', 0xffffffffffffffff, &(0x7f0000a31000-0xa)='./control\x00') r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000e4c000)={0xaa}) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000044000-0x20)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r2 = creat(&(0x7f00000df000)='./file0\x00', 0x0) write$sndseq(r2, &(0x7f0000012000-0x2e)=[{0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @time=@time={0x77359400}}], 0x30) link(&(0x7f0000b40000-0xa)='./file0\x00', &(0x7f00006b4000-0x10)='./control/file0\x00') utimensat(r0, &(0x7f0000e03000-0x10)='./control/file0\x00', &(0x7f00003e7000-0x10)={{}, {0x0, 0x2710}}, 0x0) 2018/02/01 16:23:02 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000f56000)={0x0, 0x0, &(0x7f0000576000-0x10)={&(0x7f0000334000-0x78)={0x2, 0x3, 0x0, 0x9, 0xa, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, [@sadb_address={0x3, 0x40000000000006, 0x0, 0x0, 0x0, @in={0x2, 0xffffffffffffffff, @loopback=0x7f000001}}, @sadb_sa={0x2, 0x1, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x2}, @sadb_address={0x3, 0x0, 0x0, 0x0, 0x0, @in={0x2, 0xffffffffffffffff, @broadcast=0xffffffff}}]}, 0x50}, 0x1}, 0x0) 2018/02/01 16:23:02 executing program 1: mmap(&(0x7f0000000000/0xfe9000)=nil, 0xfe9000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x0, 0x0) r1 = epoll_create(0xc) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c3c000-0xc)) ioctl$TIOCPKT(r0, 0x5420, &(0x7f00003b9000-0x4)=0x51) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003ba000-0x24)) r2 = syz_open_pts(r0, 0x0) ioctl$TCFLSH(r2, 0x540b, 0x2) 2018/02/01 16:23:02 executing program 3: clone(0x0, &(0x7f0000d51000), &(0x7f0000744000), &(0x7f0000646000-0x4), &(0x7f00001a2000)) rt_sigprocmask(0x0, &(0x7f0000602000-0x8), &(0x7f0000503000-0x8), 0x8) 2018/02/01 16:23:02 executing program 2: mmap(&(0x7f0000000000/0x12000)=nil, 0x12000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket(0x18, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000005000-0x3c)=[{{&(0x7f0000003000)=@in6={0xa, 0xffffffffffffffff, 0x0, @remote={0xfe, 0x80, [], 0xffffffffffffffff, 0xbb}}, 0x1c, &(0x7f0000005000-0x60)=[], 0x0, &(0x7f0000003000-0x2d0)=[]}}], 0x1, 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000002000)={0x0, 0x0, 0x0, 0x0, 0x1, [{0xf03f}]}) r1 = socket(0x18, 0x0, 0x1) dup2(r1, r0) connect(r1, &(0x7f0000002000)=@sco={0x1f, {0x1}}, 0x26) ioctl$PPPIOCGMRU(r0, 0x80047453, &(0x7f000000c000)) 2018/02/01 16:23:02 executing program 3: mmap(&(0x7f0000000000/0xb3c000)=nil, 0xb3c000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r0 = socket(0x2, 0x1, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000892000)) epoll_wait(r1, &(0x7f00001c9000-0xc)=[{}], 0x1, 0x0) 2018/02/01 16:23:03 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000f56000)={0x0, 0x0, &(0x7f0000576000-0x10)={&(0x7f0000334000-0x78)={0x2, 0x3, 0x0, 0x9, 0xa, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, [@sadb_address={0x3, 0x40000000000006, 0x0, 0x0, 0x0, @in={0x2, 0xffffffffffffffff, @loopback=0x7f000001}}, @sadb_sa={0x2, 0x1, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x2}, @sadb_address={0x3, 0x0, 0x0, 0x0, 0x0, @in={0x2, 0xffffffffffffffff, @broadcast=0xffffffff}}]}, 0x50}, 0x1}, 0x0) 2018/02/01 16:23:03 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mkdir(&(0x7f000082f000)='./control\x00', 0x0) r0 = open(&(0x7f0000a08000)='./control\x00', 0x0, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) symlinkat(&(0x7f00007ae000-0x8)='./file0\x00', 0xffffffffffffffff, &(0x7f0000a31000-0xa)='./control\x00') r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000e4c000)={0xaa}) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000044000-0x20)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r2 = creat(&(0x7f00000df000)='./file0\x00', 0x0) write$sndseq(r2, &(0x7f0000012000-0x2e)=[{0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @time=@time={0x77359400}}], 0x30) link(&(0x7f0000b40000-0xa)='./file0\x00', &(0x7f00006b4000-0x10)='./control/file0\x00') utimensat(r0, &(0x7f0000e03000-0x10)='./control/file0\x00', &(0x7f00003e7000-0x10)={{}, {0x0, 0x2710}}, 0x0) 2018/02/01 16:23:03 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) openat$hwrng(0xffffffffffffff9c, &(0x7f0000970000)='/dev/hwrng\x00', 0x80500, 0x0) r0 = syz_open_dev$sg(&(0x7f0000266000-0x9)='/dev/sg#\x00', 0x0, 0x2) write$tun(r0, &(0x7f0000dae000)=@hdr={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @ipv4={{0x5, 0x4, 0x0, 0x0, 0x28, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @multicast2=0xe0000002, @multicast1=0xe0000001, {[]}}, @tcp={{0xffffffffffffffff, 0xffffffffffffffff, 0x42424242, 0x42424242, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, {[]}}}}}, 0x3ba) ioctl(r0, 0x227c, &(0x7f000097e000)) 2018/02/01 16:23:03 executing program 2: mmap(&(0x7f0000000000/0x12000)=nil, 0x12000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket(0x18, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000005000-0x3c)=[{{&(0x7f0000003000)=@in6={0xa, 0xffffffffffffffff, 0x0, @remote={0xfe, 0x80, [], 0xffffffffffffffff, 0xbb}}, 0x1c, &(0x7f0000005000-0x60)=[{&(0x7f0000002000)}], 0x1, &(0x7f0000003000-0x2d0)=[]}}], 0x1, 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000002000)={0x0, 0x0, 0x0, 0x0, 0x1, [{0xf03f}]}) r1 = socket(0x18, 0x0, 0x1) dup2(r1, r0) connect(r1, &(0x7f0000002000)=@sco={0x1f, {0x1}}, 0x26) ioctl$PPPIOCGMRU(r0, 0x80047453, &(0x7f000000c000)) 2018/02/01 16:23:03 executing program 1: mmap(&(0x7f0000000000/0xfd6000)=nil, 0xfd6000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x8000000000000802, 0x0) bind$inet6(r0, &(0x7f0000fd5000)={0xa, 0xffffffffffffffff, 0x0, @ipv4={[], [0xff, 0xff], @rand_addr=0xff}}, 0x1c) sendmsg$inet_sctp(r0, &(0x7f0000a29000)={&(0x7f0000686000-0x10)=@in={0x2, 0x3, @empty}, 0x10, &(0x7f0000fc6000-0x40)=[]}, 0x0) 2018/02/01 16:23:03 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x0, 0xffffffffffffffff, 0x0) msgrcv(0x0, &(0x7f0000497000-0x8), 0x8, 0x0, 0x3000) msgsnd(0x0, &(0x7f000010d000)={0x3}, 0x8, 0x0) 2018/02/01 16:23:03 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = gettid() rt_sigtimedwait(&(0x7f0000645000-0x8), &(0x7f0000ded000), &(0x7f000052f000)={0x40000077359400}, 0x8) pipe(&(0x7f0000d8c000-0x8)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000e13000-0x8)={0xffffffffffffffff, 0xffffffffffffffff}) tee(r1, r3, 0x80007387, 0x0) r4 = dup2(r2, r3) r5 = syz_open_dev$random(&(0x7f0000bdc000-0xc)='/dev/random\x00', 0x0, 0x0) dup2(r2, r5) ioctl$int_in(r4, 0x5452, &(0x7f0000e36000-0x8)) fcntl$setown(r2, 0x8, r0) fcntl$setsig(r5, 0xa, 0x12) r6 = gettid() tkill(r6, 0x100000000000016) 2018/02/01 16:23:03 executing program 3: mmap(&(0x7f0000000000/0x10000)=nil, 0x10000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket(0x18, 0x0, 0x1) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(0xffffffffffffffff, 0x6, 0x16, &(0x7f0000002000)=[{}, {}, {}, {}, {0x1}], 0x5) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f000000f000)={@generic="ed8d3b1c0a88d6cb577d6e1c5f08c36a"}) sendmmsg(0xffffffffffffffff, &(0x7f0000005000)=[{{&(0x7f0000007000)=@in6={0xa, 0xffffffffffffffff, 0x0, @remote={0xfe, 0x80, [], 0xffffffffffffffff, 0xbb}}, 0x1c, &(0x7f0000005000-0x60)=[{&(0x7f0000002000)="4c5614c00401a0dbf8a669ebdedd102c4f7a79e606457dfdf09e2ec2ed253b", 0x1f}], 0x1, &(0x7f0000009000-0x438)=[]}}], 0x1, 0x0) connect(r0, &(0x7f0000002000)=@sco={0x1f, {0x1}}, 0x26) ioctl$SIOCGIFMTU(r0, 0x8921, &(0x7f0000010000-0x28)={@generic}) 2018/02/01 16:23:03 executing program 2: mmap(&(0x7f0000000000/0x12000)=nil, 0x12000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket(0x18, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000005000-0x3c)=[{{&(0x7f0000003000)=@in6={0xa, 0xffffffffffffffff, 0x0, @remote={0xfe, 0x80, [], 0xffffffffffffffff, 0xbb}}, 0x1c, &(0x7f0000005000-0x60)=[{&(0x7f0000002000)}], 0x1, &(0x7f0000003000-0x2d0)=[]}}], 0x1, 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000002000)={0x0, 0x0, 0x0, 0x0, 0x1, [{0xf03f}]}) r1 = socket(0x18, 0x0, 0x1) dup2(r1, r0) connect(r1, &(0x7f0000002000)=@sco={0x1f, {0x1}}, 0x26) ioctl$PPPIOCGMRU(r0, 0x80047453, &(0x7f000000c000)) 2018/02/01 16:23:03 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000f56000)={0x0, 0x0, &(0x7f0000576000-0x10)={&(0x7f0000334000-0x78)={0x2, 0x3, 0x0, 0x9, 0xa, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, [@sadb_address={0x3, 0x40000000000006, 0x0, 0x0, 0x0, @in={0x2, 0xffffffffffffffff, @loopback=0x7f000001}}, @sadb_sa={0x2, 0x1, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x2}, @sadb_address={0x3, 0x0, 0x0, 0x0, 0x0, @in={0x2, 0xffffffffffffffff, @broadcast=0xffffffff}}]}, 0x50}, 0x1}, 0x0) 2018/02/01 16:23:03 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = syz_open_dev$tun(&(0x7f0000520000-0xd)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000a5b000-0x28)={@common='gre0\x00', @ifru_settings={0x2, 0x0, @raw_hdlc=&(0x7f00004a3000)}}) ioctl$sock_inet_SIOCSIFADDR(r0, 0x8916, &(0x7f0000b90000-0x20)={@common='gre0\x00', @ifru_addrs={0x2, 0xffffffffffffffff, @rand_addr}}) 2018/02/01 16:23:03 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket(0x10, 0x2, 0x0) sendmsg$nl_route(r0, &(0x7f0000504000)={&(0x7f0000dff000-0xc)={0x10}, 0xb, &(0x7f000009b000)={&(0x7f0000c31000)=@newlink={0x1f, 0x10, 0x9, 0xffffffffffffffff, 0xffffffffffffffff, {}, [@IFLA_IFNAME={0x14, 0x3, @syzn={0x73, 0x79, 0x7a}}, @IFLA_AF_SPEC={0x8, 0x1a, [{0x4}]}]}, 0x3c}, 0x1}, 0x0) 2018/02/01 16:23:03 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000cd1000-0x38)={0x0, 0x0, &(0x7f0000ca6000)={&(0x7f00003f4000-0x10a8)={0x2, 0xd, 0x0, 0x0, 0xd, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, [@sadb_x_sec_ctx={0x1, 0x18}, @sadb_address={0x5, 0x5, 0x0, 0x0, 0x0, @in6={0xa, 0x0, 0x0, @ipv4={[], [0xff, 0xff], @dev={0xac, 0x14}}}}, @sadb_address={0x5, 0x6, 0x0, 0x0, 0x0, @in6={0xa, 0xffffffffffffffff, 0x0, @remote={0xfe, 0x80, [], 0xffffffffffffffff, 0xbb}}}]}, 0x68}, 0x1}, 0x0) 2018/02/01 16:23:03 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) capset(&(0x7f0000000000)={0x19980330}, &(0x7f0000002000-0x18)) socket$packet(0x11, 0x0, 0x300) 2018/02/01 16:23:03 executing program 2: mmap(&(0x7f0000000000/0x12000)=nil, 0x12000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket(0x18, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000005000-0x3c)=[{{&(0x7f0000003000)=@in6={0xa, 0xffffffffffffffff, 0x0, @remote={0xfe, 0x80, [], 0xffffffffffffffff, 0xbb}}, 0x1c, &(0x7f0000005000-0x60)=[{&(0x7f0000002000)}], 0x1, &(0x7f0000003000-0x2d0)=[]}}], 0x1, 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000002000)={0x0, 0x0, 0x0, 0x0, 0x1, [{0xf03f}]}) r1 = socket(0x18, 0x0, 0x1) dup2(r1, r0) connect(r1, &(0x7f0000002000)=@sco={0x1f, {0x1}}, 0x26) ioctl$PPPIOCGMRU(r0, 0x80047453, &(0x7f000000c000)) 2018/02/01 16:23:03 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) msgrcv(0x0, &(0x7f0000497000-0x8), 0x8, 0x0, 0x0) msgsnd(0x0, &(0x7f000010d000)={0x3}, 0x8, 0x0) 2018/02/01 16:23:03 executing program 2: mmap(&(0x7f0000000000/0x12000)=nil, 0x12000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket(0x18, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000005000-0x3c)=[{{&(0x7f0000003000)=@in6={0xa, 0xffffffffffffffff, 0x0, @remote={0xfe, 0x80, [], 0xffffffffffffffff, 0xbb}}, 0x1c, &(0x7f0000005000-0x60)=[{&(0x7f0000002000)="4c5614c00401a0dbf8a669ebdedd102c", 0x10}], 0x1, &(0x7f0000003000-0x2d0)=[]}}], 0x1, 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000002000)={0x0, 0x0, 0x0, 0x0, 0x1, [{0xf03f}]}) r1 = socket(0x18, 0x0, 0x1) dup2(r1, r0) connect(r1, &(0x7f0000002000)=@sco={0x1f, {0x1}}, 0x26) ioctl$PPPIOCGMRU(r0, 0x80047453, &(0x7f000000c000)) 2018/02/01 16:23:03 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000619000-0xd)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000397000-0xb0)={{0x80}, "706f72ff070000000000007fffffff000000000000000000000000001f0000001f000000000000000003ff00000000000000000000000000000000000600", 0xc3, 0x80003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0xffffffffffffffff}) openat$sequencer2(0xffffffffffffff9c, &(0x7f00006cf000-0x10)='/dev/sequencer2\x00', 0x4002, 0x0) 2018/02/01 16:23:03 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) msgrcv(0x0, &(0x7f0000497000-0x8), 0x8, 0x0, 0x0) msgsnd(0x0, &(0x7f000010d000)={0x3}, 0x8, 0x0) 2018/02/01 16:23:03 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x802, 0x0) connect(r0, &(0x7f0000eae000-0x1c)=@in6={0xa, 0x0, 0x0, @local={0xfe, 0x80, [], 0x0, 0xaa}, 0x5}, 0x1c) connect$inet6(r0, &(0x7f0000264000-0x1c)={0xa, 0x0, 0x0, @local={0xfe, 0x80, [], 0x0, 0xaa}, 0x10000000000005}, 0x1c) 2018/02/01 16:23:03 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sg(&(0x7f0000005000)='/dev/sg#\x00', 0x0, 0x8002) write$evdev(r0, &(0x7f0000a59000)=[{{0x0, 0x7530}}, {}], 0x30) ioctl(r0, 0x2286, &(0x7f0000c96000-0x2)) 2018/02/01 16:23:03 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = gettid() rt_sigtimedwait(&(0x7f0000645000-0x8), &(0x7f0000ded000), &(0x7f000052f000)={0x40000077359400}, 0x8) pipe(&(0x7f0000d8c000-0x8)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000e13000-0x8)={0xffffffffffffffff, 0xffffffffffffffff}) tee(r1, r3, 0x80007387, 0x0) r4 = dup2(r2, r3) r5 = syz_open_dev$random(&(0x7f0000bdc000-0xc)='/dev/random\x00', 0x0, 0x0) dup2(r2, r5) ioctl$int_in(r4, 0x5452, &(0x7f0000e36000-0x8)) fcntl$setown(r2, 0x8, r0) fcntl$setsig(r5, 0xa, 0x12) r6 = gettid() tkill(r6, 0x100000000000016) 2018/02/01 16:23:03 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = memfd_create(&(0x7f0000503000)='/dev/vga_arbiter\x00', 0x0) r1 = syz_open_procfs(0x0, &(0x7f00008ff000-0x8)='net/udp\x00') sendfile(r0, r1, &(0x7f00006dc000-0x8), 0x401) 2018/02/01 16:23:03 executing program 2: mmap(&(0x7f0000000000/0x12000)=nil, 0x12000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket(0x18, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000005000-0x3c)=[{{&(0x7f0000003000)=@in6={0xa, 0xffffffffffffffff, 0x0, @remote={0xfe, 0x80, [], 0xffffffffffffffff, 0xbb}}, 0x1c, &(0x7f0000005000-0x60)=[{&(0x7f0000002000)="4c5614c00401a0dbf8a669ebdedd102c", 0x10}], 0x1, &(0x7f0000003000-0x2d0)=[]}}], 0x1, 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000002000)={0x0, 0x0, 0x0, 0x0, 0x1, [{0xf03f}]}) r1 = socket(0x18, 0x0, 0x1) dup2(r1, r0) connect(r1, &(0x7f0000002000)=@sco={0x1f, {0x1}}, 0x26) ioctl$PPPIOCGMRU(r0, 0x80047453, &(0x7f000000c000)) 2018/02/01 16:23:03 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mkdir(&(0x7f000082f000)='./control\x00', 0x0) r0 = open(&(0x7f0000a08000)='./control\x00', 0x0, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) symlinkat(&(0x7f00007ae000-0x8)='./file0\x00', r0, &(0x7f0000a31000-0xa)='./control\x00') r1 = userfaultfd(0x0) ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f0000e4c000)={0xaa}) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000044000-0x20)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r2 = creat(&(0x7f00000df000)='./file0\x00', 0x0) write$sndseq(r2, &(0x7f0000012000-0x2e)=[{0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @time=@time={0x77359400}}], 0x30) link(&(0x7f0000b40000-0xa)='./file0\x00', &(0x7f00006b4000-0x10)='./control/file0\x00') utimensat(r0, &(0x7f0000e03000-0x10)='./control/file0\x00', &(0x7f00003e7000-0x10)={{}, {0x0, 0x2710}}, 0x0) 2018/02/01 16:23:03 executing program 2: mmap(&(0x7f0000000000/0x12000)=nil, 0x12000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket(0x18, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000005000-0x3c)=[{{&(0x7f0000003000)=@in6={0xa, 0xffffffffffffffff, 0x0, @remote={0xfe, 0x80, [], 0xffffffffffffffff, 0xbb}}, 0x1c, &(0x7f0000005000-0x60)=[{&(0x7f0000002000)="4c5614c00401a0dbf8a669ebdedd102c", 0x10}], 0x1, &(0x7f0000003000-0x2d0)=[]}}], 0x1, 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000002000)={0x0, 0x0, 0x0, 0x0, 0x1, [{0xf03f}]}) r1 = socket(0x18, 0x0, 0x1) dup2(r1, r0) connect(r1, &(0x7f0000002000)=@sco={0x1f, {0x1}}, 0x26) ioctl$PPPIOCGMRU(r0, 0x80047453, &(0x7f000000c000)) 2018/02/01 16:23:03 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mkdir(&(0x7f000082f000)='./control\x00', 0x0) r0 = open(&(0x7f0000a08000)='./control\x00', 0x0, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) symlinkat(&(0x7f00007ae000-0x8)='./file0\x00', r0, &(0x7f0000a31000-0xa)='./control\x00') r1 = userfaultfd(0x0) ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f0000e4c000)={0xaa}) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000044000-0x20)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r2 = creat(&(0x7f00000df000)='./file0\x00', 0x0) write$sndseq(r2, &(0x7f0000012000-0x2e)=[{0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @time=@time={0x77359400}}], 0x30) link(&(0x7f0000b40000-0xa)='./file0\x00', &(0x7f00006b4000-0x10)='./control/file0\x00') utimensat(r0, &(0x7f0000e03000-0x10)='./control/file0\x00', &(0x7f00003e7000-0x10)={{}, {0x0, 0x2710}}, 0x0) 2018/02/01 16:23:03 executing program 1: mmap(&(0x7f0000000000/0xef2000)=nil, 0xef2000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x2, 0x0) setsockopt$inet_int(r0, 0x0, 0x14, &(0x7f00004c3000-0x4)=0x1, 0x4) setsockopt$inet_int(r0, 0x0, 0x12, &(0x7f0000eef000-0x4)=0x401, 0x4) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f000046a000-0x4)=0x7fe, 0x4) sendto$inet(r0, &(0x7f0000edf000), 0x0, 0x0, &(0x7f0000eea000-0x10)={0x2, 0x0, @empty}, 0x10) recvmsg(r0, &(0x7f0000ee0000-0x38)={0x0, 0x0, &(0x7f0000aea000)=[], 0x0, &(0x7f0000eed000)=""/81, 0x51}, 0x40002102) 2018/02/01 16:23:03 executing program 7: r0 = socket$inet(0x2, 0x80001, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x40087602, &(0x7f000000b000-0x28)={@syzn={0x73, 0x79, 0x7a}}) 2018/02/01 16:23:03 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = signalfd(0xffffffffffffffff, &(0x7f00007af000-0x8), 0x8) mkdir(&(0x7f000002a000-0xa)='./control\x00', 0x0) read(r0, &(0x7f0000e6e000-0x1000)=""/384, 0x180) r1 = inotify_init1(0x0) fcntl$setstatus(r1, 0x4, 0x72109c5fef5d34d3) r2 = gettid() fcntl$setown(r1, 0x8, r2) rt_sigprocmask(0x0, &(0x7f000003b000)={0xfffff7fffffffffe}, 0x0, 0x8) fcntl$setsig(r1, 0xa, 0x20) inotify_add_watch(r1, &(0x7f00007a7000)='./control\x00', 0xa4000960) dup3(r1, r0, 0x0) open(&(0x7f00003f5000)='./control\x00', 0x0, 0x0) 2018/02/01 16:23:03 executing program 4: clone(0x0, &(0x7f0000a55000), &(0x7f0000eaa000-0x4), &(0x7f0000bf3000-0x4), &(0x7f00003b9000-0xcd)) utimensat(0xffffffffffffffff, &(0x7f0000eb5000)='./file0\x00', &(0x7f000064b000)={{0x0, 0x7530}}, 0x0) 2018/02/01 16:23:03 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) msgrcv(0x0, &(0x7f0000497000-0x8), 0x8, 0x0, 0x0) msgsnd(0x0, &(0x7f000010d000)={0x3}, 0x8, 0x0) 2018/02/01 16:23:03 executing program 2: mmap(&(0x7f0000000000/0x12000)=nil, 0x12000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket(0x18, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000005000-0x3c)=[{{&(0x7f0000003000)=@in6={0xa, 0xffffffffffffffff, 0x0, @remote={0xfe, 0x80, [], 0xffffffffffffffff, 0xbb}}, 0x1c, &(0x7f0000005000-0x60)=[{&(0x7f0000002000)="4c5614c00401a0dbf8a669ebdedd102c4f7a79e606457dfd", 0x18}], 0x1, &(0x7f0000003000-0x2d0)=[]}}], 0x1, 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000002000)={0x0, 0x0, 0x0, 0x0, 0x1, [{0xf03f}]}) r1 = socket(0x18, 0x0, 0x1) dup2(r1, r0) connect(r1, &(0x7f0000002000)=@sco={0x1f, {0x1}}, 0x26) ioctl$PPPIOCGMRU(r0, 0x80047453, &(0x7f000000c000)) 2018/02/01 16:23:03 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mkdir(&(0x7f000082f000)='./control\x00', 0x0) r0 = open(&(0x7f0000a08000)='./control\x00', 0x0, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) symlinkat(&(0x7f00007ae000-0x8)='./file0\x00', r0, &(0x7f0000a31000-0xa)='./control\x00') r1 = userfaultfd(0x0) ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f0000e4c000)={0xaa}) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000044000-0x20)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r2 = creat(&(0x7f00000df000)='./file0\x00', 0x0) write$sndseq(r2, &(0x7f0000012000-0x2e)=[{0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @time=@time={0x77359400}}], 0x30) link(&(0x7f0000b40000-0xa)='./file0\x00', &(0x7f00006b4000-0x10)='./control/file0\x00') utimensat(r0, &(0x7f0000e03000-0x10)='./control/file0\x00', &(0x7f00003e7000-0x10)={{}, {0x0, 0x2710}}, 0x0) 2018/02/01 16:23:04 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = memfd_create(&(0x7f0000756000-0x3)=',&\x00', 0x0) rt_sigaction(0x6, &(0x7f0000de8000-0x20)={0xfffffffffffffffe}, &(0x7f0000278000), 0x8, &(0x7f0000b0e000)) mmap(&(0x7f0000000000/0xaa2000)=nil, 0xaa2000, 0x9, 0x11, r0, 0x0) rt_sigaction(0x7, &(0x7f0000fc3000-0x20)={0x428421, {0x400003ffffffb}}, &(0x7f000093d000-0x20), 0x8, &(0x7f0000b89000-0x8)) syz_open_procfs(0x0, &(0x7f000032d000-0x9)='net/tcp6\x00') 2018/02/01 16:23:04 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = gettid() rt_sigtimedwait(&(0x7f0000645000-0x8), &(0x7f0000ded000), &(0x7f000052f000)={0x40000077359400}, 0x8) pipe(&(0x7f0000d8c000-0x8)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000e13000-0x8)={0xffffffffffffffff, 0xffffffffffffffff}) tee(r1, r3, 0x80007387, 0x0) r4 = dup2(r2, r3) r5 = syz_open_dev$random(&(0x7f0000bdc000-0xc)='/dev/random\x00', 0x0, 0x0) dup2(r2, r5) ioctl$int_in(r4, 0x5452, &(0x7f0000e36000-0x8)) fcntl$setown(r2, 0x8, r0) fcntl$setsig(r5, 0xa, 0x12) r6 = gettid() tkill(r6, 0x100000000000016) 2018/02/01 16:23:04 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = signalfd(0xffffffffffffffff, &(0x7f00007af000-0x8), 0x8) mkdir(&(0x7f000002a000-0xa)='./control\x00', 0x0) read(r0, &(0x7f0000e6e000-0x1000)=""/384, 0x180) r1 = inotify_init1(0x0) fcntl$setstatus(r1, 0x4, 0x72109c5fef5d34d3) r2 = gettid() fcntl$setown(r1, 0x8, r2) rt_sigprocmask(0x0, &(0x7f000003b000)={0xfffff7fffffffffe}, 0x0, 0x8) fcntl$setsig(r1, 0xa, 0x20) inotify_add_watch(r1, &(0x7f00007a7000)='./control\x00', 0xa4000960) dup3(r1, r0, 0x0) open(&(0x7f00003f5000)='./control\x00', 0x0, 0x0) 2018/02/01 16:23:04 executing program 2: mmap(&(0x7f0000000000/0x12000)=nil, 0x12000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket(0x18, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000005000-0x3c)=[{{&(0x7f0000003000)=@in6={0xa, 0xffffffffffffffff, 0x0, @remote={0xfe, 0x80, [], 0xffffffffffffffff, 0xbb}}, 0x1c, &(0x7f0000005000-0x60)=[{&(0x7f0000002000)="4c5614c00401a0dbf8a669ebdedd102c4f7a79e606457dfd", 0x18}], 0x1, &(0x7f0000003000-0x2d0)=[]}}], 0x1, 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000002000)={0x0, 0x0, 0x0, 0x0, 0x1, [{0xf03f}]}) r1 = socket(0x18, 0x0, 0x1) dup2(r1, r0) connect(r1, &(0x7f0000002000)=@sco={0x1f, {0x1}}, 0x26) ioctl$PPPIOCGMRU(r0, 0x80047453, &(0x7f000000c000)) 2018/02/01 16:23:04 executing program 4: mmap(&(0x7f0000000000/0xfe0000)=nil, 0xfe0000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f000077e000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003ba000-0x24)) r1 = syz_open_pts(r0, 0x0) close(r0) creat(&(0x7f0000fdb000)='./file0\x00', 0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f0000fde000)='/dev/ptmx\x00', 0x4000, 0x0) dup3(r0, r1, 0x0) 2018/02/01 16:23:04 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) unshare(0x40600) r0 = syz_open_dev$sg(&(0x7f0000e08000)='/dev/sg#\x00', 0x0, 0x0) signalfd(r0, &(0x7f00000ac000), 0x8) 2018/02/01 16:23:04 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mkdir(&(0x7f000082f000)='./control\x00', 0x0) r0 = open(&(0x7f0000a08000)='./control\x00', 0x0, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) symlinkat(&(0x7f00007ae000-0x8)='./file0\x00', r0, &(0x7f0000a31000-0xa)='./control\x00') r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000e4c000)={0xaa}) ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f0000044000-0x20)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r2 = creat(&(0x7f00000df000)='./file0\x00', 0x0) write$sndseq(r2, &(0x7f0000012000-0x2e)=[{0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @time=@time={0x77359400}}], 0x30) link(&(0x7f0000b40000-0xa)='./file0\x00', &(0x7f00006b4000-0x10)='./control/file0\x00') utimensat(r0, &(0x7f0000e03000-0x10)='./control/file0\x00', &(0x7f00003e7000-0x10)={{}, {0x0, 0x2710}}, 0x0) 2018/02/01 16:23:04 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) msgrcv(0x0, &(0x7f0000497000-0x8), 0x8, 0x0, 0x0) msgsnd(0x0, &(0x7f000010d000), 0x8, 0x0) 2018/02/01 16:23:04 executing program 2: mmap(&(0x7f0000000000/0x12000)=nil, 0x12000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket(0x18, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000005000-0x3c)=[{{&(0x7f0000003000)=@in6={0xa, 0xffffffffffffffff, 0x0, @remote={0xfe, 0x80, [], 0xffffffffffffffff, 0xbb}}, 0x1c, &(0x7f0000005000-0x60)=[{&(0x7f0000002000)="4c5614c00401a0dbf8a669ebdedd102c4f7a79e606457dfd", 0x18}], 0x1, &(0x7f0000003000-0x2d0)=[]}}], 0x1, 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000002000)={0x0, 0x0, 0x0, 0x0, 0x1, [{0xf03f}]}) r1 = socket(0x18, 0x0, 0x1) dup2(r1, r0) connect(r1, &(0x7f0000002000)=@sco={0x1f, {0x1}}, 0x26) ioctl$PPPIOCGMRU(r0, 0x80047453, &(0x7f000000c000)) 2018/02/01 16:23:04 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mkdir(&(0x7f000082f000)='./control\x00', 0x0) r0 = open(&(0x7f0000a08000)='./control\x00', 0x0, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) symlinkat(&(0x7f00007ae000-0x8)='./file0\x00', r0, &(0x7f0000a31000-0xa)='./control\x00') r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000e4c000)={0xaa}) ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f0000044000-0x20)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r2 = creat(&(0x7f00000df000)='./file0\x00', 0x0) write$sndseq(r2, &(0x7f0000012000-0x2e)=[{0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @time=@time={0x77359400}}], 0x30) link(&(0x7f0000b40000-0xa)='./file0\x00', &(0x7f00006b4000-0x10)='./control/file0\x00') utimensat(r0, &(0x7f0000e03000-0x10)='./control/file0\x00', &(0x7f00003e7000-0x10)={{}, {0x0, 0x2710}}, 0x0) 2018/02/01 16:23:04 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_int(r0, 0x29, 0x15, &(0x7f0000e72000-0x4), 0xffeb) 2018/02/01 16:23:04 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket(0x2, 0x1, 0x0) listen(r0, 0x0) poll(&(0x7f0000ee5000)=[{r0}], 0x1, 0x8000001) setsockopt$sock_int(r0, 0x1, 0x7, &(0x7f0000008000-0x4), 0x4) 2018/02/01 16:23:04 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndtimer(&(0x7f000002a000-0xf)='/dev/snd/timer\x00', 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_PARAMS(r0, 0x40505412, &(0x7f000001d000-0x50)) 2018/02/01 16:23:04 executing program 2: mmap(&(0x7f0000000000/0x12000)=nil, 0x12000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket(0x18, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000005000-0x3c)=[{{&(0x7f0000003000)=@in6={0xa, 0xffffffffffffffff, 0x0, @remote={0xfe, 0x80, [], 0xffffffffffffffff, 0xbb}}, 0x1c, &(0x7f0000005000-0x60)=[{&(0x7f0000002000)="4c5614c00401a0dbf8a669ebdedd102c4f7a79e606457dfdf09e2ec2", 0x1c}], 0x1, &(0x7f0000003000-0x2d0)=[]}}], 0x1, 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000002000)={0x0, 0x0, 0x0, 0x0, 0x1, [{0xf03f}]}) r1 = socket(0x18, 0x0, 0x1) dup2(r1, r0) connect(r1, &(0x7f0000002000)=@sco={0x1f, {0x1}}, 0x26) ioctl$PPPIOCGMRU(r0, 0x80047453, &(0x7f000000c000)) 2018/02/01 16:23:05 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = gettid() rt_sigtimedwait(&(0x7f0000645000-0x8), &(0x7f0000ded000), &(0x7f000052f000)={0x40000077359400}, 0x8) pipe(&(0x7f0000d8c000-0x8)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000e13000-0x8)={0xffffffffffffffff, 0xffffffffffffffff}) tee(r1, r3, 0x80007387, 0x0) r4 = dup2(r2, r3) r5 = syz_open_dev$random(&(0x7f0000bdc000-0xc)='/dev/random\x00', 0x0, 0x0) dup2(r2, r5) ioctl$int_in(r4, 0x5452, &(0x7f0000e36000-0x8)=0x45) fcntl$setown(0xffffffffffffffff, 0x8, r0) fcntl$setsig(r5, 0xa, 0x12) r6 = gettid() tkill(r6, 0x100000000000016) 2018/02/01 16:23:05 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mkdir(&(0x7f000082f000)='./control\x00', 0x0) r0 = open(&(0x7f0000a08000)='./control\x00', 0x0, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) symlinkat(&(0x7f00007ae000-0x8)='./file0\x00', r0, &(0x7f0000a31000-0xa)='./control\x00') r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000e4c000)={0xaa}) ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f0000044000-0x20)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r2 = creat(&(0x7f00000df000)='./file0\x00', 0x0) write$sndseq(r2, &(0x7f0000012000-0x2e)=[{0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @time=@time={0x77359400}}], 0x30) link(&(0x7f0000b40000-0xa)='./file0\x00', &(0x7f00006b4000-0x10)='./control/file0\x00') utimensat(r0, &(0x7f0000e03000-0x10)='./control/file0\x00', &(0x7f00003e7000-0x10)={{}, {0x0, 0x2710}}, 0x0) 2018/02/01 16:23:05 executing program 2: mmap(&(0x7f0000000000/0x12000)=nil, 0x12000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket(0x18, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000005000-0x3c)=[{{&(0x7f0000003000)=@in6={0xa, 0xffffffffffffffff, 0x0, @remote={0xfe, 0x80, [], 0xffffffffffffffff, 0xbb}}, 0x1c, &(0x7f0000005000-0x60)=[{&(0x7f0000002000)="4c5614c00401a0dbf8a669ebdedd102c4f7a79e606457dfdf09e2ec2", 0x1c}], 0x1, &(0x7f0000003000-0x2d0)=[]}}], 0x1, 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000002000)={0x0, 0x0, 0x0, 0x0, 0x1, [{0xf03f}]}) r1 = socket(0x18, 0x0, 0x1) dup2(r1, r0) connect(r1, &(0x7f0000002000)=@sco={0x1f, {0x1}}, 0x26) ioctl$PPPIOCGMRU(r0, 0x80047453, &(0x7f000000c000)) 2018/02/01 16:23:05 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sg(&(0x7f0000001000)='/dev/sg#\x00', 0x0, 0x2402) mmap(&(0x7f0000299000/0x2000)=nil, 0x2000, 0x3, 0x11, r0, 0x0) sched_getparam(0x0, &(0x7f000029a000)) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x0, 0x32, 0xffffffffffffffff, 0x0) 2018/02/01 16:23:05 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$packet(0x11, 0x3, 0x300) r1 = syz_open_dev$tun(&(0x7f000099b000-0xd)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000a5b000-0x28)={@common='gre0\x00', @ifru_names=@generic="4f54000cc0a1ed4f3a0a1fdc222073b5"}) r2 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8916, &(0x7f0000e6b000-0x20)={@common='gre0\x00', @ifru_addrs={0x2, 0xffffffffffffffff, @local={0xac, 0x14, 0xffffffffffffffff, 0xaa}}}) setsockopt$inet_mreqn(r2, 0x0, 0x23, &(0x7f000005d000)={@multicast1=0xe0000001, @local={0xac, 0x14, 0xffffffffffffffff, 0xaa}}, 0xc) setsockopt$inet_msfilter(r2, 0x0, 0x29, &(0x7f0000e1b000)={@multicast1=0xe0000001, @local={0xac, 0x14, 0xffffffffffffffff, 0xaa}, 0x0, 0x3, [@remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast2=0xe0000002, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}]}, 0x1c) dup3(r0, r2, 0x0) 2018/02/01 16:23:05 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) seccomp(0x1, 0x0, &(0x7f0000001000-0x10)={0x2, &(0x7f0000022000)=[{0x0, 0x0, 0x0, 0xffffffffffffffe0}, {0x16}]}) signalfd4(0xffffffffffffffff, &(0x7f0000d32000-0x8), 0x8, 0x0) 2018/02/01 16:23:05 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) pivot_root(&(0x7f0000783000-0x8)='./file0\x00', &(0x7f0000a21000)='./file0\x00') r1 = syz_open_dev$tun(&(0x7f0000c7f000-0xd)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00006b0000-0x28)={@common='gre0\x00', @ifru_map={0x2}}) ioctl$sock_inet_SIOCSIFADDR(r0, 0x8916, &(0x7f0000769000-0x20)={@common='gre0\x00', @ifru_addrs={0x2, 0x0, @local={0xac, 0x14, 0x0, 0xaa}}}) connect$inet(r0, &(0x7f0000561000)={0x2, 0x0, @local={0xac, 0x14, 0x0, 0xaa}}, 0x10) sendto$inet(r0, &(0x7f0000191000-0xad), 0x0, 0x0, &(0x7f00006e2000-0x10)={0x2, 0x0, @multicast1=0xe0000001}, 0x10) r2 = openat(0xffffffffffffff9c, &(0x7f000014c000+0x4cb)='./file0\x00', 0x18000, 0x4) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r2, 0x40042409, 0x1) ioctl$SNDRV_TIMER_IOCTL_NEXT_DEVICE(r2, 0xc0145401, &(0x7f0000f45000)={0x2, 0x3, 0x1, 0x1, 0x6}) prctl$getname(0x10, &(0x7f00001d7000)=""/145) dup2(r0, r1) 2018/02/01 16:23:05 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) msgrcv(0x0, &(0x7f0000497000-0x8), 0x8, 0x0, 0x0) msgsnd(0x0, &(0x7f000010d000), 0x8, 0x0) 2018/02/01 16:23:05 executing program 2: mmap(&(0x7f0000000000/0x12000)=nil, 0x12000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket(0x18, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000005000-0x3c)=[{{&(0x7f0000003000)=@in6={0xa, 0xffffffffffffffff, 0x0, @remote={0xfe, 0x80, [], 0xffffffffffffffff, 0xbb}}, 0x1c, &(0x7f0000005000-0x60)=[{&(0x7f0000002000)="4c5614c00401a0dbf8a669ebdedd102c4f7a79e606457dfdf09e2ec2", 0x1c}], 0x1, &(0x7f0000003000-0x2d0)=[]}}], 0x1, 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000002000)={0x0, 0x0, 0x0, 0x0, 0x1, [{0xf03f}]}) r1 = socket(0x18, 0x0, 0x1) dup2(r1, r0) connect(r1, &(0x7f0000002000)=@sco={0x1f, {0x1}}, 0x26) ioctl$PPPIOCGMRU(r0, 0x80047453, &(0x7f000000c000)) 2018/02/01 16:23:05 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mkdir(&(0x7f000082f000)='./control\x00', 0x0) r0 = open(&(0x7f0000a08000)='./control\x00', 0x0, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) symlinkat(&(0x7f00007ae000-0x8)='./file0\x00', r0, &(0x7f0000a31000-0xa)='./control\x00') r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000e4c000)={0xaa}) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000044000-0x20)={{&(0x7f0000011000/0x3000)=nil, 0x3000}}) r2 = creat(&(0x7f00000df000)='./file0\x00', 0x0) write$sndseq(r2, &(0x7f0000012000-0x2e)=[{0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @time=@time={0x77359400}}], 0x30) link(&(0x7f0000b40000-0xa)='./file0\x00', &(0x7f00006b4000-0x10)='./control/file0\x00') utimensat(r0, &(0x7f0000e03000-0x10)='./control/file0\x00', &(0x7f00003e7000-0x10)={{}, {0x0, 0x2710}}, 0x0) 2018/02/01 16:23:05 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) msgrcv(0x0, &(0x7f0000497000-0x8), 0x8, 0x0, 0x0) msgsnd(0x0, &(0x7f000010d000), 0x8, 0x0) 2018/02/01 16:23:05 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000ee7000)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_TIMER(r0, 0xc0605345, &(0x7f0000d44000-0x5c)={0x0, 0x0, {0x0, 0x0, 0x3}}) 2018/02/01 16:23:05 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mkdir(&(0x7f000082f000)='./control\x00', 0x0) r0 = open(&(0x7f0000a08000)='./control\x00', 0x0, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) symlinkat(&(0x7f00007ae000-0x8)='./file0\x00', r0, &(0x7f0000a31000-0xa)='./control\x00') r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000e4c000)={0xaa}) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000044000-0x20)={{&(0x7f0000011000/0x3000)=nil, 0x3000}}) r2 = creat(&(0x7f00000df000)='./file0\x00', 0x0) write$sndseq(r2, &(0x7f0000012000-0x2e)=[{0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @time=@time={0x77359400}}], 0x30) link(&(0x7f0000b40000-0xa)='./file0\x00', &(0x7f00006b4000-0x10)='./control/file0\x00') utimensat(r0, &(0x7f0000e03000-0x10)='./control/file0\x00', &(0x7f00003e7000-0x10)={{}, {0x0, 0x2710}}, 0x0) 2018/02/01 16:23:05 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f000000b000)={&(0x7f000000f000)={0x10}, 0xc, &(0x7f0000bef000-0x10)={&(0x7f00002a5000-0x1ac)=@newsa={0xfc, 0x10, 0x713, 0xffffffffffffffff, 0xffffffffffffffff, {{@in=@rand_addr, @in6=@empty}, {@in6=@mcast1={0xff, 0x1, [], 0x1}, 0xffffffffffffffff, 0x32}, @in6=@mcast2={0xff, 0x2, [], 0x1}, {}, {}, {}, 0xffffffffffffffff, 0xffffffffffffffff, 0x2}, [@sec_ctx={0xc, 0x8, {0x8, 0x8}}]}, 0xfc}, 0x1}, 0x0) 2018/02/01 16:23:05 executing program 2: mmap(&(0x7f0000000000/0x12000)=nil, 0x12000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket(0x18, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000005000-0x3c)=[{{&(0x7f0000003000)=@in6={0xa, 0xffffffffffffffff, 0x0, @remote={0xfe, 0x80, [], 0xffffffffffffffff, 0xbb}}, 0x1c, &(0x7f0000005000-0x60)=[{&(0x7f0000002000)="4c5614c00401a0dbf8a669ebdedd102c4f7a79e606457dfdf09e2ec2ed25", 0x1e}], 0x1, &(0x7f0000003000-0x2d0)=[]}}], 0x1, 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000002000)={0x0, 0x0, 0x0, 0x0, 0x1, [{0xf03f}]}) r1 = socket(0x18, 0x0, 0x1) dup2(r1, r0) connect(r1, &(0x7f0000002000)=@sco={0x1f, {0x1}}, 0x26) ioctl$PPPIOCGMRU(r0, 0x80047453, &(0x7f000000c000)) [ 230.767378] audit: type=1326 audit(1517502185.057:146): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 pid=31892 comm="syz-executor1" exe="/root/syz-executor1" sig=31 arch=c000003e syscall=202 compat=0 ip=0x453299 code=0xffff0000 2018/02/01 16:23:05 executing program 2: mmap(&(0x7f0000000000/0x12000)=nil, 0x12000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket(0x18, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000005000-0x3c)=[{{&(0x7f0000003000)=@in6={0xa, 0xffffffffffffffff, 0x0, @remote={0xfe, 0x80, [], 0xffffffffffffffff, 0xbb}}, 0x1c, &(0x7f0000005000-0x60)=[{&(0x7f0000002000)="4c5614c00401a0dbf8a669ebdedd102c4f7a79e606457dfdf09e2ec2ed25", 0x1e}], 0x1, &(0x7f0000003000-0x2d0)=[]}}], 0x1, 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000002000)={0x0, 0x0, 0x0, 0x0, 0x1, [{0xf03f}]}) r1 = socket(0x18, 0x0, 0x1) dup2(r1, r0) connect(r1, &(0x7f0000002000)=@sco={0x1f, {0x1}}, 0x26) ioctl$PPPIOCGMRU(r0, 0x80047453, &(0x7f000000c000)) [ 230.817647] audit: type=1326 audit(1517502185.108:147): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 pid=31892 comm="syz-executor1" exe="/root/syz-executor1" sig=31 arch=c000003e syscall=202 compat=0 ip=0x453299 code=0xffff0000 2018/02/01 16:23:05 executing program 7: mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = memfd_create(&(0x7f0000001000)="2cfa73656c696e757800", 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x11, r0, 0x0) fstatfs(r0, &(0x7f0000001000)) 2018/02/01 16:23:05 executing program 2: mmap(&(0x7f0000000000/0x12000)=nil, 0x12000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket(0x18, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000005000-0x3c)=[{{&(0x7f0000003000)=@in6={0xa, 0xffffffffffffffff, 0x0, @remote={0xfe, 0x80, [], 0xffffffffffffffff, 0xbb}}, 0x1c, &(0x7f0000005000-0x60)=[{&(0x7f0000002000)="4c5614c00401a0dbf8a669ebdedd102c4f7a79e606457dfdf09e2ec2ed25", 0x1e}], 0x1, &(0x7f0000003000-0x2d0)=[]}}], 0x1, 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000002000)={0x0, 0x0, 0x0, 0x0, 0x1, [{0xf03f}]}) r1 = socket(0x18, 0x0, 0x1) dup2(r1, r0) connect(r1, &(0x7f0000002000)=@sco={0x1f, {0x1}}, 0x26) ioctl$PPPIOCGMRU(r0, 0x80047453, &(0x7f000000c000)) 2018/02/01 16:23:05 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000bbc000)={0xffffffffffffffff, 0xffffffffffffffff}) rt_sigprocmask(0x0, &(0x7f0000073000-0x8)={0x7fffffff}, &(0x7f00000c1000), 0x8) r2 = dup2(r1, r0) vmsplice(r2, &(0x7f0000995000-0x80)=[{&(0x7f000072a000)='Y', 0x1}, {&(0x7f0000415000)="b5", 0x1}], 0x2, 0x0) 2018/02/01 16:23:05 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = gettid() rt_sigtimedwait(&(0x7f0000645000-0x8), &(0x7f0000ded000), &(0x7f000052f000)={0x40000077359400}, 0x8) pipe(&(0x7f0000d8c000-0x8)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000e13000-0x8)={0xffffffffffffffff, 0xffffffffffffffff}) tee(r1, r3, 0x80007387, 0x0) r4 = dup2(r2, r3) r5 = syz_open_dev$random(&(0x7f0000bdc000-0xc)='/dev/random\x00', 0x0, 0x0) dup2(r2, r5) ioctl$int_in(r4, 0x5452, &(0x7f0000e36000-0x8)=0x45) fcntl$setown(0xffffffffffffffff, 0x8, r0) fcntl$setsig(r5, 0xa, 0x12) r6 = gettid() tkill(r6, 0x100000000000016) 2018/02/01 16:23:05 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = memfd_create(&(0x7f00008de000)='\x00', 0x0) r1 = syz_open_dev$sndseq(&(0x7f0000028000-0xd)='/dev/snd/seq\x00', 0x0, 0x0) dup2(r1, r0) ioctl$SNDRV_SEQ_IOCTL_GET_PORT_INFO(r0, 0xc0a85322, &(0x7f0000c33000-0xb0)) 2018/02/01 16:23:05 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mkdir(&(0x7f000082f000)='./control\x00', 0x0) r0 = open(&(0x7f0000a08000)='./control\x00', 0x0, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) symlinkat(&(0x7f00007ae000-0x8)='./file0\x00', r0, &(0x7f0000a31000-0xa)='./control\x00') r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000e4c000)={0xaa}) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000044000-0x20)={{&(0x7f0000011000/0x3000)=nil, 0x3000}}) r2 = creat(&(0x7f00000df000)='./file0\x00', 0x0) write$sndseq(r2, &(0x7f0000012000-0x2e)=[{0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @time=@time={0x77359400}}], 0x30) link(&(0x7f0000b40000-0xa)='./file0\x00', &(0x7f00006b4000-0x10)='./control/file0\x00') utimensat(r0, &(0x7f0000e03000-0x10)='./control/file0\x00', &(0x7f00003e7000-0x10)={{}, {0x0, 0x2710}}, 0x0) 2018/02/01 16:23:05 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x10) r0 = socket(0x11, 0x4000000000080003, 0x0) setsockopt(r0, 0x107, 0xd, &(0x7f0000001000), 0x47e) setsockopt$packet_tx_ring(r0, 0x107, 0xd, &(0x7f0000ae8000)=@req={0x0, 0x40}, 0x10) 2018/02/01 16:23:05 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000d65000)={&(0x7f0000dc9000)={0x10}, 0xc, &(0x7f0000023000)={&(0x7f000011b000-0x208)={0x14, 0xd, 0xa, 0x1, 0xffffffffffffffff, 0xffffffffffffffff, {}, []}, 0x14}, 0x1}, 0x0) 2018/02/01 16:23:05 executing program 2: mmap(&(0x7f0000000000/0x12000)=nil, 0x12000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket(0x18, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000005000-0x3c)=[{{&(0x7f0000003000)=@in6={0xa, 0xffffffffffffffff, 0x0, @remote={0xfe, 0x80, [], 0xffffffffffffffff, 0xbb}}, 0x1c, &(0x7f0000005000-0x60)=[{&(0x7f0000002000)="4c5614c00401a0dbf8a669ebdedd102c4f7a79e606457dfdf09e2ec2ed253b", 0x1f}], 0x1, &(0x7f0000003000-0x2d0)=[]}}], 0x1, 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000002000)={0x0, 0x0, 0x0, 0x0, 0x0, []}) r1 = socket(0x18, 0x0, 0x1) dup2(r1, r0) connect(r1, &(0x7f0000002000)=@sco={0x1f, {0x1}}, 0x26) ioctl$PPPIOCGMRU(r0, 0x80047453, &(0x7f000000c000)) 2018/02/01 16:23:05 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndseq(&(0x7f000063a000-0xd)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000947000)={{0x100000008000080}, 'port0\x00', 0x40000000c6, 0x80000000080003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20006}) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000083000)='/dev/sequencer2\x00', 0x24401, 0x0) 2018/02/01 16:23:05 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mkdir(&(0x7f000082f000)='./control\x00', 0x0) r0 = open(&(0x7f0000a08000)='./control\x00', 0x0, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) symlinkat(&(0x7f00007ae000-0x8)='./file0\x00', r0, &(0x7f0000a31000-0xa)='./control\x00') r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000e4c000)={0xaa}) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000044000-0x20)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r2 = creat(&(0x7f00000df000)='./file0\x00', 0x0) write$sndseq(0xffffffffffffffff, &(0x7f0000012000-0x2e)=[{0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @time=@time={0x77359400}}], 0x30) link(&(0x7f0000b40000-0xa)='./file0\x00', &(0x7f00006b4000-0x10)='./control/file0\x00') utimensat(r0, &(0x7f0000e03000-0x10)='./control/file0\x00', &(0x7f00003e7000-0x10)={{}, {0x0, 0x2710}}, 0x0) 2018/02/01 16:23:05 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000353000-0x8)={0x0}) vmsplice(r0, &(0x7f00002c4000)=[{&(0x7f000016b000)}], 0x1, 0x0) 2018/02/01 16:23:05 executing program 2: mmap(&(0x7f0000000000/0x12000)=nil, 0x12000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket(0x18, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000005000-0x3c)=[{{&(0x7f0000003000)=@in6={0xa, 0xffffffffffffffff, 0x0, @remote={0xfe, 0x80, [], 0xffffffffffffffff, 0xbb}}, 0x1c, &(0x7f0000005000-0x60)=[{&(0x7f0000002000)="4c5614c00401a0dbf8a669ebdedd102c4f7a79e606457dfdf09e2ec2ed253b", 0x1f}], 0x1, &(0x7f0000003000-0x2d0)=[]}}], 0x1, 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000002000)={0x0, 0x0, 0x0, 0x0, 0x0, []}) r1 = socket(0x18, 0x0, 0x1) dup2(r1, r0) connect(r1, &(0x7f0000002000)=@sco={0x1f, {0x1}}, 0x26) ioctl$PPPIOCGMRU(r0, 0x80047453, &(0x7f000000c000)) 2018/02/01 16:23:05 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mkdir(&(0x7f000082f000)='./control\x00', 0x0) r0 = open(&(0x7f0000a08000)='./control\x00', 0x0, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) symlinkat(&(0x7f00007ae000-0x8)='./file0\x00', r0, &(0x7f0000a31000-0xa)='./control\x00') r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000e4c000)={0xaa}) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000044000-0x20)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r2 = creat(&(0x7f00000df000)='./file0\x00', 0x0) write$sndseq(0xffffffffffffffff, &(0x7f0000012000-0x2e)=[{0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @time=@time={0x77359400}}], 0x30) link(&(0x7f0000b40000-0xa)='./file0\x00', &(0x7f00006b4000-0x10)='./control/file0\x00') utimensat(r0, &(0x7f0000e03000-0x10)='./control/file0\x00', &(0x7f00003e7000-0x10)={{}, {0x0, 0x2710}}, 0x0) 2018/02/01 16:23:05 executing program 4: futex(&(0x7f0000005000-0x4), 0x85, 0x0, &(0x7f0000001000), &(0x7f0000000000), 0x3ffffffc) 2018/02/01 16:23:05 executing program 1: rt_sigprocmask(0x0, &(0x7f000003b000), 0x0, 0x2003b008) 2018/02/01 16:23:05 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000dca000-0x10)={0x2, 0x0, @multicast2=0xe0000002}, 0x10) connect$inet(r0, &(0x7f0000607000-0x10)={0x2, 0x0, @loopback=0x7f000001}, 0x10) sendto$inet(r0, &(0x7f0000d18000-0xbc)="d9", 0x1, 0x0, 0x0, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_MCAST_JOIN_GROUP(r1, 0x0, 0x2a, &(0x7f0000448000-0x90)={0x1, {{0x2, 0xffffffffffffffff, @multicast2=0xe0000002}}}, 0x90) sendmsg(r0, &(0x7f0000c75000)={0x0, 0x0, &(0x7f00001fd000-0x60)=[{&(0x7f0000eb1000-0xe7)='J', 0x1}], 0x1}, 0x0) 2018/02/01 16:23:05 executing program 2: mmap(&(0x7f0000000000/0x12000)=nil, 0x12000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket(0x18, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000005000-0x3c)=[{{&(0x7f0000003000)=@in6={0xa, 0xffffffffffffffff, 0x0, @remote={0xfe, 0x80, [], 0xffffffffffffffff, 0xbb}}, 0x1c, &(0x7f0000005000-0x60)=[{&(0x7f0000002000)="4c5614c00401a0dbf8a669ebdedd102c4f7a79e606457dfdf09e2ec2ed253b", 0x1f}], 0x1, &(0x7f0000003000-0x2d0)=[]}}], 0x1, 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000002000)={0x0, 0x0, 0x0, 0x0, 0x0, []}) r1 = socket(0x18, 0x0, 0x1) dup2(r1, r0) connect(r1, &(0x7f0000002000)=@sco={0x1f, {0x1}}, 0x26) ioctl$PPPIOCGMRU(r0, 0x80047453, &(0x7f000000c000)) 2018/02/01 16:23:05 executing program 7: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f00004b6000), 0x0) 2018/02/01 16:23:06 executing program 3: mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = memfd_create(&(0x7f0000001000-0x4)='$\x00', 0x0) fallocate(r0, 0x0, 0x0, 0x10001) mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) write(r0, &(0x7f0000001000)="15", 0x1) sendfile(r0, r0, &(0x7f0000001000), 0x5a77) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x4, 0x11, r0, 0x0) symlinkat(&(0x7f0000002000)='./file0/file0\x00', 0xffffffffffffffff, &(0x7f0000001000)='./file0\x00') 2018/02/01 16:23:06 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mkdir(&(0x7f000082f000)='./control\x00', 0x0) r0 = open(&(0x7f0000a08000)='./control\x00', 0x0, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) symlinkat(&(0x7f00007ae000-0x8)='./file0\x00', r0, &(0x7f0000a31000-0xa)='./control\x00') r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000e4c000)={0xaa}) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000044000-0x20)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r2 = creat(&(0x7f00000df000)='./file0\x00', 0x0) write$sndseq(0xffffffffffffffff, &(0x7f0000012000-0x2e)=[{0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @time=@time={0x77359400}}], 0x30) link(&(0x7f0000b40000-0xa)='./file0\x00', &(0x7f00006b4000-0x10)='./control/file0\x00') utimensat(r0, &(0x7f0000e03000-0x10)='./control/file0\x00', &(0x7f00003e7000-0x10)={{}, {0x0, 0x2710}}, 0x0) 2018/02/01 16:23:06 executing program 4: mmap(&(0x7f0000000000/0xd000)=nil, 0xd000, 0x3, 0x32, 0xffffffffffffffff, 0x0) capset(&(0x7f0000001000-0x8)={0x19980330}, &(0x7f0000000000)) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f000000d000-0xc)={0x0, 0x0, 0x0}, &(0x7f000000d000-0x4)=0xc) setresgid(0x0, r0, 0x0) 2018/02/01 16:23:06 executing program 2: mmap(&(0x7f0000000000/0x12000)=nil, 0x12000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket(0x18, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000005000-0x3c)=[{{&(0x7f0000003000)=@in6={0xa, 0xffffffffffffffff, 0x0, @remote={0xfe, 0x80, [], 0xffffffffffffffff, 0xbb}}, 0x1c, &(0x7f0000005000-0x60)=[{&(0x7f0000002000)="4c5614c00401a0dbf8a669ebdedd102c4f7a79e606457dfdf09e2ec2ed253b", 0x1f}], 0x1, &(0x7f0000003000-0x2d0)=[]}}], 0x1, 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000002000)={0x0, 0x0, 0x0, 0x0, 0x1, [{}]}) r1 = socket(0x18, 0x0, 0x1) dup2(r1, r0) connect(r1, &(0x7f0000002000)=@sco={0x1f, {0x1}}, 0x26) ioctl$PPPIOCGMRU(r0, 0x80047453, &(0x7f000000c000)) 2018/02/01 16:23:06 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x802, 0x0) bind$inet6(r0, &(0x7f000002e000-0x1c)={0xa, 0x0, 0x0, @remote={0xfe, 0x80, [], 0x0, 0xbb}, 0x100000003}, 0x1c) mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x100000d, 0x32, 0xffffffffffffffff, 0x0) poll(&(0x7f0000002000-0x11)=[{0xffffffffffffffff}, {0xffffffffffffffff, 0x4011}], 0x2, 0x0) bind$inet6(r0, &(0x7f0000002000-0xe)={0xa, 0x0, 0x0, @loopback={0x0, 0x1}}, 0x1c) getsockname$inet6(r0, &(0x7f0000f62000)={0x0, 0x0, 0x0, @local={0x0, 0x0, [], 0x0}}, &(0x7f0000cf2000-0x4)=0x1c) 2018/02/01 16:23:06 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000dee000-0x10)={0x2, 0x0, @multicast1=0xe0000001}, 0x10) sendto$inet(r0, &(0x7f0000de2000-0x1), 0xfffffffffffffd43, 0x20008005, &(0x7f0000db5000-0x10)={0x2, 0x0, @loopback=0x7f000001}, 0x10) ioctl$sock_SIOCINQ(r0, 0x541b, &(0x7f0000370000-0x4)) 2018/02/01 16:23:06 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = gettid() rt_sigtimedwait(&(0x7f0000645000-0x8), &(0x7f0000ded000), &(0x7f000052f000)={0x40000077359400}, 0x8) pipe(&(0x7f0000d8c000-0x8)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000e13000-0x8)={0xffffffffffffffff, 0xffffffffffffffff}) tee(r1, r3, 0x80007387, 0x0) r4 = dup2(r2, r3) r5 = syz_open_dev$random(&(0x7f0000bdc000-0xc)='/dev/random\x00', 0x0, 0x0) dup2(r2, r5) ioctl$int_in(r4, 0x5452, &(0x7f0000e36000-0x8)=0x45) fcntl$setown(0xffffffffffffffff, 0x8, r0) fcntl$setsig(r5, 0xa, 0x12) r6 = gettid() tkill(r6, 0x100000000000016) 2018/02/01 16:23:06 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x1, 0x0) r1 = dup(r0) setsockopt$inet_tcp_int(r1, 0x6, 0x2, &(0x7f0000b10000)=0xc2, 0x6677bbc4) bind$inet(r0, &(0x7f00000f1000-0x10)={0x2, 0x3, @multicast2=0xe0000002}, 0x10) setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x1a, &(0x7f0000e9c000-0x10)={0x1, &(0x7f0000f07000)=[{0x6, 0x0, 0x0, 0x101}]}, 0x10) connect$inet(r0, &(0x7f0000987000)={0x2, 0x3, @empty}, 0x10) sendmsg(r1, &(0x7f0000b82000)={&(0x7f0000930000-0x6)=@hci={0x1f}, 0x6, &(0x7f0000e42000)=[{&(0x7f0000781000)="23f25cc4c984636994f457561b9ac6f91889e7487b4265e56f683482a940022e4239329840ddd8d5aef7d8ce9ab6e11bbd767f7a7a089a5f14d706c4a2ad72be84cd66e7dc8cc9ee045660c12f0a5a9a701cf05fb3056b21969c10950e1e9e8c63731bf5795e128526d517b79538d0d025b66d22c36b86f6ed30cdfea5242550285c123836ad6c3bc8ce7716ce3439e32efa86eac4e3c5908733a939532a8500686581936af6cd990ac2f15f9a2bee4ec32c4d4ace7b46e0a313d8441c860a4e5b804007a968f2e9e008e6831574c3a0c0cc9be94b211055a3be43483277364b2c528dfcccf7865815d6987faa17d35925f6dde618cda0f01dc12c4b97f2ae479ed14c6b56c0ad67806448597aa9d5b737ca1680b1e58f20d6046d551b2243701f01b3ff93962e8d4b319b3094be8a05364b1eb85b9d64ca87ed8462f6de7090b6afdea0477eb798ee947f66f847f5ea7fbf45c7b4ca6d39597c56f89a93c7a72d74e4652f4ffc23ef5ea1f46f0cdd4d21d94bb16376a30ad2cc0e6e988d5aa309ca1e64a010eecc6c316d3234e5b51f2e6fd254a7202059ed98384d18f021378024b88654871f5cfa1857121f797813e21b7f9915fbb20c2a78993741b733f542c59c9289bcd3353e9168c2da6692c726d8957e581c64e0d23950d40093be83c7a6a1b9667bd280dcbf9a0a54a1817177fa157f7f45e8930494747535a528f0c5eaacccb25f8ae986d9734be5959acfdd14130b175aaa1fc4f2f600c2b1789ac343b328e20f17db5de5d33b8d79c540989220698561372430957dabd4293ef32188ba29479dc18d3edaab111dc3282e7c0297015c5e85645eb37b30cdcd9e19dddb830e4b1833012db0d37292608ce03114bd60a894346b8c23e04b35713a208653728c8f3c4c5201ab9aa92479a918198944996d3a7003a373f610dfa6a439ed9456aee0700e24b04d5a6857728a915371846b8bc0a9b6f80bad6631be05db86fe11f9f82780d9e1422f2e70128759abb0e760fe10b3c0660c900ee6ffb7bb243810cc2bc5582caf494f1f093a77ec7d4d90669d2b0b59b486f9ed34d9a1e9d7f88e7f", 0x304}], 0x1, &(0x7f0000634000)=[]}, 0x0) recvmsg(r1, &(0x7f0000434000-0x1c)={&(0x7f0000c3b000)=@pppol2tpv3={0x0, 0x0, {0x0, 0x0, {0x0, 0xffffffffffffffff, @multicast2}}}, 0x2e, &(0x7f0000ae5000)=[{&(0x7f000022a000-0x6c)=""/108, 0x6c}, {&(0x7f0000028000)=""/179, 0xb3}, {&(0x7f0000784000-0xa1)=""/161, 0xa1}], 0x3, &(0x7f0000007000)=""/131, 0x83}, 0x100) sendmsg(r1, &(0x7f0000247000)={&(0x7f000058d000-0x3a)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0xffffffffffffffff, 0x0, @local={0xfe, 0x80, [], 0xffffffffffffffff, 0xaa}}}}, 0x3a, &(0x7f0000a58000-0x20)=[{&(0x7f0000787000-0x1000)="43c552ade9499f006b837d34e3d59b5e2b05d0f1fb5cd3a933bbe36d13b79f3e297ec03e39f5c78a098e87104eefbe48d4ebefbd25aeff6015522455e1752492b914e6c9cfdba4876af4a110543d98ea7adb436387a4c9e140c18d8085e7c93ba89bc871b0e6c95a53aba09bba817fb29ebaf4d276f6b4042bed7b7a31e439df237ac88120e38e6b466bae4ca0b9c44478abbb7fc744ae4a4942b7969c43d4d5fc2a48f8f6baf9182def6950d631d898bc000952396e6e4b8a796431b75a7ecfbce48ccc294baed5d8f71d1deae7d2c6d0868f7919a5677ec01ac04bb5370734681305261aec26b9f309ddf8c4cb8f7a32181a41722af15009ecd0f0080d3b55ec7f4338a45f8c3b976b36f8f21e1b612763db6213864fdde6f3c114471844c7e5cd22a7922be21fc9984a403682c8407c059810f0f715a8a5d56e640486589bac4d88a79ef15437423caeb1b2c506ae14de606d", 0x154}], 0x1, &(0x7f0000f89000-0x80)=[]}, 0x0) shutdown(r0, 0x1) 2018/02/01 16:23:06 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mkdir(&(0x7f000082f000)='./control\x00', 0x0) r0 = open(&(0x7f0000a08000)='./control\x00', 0x0, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) symlinkat(&(0x7f00007ae000-0x8)='./file0\x00', r0, &(0x7f0000a31000-0xa)='./control\x00') r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000e4c000)={0xaa}) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000044000-0x20)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r2 = creat(&(0x7f00000df000)='./file0\x00', 0x0) write$sndseq(r2, &(0x7f0000012000-0x2e)=[], 0x0) link(&(0x7f0000b40000-0xa)='./file0\x00', &(0x7f00006b4000-0x10)='./control/file0\x00') utimensat(r0, &(0x7f0000e03000-0x10)='./control/file0\x00', &(0x7f00003e7000-0x10)={{}, {0x0, 0x2710}}, 0x0) 2018/02/01 16:23:06 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f000000b000)={&(0x7f0000af0000-0xc)={0x10}, 0xc, &(0x7f000063c000)={&(0x7f0000ca8000)=@newsa={0x13c, 0x10, 0x721, 0xffffffffffffffff, 0xffffffffffffffff, {{@in=@rand_addr, @in6=@dev={0xfe, 0x80}}, {@in=@broadcast=0xffffffff, 0xffffffffffffffff, 0x833}, @in6=@empty, {}, {}, {}, 0xffffffffffffffff, 0xffffffffffffffff, 0x2, 0x1}, [@algo_auth_trunc={0x4c, 0x14, {{'sha1\x00'}}}]}, 0x13c}, 0x1}, 0x0) 2018/02/01 16:23:06 executing program 2: mmap(&(0x7f0000000000/0x12000)=nil, 0x12000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket(0x18, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000005000-0x3c)=[{{&(0x7f0000003000)=@in6={0xa, 0xffffffffffffffff, 0x0, @remote={0xfe, 0x80, [], 0xffffffffffffffff, 0xbb}}, 0x1c, &(0x7f0000005000-0x60)=[{&(0x7f0000002000)="4c5614c00401a0dbf8a669ebdedd102c4f7a79e606457dfdf09e2ec2ed253b", 0x1f}], 0x1, &(0x7f0000003000-0x2d0)=[]}}], 0x1, 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000002000)={0x0, 0x0, 0x0, 0x0, 0x1, [{}]}) r1 = socket(0x18, 0x0, 0x1) dup2(r1, r0) connect(r1, &(0x7f0000002000)=@sco={0x1f, {0x1}}, 0x26) ioctl$PPPIOCGMRU(r0, 0x80047453, &(0x7f000000c000)) 2018/02/01 16:23:06 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) clone(0x200, &(0x7f0000fbf000), &(0x7f0000744000), &(0x7f0000f8b000), &(0x7f00000d5000)) mknod(&(0x7f0000f80000)='./file0\x00', 0x1040, 0x0) execve(&(0x7f0000f8b000-0x8)='./file0\x00', &(0x7f000026e000)=[], &(0x7f0000b5b000-0x8)=[]) r0 = syz_open_procfs(0x0, &(0x7f0000952000)='io\x00') readv(r0, &(0x7f000066e000-0x10)=[{&(0x7f00008ad000)=""/178, 0xb2}], 0x1) write$fuse(r0, &(0x7f0000374000)={0x14, 0x0, 0x0, @fuse_poll_out}, 0x14) open$dir(&(0x7f00003e9000-0x8)='./file0\x00', 0x26102, 0x0) 2018/02/01 16:23:06 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r0, 0x1, 0x4000000000000002, &(0x7f0000f65000)=0x3fb, 0x4) bind$inet6(r0, &(0x7f0000f65000)={0xa, 0x0, 0x0, @loopback={0x0, 0x1}}, 0x1c) sendto$inet6(r0, &(0x7f00007a9000-0x1), 0x0, 0xfffffefffffffffe, &(0x7f0000070000-0x1c)={0xa, 0x0, 0x0, @loopback={0x0, 0x1}}, 0x1c) bind$inet6(r0, &(0x7f000023e000-0x1c)={0xa, 0xffffffffffffffff, 0x0, @empty}, 0x1c) 2018/02/01 16:23:06 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mkdir(&(0x7f000082f000)='./control\x00', 0x0) r0 = open(&(0x7f0000a08000)='./control\x00', 0x0, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) symlinkat(&(0x7f00007ae000-0x8)='./file0\x00', r0, &(0x7f0000a31000-0xa)='./control\x00') r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000e4c000)={0xaa}) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000044000-0x20)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r2 = creat(&(0x7f00000df000)='./file0\x00', 0x0) write$sndseq(r2, &(0x7f0000012000-0x2e)=[], 0x0) link(&(0x7f0000b40000-0xa)='./file0\x00', &(0x7f00006b4000-0x10)='./control/file0\x00') utimensat(r0, &(0x7f0000e03000-0x10)='./control/file0\x00', &(0x7f00003e7000-0x10)={{}, {0x0, 0x2710}}, 0x0) 2018/02/01 16:23:06 executing program 0: clone(0x0, &(0x7f0000b26000), &(0x7f0000eaa000-0x4), &(0x7f000039b000), &(0x7f0000bda000)) dup3(0xffffffffffffff9c, 0xffffffffffffffff, 0x0) 2018/02/01 16:23:06 executing program 2: mmap(&(0x7f0000000000/0x12000)=nil, 0x12000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket(0x18, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000005000-0x3c)=[{{&(0x7f0000003000)=@in6={0xa, 0xffffffffffffffff, 0x0, @remote={0xfe, 0x80, [], 0xffffffffffffffff, 0xbb}}, 0x1c, &(0x7f0000005000-0x60)=[{&(0x7f0000002000)="4c5614c00401a0dbf8a669ebdedd102c4f7a79e606457dfdf09e2ec2ed253b", 0x1f}], 0x1, &(0x7f0000003000-0x2d0)=[]}}], 0x1, 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000002000)={0x0, 0x0, 0x0, 0x0, 0x1, [{}]}) r1 = socket(0x18, 0x0, 0x1) dup2(r1, r0) connect(r1, &(0x7f0000002000)=@sco={0x1f, {0x1}}, 0x26) ioctl$PPPIOCGMRU(r0, 0x80047453, &(0x7f000000c000)) 2018/02/01 16:23:06 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000ceb000-0xa)='/dev/ptmx\x00', 0x0, 0x0) ioctl$int_in(r0, 0x541f, &(0x7f0000f85000-0x8)) 2018/02/01 16:23:06 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000911000-0x8)="6d6f756e747300e1") r1 = epoll_create(0x6) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000faf000-0xc)) mount(&(0x7f0000a39000-0x8)='./file0\x00', &(0x7f0000852000)='.', &(0x7f0000a60000)='ramfs\x00', 0x0, &(0x7f00008a7000)) umount2(&(0x7f0000d5c000-0x1)='.', 0x0) getsockopt$inet_sctp_SCTP_PR_SUPPORTED(0xffffffffffffffff, 0x84, 0x71, &(0x7f0000862000)={0x0, 0xfffffffffffffffd}, &(0x7f0000b16000-0x4)=0x8) 2018/02/01 16:23:06 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x5, 0x32, 0xffffffffffffffff, 0x0) openat$selinux_relabel(0xffffffffffffff9c, &(0x7f0000763000)='/selinux/relabel\x00', 0x2, 0x0) futex(&(0x7f000072a000-0x4), 0x0, 0x0, &(0x7f0000028000)={0x77359400}, &(0x7f000061a000-0x4), 0x0) 2018/02/01 16:23:06 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = gettid() rt_sigtimedwait(&(0x7f0000645000-0x8), &(0x7f0000ded000), &(0x7f000052f000)={0x40000077359400}, 0x8) pipe(&(0x7f0000d8c000-0x8)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000e13000-0x8)={0xffffffffffffffff, 0xffffffffffffffff}) tee(r1, r3, 0x80007387, 0x0) r4 = dup2(r2, r3) r5 = syz_open_dev$random(&(0x7f0000bdc000-0xc)='/dev/random\x00', 0x0, 0x0) dup2(r2, r5) ioctl$int_in(r4, 0x5452, &(0x7f0000e36000-0x8)=0x45) fcntl$setown(r2, 0x8, 0x0) fcntl$setsig(r5, 0xa, 0x12) r6 = gettid() tkill(r6, 0x100000000000016) 2018/02/01 16:23:06 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000e0f000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0) r1 = epoll_create(0x4000000010011) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000337000-0xc)) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000075b000-0x30)={0x4c, 0x0, &(0x7f000092b000)=[@transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x0, &(0x7f0000bd2000-0x48)=[], &(0x7f0000a82000-0x18)=[]}}}], 0x0, 0x0, &(0x7f000005b000-0x82)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000b8000)={0x4, 0x0, &(0x7f0000109000)=[@register_looper={0x630b}], 0x1, 0x0, &(0x7f0000584000-0xad)="e7"}) 2018/02/01 16:23:06 executing program 2: mmap(&(0x7f0000000000/0x12000)=nil, 0x12000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket(0x18, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000005000-0x3c)=[{{&(0x7f0000003000)=@in6={0xa, 0xffffffffffffffff, 0x0, @remote={0xfe, 0x80, [], 0xffffffffffffffff, 0xbb}}, 0x1c, &(0x7f0000005000-0x60)=[{&(0x7f0000002000)="4c5614c00401a0dbf8a669ebdedd102c4f7a79e606457dfdf09e2ec2ed253b", 0x1f}], 0x1, &(0x7f0000003000-0x2d0)=[]}}], 0x1, 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000002000)={0x0, 0x0, 0x0, 0x0, 0x1, [{0xf03f}]}) r1 = socket(0x0, 0x0, 0x1) dup2(r1, r0) connect(r1, &(0x7f0000002000)=@sco={0x1f, {0x1}}, 0x26) ioctl$PPPIOCGMRU(r0, 0x80047453, &(0x7f000000c000)) 2018/02/01 16:23:06 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mkdir(&(0x7f000082f000)='./control\x00', 0x0) r0 = open(&(0x7f0000a08000)='./control\x00', 0x0, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) symlinkat(&(0x7f00007ae000-0x8)='./file0\x00', r0, &(0x7f0000a31000-0xa)='./control\x00') r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000e4c000)={0xaa}) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000044000-0x20)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r2 = creat(&(0x7f00000df000)='./file0\x00', 0x0) write$sndseq(r2, &(0x7f0000012000-0x2e)=[], 0x0) link(&(0x7f0000b40000-0xa)='./file0\x00', &(0x7f00006b4000-0x10)='./control/file0\x00') utimensat(r0, &(0x7f0000e03000-0x10)='./control/file0\x00', &(0x7f00003e7000-0x10)={{}, {0x0, 0x2710}}, 0x0) 2018/02/01 16:23:06 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) capset(&(0x7f0000000000)={0x19980330}, &(0x7f0000b4b000-0x18)) capset(&(0x7f0000d57000)={0x20080522}, &(0x7f0000b0b000-0x18)={0x0, 0x0, 0x0, 0x0, 0x400000004}) 2018/02/01 16:23:06 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$loop(&(0x7f000071c000-0xb)='/dev/loop#\x00', 0x0, 0x181001) r1 = memfd_create(&(0x7f00006ec000-0x11)="74756e08000000000000008000000000a4", 0x0) pwritev(r1, &(0x7f0000f51000-0x70)=[{&(0x7f00001f2000)="aa", 0x1}], 0x1, 0x81003) clock_getres(0x0, &(0x7f0000669000-0x10)) sendfile(r0, r1, &(0x7f0000cac000+0xe1b)=0x1, 0x100000001) 2018/02/01 16:23:06 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) seccomp(0x1, 0x0, &(0x7f0000b98000-0x8)={0x2, &(0x7f0000022000)=[{0x0, 0x0, 0x0, 0xffffffffffffffdc}, {0x16}]}) getresgid(&(0x7f0000f54000-0x4), &(0x7f0000cb1000), &(0x7f00007bb000)) 2018/02/01 16:23:06 executing program 1: mmap(&(0x7f0000000000/0xff8000)=nil, 0xff8000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x2, 0x0) setsockopt$inet_mtu(r0, 0x0, 0xa, &(0x7f0000ff1000-0x4)=0x8000000000004, 0x9c) r1 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f000095c000-0x4)={0x0, 0x0, 0xfffffffffffffffc}, 0x4) sendto$inet(r0, &(0x7f0000865000), 0xffe4, 0x0, &(0x7f0000fda000-0x10)={0x2, 0x0, @rand_addr}, 0x10) 2018/02/01 16:23:06 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mkdir(&(0x7f000082f000)='./control\x00', 0x0) r0 = open(&(0x7f0000a08000)='./control\x00', 0x0, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) symlinkat(&(0x7f00007ae000-0x8)='./file0\x00', r0, &(0x7f0000a31000-0xa)='./control\x00') r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000e4c000)={0xaa}) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000044000-0x20)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r2 = creat(&(0x7f00000df000)='./file0\x00', 0x0) write$sndseq(r2, &(0x7f0000012000-0x2e)=[{0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @time=@time={0x77359400}}], 0x30) link(&(0x7f0000b40000-0xa)='./file0\x00', &(0x7f00006b4000-0x10)='./control/file0\x00') utimensat(0xffffffffffffffff, &(0x7f0000e03000-0x10)='./control/file0\x00', &(0x7f00003e7000-0x10)={{}, {0x0, 0x2710}}, 0x0) [ 232.609077] binder: 32022:32028 ERROR: BC_REGISTER_LOOPER called without request 2018/02/01 16:23:06 executing program 2: mmap(&(0x7f0000000000/0x12000)=nil, 0x12000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket(0x18, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000005000-0x3c)=[{{&(0x7f0000003000)=@in6={0xa, 0xffffffffffffffff, 0x0, @remote={0xfe, 0x80, [], 0xffffffffffffffff, 0xbb}}, 0x1c, &(0x7f0000005000-0x60)=[{&(0x7f0000002000)="4c5614c00401a0dbf8a669ebdedd102c4f7a79e606457dfdf09e2ec2ed253b", 0x1f}], 0x1, &(0x7f0000003000-0x2d0)=[]}}], 0x1, 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000002000)={0x0, 0x0, 0x0, 0x0, 0x1, [{0xf03f}]}) r1 = socket(0x0, 0x0, 0x1) dup2(r1, r0) connect(r1, &(0x7f0000002000)=@sco={0x1f, {0x1}}, 0x26) ioctl$PPPIOCGMRU(r0, 0x80047453, &(0x7f000000c000)) 2018/02/01 16:23:06 executing program 0: mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x3, 0x32, 0xffffffffffffffff, 0x0) futex(&(0x7f0000000000), 0x85, 0x0, &(0x7f0000696000), &(0x7f0000000000), 0x1000100) [ 232.665665] binder_alloc: binder_alloc_mmap_handler: 32022 20000000-20002000 already mapped failed -16 [ 232.682787] IPv4: Oversized IP packet from 127.0.0.1 [ 232.682877] IPv4: Oversized IP packet from 127.0.0.1 [ 232.684653] audit: type=1326 audit(1517502186.975:148): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 pid=32043 comm="syz-executor3" exe="/root/syz-executor3" sig=31 arch=c000003e syscall=202 compat=0 ip=0x453299 code=0xffff0000 [ 232.739790] binder: BINDER_SET_CONTEXT_MGR already set [ 232.745290] binder: 32022:32028 ioctl 40046207 0 returned -16 [ 232.745333] binder_alloc: 32022: binder_alloc_buf, no vma [ 232.745357] binder: 32022:32046 transaction failed 29189/-3, size 0-0 line 2903 [ 232.767707] binder: undelivered TRANSACTION_ERROR: 29189 [ 232.773254] binder: undelivered transaction 482, process died. 2018/02/01 16:23:07 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket(0x10, 0x2, 0x0) sendmsg$nl_route(r0, &(0x7f0000504000)={&(0x7f0000c9a000)={0x10}, 0xc, &(0x7f000009b000)={&(0x7f0000dd2000)=@newlink={0x3c, 0x10, 0x9, 0xffffffffffffffff, 0xffffffffffffffff, {}, [@IFLA_IFNAME={0x12, 0x3, @syzn={0x73, 0x79, 0x7a, 0x0}}, @IFLA_MASTER={0x8, 0xa, 0x8}]}, 0x3c}, 0x1}, 0x0) 2018/02/01 16:23:07 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) sendmsg(r0, &(0x7f0000221000)={&(0x7f000073d000)=@in={0x2, 0x0, @empty}, 0x10, &(0x7f00004a4000)=[], 0x0, &(0x7f000018f000-0x11a8)=[]}, 0x810) 2018/02/01 16:23:07 executing program 0: mmap(&(0x7f0000000000/0x1c000)=nil, 0x1c000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_MCAST_JOIN_GROUP(r0, 0x0, 0x2a, &(0x7f0000008000)={0x1, {{0x2, 0xffffffffffffffff, @multicast2=0xe0000002}}}, 0x90) mprotect(&(0x7f0000008000/0x2000)=nil, 0x2000, 0x2) getsockopt$inet_buf(r0, 0x0, 0x30, &(0x7f0000008000)=""/144, &(0x7f0000013000-0x4)=0x90) 2018/02/01 16:23:07 executing program 2: mmap(&(0x7f0000000000/0x12000)=nil, 0x12000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket(0x18, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000005000-0x3c)=[{{&(0x7f0000003000)=@in6={0xa, 0xffffffffffffffff, 0x0, @remote={0xfe, 0x80, [], 0xffffffffffffffff, 0xbb}}, 0x1c, &(0x7f0000005000-0x60)=[{&(0x7f0000002000)="4c5614c00401a0dbf8a669ebdedd102c4f7a79e606457dfdf09e2ec2ed253b", 0x1f}], 0x1, &(0x7f0000003000-0x2d0)=[]}}], 0x1, 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000002000)={0x0, 0x0, 0x0, 0x0, 0x1, [{0xf03f}]}) r1 = socket(0x0, 0x0, 0x1) dup2(r1, r0) connect(r1, &(0x7f0000002000)=@sco={0x1f, {0x1}}, 0x26) ioctl$PPPIOCGMRU(r0, 0x80047453, &(0x7f000000c000)) 2018/02/01 16:23:07 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) clock_nanosleep(0x0, 0x0, &(0x7f00006ba000)={0x0, 0x1c9c380}, &(0x7f0000dab000-0x8)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) remap_file_pages(&(0x7f000023e000/0x4000)=nil, 0x4000, 0x0, 0x0, 0xfffffffffffffffd) openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000b08000)='/selinux/enforce\x00', 0x0, 0x0) 2018/02/01 16:23:07 executing program 1: mmap(&(0x7f0000000000/0x38000)=nil, 0x38000, 0x3, 0x32, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f000001a000)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x1a, &(0x7f000001d000)={0x2, &(0x7f0000001000-0x10)=[{0x28, 0x0, 0x0, 0xfffffffffffff008}, {0x6}]}, 0x10) sendto$unix(r0, &(0x7f0000037000), 0x0, 0x0, &(0x7f0000038000-0xa)=@file={0x0, './file0\x00'}, 0xa) 2018/02/01 16:23:07 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = gettid() rt_sigtimedwait(&(0x7f0000645000-0x8), &(0x7f0000ded000), &(0x7f000052f000)={0x40000077359400}, 0x8) pipe(&(0x7f0000d8c000-0x8)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000e13000-0x8)={0xffffffffffffffff, 0xffffffffffffffff}) tee(r1, r3, 0x80007387, 0x0) r4 = dup2(r2, r3) r5 = syz_open_dev$random(&(0x7f0000bdc000-0xc)='/dev/random\x00', 0x0, 0x0) dup2(r2, r5) ioctl$int_in(r4, 0x5452, &(0x7f0000e36000-0x8)=0x45) fcntl$setown(r2, 0x8, 0x0) fcntl$setsig(r5, 0xa, 0x12) r6 = gettid() tkill(r6, 0x100000000000016) 2018/02/01 16:23:07 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mkdir(&(0x7f000082f000)='./control\x00', 0x0) r0 = open(&(0x7f0000a08000)='./control\x00', 0x0, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) symlinkat(&(0x7f00007ae000-0x8)='./file0\x00', r0, &(0x7f0000a31000-0xa)='./control\x00') r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000e4c000)={0xaa}) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000044000-0x20)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r2 = creat(&(0x7f00000df000)='./file0\x00', 0x0) write$sndseq(r2, &(0x7f0000012000-0x2e)=[{0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @time=@time={0x77359400}}], 0x30) link(&(0x7f0000b40000-0xa)='./file0\x00', &(0x7f00006b4000-0x10)='./control/file0\x00') utimensat(0xffffffffffffffff, &(0x7f0000e03000-0x10)='./control/file0\x00', &(0x7f00003e7000-0x10)={{}, {0x0, 0x2710}}, 0x0) 2018/02/01 16:23:07 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f00002a7000-0x38)={0x0, 0x0, &(0x7f0000000000)={&(0x7f000045c000-0x10f0)={0x2, 0xa, 0x0, 0x0, 0x7, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, [@sadb_x_filter={0x5, 0x1a, @in=@rand_addr, @in6=@local={0xfe, 0x80, [], 0xffffffffffffffff, 0xaa}, 0x0, 0x14}]}, 0x38}, 0x1}, 0x0) 2018/02/01 16:23:07 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$key(0xf, 0x3, 0x2) r1 = dup(r0) pipe(&(0x7f00001b0000-0x8)={0x0}) splice(r2, &(0x7f0000356000-0x8), r1, &(0x7f00002d5000), 0x9, 0x0) 2018/02/01 16:23:07 executing program 2: mmap(&(0x7f0000000000/0x12000)=nil, 0x12000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket(0x18, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000005000-0x3c)=[{{&(0x7f0000003000)=@in6={0xa, 0xffffffffffffffff, 0x0, @remote={0xfe, 0x80, [], 0xffffffffffffffff, 0xbb}}, 0x1c, &(0x7f0000005000-0x60)=[{&(0x7f0000002000)="4c5614c00401a0dbf8a669ebdedd102c4f7a79e606457dfdf09e2ec2ed253b", 0x1f}], 0x1, &(0x7f0000003000-0x2d0)=[]}}], 0x1, 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000002000)={0x0, 0x0, 0x0, 0x0, 0x1, [{0xf03f}]}) r1 = socket(0x18, 0x0, 0x0) dup2(r1, r0) connect(r1, &(0x7f0000002000)=@sco={0x1f, {0x1}}, 0x26) ioctl$PPPIOCGMRU(r0, 0x80047453, &(0x7f000000c000)) 2018/02/01 16:23:07 executing program 3: mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$unix(0x1, 0x2, 0x0) connect(r0, &(0x7f0000001000-0x10)=@ax25={0x3, {"439f01a53b55cb"}}, 0x10) 2018/02/01 16:23:07 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) seccomp(0x1, 0x0, &(0x7f0000029000-0x10)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0xffffffff}]}) recvmsg(0xffffffffffffffff, &(0x7f0000466000)={0x0, 0x0, &(0x7f000064b000-0x30)=[], 0x0, &(0x7f0000c18000)=""/190, 0xbe}, 0x0) [ 233.290496] audit: type=1326 audit(1517502187.581:149): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 pid=32094 comm="syz-executor0" exe="/root/syz-executor0" sig=31 arch=c000003e syscall=202 compat=0 ip=0x453299 code=0xffff0000 [ 233.346248] audit: type=1326 audit(1517502187.636:150): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 pid=32094 comm="syz-executor0" exe="/root/syz-executor0" sig=31 arch=c000003e syscall=202 compat=0 ip=0x453299 code=0xffff0000 2018/02/01 16:23:08 executing program 2: mmap(&(0x7f0000000000/0x12000)=nil, 0x12000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket(0x18, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000005000-0x3c)=[{{&(0x7f0000003000)=@in6={0xa, 0xffffffffffffffff, 0x0, @remote={0xfe, 0x80, [], 0xffffffffffffffff, 0xbb}}, 0x1c, &(0x7f0000005000-0x60)=[{&(0x7f0000002000)="4c5614c00401a0dbf8a669ebdedd102c4f7a79e606457dfdf09e2ec2ed253b", 0x1f}], 0x1, &(0x7f0000003000-0x2d0)=[]}}], 0x1, 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000002000)={0x0, 0x0, 0x0, 0x0, 0x1, [{0xf03f}]}) r1 = socket(0x18, 0x0, 0x0) dup2(r1, r0) connect(r1, &(0x7f0000002000)=@sco={0x1f, {0x1}}, 0x26) ioctl$PPPIOCGMRU(r0, 0x80047453, &(0x7f000000c000)) 2018/02/01 16:23:08 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mkdir(&(0x7f000082f000)='./control\x00', 0x0) r0 = open(&(0x7f0000a08000)='./control\x00', 0x0, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) symlinkat(&(0x7f00007ae000-0x8)='./file0\x00', r0, &(0x7f0000a31000-0xa)='./control\x00') r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000e4c000)={0xaa}) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000044000-0x20)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r2 = creat(&(0x7f00000df000)='./file0\x00', 0x0) write$sndseq(r2, &(0x7f0000012000-0x2e)=[{0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @time=@time={0x77359400}}], 0x30) link(&(0x7f0000b40000-0xa)='./file0\x00', &(0x7f00006b4000-0x10)='./control/file0\x00') utimensat(0xffffffffffffffff, &(0x7f0000e03000-0x10)='./control/file0\x00', &(0x7f00003e7000-0x10)={{}, {0x0, 0x2710}}, 0x0) 2018/02/01 16:23:08 executing program 7: mmap(&(0x7f0000000000/0x17000)=nil, 0x17000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = add_key(&(0x7f0000015000)='logon\x00', &(0x7f0000014000)={0x73, 0x79, 0x7a, 0x0}, &(0x7f0000015000-0x1000)="578ea44f6ba3a636ffe97fbf75d7f372f0e7dc32856ed7aba5b6170997cd8b3e7f4fb91f56a1d51d0440a1121990753224a83c0fabcdf91de1ac17b66df943ab65c55d35edaefad0633a", 0x4a, 0xffffffffffffffff) keyctl$clear(0x7, r0) 2018/02/01 16:23:08 executing program 3: mmap(&(0x7f0000000000/0xfd6000)=nil, 0xfd6000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x8000000000000802, 0x0) sendmsg$inet_sctp(r0, &(0x7f0000a29000)={&(0x7f0000fc2000-0x1c)=@in6={0xa, 0x0, 0x0, @loopback={0x0, 0x1}}, 0x1c, &(0x7f0000fc2000-0x8)=[{&(0x7f00005c2000-0xfb)="91938c", 0x3}], 0x1}, 0x8000) sendto$inet6(r0, &(0x7f0000fd5000)="04", 0x1, 0x0, &(0x7f000089d000-0x1c)={0xa, 0xffffffffffffffff, 0x0, @local={0xfe, 0x80, [], 0xffffffffffffffff, 0xaa}}, 0x1c) 2018/02/01 16:23:08 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000bdb000)='./file0\x00', 0x0) mount(&(0x7f0000e07000)='./file0\x00', &(0x7f0000e8d000-0x8)='./file0\x00', &(0x7f0000d62000)='ramfs\x00', 0x800002, &(0x7f0000ccd000)) r0 = creat(&(0x7f0000016000-0xc)='./file0/bus\x00', 0x0) socketpair$inet6(0xa, 0x0, 0x0, &(0x7f0000de4000)) writev(r0, &(0x7f0000017000)=[{&(0x7f0000a0e000-0x86)='?', 0x1}], 0x1) 2018/02/01 16:23:08 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000f2f000)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CLIENT_ID(r0, 0x80045301, &(0x7f00002b3000)) 2018/02/01 16:23:08 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = gettid() rt_sigtimedwait(&(0x7f0000645000-0x8), &(0x7f0000ded000), &(0x7f000052f000)={0x40000077359400}, 0x8) pipe(&(0x7f0000d8c000-0x8)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000e13000-0x8)={0xffffffffffffffff, 0xffffffffffffffff}) tee(r1, r3, 0x80007387, 0x0) r4 = dup2(r2, r3) r5 = syz_open_dev$random(&(0x7f0000bdc000-0xc)='/dev/random\x00', 0x0, 0x0) dup2(r2, r5) ioctl$int_in(r4, 0x5452, &(0x7f0000e36000-0x8)=0x45) fcntl$setown(r2, 0x8, 0x0) fcntl$setsig(r5, 0xa, 0x12) r6 = gettid() tkill(r6, 0x100000000000016) 2018/02/01 16:23:08 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) clock_nanosleep(0x0, 0x0, &(0x7f00006ba000)={0x0, 0x1c9c380}, &(0x7f0000dab000-0x8)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) remap_file_pages(&(0x7f000023e000/0x4000)=nil, 0x4000, 0x0, 0x0, 0xfffffffffffffffd) openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000b08000)='/selinux/enforce\x00', 0x0, 0x0) 2018/02/01 16:23:08 executing program 2: mmap(&(0x7f0000000000/0x12000)=nil, 0x12000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket(0x18, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000005000-0x3c)=[{{&(0x7f0000003000)=@in6={0xa, 0xffffffffffffffff, 0x0, @remote={0xfe, 0x80, [], 0xffffffffffffffff, 0xbb}}, 0x1c, &(0x7f0000005000-0x60)=[{&(0x7f0000002000)="4c5614c00401a0dbf8a669ebdedd102c4f7a79e606457dfdf09e2ec2ed253b", 0x1f}], 0x1, &(0x7f0000003000-0x2d0)=[]}}], 0x1, 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000002000)={0x0, 0x0, 0x0, 0x0, 0x1, [{0xf03f}]}) r1 = socket(0x18, 0x0, 0x0) dup2(r1, r0) connect(r1, &(0x7f0000002000)=@sco={0x1f, {0x1}}, 0x26) ioctl$PPPIOCGMRU(r0, 0x80047453, &(0x7f000000c000)) 2018/02/01 16:23:08 executing program 7: mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/net/pfkey\x00', 0x0, 0x0) ioctl$int_out(r0, 0x5460, &(0x7f0000000000)) 2018/02/01 16:23:08 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000872000+0x936)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00009b5000-0x30)={0x4, 0x0, &(0x7f000000a000-0x10)=[@enter_looper={0x630c}], 0x0, 0x0, &(0x7f0000009000)}) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x10, 0x0, &(0x7f0000006000-0x2c)=[@acquire={0x40046305}, @acquire={0x400c630e}], 0x0, 0x0, &(0x7f0000002000)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000009000-0x30)={0x8, 0x0, &(0x7f0000008000)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000001000-0xb3)}) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) 2018/02/01 16:23:08 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000001000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCXONC(r0, 0x540a, 0x0) r1 = epoll_create(0x2) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f00006f3000)) ioctl$TCXONC(r0, 0x540a, 0x1) 2018/02/01 16:23:08 executing program 2: mmap(&(0x7f0000000000/0x12000)=nil, 0x12000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket(0x18, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000005000-0x3c)=[{{&(0x7f0000003000)=@in6={0xa, 0xffffffffffffffff, 0x0, @remote={0xfe, 0x80, [], 0xffffffffffffffff, 0xbb}}, 0x1c, &(0x7f0000005000-0x60)=[{&(0x7f0000002000)="4c5614c00401a0dbf8a669ebdedd102c4f7a79e606457dfdf09e2ec2ed253b", 0x1f}], 0x1, &(0x7f0000003000-0x2d0)=[]}}], 0x1, 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000002000)={0x0, 0x0, 0x0, 0x0, 0x1, [{0xf03f}]}) r1 = socket(0x18, 0x0, 0x1) dup2(0xffffffffffffffff, r0) connect(r1, &(0x7f0000002000)=@sco={0x1f, {0x1}}, 0x26) ioctl$PPPIOCGMRU(r0, 0x80047453, &(0x7f000000c000)) 2018/02/01 16:23:08 executing program 2: mmap(&(0x7f0000000000/0x12000)=nil, 0x12000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket(0x18, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000005000-0x3c)=[{{&(0x7f0000003000)=@in6={0xa, 0xffffffffffffffff, 0x0, @remote={0xfe, 0x80, [], 0xffffffffffffffff, 0xbb}}, 0x1c, &(0x7f0000005000-0x60)=[{&(0x7f0000002000)="4c5614c00401a0dbf8a669ebdedd102c4f7a79e606457dfdf09e2ec2ed253b", 0x1f}], 0x1, &(0x7f0000003000-0x2d0)=[]}}], 0x1, 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000002000)={0x0, 0x0, 0x0, 0x0, 0x1, [{0xf03f}]}) r1 = socket(0x18, 0x0, 0x1) dup2(0xffffffffffffffff, r0) connect(r1, &(0x7f0000002000)=@sco={0x1f, {0x1}}, 0x26) ioctl$PPPIOCGMRU(r0, 0x80047453, &(0x7f000000c000)) 2018/02/01 16:23:08 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003ba000-0x24)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCGSID(r1, 0x540f, &(0x7f00002bb000)) 2018/02/01 16:23:08 executing program 7: r0 = socket$inet(0x2, 0x2, 0x0) setsockopt$inet_mreqn(r0, 0x0, 0x1000000027, &(0x7f000062e000)={@empty, @loopback=0x7f000001}, 0xc) 2018/02/01 16:23:08 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket(0x10, 0x803, 0x0) sendto(r0, &(0x7f00004af000-0x12)="120000001600e7ff00ffe90009149b00f99b", 0x12, 0x0, 0x0, 0x0) recvmmsg(r0, &(0x7f0000398000-0xb)=[{{&(0x7f00001bb000-0x10)=@ax25, 0x10, &(0x7f00003ab000-0x50)=[], 0x0, &(0x7f00000e6000)=""/226, 0xe2}}], 0x1, 0x0, 0x0) readv(r0, &(0x7f0000c24000)=[{&(0x7f00002f9000-0x1000)=""/4096, 0x1000}], 0x1) write(r0, &(0x7f000027f000)="22000000120007d30e00000000000a000c150009000007190000000004000806da06", 0x22) 2018/02/01 16:23:08 executing program 1: clone(0x0, &(0x7f0000793000), &(0x7f00001c8000), &(0x7f0000bac000), &(0x7f0000133000)) rt_sigtimedwait(&(0x7f0000359000), &(0x7f0000491000), &(0x7f00002fb000)={0x0, 0x1c9c380}, 0x8) [ 233.909443] binder: undelivered death notification, 0000000000000000 [ 233.957266] binder: BINDER_SET_CONTEXT_MGR already set [ 233.959397] netlink: 2 bytes leftover after parsing attributes in process `syz-executor6'. [ 233.959430] netlink: 2 bytes leftover after parsing attributes in process `syz-executor6'. [ 234.005906] binder: 32134:32137 ioctl 40046207 0 returned -16 [ 234.017327] binder: undelivered death notification, 0000000000000000 2018/02/01 16:23:08 executing program 2: mmap(&(0x7f0000000000/0x12000)=nil, 0x12000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket(0x18, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000005000-0x3c)=[{{&(0x7f0000003000)=@in6={0xa, 0xffffffffffffffff, 0x0, @remote={0xfe, 0x80, [], 0xffffffffffffffff, 0xbb}}, 0x1c, &(0x7f0000005000-0x60)=[{&(0x7f0000002000)="4c5614c00401a0dbf8a669ebdedd102c4f7a79e606457dfdf09e2ec2ed253b", 0x1f}], 0x1, &(0x7f0000003000-0x2d0)=[]}}], 0x1, 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000002000)={0x0, 0x0, 0x0, 0x0, 0x1, [{0xf03f}]}) r1 = socket(0x18, 0x0, 0x1) dup2(0xffffffffffffffff, r0) connect(r1, &(0x7f0000002000)=@sco={0x1f, {0x1}}, 0x26) ioctl$PPPIOCGMRU(r0, 0x80047453, &(0x7f000000c000)) 2018/02/01 16:23:08 executing program 1: clone(0x0, &(0x7f0000572000), &(0x7f0000dad000-0x4), &(0x7f00009a9000-0x4), &(0x7f0000501000)) ppoll(&(0x7f0000d14000-0x10)=[], 0x0, &(0x7f00009b1000-0x10), &(0x7f0000548000-0x8), 0x8) 2018/02/01 16:23:08 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000cab000+0x5b3)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000d6b000-0xb0)={{0x80}, 'port0\x00'}) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000c03000)={{0x20000000000080}, "0a4ceaa05dad126e00000002a1569b3fd4cec307e8ef3d13eb790ec9c65abaf90d229db692542e5b78f8b29e0a27800f0000000000000009fb42d576589701a4", 0x77, 0x10000a}) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000d15000-0x10)='/dev/sequencer2\x00', 0x2, 0x0) close(r0) 2018/02/01 16:23:08 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x1b, &(0x7f000026d000)={@local={0xfe, 0x80, [], 0x0, 0xaa}}, 0x20) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000de8000-0x14)={@remote={0xfe, 0x80, [], 0xffffffffffffffff, 0xbb}}, 0x14) setsockopt$inet6_mreq(r0, 0x29, 0x1c, &(0x7f000013f000-0x14)={@local={0xfe, 0x80, [], 0x0, 0xaa}}, 0x14) 2018/02/01 16:23:08 executing program 0: mmap(&(0x7f0000000000/0xb4a000)=nil, 0xb4a000, 0x3, 0x32, 0xffffffffffffffff, 0x0) seccomp(0x1, 0x0, &(0x7f0000001000-0x10)={0x2, &(0x7f0000022000)=[{0x0, 0x0, 0x0, 0xffffffffffffffe0}, {0x16}]}) uname(&(0x7f00004c7000-0xa1)=""/161) 2018/02/01 16:23:08 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sg(&(0x7f0000005000)='/dev/sg#\x00', 0x0, 0x0) ioctl(r0, 0x2282, &(0x7f0000340000)) 2018/02/01 16:23:08 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = gettid() rt_sigtimedwait(&(0x7f0000645000-0x8), &(0x7f0000ded000), &(0x7f000052f000)={0x40000077359400}, 0x8) pipe(&(0x7f0000d8c000-0x8)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000e13000-0x8)={0xffffffffffffffff, 0xffffffffffffffff}) tee(r1, r3, 0x80007387, 0x0) r4 = dup2(r2, r3) r5 = syz_open_dev$random(&(0x7f0000bdc000-0xc)='/dev/random\x00', 0x0, 0x0) dup2(r2, r5) ioctl$int_in(r4, 0x5452, &(0x7f0000e36000-0x8)=0x45) fcntl$setown(r2, 0x8, r0) fcntl$setsig(0xffffffffffffffff, 0xa, 0x12) r6 = gettid() tkill(r6, 0x100000000000016) 2018/02/01 16:23:08 executing program 4: mmap(&(0x7f0000000000/0xaad000)=nil, 0xaad000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000010000-0xd)='/dev/binder#\x00', 0x0, 0x0) r1 = getpid() sched_setattr(r1, &(0x7f0000001000-0x30)={0x0, 0x5}, 0x0) rt_sigsuspend(&(0x7f0000188000-0x8), 0x8) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000e000-0x30)={0x4, 0x0, &(0x7f000000d000-0x98)=[@enter_looper={0x630c}], 0x1, 0x0, &(0x7f0000009000-0xc9)="c2"}) 2018/02/01 16:23:08 executing program 2: mmap(&(0x7f0000000000/0x12000)=nil, 0x12000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket(0x18, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000005000-0x3c)=[{{&(0x7f0000003000)=@in6={0xa, 0xffffffffffffffff, 0x0, @remote={0xfe, 0x80, [], 0xffffffffffffffff, 0xbb}}, 0x1c, &(0x7f0000005000-0x60)=[{&(0x7f0000002000)="4c5614c00401a0dbf8a669ebdedd102c4f7a79e606457dfdf09e2ec2ed253b", 0x1f}], 0x1, &(0x7f0000003000-0x2d0)=[]}}], 0x1, 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000002000)={0x0, 0x0, 0x0, 0x0, 0x1, [{0xf03f}]}) r1 = socket(0x18, 0x0, 0x1) dup2(r1, 0xffffffffffffffff) connect(r1, &(0x7f0000002000)=@sco={0x1f, {0x1}}, 0x26) ioctl$PPPIOCGMRU(r0, 0x80047453, &(0x7f000000c000)) 2018/02/01 16:23:08 executing program 2: mmap(&(0x7f0000000000/0x12000)=nil, 0x12000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket(0x18, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000005000-0x3c)=[{{&(0x7f0000003000)=@in6={0xa, 0xffffffffffffffff, 0x0, @remote={0xfe, 0x80, [], 0xffffffffffffffff, 0xbb}}, 0x1c, &(0x7f0000005000-0x60)=[{&(0x7f0000002000)="4c5614c00401a0dbf8a669ebdedd102c4f7a79e606457dfdf09e2ec2ed253b", 0x1f}], 0x1, &(0x7f0000003000-0x2d0)=[]}}], 0x1, 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000002000)={0x0, 0x0, 0x0, 0x0, 0x1, [{0xf03f}]}) r1 = socket(0x18, 0x0, 0x1) dup2(r1, 0xffffffffffffffff) connect(r1, &(0x7f0000002000)=@sco={0x1f, {0x1}}, 0x26) ioctl$PPPIOCGMRU(r0, 0x80047453, &(0x7f000000c000)) 2018/02/01 16:23:08 executing program 2: mmap(&(0x7f0000000000/0x12000)=nil, 0x12000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket(0x18, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000005000-0x3c)=[{{&(0x7f0000003000)=@in6={0xa, 0xffffffffffffffff, 0x0, @remote={0xfe, 0x80, [], 0xffffffffffffffff, 0xbb}}, 0x1c, &(0x7f0000005000-0x60)=[{&(0x7f0000002000)="4c5614c00401a0dbf8a669ebdedd102c4f7a79e606457dfdf09e2ec2ed253b", 0x1f}], 0x1, &(0x7f0000003000-0x2d0)=[]}}], 0x1, 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000002000)={0x0, 0x0, 0x0, 0x0, 0x1, [{0xf03f}]}) r1 = socket(0x18, 0x0, 0x1) dup2(r1, 0xffffffffffffffff) connect(r1, &(0x7f0000002000)=@sco={0x1f, {0x1}}, 0x26) ioctl$PPPIOCGMRU(r0, 0x80047453, &(0x7f000000c000)) 2018/02/01 16:23:08 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) sendto$inet6(r0, &(0x7f0000a78000-0x69b)="d6cdddf6785b2010c70c0e53a7b8dc46fb08eb86a063c48af64531b6d0b5e54fc637a8ce449a0b9e9bc58337badcb8b3287366371ab8840cc0f3d5af77d601c926a964d38709a0155dc77d7f1db3dec18d2d3622d251666f5ee4722f01548b798edf884d4ec51c76d0cc08d1a40051c9123b925e030e86296d2f292c596ebcd8548189ed3217ad11850252b4bf8d3586df05325e80ef836926eb2206588aa95d038d723daf2a574b8cbc080db80b5bb82cfda253f60f52303155726f41ed8eb9e8926f5e2471eefa9f3dbb87c97f8ca5d5ab2fe8e7b33258064b19f1fce68e2bd76173823280dde3ff0bdd43965a3224c4888751d958dbda5412d855c3104a56fc2dd2756cec6488513f1c72fc760e90cbbaeb031ce7e3969a1d7d941520e47963083f6804564c1be136ac8e10b64ebee48f6d9a719988633f001b611ed60a71b1a7a1b595be3ab1a5d876cf9a0d86e26c5dfc4ceb2963937ecbd0a7873500b85d115d88af3838ed2b9b4c1a5aaf8d546786b2172bed07527d72f5b5bb15c5cd7339089fec4154bbc0dc37b92c7c91af56880a3699f728d121082be998c8000a9f282b3c80cbb815a723dec3ef1c7db995e326b31f1cfdf714f46e31464d32d54539720910680b1034ee6af9cc574be349fa1d1cf7666b5715d392558f16cadbcc2cd0b67e5e80005959d3445de0be4798f7a1e3bce43abce01a36ec36e41c90028bec1fac8227c6535e82b821c50bf2dd1725bfd257ff9d0fcd9da635b4fcd3d12933401cc03fe108ac5b719ef6f2d6adc79eeb8dbfaf89487ba4e13fab495977668b9ee4b261627abe77094ba1411274b69e644482e3e4a9463a32146f0c5cb0495475a80c392a9f8c1f785f647bfcc14897fdeb74c32e335d511dd03ffe548b1055f7b2378ba31701a9b09273c8ee0000000000000009ae958cae8f2e46b858ba5c9240390d86989e88489c77898e37d54bfd8de73b17fa1a57e0177a950c981e3174783c93cdc31dc5133298164511d89875179792783f5d1bc36789309f65d3e85034a578f159688751e2c49daae0ff8b50a501c7a7eb7c5f2cce063ec1bc0b35500d132fc679e827eef7919d488da4dee22fffb3581bd8cdc3a6af7ef4844c754a31c1519fdaca546726c259d27e01111bf44e18462c229d57582d22ca38214ad06c6aa3af9425be3b3b72d00ee1feb764f7bf8cb57452133b1a96f73d40462b0b51a80b3523c5b936a92200d7179b4c705c8ca2d3481c21349844ddde0400b19c54388fa465dfeb61d41ffde3e3f9abc6913b9acba43362c8869ce47995e38f06e29222f3ee256526bc1511b215550747bba3cc8b516946107e9d2fe79f955efa36c5d567b24735b18fa5cffd924b355c61808f103fb8d28128f8658a7e197785b66c52525576174740f93886286f0981475c7699fa8552201ae3ce3cd20b3b0b1c5e166ecbca3f4f484bbfd4a5e2be556d0b0a44bae81a6e3c2a67e381ffaeef4b3b0fe74785d1991bf193c8eea1686db19c1867726d1fe37df19d26fe4eb78f79754e72a0ff66fa381675bac1d90406b5a62784caca11f51f5802d29ace1e64e71e86f213f70b35002688d4556605fe6351451a03c06ceeeaa5f6d1014adc68309c6dab7fa38ebf2b8a1b8ba6a3ec3e5c04c1d81f0ac02b0d1e7874496e978f78f29d15891b3dae69c8af582f3448d489c576cc3a28577a96c872c1fc69cbb053f4ce6b1770e1a674fa99f13037934a6ef9f408c4036506f08ef95a0de742e894ed23a611e96864f4f1e6a764ef3dd0f6048201e8e225a67587b19141850249ba55e30f3883ceee97a37205121d09c9f35776108922ab57cadd5758f2d656379100d9ce6280fb4d06527078bb1a75c686ddb44f45634939224c91f89bd7f29d12298e72cffabe02a81a9b7d26899f5d90401c3aefff2b340076d831c5f62a121ae56ca16df1b90987bca1907778b04e639a77a1cbe1bbb1e57f434cc2fdd119d83ac5aa4b5ed995bd0421f21344f1ecc2879b64079c05ec7a8216633f4179e978ccb17195f785f002", 0x5ad, 0x48000, &(0x7f0000e3f000-0x1c)={0xa, 0x2, 0x0, @mcast2={0xff, 0x2, [], 0x1}}, 0x1c) setsockopt$inet6_mtu(r0, 0x29, 0x17, &(0x7f0000a63000)=0x3, 0x4) sendto$inet6(r0, &(0x7f0000fac000-0xf), 0xffffffffffffff91, 0x20000010, &(0x7f000016b000)={0xa, 0xffffffffffffffff, 0x0, @empty}, 0x1c) 2018/02/01 16:23:08 executing program 3: mmap(&(0x7f0000000000/0xffa000)=nil, 0xffa000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000b9a000-0x18)={0xaa}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000ff8000-0x20)={{&(0x7f0000012000/0x2000)=nil, 0x2000}, 0x1}) mlock2(&(0x7f0000bfc000/0x2000)=nil, 0x2000, 0x0) mlock(&(0x7f0000011000/0x3000)=nil, 0x3000) mremap(&(0x7f0000013000/0x1000)=nil, 0x1000, 0x4000, 0x3, &(0x7f0000be4000/0x4000)=nil) mlock2(&(0x7f00007a6000/0x2000)=nil, 0x2000, 0x0) close(r0) [ 234.467137] audit: type=1326 audit(1517502188.754:151): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 pid=32167 comm="syz-executor0" exe="/root/syz-executor0" sig=31 arch=c000003e syscall=202 compat=0 ip=0x453299 code=0xffff0000 2018/02/01 16:23:08 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) syz_fuseblk_mount(&(0x7f0000c20000)='./file0\x00', &(0x7f0000db7000-0x8)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) r1 = syz_open_dev$tun(&(0x7f0000520000-0xd)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000a5b000-0x28)={@common='gre0\x00', @ifru_settings={0x2, 0x0, @raw_hdlc=&(0x7f00004a3000)}}) getrusage(0x1, &(0x7f0000b28000-0x90)) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000f88000-0x20)={@common='gre0\x00', @ifru_flags=0x100000000000301}) 2018/02/01 16:23:08 executing program 2: mmap(&(0x7f0000000000/0x12000)=nil, 0x12000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket(0x18, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000005000-0x3c)=[{{&(0x7f0000003000)=@in6={0xa, 0xffffffffffffffff, 0x0, @remote={0xfe, 0x80, [], 0xffffffffffffffff, 0xbb}}, 0x1c, &(0x7f0000005000-0x60)=[{&(0x7f0000002000)="4c5614c00401a0dbf8a669ebdedd102c4f7a79e606457dfdf09e2ec2ed253b", 0x1f}], 0x1, &(0x7f0000003000-0x2d0)=[]}}], 0x1, 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000002000)={0x0, 0x0, 0x0, 0x0, 0x1, [{0xf03f}]}) r1 = socket(0x18, 0x0, 0x1) dup2(r1, r0) connect(0xffffffffffffffff, &(0x7f0000002000)=@sco={0x1f, {0x1}}, 0x26) ioctl$PPPIOCGMRU(r0, 0x80047453, &(0x7f000000c000)) 2018/02/01 16:23:08 executing program 2: mmap(&(0x7f0000000000/0x12000)=nil, 0x12000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket(0x18, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000005000-0x3c)=[{{&(0x7f0000003000)=@in6={0xa, 0xffffffffffffffff, 0x0, @remote={0xfe, 0x80, [], 0xffffffffffffffff, 0xbb}}, 0x1c, &(0x7f0000005000-0x60)=[{&(0x7f0000002000)="4c5614c00401a0dbf8a669ebdedd102c4f7a79e606457dfdf09e2ec2ed253b", 0x1f}], 0x1, &(0x7f0000003000-0x2d0)=[]}}], 0x1, 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000002000)={0x0, 0x0, 0x0, 0x0, 0x1, [{0xf03f}]}) r1 = socket(0x18, 0x0, 0x1) dup2(r1, r0) connect(0xffffffffffffffff, &(0x7f0000002000)=@sco={0x1f, {0x1}}, 0x26) ioctl$PPPIOCGMRU(r0, 0x80047453, &(0x7f000000c000)) 2018/02/01 16:23:08 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000ead000-0x8)='./file0\x00', 0x0) mount(&(0x7f0000213000-0x8)='./file0\x00', &(0x7f0000b7c000-0x8)='./file0\x00', &(0x7f0000983000-0x7)='mqueue\x00', 0x0, &(0x7f0000ebd000-0x2)) r0 = creat(&(0x7f00004c2000-0xc)='./file0/bus\x00', 0x0) mq_timedreceive(r0, &(0x7f0000121000-0xc5)=""/197, 0xc5, 0x0, &(0x7f00004e5000-0x8)={0x0, 0x989680}) 2018/02/01 16:23:08 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x80002, 0x88) recvfrom$inet6(r0, &(0x7f0000fbf000-0x93)=""/185, 0xffffffffffffff89, 0x0, 0x0, 0xffffffffffffff8f) bind$inet6(r0, &(0x7f00008a8000)={0xa, 0x3, 0x0, @empty}, 0x1c) r1 = socket$inet6(0xa, 0x8000000000000802, 0x88) sendmsg$inet_sctp(r1, &(0x7f0000a29000)={&(0x7f0000253000-0x1c)=@in6={0xa, 0x3, 0x0, @loopback={0x0, 0x1}}, 0x1c, &(0x7f0000cb8000-0x80)=[{&(0x7f0000e4a000)="4955be42ceb0ad2c340aa24d17a087b7fd397bd99d22f1c7039bc5787c6c17bef6cec0050b70bf1e3d3b00509871399d40768729aa483b5a0de98d3864a8318c81c8cf394d", 0x45}], 0x1}, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f0000b0d000-0x92), 0x0, 0x0, &(0x7f000001b000)={0xa, 0xffffffffffffffff, 0x0, @empty}, 0x1c) [ 234.530605] audit: type=1326 audit(1517502188.811:152): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 pid=32167 comm="syz-executor0" exe="/root/syz-executor0" sig=31 arch=c000003e syscall=202 compat=0 ip=0x453299 code=0xffff0000 2018/02/01 16:23:08 executing program 2: mmap(&(0x7f0000000000/0x12000)=nil, 0x12000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket(0x18, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000005000-0x3c)=[{{&(0x7f0000003000)=@in6={0xa, 0xffffffffffffffff, 0x0, @remote={0xfe, 0x80, [], 0xffffffffffffffff, 0xbb}}, 0x1c, &(0x7f0000005000-0x60)=[{&(0x7f0000002000)="4c5614c00401a0dbf8a669ebdedd102c4f7a79e606457dfdf09e2ec2ed253b", 0x1f}], 0x1, &(0x7f0000003000-0x2d0)=[]}}], 0x1, 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000002000)={0x0, 0x0, 0x0, 0x0, 0x1, [{0xf03f}]}) r1 = socket(0x18, 0x0, 0x1) dup2(r1, r0) connect(0xffffffffffffffff, &(0x7f0000002000)=@sco={0x1f, {0x1}}, 0x26) ioctl$PPPIOCGMRU(r0, 0x80047453, &(0x7f000000c000)) [ 234.575632] device gre0 entered promiscuous mode [ 234.586651] binder: 32200 RLIMIT_NICE not set 2018/02/01 16:23:08 executing program 1: mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000002000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCMGET(r0, 0x5415, &(0x7f0000003000-0x4)) 2018/02/01 16:23:08 executing program 2: mmap(&(0x7f0000000000/0x12000)=nil, 0x12000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket(0x18, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000005000-0x3c)=[{{&(0x7f0000003000)=@in6={0xa, 0xffffffffffffffff, 0x0, @remote={0xfe, 0x80, [], 0xffffffffffffffff, 0xbb}}, 0x1c, &(0x7f0000005000-0x60)=[{&(0x7f0000002000)="4c5614c00401a0dbf8a669ebdedd102c4f7a79e606457dfdf09e2ec2ed253b", 0x1f}], 0x1, &(0x7f0000003000-0x2d0)=[]}}], 0x1, 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000002000)={0x0, 0x0, 0x0, 0x0, 0x1, [{0xf03f}]}) r1 = socket(0x18, 0x0, 0x1) dup2(r1, r0) connect(r1, &(0x7f0000002000)=@sco={0x1f}, 0x26) ioctl$PPPIOCGMRU(r0, 0x80047453, &(0x7f000000c000)) 2018/02/01 16:23:08 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) seccomp(0x1, 0x0, &(0x7f0000029000-0x10)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0xfffffffffffffffb}]}) request_key(&(0x7f000088d000-0xb)='cifs.idmap\x00', &(0x7f000055a000-0x5)={0x73, 0x79, 0x7a, 0x0}, &(0x7f0000b05000-0xa)=']GPLppp0\\\x00', 0xffffffffffffffff) 2018/02/01 16:23:08 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = gettid() rt_sigtimedwait(&(0x7f0000645000-0x8), &(0x7f0000ded000), &(0x7f000052f000)={0x40000077359400}, 0x8) pipe(&(0x7f0000d8c000-0x8)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000e13000-0x8)={0xffffffffffffffff, 0xffffffffffffffff}) tee(r1, r3, 0x80007387, 0x0) r4 = dup2(r2, r3) r5 = syz_open_dev$random(&(0x7f0000bdc000-0xc)='/dev/random\x00', 0x0, 0x0) dup2(r2, r5) ioctl$int_in(r4, 0x5452, &(0x7f0000e36000-0x8)=0x45) fcntl$setown(r2, 0x8, r0) fcntl$setsig(0xffffffffffffffff, 0xa, 0x12) r6 = gettid() tkill(r6, 0x100000000000016) 2018/02/01 16:23:08 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f0000486000)=0x10, 0x4) sendto$inet6(r0, &(0x7f0000adb000), 0x0, 0x0, &(0x7f0000809000)={0xa, 0x0, 0x0, @loopback={0x0, 0x1}}, 0x1c) 2018/02/01 16:23:08 executing program 3: mmap(&(0x7f0000000000/0xffa000)=nil, 0xffa000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000b9a000-0x18)={0xaa}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000ff8000-0x20)={{&(0x7f0000012000/0x2000)=nil, 0x2000}, 0x1}) mlock2(&(0x7f0000bfc000/0x2000)=nil, 0x2000, 0x0) mlock(&(0x7f0000011000/0x3000)=nil, 0x3000) mremap(&(0x7f0000013000/0x1000)=nil, 0x1000, 0x4000, 0x3, &(0x7f0000be4000/0x4000)=nil) mlock2(&(0x7f00007a6000/0x2000)=nil, 0x2000, 0x0) close(r0) 2018/02/01 16:23:08 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = syz_open_dev$tun(&(0x7f0000c7f000-0xd)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00006b0000-0x28)={@common='gre0\x00', @ifru_map={0x2}}) ioctl$sock_inet_SIOCSIFADDR(r0, 0x8916, &(0x7f0000719000-0x20)={@common='gre0\x00', @ifru_addrs={0x2, 0x0, @local={0xac, 0x14, 0x0, 0xaa}}}) connect$inet(r0, &(0x7f0000561000)={0x2, 0x0, @local={0xac, 0x14, 0x0, 0xaa}}, 0x10) getpeername(r0, &(0x7f000077a000-0x58)=@alg, &(0x7f0000e29000)=0x58) 2018/02/01 16:23:08 executing program 4: mmap(&(0x7f0000001000/0xa96000)=nil, 0xa96000, 0x3, 0x32, 0xffffffffffffffff, 0x0) pipe2(&(0x7f0000002000-0x8)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) vmsplice(r0, &(0x7f0000b1d000)=[{&(0x7f0000006000-0x1d)}], 0x1, 0x0) 2018/02/01 16:23:08 executing program 2: mmap(&(0x7f0000000000/0x12000)=nil, 0x12000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket(0x18, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000005000-0x3c)=[{{&(0x7f0000003000)=@in6={0xa, 0xffffffffffffffff, 0x0, @remote={0xfe, 0x80, [], 0xffffffffffffffff, 0xbb}}, 0x1c, &(0x7f0000005000-0x60)=[{&(0x7f0000002000)="4c5614c00401a0dbf8a669ebdedd102c4f7a79e606457dfdf09e2ec2ed253b", 0x1f}], 0x1, &(0x7f0000003000-0x2d0)=[]}}], 0x1, 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000002000)={0x0, 0x0, 0x0, 0x0, 0x1, [{0xf03f}]}) r1 = socket(0x18, 0x0, 0x1) dup2(r1, r0) connect(r1, &(0x7f0000002000)=@sco={0x1f}, 0x26) ioctl$PPPIOCGMRU(r0, 0x80047453, &(0x7f000000c000)) 2018/02/01 16:23:08 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x3, @broadcast=0xffffffff}, 0x10) sendto$inet(r0, &(0x7f0000fd0000), 0xfffffffffffffec1, 0x20000801, &(0x7f0000deb000-0x10)={0x2, 0x3, @loopback=0x7f000001}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f000026f000-0x6)='vegas\x00', 0x6) shutdown(r0, 0x1) 2018/02/01 16:23:08 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) personality(0x1fffffe) uname(&(0x7f0000ff0000)) 2018/02/01 16:23:08 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000c89000-0x28)={@common='sit0\x00', &(0x7f0000ca2000)=@ethtool_wolinfo={0xa, 0x0, 0x0, "22c8fa674307"}}) [ 234.676853] audit: type=1326 audit(1517502188.967:153): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 pid=32223 comm="syz-executor6" exe="/root/syz-executor6" sig=31 arch=c000003e syscall=202 compat=0 ip=0x453299 code=0xffff0000 2018/02/01 16:23:09 executing program 2: mmap(&(0x7f0000000000/0x12000)=nil, 0x12000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket(0x18, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000005000-0x3c)=[{{&(0x7f0000003000)=@in6={0xa, 0xffffffffffffffff, 0x0, @remote={0xfe, 0x80, [], 0xffffffffffffffff, 0xbb}}, 0x1c, &(0x7f0000005000-0x60)=[{&(0x7f0000002000)="4c5614c00401a0dbf8a669ebdedd102c4f7a79e606457dfdf09e2ec2ed253b", 0x1f}], 0x1, &(0x7f0000003000-0x2d0)=[]}}], 0x1, 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000002000)={0x0, 0x0, 0x0, 0x0, 0x1, [{0xf03f}]}) r1 = socket(0x18, 0x0, 0x1) dup2(r1, r0) connect(r1, &(0x7f0000002000)=@sco={0x1f}, 0x26) ioctl$PPPIOCGMRU(r0, 0x80047453, &(0x7f000000c000)) 2018/02/01 16:23:09 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSARP(r0, 0x8955, &(0x7f0000db3000-0x44)={{0x2, 0xffffffffffffffff, @remote={0xac, 0x14, 0x0, 0xbb}}, {0x0, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff]}, 0x6, {0x2, 0xffffffffffffffff, @remote={0xac, 0x14, 0x0, 0xbb}}, @syzn={0x73, 0x79, 0x7a, 0x0}}) 2018/02/01 16:23:09 executing program 4: mmap(&(0x7f000000f000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = open(&(0x7f0000010000-0x6)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x80000000000002, 0x11, r0, 0x0) fallocate(r0, 0x0, 0x8001, 0x4eb) fstat(r0, &(0x7f0000001000-0x44)) sigaltstack(&(0x7f0000001000/0x1000)=nil, &(0x7f0000009000-0x8)) sigaltstack(&(0x7f0000001000/0x3000)=nil, &(0x7f0000009000)) 2018/02/01 16:23:09 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x3, @broadcast=0xffffffff}, 0x10) sendto$inet(r0, &(0x7f0000fd0000), 0xfffffffffffffec1, 0x20000801, &(0x7f0000deb000-0x10)={0x2, 0x3, @loopback=0x7f000001}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f000026f000-0x6)='vegas\x00', 0x6) shutdown(r0, 0x1) 2018/02/01 16:23:09 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000008000-0x4)={0x0, 0x6}, 0x4) setsockopt$packet_fanout_data(r1, 0x107, 0x16, &(0x7f0000001000)={0x1, &(0x7f000000a000)=[{0x6}]}, 0x10) sendto$inet6(r0, &(0x7f0000125000), 0x0, 0x0, &(0x7f0000b35000-0x1c)={0xa, 0x0, 0x0, @empty}, 0x1c) 2018/02/01 16:23:09 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) modify_ldt$write2(0x11, &(0x7f0000cee000)={0x3da}, 0x10) modify_ldt$write2(0x11, &(0x7f0000001000-0x10), 0x10) 2018/02/01 16:23:09 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = gettid() rt_sigtimedwait(&(0x7f0000645000-0x8), &(0x7f0000ded000), &(0x7f000052f000)={0x40000077359400}, 0x8) pipe(&(0x7f0000d8c000-0x8)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000e13000-0x8)={0xffffffffffffffff, 0xffffffffffffffff}) tee(r1, r3, 0x80007387, 0x0) r4 = dup2(r2, r3) r5 = syz_open_dev$random(&(0x7f0000bdc000-0xc)='/dev/random\x00', 0x0, 0x0) dup2(r2, r5) ioctl$int_in(r4, 0x5452, &(0x7f0000e36000-0x8)=0x45) fcntl$setown(r2, 0x8, r0) fcntl$setsig(0xffffffffffffffff, 0xa, 0x12) r6 = gettid() tkill(r6, 0x100000000000016) 2018/02/01 16:23:09 executing program 6: mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x3, 0x32, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000f14000-0x8)={0x0, 0x0}) timer_settime(0x0, 0x0, &(0x7f0000001000-0x10)={{0x77359400, r0}, {0x77359400}}, &(0x7f0000001000)) [ 234.754197] audit: type=1326 audit(1517502189.044:154): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 pid=32223 comm="syz-executor6" exe="/root/syz-executor6" sig=31 arch=c000003e syscall=202 compat=0 ip=0x453299 code=0xffff0000 2018/02/01 16:23:09 executing program 6: socketpair(0x10, 0x2, 0x2, &(0x7f0000b42000-0x8)) 2018/02/01 16:23:09 executing program 2: mmap(&(0x7f0000000000/0x12000)=nil, 0x12000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket(0x18, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000005000-0x3c)=[{{&(0x7f0000003000)=@in6={0xa, 0xffffffffffffffff, 0x0, @remote={0xfe, 0x80, [], 0xffffffffffffffff, 0xbb}}, 0x1c, &(0x7f0000005000-0x60)=[{&(0x7f0000002000)="4c5614c00401a0dbf8a669ebdedd102c4f7a79e606457dfdf09e2ec2ed253b", 0x1f}], 0x1, &(0x7f0000003000-0x2d0)=[]}}], 0x1, 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000002000)={0x0, 0x0, 0x0, 0x0, 0x1, [{0xf03f}]}) r1 = socket(0x18, 0x0, 0x1) dup2(r1, r0) connect(r1, &(0x7f0000002000)=@sco={0x1f, {0x1}}, 0x26) ioctl$PPPIOCGMRU(0xffffffffffffffff, 0x80047453, &(0x7f000000c000)) 2018/02/01 16:23:09 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000c4e000)='./file0\x00', 0x0) r0 = open(&(0x7f0000033000-0x8)='./file0\x00', 0x0, 0x0) mkdirat(r0, &(0x7f0000034000-0x8)='./file0\x00', 0x0) mount(&(0x7f0000433000-0xe)='./file0/file0\x00', &(0x7f00003c9000)='./file0\x00', &(0x7f000010c000-0x9)='configfs\x00', 0x1001, &(0x7f0000a06000)) unlinkat(r0, &(0x7f000057d000)='./file0\x00', 0x200) r1 = syz_open_procfs(0x0, &(0x7f000000c000+0x53e)='mountinfo\x00') preadv(r1, &(0x7f0000000000)=[{&(0x7f0000003000-0x1)=""/1, 0x1}], 0x1, 0x480000000000000) 2018/02/01 16:23:09 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000373000-0x5)='veno\x00', 0x5) sendto$inet(r0, &(0x7f0000a2e000-0x98), 0x0, 0x20020003, &(0x7f0000386000-0x10)={0x2, 0xffffffffffffffff, @loopback=0x7f000001}, 0x10) 2018/02/01 16:23:09 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000001000)={0xaa}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) ioctl$UFFDIO_ZEROPAGE(r0, 0xc020aa04, &(0x7f0000000000)={&(0x7f0000012000/0x1000)=nil, 0x1000}) 2018/02/01 16:23:09 executing program 6: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)={0xaa}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r1, 0x0, 0x28, &(0x7f0000014000-0xc)={@dev={0xac, 0x14}, @loopback=0x7f000001, @local={0xac, 0x14, 0xffffffffffffffff, 0xaa}}, 0xc) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x2, 0x32, 0xffffffffffffffff, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x8946, &(0x7f0000266000-0x28)={@syzn={0x73, 0x79, 0x7a, 0x0}, &(0x7f0000fad000)=@ethtool_sset_info={0x37, 0x0, 0x9c2f, []}}) clone(0x0, &(0x7f0000b26000), &(0x7f0000eaa000-0x4), &(0x7f0000bf3000-0x4), &(0x7f00003b9000-0xcd)) ioctl$UFFDIO_ZEROPAGE(r0, 0x8010aa02, &(0x7f00000c1000-0x10)={&(0x7f0000011000/0x3000)=nil, 0x3000}) 2018/02/01 16:23:09 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2000000000001, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000e87000-0x4)=0x40000000000003fe, 0x4) bind$inet6(r0, &(0x7f0000895000-0x1c)={0xa, 0x0, 0x0, @empty}, 0x1c) sendto$inet6(r0, &(0x7f0000d46000), 0x0, 0xfffffefffffffffe, &(0x7f000039f000-0x1c)={0xa, 0x0, 0x0, @empty}, 0x1c) 2018/02/01 16:23:09 executing program 2: mmap(&(0x7f0000000000/0x12000)=nil, 0x12000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket(0x18, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000005000-0x3c)=[{{&(0x7f0000003000)=@in6={0xa, 0xffffffffffffffff, 0x0, @remote={0xfe, 0x80, [], 0xffffffffffffffff, 0xbb}}, 0x1c, &(0x7f0000005000-0x60)=[{&(0x7f0000002000)="4c5614c00401a0dbf8a669ebdedd102c4f7a79e606457dfdf09e2ec2ed253b", 0x1f}], 0x1, &(0x7f0000003000-0x2d0)=[]}}], 0x1, 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000002000)={0x0, 0x0, 0x0, 0x0, 0x1, [{0xf03f}]}) r1 = socket(0x18, 0x0, 0x1) dup2(r1, r0) connect(r1, &(0x7f0000002000)=@sco={0x1f, {0x1}}, 0x26) ioctl$PPPIOCGMRU(0xffffffffffffffff, 0x80047453, &(0x7f000000c000)) 2018/02/01 16:23:09 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket(0x10, 0x803, 0x0) sendto(r0, &(0x7f00004af000-0x12)="120000001600e7ff00ffe90009149b00f99b", 0x12, 0x0, 0x0, 0x0) recvfrom(r0, &(0x7f0000caa000-0xbc)=""/188, 0xbc, 0x0, &(0x7f0000920000)=@nl=@kern={0x10}, 0xc) 2018/02/01 16:23:09 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$selinux_load(0xffffffffffffff9c, &(0x7f0000007000-0xe)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r0, &(0x7f0000f7a000-0x12)={0xf97cff8c, 0x8, 'SE\vLinux'}, 0x10) 2018/02/01 16:23:09 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x802, 0x88) connect$inet6(r0, &(0x7f0000fd1000)={0xa, 0xffffffffffffffff, 0x0, @ipv4={[], [0xff, 0xff], @remote={0xac, 0x14, 0x0, 0xbb}}}, 0x1c) 2018/02/01 16:23:09 executing program 2: mmap(&(0x7f0000000000/0x12000)=nil, 0x12000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket(0x18, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000005000-0x3c)=[{{&(0x7f0000003000)=@in6={0xa, 0xffffffffffffffff, 0x0, @remote={0xfe, 0x80, [], 0xffffffffffffffff, 0xbb}}, 0x1c, &(0x7f0000005000-0x60)=[{&(0x7f0000002000)="4c5614c00401a0dbf8a669ebdedd102c4f7a79e606457dfdf09e2ec2ed253b", 0x1f}], 0x1, &(0x7f0000003000-0x2d0)=[]}}], 0x1, 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000002000)={0x0, 0x0, 0x0, 0x0, 0x1, [{0xf03f}]}) r1 = socket(0x18, 0x0, 0x1) dup2(r1, r0) connect(r1, &(0x7f0000002000)=@sco={0x1f, {0x1}}, 0x26) ioctl$PPPIOCGMRU(0xffffffffffffffff, 0x80047453, &(0x7f000000c000)) 2018/02/01 16:23:09 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x80002, 0x88) bind$inet6(r0, &(0x7f0000d86000-0x1c)={0xa, 0x3, 0x0, @empty}, 0x1c) r1 = socket$inet6(0xa, 0x802, 0x100000000000088) readv(r0, &(0x7f00009c5000-0x20)=[{&(0x7f00001af000)=""/106, 0x6a}], 0x1) setsockopt$sock_int(r0, 0x1, 0x23, &(0x7f0000539000)=0x1, 0x4) sendmsg$inet_sctp(r1, &(0x7f00002ea000-0x38)={&(0x7f0000a34000)=@in={0x2, 0x3, @empty}, 0x10, &(0x7f0000f71000)=[]}, 0x0) 2018/02/01 16:23:09 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = gettid() rt_sigtimedwait(&(0x7f0000645000-0x8), &(0x7f0000ded000), &(0x7f000052f000)={0x40000077359400}, 0x8) pipe(&(0x7f0000d8c000-0x8)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000e13000-0x8)={0xffffffffffffffff, 0xffffffffffffffff}) tee(r1, r3, 0x80007387, 0x0) r4 = dup2(r2, r3) r5 = syz_open_dev$random(&(0x7f0000bdc000-0xc)='/dev/random\x00', 0x0, 0x0) dup2(r2, r5) ioctl$int_in(r4, 0x5452, &(0x7f0000e36000-0x8)=0x45) fcntl$setown(r2, 0x8, r0) fcntl$setsig(r5, 0xa, 0x0) r6 = gettid() tkill(r6, 0x100000000000016) 2018/02/01 16:23:09 executing program 2: mmap(&(0x7f0000000000/0x5000)=nil, 0x5000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000002000-0xa)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETAF(r0, 0x5404, &(0x7f0000003000-0x14)={0x0, 0x0, 0x0, 0x0, 0x0, 0xabd}) 2018/02/01 16:23:09 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2000000000001, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000cec000-0xa)='net/arp\x00') sendto$inet6(r0, &(0x7f0000a9c000), 0x0, 0xfffffefffffffffe, &(0x7f0000f63000-0x1c)={0xa, 0xffffffffffffffff, 0x0, @loopback={0x0, 0x1}}, 0x1c) sendfile(r0, r1, &(0x7f0000cd2000-0x8), 0x10001) 2018/02/01 16:23:09 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = epoll_create(0x5) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000004000-0xc)) epoll_ctl$EPOLL_CTL_MOD(r1, 0x3, r0, &(0x7f0000045000-0xc)={0x1}) [ 234.896861] SELinux: policydb string SE Linux does not match my string SE Linux [ 234.921499] SELinux: failed to load policy [ 234.931545] SELinux: policydb string SE Linux does not match my string SE Linux [ 234.939677] SELinux: failed to load policy 2018/02/01 16:23:09 executing program 6: mmap(&(0x7f0000000000/0xc34000)=nil, 0xc34000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = request_key(&(0x7f0000c33000)='id_legacy\x00', &(0x7f0000106000-0x5)={0x73, 0x79, 0x7a, 0x0}, &(0x7f000013a000-0x5)='}GPL\x00', 0x0) r1 = add_key(&(0x7f00006c2000)='user\x00', &(0x7f000086e000)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000c2c000-0x4f)='*', 0x1, r0) keyctl$revoke(0x3, r1) add_key(&(0x7f0000036000-0x5)='user\x00', &(0x7f0000047000-0x5)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000c32000)='b', 0x1, 0xffffffffffffffff) 2018/02/01 16:23:09 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000e01000)={0x0, 0x0, &(0x7f0000454000-0x10)={&(0x7f0000d54000)={0x2, 0x13, 0x0, 0x0, 0x2, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, []}, 0x10}, 0x1}, 0x0) 2018/02/01 16:23:09 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$selinux_load(0xffffffffffffff9c, &(0x7f0000007000-0xe)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r0, &(0x7f0000f7a000-0x12)={0xf97cff8c, 0x8, 'SE\vLinux'}, 0x10) 2018/02/01 16:23:09 executing program 4: mmap(&(0x7f0000000000/0x8000)=nil, 0x8000, 0x3, 0x32, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000005000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000009000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x4, 0x32, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000e000-0x30)={0x0, 0x0, &(0x7f000000e000-0x54)=[], 0x0, 0x0, &(0x7f000000e000-0xca)}) 2018/02/01 16:23:09 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket(0x20000000000000a, 0x2, 0x0) connect$inet6(r0, &(0x7f00006b2000)={0xa, 0xffffffffffffffff, 0x0, @remote={0xfe, 0x80, [], 0xffffffffffffffff, 0xbb}, 0x100000001}, 0x1c) connect$inet(r0, &(0x7f00009a0000)={0x2, 0xffffffffffffffff, @multicast2=0xe0000002}, 0x10) 2018/02/01 16:23:09 executing program 1: mmap(&(0x7f0000000000/0x9000)=nil, 0x9000, 0x3, 0x32, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000007000-0x60)={0x0, 0x3b, 0x0, @tid}, &(0x7f0000006000)) timer_getoverrun(0x0) 2018/02/01 16:23:09 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000e72000)={&(0x7f0000002000-0xc)={0x10}, 0xc, &(0x7f0000007000)={&(0x7f0000981000)={0x20, 0x13, 0x109, 0xffffffffffffffff, 0xffffffffffffffff, {0x1f}, [@typed={0xc, 0x1, @ipv4=@rand_addr}]}, 0x20}, 0x1}, 0x0) 2018/02/01 16:23:09 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000e01000)={0x0, 0x0, &(0x7f0000454000-0x10)={&(0x7f0000d54000)={0x2, 0x13, 0x0, 0x0, 0x2, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, []}, 0x10}, 0x1}, 0x0) 2018/02/01 16:23:09 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) capset(&(0x7f00000fc000)={0x19980330}, &(0x7f0000244000)) r0 = getpid() setpriority(0x0, r0, 0x0) [ 234.987920] SELinux: policydb string SE Linux does not match my string SE Linux [ 234.999828] SELinux: failed to load policy [ 235.023502] binder: 32331:32335 ioctl c0306201 2000dfd0 returned -14 2018/02/01 16:23:09 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = gettid() rt_sigtimedwait(&(0x7f0000645000-0x8), &(0x7f0000ded000), &(0x7f000052f000)={0x40000077359400}, 0x8) pipe(&(0x7f0000d8c000-0x8)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000e13000-0x8)={0xffffffffffffffff, 0xffffffffffffffff}) tee(r1, r3, 0x80007387, 0x0) r4 = dup2(r2, r3) r5 = syz_open_dev$random(&(0x7f0000bdc000-0xc)='/dev/random\x00', 0x0, 0x0) dup2(r2, r5) ioctl$int_in(r4, 0x5452, &(0x7f0000e36000-0x8)=0x45) fcntl$setown(r2, 0x8, r0) fcntl$setsig(r5, 0xa, 0x0) r6 = gettid() tkill(r6, 0x100000000000016) 2018/02/01 16:23:09 executing program 1: mmap(&(0x7f0000000000/0xef6000)=nil, 0xef6000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0xa) sendmsg$nl_route(r0, &(0x7f000001c000-0x38)={&(0x7f0000d8c000)={0x10}, 0xc, &(0x7f000000b000)={&(0x7f0000ef6000-0x5c)=@newneigh={0x24, 0x1c, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, {0x0, 0x0, 0x0, 0x0, 0x0, 0x10}, [@NDA_VLAN={0x8, 0x5}]}, 0x24}, 0x1}, 0x0) [ 235.057833] binder: 32331:32335 ioctl c0306201 2000dfd0 returned -14 2018/02/01 16:23:09 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mkdir(&(0x7f000052b000-0x8)='./file0\x00', 0x0) r0 = open(&(0x7f0000033000-0x8)='./file0\x00', 0x0, 0x0) mkdirat(r0, &(0x7f0000b10000-0x8)='./file0\x00', 0x0) mount(&(0x7f0000df2000)='./file0/file0\x00', &(0x7f0000a17000-0x8)='./file0\x00', &(0x7f0000df3000-0x3)='\x00v\t', 0x1001, &(0x7f0000a06000)) unlinkat(r0, &(0x7f000057d000)='./file0\x00', 0x200) mount(&(0x7f0000609000)='./file0\x00', &(0x7f0000712000)='./file0\x00', &(0x7f0000c5a000)='ext3\x00', 0x2000, &(0x7f00003db000-0x23)) 2018/02/01 16:23:09 executing program 3: mmap(&(0x7f0000000000/0x17000)=nil, 0x17000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000010000)='net/icmp\x00') r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f000000c000-0xc)={0x5}) epoll_ctl$EPOLL_CTL_MOD(r1, 0x3, r0, &(0x7f000000f000)) epoll_wait(r1, &(0x7f0000004000-0xc)=[{}], 0x1, 0x0) 2018/02/01 16:23:09 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = timerfd_create(0x0, 0x0) timerfd_settime(r0, 0x3, &(0x7f0000005000)={{0x0, 0x4}, {0x101}}, &(0x7f000000c000-0x20)) timerfd_settime(r0, 0x0, &(0x7f000000b000)={{}, {0x0, 0x200}}, &(0x7f000048a000-0x20)) 2018/02/01 16:23:09 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = gettid() rt_sigtimedwait(&(0x7f0000645000-0x8), &(0x7f0000ded000), &(0x7f000052f000)={0x40000077359400}, 0x8) pipe(&(0x7f0000d8c000-0x8)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000e13000-0x8)={0xffffffffffffffff, 0xffffffffffffffff}) tee(r1, r3, 0x80007387, 0x0) r4 = dup2(r2, r3) r5 = syz_open_dev$random(&(0x7f0000bdc000-0xc)='/dev/random\x00', 0x0, 0x0) dup2(r2, r5) ioctl$int_in(r4, 0x5452, &(0x7f0000e36000-0x8)=0x45) fcntl$setown(r2, 0x8, r0) fcntl$setsig(r5, 0xa, 0x0) r6 = gettid() tkill(r6, 0x100000000000016) 2018/02/01 16:23:09 executing program 1: mmap(&(0x7f0000000000/0xcd7000)=nil, 0xcd7000, 0x3, 0x32, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000cd6000-0x10)={0x0}) setitimer(0x0, &(0x7f0000a0b000)={{}, {r0}}, &(0x7f0000cd5000)) alarm(0x0) 2018/02/01 16:23:09 executing program 2: mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x8000000000000802, 0x0) getsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f0000001000-0x2), &(0x7f0000001000-0x4)=0x4) 2018/02/01 16:23:09 executing program 6: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)={0xaa}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) request_key(&(0x7f0000011000)='id_resolver\x00', &(0x7f0000001000-0x5)={0x73, 0x79, 0x7a}, &(0x7f0000001000-0x3)='.@\x00', 0xfffffffffffffffe) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r1 = gettid() timer_create(0x0, &(0x7f0000ec5000)={0x0, 0x12, 0x0, @tid}, &(0x7f0000fd7000)) timer_settime(0x0, 0x0, &(0x7f0000d07000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r1, 0x1000000000016) ioctl$UFFDIO_ZEROPAGE(r0, 0x8010aa02, &(0x7f00000c1000-0x10)={&(0x7f0000011000/0x3000)=nil, 0x3000}) 2018/02/01 16:23:09 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000e4e000-0xf)='/dev/sequencer\x00', 0xa202, 0x0) write$sndseq(r0, &(0x7f000048c000)=[{0x0, 0x0, 0x0, 0x0, @time={0x0, 0x1c9c380}, {0x5, 0x7fff}, {}, @raw32}], 0x30) 2018/02/01 16:23:09 executing program 3: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000000)={0xaa}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) prlimit64(0x0, 0x0, &(0x7f0000013000-0x10), &(0x7f0000004000-0x10)) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) clone(0x0, &(0x7f0000f39000), &(0x7f0000eaa000-0x4), &(0x7f0000bf3000-0x4), &(0x7f0000873000-0x1)) ioctl$UFFDIO_ZEROPAGE(r0, 0x8010aa02, &(0x7f0000bb7000-0x10)={&(0x7f0000011000/0x3000)=nil, 0x3000}) 2018/02/01 16:23:09 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$tun(&(0x7f0000e9b000+0x18a)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000a5b000-0x28)={@common='ip6gretap0\x00', @ifru_ivalue=0x9}) ioctl$SIOCSIFHWADDR(r0, 0x8924, &(0x7f000099d000-0x50)={@common='vcan0\x00', @ifru_flags}) 2018/02/01 16:23:09 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000045000-0x8)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000c7e000-0x8)=@abs, 0x8) sendmmsg$unix(r1, &(0x7f00000bd000)=[], 0x80, 0x0) recvmmsg(r0, &(0x7f0000100000-0x40)=[{{0x0, 0x0, &(0x7f0000b64000-0x8)=[]}}], 0x1, 0x0, &(0x7f000040b000-0x8)) 2018/02/01 16:23:09 executing program 7: mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_int(r0, 0x107, 0x7, &(0x7f0000000000), 0x4) 2018/02/01 16:23:09 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x1, 0x32, 0xffffffffffffffff, 0x0) ioctl$TIOCPKT(r0, 0x5420, &(0x7f0000818000)) 2018/02/01 16:23:09 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_mreq(r0, 0x29, 0x3, &(0x7f0000e7b000-0x14)={@empty}, &(0x7f00007d9000)=0x14) 2018/02/01 16:23:09 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000e57000-0x18)={0xaa}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000799000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r1 = creat(&(0x7f0000729000)='./file0\x00', 0x0) write$sndseq(r1, &(0x7f0000012000-0x2e)=[{0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @time=@time={0x77359400}}], 0x30) lseek(0xffffffffffffffff, 0x0, 0x0) ioctl$UFFDIO_ZEROPAGE(r0, 0x8010aa02, &(0x7f0000002000-0x10)={&(0x7f0000011000/0x3000)=nil, 0x3000}) ioctl$UFFDIO_UNREGISTER(r0, 0x8010aa01, &(0x7f0000bd0000)={&(0x7f0000d16000/0x1000)=nil, 0x1000}) eventfd2(0xffd, 0x0) 2018/02/01 16:23:09 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$tun(&(0x7f0000e2d000)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000b1f000)={@common='eql\x00', @ifru_map={0xe70a}}) r1 = syz_open_dev$tun(&(0x7f0000a9e000-0xd)='/dev/net/tun\x00', 0x0, 0xa) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000d89000)={@common='eql\x00', @ifru_names=@syzn={0x73, 0x79, 0x7a}}) write$tun(r1, &(0x7f0000955000)=@hdr={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @ipv4={{0x5, 0x4, 0x0, 0x0, 0x28, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @empty, @broadcast=0xffffffff, {[]}}, @tcp={{0xffffffffffffffff, 0xffffffffffffffff, 0x42424242, 0x42424242, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, {[]}}}}}, 0x32) dup2(r0, r1) 2018/02/01 16:23:09 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f000000c000-0xd)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f0000010000-0xd)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000006000-0x2c)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000002000)}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000009000-0x30)={0x8, 0x0, &(0x7f0000fde000-0x10)=[@request_death={0x400c630e, 0x0, 0x3}], 0x297, 0x0, &(0x7f0000001000-0xb3)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000e000-0x30)={0x4, 0x0, &(0x7f000000d000-0x98)=[@enter_looper={0x630c}], 0x1, 0x0, &(0x7f0000009000-0xc9)="c2"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000013000-0x30)={0xc, 0x0, &(0x7f0000007000)=[@dead_binder_done={0x40086310}], 0x0, 0x0, &(0x7f0000012000)}) 2018/02/01 16:23:09 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000c27000-0x1c)={0xa, 0x2, 0x0, @empty}, 0x1c) listen(r1, 0x200) sendto$inet6(r0, &(0x7f0000f6f000)="8d", 0x1, 0x20000004, &(0x7f0000241000)={0xa, 0x2, 0x0, @empty}, 0x1c) shutdown(r1, 0x0) 2018/02/01 16:23:09 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000fd6000-0x8)='./file0\x00', 0x0) r0 = open(&(0x7f00006a2000)='./file0\x00', 0x0, 0x0) mkdirat(r0, &(0x7f0000034000-0x8)='./file0\x00', 0x0) mount(&(0x7f00001a5000-0xe)='./file0/file0\x00', &(0x7f0000f8a000-0x8)='./file0\x00', &(0x7f000067b000)='\x00v\t', 0x1004, &(0x7f000073b000-0x1)) unlinkat(r0, &(0x7f000048f000-0x8)='./file0\x00', 0x200) getdents64(r0, &(0x7f0000810000)=""/61, 0x3d) [ 235.268776] FAULT_FLAG_ALLOW_RETRY missing 30 [ 235.274113] CPU: 1 PID: 32401 Comm: syz-executor2 Not tainted 4.15.0+ #290 [ 235.281144] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 235.290496] Call Trace: [ 235.293092] dump_stack+0x194/0x257 [ 235.296738] ? arch_local_irq_restore+0x53/0x53 [ 235.301411] ? __lock_acquire+0x664/0x3e00 [ 235.305650] ? handle_userfault+0xb97/0x2500 [ 235.310058] handle_userfault+0xbd9/0x2500 [ 235.314270] ? handle_userfault+0x185a/0x2500 [ 235.318750] ? userfaultfd_ioctl+0x4520/0x4520 [ 235.320426] binder: 32421 RLIMIT_NICE not set [ 235.323197] binder: 32410:32421 BC_DEAD_BINDER_DONE 0000000000000000 not found [ 235.335121] ? debug_check_no_locks_freed+0x3c0/0x3c0 [ 235.337801] binder: 32410:32422 tried to acquire reference to desc 0, got 1 instead [ 235.339150] binder: 32410:32422 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 235.340318] binder: 32421 RLIMIT_NICE not set [ 235.340345] binder: 32410:32422 BC_DEAD_BINDER_DONE 0000000000000000 not found [ 235.367052] ? __save_stack_trace+0x7e/0xd0 [ 235.371363] ? depot_save_stack+0x12c/0x490 [ 235.375662] ? print_irqtrace_events+0x270/0x270 [ 235.380395] ? print_irqtrace_events+0x270/0x270 [ 235.385134] ? save_stack+0xa3/0xd0 [ 235.388743] ? save_stack+0x43/0xd0 [ 235.392342] ? kasan_kmalloc+0xad/0xe0 [ 235.396204] ? kasan_slab_alloc+0x12/0x20 [ 235.400323] ? kmem_cache_alloc+0x12e/0x760 [ 235.404627] ? ptlock_alloc+0x24/0x70 [ 235.408407] ? pte_alloc_one+0x59/0x100 [ 235.412369] ? __pte_alloc+0x2a/0x310 [ 235.416143] ? __handle_mm_fault+0x2d06/0x3ce0 [ 235.420700] ? handle_mm_fault+0x38f/0x930 [ 235.424910] ? __do_page_fault+0x5c9/0xc90 [ 235.429120] ? do_page_fault+0xee/0x720 [ 235.433078] ? page_fault+0x2c/0x60 [ 235.436682] ? iov_iter_fault_in_readable+0x1a7/0x410 [ 235.441846] ? generic_perform_write+0x200/0x600 [ 235.446575] ? __generic_file_write_iter+0x366/0x5b0 [ 235.451739] ? __vfs_write+0x684/0x970 [ 235.455615] ? __lock_acquire+0x664/0x3e00 [ 235.459825] ? __lock_acquire+0x664/0x3e00 [ 235.464038] ? print_irqtrace_events+0x270/0x270 [ 235.468770] ? check_noncircular+0x20/0x20 [ 235.472986] ? debug_check_no_locks_freed+0x3c0/0x3c0 [ 235.478155] ? debug_check_no_locks_freed+0x3c0/0x3c0 [ 235.483324] ? find_held_lock+0x35/0x1d0 [ 235.487372] ? __handle_mm_fault+0x3296/0x3ce0 [ 235.491931] ? lock_downgrade+0x980/0x980 [ 235.496057] ? lock_release+0xa40/0xa40 [ 235.500017] ? do_raw_spin_trylock+0x190/0x190 [ 235.504583] ? userfaultfd_ctx_put+0x720/0x720 [ 235.509146] ? _raw_spin_unlock+0x22/0x30 [ 235.513289] __handle_mm_fault+0x32a3/0x3ce0 [ 235.517683] ? __pmd_alloc+0x4e0/0x4e0 [ 235.521545] ? check_noncircular+0x20/0x20 [ 235.525754] ? print_irqtrace_events+0x270/0x270 [ 235.530493] ? find_held_lock+0x35/0x1d0 [ 235.534538] ? handle_mm_fault+0x2a0/0x930 [ 235.538750] ? lock_downgrade+0x980/0x980 [ 235.542896] handle_mm_fault+0x38f/0x930 [ 235.546946] ? __handle_mm_fault+0x3ce0/0x3ce0 [ 235.551512] ? vmacache_find+0x5f/0x280 [ 235.555466] ? find_vma+0x30/0x150 [ 235.558984] __do_page_fault+0x5c9/0xc90 [ 235.563042] ? mm_fault_error+0x2c0/0x2c0 [ 235.567172] ? __lock_is_held+0xb6/0x140 [ 235.571212] do_page_fault+0xee/0x720 [ 235.574996] ? __do_page_fault+0xc90/0xc90 [ 235.579209] ? check_noncircular+0x20/0x20 [ 235.583416] ? debug_check_no_locks_freed+0x3c0/0x3c0 [ 235.588584] ? check_noncircular+0x20/0x20 [ 235.592794] ? check_noncircular+0x20/0x20 [ 235.597007] ? __enqueue_entity+0x109/0x1e0 [ 235.601334] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 235.606165] page_fault+0x2c/0x60 [ 235.609596] RIP: 0010:iov_iter_fault_in_readable+0x1a7/0x410 [ 235.615363] RSP: 0018:ffff8801c447f928 EFLAGS: 00010246 [ 235.620698] RAX: 0000000000010000 RBX: 0000000020011fd2 RCX: ffffffff825adc81 [ 235.627943] RDX: 00000000000000c9 RSI: ffffc90002f4e000 RDI: ffff8801c447fd28 [ 235.635185] RBP: ffff8801c447fa08 R08: 1ffff10036de0472 R09: 0000000000000000 [ 235.642427] R10: ffff8801c447f858 R11: 0000000000000000 R12: 1ffff1003888ff28 [ 235.649677] R13: ffff8801c447f9e0 R14: 0000000000000000 R15: ffff8801c447fd20 [ 235.656938] ? iov_iter_fault_in_readable+0x1a1/0x410 [ 235.662109] ? iov_iter_fault_in_readable+0x1a1/0x410 [ 235.667278] ? iov_iter_revert+0x9d0/0x9d0 [ 235.671489] ? current_kernel_time64+0x122/0x2f0 [ 235.676220] ? trace_hardirqs_on_caller+0x421/0x5c0 [ 235.681212] ? trace_hardirqs_on+0xd/0x10 [ 235.685338] ? current_kernel_time64+0x1d4/0x2f0 [ 235.690074] generic_perform_write+0x200/0x600 [ 235.694628] ? __vfs_getxattr+0x8b/0xc0 [ 235.698586] ? filemap_fdatawait_keep_errors+0xb0/0xb0 [ 235.703833] ? file_update_time+0xd3/0x5b0 [ 235.708045] ? current_time+0xc0/0xc0 [ 235.711814] ? clear_nlink+0xb0/0xb0 [ 235.716280] ? down_write+0x87/0x120 [ 235.719973] __generic_file_write_iter+0x366/0x5b0 [ 235.724883] generic_file_write_iter+0x399/0x790 [ 235.729629] ? __generic_file_write_iter+0x5b0/0x5b0 [ 235.734716] ? iov_iter_init+0xaf/0x1d0 [ 235.738668] __vfs_write+0x684/0x970 [ 235.742354] ? lock_acquire+0x1d5/0x580 [ 235.746305] ? kernel_read+0x120/0x120 [ 235.750199] ? rcu_sync_lockdep_assert+0x6d/0xb0 [ 235.754938] ? __sb_start_write+0x209/0x2a0 [ 235.759249] vfs_write+0x189/0x510 [ 235.762766] SyS_write+0xef/0x220 [ 235.766196] ? SyS_read+0x220/0x220 [ 235.769794] ? trace_hardirqs_on_caller+0x421/0x5c0 [ 235.774782] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 235.779518] entry_SYSCALL_64_fastpath+0x29/0xa0 [ 235.784254] RIP: 0033:0x453299 [ 235.787416] RSP: 002b:00007fe2f145dc58 EFLAGS: 00000212 ORIG_RAX: 0000000000000001 [ 235.795096] RAX: ffffffffffffffda RBX: 000000000071bea0 RCX: 0000000000453299 [ 235.802345] RDX: 0000000000000030 RSI: 0000000020011fd2 RDI: 0000000000000014 [ 235.809587] RBP: 0000000000000069 R08: 0000000000000000 R09: 0000000000000000 2018/02/01 16:23:10 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = gettid() rt_sigtimedwait(&(0x7f0000645000-0x8), &(0x7f0000ded000), &(0x7f000052f000)={0x40000077359400}, 0x8) pipe(&(0x7f0000d8c000-0x8)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000e13000-0x8)={0xffffffffffffffff, 0xffffffffffffffff}) tee(r1, r3, 0x80007387, 0x0) r4 = dup2(r2, r3) r5 = syz_open_dev$random(&(0x7f0000bdc000-0xc)='/dev/random\x00', 0x0, 0x0) dup2(r2, r5) ioctl$int_in(r4, 0x5452, &(0x7f0000e36000-0x8)=0x45) fcntl$setown(r2, 0x8, r0) fcntl$setsig(r5, 0xa, 0x12) r6 = gettid() tkill(0x0, 0x100000000000016) 2018/02/01 16:23:10 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$loop(&(0x7f0000814000)='/dev/loop#\x00', 0x800000000000003, 0x0) keyctl$instantiate(0xc, 0x0, &(0x7f0000c1b000-0xc4)="b4", 0x1, 0x0) ioctl$LOOP_GET_STATUS(r0, 0x4c03, &(0x7f0000d51000-0x98)) 2018/02/01 16:23:10 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_crypto(r0, &(0x7f0000dcd000)={&(0x7f00004dc000-0xc)={0x10}, 0xc, &(0x7f0000796000-0x10)={&(0x7f0000bfb000)=@alg={0xe0, 0x10, 0xb0d, 0xffffffffffffffff, 0xffffffffffffffff, {{'xts-camellia-aesni-avx2\x00'}}, []}, 0xe0}, 0x1}, 0x0) [ 235.816833] R10: 0000000000000000 R11: 0000000000000212 R12: 00000000006efa78 [ 235.824075] R13: 00000000ffffffff R14: 00007fe2f145e6d4 R15: 0000000000000000 [ 235.863000] netlink: 192 bytes leftover after parsing attributes in process `syz-executor7'. [ 235.877611] netlink: 192 bytes leftover after parsing attributes in process `syz-executor7'. [ 235.882353] FAULT_FLAG_ALLOW_RETRY missing 30 [ 235.882365] CPU: 0 PID: 32411 Comm: syz-executor2 Not tainted 4.15.0+ #290 [ 235.882370] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 235.882373] Call Trace: [ 235.882390] dump_stack+0x194/0x257 [ 235.882406] ? arch_local_irq_restore+0x53/0x53 [ 235.882423] ? __lock_acquire+0x664/0x3e00 [ 235.882436] ? handle_userfault+0xb97/0x2500 [ 235.882451] handle_userfault+0xbd9/0x2500 [ 235.882459] ? handle_userfault+0x185a/0x2500 [ 235.882485] ? userfaultfd_ioctl+0x4520/0x4520 [ 235.882493] ? debug_check_no_locks_freed+0x3c0/0x3c0 [ 235.882503] ? __save_stack_trace+0x7e/0xd0 [ 235.882519] ? depot_save_stack+0x12c/0x490 [ 235.882533] ? print_irqtrace_events+0x270/0x270 [ 235.882544] ? print_irqtrace_events+0x270/0x270 [ 235.882553] ? save_stack+0xa3/0xd0 [ 235.882564] ? save_stack+0x43/0xd0 [ 235.882570] ? kasan_kmalloc+0xad/0xe0 [ 235.882578] ? kasan_slab_alloc+0x12/0x20 [ 235.882584] ? kmem_cache_alloc+0x12e/0x760 [ 235.882592] ? ptlock_alloc+0x24/0x70 [ 235.882599] ? pte_alloc_one+0x59/0x100 [ 235.882605] ? __pte_alloc+0x2a/0x310 [ 235.882613] ? __handle_mm_fault+0x2d06/0x3ce0 [ 235.882620] ? handle_mm_fault+0x38f/0x930 [ 235.882627] ? __do_page_fault+0x5c9/0xc90 [ 235.882634] ? do_page_fault+0xee/0x720 [ 235.882640] ? page_fault+0x2c/0x60 [ 235.882649] ? iov_iter_fault_in_readable+0x1a7/0x410 [ 235.882656] ? generic_perform_write+0x200/0x600 [ 235.882663] ? __generic_file_write_iter+0x366/0x5b0 [ 235.882670] ? __vfs_write+0x684/0x970 [ 235.882684] ? __lock_acquire+0x664/0x3e00 [ 235.882695] ? __lock_acquire+0x664/0x3e00 [ 235.882703] ? print_irqtrace_events+0x270/0x270 [ 235.882716] ? check_noncircular+0x20/0x20 [ 235.882737] ? debug_check_no_locks_freed+0x3c0/0x3c0 [ 235.882748] ? debug_check_no_locks_freed+0x3c0/0x3c0 [ 235.882764] ? find_held_lock+0x35/0x1d0 [ 235.882785] ? __handle_mm_fault+0x3296/0x3ce0 [ 235.882796] ? lock_downgrade+0x980/0x980 [ 235.882816] ? lock_release+0xa40/0xa40 [ 235.882833] ? do_raw_spin_trylock+0x190/0x190 [ 235.882844] ? userfaultfd_ctx_put+0x720/0x720 [ 235.882858] ? _raw_spin_unlock+0x22/0x30 [ 235.882881] __handle_mm_fault+0x32a3/0x3ce0 [ 235.882901] ? __pmd_alloc+0x4e0/0x4e0 [ 235.882909] ? check_noncircular+0x20/0x20 [ 235.882930] ? find_held_lock+0x35/0x1d0 [ 235.882953] ? handle_mm_fault+0x2a0/0x930 [ 235.882965] ? lock_downgrade+0x980/0x980 [ 235.883017] handle_mm_fault+0x38f/0x930 [ 235.883031] ? __handle_mm_fault+0x3ce0/0x3ce0 [ 235.883037] ? vmacache_find+0x5f/0x280 [ 235.883052] ? find_vma+0x30/0x150 [ 235.883068] __do_page_fault+0x5c9/0xc90 [ 235.883089] ? mm_fault_error+0x2c0/0x2c0 [ 235.883101] ? lock_release+0xa40/0xa40 [ 235.883121] do_page_fault+0xee/0x720 [ 235.883133] ? __do_page_fault+0xc90/0xc90 [ 235.883150] ? _raw_spin_unlock+0x22/0x30 [ 235.883160] ? __mark_inode_dirty+0x262/0x1170 [ 235.883174] ? __inode_attach_wb+0xf70/0xf70 [ 235.883192] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 235.883212] page_fault+0x2c/0x60 [ 235.883221] RIP: 0010:iov_iter_fault_in_readable+0x1a7/0x410 [ 235.883226] RSP: 0018:ffff8801c3cbf928 EFLAGS: 00010246 [ 235.883234] RAX: 0000000000010000 RBX: 0000000020011fd2 RCX: ffffffff825adc81 [ 235.883239] RDX: 00000000000000c5 RSI: ffffc90003050000 RDI: ffff8801c3cbfd28 [ 235.883243] RBP: ffff8801c3cbfa08 R08: 0000000000000000 R09: 1ffff10038797ed1 [ 235.883248] R10: ffff8801c3cbfa50 R11: 0000000000000003 R12: 1ffff10038797f28 [ 235.883252] R13: ffff8801c3cbf9e0 R14: 0000000000000000 R15: ffff8801c3cbfd20 [ 235.883275] ? iov_iter_fault_in_readable+0x1a1/0x410 [ 235.883293] ? iov_iter_fault_in_readable+0x1a1/0x410 [ 235.883306] ? iov_iter_revert+0x9d0/0x9d0 [ 235.883318] ? current_kernel_time64+0x122/0x2f0 [ 235.883330] ? trace_hardirqs_on_caller+0x421/0x5c0 [ 235.883340] ? trace_hardirqs_on+0xd/0x10 [ 235.883349] ? current_kernel_time64+0x1d4/0x2f0 [ 235.883365] generic_perform_write+0x200/0x600 [ 235.883396] ? filemap_fdatawait_keep_errors+0xb0/0xb0 [ 235.883402] ? file_update_time+0xd3/0x5b0 [ 235.883415] ? current_time+0xc0/0xc0 [ 235.883421] ? clear_nlink+0xb0/0xb0 [ 235.883446] ? down_write+0x87/0x120 [ 235.883462] __generic_file_write_iter+0x366/0x5b0 [ 235.883481] generic_file_write_iter+0x399/0x790 [ 235.883498] ? __generic_file_write_iter+0x5b0/0x5b0 [ 235.883514] ? iov_iter_init+0xaf/0x1d0 [ 235.883528] __vfs_write+0x684/0x970 [ 235.883535] ? lock_acquire+0x1d5/0x580 [ 235.883548] ? kernel_read+0x120/0x120 [ 235.883590] ? rcu_sync_lockdep_assert+0x6d/0xb0 [ 235.883599] ? __sb_start_write+0x209/0x2a0 [ 235.883614] vfs_write+0x189/0x510 [ 235.883630] SyS_write+0xef/0x220 [ 235.883643] ? SyS_read+0x220/0x220 [ 235.883650] ? trace_hardirqs_on_caller+0x421/0x5c0 [ 235.883661] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 235.883682] entry_SYSCALL_64_fastpath+0x29/0xa0 [ 235.883688] RIP: 0033:0x453299 [ 235.883692] RSP: 002b:00007fe2f143cc58 EFLAGS: 00000212 ORIG_RAX: 0000000000000001 [ 235.883700] RAX: ffffffffffffffda RBX: 000000000071bf58 RCX: 0000000000453299 2018/02/01 16:23:10 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000005000)='projid_map\x00') lseek(r0, 0x2, 0x0) write$tun(r0, &(0x7f0000624000-0x778)=@hdr={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @ipv6={0x0, 0x6, "594714", 0x14, 0x0, 0x0, @local={0xfe, 0x80, [], 0x0, 0xaa}, @empty, {[], @tcp={{0x0, 0x0, 0x42424242, 0x42424242, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, {[]}}}}}}, 0x46) 2018/02/01 16:23:10 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000540000-0x28)={@common='lo\x00', &(0x7f00000bf000)=@ethtool_cmd={0x23}}) 2018/02/01 16:23:10 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f000000a000-0x38)={&(0x7f0000000000)={0x10}, 0xc, &(0x7f0000007000)={&(0x7f000000c000)={0x14, 0x0, 0x105, 0xffffffffffffffff, 0xffffffffffffffff, {}, []}, 0x14}, 0x1}, 0x0) 2018/02/01 16:23:10 executing program 4: mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket(0x18, 0x0, 0x4) connect$unix(r0, &(0x7f0000000000)=@file, 0x2) 2018/02/01 16:23:10 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket(0x10, 0x2, 0x0) sendmsg$nl_route(r0, &(0x7f0000504000)={&(0x7f0000dff000-0xc)={0x10}, 0xc, &(0x7f000009b000)={&(0x7f00009c5000)=@ipv6_deladdr={0x34, 0x15, 0x1, 0xffffffffffffffff, 0xffffffffffffffff, {0xa}, [@IFA_FLAGS={0x8, 0x8}, @IFA_ADDRESS={0x14, 0x1, @dev={0xfe, 0x80}}]}, 0x34}, 0x1}, 0x0) 2018/02/01 16:23:10 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d9e000-0x1c)={0xa, 0x2, 0x0, @empty}, 0x1c) listen(r1, 0x0) sendto$inet(r0, &(0x7f0000a29000-0x1), 0x0, 0x20008045, &(0x7f00005f0000-0x10)={0x2, 0x2, @loopback=0x7f000001}, 0x10) r2 = accept(r1, &(0x7f0000fd7000+0xb75)=@ipx, &(0x7f0000f7e000)=0x10) sendmmsg(r2, &(0x7f0000426000-0x1a4)=[{{&(0x7f00007ab000-0x60)=@pppoe={0x18, 0x0, {0x0, @local={[0xaa, 0xaa, 0xaa, 0xaa], 0xffffffffffffffff, 0xaa}, @syzn={0x73, 0x79, 0x7a}}}, 0x1e, &(0x7f0000afe000-0x70)=[{&(0x7f0000037000-0x1000)='L', 0x1}], 0x1, &(0x7f0000972000)=[]}}], 0x1, 0x48040) close(r0) 2018/02/01 16:23:10 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) seccomp(0x1, 0x0, &(0x7f0000f1b000-0x8)={0x2, &(0x7f00000d8000-0x38)=[{0x81}, {0x6}]}) 2018/02/01 16:23:10 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = gettid() rt_sigtimedwait(&(0x7f0000645000-0x8), &(0x7f0000ded000), &(0x7f000052f000)={0x40000077359400}, 0x8) pipe(&(0x7f0000d8c000-0x8)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000e13000-0x8)={0xffffffffffffffff, 0xffffffffffffffff}) tee(r1, r3, 0x80007387, 0x0) r4 = dup2(r2, r3) r5 = syz_open_dev$random(&(0x7f0000bdc000-0xc)='/dev/random\x00', 0x0, 0x0) dup2(r2, r5) ioctl$int_in(r4, 0x5452, &(0x7f0000e36000-0x8)=0x45) fcntl$setown(r2, 0x8, r0) fcntl$setsig(r5, 0xa, 0x12) r6 = gettid() tkill(0x0, 0x100000000000016) 2018/02/01 16:23:10 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000045000-0x8)={0xffffffffffffffff, 0xffffffffffffffff}) bind$unix(r0, &(0x7f000055b000)=@file={0x1, './file0\x00'}, 0xa) poll(&(0x7f0000085000-0x10)=[{r1}], 0x1, 0x58) connect$unix(r1, &(0x7f00008cf000)=@file={0x1, './file0\x00'}, 0xa) [ 235.883704] RDX: 0000000000000030 RSI: 0000000020011fd2 RDI: 0000000000000014 [ 235.883708] RBP: 0000000000000321 R08: 0000000000000000 R09: 0000000000000000 [ 235.883713] R10: 0000000000000000 R11: 0000000000000212 R12: 00000000006f3bb8 [ 235.883717] R13: 00000000ffffffff R14: 00007fe2f143d6d4 R15: 0000000000000007 [ 236.430405] audit: type=1326 audit(1517502190.721:155): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 pid=32447 comm="syz-executor7" exe="/root/syz-executor7" sig=31 arch=c000003e syscall=202 compat=0 ip=0x453299 code=0x0 2018/02/01 16:23:10 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) seccomp(0x1, 0x0, &(0x7f0000029000-0x10)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0xfffffffffffffffb}]}) clock_getres(0x0, &(0x7f0000669000-0x10)) 2018/02/01 16:23:10 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000d30000)={&(0x7f0000126000-0xc)={0x10}, 0xc, &(0x7f0000d00000-0x10)={&(0x7f0000c20000)=@allocspi={0xf8, 0x16, 0x7, 0xffffffffffffffff, 0xffffffffffffffff, {{{@in=@loopback=0x7f000001, @in6=@local={0xfe, 0x80, [], 0xffffffffffffffff, 0xaa}}, {@in6=@local={0xfe, 0x80, [], 0xffffffffffffffff, 0xaa}, 0xffffffffffffffff, 0x33}, @in6=@mcast1={0xff, 0x1, [], 0x1}}}, []}, 0xf8}, 0x1}, 0x0) 2018/02/01 16:23:10 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndseq(&(0x7f000087c000-0xd)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r0, 0xc08c5332, &(0x7f0000be8000-0x8c)={0x0, 0x0, 0x0, 'queue0\x00'}) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r0, 0x40605346, &(0x7f00002f8000)) 2018/02/01 16:23:10 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x4) bind$netlink(r0, &(0x7f0000c29000)={0x10, 0x0, 0x0}, 0xc) bind$netlink(r0, &(0x7f0000317000-0xc)={0x2000000000000010, 0x0, 0x0}, 0xc) 2018/02/01 16:23:10 executing program 7: mmap(&(0x7f0000000000/0xfc6000)=nil, 0xfc6000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x8000000000000802, 0x88) sendmsg$inet_sctp(r0, &(0x7f0000a29000)={&(0x7f0000686000-0x10)=@in={0x2, 0x0, @empty}, 0x10, &(0x7f0000183000-0x18)=[{&(0x7f0000fc6000)='{', 0x1}], 0x1}, 0x0) 2018/02/01 16:23:10 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000066000-0x38)={&(0x7f00002e0000-0xc)={0x10}, 0xc, &(0x7f0000e2a000)={&(0x7f0000948000)={0x14, 0x1, 0xa, 0xfffffffffffffffd, 0xffffffffffffffff, 0xffffffffffffffff, {0x2}, []}, 0x14}, 0x1}, 0x0) 2018/02/01 16:23:10 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000028000-0xd)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_UNSUBSCRIBE_PORT(r0, 0x40505331, &(0x7f000003a000)={{}, {0x5}}) 2018/02/01 16:23:10 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = gettid() rt_sigtimedwait(&(0x7f0000645000-0x8), &(0x7f0000ded000), &(0x7f000052f000)={0x40000077359400}, 0x8) pipe(&(0x7f0000d8c000-0x8)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000e13000-0x8)={0xffffffffffffffff, 0xffffffffffffffff}) tee(r1, r3, 0x80007387, 0x0) r4 = dup2(r2, r3) r5 = syz_open_dev$random(&(0x7f0000bdc000-0xc)='/dev/random\x00', 0x0, 0x0) dup2(r2, r5) ioctl$int_in(r4, 0x5452, &(0x7f0000e36000-0x8)=0x45) fcntl$setown(r2, 0x8, r0) fcntl$setsig(r5, 0xa, 0x12) r6 = gettid() tkill(0x0, 0x100000000000016) 2018/02/01 16:23:10 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000615000)={0x0, 0x0}) setitimer(0x1, &(0x7f000087b000)={{}, {0x0, r0/1000+10000}}, &(0x7f000006d000-0x20)) getitimer(0x1, &(0x7f00004cf000-0x20)) 2018/02/01 16:23:10 executing program 6: mmap(&(0x7f0000000000/0x4ee000)=nil, 0x4ee000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000005000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) close(0xffffffffffffffff) r1 = syz_open_dev$binder(&(0x7f0000009000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) getxattr(&(0x7f0000009000)='./file0\x00', &(0x7f0000004000)=@random={'system.', '/dev/binder#\x00'}, &(0x7f000000c000-0x7e)=""/126, 0x7e) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x10, 0x0, &(0x7f000000a000)=[@acquire={0x40046305}, @decrefs={0x40046307}], 0x0, 0x0, &(0x7f0000009000-0x82)}) 2018/02/01 16:23:10 executing program 1: clone(0x0, &(0x7f00006cc000), &(0x7f0000a26000-0x4), &(0x7f0000dbb000), &(0x7f000076f000)) removexattr(&(0x7f0000706000-0x8)='./file0\x00', &(0x7f0000730000-0x15)=@random={'system.\x00', '/dev/binder#\x00'}) 2018/02/01 16:23:10 executing program 7: mmap(&(0x7f0000000000/0xb4c000)=nil, 0xb4c000, 0x3, 0x32, 0xffffffffffffffff, 0x0) seccomp(0x1, 0x0, &(0x7f0000001000-0x10)={0x2, &(0x7f000031c000-0x10)=[{0x0, 0x0, 0x0, 0xffffffffffffffe0}, {0x16}]}) pselect6(0x40, &(0x7f0000b4c000-0x40), &(0x7f0000b4b000), &(0x7f0000b4b000), &(0x7f0000444000-0x10)={0x0, 0x1c9c380}, &(0x7f0000b4b000)={&(0x7f00008a5000), 0x8}) [ 236.536804] audit: type=1326 audit(1517502190.827:156): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 pid=32465 comm="syz-executor0" exe="/root/syz-executor0" sig=31 arch=c000003e syscall=202 compat=0 ip=0x453299 code=0xffff0000 2018/02/01 16:23:10 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x1, 0x0) sendto$inet6(r0, &(0x7f0000639000-0x121), 0x0, 0xfffffefffffffffe, &(0x7f0000fd7000-0x1c)={0xa, 0xffffffffffffffff, 0x0, @ipv4={[], [0xff, 0xff], @loopback=0x7f000001}}, 0x1c) getsockopt$inet6_buf(r0, 0x29, 0x3d, &(0x7f000081c000)=""/169, &(0x7f0000636000)=0xa9) 2018/02/01 16:23:10 executing program 4: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)={0xaa}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) fchmodat(0xffffffffffffffff, &(0x7f0000012000)='./file0\x00', 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r1 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12, 0x0, @tid}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r1, 0x15) ioctl$UFFDIO_ZEROPAGE(r0, 0x8010aa02, &(0x7f00000c1000-0x10)={&(0x7f0000011000/0x3000)=nil, 0x3000}) [ 236.545494] ALSA: seq fatal error: cannot create timer (-22) [ 236.593713] binder: 32486 invalid dec weak, ref 492 desc 0 s 1 w 0 [ 236.598189] binder: BINDER_SET_CONTEXT_MGR already set [ 236.598199] binder: 32486:32491 ioctl 40046207 0 returned -16 [ 236.599465] binder: 32486 invalid dec weak, ref 493 desc 0 s 1 w 0 [ 236.662093] audit: type=1326 audit(1517502190.883:157): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 pid=32465 comm="syz-executor0" exe="/root/syz-executor0" sig=31 arch=c000003e syscall=202 compat=0 ip=0x453299 code=0xffff0000 [ 236.687347] audit: type=1326 audit(1517502190.904:158): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 pid=32490 comm="syz-executor7" exe="/root/syz-executor7" sig=31 arch=c000003e syscall=202 compat=0 ip=0x453299 code=0xffff0000 2018/02/01 16:23:11 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndtimer(&(0x7f00008ec000-0xf)='/dev/snd/timer\x00', 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_GSTATUS(r0, 0xc0505405, &(0x7f0000ff1000)={{0x1}}) 2018/02/01 16:23:11 executing program 1: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)={0xaa}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) setitimer(0x0, &(0x7f0000013000-0x20), &(0x7f0000004000-0x20)) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r1 = gettid() timer_create(0x0, &(0x7f0000ec5000)={0x0, 0x12, 0x0, @tid}, &(0x7f0000fd7000)) timer_settime(0x0, 0x0, &(0x7f0000d07000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r1, 0x1000000000016) ioctl$UFFDIO_ZEROPAGE(r0, 0x8010aa02, &(0x7f000009c000)={&(0x7f0000011000/0x3000)=nil, 0x3000}) 2018/02/01 16:23:11 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000443000)={@common='lo\x00', 0x0}) setsockopt$packet_int(r0, 0x107, 0xf, &(0x7f000008c000)=0x8, 0x4) sendto$packet(r0, &(0x7f0000215000-0x4d)="2d01000000e6000000005ca73d9fe3b5039b000000022fa51d28738167fb964051bac5fa07ff786316d84f1a0000000000000002e9e4b0d7efb2caef3e8f1902fcb8437e5b2fdeb3ab64bf49f8", 0x4d, 0x0, &(0x7f0000c2b000)={0x11, 0x800, r1, 0x1, 0x0, 0x6, @remote={[0xaa, 0xaa, 0xaa, 0xaa], 0xffffffffffffffff, 0xbb}}, 0x14) 2018/02/01 16:23:11 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000f0c000)='comm\x00') sendfile(r0, r0, &(0x7f0000dd8000-0x8), 0x1) 2018/02/01 16:23:11 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) seccomp(0x1, 0x0, &(0x7f0000001000-0x10)={0x2, &(0x7f0000022000)=[{0x0, 0x0, 0x0, 0xffffffffffffffe0}, {0x16}]}) execve(&(0x7f0000886000-0x8)='./file0\x00', &(0x7f000074e000)=[], &(0x7f0000ac0000-0x30)=[]) creat(&(0x7f0000dc5000-0x8)='./file0\x00', 0x0) close(0xffffffffffffffff) 2018/02/01 16:23:11 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = gettid() rt_sigtimedwait(&(0x7f0000645000-0x8), &(0x7f0000ded000), &(0x7f000052f000)={0x40000077359400}, 0x8) pipe(&(0x7f0000d8c000-0x8)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000e13000-0x8)={0xffffffffffffffff, 0xffffffffffffffff}) tee(r1, r3, 0x80007387, 0x0) r4 = dup2(r2, r3) r5 = syz_open_dev$random(&(0x7f0000bdc000-0xc)='/dev/random\x00', 0x0, 0x0) dup2(r2, r5) ioctl$int_in(r4, 0x5452, &(0x7f0000e36000-0x8)=0x45) fcntl$setown(r2, 0x8, r0) fcntl$setsig(r5, 0xa, 0x12) r6 = gettid() tkill(r6, 0x0) 2018/02/01 16:23:11 executing program 4: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)={0xaa}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) fchmodat(0xffffffffffffffff, &(0x7f0000012000)='./file0\x00', 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r1 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12, 0x0, @tid}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r1, 0x15) ioctl$UFFDIO_ZEROPAGE(r0, 0x8010aa02, &(0x7f00000c1000-0x10)={&(0x7f0000011000/0x3000)=nil, 0x3000}) 2018/02/01 16:23:11 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x2, 0x0) bind$inet(r0, &(0x7f0000eed000)={0x2, 0x1, @empty}, 0x10) syz_emit_ethernet(0x423, &(0x7f000018f000)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @empty=[0x0, 0x0, 0x14], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x415, 0xffffffffffffffff, 0x0, 0x0, 0x11, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001, {[]}}, @dccp={{0xffffffffffffffff, 0x1, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, "d73cde", 0x0, "f53475"}, "b441d632cdbbcb211363807aec73d3883762a61dc02d349bfa3ac974b987aa7fb97eb324d594fbbb77bab759418aa8d451d921e8f5d2cf2b08292111701192e97cac366dd3eb2e0fb039e58314ef4709c5f3556db6a1ab6b4fb2bdd83cdc26e8395ec4984ec3faf71a611d1569545d654cded93be827a85188b803c19c1b56aab522862a718b81e512b49690994d3425e33bd93f0e744c66a083c1f9f1bd7bb8f9e123c08f3f041ed3fdc058136cf0071a47cc0e38720a12e11e842a7b5b26dff07f578fdb9a7b14662a625c1ee76c41ccb2b1fc6376aa718e1067b9e4af511ef5b360dbfad326108bb033db193dab27974eb8c462739eaee51d87f31c516e7e391073770da3202e02c41a7277c847df24bd5b0a7ab6e252f3c8ebf00688cc55311d887e8bfd95a7f4c6a126af3fe26714ddb869c66d18f870631bbd497e8a06881b754ecdcdd0dcffc51cd52a6b560f8d64b63a1674745edc5f53b18a8ffcc5c2fbc4d2bbcc2faf3c189d9b36c0655d1394f5c127ec86b8a764a87b546c2b6ac37d0a8ec3edd7cda6f930570763dbdc0640d219749bd57c7c89eaadfdae41d654a46b17be069a32a7d94d29b612fbe61b8bd11a2d10ba5d4ac7014fc0465c3f144598bd1f913343e7293711040eee0ae8df1e49f04ed1037d4b742aed0e932116060aaf6b985238d2e10fb5b11d19d7801befed4833287d96a85a7cdd9e211a672760335655576fc0fa0336621c2b2b1018ef71bb5077c67ee5fa8d479d6776013363e98b1f1213712be7e47549b6035459008c509f0f983130a451531381ee3c1ab9e1cbb8e558b56ca1a70939389addc5f9632b37ff3f634abb504bb0be0a51649683f6e29588c15cda40255e173328681884ffef6729e9058c5623e1401fdcc7b8cb5623a8fd725fbeea05fc417c44e46500619218dff7c70aa068994c58883cada505a2aa85b6620dfe9c45b707c9aa1222b86972eae564b28a05ddfa3545df231fde2707d4bf67dc6ba41daba91dee8081e5c7e2bcfbebebd42d5ab8a32d6e098fd57233e3b813dc0d772134775def451823b7fef2bc93da01722cd613b9a3db7e2d4c51fb7b56006ee9cea53b62343599a56167388d45247f9289fb1cab67a7cb0c3665ddf1e1411875b4de3428b32fc6603691a023d8e4cb93c667acb7b535fb5f77af9a49640cbe8ffe3a193cf4df1b556a67cb753c60bdf978b871aa513c07074c6602037ebc32199290e3c7ac6f103ad9358951ad4de0c8f1b34951b0e6a48295975cf08b2c3c95064855fc95317e386f1c18608d1d08699003c998b93332cd316f17a5139d350cbfa9dabc3f77c4197a0186e50913978e980a7a028e7ccdeee718af028200e94a6b3a0ec93ba14b0c64dfaf3967e230d8cf876f26287d436ebc9588b52b43f2380836bfe3"}}}}}, 0x0) sendto$inet(r0, &(0x7f00002cb000), 0x0, 0x0, &(0x7f0000265000-0x10)={0x2, 0x1, @empty}, 0x10) recvmsg(r0, &(0x7f00004c6000-0x38)={&(0x7f0000319000)=@alg, 0x58, &(0x7f000035d000-0xa0)=[{&(0x7f000062d000)=""/110, 0x6e}, {&(0x7f00005db000-0x49)=""/73, 0x49}, {&(0x7f000094a000)=""/165, 0xa5}, {&(0x7f00001dd000)=""/94, 0x5e}, {&(0x7f00000e3000-0xea)=""/234, 0xea}, {&(0x7f0000989000-0xd6)=""/214, 0xd6}, {&(0x7f000092e000-0x82)=""/130, 0x82}], 0x7, &(0x7f00007eb000)=""/185, 0xb9}, 0x0) 2018/02/01 16:23:11 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) setrlimit(0x7, &(0x7f000000f000)) mq_open(&(0x7f0000890000-0xc)="7b27dd76626f786e65743000", 0x0, 0x0, &(0x7f00009b9000-0x40)) 2018/02/01 16:23:11 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = inotify_init1(0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f00007dd000)={0x0}, &(0x7f0000360000)=0xc) fcntl$setown(r0, 0x8, r1) fcntl$getownex(r0, 0x10, &(0x7f000066c000)={0x0, 0x0}) ptrace$setopts(0x4206, r2, 0x0, 0x0) ptrace(0x4207, r2) ptrace(0x18, r2) 2018/02/01 16:23:11 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$tun(&(0x7f0000e9b000+0x18a)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000a5b000-0x28)={@common='gre0\x00', @ifru_mtu=0x2}) r1 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8916, &(0x7f00007ff000)={@common='gre0\x00', @ifru_addrs={0x2, 0xffffffffffffffff, @local={0xac, 0x14, 0xffffffffffffffff, 0xaa}}}) [ 236.712460] audit: type=1326 audit(1517502190.978:159): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 pid=32490 comm="syz-executor7" exe="/root/syz-executor7" sig=31 arch=c000003e syscall=202 compat=0 ip=0x453299 code=0xffff0000 [ 236.744999] audit: type=1326 audit(1517502191.034:160): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 pid=32513 comm="syz-executor3" exe="/root/syz-executor3" sig=31 arch=c000003e syscall=202 compat=0 ip=0x453299 code=0xffff0000 2018/02/01 16:23:11 executing program 6: mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_buf(r0, 0x0, 0x40, &(0x7f0000000000), 0x0) 2018/02/01 16:23:11 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000cb1000-0x28)={@syzn={0x73, 0x79, 0x7a, 0x0}, 0x0}) sendto$packet(r0, &(0x7f0000e26000), 0x0, 0x0, &(0x7f0000dc9000)={0x11, 0x0, r1, 0x1, 0x0, 0x6, @remote={[0xaa, 0xaa, 0xaa, 0xaa], 0xffffffffffffffff, 0xbb}}, 0x14) [ 236.793670] ptrace attach of "/root/syz-executor0"[4064] was attempted by "/root/syz-executor0"[32532] [ 236.816071] ptrace attach of "/root/syz-executor0"[4064] was attempted by "/root/syz-executor0"[32532] 2018/02/01 16:23:11 executing program 4: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)={0xaa}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) fchmodat(0xffffffffffffffff, &(0x7f0000012000)='./file0\x00', 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r1 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12, 0x0, @tid}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r1, 0x15) ioctl$UFFDIO_ZEROPAGE(r0, 0x8010aa02, &(0x7f00000c1000-0x10)={&(0x7f0000011000/0x3000)=nil, 0x3000}) 2018/02/01 16:23:11 executing program 2: mmap(&(0x7f0000000000/0x14000)=nil, 0x14000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket(0x18, 0x0, 0x1) connect(r0, &(0x7f0000002000)=@sco={0x1f, {0x1}}, 0x26) 2018/02/01 16:23:11 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = gettid() rt_sigtimedwait(&(0x7f0000645000-0x8), &(0x7f0000ded000), &(0x7f000052f000)={0x40000077359400}, 0x8) pipe(&(0x7f0000d8c000-0x8)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000e13000-0x8)={0xffffffffffffffff, 0xffffffffffffffff}) tee(r1, r3, 0x80007387, 0x0) r4 = dup2(r2, r3) r5 = syz_open_dev$random(&(0x7f0000bdc000-0xc)='/dev/random\x00', 0x0, 0x0) dup2(r2, r5) ioctl$int_in(r4, 0x5452, &(0x7f0000e36000-0x8)=0x45) fcntl$setown(r2, 0x8, r0) fcntl$setsig(r5, 0xa, 0x12) r6 = gettid() tkill(r6, 0x0) 2018/02/01 16:23:11 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) socketpair$inet_tcp(0x2, 0x1, 0x0, &(0x7f0000030000-0x8)={0x0}) bind$inet(r0, &(0x7f0000f90000)={0x2, 0x0, @multicast1=0xe0000001}, 0x10) r1 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r1, &(0x7f0000dec000)={0x2, 0x0, @loopback=0x7f000001}, 0x10) sendto$inet(r1, &(0x7f0000de2000-0x1), 0x0, 0x20008045, &(0x7f0000db5000-0x10)={0x2, 0x0, @loopback=0x7f000001}, 0x10) socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x17, &(0x7f0000f98000-0x4)=0x2, 0x4) [ 236.830769] audit: type=1326 audit(1517502191.121:161): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 pid=32513 comm="syz-executor3" exe="/root/syz-executor3" sig=31 arch=c000003e syscall=202 compat=0 ip=0x453299 code=0xffff0000 2018/02/01 16:23:11 executing program 6: mmap(&(0x7f0000000000/0xfb3000)=nil, 0xfb3000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndtimer(&(0x7f0000fa6000)='/dev/snd/timer\x00', 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_SELECT(r0, 0x40345410, &(0x7f0000001000)={{0x100000001}}) ioctl$SNDRV_TIMER_IOCTL_INFO(r0, 0x80e85411, &(0x7f0000fb1000)=""/4096) 2018/02/01 16:23:11 executing program 0: mmap(&(0x7f0000000000/0x26000)=nil, 0x26000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_generic(r0, &(0x7f0000008000-0x38)={&(0x7f000001a000)={0x10}, 0xc, &(0x7f0000013000-0x10)={&(0x7f0000016000-0x30)={0x14, 0x32, 0x3, 0xffffffffffffffff, 0xffffffffffffffff, {}, []}, 0x14}, 0x1}, 0x0) 2018/02/01 16:23:11 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x1, &(0x7f0000da5000-0x4), 0x4) 2018/02/01 16:23:11 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndtimer(&(0x7f0000d31000)='/dev/snd/timer\x00', 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_NEXT_DEVICE(r0, 0xc0145401, &(0x7f0000c5a000-0x14)={0x3}) 2018/02/01 16:23:11 executing program 2: mmap(&(0x7f0000000000/0x8000)=nil, 0x8000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000005000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) close(r0) r1 = syz_open_dev$binder(&(0x7f0000009000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) mmap(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000009000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000009000-0x30)={0x4, 0x0, &(0x7f0000004000-0x18)=[@register_looper={0x630b}], 0x48, 0x0, &(0x7f0000009000)="d8fc1d016de371f1d99e3b4d488546c2bbb067efde7b55e9d1008602c19fe0b0078ade697201170fdbcc34816df860d3f87023a9d8567fa3297aac9d65b25106fc55ed85da8cb6f3"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000006000-0x2c)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f0000002000)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000b000-0x30)={0x44, 0x0, &(0x7f000000a000-0x7c)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000005000-0x68)=[@fd={0x73622a85, 0x0, 0xffffffffffffffff}], &(0x7f000000a000)=[0x0]}}], 0x0, 0x0, &(0x7f0000004000-0x4d)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000006000-0x30)={0x8, 0x0, &(0x7f000000b000-0x108)=[@increfs={0x40046304, 0x1}]}) 2018/02/01 16:23:11 executing program 4: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)={0xaa}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) fchmodat(0xffffffffffffffff, &(0x7f0000012000)='./file0\x00', 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r1 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12, 0x0, @tid}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r1, 0x15) ioctl$UFFDIO_ZEROPAGE(r0, 0x8010aa02, &(0x7f00000c1000-0x10)={&(0x7f0000011000/0x3000)=nil, 0x3000}) 2018/02/01 16:23:11 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = gettid() rt_sigtimedwait(&(0x7f0000645000-0x8), &(0x7f0000ded000), &(0x7f000052f000)={0x40000077359400}, 0x8) pipe(&(0x7f0000d8c000-0x8)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000e13000-0x8)={0xffffffffffffffff, 0xffffffffffffffff}) tee(r1, r3, 0x80007387, 0x0) r4 = dup2(r2, r3) r5 = syz_open_dev$random(&(0x7f0000bdc000-0xc)='/dev/random\x00', 0x0, 0x0) dup2(r2, r5) ioctl$int_in(r4, 0x5452, &(0x7f0000e36000-0x8)=0x45) fcntl$setown(r2, 0x8, r0) fcntl$setsig(r5, 0xa, 0x12) r6 = gettid() tkill(r6, 0x0) 2018/02/01 16:23:11 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) setrlimit(0x7, &(0x7f000000f000)) memfd_create(&(0x7f00003c5000)='#):\x00', 0x0) 2018/02/01 16:23:11 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000cde000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000bae000-0xc)={0x6}) epoll_wait(r1, &(0x7f00004c5000-0x48)=[{}], 0x1, 0x0) 2018/02/01 16:23:11 executing program 6: mmap(&(0x7f0000000000/0xf85000)=nil, 0xf85000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000f56000)={0x0, 0x0, &(0x7f0000f85000-0x10)={&(0x7f0000334000-0x78)={0x2, 0x1, 0x0, 0x0, 0x8, 0x0, 0x6, 0xffffffffffffffff, [@sadb_address={0x3, 0x6, 0x0, 0x0, 0x0, @in={0x2, 0xffffffffffffffff, @multicast1=0xe0000001}}, @sadb_address={0x3, 0x5, 0x0, 0x0, 0x0, @in={0x2, 0xffffffffffffffff, @multicast1=0xe0000001}}]}, 0x40}, 0x1}, 0x0) 2018/02/01 16:23:11 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$tun(&(0x7f0000125000-0xd)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000279000-0x50)={@generic="30609402000000000000067d08cebd5c", @ifru_mtu=0xcf1a}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f000053d000)={@generic="116dc1701ce8009a1da97f1bb45f38b7", @ifru_map={0xd6c}}) ioctl$TUNGETIFF(r0, 0x800454d2, &(0x7f0000b07000-0x4)) 2018/02/01 16:23:11 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) open(&(0x7f0000fb7000)='./file0\x00', 0x141046, 0x0) mount(&(0x7f0000410000-0x8)='./file0\x00', &(0x7f000002d000)='./file0\x00', &(0x7f0000172000)="72706396706970006673904d14239396e69a46", 0x1000, &(0x7f00007e7000)) open(&(0x7f00005d5000-0xa)='./control\x00', 0x80040, 0x0) rename(&(0x7f00008ef000)='./control\x00', &(0x7f0000a4e000-0x8)='./file0\x00') 2018/02/01 16:23:11 executing program 3: mmap(&(0x7f0000000000/0xa000)=nil, 0xa000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000003000)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000001000)={0x2, 0xa, 0x0, 0xfffffffffffffffe, 0x2, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, []}, 0x10}, 0x1}, 0x0) [ 236.971416] tc_ctl_action: received NO action attribs [ 236.987693] binder: 32571:32576 ERROR: BC_REGISTER_LOOPER called without request [ 236.989785] tc_ctl_action: received NO action attribs [ 237.000573] binder: 32576 RLIMIT_NICE not set 2018/02/01 16:23:11 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)={0xaa}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) fchmodat(0xffffffffffffffff, &(0x7f0000012000)='./file0\x00', 0x0) r1 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12, 0x0, @tid}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r1, 0x15) ioctl$UFFDIO_ZEROPAGE(r0, 0x8010aa02, &(0x7f00000c1000-0x10)={&(0x7f0000011000/0x3000)=nil, 0x3000}) 2018/02/01 16:23:11 executing program 7: mmap(&(0x7f0000000000/0xf94000)=nil, 0xf94000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket(0x1000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f00006d2000-0x28)={@common='lo\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000f8b000)={&(0x7f0000814000)={0x10}, 0xc, &(0x7f00006aa000-0x8)={&(0x7f0000f8e000-0x12c)=@ipv6_newroute={0x28, 0x18, 0x3, 0xffffffffffffffff, 0xffffffffffffffff, {0xa}, [@RTA_MULTIPATH={0xc, 0x9, [{0x8, 0x0, 0x0, r1}]}]}, 0x28}, 0x1}, 0x0) 2018/02/01 16:23:11 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x802, 0x0) sendto$inet(r0, &(0x7f0000111000), 0x0, 0x800, &(0x7f000010e000-0x10)={0x2, 0x3, @loopback=0x7f000001}, 0x10) [ 237.025113] binder: 32571:32587 got reply transaction with bad transaction stack, transaction 495 has target 32571:0 [ 237.025124] binder: 32571:32587 transaction failed 29201/-71, size 24-8 line 2718 [ 237.057232] binder: BINDER_SET_CONTEXT_MGR already set 2018/02/01 16:23:11 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)={0xaa}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) fchmodat(0xffffffffffffffff, &(0x7f0000012000)='./file0\x00', 0x0) r1 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12, 0x0, @tid}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r1, 0x15) ioctl$UFFDIO_ZEROPAGE(r0, 0x8010aa02, &(0x7f00000c1000-0x10)={&(0x7f0000011000/0x3000)=nil, 0x3000}) 2018/02/01 16:23:11 executing program 3: mmap(&(0x7f0000000000/0xa000)=nil, 0xa000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000003000)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000001000)={0x2, 0xa, 0x0, 0xfffffffffffffffe, 0x2, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, []}, 0x10}, 0x1}, 0x0) 2018/02/01 16:23:11 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$loop(&(0x7f0000d84000)='/dev/loop#\x00', 0x0, 0x0) ioctl$LOOP_GET_STATUS64(r0, 0x4c05, &(0x7f0000137000+0x3a3)) 2018/02/01 16:23:11 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)={0xaa}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) fchmodat(0xffffffffffffffff, &(0x7f0000012000)='./file0\x00', 0x0) r1 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12, 0x0, @tid}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r1, 0x15) ioctl$UFFDIO_ZEROPAGE(r0, 0x8010aa02, &(0x7f00000c1000-0x10)={&(0x7f0000011000/0x3000)=nil, 0x3000}) [ 237.057242] binder: 32571:32599 ioctl 40046207 0 returned -16 [ 237.058618] binder: 32571:32599 ERROR: BC_REGISTER_LOOPER called without request [ 237.058628] binder: 32599 RLIMIT_NICE not set [ 237.063931] binder_alloc: 32571: binder_alloc_buf, no vma [ 237.063955] binder: 32571:32605 transaction failed 29189/-3, size 0-0 line 2903 2018/02/01 16:23:11 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x2) timer_settime(0x0, 0x0, &(0x7f0000ce8000-0x20)={{}, {0x0, 0x1c9c380}}, &(0x7f0000e89000-0x20)={{0x0}}) write$evdev(r0, &(0x7f0000001000)=[{{r1}}, {{}, 0x0, 0x0, 0xffffffffffffffff}, {}, {{0x0, 0x2710}}], 0x60) readv(r0, &(0x7f000069b000)=[{&(0x7f0000200000-0x1e)=""/30, 0x1e}], 0x1) 2018/02/01 16:23:11 executing program 5: mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000003000)={0x0, 0x0, &(0x7f0000001000)={&(0x7f0000003000-0x30)={0x2, 0x0, 0x0, 0x0, 0x2, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, []}, 0x10}, 0x1}, 0x0) 2018/02/01 16:23:11 executing program 6: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)={0xaa}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) lsetxattr(&(0x7f0000013000-0x8)='./file0\x00', &(0x7f0000004000-0x11)=@known='security.selinux\x00', &(0x7f0000003000)='.GPL\'&cgroupmime_type\x00', 0x16, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r1 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12, 0x0, @tid}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r1, 0x15) ioctl$UFFDIO_ZEROPAGE(r0, 0x8010aa02, &(0x7f00000c1000-0x10)={&(0x7f0000011000/0x3000)=nil, 0x3000}) 2018/02/01 16:23:11 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) pipe(&(0x7f00006c2000-0x8)={0xffffffffffffffff, 0xffffffffffffffff}) write$eventfd(r0, &(0x7f0000316000-0x8), 0x8) write$tun(r0, &(0x7f0000424000+0x70b)=@hdr={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @ipv4={{0x5, 0x4, 0x0, 0x0, 0xff7, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @empty, @multicast1=0xe0000001, {[]}}, @tcp={{0xffffffffffffffff, 0xffffffffffffffff, 0x42424242, 0x42424242, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, {[]}}, {"665fe12c7b4bb79ce52c9c2a3edaab9657786a845459925a446a9ceba0c936e73093a8e3422319276bde33415233b40c42a1c2e5a9c26a9c711a57006a30e298d047c36f20028c2428a808bdfff9be360333519eeb43f62cfb8d1473e40fb990b9d465881eb74f22094243f75117c9e08bdacfbde75fb9749cd72e2c2834030fe1baa86a6492a062b773f5a40478066009e8d5806e17fa7c6cc927ce1e3c4bd79dd08ddc9b6826f4f105f49cbeddbd98a8e8c37aced50b271e7c415e9eb88719072a89ed083485f065893b2aa674234aa06217cdfafcf474adc91cb5d53f906a20ab922a568a7b1e6502b88c851f7dabfde1d458639005c1298410199fd94b36752865b74df0fcab66ed47b91b00fb44dbc81cd77ba9f11f3117e9ffa731d67e88872a576edb8b42517610d396eb1bec21be272e138a7a1564f6fa7546a130f8ea753766b7969d4b945cc4a61b909858b3662fda798dfcbedc1d140c186f974a735d12ef67b6bc11b88a12124bad9dc51083a11f306c14e92a32cfef060726f482c77da0e61da7f7e49607a9cfab502bead724d37add567e326e84180bc069587f9ed0b0729f849729848b83010155d86a4e41700b825a99e1b79755fc3ed14c5b976e3d204bdcd6b510831a400911877509a45728226bbe4cdba92331ac082cbaaf7bfa92dc53527c35bd06e7bc831a1129f7f04c3049ec5ae55e991bcf20be4976800e609080df2abe86b6dde7c026fbaf1c041185a671e8decd298f2540e5e8149747a710e4db5d65cb544726376f7531dcf859e3108e34105eea2cf2fa4fe09af59f1e4388081fbe07e33a3b3b7b09452e11eb99eb351de0393261bb9dfeb79493aa26312ae1ea794853e7c306eec3dde26649fa10007c5476b2db8294cd58b966e4434a937fc85e742223bb13699545ac276251b919123c9772d9b1442072ae4745d607027e273b2c8312c9f66d8bd13cbcf368cc80253ef77093ba920faccfd75f275aa563dc24afe86cc61f5c272b54569cdabf79ade33cab4e4318f3411e7309e9c9852332417fad9b380c1215902fe9128c59c01ba403db43329321ea9e05925973243af24e811c77d967c9a70df14ee46bb89e5c6b1d256f6501c851849c243996750bfb2309739eb270e14800e292449b8592a4791ba094d891581a085b3282d5027590ed9de409a99ef730b5f3592f2405b28c2fd7a6bd8672b0a46ffd7b01e8445222659a55325cff78c6d36b0e5318515bf9d478ef85bd428f76ed345042d43d62778c270c9ef66eb68b80e77a6ebd60f876c3d3bac453b3fedecdac63bd009c4d75d6e2b3027109f787a188c0d3d2c5de9b3c4844f3a91469ca9dc1a472b07a850a3750431d3080a2934eef07cb3b44d096ab14b5f093baa223a4cb3a7344d2a410b58d0b579f6f03ca65f1eee73f48b892b65a8a6d05908cb0e541a28996248344a72805dd990bfe702c0f1015b30c06f28aa47e5b4825c360154a129ac0416eaedf865e2e80ec76d1f6dbc547a455c2e7a4463a20a6df2a90c4fa756e98ee02c76180025d17f2a38111f9a862cbc15c5bee86b8b32a68e76eb1c454e9b004307113e6b58e7dac6d60c1730e01a85a2d30ef8e2a7a7342e88c5e1b131f38f3afc1c428bf16bc2db8c052e58d3352627273d57654ff99464f51811f05bdf7c57fb77da70df6ffcfbc430cde98fca935ba2eaf08436e9f6fc18b1b4caff1fdb4b057e38f2f08fa98d746ad040a9e83b0f6d980e92bc5b2fed95cfa3232525fbb0d2e0ace377003fc50e7d0cb2d8c2d5de4e1a82766bd9bc0e2b111abc7f5e9bd6ff3be3a6c5464721b5deca1340a561749c13c17bbc06fa8b7ce478b366bbb17e92ba17210447aa54ceeb46be6ec5a3aef52eb8ad4a246742e9444ffc58fccc888046751e2732cb8f4bbc0ae0d01c85809a7cb3dc335f139dd4286a4521b8606b4aadc0bfd911bf30ff460ffa8bfa14e609b8f38551a8f46fdf2fde6aca577b4565039632cddea548be86ff05faea5ca9829dc65bc98a81447c01c84676335c8f35f10ba80fe9d91770545da4e2ac2aa52ae8e24649469b0732b4188e08041fb571fc8043aa06e183694f7299fc84259ad84cfd314ed4a890ec57bfe46dfdce52883018d882234688a594374a0efb25832d002c5928b2402db1e9334892e287bd3bac35b29d7c79248843ad27e9abbc859ac3c032d1669ce3db91e9114e484dc2181117f35eb40123c05bd4f5772b08cae953f5663a4ff1cc9f0b9efdf2bbefe4aa4dff7e274114a3e948633e704d7845b3e5ff2bfe704b869d9fc6238a4264b9db0cfd01b5d40efa9095197ba05278df83e4e5a6646b7de53253e729a69010ffd3f22ed67d6070617f3cdc32d51fb399bfa977483d3bc15e44fe3e45ef89ca792faa9dfc3d48a4b9659b9c4e633259123e2e6c96eaa6684ff28c999c3fe2ef21b659444b3e240d611359e4f8a88db6e2b47aef27fade357a594af0a49d7bcf21a72ad8fead01a024a60ab083198424e58fefa568c216883ba0b78493198b5310faf7710bc925be045e8fc2b303263e3a982c307cac946881e63d0e9c47b4e6c1f3d3b6b0b27ae4114eabd292f97957bb5a26b3c45e7e9196e3637efa1b72dbdbab96377c766a1500399bce77b0c88a3dff2cb45b47d34f3fb503f4e28d1c247781978cb47235a2015567b316d8ebb700cdac88a918a06f8bdf0958703761d10b899b15f9fe1eb03cd0891255ef4a3f061e9caf68fae4a369b5cf39352fa19833e034c7ae7af8cb0d1a5fdf1e62751a64f5d386d15b40e688e1dfd0cdf6d39d93cffede35a899e76795f287159654d8e8eab9eea5f43283ec80e1b4bf5013c31bf65aadbd069026e4014850fb9eea1541bf7d86a2793e562c366e5136c676036ad68b87a5429b2df89ffe6c673f44207e09ed4dca42542cf0c8670dcac722dbb027287fea738e17d1d158d6fb207d4fcf1ef104f5956b1bc068fe803090c7cbefeb72ff35e794f7472b2abd8df53105f8dbd7ef503ec687c6e97cd4515a4875b5da34df41c7c107c773522bde8e4991bf3b41da6e2b0f197d934e79016f26adcf11d5afd76d19d42fe7b3fedf9b302cba5f7f014049ffdb4f486f771501df2ed9441e0ac6aa1f889ca228fdb972a7e74c19df50b62ec68f58acd0835950d72ee561e2e53ca56a4b772dfb4b81207fa31178b5a54291268f19cb8d1c2da5a754bcdb09805c0664a403296d2499cf03bd82c57d92eae8c7fe7be23f9e3075696334fc4d79c3fb2de7bbb7d2acc4691f9831893322625bbaeb2075298aac5a1e65e6d74e387bfe5fc5304abd6fa6587e15902b16506ac8a8f8712cc20d6476ef9ef6f9e7ffb207458fb1db1981a9c4c5ad5bcf80dbb15c7fd097febfcdc709485200f05cd3b875eccae646bc2fe77788731de21aa18be63052ee0481fe6393750b9582f2028ce90f10682965e1727ac6d207f5d5a9fe460eb0c79356ae1a52770bd84096fb87ba5f0014db16e737dd9c0d2df5f86952a9f94f3d90a70b8ad5971f78e3a693c2fbc0c7d4b05ff75c4507d7ec91ea9bfded04e62a80766b82e2f18b2cac8ebf935141635fa2ddd30b67d4bd73498a728b30b9ce59c26292543b67379db78d1c1de3b3d508cbc15df0a59fce5918731ec504d1a6c98b98a093a7f6a358305778db0c331281230c4f10f133075090b5f42cbe723c56220f6cbfca1b9a0bead8c3570aef9d09c97dbd9c5e9c214e74809a78e06d61c6103c40481fc82073e757362e5c8a6860965b26fd1b29b65bee4e17161ca2ed935d5486f71a5348aa3661f5250a0e022446db7d1ed0e3342a9697f797e7f4df8966b9a6823a46a6cd8ae50b91933d45ebe240e4934b587fe7a03fe72a4e4225e981bf6831705341e752d54a2113a1c0c29fcc7599c467565acace14ced2154e5b2339515672f2d6f9c231c1f917b134cdde8f5606b30fbbeaabbddef9932c80abbf29e2e4da96bdf18144412c9ac9467082b01c14fc22b3517d08433ad4630c71e94f2aaec7d485303bfdafc42f5048c4c4d719c1034b182c0dd59a19f18b5cde0e4f29f4c855efe26a21120a81527565b356993bc377ae5f798dc3bc1ef95b8f4957be32f5b1d12d8bee448596d82919a8ccf0b967a809a9b709b991d947aaed9a10f7711b81109daa16ca0565e1e32840cd0adf652ff363b086ccbdde027f3ee6544ff3fe7fea3e128659feed77b6baa2f8636b47d7a2665e66a6680173d5449ba017fddbad59603473f86d1719287ca5b196efc9f36133f1f4512061669fd5449e20191ed00ce94ccd4afdcdf27d77c114abdc1d450acccf7c3007f7c878c8247c99b87dcee80c71a735895893416bc2a651c070d7c4a3f9ea96fb25ea06e7178e3ae1bc1baba70810db3f0b9c47ccc1d0ab7fa6afb1172ad7fb8cd9157ad94b205a0cc28e77c4bacd78eb5b54daffbbd14a91d975c9296cdcac52b45fbc47c855bad4930b1555dc959ba76fe4022750975863c2c40ae990aaa349574da1b4a2495098a00b004a012fd4c5d4ebc8cde9d931f8a412d1a1439e437887a2381537ad8cc4fb0f2bee4c73ddd7ad6b0c38aca3f09e802fbe5ebead0f4a6c4f4dd6e6f3407333685b89bd848502e279d46b9fb2ad2327920947ae5b9a151ff4ac85d12ca8a133029da795e7296b3e639ad6a0c1ad00fc42fa9371346532f2ad8be4217796d622c41295a1db1dc3454da46b09191fd500eda6883c68c173cb8e8cc32b2ae7d223c2cf1779341bba9ce6bc96a39d27ff59027666651cdfbd4459f77af623371e727d998348ecc1034e0de34958a1371d1c7e69237289b71c17ec009a19aec6253887775a6dbe09471c0ac03ef7e46ab707466c926e2fd0700a7c65eb667b36103847f446e7407ed2a9a012668bcc0a63e3c8371e2fab39c64121c9d71d13de0a4e83f53bc255a8c4cb0d17fb6bd0d9404c995ea56c003ffcd0f8fa55906ad6f640615d4a3cf322a6128558e693d7aca82b4d02028377265e5a8d677e8c9733c8a4382fa36e68510ff6f32ced52dc0c1dd136765e3e62a4f77dada2713af0c5ab70e6710d29db3342baa9582edc84d2debdc52a60fc58332f371a82401b2106fb826a5deb0c34d5e89cf3fb2284b21aa1c59506b11bda647d212cbc0124d3a636df55ebb323b01aadafc1c1b88f920f54638d3a68ff78e4c8cbc6d617c5e259b4dbf48aeacab8031faf5957c3407b7f470cfd2b614504a92f3112f1d7cd32d626c2a2ed74a3395edc0c423927bc11faeccff96f1f1ed2dd47f814795d96e5c8dcf26b8ce1db9886952b2c2185b867b5a77017bd62187ea86d247744e04126a57c5b51ff3b3b07a79fe0d3204aece8cea9ba5b4afde4e04c89e3c43a0b2ff4705ca33b870332683cfb4a235b5157ce9fe7eb75d97341a1e0e8a22f18649adfa1071cfd14c2d21c3a525289e65f252b9f55db3f352faa2915af81f8803f121d081647095ee7f5716b15991b861202c8442e8d8bb20c369649e5dd3979cc5f2d634db4633c9ca8353592e0bc036cd2d1d4a289c9f96cf788e30d4b2bb5f330267832187612ec440d4c2a067031ef30d5c76aa2827cc7439c3bce9e2c2c72fe284d9309cc14a4a550bf4605eda99574e5223f294909528182e6a335f3bd2f5af3206d5a697cb7fbefe61b45eb5dc20eddf2d55b6b8f0f6b92a4ae812bc64b247e8cee2ee7621b2011b5c467e4a64"}}}}, 0x1001) read(0xffffffffffffffff, &(0x7f0000063000)=""/1, 0x1) ioctl$int_in(0xffffffffffffffff, 0x0, &(0x7f0000009000-0x8)) fcntl$setown(0xffffffffffffffff, 0x8, 0x0) fcntl$setsig(0xffffffffffffffff, 0xa, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) tkill(0x0, 0x0) 2018/02/01 16:23:11 executing program 3: mmap(&(0x7f0000000000/0xfb1000)=nil, 0xfb1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndtimer(&(0x7f0000fa6000)='/dev/snd/timer\x00', 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_TREAD(0xffffffffffffffff, 0x40045402, &(0x7f0000faf000)) ioctl$SNDRV_TIMER_IOCTL_SELECT(r0, 0x40345410, &(0x7f0000001000)={{0x100000001}}) ioctl$SNDRV_TIMER_IOCTL_PARAMS(r0, 0x40505412, &(0x7f0000fb0000-0x50)={0xfffffffffffffffd, 0x1}) 2018/02/01 16:23:11 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) r1 = syz_open_dev$tun(&(0x7f0000416000)='/dev/net/tun\x00', 0x0, 0x0) r2 = fcntl$dupfd(r1, 0x0, r0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000db4000-0x28)={@common='gre0\x00', @ifru_names=@generic="16f1a033533c000035db24a266325d59"}) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000630000-0x20)={@common="677265300000e3f800", @ifru_flags=0x2fd}) r3 = socket$inet6(0xa, 0x2, 0x0) sendto$inet6(r3, &(0x7f0000a7d000-0x60f), 0x0, 0x13, &(0x7f00008b1000)={0xa, 0x0, 0x0, @local={0xfe, 0x80, [], 0xffffffffffffffff, 0xaa}}, 0x1c) 2018/02/01 16:23:11 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) setrlimit(0x7, &(0x7f0000a06000)) timerfd_create(0x0, 0x0) 2018/02/01 16:23:11 executing program 4: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)={0xaa}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) fchmodat(0xffffffffffffffff, &(0x7f0000012000)='./file0\x00', 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r1 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12, 0x0, @tid}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r1, 0x15) [ 237.070346] binder: 32571:32599 IncRefs 0 refcount change on invalid ref 1 ret -22 [ 237.070975] binder: 32571:32587 got reply transaction with no transaction stack [ 237.070985] binder: 32571:32587 transaction failed 29201/-71, size 24-8 line 2703 [ 237.163169] binder: 32576 RLIMIT_NICE not set [ 237.167821] binder: release 32571:32576 transaction 495 in, still active [ 237.174690] binder: send failed reply for transaction 495 to 32571:32587 [ 237.181581] binder: undelivered TRANSACTION_COMPLETE 2018/02/01 16:23:11 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) seccomp(0x1, 0x0, &(0x7f0000001000-0x10)={0x2, &(0x7f0000022000)=[{0x0, 0x0, 0x0, 0xffffffffffffffe0}, {0x16}]}) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x0, 0x0) syz_open_pts(r0, 0x0) syz_open_pts(r0, 0x0) 2018/02/01 16:23:11 executing program 7: mmap(&(0x7f0000000000/0xa000)=nil, 0xa000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCDARP(r0, 0x8953, &(0x7f0000000000)={{0x2, 0xffffffffffffffff, @remote={0xac, 0x14, 0x0, 0xbb}}, {0x0, @empty}, 0x0, {0x2, 0xffffffffffffffff, @multicast2=0xe0000002}, @generic="001a000000000005ef00000100000068"}) 2018/02/01 16:23:11 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) capset(&(0x7f00000c2000)={0x19980330}, &(0x7f0000852000-0x18)) r0 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$inet_buf(r0, 0x0, 0x200000000000042, &(0x7f0000af7000-0x1e)=""/30, &(0x7f0000001000-0x4)=0x1e) 2018/02/01 16:23:11 executing program 5: mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$urandom(&(0x7f0000001000-0xd)='/dev/urandom\x00', 0x0, 0x1) pwrite64(r0, &(0x7f0000001000-0x1), 0x0, 0x0) 2018/02/01 16:23:11 executing program 2: mmap(&(0x7f0000000000/0xfca000)=nil, 0xfca000, 0x3, 0x32, 0xffffffffffffffff, 0x0) seccomp(0x1, 0x0, &(0x7f0000001000-0x10)={0x2, &(0x7f0000022000)=[{0x0, 0x0, 0x0, 0xffffffffffffffe0}, {0x16}]}) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) 2018/02/01 16:23:11 executing program 4: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)={0xaa}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) fchmodat(0xffffffffffffffff, &(0x7f0000012000)='./file0\x00', 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r1 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12, 0x0, @tid}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r1, 0x15) 2018/02/01 16:23:11 executing program 1: mmap(&(0x7f0000000000/0xfc7000)=nil, 0xfc7000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = inotify_init1(0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000fb7000)={0x0}, &(0x7f00002f5000)=0xc) openat$selinux_create(0xffffffffffffff9c, &(0x7f00004d6000)='/selinux/create\x00', 0x2, 0x0) fcntl$setown(r0, 0x8, r1) fcntl$getownex(r0, 0x10, &(0x7f0000fb4000)={0x0, 0x0}) ptrace$setopts(0x4206, r2, 0x0, 0x0) ptrace(0x4207, r2) ptrace$setsig(0x4203, r2, 0x0, &(0x7f0000c3b000)={0x0, 0x0, 0x400050077918}) ptrace$getsig(0x4202, r2, 0x0, &(0x7f00004e7000)) 2018/02/01 16:23:11 executing program 6: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)={0xaa}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) lsetxattr(&(0x7f0000013000-0x8)='./file0\x00', &(0x7f0000004000-0x11)=@known='security.selinux\x00', &(0x7f0000003000)='.GPL\'&cgroupmime_type\x00', 0x16, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r1 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12, 0x0, @tid}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r1, 0x15) ioctl$UFFDIO_ZEROPAGE(r0, 0x8010aa02, &(0x7f00000c1000-0x10)={&(0x7f0000011000/0x3000)=nil, 0x3000}) [ 237.198712] device gre0 left promiscuous mode [ 237.207357] binder: undelivered TRANSACTION_ERROR: 29201 [ 237.216894] binder: undelivered TRANSACTION_ERROR: 29189 [ 237.225261] binder: undelivered TRANSACTION_ERROR: 29201 [ 237.236492] binder: undelivered TRANSACTION_ERROR: 29189 [ 237.294484] audit: type=1326 audit(1517502191.585:162): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 pid=32648 comm="syz-executor0" exe="/root/syz-executor0" sig=31 arch=c000003e syscall=202 compat=0 ip=0x453299 code=0xffff0000 [ 237.320277] audit: type=1326 audit(1517502191.611:163): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 pid=32652 comm="syz-executor2" exe="/root/syz-executor2" sig=31 arch=c000003e syscall=202 compat=0 ip=0x453299 code=0xffff0000 2018/02/01 16:23:11 executing program 4: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)={0xaa}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) fchmodat(0xffffffffffffffff, &(0x7f0000012000)='./file0\x00', 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r1 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12, 0x0, @tid}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r1, 0x15) 2018/02/01 16:23:11 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_buf(r0, 0x29, 0x4a, &(0x7f0000363000), 0x0) 2018/02/01 16:23:11 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) mmap(&(0x7f0000000000/0xfde000)=nil, 0xfde000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000fde000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f00000f9000-0x28)={@common='lo\x00', &(0x7f0000fdf000-0x5)=@ethtool_sset_info={0x37, 0x0, 0x0, []}}) 2018/02/01 16:23:11 executing program 6: mmap(&(0x7f0000000000/0xef6000)=nil, 0xef6000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0xa, 0x0) bind$vsock_stream(r0, &(0x7f00000d0000)={0x28, 0x0, 0x0, @any=0xffffffff}, 0x10) 2018/02/01 16:23:11 executing program 7: mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x3, 0x32, 0xffffffffffffffff, 0x0) add_key$keyring(&(0x7f0000001000)='keyring\x00', &(0x7f0000001000)={0x73, 0x79, 0x7a, 0x0}, 0x0, 0x0, 0xffffffffffffffff) r0 = add_key(&(0x7f0000004000-0xd)='dns_resolver\x00', &(0x7f0000003000)={0x73, 0x79, 0x7a, 0x0}, &(0x7f0000001000), 0x0, 0x0) keyctl$describe(0x6, r0, &(0x7f0000009000)=""/86, 0x56) 2018/02/01 16:23:11 executing program 1: mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x101000, 0x0) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000430000-0xe8)={{{@in=@broadcast, @in=@multicast1, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@empty}, 0x0, @in=@multicast2}}, &(0x7f0000001000-0x4)=0xe8) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f0000001000-0x50)={@remote={0xfe, 0x80, [], 0x0, 0xbb}, @mcast2={0xff, 0x2, [], 0x1}, @local={0xfe, 0x80, [], 0x0, 0xaa}, 0x80000001, 0x7, 0x81, 0x0, 0xff, 0x10020, r1}) r2 = fcntl$dupfd(0xffffffffffffffff, 0x406, 0xffffffffffffff9c) ioctl$TIOCMBIC(r2, 0x5417, &(0x7f00003d1000)=0x7) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r3 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000378000)='/dev/loop-control\x00', 0x0, 0x0) r4 = dup(r3) openat$sequencer(0xffffffffffffff9c, &(0x7f0000d9e000)='/dev/sequencer\x00', 0x400400, 0x0) ioctl$LOOP_CTL_ADD(r3, 0x4c81, 0x0) ioctl$LOOP_CTL_REMOVE(r4, 0x4c80, 0x0) ioctl$KDSETKEYCODE(r4, 0x4b4d, &(0x7f000006b000-0x8)) setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000f62000-0x5c)={{0xa, 0x0, 0x0, @local={0xfe, 0x80, [], 0x0, 0xaa}}, {0xa, 0x0, 0xddb, @mcast1={0xff, 0x1, [], 0x1}}, 0x0, [0x0, 0x0, 0xbe2e]}, 0x5c) 2018/02/01 16:23:11 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x4) sendmsg$nl_route(r0, &(0x7f0000ab1000)={&(0x7f0000016000)={0x10}, 0xc, &(0x7f00006bd000-0x10)={&(0x7f0000582000-0x390)=@ipv6_newroute={0x1c, 0x18, 0x301, 0xffffffffffffffff, 0xffffffffffffffff, {0xa}, []}, 0x1c}, 0x1}, 0x0) 2018/02/01 16:23:11 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket(0xa, 0x2400000001, 0x0) ioctl$sock_inet_SIOCADDRT(r0, 0x890b, &(0x7f0000437000)={0x0, {0x2, 0xffffffffffffffff, @multicast1=0xe0000001}, {0x2, 0xffffffffffffffff, @multicast1=0xe0000001}, {0x2, 0xffffffffffffffff, @multicast1=0xe0000001}, 0x0, 0x0, 0x0, 0x3, 0x0, &(0x7f00002a8000)=@syzn={0x73, 0x79, 0x7a}}) 2018/02/01 16:23:11 executing program 2: mmap(&(0x7f0000000000/0x829000)=nil, 0x829000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$evdev(&(0x7f000004a000)='/dev/input/event#\x00', 0x0, 0x0) ioctl(r0, 0x8000000c0004530, &(0x7f00005e3000-0x1)) 2018/02/01 16:23:11 executing program 7: mmap(&(0x7f0000000000/0xe74000)=nil, 0xe74000, 0x3, 0x32, 0xffffffffffffffff, 0x0) socket$l2tp(0x18, 0x1, 0x1) sigaltstack(&(0x7f0000832000/0x2000)=nil, 0x0) r0 = socket$inet6_udp(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000e71000)={0xa, 0x0, 0x45da8146, @dev={0xfe, 0x80, [], 0x0, 0x11}, 0x3}, 0x1c) connect$inet6(r0, &(0x7f0000e6f000)={0xa, 0x2, 0x1000000000000, @ipv4={[], [0xff, 0xff], @local={0xac, 0x14, 0x0, 0xaa}}, 0x8000000000000001}, 0x1c) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f00005fb000-0x2e)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x1, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e) sendmsg$nl_crypto(r1, &(0x7f0000380000-0x38)={&(0x7f00009dd000)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00002cf000-0x10)={&(0x7f000097b000)=@delrng={0x10, 0x14, 0x200, 0x1, 0x3, "", []}, 0xfff1}, 0x1, 0x0, 0x0, 0x8820}, 0x81) 2018/02/01 16:23:11 executing program 4: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)={0xaa}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) fchmodat(0xffffffffffffffff, &(0x7f0000012000)='./file0\x00', 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12, 0x0, @tid}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) ioctl$UFFDIO_ZEROPAGE(r0, 0x8010aa02, &(0x7f00000c1000-0x10)={&(0x7f0000011000/0x3000)=nil, 0x3000}) [ 237.353743] ptrace attach of "/root/syz-executor1"[31334] was attempted by "/root/syz-executor1"[32661] [ 237.377953] ptrace attach of "/root/syz-executor1"[31334] was attempted by "/root/syz-executor1"[32661] 2018/02/01 16:23:11 executing program 3: mmap(&(0x7f0000000000/0xfa7000)=nil, 0xfa7000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = inotify_init1(0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000fa1000)={0x0}, &(0x7f0000fa1000)=0xc) fcntl$setown(r0, 0x8, r1) fcntl$getownex(r0, 0x10, &(0x7f0000fa3000)={0x0, 0x0}) ptrace$setopts(0x4206, r2, 0x0, 0x0) ptrace(0x4207, r2) ptrace$getregset(0x4204, r2, 0x202, &(0x7f0000002000)={&(0x7f0000fa6000-0x40)=""/64, 0x40}) 2018/02/01 16:23:11 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$loop(&(0x7f000071c000-0xb)='/dev/loop#\x00', 0x0, 0x181001) r1 = memfd_create(&(0x7f00006ec000-0x11)="74756e08000000000000008000000000a4", 0x0) pwritev(r1, &(0x7f0000f51000-0x70)=[{&(0x7f00001f2000)="aa", 0x1}], 0x1, 0x81003) seccomp(0x1, 0x0, &(0x7f0000029000-0x10)={0x0, &(0x7f0000000000)=[]}) clock_getres(0x0, &(0x7f0000669000-0x10)) sendfile(r0, r1, &(0x7f0000cac000+0xe1b)=0x1, 0x100000001) 2018/02/01 16:23:11 executing program 7: ioperm(0x0, 0x4, 0x0) clone(0x0, &(0x7f0000000000), &(0x7f0000000000), &(0x7f00008d3000), &(0x7f0000635000)) 2018/02/01 16:23:11 executing program 3: clone(0x0, &(0x7f0000251000+0xdca), &(0x7f0000744000), &(0x7f00008c8000), &(0x7f0000dad000-0x37)) mq_open(&(0x7f0000b34000)='self\x00', 0x0, 0x0, &(0x7f0000f7f000-0x40)) 2018/02/01 16:23:11 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000430000)={{{@in6=@loopback={0x0, 0x1}, @in6=@empty, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0xffffffffffffffc0, 0xa}, {}, {}, 0x0, 0xffffffffffffffff, 0x1}, {{@in=@multicast2=0xe0000002}, 0x0, @in=@multicast2=0xe0000002}}, 0xe8) connect$inet6(r0, &(0x7f00001c5000)={0xa, 0xffffffffffffffff, 0x0, @empty}, 0x1c) 2018/02/01 16:23:11 executing program 4: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)={0xaa}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) fchmodat(0xffffffffffffffff, &(0x7f0000012000)='./file0\x00', 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12, 0x0, @tid}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) ioctl$UFFDIO_ZEROPAGE(r0, 0x8010aa02, &(0x7f00000c1000-0x10)={&(0x7f0000011000/0x3000)=nil, 0x3000}) 2018/02/01 16:23:11 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000107000-0x8)='./file0\x00', 0x18442, 0x0) write$sndseq(r0, &(0x7f0000c55000)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @quote={{}, 0x0, &(0x7f0000cbb000)={0x0, 0x0, 0x0, 0x0, @time={0x77359400}, {}, {}, @control}}}], 0x30) [ 237.439114] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=24 sclass=netlink_tcpdiag_socket pig=32691 comm=syz-executor5 [ 237.455880] ptrace attach of "/root/syz-executor3"[15129] was attempted by "/root/syz-executor3"[32702] 2018/02/01 16:23:11 executing program 1: mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x101000, 0x0) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000430000-0xe8)={{{@in=@broadcast, @in=@multicast1, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@empty}, 0x0, @in=@multicast2}}, &(0x7f0000001000-0x4)=0xe8) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f0000001000-0x50)={@remote={0xfe, 0x80, [], 0x0, 0xbb}, @mcast2={0xff, 0x2, [], 0x1}, @local={0xfe, 0x80, [], 0x0, 0xaa}, 0x80000001, 0x7, 0x81, 0x0, 0xff, 0x10020, r1}) r2 = fcntl$dupfd(0xffffffffffffffff, 0x406, 0xffffffffffffff9c) ioctl$TIOCMBIC(r2, 0x5417, &(0x7f00003d1000)=0x7) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r3 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000378000)='/dev/loop-control\x00', 0x0, 0x0) r4 = dup(r3) openat$sequencer(0xffffffffffffff9c, &(0x7f0000d9e000)='/dev/sequencer\x00', 0x400400, 0x0) ioctl$LOOP_CTL_ADD(r3, 0x4c81, 0x0) ioctl$LOOP_CTL_REMOVE(r4, 0x4c80, 0x0) ioctl$KDSETKEYCODE(r4, 0x4b4d, &(0x7f000006b000-0x8)) setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000f62000-0x5c)={{0xa, 0x0, 0x0, @local={0xfe, 0x80, [], 0x0, 0xaa}}, {0xa, 0x0, 0xddb, @mcast1={0xff, 0x1, [], 0x1}}, 0x0, [0x0, 0x0, 0xbe2e]}, 0x5c) 2018/02/01 16:23:11 executing program 7: mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x101000, 0x0) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000430000-0xe8)={{{@in=@broadcast, @in=@multicast1, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@empty}, 0x0, @in=@multicast2}}, &(0x7f0000001000-0x4)=0xe8) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f0000001000-0x50)={@remote={0xfe, 0x80, [], 0x0, 0xbb}, @mcast2={0xff, 0x2, [], 0x1}, @local={0xfe, 0x80, [], 0x0, 0xaa}, 0x80000001, 0x7, 0x81, 0x0, 0xff, 0x10020, r1}) r2 = fcntl$dupfd(0xffffffffffffffff, 0x406, 0xffffffffffffff9c) ioctl$TIOCMBIC(r2, 0x5417, &(0x7f00003d1000)=0x7) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r3 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000378000)='/dev/loop-control\x00', 0x0, 0x0) r4 = dup(r3) openat$sequencer(0xffffffffffffff9c, &(0x7f0000d9e000)='/dev/sequencer\x00', 0x400400, 0x0) ioctl$LOOP_CTL_ADD(r3, 0x4c81, 0x0) ioctl$LOOP_CTL_REMOVE(r4, 0x4c80, 0x0) ioctl$KDSETKEYCODE(r4, 0x4b4d, &(0x7f000006b000-0x8)) setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000f62000-0x5c)={{0xa, 0x0, 0x0, @local={0xfe, 0x80, [], 0x0, 0xaa}}, {0xa, 0x0, 0xddb, @mcast1={0xff, 0x1, [], 0x1}}, 0x0, [0x0, 0x0, 0xbe2e]}, 0x5c) 2018/02/01 16:23:11 executing program 2: mmap(&(0x7f0000000000/0xef8000)=nil, 0xef8000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x2, 0x0) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f000046a000-0x4)=0x100, 0x4) sendto$inet(r0, &(0x7f0000edf000), 0x0, 0x0, &(0x7f0000eea000-0x10)={0x2, 0x0, @empty}, 0x10) r1 = fcntl$dupfd(r0, 0x0, r0) recvfrom$inet(r0, &(0x7f0000ef0000-0x73)=""/115, 0x73, 0x12041, &(0x7f0000899000-0x10)={0x2, 0xffffffffffffffff, @rand_addr}, 0x10) ioctl$sock_netrom_SIOCGSTAMPNS(r1, 0x8907, &(0x7f0000ef7000-0x4)) 2018/02/01 16:23:11 executing program 3: mmap(&(0x7f0000000000/0x3a000)=nil, 0x3a000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f000003a000/0x1000)=nil, 0x1000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r0 = memfd_create(&(0x7f000003b000-0x6)='posix_acl_access{Y\x00', 0x0) mmap(&(0x7f000003b000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f000003c000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) pwrite64(r0, &(0x7f000003c000-0x1)='/', 0x1, 0x0) lseek(r0, 0x0, 0x2) mmap(&(0x7f000003d000/0x1000)=nil, 0x1000, 0x3, 0x0, 0xffffffffffffffff, 0x0) socket$netlink(0x10, 0x3, 0x0) mmap(&(0x7f000003e000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f000003e000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f000003e000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f000003e000/0x1000)=nil, 0x1000, 0x3, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f000003e000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f000003e000/0x1000)=nil, 0x1000, 0x3, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f000003e000/0x1000)=nil, 0x1000, 0x3, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f000003e000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f000003e000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f000003e000/0x1000)=nil, 0x1000, 0x3, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f000003e000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f000003e000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f000003e000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f000003e000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f000003e000/0x1000)=nil, 0x1000, 0x3, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f000000b000/0x4000)=nil, 0x4000, 0x3, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000022000/0x2000)=nil, 0x2000, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f000003e000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f000003e000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f000003e000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f000003e000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f000003e000/0x1000)=nil, 0x1000, 0x3, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f000003e000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f000003e000/0x1000)=nil, 0x1000, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f000003e000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) sendfile(r0, r0, &(0x7f000003c000), 0x1000) mmap(&(0x7f000003e000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) readv(r0, &(0x7f0000032000-0x60)=[{&(0x7f000003e000)=""/234, 0xea}, {&(0x7f0000011000)=""/4096, 0x1000}, {&(0x7f000003e000)=""/255, 0xff}, {&(0x7f000003f000-0xf9)=""/249, 0xf9}, {&(0x7f000003f000-0x1000)=""/4096, 0x1000}], 0x5) [ 237.504768] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=24 sclass=netlink_tcpdiag_socket pig=32711 comm=syz-executor5 2018/02/01 16:23:11 executing program 5: mmap(&(0x7f0000000000/0xd12000)=nil, 0xd12000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) shutdown(r0, 0x0) ioctl$sock_inet_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f0000000000)={@common='sit0\x00', @ifru_addrs={0x2, 0x0, @remote={0xac, 0x14, 0x0, 0xbb}}}) recvmmsg(r0, &(0x7f0000d10000)=[{{0x0, 0x0, &(0x7f0000891000-0x30)=[], 0x0, &(0x7f0000d0e000)=""/4096, 0x1000}}, {{&(0x7f0000d0e000)=@in={0x0, 0x0, @rand_addr}, 0x10, &(0x7f0000d10000)=[{&(0x7f0000d0f000-0x6e)=""/110, 0x6e}, {&(0x7f0000071000-0xea)=""/234, 0xea}, {&(0x7f0000d0f000-0x53)=""/178, 0xb2}, {&(0x7f0000d0f000-0x3a)=""/58, 0x3a}, {&(0x7f0000408000-0xd6)=""/214, 0xd6}, {&(0x7f0000d0e000)=""/48, 0x30}], 0x6, &(0x7f0000b13000-0x9c)=""/156, 0x9c}}], 0x2, 0x10020, 0x0) 2018/02/01 16:23:11 executing program 4: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)={0xaa}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) fchmodat(0xffffffffffffffff, &(0x7f0000012000)='./file0\x00', 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12, 0x0, @tid}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) ioctl$UFFDIO_ZEROPAGE(r0, 0x8010aa02, &(0x7f00000c1000-0x10)={&(0x7f0000011000/0x3000)=nil, 0x3000}) 2018/02/01 16:23:11 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) seccomp(0x800000000001, 0x0, &(0x7f0000001000-0x10)={0x2, &(0x7f000045c000-0x10)=[{0x20, 0x0, 0x0, 0x102}, {0x6}]}) 2018/02/01 16:23:11 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000ea000-0x8)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_ifreq(r0, 0x8943, &(0x7f00008c8000-0x28)={@generic="95886fa3f7caafb3c6d4f979c8bd4c09", @ifru_ivalue}) 2018/02/01 16:23:11 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) seccomp(0x1, 0x0, &(0x7f0000b98000-0x8)={0x2, &(0x7f0000022000)=[{0x0, 0x0, 0x0, 0xffffffffffffffdc}, {0x16}]}) flistxattr(0xffffffffffffffff, &(0x7f00001da000-0xb2)=""/178, 0xb2) 2018/02/01 16:23:11 executing program 6: mmap(&(0x7f0000000000/0xd42000)=nil, 0xd42000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket(0xa, 0x1, 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x1, 0x0, []}) ioctl(r0, 0x8916, &(0x7f0000000000)) 2018/02/01 16:23:11 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket(0x20000000000000a, 0x2, 0x0) connect$inet6(r0, &(0x7f00006b2000)={0xa, 0xffffffffffffffff, 0x0, @remote={0xfe, 0x80, [], 0xffffffffffffffff, 0xbb}, 0x100000001}, 0x1c) connect$inet(r0, &(0x7f00009a0000)={0x2, 0xffffffffffffffff, @multicast2=0xe0000002}, 0x10) getsockopt$inet6_mreq(r0, 0x29, 0x18, &(0x7f0000aa1000-0x14)={@remote}, &(0x7f0000798000)=0x14) 2018/02/01 16:23:11 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$random(&(0x7f0000ba3000)='/dev/random\x00', 0x0, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000004000-0xc)) epoll_ctl$EPOLL_CTL_MOD(r1, 0x3, r0, &(0x7f0000019000)={0x400000004}) 2018/02/01 16:23:12 executing program 2: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x4, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000001000-0xd)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r0, 0xc08c5332, &(0x7f0000011000)={0x0, 0x0, 0x0, 'queue1\x00'}) 2018/02/01 16:23:12 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) sendmsg$unix(0xffffffffffffffff, &(0x7f0000833000)={&(0x7f0000564000)=@abs, 0x8, &(0x7f00007e0000)=[{&(0x7f0000007000)="fd20932fcc7cfaafcf960802e02348f8fba600069da7a78a04a646", 0x1b}], 0x1, &(0x7f0000335000-0xd8)=[]}, 0x0) r0 = syz_open_dev$sg(&(0x7f0000005000)='/dev/sg#\x00', 0x0, 0x2202) ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, &(0x7f0000007000)={0x0, 0x0, 0x8}) ioctl(r0, 0x2285, &(0x7f0000007000)='S') 2018/02/01 16:23:12 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00001b5000-0xa)='/dev/ptmx\x00', 0x106, 0x0) writev(r0, &(0x7f0000dc0000-0x8)=[{&(0x7f0000aa5000)="ebb29c2aa804af648d63b2908439b40213", 0x11}], 0x1) writev(r0, &(0x7f0000457000)=[{&(0x7f0000fc0000-0x1000)="60745d5ba48e28c8cab5e801f2c78aac5df2fcbc6f22627993ffa7043fa0a8e317662ba96c5f6012", 0x28}], 0x1) ioctl$TCSETA(r0, 0x5402, &(0x7f0000a27000-0x14)={0x0, 0x0, 0xfffffffffffffffd}) 2018/02/01 16:23:12 executing program 1: mmap(&(0x7f0000000000/0x38000)=nil, 0x38000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000027000)='./file0\x00', 0x0) mount(&(0x7f0000034000-0xc)='./file0/bus\x00', &(0x7f0000010000-0x8)='./file0\x00', &(0x7f0000033000-0x5)='fuse\x00', 0x7ffbf, &(0x7f0000032000)) 2018/02/01 16:23:12 executing program 0: r0 = add_key$keyring(&(0x7f0000517000)='keyring\x00', &(0x7f00006ee000)={0x73, 0x79, 0x7a}, 0x0, 0x0, 0x0) keyctl$clear(0x7, r0) 2018/02/01 16:23:12 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndtimer(&(0x7f0000d40000-0xf)='/dev/snd/timer\x00', 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_SELECT(r0, 0x40345410, &(0x7f0000001000)={{0x100000001}}) ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r0, 0x54a2) mmap(&(0x7f0000000000/0xddf000)=nil, 0xddf000, 0x0, 0x32, 0xffffffffffffffff, 0x0) readv(r0, &(0x7f0000fca000-0x40)=[{&(0x7f0000caa000)=""/8, 0x8}], 0x1) 2018/02/01 16:23:12 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000f6c000-0x18)={0xaa}) ioctl$TUNSETIFINDEX(0xffffffffffffffff, 0x400454da, &(0x7f0000306000-0x4)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f000072f000)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1}) ioctl$UFFDIO_REGISTER(r0, 0xc028aa03, &(0x7f00000a1000-0x20)={{&(0x7f000014d000/0x800000)=nil, 0x800000}, 0x200000}) 2018/02/01 16:23:12 executing program 4: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)={0xaa}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) fchmodat(0xffffffffffffffff, &(0x7f0000012000)='./file0\x00', 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r1 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12, 0x0, @tid}, &(0x7f0000044000)) tkill(r1, 0x15) ioctl$UFFDIO_ZEROPAGE(r0, 0x8010aa02, &(0x7f00000c1000-0x10)={&(0x7f0000011000/0x3000)=nil, 0x3000}) 2018/02/01 16:23:12 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x5, 0x78, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, @perf_bp={&(0x7f0000000000), 0x1}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getresuid(&(0x7f0000000000), &(0x7f0000a1d000-0x4), &(0x7f0000896000-0x4)) 2018/02/01 16:23:12 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000966000-0x14), 0x14) 2018/02/01 16:23:12 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) capset(&(0x7f0000000000)={0x19980330}, &(0x7f0000002000-0x18)) r0 = shmget$private(0x0, 0x3000, 0x0, &(0x7f0000609000/0x3000)=nil) shmctl$SHM_UNLOCK(r0, 0xc) 2018/02/01 16:23:12 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000fd6000-0x8)='./file0\x00', 0x0) mount(&(0x7f000000a000)='./file0\x00', &(0x7f0000027000-0x8)='./file0\x00', &(0x7f000000c000)='ramfs\x00', 0x0, &(0x7f000000a000)) mount(&(0x7f0000037000)='./file0\x00', &(0x7f0000c50000-0x8)='./file0\x00', &(0x7f000002f000-0x6)='ramfs\x00', 0x100000, &(0x7f0000ce3000)) mount(&(0x7f000052f000)='./file0\x00', &(0x7f00008fd000-0x1)='.', &(0x7f00003a3000-0x6)="00e2660000", 0x1000, 0x0) mount(&(0x7f00002ba000-0x8)='./file0\x00', &(0x7f0000cbf000-0x8)='./file0\x00', &(0x7f0000dcd000)='ramfs\x00', 0x80000, &(0x7f000002f000)) mount(&(0x7f00009b1000)='./file0\x00', &(0x7f0000ae7000-0x8)='./file0\x00', &(0x7f0000226000)='an\x00\x00\x00\x00\x00\x00\x00\afs\x00', 0x100000, &(0x7f0000b64000-0x1000)) r0 = open(&(0x7f00006a2000)='./file0\x00', 0x0, 0x0) mkdirat(r0, &(0x7f0000034000-0x8)='./file0\x00', 0x0) mount(&(0x7f00001a5000-0xe)='./file0/file0\x00', &(0x7f00002fb000-0x8)='./file0/file0\x00', &(0x7f00002ba000)='\x00v\t', 0x0, &(0x7f000073b000-0x1)) mount(&(0x7f00005e1000-0x8)='./file0\x00', &(0x7f0000df5000-0x8)='.', &(0x7f0000df4000)='%&t3\x00', 0x2000, &(0x7f00003db000-0x23)) 2018/02/01 16:23:12 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mkdir(&(0x7f000082f000)='./control\x00', 0x0) r0 = open(&(0x7f0000a08000)='./control\x00', 0x0, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) symlinkat(&(0x7f00007ae000-0x8)='./file0\x00', r0, &(0x7f0000a31000-0xa)='./control\x00') r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000e4c000)={0xaa}) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000044000-0x20)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r2 = creat(&(0x7f00000df000)='./file0\x00', 0x0) write$sndseq(r2, &(0x7f0000012000-0x2e)=[], 0x0) link(&(0x7f0000b40000-0xa)='./file0\x00', &(0x7f00006b4000-0x10)='./control/file0\x00') utimensat(r0, &(0x7f0000e03000-0x10)='./control/file0\x00', &(0x7f00003e7000-0x10)={{}, {0x0, 0x2710}}, 0x0) 2018/02/01 16:23:12 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) msgrcv(0x0, &(0x7f0000497000-0x8), 0x8, 0x0, 0x0) msgsnd(0x0, &(0x7f000010d000)={0x3}, 0x8, 0x0) 2018/02/01 16:23:12 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) socket$inet_udp(0x2, 0x2, 0x0) r0 = syz_open_dev$tun(&(0x7f0000520000-0xd)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00006b0000-0x28)={@common='gre0\x00', @ifru_map={0x2}}) r1 = syz_open_procfs(0x0, &(0x7f0000256000)='net/mcfilter\x00') readv(r1, &(0x7f0000de3000)=[{&(0x7f0000791000-0xd4)=""/212, 0xd4}], 0x1) 2018/02/01 16:23:12 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000872000+0x936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00009b5000-0x30)={0x4, 0x0, &(0x7f000000a000-0x10)=[@enter_looper={0x630c}], 0x0, 0x0, &(0x7f0000009000)}) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000007000)={0x10, 0x0, &(0x7f0000006000-0x2c)=[@acquire={0x40046305}, @acquire={0x400c630e}], 0x0, 0x0, &(0x7f0000002000)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000009000-0x30)={0x8, 0x0, &(0x7f0000008000)=[@release={0x400c630f}], 0x0, 0x0, &(0x7f0000001000-0xb3)}) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) 2018/02/01 16:23:12 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f000012e000)={0x2, 0x3, @broadcast=0xffffffff}, 0x10) connect$inet(r0, &(0x7f0000987000)={0x2, 0x3, @empty}, 0x10) 2018/02/01 16:23:12 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r0, 0x7ff9) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000eeb000-0xa)='/dev/ptmx\x00', 0x840000000000801, 0x0) sendfile(r1, r0, &(0x7f00000d1000-0x8), 0x8000fffffffe) ioctl$TCSETAF(r1, 0x5408, &(0x7f00003b3000)={0x0, 0x0, 0x0, 0x0, 0xffffffff}) preadv(0xffffffffffffffff, &(0x7f0000e6a000)=[], 0x0, 0x0) 2018/02/01 16:23:12 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000f6c000-0x18)={0xaa}) ioctl$TUNSETIFINDEX(0xffffffffffffffff, 0x400454da, &(0x7f0000306000-0x4)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f000072f000)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1}) ioctl$UFFDIO_REGISTER(r0, 0xc028aa03, &(0x7f00000a1000-0x20)={{&(0x7f000014d000/0x800000)=nil, 0x800000}, 0x200000}) [ 237.864138] binder: 336:339 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 2018/02/01 16:23:12 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x5, 0x78, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, @perf_bp={&(0x7f0000000000), 0x1}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getresuid(&(0x7f0000000000), &(0x7f0000a1d000-0x4), &(0x7f0000896000-0x4)) 2018/02/01 16:23:12 executing program 6: mmap(&(0x7f0000000000/0x13000)=nil, 0x13000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f000000c000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f0000013000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000006000-0x2c)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000002000)}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000e000-0x30)={0x4, 0x0, &(0x7f000000d000-0x98)=[@enter_looper={0x630c}], 0x0, 0x0, &(0x7f0000009000-0xc9)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000a000)={0x10, 0x0, &(0x7f0000010000-0x80)=[@request_death={0x400c630e}], 0x1, 0x0, &(0x7f0000003000-0x1)='\\'}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000004000-0x30)={0x0, 0x0, &(0x7f000000f000)=[], 0x1, 0x0, &(0x7f000000c000-0xe1)="8f"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000e000)={0xc, 0x0, &(0x7f0000007000)=[@dead_binder_done={0x40086310, 0x6}], 0xffffffffffffff51, 0x0, &(0x7f0000011000)}) 2018/02/01 16:23:12 executing program 2: mmap(&(0x7f0000000000/0x13000)=nil, 0x13000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f000000c000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f0000013000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000006000-0x2c)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000002000)}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000e000-0x30)={0x4, 0x0, &(0x7f000000d000-0x98)=[@enter_looper={0x630c}], 0x0, 0x0, &(0x7f0000009000-0xc9)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000a000)={0x10, 0x0, &(0x7f0000010000-0x80)=[@request_death={0x400c630e}], 0x1, 0x0, &(0x7f0000003000-0x1)='\\'}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000004000-0x30)={0x0, 0x0, &(0x7f000000f000)=[], 0x1, 0x0, &(0x7f000000c000-0xe1)="8f"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000e000)={0xc, 0x0, &(0x7f0000007000)=[@dead_binder_done={0x40086310, 0x6}], 0xffffffffffffff51, 0x0, &(0x7f0000011000)}) 2018/02/01 16:23:12 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000009000-0x30)={0x4c, 0x0, &(0x7f0000452000-0x4c)=[@transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f0000b5b000-0x50)=[@ptr={0x70742a85, 0x1, &(0x7f00003df000), 0x1}], &(0x7f0000788000-0x20)=[0x0, 0x28]}, 0x1000}}], 0x0, 0x0, &(0x7f0000009000)}) 2018/02/01 16:23:12 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x1, 0x0) r1 = dup(r0) bind$inet(r0, &(0x7f000012e000)={0x2, 0x3, @broadcast=0xffffffff}, 0x10) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000e9c000-0x10)={0x1, &(0x7f0000f07000)=[{0x6, 0x0, 0x0, 0x101}]}, 0x10) connect$inet(r0, &(0x7f0000987000)={0x2, 0x3, @empty}, 0x10) sendto$inet(r1, &(0x7f00004ef000-0xf7)="96427feebcc603c266d2a2c2da2644124066d6c52746a66fd07a4a9370b924b494651c3febca0be535e0f30bbafe65b8b859d66972208f558b002bbc2366429da28cdb97727474f32fcce772ce439a1b5785bb74b8680705191a3d28e775b402a04cdf7881cf1c80eb042835db0e8c24fd", 0x71, 0x4001, &(0x7f0000849000-0x10)={0x2, 0xffffffffffffffff, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}}, 0x10) sendto$inet(r1, &(0x7f0000e65000)='V', 0x1, 0x0, 0x0, 0x0) ppoll(&(0x7f0000598000-0x8)=[], 0x0, &(0x7f000001f000)={0x77359400}, &(0x7f0000d3f000-0x8), 0x8) sendto$packet(r1, &(0x7f0000d56000)="e6", 0x1, 0x0, &(0x7f000072b000-0x14)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote={[0xaa, 0xaa, 0xaa, 0xaa], 0xffffffffffffffff, 0xbb}}, 0x14) 2018/02/01 16:23:12 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) read(r0, &(0x7f0000622000)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000419000-0xb0)={{0x80}, "0a4ceaa05d9a00000000000000039b3fd4cec307e8ef3d13eb790ec9c65abaf90d229db692542e5b78f8b29e0a27800f0000000000000009fb42f376589701a4", 0xa9824f69d1376637, 0x10800a}) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(0xffffffffffffffff, 0x4040534e, &(0x7f00001a0000-0x17)={0x3, @tick}) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x402c5342, &(0x7f00003c2000)) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000fdc000-0x10)='/dev/sequencer2\x00', 0x0, 0x0) 2018/02/01 16:23:12 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) read(r0, &(0x7f0000622000)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000419000-0xb0)={{0x80}, "0a4ceaa05d9a00000000000000039b3fd4cec307e8ef3d13eb790ec9c65abaf90d229db692542e5b78f8b29e0a27800f0000000000000009fb42f376589701a4", 0xa9824f69d1376637, 0x10800a}) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(0xffffffffffffffff, 0x4040534e, &(0x7f00001a0000-0x17)={0x3, @tick}) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x402c5342, &(0x7f00003c2000)) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000fdc000-0x10)='/dev/sequencer2\x00', 0x0, 0x0) 2018/02/01 16:23:12 executing program 4: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)={0xaa}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) fchmodat(0xffffffffffffffff, &(0x7f0000012000)='./file0\x00', 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r1 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12, 0x0, @tid}, &(0x7f0000044000)) tkill(r1, 0x15) ioctl$UFFDIO_ZEROPAGE(r0, 0x8010aa02, &(0x7f00000c1000-0x10)={&(0x7f0000011000/0x3000)=nil, 0x3000}) 2018/02/01 16:23:12 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x5, 0x78, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, @perf_bp={&(0x7f0000000000), 0x1}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getresuid(&(0x7f0000000000), &(0x7f0000a1d000-0x4), &(0x7f0000896000-0x4)) 2018/02/01 16:23:12 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x5, 0x78, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, @perf_bp={&(0x7f0000000000), 0x1}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getresuid(&(0x7f0000000000), &(0x7f0000a1d000-0x4), &(0x7f0000896000-0x4)) 2018/02/01 16:23:12 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000009000-0x30)={0x4c, 0x0, &(0x7f0000452000-0x4c)=[@transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f0000b5b000-0x50)=[@ptr={0x70742a85, 0x1, &(0x7f00003df000), 0x1}], &(0x7f0000788000-0x20)=[0x0, 0x28]}, 0x1000}}], 0x0, 0x0, &(0x7f0000009000)}) [ 238.376132] binder: 358 RLIMIT_NICE not set [ 238.387193] binder: 360 RLIMIT_NICE not set [ 238.392374] binder: 360 RLIMIT_NICE not set [ 238.397116] binder: 350:357 got transaction with invalid parent offset or type [ 238.397154] binder: 350:357 transaction failed 29201/-22, size 40-16 line 3088 [ 238.397208] binder: 358 RLIMIT_NICE not set 2018/02/01 16:23:12 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x5, 0x78, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, @perf_bp={&(0x7f0000000000), 0x1}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getresuid(&(0x7f0000000000), &(0x7f0000a1d000-0x4), &(0x7f0000896000-0x4)) 2018/02/01 16:23:12 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000009000-0x30)={0x4c, 0x0, &(0x7f0000452000-0x4c)=[@transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f0000b5b000-0x50)=[@ptr={0x70742a85, 0x1, &(0x7f00003df000), 0x1}], &(0x7f0000788000-0x20)=[0x0, 0x28]}, 0x1000}}], 0x0, 0x0, &(0x7f0000009000)}) 2018/02/01 16:23:12 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) getresuid(&(0x7f0000000000), &(0x7f0000a1d000-0x4), &(0x7f0000896000-0x4)) 2018/02/01 16:23:12 executing program 6: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x0, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)={0xaa}) mprotect(&(0x7f0000012000/0x2000)=nil, 0x2000, 0x2) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) time(&(0x7f0000013000)) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x0, 0xffffffffffffffff, 0x0) clone(0x0, &(0x7f0000f39000), &(0x7f00008a3000), &(0x7f0000bf3000-0x4), &(0x7f00003b9000-0xcd)) ioctl$UFFDIO_ZEROPAGE(r0, 0x8010aa02, &(0x7f00009a2000)={&(0x7f0000011000/0x3000)=nil, 0x3000}) [ 238.409372] binder: undelivered TRANSACTION_ERROR: 29201 [ 238.427371] binder: 348:370 BC_DEAD_BINDER_DONE 0000000000000006 not found [ 238.427648] binder: 346:366 BC_DEAD_BINDER_DONE 0000000000000006 not found [ 238.441134] binder: 372:373 got transaction with invalid parent offset or type [ 238.441169] binder: 372:373 transaction failed 29201/-22, size 40-16 line 3088 [ 238.448181] binder: undelivered TRANSACTION_ERROR: 29201 [ 238.474042] binder: 378:380 got transaction with invalid parent offset or type [ 238.474077] binder: 378:380 transaction failed 29201/-22, size 40-16 line 3088 [ 238.479698] binder: undelivered TRANSACTION_ERROR: 29201 2018/02/01 16:23:13 executing program 3: mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x0, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) mmap(&(0x7f0000003000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000004000-0x18)={0xaa}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000002000-0x1e)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$UFFDIO_ZEROPAGE(r0, 0xc020aa04, &(0x7f0000001000-0x10)={&(0x7f0000012000/0x1000)=nil, 0x1000}) 2018/02/01 16:23:13 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) read(r0, &(0x7f0000622000)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000419000-0xb0)={{0x80}, "0a4ceaa05d9a00000000000000039b3fd4cec307e8ef3d13eb790ec9c65abaf90d229db692542e5b78f8b29e0a27800f0000000000000009fb42f376589701a4", 0xa9824f69d1376637, 0x10800a}) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f00001a0000-0x17)={0x3, @tick}) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x402c5342, &(0x7f00003c2000)) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000fdc000-0x10)='/dev/sequencer2\x00', 0x0, 0x0) 2018/02/01 16:23:13 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000633000)='/dev/ptmx\x00', 0x0, 0x0) r1 = eventfd(0x0) r2 = gettid() socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000029000)={0xffffffffffffffff, 0xffffffffffffffff}) readv(r0, &(0x7f0000dce000-0x10)=[{&(0x7f0000cd8000)=""/1, 0x1}], 0x1) ioctl$int_in(r3, 0x5452, &(0x7f0000b38000)=0x3c) fcntl$setsig(r3, 0xa, 0x12) poll(&(0x7f0000b2c000)=[{r4}], 0x1, 0xfffffffffffffff8) read$eventfd(r1, &(0x7f000039e000-0x8), 0x8) close(r1) r5 = dup2(r3, r4) fcntl$setown(r5, 0x8, r2) tkill(0x0, 0x16) 2018/02/01 16:23:13 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000009000-0x30)={0x4c, 0x0, &(0x7f0000452000-0x4c)=[@transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f0000b5b000-0x50)=[@ptr={0x70742a85, 0x1, &(0x7f00003df000), 0x1}], &(0x7f0000788000-0x20)=[0x0, 0x28]}, 0x1000}}], 0x0, 0x0, &(0x7f0000009000)}) 2018/02/01 16:23:13 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) getresuid(&(0x7f0000000000), &(0x7f0000a1d000-0x4), &(0x7f0000896000-0x4)) 2018/02/01 16:23:13 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x0, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000b37000-0x18)) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f000026c000)=[@flat={0x77622a85, 0x0, 0x0, 0x4}], &(0x7f000000b000-0x30)=[0x0]}}], 0xfffffcf9, 0x0, &(0x7f0000009000)}) 2018/02/01 16:23:13 executing program 4: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)={0xaa}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) fchmodat(0xffffffffffffffff, &(0x7f0000012000)='./file0\x00', 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r1 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12, 0x0, @tid}, &(0x7f0000044000)) tkill(r1, 0x15) ioctl$UFFDIO_ZEROPAGE(r0, 0x8010aa02, &(0x7f00000c1000-0x10)={&(0x7f0000011000/0x3000)=nil, 0x3000}) 2018/02/01 16:23:13 executing program 2: mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000019000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x4, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) mmap(&(0x7f0000003000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000003000)={0xaa}) r1 = epoll_create1(0x0) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f000001a000-0x20)={{&(0x7f0000012000/0x2000)=nil, 0x2000}, 0x1}) close(r1) r2 = memfd_create(&(0x7f0000002000)="6d696d655f747970655e5c76626f780565743028255b73656375726974796370757365742d262727a0255b7070703000", 0x0) pwritev(r2, &(0x7f0000000000)=[{&(0x7f0000012000)="ca", 0x1}], 0x1, 0x0) pwrite64(0xffffffffffffffff, &(0x7f0000005000-0xfe), 0x0, 0x0) clone(0x0, &(0x7f0000000000), &(0x7f0000013000-0x4), &(0x7f0000001000-0x4), &(0x7f0000004000-0x35)) close(r0) 2018/02/01 16:23:13 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) getresuid(&(0x7f0000000000), &(0x7f0000a1d000-0x4), &(0x7f0000896000-0x4)) 2018/02/01 16:23:13 executing program 3: mmap(&(0x7f0000000000/0xfc1000)=nil, 0xfc1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x80002, 0x88) recvfrom$inet6(r0, &(0x7f0000fc1000)=""/185, 0xffffffffffffffd5, 0x0, 0x0, 0x0) bind$inet6(r0, &(0x7f00008a8000)={0xa, 0x3, 0x0, @empty}, 0x1c) r1 = socket$inet6(0xa, 0x8000000000000802, 0x88) sendmsg$inet_sctp(r1, &(0x7f0000a29000)={&(0x7f0000686000-0x10)=@in={0x2, 0x3, @empty}, 0x10, &(0x7f0000fc6000-0x40)=[]}, 0x8000) sendto$inet6(r1, &(0x7f000079f000-0x4b)="b0e57c6b9aee39f5dddb12a5bfc2bc45658dc90f34b7a63a9bcc2c31a1c2f51afa9bb8dc7bd4f1281307caab72a4b0fab24db8791e57fe7cd596d6f14273c08c31b434cf8d", 0x45, 0x0, &(0x7f000089d000-0x1c)={0xa, 0xffffffffffffffff, 0x0, @empty}, 0x1c) 2018/02/01 16:23:13 executing program 7: perf_event_open(&(0x7f000001d000)={0x5, 0x78, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, @perf_bp={&(0x7f0000000000), 0x1}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getresuid(&(0x7f0000000000), &(0x7f0000a1d000-0x4), &(0x7f0000896000-0x4)) [ 238.967591] binder_alloc: 392: binder_alloc_buf, no vma [ 238.968769] binder: BINDER_SET_CONTEXT_MGR already set [ 238.968777] binder: 390:396 ioctl 40046207 0 returned -16 [ 238.993177] binder: 392:394 transaction failed 29189/-3, size 24-8 line 2903 [ 239.000492] binder_alloc: 392: binder_alloc_buf, no vma 2018/02/01 16:23:13 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000009000-0x30)={0x4c, 0x0, &(0x7f0000452000-0x4c)=[@transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f0000b5b000-0x50)=[@ptr={0x70742a85, 0x1, &(0x7f00003df000), 0x1}], &(0x7f0000788000-0x20)=[0x0, 0x28]}, 0x1000}}], 0x0, 0x0, &(0x7f0000009000)}) 2018/02/01 16:23:13 executing program 7: perf_event_open(&(0x7f000001d000)={0x5, 0x78, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, @perf_bp={&(0x7f0000000000), 0x1}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getresuid(&(0x7f0000000000), &(0x7f0000a1d000-0x4), &(0x7f0000896000-0x4)) 2018/02/01 16:23:13 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x3, @broadcast=0xffffffff}, 0x10) sendto$inet(r0, &(0x7f0000fd0000), 0x0, 0x200007ff, &(0x7f0000deb000-0x10)={0x2, 0x3, @loopback=0x7f000001}, 0x10) setsockopt$inet_tcp_int(r0, 0x6, 0xc, &(0x7f000023f000)=0x46, 0x4) 2018/02/01 16:23:13 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000009000-0x30)={0x4c, 0x0, &(0x7f0000452000-0x4c)=[@transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f0000b5b000-0x50)=[@ptr={0x70742a85, 0x1, &(0x7f00003df000), 0x1}], &(0x7f0000788000-0x20)=[0x0, 0x28]}, 0x1000}}], 0x0, 0x0, &(0x7f0000009000)}) 2018/02/01 16:23:13 executing program 7: perf_event_open(&(0x7f000001d000)={0x5, 0x78, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, @perf_bp={&(0x7f0000000000), 0x1}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getresuid(&(0x7f0000000000), &(0x7f0000a1d000-0x4), &(0x7f0000896000-0x4)) [ 239.000524] binder: 390:396 transaction failed 29189/-3, size 40-16 line 2903 [ 239.015127] binder: undelivered TRANSACTION_ERROR: 29189 [ 239.031769] binder: BINDER_SET_CONTEXT_MGR already set [ 239.031779] binder: 410:412 ioctl 40046207 0 returned -16 [ 239.034763] binder_alloc: 392: binder_alloc_buf, no vma 2018/02/01 16:23:13 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000009000-0x30)={0x4c, 0x0, &(0x7f0000452000-0x4c)=[@transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f0000b5b000-0x50)=[@ptr={0x70742a85, 0x1, &(0x7f00003df000), 0x1}], &(0x7f0000788000-0x20)=[0x0, 0x28]}, 0x1000}}], 0x0, 0x0, &(0x7f0000009000)}) 2018/02/01 16:23:13 executing program 1: mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000001000-0xa)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x80045430, &(0x7f00003ba000-0x24)) 2018/02/01 16:23:13 executing program 5: mmap(&(0x7f0000000000/0x6000)=nil, 0x6000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000001000-0x5)='comm\x00') write$fuse(r0, &(0x7f0000aa3000-0x34)={0x10, 0x0, 0x0, @random}, 0x10) 2018/02/01 16:23:13 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x0, 0x32, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x5, 0x78, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, @perf_bp={&(0x7f0000000000), 0x1}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getresuid(&(0x7f0000000000), &(0x7f0000a1d000-0x4), &(0x7f0000896000-0x4)) 2018/02/01 16:23:13 executing program 2: mmap(&(0x7f0000000000/0x7fa000)=nil, 0x7fa000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$key(0xa, 0x2, 0x88) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000008000)={0xa, 0x0, 0x0, 0x4, 0x3, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, [@sadb_x_nat_t_port={0x1}]}, 0x18}, 0x1}, 0x0) [ 239.034786] binder: 410:412 transaction failed 29189/-3, size 40-16 line 2903 [ 239.048924] binder: undelivered TRANSACTION_ERROR: 29189 [ 239.064233] binder: BINDER_SET_CONTEXT_MGR already set [ 239.064242] binder: 421:423 ioctl 40046207 0 returned -16 [ 239.067713] binder_alloc: 392: binder_alloc_buf, no vma [ 239.067739] binder: 421:423 transaction failed 29189/-3, size 40-16 line 2903 2018/02/01 16:23:13 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x0, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000b37000-0x18)) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f000026c000)=[@flat={0x77622a85, 0x0, 0x0, 0x4}], &(0x7f000000b000-0x30)=[0x0]}}], 0xfffffcf9, 0x0, &(0x7f0000009000)}) [ 239.074181] binder: undelivered TRANSACTION_ERROR: 29189 [ 239.115868] binder_alloc: 392: binder_alloc_buf, no vma [ 239.115925] binder: 427:430 transaction failed 29189/-3, size 40-16 line 2903 [ 239.134587] binder: undelivered TRANSACTION_ERROR: 29189 [ 239.168336] binder_alloc: 442: binder_alloc_buf, no vma [ 239.173834] binder: 442:443 transaction failed 29189/-3, size 24-8 line 2903 2018/02/01 16:23:13 executing program 4: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)={0xaa}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) fchmodat(0xffffffffffffffff, &(0x7f0000012000)='./file0\x00', 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r1 = gettid() timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r1, 0x15) ioctl$UFFDIO_ZEROPAGE(r0, 0x8010aa02, &(0x7f00000c1000-0x10)={&(0x7f0000011000/0x3000)=nil, 0x3000}) 2018/02/01 16:23:13 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x1, 0x0) setsockopt$inet6_group_source_req(r0, 0x29, 0x30, &(0x7f0000b18000-0x108)={0x0, {{0xa, 0x0, 0x0, @remote={0xfe, 0x80, [], 0x0, 0xbb}}}, {{0xa, 0x0, 0x84c, @local={0xfe, 0x80, [], 0x0, 0xaa}}}}, 0x108) 2018/02/01 16:23:13 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x0, 0x32, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x5, 0x78, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, @perf_bp={&(0x7f0000000000), 0x1}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getresuid(&(0x7f0000000000), &(0x7f0000a1d000-0x4), &(0x7f0000896000-0x4)) 2018/02/01 16:23:13 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000009000-0x30)={0x4c, 0x0, &(0x7f0000452000-0x4c)=[@transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f0000b5b000-0x50)=[@ptr={0x70742a85, 0x1, &(0x7f00003df000), 0x1}], &(0x7f0000788000-0x20)=[0x0, 0x28]}, 0x1000}}], 0x0, 0x0, &(0x7f0000009000)}) 2018/02/01 16:23:13 executing program 5: mmap(&(0x7f0000000000/0x20000)=nil, 0x20000, 0x3, 0x32, 0xffffffffffffffff, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000004000-0xe0)=[{&(0x7f0000011000)=@file={0x0, './file0\x00'}, 0xa, &(0x7f0000017000)=[{&(0x7f000001f000-0x1000)="556bc0368135b33e0adae316810e5bc1bb7b742d98539a9bcf21b232e3354e54aadc6e356cbc46758d9c23626ab6c0f514cb4439361d8f3328a60fd418fc76d57cd7f78cee028dc01f7548a241e71cb5c0aec4da7b5fcd9f5f4e21f3687a179bb0746b9eeb04c5f21992667124ccfc40d6ed3d92b4e42adc89aca5b8d7d957b1d88270178ff50fc842ab90915c773399b871e203553e98858389267b37d63f8a1ef7dceb048172d4a88b42dd6755704b30f76aa94ea316661ad40a8c819ea5fac9617fd37b4dd4aca88fc443464f003b58e12855a21e670c82ab8f38d1f682746b703d3cb5f1142bff8f2cbe3e7594f83e01f2ad01b7c95d7f06528b24d6", 0xfe}, {&(0x7f000001e000)="34e67bbf31dcb981144e81a347842b271476e1785ee24839bc6e713dc9687fe8cd93e3c1e6c72b87feaed28239253d30cdcfcbdb6f72a7944ca9b0ac6fe243d46d3f03b8a2486def9d4aaa92bd3c95298aaca4aeb318aad0a552c3384aa9db065e1ed4984e20568ef2c971ef72fadcb45fb5481e4563fdb34f9084db55ce7057360fd5b513acbc86854dc65340a221f308cb02d27256f7b21667ccd58f2080565fed43ad26165c0bfda3b59933c53e84fe3a56b67794ae993f4c423f20e04ac6185ab5780114dbc2d7ee36743f3d3c", 0xcf}], 0x2}], 0x1, 0x0) r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000018000)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_NAME(r0, 0x41007701, &(0x7f000001e000-0x2)="a843") 2018/02/01 16:23:13 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) keyctl$join(0x1, &(0x7f0000329000-0x5)={0x73, 0x79, 0x7a}) keyctl$session_to_parent(0x12) 2018/02/01 16:23:13 executing program 1: r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$inet_opts(r0, 0x0, 0xd, &(0x7f0000d80000), 0x0) 2018/02/01 16:23:13 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0xa, 0x0) ioctl$sock_inet_SIOCDELRT(r0, 0x890c, &(0x7f0000ceb000-0x78)={0x0, {0x2, 0xffffffffffffffff, @broadcast=0xffffffff}, {0x2, 0xffffffffffffffff, @loopback=0x7f000001}, {0x2, 0xffffffffffffffff, @rand_addr=0xffffffff}, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000d52000)=@syzn={0x73, 0x79, 0x7a, 0x0}}) 2018/02/01 16:23:13 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x0, 0x32, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x5, 0x78, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, @perf_bp={&(0x7f0000000000), 0x1}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getresuid(&(0x7f0000000000), &(0x7f0000a1d000-0x4), &(0x7f0000896000-0x4)) 2018/02/01 16:23:13 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) rmdir(&(0x7f00002eb000)='./file0\x00') mkdir(&(0x7f00000ee000)='./file0\x00', 0x0) mount(&(0x7f0000e07000)='./file0\x00', &(0x7f0000d15000-0x4)='./file0\x00', &(0x7f00009cf000)='ramfs\x00', 0x2000000, &(0x7f000081f000)) creat(&(0x7f0000ec8000-0x8)='./file0\x00', 0x0) r0 = open(&(0x7f000017d000-0xc)='./file0/bus\x00', 0x141042, 0xfffffffffffffffb) pwritev(r0, &(0x7f0000a5d000-0xa0)=[{&(0x7f000049f000-0x47)='Z', 0x1}], 0x1, 0x0) 2018/02/01 16:23:13 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) capset(&(0x7f0000000000)={0x19980330}, &(0x7f0000b4b000-0x18)) capset(&(0x7f0000d57000)={0x20080522}, &(0x7f0000b0b000-0x18)={0x0, 0x0, 0x0, 0x0, 0x0, 0x81}) 2018/02/01 16:23:13 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000c9c000)={0xa, 0x2, 0x0, @empty}, 0x1c) listen(r1, 0x0) sendto$inet(r0, &(0x7f0000d44000), 0x0, 0x20008045, &(0x7f00000b0000)={0x2, 0x2, @empty}, 0x10) getsockopt$sock_buf(r0, 0x1, 0x1f, &(0x7f0000fd1000)=""/78, &(0x7f0000a20000)=0x4e) 2018/02/01 16:23:13 executing program 2: mmap(&(0x7f0000000000/0xe000)=nil, 0xe000, 0x3, 0x32, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000003000-0x8)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = memfd_create(&(0x7f0000000000)='dev ', 0x0) ftruncate(r2, 0x40001) sendfile(r1, r2, &(0x7f000000a000), 0x420000000fee) recvmmsg(r0, &(0x7f000000e000-0x100)=[{{&(0x7f0000010000)=@alg, 0x58, &(0x7f0000005000-0x40)=[{&(0x7f000000e000)=""/1, 0x1}], 0x1, &(0x7f000000f000-0x3f)}}], 0x1, 0x0, 0x0) 2018/02/01 16:23:13 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x5, 0x78, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, @perf_bp={&(0x7f0000000000), 0x1}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getresuid(&(0x7f0000000000), &(0x7f0000a1d000-0x4), &(0x7f0000896000-0x4)) [ 239.536708] binder: 448:452 transaction failed 29189/-22, size 40-16 line 2788 2018/02/01 16:23:13 executing program 6: r0 = socket(0x10, 0x803, 0x0) write(r0, &(0x7f0000125000), 0x0) close(r0) 2018/02/01 16:23:13 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000009000-0x30)={0x4c, 0x0, &(0x7f0000452000-0x4c)=[@transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f0000b5b000-0x50)=[@ptr={0x70742a85, 0x1, &(0x7f00003df000), 0x1}], &(0x7f0000788000-0x20)=[0x0, 0x28]}, 0x1000}}], 0x0, 0x0, &(0x7f0000009000)}) [ 239.580483] binder: undelivered TRANSACTION_ERROR: 29189 [ 239.596987] TCP: request_sock_TCP: Possible SYN flooding on port 20022. Sending cookies. Check SNMP counters. [ 239.625708] binder: 476:483 transaction failed 29189/-22, size 40-16 line 2788 [ 239.638788] binder: undelivered TRANSACTION_ERROR: 29189 2018/02/01 16:23:14 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x5, 0x78, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, @perf_bp={&(0x7f0000000000), 0x1}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getresuid(&(0x7f0000000000), &(0x7f0000a1d000-0x4), &(0x7f0000896000-0x4)) 2018/02/01 16:23:14 executing program 4: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)={0xaa}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) fchmodat(0xffffffffffffffff, &(0x7f0000012000)='./file0\x00', 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r1 = gettid() timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r1, 0x15) ioctl$UFFDIO_ZEROPAGE(r0, 0x8010aa02, &(0x7f00000c1000-0x10)={&(0x7f0000011000/0x3000)=nil, 0x3000}) 2018/02/01 16:23:14 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$tun(&(0x7f0000434000-0xd)='/dev/net/tun\x00', 0x0, 0xa) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000c52000-0x41)={@common='gre0\x00', @ifru_names=@generic="4e54000cc0a1ed4f3a0a1fdc222073b5"}) write$tun(r0, &(0x7f0000d0b000-0x41f)=@hdr={0x1, 0x0, 0x0, 0x0, 0x0, 0x0, @ipv4={{0x5, 0x4, 0x0, 0x0, 0x24, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @empty, @broadcast=0xffffffff, {[]}}, @dccp={{0xffffffffffffffff, 0xffffffffffffffff, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, "b31d90", 0x0, "b99878"}}}}, 0x2e) 2018/02/01 16:23:14 executing program 3: mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0xa, 0x0) bind(r0, &(0x7f0000001000-0x2e)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0xffffffffffffffff, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}}}}, 0x2e) 2018/02/01 16:23:14 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket(0x20000000000000a, 0x2, 0x0) sendmsg(r0, &(0x7f00003a7000)={&(0x7f0000aee000-0x1c)=@in6={0xa, 0x0, 0x0, @empty}, 0x1c, &(0x7f00008f3000)=[], 0x0, &(0x7f0000ca4000-0x3f0)=[{0x10, 0x29, 0x8}], 0x10}, 0x0) 2018/02/01 16:23:14 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000009000-0x30)={0x4c, 0x0, &(0x7f0000452000-0x4c)=[@transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f0000b5b000-0x50)=[@ptr={0x70742a85, 0x1, &(0x7f00003df000), 0x1}], &(0x7f0000788000-0x20)=[0x0, 0x28]}, 0x1000}}], 0x0, 0x0, &(0x7f0000009000)}) 2018/02/01 16:23:14 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) timerfd_gettime(0xffffffffffffffff, &(0x7f0000dd9000-0x20)={{}, {0x0, 0x0}}) clock_nanosleep(0x0, 0x0, &(0x7f00001d9000-0x10)={0x77359400, r0}, &(0x7f00001ad000-0x10)) 2018/02/01 16:23:14 executing program 5: mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_int(r0, 0x1, 0x21, &(0x7f0000001000-0x4), 0x4) [ 240.101478] binder_alloc: 487: binder_alloc_buf, no vma [ 240.118271] binder: 487:493 transaction failed 29189/-3, size 40-16 line 2903 [ 240.139401] binder: undelivered TRANSACTION_ERROR: 29189 2018/02/01 16:23:14 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x5, 0x78, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, @perf_bp={&(0x7f0000000000), 0x1}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getresuid(&(0x7f0000000000), &(0x7f0000a1d000-0x4), &(0x7f0000896000-0x4)) 2018/02/01 16:23:14 executing program 2: clone(0x0, &(0x7f0000e81000), &(0x7f00001e8000-0x4), &(0x7f00000e7000-0x4), &(0x7f00005d6000-0x75)) dup(0xffffffffffffff9c) 2018/02/01 16:23:14 executing program 1: mmap(&(0x7f0000000000/0x22000)=nil, 0x22000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) recvmsg(r0, &(0x7f000001f000-0x38)={&(0x7f000001c000)=@ll={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @local={[], 0x0}}, 0x14, &(0x7f000001e000-0x30)=[], 0x0, &(0x7f0000017000-0x8b)=""/139, 0x8b}, 0x2021) 2018/02/01 16:23:14 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000266000-0x28)={@syzn={0x73, 0x79, 0x7a, 0x0}, &(0x7f00003e7000-0x162)=@ethtool_regs={0x4}}) 2018/02/01 16:23:14 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000034000-0xd)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_TIMER(r0, 0xc0605345, &(0x7f0000118000)={0x4636}) 2018/02/01 16:23:14 executing program 6: mmap(&(0x7f0000000000/0x4e000)=nil, 0x4e000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = memfd_create(&(0x7f000004e000-0x2)='!\x00', 0x0) r1 = syz_open_dev$sndseq(&(0x7f0000028000-0xd)='/dev/snd/seq\x00', 0x0, 0x20005) r2 = dup2(r1, r0) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r2, 0xc08c5332, &(0x7f0000037000)={0x0, 0x0, 0x0, "9ede7a8c5ae95e48000000000000007f4f13eeab650000000000007fffde2c51f01b7f0b014f9f91eeb7c37c7240f476c8d753d000aa0500000074dbcfa6c14d"}) write$sndseq(r0, &(0x7f000000a000)=[{0x7, 0x3, 0x0, 0x0, @tick=0x404, {}, {}, @ext={0x0, &(0x7f0000039000-0x2)}}], 0x30) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000044000-0x50)={0x343, @tick}) 2018/02/01 16:23:14 executing program 4: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)={0xaa}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) fchmodat(0xffffffffffffffff, &(0x7f0000012000)='./file0\x00', 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r1 = gettid() timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r1, 0x15) ioctl$UFFDIO_ZEROPAGE(r0, 0x8010aa02, &(0x7f00000c1000-0x10)={&(0x7f0000011000/0x3000)=nil, 0x3000}) 2018/02/01 16:23:14 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000009000-0x30)={0x4c, 0x0, &(0x7f0000452000-0x4c)=[@transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f0000b5b000-0x50)=[@ptr={0x70742a85, 0x1, &(0x7f00003df000), 0x1}], &(0x7f0000788000-0x20)=[0x0, 0x28]}, 0x1000}}], 0x0, 0x0, &(0x7f0000009000)}) 2018/02/01 16:23:14 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x0, 0x78, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, @perf_bp={&(0x7f0000000000), 0x1}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getresuid(&(0x7f0000000000), &(0x7f0000a1d000-0x4), &(0x7f0000896000-0x4)) 2018/02/01 16:23:14 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000086000-0x8)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$lock(r1, 0x7, &(0x7f0000def000)) fcntl$lock(r1, 0x25, &(0x7f0000016000)) dup2(r0, r1) 2018/02/01 16:23:14 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$TIOCGSID(0xffffffffffffffff, 0x540f, &(0x7f00008bc000-0x4)=0x0) r1 = syz_open_procfs(r0, &(0x7f0000275000)='oom_score_adj\x00') exit(0x0) write$fuse(r1, &(0x7f00009c3000)={0x30, 0x0, 0x0, @fuse_notify_retrieve_out}, 0x30) 2018/02/01 16:23:14 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = gettid() ppoll(&(0x7f0000fd6000-0x18)=[], 0x0, &(0x7f000082d000)={0x77359400}, &(0x7f000096d000+0x79), 0x8) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12, 0x0, @tid}, &(0x7f0000044000)) clock_gettime(0x0, &(0x7f0000f8f000-0x10)={0x0, 0x0}) rt_sigtimedwait(&(0x7f0000bc5000), &(0x7f00008b8000-0x10), &(0x7f000005e000-0x10)={0x0, r1}, 0x8) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r0, 0x1000000000016) 2018/02/01 16:23:14 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket(0xa, 0x2400000001, 0x0) capget(&(0x7f000003a000), &(0x7f0000034000)={0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}) setsockopt$inet6_MCAST_JOIN_GROUP(r0, 0x29, 0x2a, &(0x7f00006e5000)={0x1, {{0xa, 0xffffffffffffffff, 0x0, @mcast1={0xff, 0x1, [], 0x1}}}}, 0x88) ioctl$DRM_IOCTL_SET_CLIENT_CAP(0xffffffffffffffff, 0x4010640d, &(0x7f0000034000)={0x100000001, 0xa}) getsockopt$inet6_buf(r0, 0x29, 0x10000000000030, &(0x7f0000035000-0x1000)=""/144, &(0x7f0000001000-0x4)=0x90) 2018/02/01 16:23:15 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = open(&(0x7f000074d000-0x8)='./file0\x00', 0x141046, 0x0) write$evdev(r0, &(0x7f0000548000-0x18)=[{}], 0x18) ftruncate(r0, 0x4) [ 240.690895] binder_alloc: 519: binder_alloc_buf, no vma [ 240.715308] binder: 519:523 transaction failed 29189/-3, size 40-16 line 2903 [ 240.742582] binder: undelivered TRANSACTION_ERROR: 29189 2018/02/01 16:23:15 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x0, 0x78, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, @perf_bp={&(0x7f0000000000), 0x1}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getresuid(&(0x7f0000000000), &(0x7f0000a1d000-0x4), &(0x7f0000896000-0x4)) 2018/02/01 16:23:15 executing program 2: mmap(&(0x7f0000000000/0xadc000)=nil, 0xadc000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(r0, 0x29, 0x43, &(0x7f0000adb000)=0xa, 0x4) sendto$inet6(r0, &(0x7f00002a1000-0x4ec), 0x0, 0x200408d4, &(0x7f000072e000)={0xa, 0xffffffffffffffff, 0x0, @loopback={0x0, 0x1}}, 0x1c) 2018/02/01 16:23:15 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x1, 0x0) setsockopt$inet6_MCAST_JOIN_GROUP(r0, 0x29, 0x2a, &(0x7f0000c76000)={0xffffffffffff0000, {{0xa, 0xffffffffffffffff, 0x0, @mcast2={0xff, 0x2, [], 0x1}}}}, 0x88) 2018/02/01 16:23:15 executing program 6: mmap(&(0x7f0000000000/0xf1e000)=nil, 0xf1e000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_IPSEC_POLICY(r0, 0x29, 0x30, &(0x7f0000c02000-0xe8)={{{@in6=@mcast1={0xff, 0x1, [], 0x1}, @in6=@empty}}, {{@in=@rand_addr}, 0x0, @in6=@empty}}, 0x40fd) 2018/02/01 16:23:15 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000009000-0x30)={0x4c, 0x0, &(0x7f0000452000-0x4c)=[@transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f0000b5b000-0x50)=[@ptr={0x70742a85, 0x1, &(0x7f00003df000), 0x1}], &(0x7f0000788000-0x20)=[0x0, 0x28]}, 0x1000}}], 0x0, 0x0, &(0x7f0000009000)}) 2018/02/01 16:23:15 executing program 5: clone(0x0, &(0x7f0000b26000), &(0x7f0000eaa000-0x4), &(0x7f000039b000), &(0x7f0000bda000)) modify_ldt$read_default(0x2, &(0x7f0000f21000-0x8c)=""/140, 0x8c) 2018/02/01 16:23:15 executing program 4: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)={0xaa}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) fchmodat(0xffffffffffffffff, &(0x7f0000012000)='./file0\x00', 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12, 0x0, @tid}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(0x0, 0x15) ioctl$UFFDIO_ZEROPAGE(r0, 0x8010aa02, &(0x7f00000c1000-0x10)={&(0x7f0000011000/0x3000)=nil, 0x3000}) 2018/02/01 16:23:15 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f000039b000)={0xaa}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f000072f000)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1}) ioctl$UFFDIO_REGISTER(r0, 0xc028aa03, &(0x7f00000a1000-0x20)={{&(0x7f000014d000/0x800000)=nil, 0x800000}, 0x200000}) 2018/02/01 16:23:15 executing program 2: mmap(&(0x7f0000000000/0x95e000)=nil, 0x95e000, 0x3, 0x32, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1000000000005, 0x0, &(0x7f0000021000)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000022000-0x10)={0x2, &(0x7f0000016000)=[{0x28, 0x0, 0x0, 0xfffffffffffff010}, {0x6}]}, 0x10) writev(r1, &(0x7f00001f5000-0x30)=[{&(0x7f00004a7000)="d37653fa", 0x4}], 0x1) 2018/02/01 16:23:15 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x0, 0x78, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, @perf_bp={&(0x7f0000000000), 0x1}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getresuid(&(0x7f0000000000), &(0x7f0000a1d000-0x4), &(0x7f0000896000-0x4)) 2018/02/01 16:23:15 executing program 5: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)={0xaa}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) lgetxattr(&(0x7f0000011000)='./file0\x00', &(0x7f0000011000)=@random={'btrfs.\x00', "73797374656d865e00"}, &(0x7f0000001000-0x63)=""/99, 0x63) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x2, 0x32, 0xffffffffffffffff, 0x0) clone(0x0, &(0x7f0000b26000), &(0x7f0000eaa000-0x4), &(0x7f000039b000), &(0x7f0000bda000)) ioctl$UFFDIO_ZEROPAGE(r0, 0x8010aa02, &(0x7f00000c1000-0x10)={&(0x7f0000011000/0x3000)=nil, 0x3000}) 2018/02/01 16:23:15 executing program 4: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)={0xaa}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) fchmodat(0xffffffffffffffff, &(0x7f0000012000)='./file0\x00', 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12, 0x0, @tid}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(0x0, 0x15) ioctl$UFFDIO_ZEROPAGE(r0, 0x8010aa02, &(0x7f00000c1000-0x10)={&(0x7f0000011000/0x3000)=nil, 0x3000}) 2018/02/01 16:23:15 executing program 1: mmap(&(0x7f0000000000/0xf7c000)=nil, 0xf7c000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_int(r0, 0x29, 0x19, &(0x7f0000e72000-0x4), 0x4) [ 241.236206] binder_alloc: 556: binder_alloc_buf, no vma [ 241.255654] binder: 556:557 transaction failed 29189/-3, size 40-16 line 2903 2018/02/01 16:23:15 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) unshare(0x8000400) r0 = mq_open(&(0x7f000004b000)='/$cgrouplo\x00', 0x8c2, 0x0, &(0x7f000004b000)={0xffffffffffffffff, 0x1, 0x3}) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000289000)) mq_timedsend(r0, &(0x7f0000012000), 0x0, 0x0, &(0x7f0000036000)) epoll_pwait(r1, &(0x7f00003da000-0x3c)=[{}], 0x1, 0x0, &(0x7f0000e80000), 0x8) 2018/02/01 16:23:15 executing program 3: mmap(&(0x7f0000000000/0xfcd000)=nil, 0xfcd000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mkdir(&(0x7f00004fa000)='./file0\x00', 0x0) mount(&(0x7f000000a000)='./file0\x00', &(0x7f0000db1000-0x8)='./file0\x00', &(0x7f0000014000)='proc\x00', 0x0, &(0x7f0000cde000)) r0 = open(&(0x7f000054f000-0x8)='./file0\x00', 0x0, 0x0) mount(&(0x7f000000a000)='./file0\x00', &(0x7f0000b31000-0x8)='./file0\x00', &(0x7f0000014000)='ramfs\x00', 0x0, &(0x7f0000525000)) getdents(r0, &(0x7f000058f000)=""/160, 0xa0) getdents64(r0, &(0x7f0000fcc000)=""/181, 0xb5) getdents64(r0, &(0x7f0000efa000-0x17)=""/1712, 0x6b0) 2018/02/01 16:23:15 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000d9d000-0xc)={0x0}, &(0x7f000044c000)=0xc) r1 = syz_open_procfs(r0, &(0x7f0000ad9000)='attr/current\x00') sendfile(r1, r1, &(0x7f00003fa000-0x8), 0x1f) 2018/02/01 16:23:15 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000009000-0x30)={0x4c, 0x0, &(0x7f0000452000-0x4c)=[@transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f0000b5b000-0x50)=[@ptr={0x70742a85, 0x1, &(0x7f00003df000), 0x1}], &(0x7f0000788000-0x20)=[0x0, 0x28]}, 0x1000}}], 0x0, 0x0, &(0x7f0000009000)}) 2018/02/01 16:23:15 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x5, 0x78, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, @perf_bp={&(0x7f0000000000), 0x1}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getresuid(&(0x7f0000000000), &(0x7f0000a1d000-0x4), &(0x7f0000896000-0x4)) 2018/02/01 16:23:15 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000009000-0x30)={0x4c, 0x0, &(0x7f0000452000-0x4c)=[@transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f0000b5b000-0x50)=[@ptr={0x70742a85, 0x1, &(0x7f00003df000), 0x1}], &(0x7f0000788000-0x20)=[0x0, 0x28]}, 0x1000}}], 0x0, 0x0, &(0x7f0000009000)}) [ 241.291905] binder: undelivered TRANSACTION_ERROR: 29189 2018/02/01 16:23:15 executing program 5: mmap(&(0x7f0000000000/0xb4c000)=nil, 0xb4c000, 0x3, 0x32, 0xffffffffffffffff, 0x0) seccomp(0x1, 0x0, &(0x7f0000001000-0x10)={0x2, &(0x7f0000022000)=[{0x0, 0x0, 0x0, 0xffffffffffffffe0}, {0x16}]}) alarm(0x0) 2018/02/01 16:23:15 executing program 1: ioprio_set$pid(0x1, 0x0, 0x7fff) socketpair$inet6_sctp(0xa, 0x0, 0x84, &(0x7f0000000000)) ioprio_get$pid(0x1000000000002, 0x0) 2018/02/01 16:23:15 executing program 6: mmap(&(0x7f0000000000/0x26000)=nil, 0x26000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x2, &(0x7f0000691000-0x4)=0x79, 0x4) bind$inet(r0, &(0x7f0000887000-0x10)={0x2, 0x3, @broadcast=0xffffffff}, 0x10) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000cd5000-0x4), 0x4) sendto$inet(r0, &(0x7f0000d5a000-0x73), 0xfffffc6c, 0x20000804, &(0x7f0000e1e000)={0x2, 0x3, @loopback=0x7f000001}, 0x10) readv(r0, &(0x7f00007d7000-0x50)=[{&(0x7f0000b7e000)=""/4096, 0x1000}], 0x1) 2018/02/01 16:23:15 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f00005f5000)={0x0, 0x0, &(0x7f00008ff000-0x10)={&(0x7f0000699000-0x110)={0x2, 0xf, 0x0, 0x0, 0xa, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, [@sadb_address={0x5, 0x6, 0x0, 0x0, 0x0, @in6={0xa, 0xffffffffffffffff, 0x0, @empty}}, @sadb_address={0x3, 0x5, 0x0, 0x0, 0x0, @in={0x2, 0xffffffffffffffff, @broadcast=0xffffffff}}]}, 0x50}, 0x1}, 0x0) 2018/02/01 16:23:15 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000009000-0x30)={0x4c, 0x0, &(0x7f0000452000-0x4c)=[@transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f0000b5b000-0x50)=[@ptr={0x70742a85, 0x1, &(0x7f00003df000), 0x1}], &(0x7f0000788000-0x20)=[0x0, 0x28]}, 0x1000}}], 0x0, 0x0, &(0x7f0000009000)}) 2018/02/01 16:23:15 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x5, 0x78, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, @perf_bp={&(0x7f0000000000), 0x1}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getresuid(&(0x7f0000000000), &(0x7f0000a1d000-0x4), &(0x7f0000896000-0x4)) 2018/02/01 16:23:15 executing program 4: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)={0xaa}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) fchmodat(0xffffffffffffffff, &(0x7f0000012000)='./file0\x00', 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12, 0x0, @tid}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(0x0, 0x15) ioctl$UFFDIO_ZEROPAGE(r0, 0x8010aa02, &(0x7f00000c1000-0x10)={&(0x7f0000011000/0x3000)=nil, 0x3000}) 2018/02/01 16:23:15 executing program 3: mmap(&(0x7f0000000000/0xfcd000)=nil, 0xfcd000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mkdir(&(0x7f00004fa000)='./file0\x00', 0x0) mount(&(0x7f000000a000)='./file0\x00', &(0x7f0000db1000-0x8)='./file0\x00', &(0x7f0000014000)='proc\x00', 0x0, &(0x7f0000cde000)) r0 = open(&(0x7f000054f000-0x8)='./file0\x00', 0x0, 0x0) mount(&(0x7f000000a000)='./file0\x00', &(0x7f0000b31000-0x8)='./file0\x00', &(0x7f0000014000)='ramfs\x00', 0x0, &(0x7f0000525000)) getdents(r0, &(0x7f000058f000)=""/160, 0xa0) getdents64(r0, &(0x7f0000fcc000)=""/181, 0xb5) getdents64(r0, &(0x7f0000efa000-0x17)=""/1712, 0x6b0) 2018/02/01 16:23:15 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x5, 0x78, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, @perf_bp={&(0x7f0000000000), 0x1}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getresuid(&(0x7f0000000000), &(0x7f0000a1d000-0x4), &(0x7f0000896000-0x4)) [ 241.405524] kauditd_printk_skb: 3 callbacks suppressed [ 241.405533] audit: type=1326 audit(1517502195.696:167): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 pid=603 comm="syz-executor5" exe="/root/syz-executor5" sig=31 arch=c000003e syscall=202 compat=0 ip=0x453299 code=0xffff0000 2018/02/01 16:23:15 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000699000)='/selinux/enforce\x00', 0x2, 0x0) mknod(&(0x7f0000001000-0x6)='./bus\x00', 0x1000, 0x0) r0 = open(&(0x7f000054a000)='./bus\x00', 0xb00, 0x0) clock_gettime(0x0, &(0x7f0000083000-0x10)={0x0, 0x0}) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(0xffffffffffffffff, 0xc058534f, &(0x7f0000ecb000)={{0xffff}}) ppoll(&(0x7f0000075000)=[{r0}], 0x1, &(0x7f00009b6000-0x10)={0x0, r1+10000000}, &(0x7f000086e000), 0x8) open(&(0x7f0000cd2000)='./bus\x00', 0x24867c8490945911, 0x0) 2018/02/01 16:23:15 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000fde000-0x8)='./file0\x00', 0x0) r0 = open(&(0x7f0000f52000-0x8)='./file0\x00', 0x0, 0x0) mkdirat(r0, &(0x7f0000034000-0x8)='./file0\x00', 0x0) mount(&(0x7f0000df2000)='./file0/file0\x00', &(0x7f0000a17000-0x8)='./file0\x00', &(0x7f0000a42000)='\x00v\t', 0x1001, &(0x7f0000f8e000)) unlinkat(r0, &(0x7f000057d000)='./file0\x00', 0x200) mount(&(0x7f0000c08000)='./file0\x00', &(0x7f00006b7000)='.', &(0x7f00005e9000)='cifs\x00', 0x6004, &(0x7f0000ad5000)) 2018/02/01 16:23:15 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x2, 0x0) setsockopt$inet_mtu(r0, 0x0, 0xa, &(0x7f0000ff1000-0x4)=0x8000000000003, 0x4) sendto$inet(r0, &(0x7f0000865000), 0xffe4, 0x0, &(0x7f0000fda000-0x10)={0x2, 0x0, @rand_addr}, 0x10) 2018/02/01 16:23:15 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000009000-0x30)={0x4c, 0x0, &(0x7f0000452000-0x4c)=[@transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f0000b5b000-0x50)=[@ptr={0x70742a85, 0x1, &(0x7f00003df000), 0x1}], &(0x7f0000788000-0x20)=[0x0, 0x28]}, 0x1000}}], 0x0, 0x0, &(0x7f0000009000)}) 2018/02/01 16:23:15 executing program 5: mmap(&(0x7f0000000000/0xfea000)=nil, 0xfea000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000fe4000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003ba000-0x24)) ioctl$TCSETSW(r0, 0x5402, &(0x7f00009dc000)) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000fe5000-0xc)) r2 = syz_open_pts(r0, 0x0) ioctl$TCXONC(r0, 0x540a, 0x2) ioctl$TCSETA(r0, 0x5402, &(0x7f0000fd8000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6}) readv(r2, &(0x7f0000fe2000)=[{&(0x7f00003b7000-0x8)=""/8, 0x8}], 0x1) 2018/02/01 16:23:15 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x5, 0x78, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x1}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getresuid(&(0x7f0000000000), &(0x7f0000a1d000-0x4), &(0x7f0000896000-0x4)) 2018/02/01 16:23:15 executing program 4: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)={0xaa}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) fchmodat(0xffffffffffffffff, &(0x7f0000012000)='./file0\x00', 0x0) r1 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12, 0x0, @tid}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r1, 0x15) ioctl$UFFDIO_ZEROPAGE(r0, 0x8010aa02, &(0x7f00000c1000-0x10)={&(0x7f0000011000/0x3000)=nil, 0x3000}) 2018/02/01 16:23:15 executing program 6: mmap(&(0x7f0000000000/0x26000)=nil, 0x26000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x2, &(0x7f0000691000-0x4)=0x79, 0x4) bind$inet(r0, &(0x7f0000887000-0x10)={0x2, 0x3, @broadcast=0xffffffff}, 0x10) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000cd5000-0x4), 0x4) sendto$inet(r0, &(0x7f0000d5a000-0x73), 0xfffffc6c, 0x20000804, &(0x7f0000e1e000)={0x2, 0x3, @loopback=0x7f000001}, 0x10) readv(r0, &(0x7f00007d7000-0x50)=[{&(0x7f0000b7e000)=""/4096, 0x1000}], 0x1) [ 241.477567] audit: type=1326 audit(1517502195.768:168): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 pid=603 comm="syz-executor5" exe="/root/syz-executor5" sig=31 arch=c000003e syscall=202 compat=0 ip=0x453299 code=0xffff0000 2018/02/01 16:23:15 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000009000-0x30)={0x4c, 0x0, &(0x7f0000452000-0x4c)=[@transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f0000b5b000-0x50)=[@ptr={0x70742a85, 0x1, &(0x7f00003df000), 0x1}], &(0x7f0000788000-0x20)=[0x0, 0x28]}, 0x1000}}], 0x0, 0x0, &(0x7f0000009000)}) 2018/02/01 16:23:15 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x5, 0x78, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x1}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getresuid(&(0x7f0000000000), &(0x7f0000a1d000-0x4), &(0x7f0000896000-0x4)) 2018/02/01 16:23:15 executing program 2: clone(0x0, &(0x7f0000000000), &(0x7f0000000000), &(0x7f0000000000), &(0x7f0000000000)) unshare(0x10210800) 2018/02/01 16:23:15 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000009000-0x30)={0x4c, 0x0, &(0x7f0000452000-0x4c)=[@transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f0000b5b000-0x50)=[@ptr={0x70742a85, 0x1, &(0x7f00003df000), 0x1}], &(0x7f0000788000-0x20)=[0x0, 0x28]}, 0x1000}}], 0x0, 0x0, &(0x7f0000009000)}) 2018/02/01 16:23:15 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = epoll_create1(0x0) r1 = timerfd_create(0x0, 0x0) epoll_wait(r0, &(0x7f000075e000)=[{}], 0x1, 0x80000001) epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r1, &(0x7f0000ea1000-0xc)) timerfd_settime(r1, 0x3, &(0x7f0000001000-0x20)={{}, {0x0, 0x989680}}, &(0x7f0000037000)) epoll_ctl$EPOLL_CTL_MOD(r0, 0x3, r1, &(0x7f000003d000-0xc)={0x7}) 2018/02/01 16:23:15 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x5, 0x78, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x1}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getresuid(&(0x7f0000000000), &(0x7f0000a1d000-0x4), &(0x7f0000896000-0x4)) 2018/02/01 16:23:15 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000e12000)={0x0}) r1 = gettid() socketpair$unix(0x1, 0x80010000000005, 0x0, &(0x7f0000e19000-0x8)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$int_in(r2, 0x5452, &(0x7f0000009000-0x8)=0x3f) fcntl$setown(r2, 0x8, r1) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000d17000-0x8)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000017a000)=@abs, 0x8) sendmmsg$unix(r5, &(0x7f00000bd000)=[], 0x80, 0x0) writev(r5, &(0x7f0000d89000)=[{&(0x7f0000163000)="82", 0x1}], 0x1) close(r5) fcntl$setsig(r2, 0xa, 0x12) r6 = socket$unix(0x1, 0x2, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f000000b000-0x8)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$unix(r7, &(0x7f0000001000-0x38)={&(0x7f0000239000-0x8)=@abs, 0x8, &(0x7f0000008000)=[], 0x0, &(0x7f0000001000-0x10)=[@rights={0x200, 0x1, 0x1, [r6]}], 0x1}, 0x0) recvmsg(r8, &(0x7f000000e000)={0x0, 0x0, &(0x7f000008b000)=[], 0x0, &(0x7f000000c000), 0xfc13}, 0x0) pselect6(0x40, &(0x7f0000cc9000-0x40), &(0x7f0000cc9000-0x40), &(0x7f000070b000-0x40)={0xffffffffffffffe1}, &(0x7f00008e6000-0x10)={r0, 0x989680}, &(0x7f0000205000-0x10)={&(0x7f0000cc9000-0x8), 0x8}) dup2(r2, r3) tkill(r1, 0x16) 2018/02/01 16:23:15 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) getsockname(0xffffffffffffffff, &(0x7f0000001000-0xa)=@rc, &(0x7f0000000000)=0x9) keyctl$join(0x1, 0x0) 2018/02/01 16:23:15 executing program 3: mmap(&(0x7f0000000000/0x25000)=nil, 0x25000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$key(0xf, 0x3, 0x2) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000012000), 0x4) sendmsg$key(r0, &(0x7f000001d000-0x38)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000001000)={0x2, 0xa, 0x0, 0x0, 0x2, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, []}, 0x10}, 0x1}, 0x0) sendmsg$key(r0, &(0x7f0000007000)={0x0, 0x0, &(0x7f000001b000)={&(0x7f000001c000-0xd0)={0x2, 0x12, 0x0, 0x0, 0x2, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, []}, 0x10}, 0x1}, 0x0) 2018/02/01 16:23:15 executing program 6: mmap(&(0x7f0000000000/0x26000)=nil, 0x26000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x2, &(0x7f0000691000-0x4)=0x79, 0x4) bind$inet(r0, &(0x7f0000887000-0x10)={0x2, 0x3, @broadcast=0xffffffff}, 0x10) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000cd5000-0x4), 0x4) sendto$inet(r0, &(0x7f0000d5a000-0x73), 0xfffffc6c, 0x20000804, &(0x7f0000e1e000)={0x2, 0x3, @loopback=0x7f000001}, 0x10) readv(r0, &(0x7f00007d7000-0x50)=[{&(0x7f0000b7e000)=""/4096, 0x1000}], 0x1) 2018/02/01 16:23:15 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x0, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000009000-0x30)={0x4c, 0x0, &(0x7f0000452000-0x4c)=[@transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f0000b5b000-0x50)=[@ptr={0x70742a85, 0x1, &(0x7f00003df000), 0x1}], &(0x7f0000788000-0x20)=[0x0, 0x28]}, 0x1000}}], 0x0, 0x0, &(0x7f0000009000)}) 2018/02/01 16:23:15 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x5, 0x78, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getresuid(&(0x7f0000000000), &(0x7f0000a1d000-0x4), &(0x7f0000896000-0x4)) 2018/02/01 16:23:15 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x3, @broadcast=0xffffffff}, 0x10) sendto$inet(r0, &(0x7f0000dc3000)="cd1e", 0x2, 0x20000801, &(0x7f0000deb000-0x10)={0x2, 0x3, @loopback=0x7f000001}, 0x10) readv(r0, &(0x7f0000d77000)=[{&(0x7f0000f0b000)=""/240, 0xf0}], 0x1) sendto$inet(r0, &(0x7f0000a93000)="90", 0x1, 0x0, &(0x7f0000d1f000)={0x2, 0xffffffffffffffff, @local={0xac, 0x14, 0xffffffffffffffff, 0xaa}}, 0x10) sendto$inet(r0, &(0x7f00006fd000)="c3", 0x1, 0x81, &(0x7f0000e66000)={0x2, 0xffffffffffffffff, @rand_addr}, 0x10) 2018/02/01 16:23:15 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x0, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000009000-0x30)={0x4c, 0x0, &(0x7f0000452000-0x4c)=[@transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f0000b5b000-0x50)=[@ptr={0x70742a85, 0x1, &(0x7f00003df000), 0x1}], &(0x7f0000788000-0x20)=[0x0, 0x28]}, 0x1000}}], 0x0, 0x0, &(0x7f0000009000)}) 2018/02/01 16:23:16 executing program 4: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)={0xaa}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) fchmodat(0xffffffffffffffff, &(0x7f0000012000)='./file0\x00', 0x0) r1 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12, 0x0, @tid}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r1, 0x15) ioctl$UFFDIO_ZEROPAGE(r0, 0x8010aa02, &(0x7f00000c1000-0x10)={&(0x7f0000011000/0x3000)=nil, 0x3000}) 2018/02/01 16:23:16 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x5, 0x78, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getresuid(&(0x7f0000000000), &(0x7f0000a1d000-0x4), &(0x7f0000896000-0x4)) 2018/02/01 16:23:16 executing program 5: mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000001000-0x4)) 2018/02/01 16:23:16 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x0, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000009000-0x30)={0x4c, 0x0, &(0x7f0000452000-0x4c)=[@transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f0000b5b000-0x50)=[@ptr={0x70742a85, 0x1, &(0x7f00003df000), 0x1}], &(0x7f0000788000-0x20)=[0x0, 0x28]}, 0x1000}}], 0x0, 0x0, &(0x7f0000009000)}) 2018/02/01 16:23:16 executing program 3: mmap(&(0x7f0000000000/0x24000)=nil, 0x24000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f000001c000-0x38)={&(0x7f0000022000)={0x10}, 0xc, &(0x7f0000021000)={&(0x7f0000022000-0x20)=@ipv4_newaddr={0x18, 0x14, 0x221, 0xffffffffffffffff, 0xffffffffffffffff, {0x2}, []}, 0x18}, 0x1}, 0x0) r1 = dup2(r0, r0) recvmsg$netrom(r1, &(0x7f0000023000)={&(0x7f0000023000)=@ax25={0x3, {"076713aa21cad2"}}, 0x10, &(0x7f0000023000)=[], 0x0, &(0x7f0000002000)=[]}, 0x0) 2018/02/01 16:23:16 executing program 1: mmap(&(0x7f0000000000/0xb4a000)=nil, 0xb4a000, 0x3, 0x32, 0xffffffffffffffff, 0x0) seccomp(0x1, 0x0, &(0x7f0000001000-0x10)={0x3, &(0x7f0000022000)=[{0x0, 0x0, 0x0, 0xffffffffffffffe0}, {0x4c}, {0x16}]}) select(0x40, &(0x7f00007da000), &(0x7f00003c3000-0x40), &(0x7f0000b49000-0x40), &(0x7f0000b48000)) 2018/02/01 16:23:16 executing program 6: mmap(&(0x7f0000000000/0x26000)=nil, 0x26000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x2, &(0x7f0000691000-0x4)=0x79, 0x4) bind$inet(r0, &(0x7f0000887000-0x10)={0x2, 0x3, @broadcast=0xffffffff}, 0x10) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000cd5000-0x4), 0x4) sendto$inet(r0, &(0x7f0000d5a000-0x73), 0xfffffc6c, 0x20000804, &(0x7f0000e1e000)={0x2, 0x3, @loopback=0x7f000001}, 0x10) readv(r0, &(0x7f00007d7000-0x50)=[{&(0x7f0000b7e000)=""/4096, 0x1000}], 0x1) 2018/02/01 16:23:16 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f000000d000)={0xffffffffffffffff, 0xffffffffffffffff}) read(r0, &(0x7f000095b000), 0x0) [ 242.124747] audit: type=1326 audit(1517502196.415:169): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 pid=695 comm="syz-executor1" exe="/root/syz-executor1" sig=31 arch=c000003e syscall=202 compat=0 ip=0x453299 code=0xffff0000 [ 242.178162] audit: type=1326 audit(1517502196.468:170): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 pid=695 comm="syz-executor1" exe="/root/syz-executor1" sig=31 arch=c000003e syscall=202 compat=0 ip=0x453299 code=0xffff0000 2018/02/01 16:23:16 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$selinux_load(0xffffffffffffff9c, &(0x7f0000160000)='/selinux/load\x00', 0x2, 0x0) r1 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f000086c000)='/selinux/policy\x00', 0x0, 0x0) sendfile(r0, r1, &(0x7f00005b3000), 0x1b4) 2018/02/01 16:23:16 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000009000-0x30)={0x4c, 0x0, &(0x7f0000452000-0x4c)=[@transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f0000b5b000-0x50)=[@ptr={0x70742a85, 0x1, &(0x7f00003df000), 0x1}], &(0x7f0000788000-0x20)=[0x0, 0x28]}, 0x1000}}], 0x0, 0x0, &(0x7f0000009000)}) 2018/02/01 16:23:16 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x5, 0x78, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getresuid(&(0x7f0000000000), &(0x7f0000a1d000-0x4), &(0x7f0000896000-0x4)) 2018/02/01 16:23:16 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x1, 0x0) r1 = syz_open_dev$tun(&(0x7f0000664000)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000705000)={@common='gre0\x00', @ifru_flags=0x2002}) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000630000-0x20)={@common='gre0\x00', @ifru_flags=0x301}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r2, 0x29, 0x1b, &(0x7f0000692000-0x20)={@local={0xfe, 0x80, [], 0x0, 0xaa}}, 0x20) setsockopt$inet6_mreq(r2, 0x29, 0x1c, &(0x7f0000a05000)={@local={0xfe, 0x80, [], 0x0, 0xaa}}, 0x14) 2018/02/01 16:23:16 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$sock_int(r0, 0x1, 0xa, &(0x7f0000cd5000-0x4)=0xddd, 0x4) ioctl$sock_inet_tcp_SIOCINQ(r0, 0x541b, &(0x7f0000566000)) 2018/02/01 16:23:16 executing program 1: mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mq_getsetattr(0xffffffffffffffff, &(0x7f0000000000)={0x400000000000000}, 0x0) 2018/02/01 16:23:16 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x2, &(0x7f0000691000-0x4)=0x79, 0x4) bind$inet(r0, &(0x7f0000887000-0x10)={0x2, 0x3, @broadcast=0xffffffff}, 0x10) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000cd5000-0x4), 0x4) sendto$inet(r0, &(0x7f0000d5a000-0x73), 0xfffffc6c, 0x20000804, &(0x7f0000e1e000)={0x2, 0x3, @loopback=0x7f000001}, 0x10) readv(r0, &(0x7f00007d7000-0x50)=[{&(0x7f0000b7e000)=""/4096, 0x1000}], 0x1) 2018/02/01 16:23:16 executing program 4: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)={0xaa}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) fchmodat(0xffffffffffffffff, &(0x7f0000012000)='./file0\x00', 0x0) r1 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12, 0x0, @tid}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r1, 0x15) ioctl$UFFDIO_ZEROPAGE(r0, 0x8010aa02, &(0x7f00000c1000-0x10)={&(0x7f0000011000/0x3000)=nil, 0x3000}) 2018/02/01 16:23:16 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) unshare(0x8000400) mq_open(&(0x7f000004b000)='/$cgrouplo\x00', 0xfffffffffffffffe, 0x0, &(0x7f000004b000)={0x3, 0x7, 0x3}) unshare(0xc000000) sync() 2018/02/01 16:23:16 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x5, 0x78, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, @perf_bp={&(0x7f0000000000), 0x1}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) getresuid(&(0x7f0000000000), &(0x7f0000a1d000-0x4), &(0x7f0000896000-0x4)) 2018/02/01 16:23:17 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndseq(&(0x7f00007aa000)='/dev/snd/seq\x00', 0x0, 0x7) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000069000-0xb0)={{0x80}, 'port0\x00', 0xc3, 0x80003}) openat$sequencer2(0xffffffffffffff9c, &(0x7f000010e000)='/dev/sequencer2\x00', 0x3, 0x0) poll(&(0x7f000032a000)=[{r0}], 0x1, 0x0) 2018/02/01 16:23:17 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000009000-0x30)={0x4c, 0x0, &(0x7f0000452000-0x4c)=[@transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f0000b5b000-0x50)=[@ptr={0x70742a85, 0x1, &(0x7f00003df000), 0x1}], &(0x7f0000788000-0x20)=[0x0, 0x28]}, 0x1000}}], 0x0, 0x0, &(0x7f0000009000)}) [ 242.695921] device gre0 entered promiscuous mode 2018/02/01 16:23:17 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x5, 0x78, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, @perf_bp={&(0x7f0000000000), 0x1}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) getresuid(&(0x7f0000000000), &(0x7f0000a1d000-0x4), &(0x7f0000896000-0x4)) 2018/02/01 16:23:17 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000009000-0x30)={0x4c, 0x0, &(0x7f0000452000-0x4c)=[@transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f0000b5b000-0x50)=[@ptr={0x70742a85, 0x1, &(0x7f00003df000), 0x1}], &(0x7f0000788000-0x20)=[0x0, 0x28]}, 0x1000}}], 0x0, 0x0, &(0x7f0000009000)}) [ 242.727143] SELinux: failed to load policy 2018/02/01 16:23:17 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x0, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000009000-0x30)={0x4c, 0x0, &(0x7f0000452000-0x4c)=[@transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f0000b5b000-0x50)=[@ptr={0x70742a85, 0x1, &(0x7f00003df000), 0x1}], &(0x7f0000788000-0x20)=[0x0, 0x28]}, 0x1000}}], 0x0, 0x0, &(0x7f0000009000)}) 2018/02/01 16:23:17 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$selinux_load(0xffffffffffffff9c, &(0x7f0000160000)='/selinux/load\x00', 0x2, 0x0) r1 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f000086c000)='/selinux/policy\x00', 0x0, 0x0) sendfile(r0, r1, &(0x7f00005b3000), 0x1b4) 2018/02/01 16:23:17 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x802, 0x0) sendto$inet6(r0, &(0x7f00004d5000-0x1000)="dfe278d84f047e1808a3a992ddc389ae510e72c21d071d767c92f5a76aabd0152fcbd05c4db7f4e5e729497dfc375f1a021a5b1fd8ea7d7047775b8daf66303ddae94f4cc9d10f0e4bd21802c30927bf91de19baad5d68d29e6c0265b15278bc3a26defe99b129cae1e0377939e119e495cb84900b82d2c0689fd8d30bcd08437ed371f99c2b1cb8434a8ed7a106d463883ccdd36f76022dd29c59311fd01f26dc7cb7bb2578798d919b871cbb90dda4fccbca8d521c0c9c95c6278cad91c144f5079d7aa44b35c54465cb314586eae1b2afb0d94912bea757906d494c2e049598bae15d4a1b6892ed414e4ca5448a7e457350859333529825a60e93889fece46d4917cb7b429852148679694cbbb5d71bd8c81da130daf7387dc095c6ea85a19f5c62434a0b42723ae95420971a2edaa24f04e1c558283be5b08d1903dd2aa5b55ff876b7df8ad497a163fc1667bf677560acc9bdc58fd2190ceb7ee16969f2b7924651b5256b83fa8cee4a85b601371092d883db7c63cc060f80cc96a47d90dfc06ebf61665b68ab6c40e701325f2ad65b98bbc038fc1f70c5cec0ef6de84b30f331304e18333bf6018ab00b454771618a74cdcb90bae013843a586b8da3f26fc134faea8f02f500ccfc8d8e056bfe8154a816b1c836d2f0345fe72801be88a7bf12b5b70f3fca631f4f27ade17670201ca78090a2ce78f7660b62d6b1ae74b433a537ec8972cd75ed3aef141e6e274274ceed44bdcd0b8da06e8862dfb649d39a860042261fc9ab949991711eac9264633a7f15ff272779b3015c402e43e63fa3cbb3baaffe971b739673c5313ef74a7c2a480a7302734a607e1cd559189f4aee38fbcd3bde9776c29fc8426b18bb0029546358d39ce716f03359f656cb3103e1ef253bd0614af54f8d7d03f6bf80ab3ae047aadfd7a3e006f9f04e326f391426a8618dcf4747f189c892ca162d7a2949aedf8eb6ead2a7f8673c03830282983f880d7ff55b9bc04afd7439857238bef451407dbd506b94d8a0085a9649e9d2f24d4442ce81791d7f0b00eefc6547c57493812cb93d1166bd506ff8cd0852edd7d8ccf90a2f5f137e82c7f2b356ab3f7fc0f854f82608949d79e780d563642ee0ee73397a83117059d2b30f4dc169f98474d01200cd765918dde6c075b3444d46c0859a7d921469c7ffa6a1caac885a8f285fe70c48233d29061f13b216ac406247a68aa3c516fac4cacbd78a303377130cd92ba8331614365765b2c80cb717626c9f6e9b45d6d16b10ca7325316e8107c2b57d630b46fb8369905a2e9b75e0a3b0972634b46e44430310580e9ae49ac0f065261ca26053dc08aafb3308e40d709a6404fa39e45e9643edf205ba121470c36389e3c161ab41179418b71652f92cb4b3a6d925fcd7d5c0a13ab9c020446aae0e7d3eedf23fec3ffa6ed748953bf7a5e19960f43313f16e5bb43f3e6adc62a5a45db3ea43e44ed6ee5596a6c66c747aab8757ee26d5912a07edecd4e4b9d6f6a03c6f4d7445d041fab5cdd668280b392be052ca3095a8408ac836e6d361f5c7512768f6897b7529d658503f61bcffc714e95adabd1178191b3d82d959200e508c6358af53b7684d2cab8ed404cdfd134e004a71deaaaec8c9835e5a711b51e1829f96c2be8ad2c851f8b70c70114cbb7d647cfb26ba91f62ec29925e6f10aebbb0a28a7ffcfc360d86a70ade4d3d2bbbea005b41823f2a54b1513ee080e62d3f337a0e250d592ef3a43be37bef30496fe34eb2eb7b038bf1a8ad837c18cd9745e937d7c0503d1c50ed4a9f3d446eccc3cddc586df7c077e09119b5172dee9d6349783329c2c7a2d71dfb7c2d7aa656f2599b84fab8ee1c21073c7cf64babeb4f768d8c283ff7599849e36d5a7d7071b396fbde96af351d02ff61b159bddbb8d66e51d6431eee6173857d089d4ab3ac1c05b57c80a08fe3d1c89aefb7fe07df71b0d0f636e5b8a609af0a1e708390f828907e7691fad891c5d7a6cf7cd8842ce264ecdc1caf78795883e37a3a8b7dbd67cff31ab2c868a79691c", 0x5ad, 0x0, &(0x7f0000089000)={0xa, 0x3, 0x0, @remote={0xfe, 0x80, [], 0xffffffffffffffff, 0xbb}}, 0x1c) socketpair$unix(0x1, 0x2000000005, 0x0, &(0x7f000004e000-0x8)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_ifreq(r1, 0x8937, &(0x7f0000abc000)={@syzn={0x73, 0x79, 0x7a, 0x0}, @ifru_mtu=0x1}) 2018/02/01 16:23:17 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) prctl$seccomp(0x16, 0x2, &(0x7f000051c000)={0x2, &(0x7f0000310000)=[{}, {0xfff}]}) 2018/02/01 16:23:17 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x2, &(0x7f0000691000-0x4)=0x79, 0x4) bind$inet(r0, &(0x7f0000887000-0x10)={0x2, 0x3, @broadcast=0xffffffff}, 0x10) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000cd5000-0x4), 0x4) readv(r0, &(0x7f00007d7000-0x50)=[{&(0x7f0000b7e000)=""/4096, 0x1000}], 0x1) 2018/02/01 16:23:17 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x5, 0x78, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, @perf_bp={&(0x7f0000000000), 0x1}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) getresuid(&(0x7f0000000000), &(0x7f0000a1d000-0x4), &(0x7f0000896000-0x4)) 2018/02/01 16:23:17 executing program 4: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)={0xaa}) fchmodat(0xffffffffffffffff, &(0x7f0000012000)='./file0\x00', 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r1 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12, 0x0, @tid}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r1, 0x15) ioctl$UFFDIO_ZEROPAGE(r0, 0x8010aa02, &(0x7f00000c1000-0x10)={&(0x7f0000011000/0x3000)=nil, 0x3000}) 2018/02/01 16:23:17 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f00002df000)={&(0x7f0000c0b000)={0x10}, 0xc, &(0x7f0000823000)={&(0x7f0000bc4000-0x150)=@delpolicy={0x5c, 0x14, 0x801, 0xffffffffffffffff, 0xffffffffffffffff, {{@in=@multicast1=0xe0000001, @in=@multicast1=0xe0000001}}, [@policy_type={0xc, 0x10}]}, 0x5c}, 0x1}, 0x0) 2018/02/01 16:23:17 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r0, &(0x7f00001ee000-0x10)={0x2, 0x0, @multicast1=0xe0000001}, 0x10) connect$inet(r0, &(0x7f0000561000)={0x2, 0xffffffffffffffff, @local={0xac, 0x14, 0x0, 0xaa}}, 0x10) sendto$inet(r0, &(0x7f0000c96000-0x3), 0x0, 0x8000, &(0x7f000057c000-0x10)={0x2, 0x0, @multicast1=0xe0000001}, 0x10) sendto$inet(r0, &(0x7f0000e77000-0x1000)="18631ccc129cfe6da87b432660521bda2cfa08561e1daa4de85af3298223e83f37926ae556dd4a7a25f1a7b54208b3c12ae701b74daf6c7e9ec726930f1893953fc43d7c63050e359e8ada93a455fa265b578a5f92b7fc5698f55d554653f0ced1f85c3735bd21bca77d7d9ba3458472926ed49515628bd9c3b940a33cc1bc77ea3a584afc89539a7417791023ff8ca33799b374e760179e5b39b74997e096128c12a6dda762f27df4b0f2b39eb1736b5ae773592489f2f5fd86c1910d414735c23f2aa2053c06fd076b126a9e3318158fb971e3a179206e0cfa842510d062585f2ed0433bd6f6c826706e26b1a1c7ab8aba4278978279bef2a074af9240ad01beb0b7d6d24c06ca3b93a11ec2dde0cd556f7f661fda8d4b52095312c1ad6e538d10ae71ce64181ca2ac7ebff633c940fceb8191e431014cc1ad60cbaedb15832025573e0d44dd1132df1a4e4094be90f9d743074178b4e239470e82745feaa4577ff19c9295d4366509a8118d9c2d7f407974af1818796aecfb780aae793f4f16dad688abad30ca0965ddc9764321505d6ef60bc519dc03a465534b66af52e4e70669ae4506107dc830ef124521097e9fcdadcc39a8eb7b41fb60b74583c5abdf384467d20a97dba87da9ece6628fdc4a2f781ab0780df2e2cffb318bff3013fe4a5b7ba50c0ce804e8102d41a6856364ef62ca72b815672074595b734d76fab41e26af3ccf2d39f4d49d2d3d1b117881792f068a7cac9782f2c8cbcf11023685ac781ff70f96b16d7eb956fe31aea3af7974f8385cf2fe9152baa7c2556e8bb7030b0dd1f0d21503af85de38a85532a75dfa0ce136703def956ade894ff2d7f415a355a33fe65c5e7c6e6fd58f39169e60d50fba3ce3bc9058322a3575dc6412aa5ecb8d62939e5c94b0ba12613a6a3618912437182bce9130f8ece10ad861159bea5911d44f7a8d7ef8f7a160d6ae3b7165fb66425ca9732686356636efdb77fc05e28a5a6493f9bf9703fcc9f5571ab3ce59ca5ee35a94e821e6ada2da7916a37a74a30313820a5cdf1f3017a268acb2bf42dcbcaa6722bb31a70dd8b812760bcd092c65360a171227f80de6b8d1e127774b392fc52bc0b565ab6f8450d3b7ab1c3543917ab303955d66fee82791eff78f1a98177ea3acf2a4c926618a0dd180bcafce2f24196fff796c498900f945f97ba2904aafc4b5775e171ee5aa13e35f34cd58e700abd191b42dbb6a1d4847747bc330318b3865b18e301d44e3c6274dd2a374d25885680f18295efeb6d94f943b43fc8fae544cbc5f5e9528e45b8f8e579f6815295eaeab7f3980a09bd13858a22cd2c5b788c29c016d578b052e2d2c0ef7913a78c2b21b3713d293b62f54ecab1efb03c4518e71c9457c3c190c31f13b7a06fa28ecc071b29829cef338e80dae408d7f06b8e75da745cf83fb8a6e16600549ed3a729811cd77c8165758e023d706b218e0780678ca6d7bd291980a268f4a55d00a6ea969a14c0efe619b032fc6ccae50845c82fec6e8662ffb25dc4a733426a500828bbc1fe570acc5eefd334a2f68e497448dc85becb9c084b5186ca9b872be84a39853a59c32305d2c8d1365bf4a047e829e995c843fbda0a3f4bf9373d2c6e2f9b71f088d61cbe793409b450aff67d0ead723b7da7ecd896ddc5ba10d34cfa4b203d19b9707eb5a8cb98a9a38d5d95219f41989088973778fe7dcad466cb8221504300bd6fd90a2a48e033cc93474f6091be4466c89aff8c8dab3b838808ea220e63e2cdba7b7a65025c315739232c9b91db85e93a2022f08d3d367c014dcfa9437df5548a6a53237fbd312c747a696ad991e4734adb8f1ce54e505616117abda379d7cc636712aab4cd88059a8382a9f57ca4f4eefe878773f7ea46ad0c2d28eb8621ef7000997a8d89c8d4ff1d00c223dbd642cbe29bf3bfaca3c77949eeeaf57b5c068d3729266dc8fb7e2e737e94458fefe1420830415d7a948a850c4b88218fc005b6c664f909a84d92c8a50698feb5be92feeebd8b813fd4a143a248040e9518f00637fc7cf6757fd3157e3935a2962e8ba7db2fe3eeb", 0x5c1, 0x0, &(0x7f0000bc9000-0x10)={0x2, 0xffffffffffffffff, @multicast1=0xe0000001}, 0x10) recvfrom$inet(r0, &(0x7f0000db1000)=""/109, 0xffffffffffffffb4, 0x0, &(0x7f0000798000-0x3)={0x2, 0xffffffffffffffff, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}}, 0xfffffffffffffe40) 2018/02/01 16:23:17 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x2, &(0x7f0000691000-0x4)=0x79, 0x4) bind$inet(r0, &(0x7f0000887000-0x10)={0x2, 0x3, @broadcast=0xffffffff}, 0x10) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000cd5000-0x4), 0x4) readv(r0, &(0x7f00007d7000-0x50)=[{&(0x7f0000b7e000)=""/4096, 0x1000}], 0x1) 2018/02/01 16:23:17 executing program 5: mmap(&(0x7f0000000000/0xe62000)=nil, 0xe62000, 0x1000004, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x2, 0x0) mmap(&(0x7f0000e6a000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) setsockopt$inet_int(r0, 0x0, 0x18, &(0x7f0000e6b000-0x4)=0x1, 0x4) bind$inet(r0, &(0x7f00007b3000)={0x2, 0x0, @loopback=0x7f000001}, 0x10) 2018/02/01 16:23:17 executing program 1: clone(0x0, &(0x7f0000b26000), &(0x7f0000eaa000-0x4), &(0x7f000039b000), &(0x7f0000bda000)) madvise(&(0x7f0000635000/0x4000)=nil, 0x4000, 0x0) 2018/02/01 16:23:17 executing program 4: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)={0xaa}) fchmodat(0xffffffffffffffff, &(0x7f0000012000)='./file0\x00', 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r1 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12, 0x0, @tid}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r1, 0x15) ioctl$UFFDIO_ZEROPAGE(r0, 0x8010aa02, &(0x7f00000c1000-0x10)={&(0x7f0000011000/0x3000)=nil, 0x3000}) [ 243.270255] binder_alloc: 746: binder_alloc_buf, no vma [ 243.297568] binder: 746:755 transaction failed 29189/-3, size 40-16 line 2903 2018/02/01 16:23:17 executing program 3: mmap(&(0x7f0000000000/0x13000)=nil, 0x13000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sg(&(0x7f0000001000)='/dev/sg#\x00', 0x0, 0x0) ioctl(r0, 0x2287, &(0x7f000000e000-0x1)) [ 243.327469] binder: undelivered TRANSACTION_ERROR: 29189 2018/02/01 16:23:17 executing program 2: mmap(&(0x7f0000000000/0xb4a000)=nil, 0xb4a000, 0x3, 0x32, 0xffffffffffffffff, 0x0) seccomp(0x1, 0x0, &(0x7f0000001000-0x10)={0x2, &(0x7f0000022000)=[{0x0, 0x0, 0x0, 0xffffffffffffffe0}, {0x16}]}) r0 = getpid() process_vm_writev(r0, &(0x7f0000b49000)=[{&(0x7f000008e000)=""/155, 0x9b}, {&(0x7f000091e000)=""/213, 0xd5}, {&(0x7f0000b49000)=""/157, 0x9d}, {&(0x7f0000b49000)=""/205, 0xcd}], 0x4, &(0x7f00007d1000-0x60)=[{&(0x7f0000b49000)=""/203, 0xcb}, {&(0x7f0000b49000)=""/240, 0xf0}, {&(0x7f00001c9000)=""/97, 0x61}], 0x3, 0x0) 2018/02/01 16:23:17 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x0, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000009000-0x30)={0x4c, 0x0, &(0x7f0000452000-0x4c)=[@transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f0000b5b000-0x50)=[@ptr={0x70742a85, 0x1, &(0x7f00003df000), 0x1}], &(0x7f0000788000-0x20)=[0x0, 0x28]}, 0x1000}}], 0x0, 0x0, &(0x7f0000009000)}) 2018/02/01 16:23:17 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f000004b000)={0x0}, &(0x7f0000d9f000)=0xc) r1 = syz_open_procfs(r0, &(0x7f0000ad9000)='attr/current\x00') sendfile(r1, r1, &(0x7f00006c7000), 0x2a) pread64(r1, &(0x7f00002e5000-0xef)=""/239, 0xef, 0x0) 2018/02/01 16:23:17 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x2, &(0x7f0000691000-0x4)=0x79, 0x4) bind$inet(r0, &(0x7f0000887000-0x10)={0x2, 0x3, @broadcast=0xffffffff}, 0x10) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000cd5000-0x4), 0x4) readv(r0, &(0x7f00007d7000-0x50)=[{&(0x7f0000b7e000)=""/4096, 0x1000}], 0x1) 2018/02/01 16:23:17 executing program 4: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)={0xaa}) fchmodat(0xffffffffffffffff, &(0x7f0000012000)='./file0\x00', 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r1 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12, 0x0, @tid}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r1, 0x15) ioctl$UFFDIO_ZEROPAGE(r0, 0x8010aa02, &(0x7f00000c1000-0x10)={&(0x7f0000011000/0x3000)=nil, 0x3000}) 2018/02/01 16:23:17 executing program 7: mmap(&(0x7f0000000000/0x16000)=nil, 0x16000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000016000-0xa)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCGETA(r0, 0x5405, &(0x7f000000f000-0x2)) 2018/02/01 16:23:17 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$tun(&(0x7f0000e9b000+0x18a)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000a5b000-0x28)={@common='gre0\x00', @ifru_names=@generic="4f54000cc0a1ed4f3a0a1fdc222073b5"}) r1 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8916, &(0x7f00007ff000)={@common='gre0\x00', @ifru_addrs={0x2, 0xffffffffffffffff, @local={0xac, 0x14, 0x0, 0xaa}}}) setsockopt$inet_mreqn(r1, 0x0, 0x23, &(0x7f0000939000-0xc)={@multicast1=0xe0000001, @local={0xac, 0x14, 0x0, 0xaa}}, 0xc) setsockopt$inet_mreqn(r1, 0x0, 0x25, &(0x7f0000dcd000-0xc)={@multicast1=0xe0000001, @local={0xac, 0x14, 0x0, 0xaa}}, 0xc) 2018/02/01 16:23:17 executing program 5: mmap(&(0x7f0000000000/0xdfb000)=nil, 0xdfb000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f00005d6000-0xd)={0x2, 0x0, @rand_addr}, 0x10) setsockopt$sock_void(r0, 0x1, 0x24, 0x0, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x200000000000a, &(0x7f0000dee000-0x4)=0x2, 0x4) sendto$inet(r0, &(0x7f0000de2000-0x1)='U', 0x1, 0x20008005, &(0x7f0000db5000-0x10)={0x2, 0x0, @loopback=0x7f000001}, 0x10) ioctl$sock_inet_SIOCGIFBRDADDR(r0, 0x8919, &(0x7f0000527000)={@common='tunl0\x00', @ifru_flags=0x4000}) setsockopt$sock_int(r0, 0x1, 0xa, &(0x7f0000df0000-0x4)=0xb, 0x4) r1 = accept4$inet6(0xffffffffffffff9c, &(0x7f0000df7000)={0x0, 0xffffffffffffffff, 0x0, @mcast1}, &(0x7f00006fb000)=0x1c, 0x80000) socketpair$inet_dccp(0x2, 0x6, 0x0, &(0x7f0000dfa000-0x8)={0x0, 0x0}) getsockopt$inet_dccp_buf(r2, 0x21, 0xd, &(0x7f0000cde000-0x49)=""/140, &(0x7f0000dfa000-0x4)=0x8c) getsockopt$inet_sctp_SCTP_GET_LOCAL_ADDRS(r0, 0x84, 0x6d, &(0x7f000020f000)={0x0, 0x8c, "bb1f3e1a5f4aa58504efbe6479b44542e760056906cfc7737ab2ddaba97ba566846fe3690a7c371f485fa5e153cd9eb36ddeaa107c1fb8affea6e9707f63111e4b80f7815a01ab8987d137cdb611184abd672bdee4d676c182d964786ceac528b685b43f0ccd95ff6908563a6fc1df9d856ed84edb90d172ccf224011d46e85d7310558c3e2b620f4eba9748"}, &(0x7f0000590000-0x4)=0x94) setsockopt$inet_sctp6_SCTP_CONTEXT(r1, 0x84, 0x11, &(0x7f0000df7000)={r3, 0x9}, 0x8) sendto$inet(r0, &(0x7f0000b0c000)="11a58fde7649496403db92ed306004b3d3cbfc195485c3b895d864ab91a3aebde4f70a917a91ec9612d004000a7b43a35bb73249ede41bf5c05ab608fb7b74ffd57f6e8e43cf9cb723fc0d8d8cabbbbae3a5fde8ad6f52d667c512596f50b9962aa2193688d872a7eeca57801742d74d39c4b003a5e292e077ed102e7999329aab95a3d96363505f76c86a6d2352dd8025207ae531701f1ce353d6b017eb64000000bc2e9f8b66fe4a8e64f0fc7a0aa55d4103e1d7d5b0dd5750071e9b3a786021678a86fcbb0b9f9364ec0f0310306fef9c21b3b20d8b44423b495299cea2c6f40c377a72534453ad7f5af27b1efb2514ace1f9a68cf205a9ddb8fd954e34bde3612e6e05686cf3b968a14bd3a356f7b8d20214c0f7a388ef5ea8d063c65f2aabff685e69f86b4a0b3697f8bfbfe66796f0489ad2e49bdbc1742941c28c88cb93e1f8ccc3db4782cdf9cbd797ddc8d7b1364da50ad48e081a38622280169eba5c6a3bf9b5f15bdf8a8b6483340a3297c31154905db209195c28f15d10153204fbe0586516c714ddc939e0eb68c73969e81fc6f215b476ddf3fcf1a604603360089dadba2779cfed9027ac163067fc0d7592ac8a013b907372a42b242405241ac1f63f85a52fff2d78b30e87a156b5cfa133dabc259bb027bec5eb8c8eb623e9776a13d3ce972a6769de8a78153f498084a244b0146b77be3d1cba7b02fe8906ed8a88f105c763d1772825b986d52823bf38b6f95eca494fd9c64497874b9f450bec65311493cc108b27611eaa6819305a3730d29368f25f7e816d60884a1e0271c3c786ad36391366ac3b65f04c148974f6973005c5ff73d6f0b3f7e44c65da7c4115c4ee543991e4ad26938384cafffffffc8f7e79aaf1b8ef37f627e3c7168ecda2cf224a491bea6129fcd954b88dbb2d29464931bcd5378041db67ddc70ee856ae09c1b26b9ada008a7d52bf1a160606865a29794f36b2a3811c66e9fe27af8fc8356374e37f3eca244367fb535dde71fae4683710761b89f18820d4f06065450c3d1f76fa26ef28320edf6c36480af14f4444edb40ebb3f8ea264486ec31c40c7f0007a69c24da10db6f60da3e648f16b5fc6b5a5c6217e46c1f3ff354a8b49beb3b46a69dcb4c5d547a7b7ba8fe22da0173f9fe80f4bd47afbec4d2e0d3c91b1a326d8bb9fded873e87f847032af52bd6d129f3ce3f11ea9d0b4250af7eaa2649d9972b9b8dc773c869b3a431eac7f55d6bb92dc29f08d7d8959e2af7571efb7ec88eac4b62850e8f6b60d4a5d06d66875b4bd260a9014a2eb88621f4c6eb3f9ed2190b48acf0358d8b82fb4794535fcb8dd50ba86d23d230a94f07a768142ff3b4c8558dac21726b6279980c238041f26e86c8e3fa83028345999464e3e37d610ab7c15daaffb744a505a3dd9802b3721f29553ee23e1cf376f12cc3fe6b7ac76bd13da44356855be096155e355c9cad31fcdeedc6679c531bc1a2765dc8777108ec5e31d793005e718a9ced77d6505e44f649128a29f5264fecba132f9f5016eaf690751edd64d903b36ceb2b08042c60e9e97f8bc985476e6088a5ebd3743c2358171b30b16d730a5dd49c92fa19cc267e2c1927f200fc3d23a804f0a12b06a6a88a2685051ab28f1721209ada2c14b557a49423795b07040d510bb21ce5d15acedd18cb7cb7a93389ceb934206e4ffb220048a7a82fb3c251d0a31ba5af9eb0c16e29f33f9d0a78f5e6300cf04d17eb5f67711cafa0d4e99eeaf0f8fdbd34170318879a0d12c01891127ba7b677d204268524c5af1d7dc27176826302e34f9d35d2f2eefad5f22f68929d3456c11d5f00d4a8ce8b784bca8088805731eff2d47024c2da68abc2d2c0f7806d7d76cdf489f3bffa75cb826bc0809331d89a3255a498b8150d4ae31d03414ab244939455b6377c2917cb2d8a9f9ebf282657e417860e49ac94f4a838aefd34f28960a78da47933252d8cb2fdb27d413ee54502cd1bf75585468b77b8dca627cab29ef0a5297ee3dcb4c987520804e9a5f45e8241019281bab7e30f4b008bf0edf3b6fb5e8d1c2ab619b2eb84293d636a6a37d716cd8e102b7099676693cb7b01031b57ee93fd22cb18229893fd4d4ef87f1596879ac9f61b2f0c35be34cb6e6f75087ff963c188d43bcb464a95e956e75559eb1f6f2224fb2ca8f0bdc90ae5c2ce712498ee4026b13b8f3137000aa1545a75e5b48e80da30e6dac5529cac1099244e79ad542f45dcfbf16c62b5eb63daee8185c5e79ebfa1ca60880f9e2895f54ab95bbae38ae62200c1e439d73fa63d0bff75935a8ad2ae73b82132e8d4eb4bd55844b2f55c65d5ffa0c65aaf0cc5bc73925d05cf7c1c4383af074feb3a53919d2a3b5bef96115aab966821dbfc4577d19d85911a485c58a5b87cf44d230cfdc255486bb09d5c16f2164397f0fc5f652a171f0269bdcd98291410c010cc377d2690a6032fe5701117adbd0f6b847c9617a9b3d20529024d8d9749b9c49827694d346d3b1bbe434122331986b9f6e84430dfd75d123f3e307d6f5514f3da09b527408bfb6816da54beeefad160e4b095517f3292c2e17fb3bba47527671d0afe7c35d54d25ab307b15d069a05395a9cddd4b519224fe3c689d14827ede6d91ebace2a80afaad3dcd1f8ce20e92012b8934d7ff3ebdd285cc24202a86d70b96674a6af05a3c29065afa4e38b9c34006cb3eb9c87985cfc511a8c261cdeb0c7a3c7a682c40c5b9f1d7d5ef6f97e32d02fdd3f2ded413f4a36c4db899b96c8e40d91c2743cd1d435013e3c3431c82fc5b3345b66cce79fa49f10baa4ef28535eee8c5c1a4b38bace2fb14ec11d34d620b1cc2396dc1fa857ac6ac9f5689b5935f2f25184edd40f8f5c70714f941beae3e1bc9af757edd9d68fb24218e2a02aad4dc0b3c2e5ff94ce547f358f38e52673473fd0e57497978324aee16559e9cdbe5b3a0b96dd69fe5bc97e644487274b6158a0412bd60172bb66f774b8eae7bc1f52ed64d44c553bdc26823e35f18683554e7359802173d1fa86a66104abb1977c3e9fa6970ed7ee483b14b65673a81786fe0ed301f8edb0669fd25bfa0d565e3e93b19b8572c98dbacb103053527a95ee758be002e13df756bbc486def0db079124db72fadc26f0a26b42e21f260f902bb4cd881baae57eff1c3cc15063be17e48208b9a69622adfc03991d204fe0f5ae2528b22c7743f97e0669a1c3c0d0d90f39846fd954d681be0265d14b12285fb1b20bcbaa95915ad51ab8f84094674cbac0071021b261c39a46b0177b98f1662100ef31a3e981236d51e6c1429144a89d46b149301873ef99959f8ab15c12309620d5d548b62ff92233a3f200e0d0a9c2122be615dd91e6a6cd89290d24895540635fead9a56f481ee3fd7890852e271fa7c37b1836a3e1764574960e1ab9fda1d25693cfc33defea84f65c08cce479c66dc16b28d453a1b717fdd9f6ff46b1fa1b6866b4a8c1ad53439c5958403953b3a844b660b28b11d427b392a7c710edbf25725a65e6b94e4c64ae458a8c97c9f7a05a7d8ebf6c76e3afc0204ced97be84986da5403ef31eff1790c039fe00a89976ccab7638d2e217fc64609a41f3a008ed78b25d1a9420b782deef6ce2db0c6d427580087b69c75c1357ed2908c32cffee1c6ddd08510562ab015507a4eb4f54ae5c097cdca34f521f9fa8df7667645a696a472650c1ca9c035e95f34db54722897159c31dc6be5693a5f3871ccbb48a7ead233d03b76875590fa20bae4f37a2011622d0203a3e9d9e198cb075aba26f5e78a8f0b0cd27052527daf0f8e77858dbddec7038c198b868e93ae32f1745d166afed4129460e07af8cb6c3debb6503e87f3cb309e39ed3d682d24adec48ea22702c4d8d48386977a89b73e585f8c2c5fcb0a693cd5028a601b04b833a41ec705735c767c70d316b60aba2da24bd6523533f3180accade90f47e412b393ee1d2456cf8bb430289ddb824350764985c5e35f738f830a378bfa65fd167c7307c13acb912beefa69e499d4a750e820a7af08a7c204ffb64e09fcc921a4e79999757d608880bfd52255bbc16369af4f779edfd9439cfcd17fcc02d5aaa81bac66fa2e551cef55779bd90e8be587ee698575918fced59ec652af26718b3afd1471379132ba0b5143a78f84605b1ef51e49e820a8a8c1639f66bca5afd83602287e982eb125a3a032e4cc5b5be91ab4d8d958fd4dc4cbd310eddc91d89ada4d33fcc963d259e222520281d14e13577906e33665a31afa7cb501cc0c1198d1f755005e82f29bcda62bbf8680bc23d09cac6a8c89709b30c91d27ea148f01ba745346f1ba9ce89cd9b71ff18668a0254c07479762dbb78117c50450506e2a0a606309aa383ec55a49d2569c3a3fef8aad456aa81cb859519765de18a4b92194e8a6a43f1dade801f71eb56699bc021fa48f320f4128d6c153a2ec1fba1c5ca55c5058641692365d311c8902aaf1428d83281aa970af5d98591cd3af30fbb5ee4a1b697491ff6dd727a329feb17b782f254d691f949baf96afa195c62f2c3fd1855a79b25268cef9822e3c6a1b3aa226ec494b070a8774426a5f8877714fe206e569635805208ac7823c8546ec33e4482a85d6fddf86a37a1c60f0a19b5dfe88031b7541af0e93cac8a3bb1ff3e60190b96faedc3b6f63d38f3ee4286fbaa053e8e27ed13b77b2c576d824d777ca53df76d9572e71f74ff180778bf57458b37fe9dbaa6f9927b48b059e5c7fd908ac826aed8f68764285022f4b5cb6b73ef7222ecb0d701c782ed5c16a7c94235fe7c3e0bef9da7310c5f3cda407c5ae7ecfb6b392ad576610b48af17b3fc8a2fd6cd2eee1153cc48a21ba6768a88367a807be008bea547402da4c92c2006c83d74c9d0ef2ca711c54036c8e76ac26c7d22060c9bfc2e67f1d1c6f6bd2f751879295ee21fcf8588c9504cacb02fa3e3fc6e2bed352447a5c2677caba0538960357d6d1706adef5e7d4f6298ed4ecacb7776de15d9bbd672f9991f4bdc4f07401f67cf3a74c0495ea58d0f76a2e6060cecc1d04b93808dc8d61130305740b408359d5552cc23a7b1eff4285d563b4b6b011a4a11372a2bb01cbda724482f95c4487b02c85cc121012b3213041ff6a689072daa4d86a4c125b110f4e2eeed2dd73db0f94ce995896e0b8a9f8f3e9559024251a5b1726b0b3775bac9fabed968d2d4ea31bbdfb2910331d92cb4ff5cc9037cc08cd35f88c4d7b89e46a8cbd05e3c35732b5046b33060dce5372b171daa526a46c3444b331e71f0455fb8b43dc46e2c9f2c4effccf040e56de00000007b16de337f13e7a610feac2f336e75405a530815366e7edfbb429babfd0e68db56892b94621edd9df6ff454ab1dcdb8d39d282fa7932ec7ba5203df2f4196538a1fa040c8014d20ff57fdb8515325a6997b9b71f2094e053f126402a47e628eeb7d8f665fbabe8f1a409ca9c7c5c25baaa0e9945acf27e96f8241a445f7d3352494ba4210b348fa0ec11ea67dead4fc1e5e4f9202931386468882bee59f8d12174198142ef7764d6b930e937e20d018c0cc5a780490356f5521aac74d2c1736e20ae5e0cd8cf6676ac337e8a8976aac75a698e34e72bac561038f228c13b6e974bc21bb79618111db507f3ba314dd2d05fd050d684cf33d8da5f8e5f723a092098ac5b180a6579d543515c2e1d0eb502193aedab526d354b625990c7d5a9f90d86c4e374054f1d14270b603065293e7fa3840de575413b74bfbc4f8c139947ade9a6f48907053f1ae3a95c2", 0x1001, 0xc004, 0x0, 0x0) recvmsg(r0, &(0x7f0000df7000-0x38)={&(0x7f0000df7000-0x80)=@generic, 0x80, &(0x7f0000df5000)=[{&(0x7f0000df6000-0x92)=""/146, 0x92}, {&(0x7f0000df7000-0x8c)=""/140, 0x8c}, {&(0x7f0000df6000-0xe8)=""/232, 0xe8}, {&(0x7f000040a000-0x5e)=""/94, 0x5e}, {&(0x7f00007a8000-0xe7)=""/231, 0xe7}, {&(0x7f00009e3000)=""/230, 0xe6}, {&(0x7f0000923000)=""/37, 0x25}, {&(0x7f0000555000-0x31)=""/49, 0x31}], 0x8, &(0x7f0000c28000-0x7)=""/7, 0x7}, 0x0) [ 243.434044] audit: type=1326 audit(1517502197.724:171): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 pid=794 comm="syz-executor2" exe="/root/syz-executor2" sig=31 arch=c000003e syscall=202 compat=0 ip=0x453299 code=0xffff0000 [ 243.463499] binder_alloc: 796: binder_alloc_buf, no vma [ 243.463523] binder: 796:806 transaction failed 29189/-3, size 40-16 line 2903 2018/02/01 16:23:17 executing program 4: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) fchmodat(0xffffffffffffffff, &(0x7f0000012000)='./file0\x00', 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r1 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12, 0x0, @tid}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r1, 0x15) ioctl$UFFDIO_ZEROPAGE(r0, 0x8010aa02, &(0x7f00000c1000-0x10)={&(0x7f0000011000/0x3000)=nil, 0x3000}) 2018/02/01 16:23:17 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f00003cf000)={&(0x7f0000f4e000-0xc)={0x10}, 0xc, &(0x7f00005ad000)={&(0x7f000044d000-0x204)=@migrate={0xac, 0x21, 0x1, 0xffffffffffffffff, 0xffffffffffffffff, {{@in6=@remote={0xfe, 0x80, [], 0xffffffffffffffff, 0xbb}, @in6=@mcast1={0xff, 0x1, [], 0x1}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xa}}, [@migrate={0x5c, 0x11, [{@in=@dev={0xac, 0x14}, @in6=@mcast1={0xff, 0x1, [], 0x1}}, {@in6=@loopback={0x0, 0x1}, @in=@multicast1=0xe0000001}]}]}, 0xac}, 0x1}, 0x0) 2018/02/01 16:23:17 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x2, &(0x7f0000691000-0x4)=0x79, 0x4) bind$inet(r0, &(0x7f0000887000-0x10)={0x2, 0x3, @broadcast=0xffffffff}, 0x10) sendto$inet(r0, &(0x7f0000d5a000-0x73), 0xfffffc6c, 0x20000804, &(0x7f0000e1e000)={0x2, 0x3, @loopback=0x7f000001}, 0x10) readv(r0, &(0x7f00007d7000-0x50)=[{&(0x7f0000b7e000)=""/4096, 0x1000}], 0x1) 2018/02/01 16:23:17 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000066000-0x38)={&(0x7f0000c25000)={0x10}, 0xc, &(0x7f0000e2a000)={&(0x7f00006fa000)={0x14, 0x0, 0x0, 0x6, 0xffffffffffffffff, 0xffffffffffffffff, {}, []}, 0x14}, 0x1}, 0x0) 2018/02/01 16:23:17 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x0, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000009000-0x30)={0x4c, 0x0, &(0x7f0000452000-0x4c)=[@transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f0000b5b000-0x50)=[@ptr={0x70742a85, 0x1, &(0x7f00003df000), 0x1}], &(0x7f0000788000-0x20)=[0x0, 0x28]}, 0x1000}}], 0x0, 0x0, &(0x7f0000009000)}) 2018/02/01 16:23:17 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000fd6000-0x8)='./file0\x00', 0x0) mount(&(0x7f00004ba000)='./file0\x00', &(0x7f000021d000-0x8)='./file0\x00', &(0x7f000015e000)='ramfs\x00', 0x0, &(0x7f000000a000)) chdir(&(0x7f00002d7000)='./file0\x00') umount2(&(0x7f0000f66000)='.', 0x2) mount(&(0x7f0000071000-0x1)='.', &(0x7f0000b35000-0x1)='.', &(0x7f00009b2000)='coda\x00', 0x28, &(0x7f00005cb000-0x1000)) 2018/02/01 16:23:17 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x2, &(0x7f0000ed4000)=0x7b, 0x4) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x3, @broadcast=0xffffffff}, 0x10) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000d26000)={0x1, &(0x7f0000818000)=[{0x6, 0x0, 0x0, 0x8}]}, 0x10) sendto$inet(r0, &(0x7f0000080000), 0x0, 0x200007ff, &(0x7f0000deb000-0x10)={0x2, 0x3, @empty}, 0x10) r1 = syz_open_procfs(0x0, &(0x7f00005f3000)='net/ip_tables_targets\x00') sendfile(r0, r1, 0x0, 0x2fc) 2018/02/01 16:23:17 executing program 5: clone(0x0, &(0x7f0000b26000), &(0x7f0000eaa000-0x4), &(0x7f000039b000), &(0x7f0000bda000)) splice(0xffffffffffffffff, &(0x7f0000bb7000), 0xffffffffffffffff, &(0x7f000005d000), 0x0, 0x0) [ 243.475750] binder: undelivered TRANSACTION_ERROR: 29189 [ 243.500766] audit: type=1326 audit(1517502197.791:172): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 pid=794 comm="syz-executor2" exe="/root/syz-executor2" sig=31 arch=c000003e syscall=202 compat=0 ip=0x453299 code=0xffff0000 2018/02/01 16:23:17 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f000066d000-0xa)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETA(r0, 0x5402, &(0x7f0000a7f000)={0x40000000000013}) 2018/02/01 16:23:17 executing program 4: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) fchmodat(0xffffffffffffffff, &(0x7f0000012000)='./file0\x00', 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r1 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12, 0x0, @tid}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r1, 0x15) ioctl$UFFDIO_ZEROPAGE(r0, 0x8010aa02, &(0x7f00000c1000-0x10)={&(0x7f0000011000/0x3000)=nil, 0x3000}) 2018/02/01 16:23:17 executing program 7: mmap(&(0x7f0000000000/0x8000)=nil, 0x8000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000005000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000009000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x0, 0x12, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_THREAD_EXIT(r1, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000006000-0x2c)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f0000008000-0x1)}) 2018/02/01 16:23:17 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x2, &(0x7f0000691000-0x4)=0x79, 0x4) bind$inet(r0, &(0x7f0000887000-0x10)={0x2, 0x3, @broadcast=0xffffffff}, 0x10) sendto$inet(r0, &(0x7f0000d5a000-0x73), 0xfffffc6c, 0x20000804, &(0x7f0000e1e000)={0x2, 0x3, @loopback=0x7f000001}, 0x10) readv(r0, &(0x7f00007d7000-0x50)=[{&(0x7f0000b7e000)=""/4096, 0x1000}], 0x1) 2018/02/01 16:23:17 executing program 5: clock_getres(0xfffffffffffffbfb, &(0x7f00007ef000)) [ 243.554341] binder_alloc: 815: binder_alloc_buf, no vma [ 243.572481] binder: 815:820 transaction failed 29189/-3, size 40-16 line 2903 2018/02/01 16:23:17 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndseq(&(0x7f000061a000-0xd)='/dev/snd/seq\x00', 0x0, 0x80001) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f00003bc000-0xc)) epoll_ctl$EPOLL_CTL_MOD(r1, 0x3, r0, &(0x7f0000abf000-0xc)={0x6}) 2018/02/01 16:23:17 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2000000802, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000f68000)={@loopback={0x0, 0x1}, 0x800, 0x0, 0xff, 0x1}, 0x20) setsockopt$inet6_int(r0, 0x29, 0x21, &(0x7f000089b000)=0xffffffffffffffff, 0x4) connect$inet6(r0, &(0x7f000000d000-0x1c)={0xa, 0xffffffffffffffff, 0x807, @empty}, 0x1c) sendmmsg(r0, &(0x7f0000ad9000)=[{{0x0, 0x0, &(0x7f0000bff000)=[], 0x0, &(0x7f0000cc4000-0x18)=[{0x10}], 0x10}}], 0x1, 0x0) [ 243.595884] binder: BINDER_SET_CONTEXT_MGR already set 2018/02/01 16:23:17 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$evdev(&(0x7f000000e000-0x12)='/dev/input/event#\x00', 0x0, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f00002a7000)) epoll_ctl$EPOLL_CTL_MOD(r1, 0x3, r0, &(0x7f0000a01000)) 2018/02/01 16:23:17 executing program 4: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) fchmodat(0xffffffffffffffff, &(0x7f0000012000)='./file0\x00', 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r1 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12, 0x0, @tid}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r1, 0x15) ioctl$UFFDIO_ZEROPAGE(r0, 0x8010aa02, &(0x7f00000c1000-0x10)={&(0x7f0000011000/0x3000)=nil, 0x3000}) [ 243.595894] binder: 838:839 ioctl 40046207 0 returned -16 [ 243.596090] binder_alloc: 815: binder_alloc_buf, no vma [ 243.596111] binder: 838:839 transaction failed 29189/-3, size 0-0 line 2903 [ 243.598160] binder_alloc: binder_alloc_mmap_handler: 838 20002000-20003000 already mapped failed -16 [ 243.599091] binder: BINDER_SET_CONTEXT_MGR already set [ 243.599100] binder: 838:840 ioctl 40046207 0 returned -16 [ 243.604718] binder_alloc: 815: binder_alloc_buf, no vma [ 243.604741] binder: 838:840 transaction failed 29189/-3, size 0-0 line 2903 [ 243.622644] binder: undelivered TRANSACTION_ERROR: 29189 [ 243.622805] binder: undelivered TRANSACTION_ERROR: 29189 2018/02/01 16:23:18 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) accept$unix(0xffffffffffffffff, &(0x7f00006c9000)=@file={0x0, ""/108}, &(0x7f00005ed000-0x4)=0x6e) r0 = socket(0x17, 0x0, 0x4e00) accept4$inet6(r0, 0x0, &(0x7f0000966000), 0x803) openat$selinux_access(0xffffffffffffff9c, &(0x7f0000378000)='/selinux/access\x00', 0x2, 0x0) accept$inet(0xffffffffffffffff, 0x0, &(0x7f0000e71000-0x4)) openat$selinux_context(0xffffffffffffff9c, &(0x7f0000e03000)='/selinux/context\x00', 0x2, 0x0) accept$llc(0xffffffffffffffff, 0x0, &(0x7f0000500000)) socketpair$inet_sctp(0x2, 0x1, 0x84, &(0x7f0000638000)) socket$netlink(0x10, 0x3, 0xf) eventfd(0x3) gettid() getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffff9c, 0x29, 0x22, &(0x7f0000428000)={{{@in6=@dev, @in=@remote}}, {{@in6=@remote}, 0x0, @in=@local}}, &(0x7f0000440000)=0xe8) getgroups(0x1, &(0x7f0000b36000-0xc)=[0xffffffffffffffff]) socket(0x11, 0x6, 0x0) openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000322000-0x11)='/selinux/enforce\x00', 0x80000, 0x0) accept$ax25(0xffffffffffffffff, &(0x7f000033d000), &(0x7f00009f4000-0x4)=0x10) openat$rfkill(0xffffffffffffff9c, &(0x7f00002d2000)='/dev/rfkill\x00', 0x1, 0x0) syz_open_dev$evdev(&(0x7f0000458000-0x12)='/dev/input/event#\x00', 0xda3, 0x4000) socketpair$inet_dccp(0x2, 0x6, 0x0, &(0x7f00003ab000-0x8)) syz_open_dev$sndtimer(&(0x7f000042e000-0xf)='/dev/snd/timer\x00', 0x0, 0x0) pipe(&(0x7f00007cb000-0x8)) 2018/02/01 16:23:18 executing program 1: clone(0x0, &(0x7f000075e000-0x69), &(0x7f00002ce000), &(0x7f00008de000-0x4), &(0x7f0000570000)) remap_file_pages(&(0x7f00007f4000/0x3000)=nil, 0x3000, 0x0, 0x0, 0x0) 2018/02/01 16:23:18 executing program 4: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)={0xaa}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) fchmodat(0xffffffffffffffff, &(0x7f0000012000)='./file0\x00', 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r1 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12, 0x0, @tid}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r1, 0x15) ioctl$UFFDIO_ZEROPAGE(r0, 0x8010aa02, &(0x7f00000c1000-0x10)={&(0x7f0000011000/0x3000)=nil, 0x3000}) 2018/02/01 16:23:18 executing program 7: mmap(&(0x7f0000000000/0xa2e000)=nil, 0xa2e000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0xffffffffffffffff, 0x0, @local={0xfe, 0x80, [], 0xffffffffffffffff, 0xaa}, 0x4}, 0x1c) connect$inet6(r0, &(0x7f0000000000)={0xa, 0xffffffffffffffff, 0x0, @remote={0xfe, 0x80, [], 0xffffffffffffffff, 0xbb}}, 0x1c) 2018/02/01 16:23:18 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f000000b000)={&(0x7f000000f000)={0x10}, 0xc, &(0x7f000063c000)={&(0x7f00004f3000-0x1dc)=@newsa={0x1bc, 0x10, 0x721, 0xffffffffffffffff, 0xffffffffffffffff, {{@in=@empty, @in=@rand_addr}, {@in=@broadcast=0xffffffff, 0xffffffffffffffff, 0x833}, @in6=@empty, {}, {}, {}, 0xffffffffffffffff, 0xffffffffffffffff, 0x200000000000002}, [@algo_auth_trunc={0xcc, 0x14, {{'sha1\x00'}, 0x400, 0x0, "938777e1092893c8c156e35f6cce6e2be93f15e4c1793d4d01de8f03880a547e10d9f2c2795657d50c005d7818dbae34c91612eae3cc5a187a396002d804e7706cc3d6e16913ac76efd084d767a9983f518d946b52adfd57ddcffc6a4eba10520d431e4c3150604beea9bc0d49c991e56eb694f69eff2cd7fe81d8e0ed00a510"}}]}, 0x1bc}, 0x1}, 0x0) 2018/02/01 16:23:18 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x2, &(0x7f0000691000-0x4)=0x79, 0x4) bind$inet(r0, &(0x7f0000887000-0x10)={0x2, 0x3, @broadcast=0xffffffff}, 0x10) sendto$inet(r0, &(0x7f0000d5a000-0x73), 0xfffffc6c, 0x20000804, &(0x7f0000e1e000)={0x2, 0x3, @loopback=0x7f000001}, 0x10) readv(r0, &(0x7f00007d7000-0x50)=[{&(0x7f0000b7e000)=""/4096, 0x1000}], 0x1) 2018/02/01 16:23:18 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) timer_gettime(0x0, &(0x7f0000fdc000)={{}, {0x0}}) rt_sigtimedwait(&(0x7f000083a000-0x8), 0x0, &(0x7f0000dd6000-0x10)={r0}, 0x8) 2018/02/01 16:23:18 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000009000-0x30)={0x4c, 0x0, &(0x7f0000452000-0x4c)=[@transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f0000b5b000-0x50)=[@ptr={0x70742a85, 0x1, &(0x7f00003df000), 0x1}], &(0x7f0000788000-0x20)=[0x0, 0x28]}, 0x1000}}], 0x0, 0x0, &(0x7f0000009000)}) 2018/02/01 16:23:18 executing program 4: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)={0xaa}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) fchmodat(0xffffffffffffffff, &(0x7f0000012000)='./file0\x00', 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r1 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12, 0x0, @tid}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r1, 0x15) ioctl$UFFDIO_ZEROPAGE(r0, 0x8010aa02, &(0x7f00000c1000-0x10)={&(0x7f0000011000/0x3000)=nil, 0x3000}) 2018/02/01 16:23:18 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket(0x20000000000000a, 0x2, 0x0) sendmsg(r0, &(0x7f0000bae000)={&(0x7f0000d44000)=@in6={0xa, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xffffffffffffffff, 0xbb}}, 0x1c, &(0x7f0000d17000-0x90)=[{&(0x7f0000a07000-0x1000)="ff30d888f522a0f4bf24a4ababaeb4b0f9bede3ea522f0784e9e6cef334e6f1446e0170aa9e6e3fb9689046981c0834780235d776dcae32a56f33073d2a93db42a2fa18dc7c2e2f0080632b1968df864175bcb1db78434b4117e313928028bed3e056bc2f97a862f924411e81d3e46b5f35b910a796a5e6741e291396620b432c41621b123875f66d141e98ea17fc748d01e9ed81d0e84298394a46e1c4eb6a902592cfa075cc80d0a607446d8fef48f4491e7a5fe29d7e41893618fecdffae4e4809ba9b90cac32a34f63b034f83dcd49cd9ce063d62eb7bce696e7b5d5339850a48b33f8167a40fc6987bcd2632f30db38b62c1780800b5a3b937e4928a1abf0af5f36d2a2557e8d4f753253e57b65dcf2c38ad72f27984113ff91e20c24be1c0361e2cf2e2563d3a96d6399cd73058f5c16126ead5c0a178424fdae0cd94931c6a1412ae93de8992d26cd0d1e41b3a6fe3ad938f471bfe292204097dbde92c36813bb11c0e483c082d8f3a8dab456f195f964392871fa5f55ae01122e179b2a2637f7a6f8b490d00adcd6664b8d4fdd7e720fcf5aeafdd66d586fa9614ed735f133351ca61732b592bffd47000cc0d8953f2bd32c30a40494a700819df3ee8d0f70350de73d684709ae83ff4927241ffbc03b9aaad2bc3525a9e1e24bb2bbf2eb0ab6a5563d36fd33fe4db3f76b884d7653713838ab88d2343567724e98e84eaba48c5705de97fac116c63510a723561e24a1cb9cc130dc2263c32805a05d784bbf94f58e0d7e2b273b8efc8073017ab0d990a85b26110fa12aff79ec2981c245aeb22d806f766497ade90374e8c4c8637698d06ba12c1467ce35548bac41e47f8730fcd9e831e4863ecbef4c8cd851a2a7b8de023832212d710c4217effa37089fa24a1c24088464be30c1957697be879ea5c189230b84017dae80a4ffb87e7e0c3ad1b24bf203081feefda1c56532000febb9515b29b0e6cbe8ffd2ed4ac6435838a6595cc2e9157cc53ec752e7491f19ea9f6c4f7e4bd84315a4b37beb3b41ace4c2fa11a3fd1eb34a61aa9383da91c428c52a7fc0cba1a21b9c6aa06de179715ace0145b5e8467b0d6667dddc7a3551a2b62ee9f62a5c5003a530f58ba4f1c7dead78cf64803fd397bc65d3ea2b152c236b2345ca64c10ef1633018c4a606e4d2a7229b227b975dfc63a81d05b97971c633ae8bcab1f815f611a420d974279a493a26e92f7c899a221bcff08834a70a5e5f23722a44e41820d7130aa8dbb38477e703660cdc8e900bd9b61d7f564e1b0e4fa7273b8da9626d3c9adfa75e60c9c88eff71bc38aacf8bcdc158a6b6b958452e43722e852349b7cadb3489ce46bc21ab9ed41cac89da73c3b328dfdfbfa792611754bc1798168ef456627d0e8117bfe254fc1f8927afa9603203586aae517c3fadf8e711558d5dabaf81c8740ec6e1cedd5c35528a9ee91ba82b780321a44487fea54a499047fcaa59556bebea6a5e8af4973100d9df504dcc551587652c61888034048a2921b6e26e21c5d535ccd279a85942fe620fc2e8cfb8653bfa781d0a52ab6e57b0fecf4afb916bb15d06c8cc1145868bc8be4a07b8c877f799c965e5fc56c652df4dc227bb2d69d4f43bffec6da19d517f7214a14b158559b5432dd20d1575ad068d0af80337e0c40500488ebf1d8cd23a9266e2255fa80ad5f89a33302c852407e0231679033c263dea541f177456b5c4ef380356b3852b75ff9a23e4d1f6491e951d8bb2ae5fe77f62f1af851fd820d6c8d8246aed2105ac26d848055f812107d62f4e60ea82d777e8222f8aa0fbef30448aff7115b4c983f980332a060d1c1d739ebb09f2f1bc5c5a4a9ee3c18e60c65586c4fd409f8a05d50acbd973e20a43ee8403c8b890563449ef5c992332223e73826176f2fb569a5e92fcf96924e3a07dab2c893c9adfac55461e500893b4d2be653627d80ba10200bcf7b60770e2dccc647bfc446c68be7777deb461d60526770928faa6587e0117a7223137055f6070d644b90fbb8c3e87eb506e30900c0b03f1b21608f15935cc33f61a89cf84e831a40a02fed3cfa51e33c01d5fa80fbe2afcf3060237e3309c49779241b83bcde5c64b0eff8e38b0ece69d89f0ad84da296fd3a83105ad028db298d6c1ac818244047304114c81ce74b4d8bac2982cf092a3f0a707a13b2fbd1766a1b9251f38e80e6634fae4fa85a4a51e0846b297f6913651e4e8d1b163eebb62f29fd826765549dc277a4e20a2c4b75fc8f9fc0ab9ed4fb60721233fa7b0889d54813487b09b1f32e33f66091d7b2c6f592ebcaf828a9953570240bb84f0dc44c39a5223fbcf68be8c93c4f60b618ab08ee70849c22c1931d012cbd19520fff712b8ebff27dc5a7849c07b8d4bd391507c7336686e2259a5fd1f4bb6045b913efbdc87410bdb4eec4481b94e5ffd99453ca014984332385dd279f56c990a032f16e3b1875c8051b8206fd62b1f2f88b7192f9237aee18612609458437cdebff4b2ff9eb412e422730b89f50bae4b1c71b66294e714e8262ad3ac1c227a68a8e40440e69f0d14a91df4e42ddf2683dd2edaf86ee90e71ec65", 0x72d}, {&(0x7f0000d2a000-0xc8)="dfb18672ecf6775e24de7ab13a18a24e59af39eeaffea09eaec7f4533d9b10ee0ebdcea0b8813b642b8c3e0ef54f1959dae9c80203913fee79f6ef24e73612d87939d4447afac37aa9d09f1038ef6044e83db676255bdb7de2377a35b5bf3cb822c2b95f1af8ac55836db5a8009456e0fb8a33f3f3584c7078772fa4b0c7ba2ae2f337f0438f4a0f4d43880169bacd40ac635900988187c9f5996f12fc07231058d4188abe8dbca2fe51599e19b0d1cef7b795fcb3e9d17c1f2eb2d432112686833d9c4db3899eba", 0xc8}, {&(0x7f0000720000-0x95)="a8949ba7029fb718ab94115b9a7b71ff48442a776b08245f3dc9f46cd18c215626c0f2b244354b6f4a2086e80160b8f1af3a3856d59d0dc7f8aad00a142ade34738db609ba50d66cff924231cf7aa800a6aeb08711eba27a5e397ac8efe5186396d4e9a31a956397bf47d419ed8882807bb67dd0e9a1cd6077042c3c7c0cd97f29ce3f4b5571cd98d74a2d1c452ebb6298ee1d2cc9", 0x95}, {&(0x7f0000f83000-0xa5)="f2fff0b725dc789062bea0903dae830ffda5089a286635984eae5ae4ebce50fd7c2595d3b7cfbe79add11e59738b460c4edc82e88e2b4d922edbca7ac08b85152b18f5b48f21d44097890821f817e9906ebbe8f15ff5789b738a9c443bd0622403c7629bb59294e6d5cf9bfd68b805ee7e9a5ee96ddbe38a0a5ceb88fcf93281609170f75864efcc02d097554f2372401e12ab97ac26381a589367a06472a6127fc7b7439b", 0xa5}], 0x4, &(0x7f0000c8e000-0x90)=[]}, 0x0) 2018/02/01 16:23:18 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_int(r0, 0x0, 0x12, &(0x7f00008f1000), 0x4) 2018/02/01 16:23:18 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = memfd_create(&(0x7f000003e000)='\'', 0x0) r1 = syz_open_dev$sndseq(&(0x7f0000042000)='/dev/snd/seq\x00', 0x0, 0x0) r2 = dup2(r1, r0) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r2, 0xc08c5332, &(0x7f0000001000)={0x0, 0x0, 0x0, "9ede7a8c5ae95ec8672c93340f643a664f13eeab65c0322901dc6bd36cde2c51f01b7f0b014f9f91eeb7c37c7240f476c8d753d000aa8faf8fb574dbcfa6dc4d"}) r3 = memfd_create(&(0x7f000003e000)='\t', 0x0) r4 = syz_open_dev$sndseq(&(0x7f000011c000)='/dev/snd/seq\x00', 0x0, 0x8000000000102) dup2(r4, r3) write$sndseq(r3, &(0x7f0000e70000-0x30)=[{0x1e, 0x0, 0x0, 0x3fd, @time, {}, {}, @note}], 0x30) r5 = memfd_create(&(0x7f00008f0000-0x1)='\t', 0x0) r6 = syz_open_dev$sndseq(&(0x7f000011c000)='/dev/snd/seq\x00', 0x0, 0x8000000000102) dup2(r6, r5) write$sndseq(r5, &(0x7f0000e70000-0x30)=[{0x1e, 0x0, 0x0, 0x3fd, @time, {}, {}, @note}], 0x30) [ 243.735323] binder: undelivered TRANSACTION_ERROR: 29189 2018/02/01 16:23:18 executing program 3: mmap(&(0x7f0000000000/0xffa000)=nil, 0xffa000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket(0xa, 0x2, 0x0) connect(r0, &(0x7f0000ff8000)=@ethernet={0x306, @local={[0xaa, 0xaa, 0xaa, 0xaa], 0x0}}, 0x10) 2018/02/01 16:23:18 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x2, &(0x7f0000691000-0x4)=0x79, 0x4) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000cd5000-0x4), 0x4) sendto$inet(r0, &(0x7f0000d5a000-0x73), 0xfffffc6c, 0x20000804, &(0x7f0000e1e000)={0x2, 0x3, @loopback=0x7f000001}, 0x10) readv(r0, &(0x7f00007d7000-0x50)=[{&(0x7f0000b7e000)=""/4096, 0x1000}], 0x1) 2018/02/01 16:23:18 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x1, 0x0) r1 = dup(r0) setsockopt$inet6_dccp_int(r1, 0x21, 0xb, &(0x7f000056f000)=0x4, 0x4) accept4$inet(r1, &(0x7f0000788000)={0x0, 0xffffffffffffffff, @loopback}, &(0x7f00002b1000-0x4)=0x10, 0x800) setsockopt$inet_tcp_int(r1, 0x6, 0x2, &(0x7f0000b10000)=0xc2, 0x6677bbc4) bind$inet(r0, &(0x7f0000310000-0x10)={0x2, 0x3, @multicast2=0xe0000002}, 0x10) setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x1a, &(0x7f0000e9c000-0x10)={0x1, &(0x7f0000f07000)=[{0x6, 0x0, 0x0, 0x101}]}, 0x10) connect$inet(r0, &(0x7f0000987000)={0x2, 0x3, @empty}, 0x10) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000fe2000-0xe8)={{{@in6=@local, @in=@broadcast, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@mcast1}, 0x0, @in6=@ipv4={[], [], @remote}}}, &(0x7f0000a0d000)=0xe8) lstat(&(0x7f0000725000-0x8)='./file0\x00', &(0x7f0000dbe000-0x44)) ioctl$sock_inet6_SIOCDELRT(r1, 0x890c, &(0x7f0000f7f000)={@mcast1={0xff, 0x1, [], 0x1}, @loopback={0x0, 0x1}, @remote={0xfe, 0x80, [], 0xffffffffffffffff, 0xbb}, 0xf1, 0x401, 0x9, 0x500, 0x7, 0x200, r2}) sendmsg$nl_xfrm(r1, &(0x7f0000a24000-0x31)={&(0x7f00005b4000-0xc)={0x10}, 0xc, &(0x7f00008fd000-0x4)={&(0x7f00008d6000-0x1428)=@delpolicy={0xc48, 0x14, 0x100, 0x4, 0xffffffffffffffff, {{@in6=@ipv4={[], [0xff, 0xff], @broadcast=0xffffffff}, @in6=@mcast1={0xff, 0x1, [], 0x1}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x80, 0x0, 0xac}}, [@algo_comp={0xa6c, 0x3, {{'lzjh\x00'}, 0x5110, "45fd9a7f247300015a7891fef251b3d89754068a023c962a405be64d4b32adc55ca4b431dee78ed63735c64a901d90189120d688335c2b1c919f4b24a7cffa5fdb3ec10641b2ef1cbb0515b4e01c128f6413139709385618f1048c5fcbe67240e131c26c1236b8e0895d84fcfd69892b17a845bed7f305af940bfd6aa87f0f92251031284b4d958c7d78364f9f778e2fafa7908fadefb4e8839a8cf202e5516c4a617984a9edc371af04b9f45bc79fad683277c298bdaae16b61d99bdc08a936222ac2f76059662db62514448d07d48cdf7a8b1fef940415e836e24ca6524e3e2555f0c1e21b7e78a9d59123cb48ff08b3a61cc8ee1bad31763d26356334ea78da77ae8c5523dabbb660938f8a9e640fcf76357bb7d2f16cafdb4a29b536fba078d4303a7d9ea23a7f95c161fb58d7bd8b82b4be2b631f9940a0672de6a99c71e42114b1312eb2c1ad6750d29e74bdf02390e4d2274f081943cb97caeee258f7effb07fb5ec7ae75c78837cf58b0092d7aeb58098421a94425ef542b6726831200d17612d1cff60c676641ebba29cc4e3103c8225ffeee489ab028568c3be08d50f7b71eb5682aecf4b5d241a0426b73b37613d6fbabd9afcd3621a66ceae4a35568fadbdc0d3bc7808fe392a99ca79074b9d6bbf680d8e34cd40d02c1d89cf032ed121af190986d2cc48f5b527a94828374a60ae481d39ec6fbf6c8ca4a799bd69bfe5e50dfa6d755091051c79e5543b73a769cc15dac0e91c0c19759169e2805d7397627ccdfbb14b2727a5376e521a66ddf3e136147ba25f6a0898f36566f4e6ab0204c6c873c084a7c39f2af033922c68d988885a5725d7baa8649c12102edbd0f084627516391d4c98a1ba2baf04cf6850a37f4f1efd0aed58202067665d12e1d36f012f7e179ec3ae549f73f1532d759a96ffdeb88acb28be8bbb588a78df30a09d54e1aa94eb06508739eca45a1648ec0570c801cf180159d2812824ca575e2260db48b630c52321f0ff516fc4b9b26d2cfe2bccfd37dfa8b11b92fcda1a6e221098c0d565b8223ac7a4f084c97c27dbf0aa6781c07b9b69140a3e6dee3fdf94ff7a8f382a380f0518f69f7e2ce4d5d961cfbc111382fa4ed5a70d5786d7a32d7f6278b6234a5054f9e2da37ea290f7290a2ce2c7f1f7fe18cda1b40a77972fc15992d9f18fb71a6cd28e3e0a156b329f3cfa9dfd792f80e06edc27deb1d153e2bb62405bd2f00a3424add1f0782239c7db3794003edbfe7fc0174333c47d3002a8da2f7185910fd1dbdac401e885ec489a0fac3782e119218ee569233647898bd721be98effd84295c78a5ab3871c63158de685e74e57a53ebcc96ba40a85fed87068148a528506e4e313ffc38fd7e6647b7f8b153617d9a45920816cdc2aef8a1c6ef23351469b5b5dd0760d069c8411ff7d5a80683d9afe75bdd58434ee1322735926dd1dafa56d4ac179954f7d3f4fbd157c0b9c4265d3b740c4d4ac8293aa357c241a11bc14e8a0101493244362858ce0bd83741a7c6283b1ed66bb4abe9b9a29a0f8b805251936124387f1da113432c31a0ed867fe4b64c2914a614ca837fe2d1f3078a80477ec420df18276e14406771d11c9487634bc3d5d6c7b2996194baf2a8b3b15651f5a538e9a1a3bb4464f0955467251b9f073149136b98a638b5224cb482ff1a0cd0921f8ceac3df11107d931b139983ceeb7d7b9269487a0c58aa41f9333e6f96f5a6bce3b0c6b297e279f551f77bab5274c497112a55346f793e99729e8e47c79184a83aee276b1df58c4e9cd6c0fc246a3e859554da739e903aa023586b8c4c4eb2a07ebdd20f383ea85184ede677236956f8bc0f371ee1a987346412ece33552517057e8719af81d602695bf9ba7d308b9cea3f0146540b56524665a5aed21163087b598e973b58f32bea2c8421293f4793f0835796d99bb36afd420ddd70f4dae2ef86204aae67e40f30a23ab77dab8543c8e5a4afe643ccbcaa57621e42691ef417766bfdba38d7682e39fb1c924f3aab0af81d06515d73ee2240b8191ee2d463c5f7e9d38e2335320c6e402df89e9f870d05d3ea69a7450d8660c1ecea87bbc6ef4b5a30f5543ecaa80d531bd30ad38d98060e0c95b7112ea7ae3074c862d39c57f96179ece7f25761b53b8afd5acfba8de8277b2433eb3243d995bea599d0feabd061a0ccb7cf8991508d2bf7719e56ce1261dc0973ebff1f7ac3e54c654a95331ba8d9e6598a13887c6908629c85b683e1a96693bbe0d845ca928505db00f199f0cb85685378a0e2bea340ad57df389ca04791b9beb229f907cc399e63f0c1394ff096d696a13f76899473b13835afb79c08b3e4e3d40829426e4fa01dcba9d6ed29173573347a301e71de80c61afc5ad2c11a8954628850e64f2025d8617e330cd22e4a84108decfab8b66483a575ae2734820b8c404472750654a5e4e09d888f8cc53e702e521f4fb94821a6b519336a74e04a30f36955d312c83b3d6e5227a241b252e4b066652a0ffa653b8764c31183d5054f1cbdaf81a6ec47f67cc8792a26189c2c0d2ce38d71c29d5d718a2530680276475bef2cc537869b41ed5c81ca8d9b4a3103311e8725791c98aebba7e86eefd18a43114d6150d5818ad7095576685b35ec80da95a1da64cba9b35a46e7a7f56e6c0d8ad6797768058871e71469d13b15a433da68c77f4e6023d38c923cc1eea17f09e780a557d7d8d65f4b2e3eb5b845caf64d64130ceb702baab5e8d8337d128bc58aefe5cd53ffe3ce8655e979fc738c705ca4e507685f7d7c62019a93bbc9fdff1ddfead829ab3f66850bce61e2f9ff8b80f6ad3c84003b28a9732d3f6318fb3cd8b9816dfba1309adc9f9f582f292199119340ffb51765e8695a34b8930fc6c2e2b72d331edd499f4d6cbce501f83a71192bffafaf8ad78d89ce5d149fcfe139939db56a6c5a591450d58f715d56b51203ec8fe11a816edf85628fd723526b5fbaef5efbedebe03506a519525bd7c3e1a4d688ec4e30414554f18cf18c9f212ed4b43b50700eaca85f3ab89864bd3de59edb63956ee9a3ef30098635dabf01a353453cbccba3aac906983b06a8383b829263e9bdba646e9cd33cc795497426a33c18069802b6812d44a6b46d9bc09b2cb83983266aabdf1c6b369d7b23ab25a66954611e95dc504ea5a202217a426b3d75a7746e8961d0ef1e11148256d6ddf7b4d354fcdc91cbe50f969c4474d64d756ce72b6feeb1cc3cf5bf50b9e1838ba9f9f7e261258d78e42b762c62f3272054afdd6fe3979272cf4d64a13ef09e488ee38e224455846b6506095b12430ffe4358e346fd8c030f6247bb4a7fbb9e5a1e67d70f581c57ffc0f737a4323a0802d1c4d4ef4961296354f81828ee579ae48181268d753444bd19be8f27959db8ac5e0252260dfdcd7036cd9f92bb0ebc191d125402ea20b0d6f0610a8721800bb242b1da6ab5c964526670ff072ae8228b5cdff3c4cf3f454b67f2599522db35f50138ddf26b63bc69eb743c5eb9dbf7ce160321b0fb3bf31db630c507d890d7eef01f30d3af8ec9afdcd0d263e0d2e94c52be1aff4c376fb12c0d4cd6ccc811cd2b6bc7d0307d084c81cde7ca0956f0abc85552b47f5fc2804292df295d2d6df3d84eef0f4ac0a2f9daf5b619d82"}}, @user_kmaddress={0x2c, 0x13, {@in6=@mcast1={0xff, 0x1, [], 0x1}, @in6=@mcast1={0xff, 0x1, [], 0x1}}}, @algo_comp={0x12c, 0x3, {{'lzjh\x00'}, 0x720, "7f553e4698f08645d27f368d5c982af5a87f436b06650e9b0acba98322a4aba9980ab63fea783358501a0e13524f881d2b93d167b619c58f376ec93ecf8b2b39e90def0358ab2d3639b6d32aea6e199d9ab1f849686429cb1c18512ca5a344b49ec61b1436e7b385ffbede8d9cfcae3bb56a898fecab08bab7be244e0912e8712cd30e8d43f255bbadcb0b65dad8ad73489c4f128ef1d9fae676fca7baa07387e1f91b05eb447334881c0f3c17bf93da4e5732bcca46bc89a516d60896f7b7e0eec4515e9c90a42904cea180ac35736e0f48ed12ed929276bc5e950ed6ecf17190916d12"}}, @replay_esn_val={0x34, 0x17, {0x6, 0x7, 0x4, 0x7, 0x3, 0x8, [0x8, 0x0, 0x2f7, 0x8, 0x8, 0x0]}}]}, 0xc48}, 0x1}, 0x44) readv(r1, &(0x7f0000aae000)=[{&(0x7f0000e89000)=""/109, 0x6d}, {&(0x7f0000b8c000-0xb1)=""/177, 0xb1}], 0x2) recvmsg(r1, &(0x7f0000a33000-0x38)={&(0x7f0000856000-0x1c)=@in6={0x0, 0xffffffffffffffff, 0x0, @mcast1}, 0x1c, &(0x7f00005e2000)=[{&(0x7f00004ad000-0xbf)=""/191, 0xbf}], 0x1, &(0x7f0000156000-0xc2)=""/194, 0xc2}, 0x0) sendmsg$netlink(r1, &(0x7f0000791000)={&(0x7f0000757000-0xc)=@proc={0x10}, 0xc, &(0x7f0000713000)=[{&(0x7f00006aa000-0x164)={0x10, 0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, "", []}, 0x10}], 0x1}, 0x0) 2018/02/01 16:23:18 executing program 4: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)={0xaa}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) fchmodat(0xffffffffffffffff, &(0x7f0000012000)='./file0\x00', 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r1 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12, 0x0, @tid}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r1, 0x15) ioctl$UFFDIO_ZEROPAGE(r0, 0x8010aa02, &(0x7f00000c1000-0x10)={&(0x7f0000011000/0x3000)=nil, 0x3000}) [ 243.804101] binder_alloc: 872: binder_alloc_buf, no vma [ 243.816424] binder: 872:880 transaction failed 29189/-3, size 40-16 line 2903 2018/02/01 16:23:18 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = memfd_create(&(0x7f0000ca1000-0x11)='/dev/vga_arbiter\x00', 0x0) write(r0, &(0x7f0000ffe000-0x5)="da00", 0x2) r1 = syz_open_procfs(0x0, &(0x7f00008ff000-0x8)='net/udp\x00') sendfile(r0, r1, &(0x7f00006dc000-0x8), 0x401) execveat(r0, &(0x7f0000ff7000)='./file0\x00', &(0x7f0000d0e000)=[], &(0x7f000034c000-0x8)=[&(0x7f0000ff7000)="00000000000000060804002000fffc0c6565643b799365005f1b76"], 0x1000) 2018/02/01 16:23:18 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x2, &(0x7f0000691000-0x4)=0x79, 0x4) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000cd5000-0x4), 0x4) sendto$inet(r0, &(0x7f0000d5a000-0x73), 0xfffffc6c, 0x20000804, &(0x7f0000e1e000)={0x2, 0x3, @loopback=0x7f000001}, 0x10) readv(r0, &(0x7f00007d7000-0x50)=[{&(0x7f0000b7e000)=""/4096, 0x1000}], 0x1) 2018/02/01 16:23:18 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000009000-0x30)={0x4c, 0x0, &(0x7f0000452000-0x4c)=[@transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f0000b5b000-0x50)=[@ptr={0x70742a85, 0x1, &(0x7f00003df000), 0x1}], &(0x7f0000788000-0x20)=[0x0, 0x28]}, 0x1000}}], 0x0, 0x0, &(0x7f0000009000)}) 2018/02/01 16:23:18 executing program 3: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)={0xaa}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000012000/0x2000)=nil, 0x2000}, 0x1}) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x0) write$sndseq(r1, &(0x7f0000012000-0x2e)=[{0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @connect}], 0x30) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) chmod(&(0x7f000087c000-0x8)='./file0\x00', 0x0) mremap(&(0x7f0000679000/0x1000)=nil, 0x1000, 0x4000, 0x3, &(0x7f0000099000/0x4000)=nil) ioctl$UFFDIO_ZEROPAGE(r0, 0x8010aa02, &(0x7f0000002000-0x10)={&(0x7f0000011000/0x3000)=nil, 0x3000}) 2018/02/01 16:23:18 executing program 5: mmap(&(0x7f0000000000/0x5000)=nil, 0x5000, 0x3, 0x32, 0xffffffffffffffff, 0x0) setrlimit(0x9, &(0x7f0000002000-0x10)) mmap(&(0x7f0000004000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) 2018/02/01 16:23:18 executing program 4: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)={0xaa}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) fchmodat(0xffffffffffffffff, &(0x7f0000012000)='./file0\x00', 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r1 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12, 0x0, @tid}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r1, 0x15) ioctl$UFFDIO_ZEROPAGE(r0, 0x8010aa02, &(0x7f00000c1000-0x10)={&(0x7f0000011000/0x3000)=nil, 0x3000}) 2018/02/01 16:23:18 executing program 2: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)={0xaa}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) rt_sigaction(0x8, &(0x7f0000012000-0x20), &(0x7f0000001000-0x20), 0x8, &(0x7f0000001000-0x8)) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x2, 0x32, 0xffffffffffffffff, 0x0) clone(0x0, &(0x7f0000b26000), &(0x7f0000eaa000-0x4), &(0x7f0000bf3000-0x4), &(0x7f00003b9000-0xcd)) ioctl$UFFDIO_ZEROPAGE(r0, 0x8010aa02, &(0x7f00000c1000-0x10)={&(0x7f0000011000/0x3000)=nil, 0x3000}) 2018/02/01 16:23:18 executing program 1: mmap(&(0x7f0000000000/0xff3000)=nil, 0xff3000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r0, 0x0, 0x2c, &(0x7f0000008000-0xc)={@loopback=0x7f000001, @multicast1=0xe0000001, @empty}, 0x108) 2018/02/01 16:23:18 executing program 4: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)={0xaa}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) fchmodat(0xffffffffffffffff, &(0x7f0000012000)='./file0\x00', 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r1 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12, 0x0, @tid}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r1, 0x15) ioctl$UFFDIO_ZEROPAGE(r0, 0x8010aa02, &(0x7f00000c1000-0x10)={&(0x7f0000011000/0x3000)=nil, 0x3000}) [ 243.877730] binder: undelivered TRANSACTION_ERROR: 29189 2018/02/01 16:23:18 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$unix(0x1, 0x1, 0x0) timerfd_create(0x0, 0x0) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f00003ba000-0x24)) syz_open_pts(r1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f000000b000-0x8)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$unix(r2, &(0x7f0000001000-0x38)={&(0x7f0000239000-0x8)=@abs={0x0, 0x0, 0x0}, 0x8, &(0x7f0000008000)=[], 0x0, &(0x7f0000001000-0x10)=[@rights={0x200, 0x1, 0x1, [r0]}], 0x1}, 0x0) recvmsg(r3, &(0x7f000000e000)={0x0, 0x0, &(0x7f000008b000)=[], 0x0, &(0x7f000000c000), 0xfc13}, 0x0) pselect6(0x40, &(0x7f0000cc9000-0x40), &(0x7f0000cc9000-0x40), &(0x7f00000de000-0x40)={0xffffffffffffffe1}, &(0x7f00008e6000-0x10)={0x0, 0x989680}, &(0x7f0000205000-0x10)={&(0x7f0000cc9000-0x8), 0x8}) 2018/02/01 16:23:18 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x2, &(0x7f0000691000-0x4)=0x79, 0x4) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000cd5000-0x4), 0x4) sendto$inet(r0, &(0x7f0000d5a000-0x73), 0xfffffc6c, 0x20000804, &(0x7f0000e1e000)={0x2, 0x3, @loopback=0x7f000001}, 0x10) readv(r0, &(0x7f00007d7000-0x50)=[{&(0x7f0000b7e000)=""/4096, 0x1000}], 0x1) 2018/02/01 16:23:18 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket(0xa, 0x802, 0x0) connect$inet6(r0, &(0x7f000049e000)={0xa, 0xffffffffffffffff, 0x0, @loopback={0x0, 0x1}}, 0x1c) getsockopt$inet_int(r0, 0x0, 0xe, &(0x7f0000db7000), &(0x7f0000a59000)=0x3) 2018/02/01 16:23:18 executing program 4: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)={0xaa}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) fchmodat(0xffffffffffffffff, &(0x7f0000012000)='./file0\x00', 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r1 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12, 0x0, @tid}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r1, 0x15) ioctl$UFFDIO_ZEROPAGE(r0, 0x8010aa02, &(0x7f00000c1000-0x10)={&(0x7f0000011000/0x3000)=nil, 0x3000}) [ 243.936734] binder_alloc: 911: binder_alloc_buf, no vma [ 243.946923] binder: 911:918 transaction failed 29189/-3, size 40-16 line 2903 2018/02/01 16:23:18 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r0, &(0x7f0000887000-0x10)={0x2, 0x3, @broadcast=0xffffffff}, 0x10) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000cd5000-0x4), 0x4) sendto$inet(r0, &(0x7f0000d5a000-0x73), 0xfffffc6c, 0x20000804, &(0x7f0000e1e000)={0x2, 0x3, @loopback=0x7f000001}, 0x10) readv(r0, &(0x7f00007d7000-0x50)=[{&(0x7f0000b7e000)=""/4096, 0x1000}], 0x1) 2018/02/01 16:23:18 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000009000-0x30)={0x4c, 0x0, &(0x7f0000452000-0x4c)=[@transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f0000b5b000-0x50)=[@ptr={0x70742a85, 0x1, &(0x7f00003df000), 0x1}], &(0x7f0000788000-0x20)=[0x0, 0x28]}, 0x1000}}], 0x0, 0x0, &(0x7f0000009000)}) 2018/02/01 16:23:18 executing program 4: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f0000002000)={0xaa}) ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) fchmodat(0xffffffffffffffff, &(0x7f0000012000)='./file0\x00', 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12, 0x0, @tid}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r0, 0x15) ioctl$UFFDIO_ZEROPAGE(0xffffffffffffffff, 0x8010aa02, &(0x7f00000c1000-0x10)={&(0x7f0000011000/0x3000)=nil, 0x3000}) 2018/02/01 16:23:18 executing program 7: mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = memfd_create(&(0x7f0000001000-0x2)='$\x00', 0x0) fallocate(r0, 0x0, 0x0, 0x10001) write(r0, &(0x7f0000002000)='/', 0x1) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) sendfile(r0, r0, &(0x7f0000001000), 0xfec) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x4, 0x11, r0, 0x0) renameat(0xffffffffffffffff, &(0x7f0000001000)='./file0\x00', 0xffffffffffffffff, &(0x7f0000001000)='./file0\x00') 2018/02/01 16:23:18 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x1, 0x0) r1 = dup(r0) setsockopt$inet_tcp_int(r1, 0x6, 0x2, &(0x7f0000b10000)=0xc2, 0x6677bbc4) bind$inet(r0, &(0x7f00000f1000-0x10)={0x2, 0x3, @multicast2=0xe0000002}, 0x10) setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x1a, &(0x7f0000e9c000-0x10)={0x1, &(0x7f0000f07000)=[{0x6, 0x0, 0x0, 0x101}]}, 0x10) connect$inet(r0, &(0x7f0000987000)={0x2, 0x3, @empty}, 0x10) sendmsg(r1, &(0x7f0000b82000)={&(0x7f0000930000-0x6)=@hci={0x1f}, 0x6, &(0x7f0000e42000)=[{&(0x7f0000781000)="23f25cc4c984636994f457561b9ac6f91889e7487b4265e56f683482a940022e4239329840ddd8d5aef7d8ce9ab6e11bbd767f7a7a089a5f14d706c4a2ad72be84cd66e7dc8cc9ee045660c12f0a5a9a701cf05fb3056b21969c10950e1e9e8c63731bf5795e128526d517b79538d0d025b66d22c36b86f6ed30cdfea5242550285c123836ad6c3bc8ce7716ce3439e32efa86eac4e3c5908733a939532a8500686581936af6cd990ac2f15f9a2bee4ec32c4d4ace7b46e0a313d8441c860a4e5b804007a968f2e9e008e6831574c3a0c0cc9be94b211055a3be43483277364b2c528dfcccf7865815d6987faa17d35925f6dde618cda0f01dc12c4b97f2ae479ed14c6b56c0ad67806448597aa9d5b737ca1680b1e58f20d6046d551b2243701f01b3ff93962e8d4b319b3094be8a05364b1eb85b9d64ca87ed8462f6de7090b6afdea0477eb798ee947f66f847f5ea7fbf45c7b4ca6d39597c56f89a93c7a72d74e4652f4ffc23ef5ea1f46f0cdd4d21d94bb16376a30ad2cc0e6e988d5aa309ca1e64a010eecc6c316d32", 0x18c}], 0x1, &(0x7f0000634000)=[]}, 0x0) sendmsg(r1, &(0x7f0000c64000-0x38)={0x0, 0x0, &(0x7f0000692000-0x30)=[{&(0x7f0000b87000+0x4b1)="9895b8f7ac65dbe8b555fff05f2bf65f4f2cb457ef03dc3e387b958bf52b3d129c38dea1bd", 0x25}, {&(0x7f00009e9000)="5383744b58e5205303b2bb32907845915b2af5fb81fe627971ba73572f22d84889870d1655519739e355a45b232645a6be32f7e3973e8227d74ea2ae58c60c3d57f09d7df2ecdcc3428d4eb2851528d9c0de181c8039cecaab878d2a019d8bd0d2b218ea96bd85615d6a62d335b28a12a32b0665013352a0d4f083f1fed3e7e35bcc2c0c6cb3d57fcb4ea03d48e8840fbaf52551e0c22875", 0x98}], 0x2, &(0x7f0000c66000)=[{0xf8, 0x29, 0x2, "693012c4291b0735f0af4d05812cd2c638cda0e63ede9455065a73f81d156c34c12cca1b6257d046b71a6fff837ee499f1c89f6338a787253478d64ed63c279b3b41642c86678c81211c7b978033c42549ad6f85eb6d1190d1f4caf5c113c01387138b8f85f85c8ebea661161be4fe72568aca2735827d995216863775eeff1a9af2c1f24fd0d16e2b36a35fa07a21ff477a563da9ad7d755c961b63bf1ac7aca30a83ec2d75063065a1efb6f4e0e83b23ce17b8ae432062fcc0392f3b8f653e4928bfe16d23c65e972f01a1d68964d4dffc583f9401994484e49f15715c267bd5d69984ca"}, {0xc8, 0x11f, 0x0, "9e44e0893261d9ad6cad124a058d5496aae74629366f7f8356869b9057e436bc0342eb562e1435c512ec071386cfbdebf1bbacf2e7bf4ce8ba90725b0bd9d7076453af0fe7f7c465c28fd28890b1700c6e9e24c91f84ffdaeeb332fa52c35b772d5b42b5cb48d6cfa6a59d5d0c31897819600f9ca6631cda100eacb353a68e3daab9a463ece1cb6e7dd3fafc9c6e890ac37ceea76a6ef0917ed061d3bf5728ace802ef91e433fde94eb75811a75374b21bcf8265"}, {0xe8, 0x197, 0x81, "fb828be889a69e6d7986da92bd25ce57fb8ddfbbae03d0c2c142a28413c7917c518f06c2722fc933582f1b0a17d13d0df40cd8f6afff56d70c8d66e65c894da24753d135d9df167be7260a9adff3980dbb50930bf1c69700ac4254d5abdca8bbf6c68fd37f182a063cc24c22df4ac967b1393cba8decf74f171f0cbde6dad6465c7923843f17f4848c879b6029d4331b30dc6d1df56fd2ff81d2bbacbc466d6e0d3cb25ad55cb088247ed70fb369dd282efbaaa37d2f40e9dd89445cbafd5fe337656a3a0bfbd7c1ca9c9fd3300cd98189"}], 0x2a8, 0x4008080}, 0x1) recvmsg(r1, &(0x7f0000434000-0x1c)={&(0x7f0000c3b000)=@pppol2tpv3={0x0, 0x0, {0x0, 0x0, {0x0, 0xffffffffffffffff, @multicast2}}}, 0x2e, &(0x7f0000ae5000)=[{&(0x7f000022a000-0x6c)=""/108, 0x6c}, {&(0x7f0000028000)=""/179, 0xb3}, {&(0x7f0000784000-0xa1)=""/161, 0xa1}], 0x3, &(0x7f0000007000)=""/131, 0x83}, 0x100) sendmsg(r1, &(0x7f0000247000)={&(0x7f000058d000-0x3a)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0xffffffffffffffff, 0x0, @local={0xfe, 0x80, [], 0xffffffffffffffff, 0xaa}}}}, 0x3a, &(0x7f0000a58000-0x20)=[{&(0x7f0000787000-0x1000)="43c552ade9499f006b837d34e3d59b5e2b05d0f1fb5cd3a933bbe36d13b79f3e297ec03e39f5c78a098e87104eefbe48d4ebefbd25aeff6015522455e1752492b914e6c9cfdba4876af4a110543d98ea7adb436387a4c9e140c18d8085e7c93ba89bc871b0e6c95a53aba09bba817fb29ebaf4d276f6b4042bed7b7a31e439df237ac88120e38e6b466bae4ca0b9c44478abbb7fc744ae4a4942b7969c43d4d5fc2a48f8f6baf9182def6950d631d898bc000952396e6e4b8a796431b75a7ecfbce48ccc294baed5d8f71d1deae7d2c6d0868f7919a5677ec01ac04bb5370734681305261aec26b9f309ddf8c4cb8f7a32181a41722af15009ecd0f0080d3b55ec7f4338a45f8c3b976b36f8f21e1b612763db6213864fdde6f3c114471844c7e5cd22a7922be21fc9984a403682c8407c059810f0f715a8a5d56e640486589bac4d88a79ef15437423caeb1b2c506ae14de606d", 0x154}], 0x1, &(0x7f0000f89000-0x80)=[]}, 0x0) [ 243.985960] binder: undelivered TRANSACTION_ERROR: 29189 2018/02/01 16:23:18 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_ifreq(r0, 0x89f2, &(0x7f00001c5000-0x28)={@common='sit0\x00', @ifru_map={0x41776e}}) 2018/02/01 16:23:18 executing program 3: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)={0xaa}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000012000/0x2000)=nil, 0x2000}, 0x1}) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x0) write$sndseq(r1, &(0x7f0000012000-0x2e)=[{0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @connect}], 0x30) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) chmod(&(0x7f000087c000-0x8)='./file0\x00', 0x0) mremap(&(0x7f0000679000/0x1000)=nil, 0x1000, 0x4000, 0x3, &(0x7f0000099000/0x4000)=nil) ioctl$UFFDIO_ZEROPAGE(r0, 0x8010aa02, &(0x7f0000002000-0x10)={&(0x7f0000011000/0x3000)=nil, 0x3000}) 2018/02/01 16:23:18 executing program 5: clone(0x0, &(0x7f00007ef000), &(0x7f000086c000), &(0x7f0000d0b000), &(0x7f0000312000)) rmdir(&(0x7f000017a000)='./file0\x00') 2018/02/01 16:23:18 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r0, &(0x7f0000887000-0x10)={0x2, 0x3, @broadcast=0xffffffff}, 0x10) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000cd5000-0x4), 0x4) sendto$inet(r0, &(0x7f0000d5a000-0x73), 0xfffffc6c, 0x20000804, &(0x7f0000e1e000)={0x2, 0x3, @loopback=0x7f000001}, 0x10) readv(r0, &(0x7f00007d7000-0x50)=[{&(0x7f0000b7e000)=""/4096, 0x1000}], 0x1) 2018/02/01 16:23:18 executing program 4: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f0000002000)={0xaa}) ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) fchmodat(0xffffffffffffffff, &(0x7f0000012000)='./file0\x00', 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12, 0x0, @tid}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r0, 0x15) ioctl$UFFDIO_ZEROPAGE(0xffffffffffffffff, 0x8010aa02, &(0x7f00000c1000-0x10)={&(0x7f0000011000/0x3000)=nil, 0x3000}) 2018/02/01 16:23:18 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000009000-0x30)={0x4c, 0x0, &(0x7f0000452000-0x4c)=[@transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f0000b5b000-0x50)=[@ptr={0x70742a85, 0x1, &(0x7f00003df000), 0x1}], &(0x7f0000788000-0x20)=[0x0, 0x28]}, 0x1000}}], 0x0, 0x0, &(0x7f0000009000)}) 2018/02/01 16:23:18 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_MRT6_DEL_MFC_PROXY(r0, 0x29, 0xd3, &(0x7f0000bb3000-0x5c)={{0xa, 0xffffffffffffffff, 0x0, @empty}, {0xa, 0xffffffffffffffff, 0x0, @loopback={0x0, 0x1}}}, 0x5c) 2018/02/01 16:23:18 executing program 2: mmap(&(0x7f0000000000/0xff4000)=nil, 0xff4000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x2, 0x0) setsockopt$inet_mtu(r0, 0x0, 0xa, &(0x7f0000ff1000-0x4)=0x8000000000004, 0x9c) r1 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f000095c000-0x4)={0x0, 0x0, 0xffffffffffffff7c}, 0x4) sendto$inet(r0, &(0x7f0000865000), 0xffe4, 0x0, &(0x7f0000fda000-0x10)={0x2, 0x0, @rand_addr}, 0x10) 2018/02/01 16:23:18 executing program 4: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f0000002000)={0xaa}) ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) fchmodat(0xffffffffffffffff, &(0x7f0000012000)='./file0\x00', 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12, 0x0, @tid}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r0, 0x15) ioctl$UFFDIO_ZEROPAGE(0xffffffffffffffff, 0x8010aa02, &(0x7f00000c1000-0x10)={&(0x7f0000011000/0x3000)=nil, 0x3000}) 2018/02/01 16:23:18 executing program 1: mmap(&(0x7f0000000000/0xfdc000)=nil, 0xfdc000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003ba000-0x24)) ioctl$TCSETS(r0, 0x5402, &(0x7f0000fdc000-0x24)={0x0, 0x0, 0xffffffffffffff00}) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000e40000+0x56c)=0x3) [ 244.043977] binder_alloc: 948: binder_alloc_buf, no vma [ 244.054187] binder: 948:955 transaction failed 29189/-3, size 40-16 line 2903 [ 244.068627] binder: undelivered TRANSACTION_ERROR: 29189 2018/02/01 16:23:18 executing program 5: r0 = socket$packet(0x11, 0x800000000002, 0x300) setsockopt$packet_add_memb(r0, 0x107, 0x1, &(0x7f0000009000)={0x0, 0x1, 0x6, @remote={[0xaa, 0xaa, 0xaa, 0xaa], 0xffffffffffffffff, 0xbb}}, 0x4) 2018/02/01 16:23:18 executing program 4: r0 = userfaultfd(0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)={0xaa}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) fchmodat(0xffffffffffffffff, &(0x7f0000012000)='./file0\x00', 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r1 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12, 0x0, @tid}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r1, 0x15) ioctl$UFFDIO_ZEROPAGE(r0, 0x8010aa02, &(0x7f00000c1000-0x10)={&(0x7f0000011000/0x3000)=nil, 0x3000}) 2018/02/01 16:23:18 executing program 7: mmap(&(0x7f0000000000/0x8d8000)=nil, 0x8d8000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$sock_int(r0, 0x1, 0x9, &(0x7f00008db000-0x4), &(0x7f0000694000-0x4)=0x4) 2018/02/01 16:23:18 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) connect$inet6(r0, &(0x7f000097e000)={0xa, 0xffffffffffffffff, 0x0, @remote={0xfe, 0x80, [], 0xffffffffffffffff, 0xbb}, 0x4}, 0x1c) getsockopt$inet6_buf(r0, 0x29, 0x50, &(0x7f0000954000)=""/185, &(0x7f0000b55000)=0xb9) [ 244.121111] binder: 967:969 transaction failed 29189/-22, size 40-16 line 2788 [ 244.168248] binder: undelivered TRANSACTION_ERROR: 29189 2018/02/01 16:23:18 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000371000)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f000002a000-0xb0)={{0x80}, "0a4ceaa05d9a00000000000000039b3fd4cec307e8ef3d13eb790ec9c65abaf90d229db692542e5b78f8b29e0a27800f0000000000000009fb42f376589701a4", 0xa9824f69d1376637, 0x10000a}) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000e12000)='/dev/sequencer2\x00', 0x4000, 0x0) read(r0, &(0x7f0000c7c000)=""/136, 0x88) 2018/02/01 16:23:18 executing program 4: r0 = userfaultfd(0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)={0xaa}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) fchmodat(0xffffffffffffffff, &(0x7f0000012000)='./file0\x00', 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r1 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12, 0x0, @tid}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r1, 0x15) ioctl$UFFDIO_ZEROPAGE(r0, 0x8010aa02, &(0x7f00000c1000-0x10)={&(0x7f0000011000/0x3000)=nil, 0x3000}) 2018/02/01 16:23:18 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000009000-0x30)={0x4c, 0x0, &(0x7f0000452000-0x4c)=[@transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f0000b5b000-0x50)=[@ptr={0x70742a85, 0x1, &(0x7f00003df000), 0x1}], &(0x7f0000788000-0x20)=[0x0, 0x28]}, 0x1000}}], 0x0, 0x0, &(0x7f0000009000)}) 2018/02/01 16:23:18 executing program 5: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)={0xaa}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) readv(r0, &(0x7f0000000000)=[{&(0x7f0000001000-0xdf)=""/223, 0xdf}], 0x1) openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000011000)='/selinux/policy\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x2, 0x32, 0xffffffffffffffff, 0x0) ioctl$UFFDIO_ZEROPAGE(r0, 0x8010aa02, &(0x7f00000c1000-0x10)={&(0x7f0000011000/0x3000)=nil, 0x3000}) 2018/02/01 16:23:18 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000fe2000)={@remote={0xfe, 0x80, [], 0x0, 0xbb}, 0x0, 0x0, 0x20000000002, 0x1}, 0x20) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000012000-0x20)={@loopback={0x0, 0x1}, 0x0, 0x0, 0x2, 0x1}, 0x20) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000420000-0x20)={@local={0xfe, 0x80, [], 0x0, 0xaa}, 0x0, 0x2}, 0x20) 2018/02/01 16:23:18 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r0, &(0x7f0000887000-0x10)={0x2, 0x3, @broadcast=0xffffffff}, 0x10) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000cd5000-0x4), 0x4) sendto$inet(r0, &(0x7f0000d5a000-0x73), 0xfffffc6c, 0x20000804, &(0x7f0000e1e000)={0x2, 0x3, @loopback=0x7f000001}, 0x10) readv(r0, &(0x7f00007d7000-0x50)=[{&(0x7f0000b7e000)=""/4096, 0x1000}], 0x1) 2018/02/01 16:23:18 executing program 2: mmap(&(0x7f0000000000/0xf69000)=nil, 0xf69000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x2, 0x0) sendto$inet(r0, &(0x7f0000e79000-0x5be), 0xffae, 0x8084, &(0x7f00004d4000)={0x2, 0x0, @empty}, 0x10) ioctl$int_in(r0, 0x5452, &(0x7f00009a2000)=0x4) poll(&(0x7f0000caf000-0x8)=[{r0}], 0x1, 0x0) sendto$inet(r0, &(0x7f0000f68000), 0x0, 0x0, &(0x7f00008ec000)={0x2, 0xffffffffffffffff, @empty}, 0x10) 2018/02/01 16:23:18 executing program 3: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)={0xaa}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000012000/0x2000)=nil, 0x2000}, 0x1}) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x0) write$sndseq(r1, &(0x7f0000012000-0x2e)=[{0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @connect}], 0x30) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) chmod(&(0x7f000087c000-0x8)='./file0\x00', 0x0) mremap(&(0x7f0000679000/0x1000)=nil, 0x1000, 0x4000, 0x3, &(0x7f0000099000/0x4000)=nil) ioctl$UFFDIO_ZEROPAGE(r0, 0x8010aa02, &(0x7f0000002000-0x10)={&(0x7f0000011000/0x3000)=nil, 0x3000}) 2018/02/01 16:23:18 executing program 4: r0 = userfaultfd(0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)={0xaa}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) fchmodat(0xffffffffffffffff, &(0x7f0000012000)='./file0\x00', 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r1 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12, 0x0, @tid}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r1, 0x15) ioctl$UFFDIO_ZEROPAGE(r0, 0x8010aa02, &(0x7f00000c1000-0x10)={&(0x7f0000011000/0x3000)=nil, 0x3000}) 2018/02/01 16:23:18 executing program 2: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)={0xaa}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000-0x20)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) ioctl$UFFDIO_ZEROPAGE(r0, 0xc020aa04, &(0x7f0000011000)={&(0x7f0000011000/0x3000)=nil, 0x3000}) mmap(&(0x7f0000004000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) select(0x40, &(0x7f0000013000-0x40), &(0x7f0000011000), &(0x7f0000002000-0x40), &(0x7f0000001000+0x311)={0x0, 0x2710}) ioctl$UFFDIO_ZEROPAGE(r0, 0x8010aa02, &(0x7f0000004000)={&(0x7f0000011000/0x3000)=nil, 0x3000}) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$UFFDIO_ZEROPAGE(r0, 0x8010aa02, &(0x7f00000c1000-0x10)={&(0x7f0000011000/0x3000)=nil, 0x3000}) 2018/02/01 16:23:18 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x80002, 0x88) bind$inet6(r0, &(0x7f0000d86000-0x1c)={0xa, 0x3, 0x0, @empty}, 0x1c) r1 = socket$inet6(0xa, 0x802, 0x88) setsockopt$inet6_udp_int(r1, 0x11, 0xa, &(0x7f0000f6a000)=0x8, 0x4) sendmsg$inet_sctp(r1, &(0x7f0000558000-0x38)={&(0x7f0000a34000)=@in={0x2, 0x3, @empty}, 0x10, &(0x7f0000f70000)=[{&(0x7f0000f70000-0x65)="470a3747e4d6c6dc7e519c8cfa37b13380c40d8724eb4f1fe4fb8607a6fa401ca8969a47542c8e2cb00000000000000000dbf1eedf91d955a9e84c62af9fc4452b9c97c651", 0x45}], 0x1}, 0x0) recvmsg(r0, &(0x7f00002d6000)={&(0x7f00004d4000-0x6)=@hci, 0x6, &(0x7f00003c1000-0x10)=[], 0x0, &(0x7f00005df000)}, 0x3) 2018/02/01 16:23:18 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000000)={0x0, 0x0}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f00007e5000)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r2, &(0x7f00000bd000)=[], 0x80, 0x0) ppoll(&(0x7f0000b80000-0x10)=[{r2}], 0x1, &(0x7f0000346000-0x10)={0x0, r0}, &(0x7f0000d5c000), 0x8) connect$unix(r1, &(0x7f00006ee000-0x5)=@file={0x0, './file0\x00'}, 0xa) [ 244.263583] binder: 1000:1009 transaction failed 29189/-22, size 40-16 line 2788 2018/02/01 16:23:18 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000009000-0x30)={0x4c, 0x0, &(0x7f0000452000-0x4c)=[@transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f0000b5b000-0x50)=[@ptr={0x70742a85, 0x1, &(0x7f00003df000), 0x1}], &(0x7f0000788000-0x20)=[0x0, 0x28]}, 0x1000}}], 0x0, 0x0, &(0x7f0000009000)}) 2018/02/01 16:23:18 executing program 4: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x0, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)={0xaa}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) fchmodat(0xffffffffffffffff, &(0x7f0000012000)='./file0\x00', 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r1 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12, 0x0, @tid}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r1, 0x15) ioctl$UFFDIO_ZEROPAGE(r0, 0x8010aa02, &(0x7f00000c1000-0x10)={&(0x7f0000011000/0x3000)=nil, 0x3000}) 2018/02/01 16:23:18 executing program 3: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)={0xaa}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000012000/0x2000)=nil, 0x2000}, 0x1}) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x0) write$sndseq(r1, &(0x7f0000012000-0x2e)=[{0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @connect}], 0x30) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) chmod(&(0x7f000087c000-0x8)='./file0\x00', 0x0) mremap(&(0x7f0000679000/0x1000)=nil, 0x1000, 0x4000, 0x3, &(0x7f0000099000/0x4000)=nil) ioctl$UFFDIO_ZEROPAGE(r0, 0x8010aa02, &(0x7f0000002000-0x10)={&(0x7f0000011000/0x3000)=nil, 0x3000}) 2018/02/01 16:23:18 executing program 4: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x0, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)={0xaa}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) fchmodat(0xffffffffffffffff, &(0x7f0000012000)='./file0\x00', 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r1 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12, 0x0, @tid}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r1, 0x15) ioctl$UFFDIO_ZEROPAGE(r0, 0x8010aa02, &(0x7f00000c1000-0x10)={&(0x7f0000011000/0x3000)=nil, 0x3000}) 2018/02/01 16:23:18 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000009000-0x30)={0x4c, 0x0, &(0x7f0000452000-0x4c)=[@transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f0000b5b000-0x50)=[@ptr={0x70742a85, 0x1, &(0x7f00003df000), 0x1}], &(0x7f0000788000-0x20)=[0x0, 0x28]}, 0x1000}}], 0x0, 0x0, &(0x7f0000009000)}) 2018/02/01 16:23:18 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000500000)='/dev/sequencer\x00', 0x0, 0x0) r1 = syz_open_dev$sndtimer(&(0x7f00000b6000-0xf)='/dev/snd/timer\x00', 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_SELECT(r1, 0x40345410, &(0x7f000002a000-0x34)={{0x0, 0x2, 0x0, 0xffefffffffffffff}}) ioctl$SNDRV_TIMER_IOCTL_START(r1, 0x54a0) dup3(r0, r1, 0x0) [ 244.306669] binder: undelivered TRANSACTION_ERROR: 29189 [ 244.335443] binder: 1027:1029 transaction failed 29189/-22, size 40-16 line 2788 2018/02/01 16:23:18 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000009000-0x30)={0x4c, 0x0, &(0x7f0000452000-0x4c)=[@transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f0000b5b000-0x50)=[@ptr={0x70742a85, 0x1, &(0x7f00003df000), 0x1}], &(0x7f0000788000-0x20)=[0x0, 0x28]}, 0x1000}}], 0x0, 0x0, &(0x7f0000009000)}) [ 244.356724] binder: undelivered TRANSACTION_ERROR: 29189 [ 244.371633] FAULT_FLAG_ALLOW_RETRY missing 30 [ 244.376495] FAULT_FLAG_ALLOW_RETRY missing 30 [ 244.376507] CPU: 0 PID: 1022 Comm: syz-executor2 Not tainted 4.15.0+ #290 2018/02/01 16:23:18 executing program 4: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x0, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)={0xaa}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) fchmodat(0xffffffffffffffff, &(0x7f0000012000)='./file0\x00', 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r1 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12, 0x0, @tid}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r1, 0x15) ioctl$UFFDIO_ZEROPAGE(r0, 0x8010aa02, &(0x7f00000c1000-0x10)={&(0x7f0000011000/0x3000)=nil, 0x3000}) [ 244.376513] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 244.376516] Call Trace: [ 244.376534] dump_stack+0x194/0x257 [ 244.376550] ? arch_local_irq_restore+0x53/0x53 [ 244.376563] ? gup_pgd_range+0x843/0x2cf0 [ 244.376579] ? handle_userfault+0xb97/0x2500 [ 244.376597] handle_userfault+0xbd9/0x2500 [ 244.376605] ? handle_userfault+0x185a/0x2500 [ 244.376631] ? userfaultfd_ioctl+0x4520/0x4520 [ 244.376641] ? debug_check_no_locks_freed+0x3c0/0x3c0 [ 244.376651] ? __gup_device_huge+0x170/0x170 [ 244.376676] ? print_irqtrace_events+0x270/0x270 [ 244.376688] ? print_irqtrace_events+0x270/0x270 [ 244.376706] ? __lock_acquire+0x664/0x3e00 [ 244.376738] ? __lock_acquire+0x664/0x3e00 [ 244.376750] ? __lock_acquire+0x664/0x3e00 [ 244.376767] ? check_noncircular+0x20/0x20 [ 244.376790] ? debug_check_no_locks_freed+0x3c0/0x3c0 [ 244.376802] ? debug_check_no_locks_freed+0x3c0/0x3c0 [ 244.376809] ? rb_next+0x140/0x140 [ 244.376824] ? find_held_lock+0x35/0x1d0 [ 244.376847] ? __handle_mm_fault+0x3296/0x3ce0 [ 244.376858] ? lock_downgrade+0x980/0x980 [ 244.376873] ? lock_release+0xa40/0xa40 [ 244.376886] ? check_noncircular+0x20/0x20 [ 244.376897] ? do_raw_spin_trylock+0x190/0x190 [ 244.376906] ? userfaultfd_ctx_put+0x720/0x720 [ 244.376918] ? print_irqtrace_events+0x231/0x270 [ 244.376925] ? check_noncircular+0x20/0x20 [ 244.376946] __handle_mm_fault+0x32a3/0x3ce0 [ 244.376966] ? __pmd_alloc+0x4e0/0x4e0 [ 244.376974] ? check_noncircular+0x20/0x20 [ 244.376982] ? cpuacct_charge+0x2e6/0x5c0 [ 244.376999] ? find_held_lock+0x35/0x1d0 [ 244.377028] ? handle_mm_fault+0x2a0/0x930 [ 244.377042] ? lock_downgrade+0x980/0x980 [ 244.377096] handle_mm_fault+0x38f/0x930 [ 244.377113] ? __handle_mm_fault+0x3ce0/0x3ce0 [ 244.377120] ? vmacache_find+0x5f/0x280 [ 244.377140] ? find_vma+0x30/0x150 [ 244.377160] __do_page_fault+0x5c9/0xc90 [ 244.377185] ? mm_fault_error+0x2c0/0x2c0 [ 244.377200] ? check_noncircular+0x20/0x20 [ 244.377220] do_page_fault+0xee/0x720 [ 244.377233] ? __do_page_fault+0xc90/0xc90 [ 244.377251] ? find_held_lock+0x35/0x1d0 [ 244.377274] ? __might_fault+0x110/0x1d0 [ 244.377291] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 244.377313] page_fault+0x2c/0x60 [ 244.377323] RIP: 0010:copy_user_generic_unrolled+0x86/0xc0 [ 244.377327] RSP: 0018:ffff8801cf5ef530 EFLAGS: 00010206 [ 244.377336] RAX: ffffed0039ebdf97 RBX: 0000000020011000 RCX: 0000000000000003 [ 244.377341] RDX: 0000000000000000 RSI: 0000000020011000 RDI: ffff8801cf5efca0 [ 244.377346] RBP: ffff8801cf5ef560 R08: ffffed0039ebdf97 R09: ffffed0039ebdf97 [ 244.377351] R10: 0000000000000003 R11: ffffed0039ebdf96 R12: 0000000000000018 [ 244.377356] R13: ffff8801cf5efca0 R14: 00007ffffffff000 R15: 0000000020011018 [ 244.377392] ? _copy_from_user+0xc5/0x110 [ 244.377407] userfaultfd_ioctl+0x1647/0x4520 [ 244.377414] ? check_noncircular+0x20/0x20 [ 244.377439] ? debug_check_no_locks_freed+0x3c0/0x3c0 [ 244.377448] ? do_raw_spin_trylock+0x190/0x190 [ 244.377454] ? do_raw_spin_trylock+0x190/0x190 [ 244.377465] ? userfaultfd_read+0x220/0x220 [ 244.377476] ? __lock_is_held+0xb6/0x140 [ 244.377498] ? print_irqtrace_events+0x270/0x270 [ 244.377515] ? __lock_is_held+0xb6/0x140 [ 244.377543] ? set_next_entity+0x2ed/0xd70 [ 244.377560] ? __lock_acquire+0x664/0x3e00 [ 244.377568] ? check_noncircular+0x20/0x20 [ 244.377581] ? __enqueue_entity+0x109/0x1e0 [ 244.377608] ? debug_check_no_locks_freed+0x3c0/0x3c0 [ 244.377618] ? find_held_lock+0x35/0x1d0 [ 244.377638] ? finish_task_switch+0x1d3/0x740 [ 244.377649] ? lock_downgrade+0x980/0x980 [ 244.377660] ? load_balance+0x34c0/0x34c0 [ 244.377675] ? lock_release+0xa40/0xa40 [ 244.377683] ? compat_start_thread+0x80/0x80 [ 244.377694] ? do_raw_spin_trylock+0x190/0x190 [ 244.377707] ? _raw_spin_unlock_irq+0x27/0x70 [ 244.377720] ? trace_hardirqs_on_caller+0x421/0x5c0 [ 244.377731] ? trace_hardirqs_on+0xd/0x10 [ 244.377741] ? _raw_spin_unlock_irq+0x27/0x70 [ 244.377750] ? finish_task_switch+0x1d3/0x740 [ 244.377756] ? finish_task_switch+0x1aa/0x740 [ 244.377770] ? check_noncircular+0x20/0x20 [ 244.377778] ? copy_overflow+0x20/0x20 [ 244.377811] ? find_held_lock+0x35/0x1d0 [ 244.377834] ? __fget+0x333/0x570 [ 244.377846] ? lock_downgrade+0x980/0x980 [ 244.377862] ? lock_release+0xa40/0xa40 [ 244.377877] ? __lock_is_held+0xb6/0x140 [ 244.377905] ? __fget+0x35c/0x570 [ 244.377924] ? iterate_fd+0x3f0/0x3f0 [ 244.377930] ? up_read+0x40/0x40 [ 244.377939] ? down_read_killable+0x180/0x180 [ 244.377950] ? security_mmap_file+0x143/0x180 [ 244.377971] ? userfaultfd_read+0x220/0x220 [ 244.377980] do_vfs_ioctl+0x1b1/0x1520 [ 244.377987] ? do_vfs_ioctl+0x1b1/0x1520 [ 244.378006] ? ioctl_preallocate+0x2b0/0x2b0 [ 244.378020] ? selinux_capable+0x40/0x40 [ 244.378047] ? syscall_return_slowpath+0x2ad/0x550 [ 244.378067] ? security_file_ioctl+0x89/0xb0 [ 244.378082] SyS_ioctl+0x8f/0xc0 [ 244.378100] entry_SYSCALL_64_fastpath+0x29/0xa0 [ 244.378107] RIP: 0033:0x453299 [ 244.378111] RSP: 002b:00007fe2f145dc58 EFLAGS: 00000212 ORIG_RAX: 0000000000000010 [ 244.378120] RAX: ffffffffffffffda RBX: 000000000071bea0 RCX: 0000000000453299 [ 244.378130] RDX: 0000000020011000 RSI: 00000000c020aa04 RDI: 0000000000000013 [ 244.378135] RBP: 000000000000031e R08: 0000000000000000 R09: 0000000000000000 [ 244.378139] R10: 0000000000000000 R11: 0000000000000212 R12: 00000000006f3b70 [ 244.378144] R13: 00000000ffffffff R14: 00007fe2f145e6d4 R15: 0000000000000000 [ 244.955464] CPU: 1 PID: 1030 Comm: syz-executor2 Not tainted 4.15.0+ #290 [ 244.962360] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 244.971685] Call Trace: [ 244.974249] dump_stack+0x194/0x257 [ 244.977854] ? arch_local_irq_restore+0x53/0x53 [ 244.982496] ? find_held_lock+0x35/0x1d0 [ 244.986532] ? handle_userfault+0xb97/0x2500 [ 244.990917] handle_userfault+0xbd9/0x2500 [ 244.995122] ? handle_userfault+0x185a/0x2500 [ 244.999605] ? userfaultfd_ioctl+0x4520/0x4520 [ 245.004159] ? debug_check_no_locks_freed+0x3c0/0x3c0 [ 245.009322] ? _raw_spin_unlock_irq+0x27/0x70 [ 245.013791] ? trace_hardirqs_on_caller+0x421/0x5c0 [ 245.018783] ? print_irqtrace_events+0x270/0x270 [ 245.023514] ? print_irqtrace_events+0x270/0x270 [ 245.028253] ? copy_overflow+0x20/0x20 [ 245.032128] ? __lock_acquire+0x664/0x3e00 [ 245.036338] ? __lock_acquire+0x664/0x3e00 [ 245.040546] ? __sched_text_start+0x8/0x8 [ 245.044669] ? check_noncircular+0x20/0x20 [ 245.048886] ? debug_check_no_locks_freed+0x3c0/0x3c0 [ 245.054051] ? debug_check_no_locks_freed+0x3c0/0x3c0 [ 245.059216] ? find_held_lock+0x35/0x1d0 [ 245.063258] ? __handle_mm_fault+0x3296/0x3ce0 [ 245.067815] ? lock_downgrade+0x980/0x980 [ 245.071939] ? lock_release+0xa40/0xa40 [ 245.075889] ? do_raw_spin_trylock+0x190/0x190 [ 245.080442] ? userfaultfd_ctx_put+0x720/0x720 [ 245.085012] __handle_mm_fault+0x32a3/0x3ce0 [ 245.089403] ? __pmd_alloc+0x4e0/0x4e0 [ 245.093262] ? check_noncircular+0x20/0x20 [ 245.097469] ? refill_pi_state_cache.part.6+0x2f0/0x2f0 [ 245.102812] ? find_held_lock+0x35/0x1d0 [ 245.106851] ? handle_mm_fault+0x2a0/0x930 [ 245.111058] ? lock_downgrade+0x980/0x980 [ 245.115200] handle_mm_fault+0x38f/0x930 [ 245.119235] ? __handle_mm_fault+0x3ce0/0x3ce0 [ 245.123787] ? vmacache_find+0x5f/0x280 [ 245.127737] ? find_vma+0x30/0x150 [ 245.131254] __do_page_fault+0x5c9/0xc90 [ 245.135305] ? mm_fault_error+0x2c0/0x2c0 [ 245.139431] ? check_noncircular+0x20/0x20 [ 245.143644] do_page_fault+0xee/0x720 [ 245.147419] ? __do_page_fault+0xc90/0xc90 [ 245.151638] ? find_held_lock+0x35/0x1d0 [ 245.155678] ? __might_fault+0x110/0x1d0 [ 245.159715] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 245.164544] page_fault+0x2c/0x60 [ 245.167978] RIP: 0010:copy_user_generic_unrolled+0x86/0xc0 [ 245.173572] RSP: 0018:ffff8801b89cfbc8 EFLAGS: 00010202 [ 245.178906] RAX: ffffed0037139fa2 RBX: 0000000020012fc0 RCX: 0000000000000001 [ 245.186149] RDX: 0000000000000000 RSI: 0000000020012fc0 RDI: ffff8801b89cfd08 [ 245.193400] RBP: ffff8801b89cfbf8 R08: ffffed0037139fa2 R09: ffffed0037139fa2 [ 245.200645] R10: 0000000000000001 R11: ffffed0037139fa1 R12: 0000000000000008 [ 245.207894] R13: ffff8801b89cfd08 R14: 00007ffffffff000 R15: 0000000020012fc8 [ 245.215162] ? _copy_from_user+0xc5/0x110 [ 245.219285] core_sys_select+0x397/0x960 [ 245.223332] ? poll_select_set_timeout+0x210/0x210 [ 245.228247] ? kvm_clock_get_cycles+0x25/0x30 [ 245.232722] ? timespec64_add_safe+0x1bb/0x2c0 [ 245.237279] ? nsec_to_clock_t+0x30/0x30 [ 245.241315] ? vm_mmap_pgoff+0x1fc/0x280 [ 245.245349] ? vm_mmap_pgoff+0x13b/0x280 [ 245.249388] ? poll_select_set_timeout+0x12f/0x210 [ 245.254297] ? do_restart_poll+0x2a0/0x2a0 [ 245.258508] ? kasan_check_write+0x14/0x20 [ 245.262720] SyS_select+0x194/0x230 [ 245.266323] ? core_sys_select+0x960/0x960 [ 245.270531] ? entry_SYSCALL_64_fastpath+0x5/0xa0 [ 245.275351] ? trace_hardirqs_on_caller+0x421/0x5c0 [ 245.280343] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 245.285081] entry_SYSCALL_64_fastpath+0x29/0xa0 [ 245.289810] RIP: 0033:0x453299 [ 245.292970] RSP: 002b:00007fe2f143cc58 EFLAGS: 00000212 ORIG_RAX: 0000000000000017 [ 245.300661] RAX: ffffffffffffffda RBX: 000000000071bf58 RCX: 0000000000453299 [ 245.307906] RDX: 0000000020011000 RSI: 0000000020012fc0 RDI: 0000000000000040 [ 245.315154] RBP: 00000000000003d6 R08: 0000000020001311 R09: 0000000000000000 2018/02/01 16:23:19 executing program 1: mmap(&(0x7f0000000000/0xe000)=nil, 0xe000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000006000)={0xaa}) mprotect(&(0x7f0000003000/0x4000)=nil, 0x4000, 0x1) ioctl$UFFDIO_REGISTER(r0, 0x8010aa01, &(0x7f0000007000-0x4)={{&(0x7f0000009000/0x4000)=nil, 0x4000}}) 2018/02/01 16:23:19 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x2, &(0x7f0000691000-0x4)=0x79, 0x4) bind$inet(0xffffffffffffffff, &(0x7f0000887000-0x10)={0x2, 0x3, @broadcast=0xffffffff}, 0x10) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x8, &(0x7f0000cd5000-0x4), 0x4) sendto$inet(0xffffffffffffffff, &(0x7f0000d5a000-0x73), 0xfffffc6c, 0x20000804, &(0x7f0000e1e000)={0x2, 0x3, @loopback=0x7f000001}, 0x10) readv(0xffffffffffffffff, &(0x7f00007d7000-0x50)=[{&(0x7f0000b7e000)=""/4096, 0x1000}], 0x1) 2018/02/01 16:23:19 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x2, 0x0) setsockopt$inet_mreqn(r0, 0x0, 0x23, &(0x7f0000282000)={@multicast2=0xe0000002, @multicast1=0xe0000001, 0x2}, 0xc) setsockopt$inet_mreqsrc(r0, 0x0, 0x27, &(0x7f00004bd000)={@multicast1=0xe0000001, @loopback=0x7f000001, @multicast1=0xe0000001}, 0xc) ioctl$sock_inet_SIOCRTMSG(0xffffffffffffffff, 0x890d, &(0x7f0000283000)={0x0, {0x2, 0x0, @multicast2=0xe0000002}, {0x2, 0x0, @multicast1=0xe0000001}, {0x2, 0x0, @loopback=0x7f000001}}) getsockopt$inet_buf(r0, 0x0, 0x30, &(0x7f0000283000)=""/144, &(0x7f0000001000-0x4)=0x90) 2018/02/01 16:23:19 executing program 4: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x0, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)={0xaa}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) fchmodat(0xffffffffffffffff, &(0x7f0000012000)='./file0\x00', 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r1 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12, 0x0, @tid}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r1, 0x15) ioctl$UFFDIO_ZEROPAGE(r0, 0x8010aa02, &(0x7f00000c1000-0x10)={&(0x7f0000011000/0x3000)=nil, 0x3000}) 2018/02/01 16:23:19 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000009000-0x30)={0x4c, 0x0, &(0x7f0000452000-0x4c)=[@transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f0000b5b000-0x50)=[@ptr={0x70742a85, 0x1, &(0x7f00003df000), 0x1}], &(0x7f0000788000-0x20)=[0x0, 0x28]}, 0x1000}}], 0x0, 0x0, &(0x7f0000009000)}) 2018/02/01 16:23:19 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000014000-0xd)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_RUNNING_MODE(r0, 0xc0105303, &(0x7f0000994000-0x10)={0x3ad}) 2018/02/01 16:23:19 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x3, @broadcast=0xffffffff}, 0x10) sendto$inet(r0, &(0x7f0000fd0000), 0x0, 0x200007ff, &(0x7f0000deb000-0x10)={0x2, 0x3, @loopback=0x7f000001}, 0x10) shutdown(r0, 0x1) poll(&(0x7f0000b6e000)=[{r0}], 0x1, 0x0) 2018/02/01 16:23:19 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000004000)={0x4, 0x0, &(0x7f000000d000-0x70)=[@enter_looper={0x630c}], 0x0, 0x0, &(0x7f0000005000)}) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000-0x30)={0x0, 0x0, &(0x7f0000004000)=[], 0x48, 0x0, &(0x7f000000d000)="62164b44a5c310affb2298c023c7036e8915400419dae89cc59e3878ffffff00000000f7d7000003000000070718d1fc0e41a052600c828100000000000000bf244f0f2cc508303a"}) mmap$binder(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x0, 0x12, r0, 0x0) clone(0x0, &(0x7f0000df0000-0x4b), &(0x7f0000ab4000), &(0x7f00007bf000), &(0x7f0000535000)) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000006000-0x2c)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f0000002000)}) 2018/02/01 16:23:19 executing program 4: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x0, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)={0xaa}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) fchmodat(0xffffffffffffffff, &(0x7f0000012000)='./file0\x00', 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r1 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12, 0x0, @tid}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r1, 0x15) ioctl$UFFDIO_ZEROPAGE(r0, 0x8010aa02, &(0x7f00000c1000-0x10)={&(0x7f0000011000/0x3000)=nil, 0x3000}) 2018/02/01 16:23:19 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000009000-0x30)={0x0, 0x0, &(0x7f0000452000-0x4c)=[], 0x0, 0x0, &(0x7f0000009000)}) 2018/02/01 16:23:19 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x2, &(0x7f0000691000-0x4)=0x79, 0x4) bind$inet(0xffffffffffffffff, &(0x7f0000887000-0x10)={0x2, 0x3, @broadcast=0xffffffff}, 0x10) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x8, &(0x7f0000cd5000-0x4), 0x4) sendto$inet(0xffffffffffffffff, &(0x7f0000d5a000-0x73), 0xfffffc6c, 0x20000804, &(0x7f0000e1e000)={0x2, 0x3, @loopback=0x7f000001}, 0x10) readv(0xffffffffffffffff, &(0x7f00007d7000-0x50)=[{&(0x7f0000b7e000)=""/4096, 0x1000}], 0x1) [ 245.322396] R10: 0000000020001fc0 R11: 0000000000000212 R12: 00000000006f4cb0 [ 245.329640] R13: 00000000ffffffff R14: 00007fe2f143d6d4 R15: 0000000000000007 [ 245.364812] binder: BINDER_SET_CONTEXT_MGR already set 2018/02/01 16:23:19 executing program 5: clock_gettime(0x400000000000005, &(0x7f0000a12000)) 2018/02/01 16:23:19 executing program 7: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)={0xaa}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000012000/0x2000)=nil, 0x2000}, 0x1}) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x0) write$sndseq(r1, &(0x7f0000012000-0x2e)=[{0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @connect}], 0x30) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) unlink(&(0x7f00006ec000)='./file0\x00') umount2(&(0x7f00001f8000)='./file1\x00', 0x0) link(&(0x7f0000903000)='./file0\x00', &(0x7f0000118000)='./file2\x00') ioctl$UFFDIO_ZEROPAGE(r0, 0x8010aa02, &(0x7f0000002000-0x10)={&(0x7f0000011000/0x3000)=nil, 0x3000}) 2018/02/01 16:23:19 executing program 2: mmap(&(0x7f0000000000/0x13000)=nil, 0x13000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000002000)={&(0x7f0000008000)={0x10}, 0xc, &(0x7f0000006000-0x10)={&(0x7f0000004000-0x1a4)=@flushpolicy={0x1c, 0x1d, 0x719, 0xffffffffffffffff, 0xffffffffffffffff, "", [@policy_type={0xc, 0x10}]}, 0x1c}, 0x1}, 0x0) 2018/02/01 16:23:19 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000009000-0x30)={0x0, 0x0, &(0x7f0000452000-0x4c)=[], 0x0, 0x0, &(0x7f0000009000)}) 2018/02/01 16:23:19 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x2, &(0x7f0000691000-0x4)=0x79, 0x4) bind$inet(0xffffffffffffffff, &(0x7f0000887000-0x10)={0x2, 0x3, @broadcast=0xffffffff}, 0x10) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x8, &(0x7f0000cd5000-0x4), 0x4) sendto$inet(0xffffffffffffffff, &(0x7f0000d5a000-0x73), 0xfffffc6c, 0x20000804, &(0x7f0000e1e000)={0x2, 0x3, @loopback=0x7f000001}, 0x10) readv(0xffffffffffffffff, &(0x7f00007d7000-0x50)=[{&(0x7f0000b7e000)=""/4096, 0x1000}], 0x1) 2018/02/01 16:23:19 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$tun(&(0x7f0000e9b000+0x18a)='/dev/net/tun\x00', 0x0, 0x20001) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000a5b000-0x28)={@common='gre0\x00', @ifru_names=@generic="4f54000cc0a1ed4f3a0a1fdc222073b5"}) write$tun(r0, &(0x7f0000e70000-0x89)=@hdr={0xfffffffffffffffd, 0x83, 0x0, 0x0, 0xfffffffffffffffe, 0x0, @ipv4={{0x5, 0x4, 0x0, 0x0, 0x30, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast2=0xe0000002, {[]}}, @icmp=@source_quench={0x4, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @rand_addr, @loopback=0x7f000001, {[]}}}}}, 0x3a) 2018/02/01 16:23:19 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_group_source_req(r0, 0x29, 0x2e, &(0x7f0000001000)={0x1, {{0xa, 0xffffffffffffffff, 0x0, @mcast2={0xff, 0x2, [], 0x1}}}, {{0xa, 0xffffffffffffffff, 0x0, @local={0xfe, 0x80, [], 0xffffffffffffffff, 0xaa}}}}, 0x108) r1 = syz_open_procfs(0x0, &(0x7f000012c000-0xe)='net/mcfilter6\x00') preadv(r1, &(0x7f0000c86000-0x40)=[{&(0x7f00003e6000-0x1000)=""/4096, 0x1000}], 0x10000000000001b7, 0x400000000) 2018/02/01 16:23:19 executing program 4: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x0, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)={0xaa}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) fchmodat(0xffffffffffffffff, &(0x7f0000012000)='./file0\x00', 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r1 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12, 0x0, @tid}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r1, 0x15) ioctl$UFFDIO_ZEROPAGE(r0, 0x8010aa02, &(0x7f00000c1000-0x10)={&(0x7f0000011000/0x3000)=nil, 0x3000}) [ 245.396211] binder: 1062:1066 ioctl 40046207 0 returned -16 [ 245.407313] binder_alloc: 1071: binder_alloc_buf failed to map pages in userspace, no vma 2018/02/01 16:23:19 executing program 2: mmap(&(0x7f0000000000/0xa000)=nil, 0xa000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = gettid() rt_tgsigqueueinfo(r0, r0, 0x0, &(0x7f0000001000-0x10)={0x0, 0x0, 0xfffffffffffffeff}) 2018/02/01 16:23:19 executing program 6: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x2, &(0x7f0000691000-0x4)=0x79, 0x4) bind$inet(r0, &(0x7f0000887000-0x10)={0x2, 0x3, @broadcast=0xffffffff}, 0x10) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000cd5000-0x4), 0x4) sendto$inet(r0, &(0x7f0000d5a000-0x73), 0xfffffc6c, 0x20000804, &(0x7f0000e1e000)={0x2, 0x3, @loopback=0x7f000001}, 0x10) readv(r0, &(0x7f00007d7000-0x50)=[{&(0x7f0000b7e000)=""/4096, 0x1000}], 0x1) 2018/02/01 16:23:19 executing program 4: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)={0xaa}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) fchmodat(0xffffffffffffffff, &(0x7f0000012000)='./file0\x00', 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r1 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12, 0x0, @tid}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r1, 0x15) ioctl$UFFDIO_ZEROPAGE(r0, 0x8010aa02, &(0x7f00000c1000-0x10)={&(0x7f0000011000/0x3000)=nil, 0x3000}) 2018/02/01 16:23:19 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000009000-0x30)={0x0, 0x0, &(0x7f0000452000-0x4c)=[], 0x0, 0x0, &(0x7f0000009000)}) [ 245.407338] binder: 1062:1074 transaction failed 29189/-3, size 0-0 line 2903 [ 245.453434] binder: BINDER_SET_CONTEXT_MGR already set [ 245.453444] binder: 1083:1088 ioctl 40046207 0 returned -16 2018/02/01 16:23:19 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00008d8000)='net/arp\x00') r1 = syz_open_dev$sndseq(&(0x7f0000fd9000)='/dev/snd/seq\x00', 0x0, 0x42102) sendfile(r1, r0, &(0x7f00003e1000), 0x3ff) 2018/02/01 16:23:19 executing program 6: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x2, &(0x7f0000691000-0x4)=0x79, 0x4) bind$inet(r0, &(0x7f0000887000-0x10)={0x2, 0x3, @broadcast=0xffffffff}, 0x10) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000cd5000-0x4), 0x4) sendto$inet(r0, &(0x7f0000d5a000-0x73), 0xfffffc6c, 0x20000804, &(0x7f0000e1e000)={0x2, 0x3, @loopback=0x7f000001}, 0x10) readv(r0, &(0x7f00007d7000-0x50)=[{&(0x7f0000b7e000)=""/4096, 0x1000}], 0x1) 2018/02/01 16:23:19 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$loop(&(0x7f00000fb000-0xb)='/dev/loop#\x00', 0x0, 0x4000000006) getresuid(&(0x7f0000012000-0x4), &(0x7f000001a000), &(0x7f000002a000)) close(r0) r1 = socket$inet6(0xa, 0x2, 0x73) connect(r1, &(0x7f0000ee2000-0x80)=@generic={0xa, "81bd44df84835b2aebfac37525addb13cb8a2ab46eed7e6b9ab0ff990055d8cd349dcd4a929ba55f82fac4af14ad70196eece587c480a5d691ef069a010236f201389c28e806823a89249cb6afd3eb39b23a520caa5ea398413b8a55b342c039d75b9345d04983cb12e1876e7fc3fd42d40e5347a46a0cc17353eeef7a08"}, 0x80) perf_event_open(&(0x7f000001d000)={0x2, 0x78, 0x9eb5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x8, 0x10000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000dc0000)='/dev/sequencer2\x00', 0x0, 0x0) stat(&(0x7f000087e000-0x8)='./file0\x00', &(0x7f0000ee4000)={0x0, 0x0, 0x0, 0x0, 0x0}) lstat(&(0x7f0000867000-0x8)='./file0\x00', &(0x7f0000dc0000-0x44)={0x0, 0x0, 0x0, 0x0, 0x0}) setreuid(r2, r3) r4 = socket(0x20000000000000a, 0x2, 0x0) sendmmsg$inet_sctp(r4, &(0x7f00007b3000-0x118)=[{&(0x7f0000c5e000)=@in6={0xa, 0x3, 0x0, @remote={0xfe, 0x80, [], 0xffffffffffffffff, 0xbb}}, 0x1c, &(0x7f0000a62000-0x30)=[], 0x0, &(0x7f00001dd000)=[@sndrcv={0x30, 0x84, 0x1}, @sndrcv={0x30, 0x84, 0x1}], 0x60}], 0x1, 0x0) 2018/02/01 16:23:19 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000ae4000-0xd)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_NEXT_PORT(r0, 0xc0a85352, &(0x7f0000d8c000-0xb0)={{0x0, 0x9}, 'port0\x00'}) 2018/02/01 16:23:19 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) unshare(0x4040400) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(&(0x7f00007a4000-0x8)='./file0\x00', &(0x7f00004f6000-0x8)='./file0\x00', &(0x7f00000e1000)='ramfs\x00', 0x8409, &(0x7f0000c82000-0x2)) r0 = openat(0xffffffffffffff9c, &(0x7f0000013000-0x8)='./file0\x00', 0x0, 0x0) fchown(r0, 0x0, 0x0) 2018/02/01 16:23:19 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000009000-0x30)={0x4c, 0x0, &(0x7f0000452000-0x4c)=[@transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, &(0x7f0000b5b000-0x50)=[], &(0x7f0000788000-0x20)=[0x0, 0x28]}, 0x1000}}], 0x0, 0x0, &(0x7f0000009000)}) 2018/02/01 16:23:19 executing program 4: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)={0xaa}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) fchmodat(0xffffffffffffffff, &(0x7f0000012000)='./file0\x00', 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r1 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12, 0x0, @tid}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r1, 0x15) ioctl$UFFDIO_ZEROPAGE(r0, 0x8010aa02, &(0x7f00000c1000-0x10)={&(0x7f0000011000/0x3000)=nil, 0x3000}) 2018/02/01 16:23:19 executing program 7: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)={0xaa}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000012000/0x2000)=nil, 0x2000}, 0x1}) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x0) write$sndseq(r1, &(0x7f0000012000-0x2e)=[{0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @connect}], 0x30) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) unlink(&(0x7f00006ec000)='./file0\x00') umount2(&(0x7f00001f8000)='./file1\x00', 0x0) link(&(0x7f0000903000)='./file0\x00', &(0x7f0000118000)='./file2\x00') ioctl$UFFDIO_ZEROPAGE(r0, 0x8010aa02, &(0x7f0000002000-0x10)={&(0x7f0000011000/0x3000)=nil, 0x3000}) [ 245.498210] binder: BINDER_SET_CONTEXT_MGR already set [ 245.498219] binder: 1105:1109 ioctl 40046207 0 returned -16 [ 245.526953] binder: undelivered TRANSACTION_ERROR: 29189 2018/02/01 16:23:19 executing program 6: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x2, &(0x7f0000691000-0x4)=0x79, 0x4) bind$inet(r0, &(0x7f0000887000-0x10)={0x2, 0x3, @broadcast=0xffffffff}, 0x10) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000cd5000-0x4), 0x4) sendto$inet(r0, &(0x7f0000d5a000-0x73), 0xfffffc6c, 0x20000804, &(0x7f0000e1e000)={0x2, 0x3, @loopback=0x7f000001}, 0x10) readv(r0, &(0x7f00007d7000-0x50)=[{&(0x7f0000b7e000)=""/4096, 0x1000}], 0x1) 2018/02/01 16:23:19 executing program 4: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)={0xaa}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) fchmodat(0xffffffffffffffff, &(0x7f0000012000)='./file0\x00', 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r1 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12, 0x0, @tid}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r1, 0x15) ioctl$UFFDIO_ZEROPAGE(r0, 0x8010aa02, &(0x7f00000c1000-0x10)={&(0x7f0000011000/0x3000)=nil, 0x3000}) 2018/02/01 16:23:19 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x0, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x2, &(0x7f0000691000-0x4)=0x79, 0x4) bind$inet(r0, &(0x7f0000887000-0x10)={0x2, 0x3, @broadcast=0xffffffff}, 0x10) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000cd5000-0x4), 0x4) sendto$inet(r0, &(0x7f0000d5a000-0x73), 0xfffffc6c, 0x20000804, &(0x7f0000e1e000)={0x2, 0x3, @loopback=0x7f000001}, 0x10) readv(r0, &(0x7f00007d7000-0x50)=[{&(0x7f0000b7e000)=""/4096, 0x1000}], 0x1) 2018/02/01 16:23:19 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000983000)='comm\x00') mmap(&(0x7f0000000000/0xff7000)=nil, 0xff7000, 0x1, 0x32, 0xffffffffffffffff, 0x0) write$fuse(r0, &(0x7f00006a0000)={0x18, 0x0, 0x0, @fuse_bmap_out}, 0x18) 2018/02/01 16:23:19 executing program 1: mmap(&(0x7f0000000000/0x12000)=nil, 0x12000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket(0x18, 0x0, 0x1) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(0xffffffffffffffff, 0x6, 0x16, &(0x7f0000002000)=[{}, {}, {}, {}, {0x1}], 0x5) sendmmsg(0xffffffffffffffff, &(0x7f0000005000)=[{{&(0x7f0000007000)=@in6={0xa, 0xffffffffffffffff, 0x0, @remote={0xfe, 0x80, [], 0xffffffffffffffff, 0xbb}}, 0x1c, &(0x7f0000005000-0x60)=[{&(0x7f0000002000)="4c5614c00401a0dbf8a669ebdedd102c4f7a79e606457dfdf09e2ec2ed253b", 0x1f}], 0x1, &(0x7f0000009000-0x438)=[]}}], 0x1, 0x0) connect(r0, &(0x7f0000002000)=@sco={0x1f, {0x1}}, 0x26) ioctl$SIOCGIFMTU(r0, 0x8921, &(0x7f0000007000-0x28)={@generic}) [ 245.602169] binder: 1123:1134 got transaction with invalid offset (0, min 0 max 0) or object. [ 245.639070] binder: 1123:1134 transaction failed 29201/-22, size 0-16 line 2966 [ 245.657137] binder: undelivered TRANSACTION_ERROR: 29201 2018/02/01 16:23:20 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003ba000-0x24)) r1 = syz_open_pts(r0, 0x0) dup2(r1, r0) ioctl$TIOCNXCL(r1, 0x540d) 2018/02/01 16:23:20 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000009000-0x30)={0x4c, 0x0, &(0x7f0000452000-0x4c)=[@transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, &(0x7f0000b5b000-0x50)=[], &(0x7f0000788000-0x20)=[0x0, 0x28]}, 0x1000}}], 0x0, 0x0, &(0x7f0000009000)}) 2018/02/01 16:23:20 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x0, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x2, &(0x7f0000691000-0x4)=0x79, 0x4) bind$inet(r0, &(0x7f0000887000-0x10)={0x2, 0x3, @broadcast=0xffffffff}, 0x10) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000cd5000-0x4), 0x4) sendto$inet(r0, &(0x7f0000d5a000-0x73), 0xfffffc6c, 0x20000804, &(0x7f0000e1e000)={0x2, 0x3, @loopback=0x7f000001}, 0x10) readv(r0, &(0x7f00007d7000-0x50)=[{&(0x7f0000b7e000)=""/4096, 0x1000}], 0x1) 2018/02/01 16:23:20 executing program 4: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)={0xaa}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) fchmodat(0xffffffffffffffff, &(0x7f0000012000)='./file0\x00', 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r1 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12, 0x0, @tid}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r1, 0x15) ioctl$UFFDIO_ZEROPAGE(r0, 0x8010aa02, &(0x7f00000c1000-0x10)={&(0x7f0000011000/0x3000)=nil, 0x3000}) 2018/02/01 16:23:20 executing program 5: getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffff9c, 0x29, 0x23, &(0x7f0000b9d000-0x96)={{{@in=@remote={0x0, 0x0, 0x0}, @in=@empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, {}, {}, 0x0, 0x0}, {{@in6=@local={0x0, 0x0, [], 0x0}, 0x0}, 0x0, @in=@multicast1, 0x0}}, &(0x7f0000669000)=0xe8) setuid(r0) 2018/02/01 16:23:20 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000993000)='cmdline\x00') pread64(r0, &(0x7f00009d8000), 0x0, 0x0) 2018/02/01 16:23:20 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000045000-0x8)={0xffffffffffffffff, 0xffffffffffffffff}) bind$unix(r0, &(0x7f000055b000)=@file={0x1, './file0\x00'}, 0xa) connect$unix(r0, &(0x7f0000c7e000-0x8)=@abs, 0x8) sendmmsg$unix(r1, &(0x7f00000bd000)=[], 0x80, 0x0) connect$unix(r0, &(0x7f00003de000)=@file={0x1, './file0\x00'}, 0xa) connect$unix(r0, &(0x7f0000681000)=@abs, 0x8) 2018/02/01 16:23:20 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$loop(&(0x7f00000fb000-0xb)='/dev/loop#\x00', 0x0, 0x4000000006) getresuid(&(0x7f0000012000-0x4), &(0x7f000001a000), &(0x7f000002a000)) close(r0) r1 = socket$inet6(0xa, 0x2, 0x73) connect(r1, &(0x7f0000ee2000-0x80)=@generic={0xa, "81bd44df84835b2aebfac37525addb13cb8a2ab46eed7e6b9ab0ff990055d8cd349dcd4a929ba55f82fac4af14ad70196eece587c480a5d691ef069a010236f201389c28e806823a89249cb6afd3eb39b23a520caa5ea398413b8a55b342c039d75b9345d04983cb12e1876e7fc3fd42d40e5347a46a0cc17353eeef7a08"}, 0x80) perf_event_open(&(0x7f000001d000)={0x2, 0x78, 0x9eb5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x8, 0x10000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000dc0000)='/dev/sequencer2\x00', 0x0, 0x0) stat(&(0x7f000087e000-0x8)='./file0\x00', &(0x7f0000ee4000)={0x0, 0x0, 0x0, 0x0, 0x0}) lstat(&(0x7f0000867000-0x8)='./file0\x00', &(0x7f0000dc0000-0x44)={0x0, 0x0, 0x0, 0x0, 0x0}) setreuid(r2, r3) r4 = socket(0x20000000000000a, 0x2, 0x0) sendmmsg$inet_sctp(r4, &(0x7f00007b3000-0x118)=[{&(0x7f0000c5e000)=@in6={0xa, 0x3, 0x0, @remote={0xfe, 0x80, [], 0xffffffffffffffff, 0xbb}}, 0x1c, &(0x7f0000a62000-0x30)=[], 0x0, &(0x7f00001dd000)=[@sndrcv={0x30, 0x84, 0x1}, @sndrcv={0x30, 0x84, 0x1}], 0x60}], 0x1, 0x0) 2018/02/01 16:23:20 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x0, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x2, &(0x7f0000691000-0x4)=0x79, 0x4) bind$inet(r0, &(0x7f0000887000-0x10)={0x2, 0x3, @broadcast=0xffffffff}, 0x10) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000cd5000-0x4), 0x4) sendto$inet(r0, &(0x7f0000d5a000-0x73), 0xfffffc6c, 0x20000804, &(0x7f0000e1e000)={0x2, 0x3, @loopback=0x7f000001}, 0x10) readv(r0, &(0x7f00007d7000-0x50)=[{&(0x7f0000b7e000)=""/4096, 0x1000}], 0x1) [ 245.755933] binder: 1161:1169 got transaction with invalid offset (0, min 0 max 0) or object. [ 245.787961] binder: 1161:1169 transaction failed 29201/-22, size 0-16 line 2966 2018/02/01 16:23:20 executing program 4: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)={0xaa}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) fchmodat(0xffffffffffffffff, &(0x7f0000012000)='./file0\x00', 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r1 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12, 0x0, @tid}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r1, 0x15) ioctl$UFFDIO_ZEROPAGE(r0, 0x8010aa02, &(0x7f00000c1000-0x10)={&(0x7f0000011000/0x3000)=nil, 0x3000}) 2018/02/01 16:23:20 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r0, &(0x7f0000616000)={0x2, 0x2, @rand_addr}, 0x10) r1 = socket$inet(0x2, 0x2, 0x0) bind$inet(r1, &(0x7f0000e96000-0x10)={0x2, 0x2, @rand_addr=0x4}, 0x10) 2018/02/01 16:23:20 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCDARP(r0, 0x8953, &(0x7f000067c000-0x44)={{0x2, 0xffffffffffffffff, @empty}, {0x0, @link_local={0x1, 0x80, 0xc2}}, 0x8, {0x2, 0xffffffffffffffff, @local={0xac, 0x14, 0xffffffffffffffff, 0xaa}}, @syzn={0x73, 0x79, 0x7a, 0x0}}) 2018/02/01 16:23:20 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f000001c000-0x38)={&(0x7f00007a9000)={0x10}, 0xc, &(0x7f0000835000)={&(0x7f0000352000)=@ipv6_newroute={0x2c, 0x18, 0x501, 0xffffffffffffffff, 0xffffffffffffffff, {0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}, [@RTA_METRICS={0x10, 0x8, "0600000000000000c3"}]}, 0x2c}, 0x1}, 0x0) 2018/02/01 16:23:20 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x2, &(0x7f0000691000-0x4)=0x79, 0x4) bind$inet(r0, &(0x7f0000887000-0x10)={0x2, 0x3, @broadcast=0xffffffff}, 0x10) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000cd5000-0x4), 0x4) sendto$inet(r0, &(0x7f0000d5a000-0x73), 0xfffffc6c, 0x20000804, &(0x7f0000e1e000)={0x2, 0x3, @loopback=0x7f000001}, 0x10) readv(r0, &(0x7f00007d7000-0x50)=[{&(0x7f0000b7e000)=""/4096, 0x1000}], 0x1) 2018/02/01 16:23:20 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000009000-0x30)={0x4c, 0x0, &(0x7f0000452000-0x4c)=[@transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, &(0x7f0000b5b000-0x50)=[], &(0x7f0000788000-0x20)=[0x0, 0x28]}, 0x1000}}], 0x0, 0x0, &(0x7f0000009000)}) 2018/02/01 16:23:20 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00001b5000-0xa)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCGETD(r0, 0x5424, &(0x7f0000e8a000-0x4)) 2018/02/01 16:23:20 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndseq(&(0x7f000005f000)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f000002a000-0xb0)={{0x80}, "0a4ceaa05dad126e00000002a1569b3fd4cec307e8ef3d13eb790ec9c65abb110d229db692542e5b78f8b29e0a27800f0000000000000009fb42d576589701a4"}) ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO(r0, 0x40a85323, &(0x7f000005c000)={{0x80}, "55754b1d8d5053f16af6ea3fc35236f55cf1b51d515bf6f2beddb0658891107582435f79c807b4a55dd620119fa6888159c8c15446978f1696e8a41af565265c"}) [ 245.808346] binder: undelivered TRANSACTION_ERROR: 29201 2018/02/01 16:23:20 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x2, &(0x7f0000691000-0x4)=0x79, 0x4) bind$inet(r0, &(0x7f0000887000-0x10)={0x2, 0x3, @broadcast=0xffffffff}, 0x10) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000cd5000-0x4), 0x4) sendto$inet(r0, &(0x7f0000d5a000-0x73), 0xfffffc6c, 0x20000804, &(0x7f0000e1e000)={0x2, 0x3, @loopback=0x7f000001}, 0x10) readv(r0, &(0x7f00007d7000-0x50)=[{&(0x7f0000b7e000)=""/4096, 0x1000}], 0x1) 2018/02/01 16:23:20 executing program 3: mmap(&(0x7f0000000000/0xdf7000)=nil, 0xdf7000, 0x3, 0x32, 0xffffffffffffffff, 0x0) setsockopt$inet6_MRT6_ADD_MFC(0xffffffffffffffff, 0x29, 0xcc, &(0x7f000001b000-0x5c)={{0xa, 0x0, 0x0, @local={0xfe, 0x80, [], 0x0, 0xaa}, 0x6}, {0xa, 0x3, 0x5, @local={0xfe, 0x80, [], 0x0, 0xaa}}, 0x0, [0x0, 0x0, 0x0, 0x80400000000, 0x0, 0x0, 0x81, 0x5]}, 0x5c) pipe(&(0x7f0000a7e000-0x6)={0x0, 0x0}) accept$unix(r0, &(0x7f0000df1000)=@file={0x0, ""/4096}, &(0x7f0000c1e000)=0x1002) r1 = socket$inet6(0xa, 0x1, 0xaf) ioctl$sock_ifreq(r1, 0x896f, &(0x7f0000282000)={@syzn={0x73, 0x79, 0x7a, 0x0}, @ifru_ivalue=0x1}) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r0, 0xc00c642e, &(0x7f000088c000-0xc)={0x0, 0x80000, r0}) ioctl$DRM_IOCTL_GEM_OPEN(r0, 0xc010640b, &(0x7f0000df4000)={0x0, r2, 0xbd}) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r3, 0xc00c642d, &(0x7f0000d97000)={r4, 0x80000, r0}) r5 = socket$inet(0x2, 0x80001, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r5, 0x8914, &(0x7f000003b000)={@common='lo\x00', @ifru_flags=0xfffffffffffffffd}) r6 = socket$inet_tcp(0x2, 0x1, 0x0) r7 = socket$inet6_dccp(0xa, 0x6, 0x0) setsockopt$sock_linger(r6, 0x1, 0xd, &(0x7f0000df6000)={0x1, 0x4c}, 0x8) bind$inet(r6, &(0x7f0000dec000)={0x2, 0x0, @loopback=0x7f000001}, 0x10) getsockopt$sock_buf(r6, 0x1, 0x1a, &(0x7f0000dee000), &(0x7f0000dee000)) setsockopt$inet_tcp_int(r6, 0x6, 0x200000000000a, &(0x7f0000425000)=0x1000, 0x4) getsockopt$inet_sctp_SCTP_I_WANT_MAPPED_V4_ADDR(r5, 0x84, 0xc, &(0x7f000081d000), &(0x7f00002f4000-0x4)=0x4) setsockopt$inet_sctp_SCTP_DEFAULT_SNDINFO(r5, 0x84, 0x22, &(0x7f00007ee000)={0x8000, 0x204, 0xffffff7ffffffff8, 0x3}, 0x10) sendto$inet(r6, &(0x7f0000de2000-0x1)='U', 0x1, 0x20008045, &(0x7f0000db5000-0x10)={0x2, 0x0, @loopback=0x7f000001}, 0x10) ioctl$sock_SIOCGIFBR(r6, 0x8940, &(0x7f0000de9000-0x18)=@add_del={0x2, &(0x7f000092e000)=@common='ip6_vti0\x00', 0x3}) setsockopt$sock_int(r6, 0x1, 0x20001000000004, &(0x7f0000361000-0x4)=0x100000, 0x4) getsockopt$inet6_IPV6_IPSEC_POLICY(r7, 0x29, 0x22, &(0x7f0000de9000-0xe8)={{{@in=@remote={0x0, 0x0, 0x0}, @in6=@loopback, 0x0, 0x0, 0x0}, {}, {}, 0x0, 0x0}, {{@in6=@remote={0x0, 0x0, [], 0x0}, 0x0}, 0x0, @in=@multicast1, 0x0}}, &(0x7f0000de9000)=0xe8) setsockopt$inet_sctp_SCTP_I_WANT_MAPPED_V4_ADDR(r5, 0x84, 0xc, &(0x7f0000dec000)=0x5, 0x4) pipe(&(0x7f0000de9000)) getsockname(r6, &(0x7f0000deb000-0x14)=@ll={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @empty}, &(0x7f0000deb000-0x4)=0x14) setsockopt$SO_BINDTODEVICE(r5, 0x1, 0x19, &(0x7f0000c51000-0xe)=@generic="fd5f6f5eebc841c763ec6807a0da1a1a", 0x10) sendto$inet(r6, &(0x7f0000261000-0x1000)="11a58fde7649496403db92ed306004b3d3cbfc195485c3b895d864ab91a3aebde4f70a917a91ec9612d004000a7b43a35bb73249ede41bf5c05ab608fb7b74ffd57f6e8e43cf9cb723fc0d8d8cabbbbae3a5fde8ad6f52d667c512596f50b9962aa2193688d872a7eeca57801742d74d39c4b003a5e292e077ed102e7999329aab95a3d96363505f76c86a6d2352dd8025207ae531701f1ce353d6b017eb64000000bc2e9f8b66fe4a8e64f0fc7a0aa55d4103e1d7d5b0dd5750071e9b3a786021678a86fcbb0b9f9364ec0f0310306fef9c21b3b20d8b44423b495299cea2c6f40c377a72534453ad7f5af27b1efb2514ace1f9a68cf205a9ddb8fd954e34bde3612e6e05686cf3b968a14bd3a356f7b8d20214c0f7a388ef5ea8d063c65f2aabff685e69f86b4a0b3697f8bfbfe66796f0489ad2e49bdbc1742941c28c88cb93e1f8ccc3db4782cdf9cbd797ddc8d7b1364da50ad48e081a38622280169eba09000000b5f15bdf8a8b6483340a3297c31154905db209195c28f15d10153204fbe0586516c714ddc939e0eb68c73969e81fc6f215b476ddf3fcf1a604603360089dadba2779cfed9027ac163067fc0d7592ac8a013b907372a42b242405241ac1f63f85a52fff2d78b30e87a156b5cfa133dabc259bb027bec5eb8c8eb623e9776a13d3ce972a6769de8a78153f498084a244b0146b77be3d1cba7b02fe8906ed8a88f105c763d1772825b986d52823bf38b6f95eca494fd9c64497874b9f450bec65311493cc108b27611eaa6819305a3730d29368f25f7e816d60884a1e0271c3c786ad36391366ac3b65f04c148974f6973005c5ff73d6f0b3f7e44c65da7c4115c4ee543991e4ad26938384cafffffffc8f7e79aaf1b8ef37f627e3c7168ecda2cf224a491bea6129fcd954b88dbb2d29464931bcd5378041db67ddc70ee856ae09c1b26b9ada008a7d52bf1a160606865a29794f36b2a3811c66e9fe27af8fc8356374e37f3eca244367fb535dde71fae4683710761b89e28820d4f06065450c3d1f76fa26ef28320edf6c36480af14f4444edb40ebb3f8ea264486e351c40c7e43c7a69c24da10db6f60da3e648f16b5fc6b5a5c6217e46c1f3ff354a8b49beb3b46a69dcb4c5d547a7b7ba8fe22da0173f9fe80f4bd47afbec4d2e0d3c91b1a326d8bb9fded873e87f847032af52bd6d129f3ce3f11ea9d0b4250af7eaa2649d9972b9b8dc773c869b3a431eac7f55d6bb92dc29f0eb7d8959e2af7571efb7ec88eac4b62850e8f6b60d4a5d06d66875b4bd260a9014a2eb88621f4c6eb3f9ed2190b48acf0358d8b82fb4794535fcb8dd50ba86d23d230a94f07a768142ff3b4c8558dac21726b6279980c238041f26e86c8e3fa83028345999ff4e5a37d610ab7c15daaffb744a505a3dd9802b3721f29553ee23e1cf376f12cc3fe6b7ac76bd13da44356855be096155e355c9cad31fcdeedc6679c531bc1a2765dc8777108ec5e31d793005e718a9ced77d6505e44f649128a29f5264fecba132f9f5016eaf690751edd64d903b36ceb2b08042c60e9e97f8bc985476e6088a5ebd3743c2358171b30b16d730a5dd49c92fa19cc267e2c1927f200fc3d23a804f0a12b06a6a88a2685051ab28f1721209ada2c14b557a49423795b07040d510bb21ce5d15acedd18cb7cb7a93389c8d934206e4ffb220048a7a82fb3c251d0a31ba5af9eb0c16e29f33f9d0a78f5e6300cf04d17eb5f67711cafa0d4e99eeaf0f8fdbd34170318879a0d12c01891127ba7b677d204268524c5af1d7dc27176826302e34f9d35d2f2eefad5f22f68929d3456c11d5f00d4a8ce8b784bca8088805731eff2d47024c2da68abc2d2c0f7806d7d76cdf489f3bffa75cb826bc0809331d89a3255a498b8150d4ae31d03414ab244939455b6377c2917cb2d8a9f9ebf282657e417860e49ac94f4a838aefd34f28960a78da47933252d8cb2fdb27d413ee54502cd1bf75585468b77b8dca627cab29ef0a5297ee3dcb4c987520804e9a5f45e8241019281bab7e30f4b008bf0edf3b6fb5e8d1c2ab619b2eb84293d636a6a37d716cd8e102b7099676693cb7b01031b57ee93fd22cb18229893fd4d4ef87f1596879ac9f61b2f0c35be34cb6e6f75087ff963c188d43bcb464a95e956e75559eb1f6f2224fb2ca8f0bdc90ae5c2ce712498ee4026b13b8f3137000aa1545a75e5b48e80da30e6dac5529cac1099244e79ad542f45dcfbf16c62b5eb63daee8185c5e79ebfa1ca60880f9e2895f54ab95bbae38ae62200c1e439d73fa63d0bff75935a8ad2ae73b82132e8d4eb4bd55844b2f55c65d5ffa0c65aaf0cc5bc73925d05cf7c1c4383af074feb3a53919d2a3b5bef96115aab966821dbfc4577d19d85911a485c58a5b87cf44d230cfdc255486bb09d5c16f2164397f0fc5f652a171f0269bdcd98291410c010cc377d2690a6032fe5701117adbd0f6b847c9617a9b3d20529024d8d9749b9c49827694d346d3b1bbe434122331986b9f6e84430dfd75d123f3e307d6f5514f3da09b527408bfb6816da54beeefad160e4b095517f3292c2e17fb3bba47527671d0afe7c35d54d25ab307b15d069a05395a9cddd4b519224fe3c689d14827ede6d91ebace2a80afaad3dcd1f8ce20e92012b8934d7ff3ebdd285cc24202a86d70b96674a6af05a3c29065afa4e38b9c34006cb3eb9c87985cfc511a8c261cdeb0c7a3c7a682c40c5b9f1d7d5ef6f97e32d02fdd3f2ded413f4a36c4db899b96c8e40d91c2743cd1d435010300000000000000345b66cce79fa49f10baa4ef28535eee8c5c1a4b38bace2fb14ec11d34d620b1cc2396dc1fa857ac6ac9f5689b5935f2f25184edd40f8f5c70714f941beae3e1bc9af757edd9d68fb24218e2a02aad4dc0b3c2e54694ce547fc38f38e52673473fd0e57497978324aee16559e9cdbe5b3a0b96dd69fe5bc97e644487274b6158a0412bd60172bb66f774b8eae7bc1f52ed64d44c553bdc26823e35f18683554e7359802173d1fa86a66104abb1977c3e9fa6970ed7ee483b14b65673a81786fe0ed301f8edb0669fd25bfa0d565e3e93b19b8572c98dbacb103053527a95ee758be002e03df756bbc486def0db079124db72fadc26f0a26b42e21f260f902bb4cd881baae57eff1c3cc15063be17e48208b9a69622adfc03991d204fe0f5ae2528b22c7743f97e0669a1c3c0d0d90f39846fd954d681be0265d14b12285fb1b20bcbaa95915ad51ab8f84094674cbac0071021b261c39a46b0177b98f1662100ef31a3e981236d51e6c1429144a89d46b149301873ef99959f8ab15c12309620d5d548b62ff92233a3f200e0d0a9c2122be615dd91e6a6cd89290d24895540635fead9a56f481ee3fd7890852e271fa7c37b1836a3e1764574960e1ab9fda1d25693cfc33defea84f65c08cce479c66dc16b28d453a1b717fdd9f6ff46b1fa1b6866b4a8c1ad53439c5958403953b3a844b660b28b11d427b392a7c710edbf25725a65e6b94e4c64ae458a8c97c9f7a05a7d8ebf6c76e3afc0204ced97be84986da5403ef31eff1790c039fe00a89976ccab7638d2e217fc64609a41f3a008ed78b25d1a9420b782deef6ce2db2c6d427580087b69c75c1357ed2908c32cffee1c6ddd08510562ab015507a4eb4f54ae5c097cdca34f521f9fa8df7667645a696a472650c1ca9c035e95f34db54722897159c31dc6be5693a5f3871ccbb48a7ead233d03b76875590fa20bae4f37a2011622d0203a3e9d9e198cb075aba26f5e78a8f0b0cd27052527daf0f8e77858dbddec7038c198b868e93ae32f1745d166afed4129460e07af8cb6c3debb6503e87f3cb309e39ed3d682d24adec48ea22702c4d8d48386977a89b73e585f8c2c5fcb0a693cd5028a601b04b833a41ec705735c767c70d316b60aba2da24bd6523533f3180accade90f47e412b393ee1d2456cf8bb430289ddb824350764985c5e35f738f830a378bfa65fd167c7307c13acb912beefa69e499d4a750e820a7af08a7c204ffb64e09fcc921a4e79999757d608880bfd52255bbc16369af4f779edfd9439cfcd17fcc02d5aaa81bac66fa2e551cef55779bd90e8be587ee698575918fced59ec652af26718b3afd1471379132ba0b5143a78f84605b1ef51e49e820a8a8c1639f66bca5afd83602287e982eb125a3a032e4cc5b5be91ab4d8d958fd4dc4cbd310eddc91d89ada4d33fcc963d259e222520281d14e13577906e33665a31afa7cb501cc0c1198d1f755005e82f29bcda62bbf8680bc23d09cac6a8c89709b30c91d27ea148f01ba745346f1ba9ce89cd9b71ff18668a0254c07479762dbb78117c50450506e2a0a606309aa383ec55a49d2569c3a3fef8aad456aa81cb859519765de18a4b92194e8a6a43f1dade801f71eb56699bc021fa48f320f4128d6c153a2ec1fba1c5ca55c5058641692365d311c8902aaf1428d83281aa970af5d98591cd3af30fbb5ee4a1b697491ff6dd727a329feb17b7846254d691f949baf96afa195c62f2c3fd1855a79b25268cef9822e3c6a1b3aa226ec494b070a8774426a5f8877714fe206e569635805208ac7823c8546ec33e4482a85d6fddf86a37a1c60f0a19b5dfe88031b7541af0e93cac8a3bb1ff3e60190b96faedc3b6f63d38f3ee4286fbaa053e8e27ed13b77b2c576d824d777ca53df76d9572e71f74ff180778bf57458b37fe9dbaa6f9927b48b059e5c7fd908ac826aed8f68764285022f4b5cb6b73ef7222ecb0d701c782ed5c16a7c94235fe7c3e0bef9da7310c5f3cda407c5ae7ecfb6b392ad576610b48af17b3fc8a2fd6cd2eee1153cc48a21ba6768a88367a807be008bea547402da4c92c2006c83d74c9d0ef2ca711c54036c8e76ac26c7d22060c9bfc2e67f1d1c6f6bd2f751879295ee21fcf8588c9504cacb02fa3e3fc6e2bed352447a5c2677caba0538960357d6d1706adef5e7d4f6298ed4ecacb7776de15d9bbd672f9991f4bdc4f07401f67cf3a74c0495ea58d0f76a2e6060cecc1d04b93808dc8d61130305740b408359d5552cc23a7b1eff4285d563b4b6b011a4a11372a2bb01cbda724482f95c4487b02c85cc121012b3213041ff6a689072daa4d86a4c125b110f4e2eeed2dd73db0f94ce995896e0b8a9f8f3e9559024251a5b1726b0b3775bac9fabed968d2d4ea31bbdfb2910331d92cb4ff5cc9037cc08cd35f88c4d7b89e46a8cbd05e3c35732b5046b33060dce5372b171daa526a46c3444b331e71f0455fb8b43dc46e2c9f2c4effccf040e56de00000007b16de337f13e7a610feac2f336e75405a530815366e7edfbb429babfd0e68db56892b94621edd9df6ff454ab1dcdb8d39d282fa7932ec7ba5203df2f4196538a1fa040c8014d20ff57fdb8515325a6997b9b71f2094e053f126402a47e628eeb7d8f665fbabe8f1a409ca9c7c5c25baaa0e9945acf27e96f8241a445f7d3352494ba4210b348fa0ec11ea67dead4fc1e5e4f9202931386468882bee59f8d12174198142ef7764d6b930e937e20d018c0cc5a780490356f5521aac74d2c1736e20ae5e0cd8cf6676ac337e8a8976aac75a698e34e72bac561038f228c13b6e974bc21bb79618111db507f3ba314dd2d05fd050d684cf33d8da5f8e5f723a092098ac5b180a6579d543515c2e1d0eb502193aedab526d354b625990c7d5a9f90d86c4e374054f1d14270b603065293e7fa3840de575413b74bfbc4f8c139947ade9a6f48907053f1ae3a95", 0x1000, 0x3fff, 0x0, 0x0) read(r6, &(0x7f0000edb000)=""/4096, 0x1000) 2018/02/01 16:23:20 executing program 2: mmap(&(0x7f0000000000/0x22000)=nil, 0x22000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_generic(r0, &(0x7f000001c000-0x38)={&(0x7f000001a000)={0x10}, 0xc, &(0x7f0000013000-0x10)={&(0x7f0000021000)={0x14, 0x32, 0x3ff, 0xffffffffffffffff, 0xffffffffffffffff, {}, []}, 0x14}, 0x1}, 0x0) 2018/02/01 16:23:20 executing program 4: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)={0xaa}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) fchmodat(0xffffffffffffffff, &(0x7f0000012000)='./file0\x00', 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r1 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12, 0x0, @tid}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r1, 0x15) ioctl$UFFDIO_ZEROPAGE(r0, 0x8010aa02, &(0x7f00000c1000-0x10)={&(0x7f0000011000/0x3000)=nil, 0x3000}) 2018/02/01 16:23:20 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) syz_open_dev$sndseq(&(0x7f0000000000)='/dev/snd/seq\x00', 0x0, 0x0) userfaultfd(0x0) syz_open_dev$sg(&(0x7f0000b65000)='/dev/sg#\x00', 0x0, 0x0) unshare(0x40600) pselect6(0x40, &(0x7f00000ac000-0x40)={0x3ffffd}, &(0x7f0000768000), &(0x7f00007fc000-0x40), &(0x7f0000f22000)={0x0, 0x989680}, &(0x7f0000f14000)={&(0x7f0000554000-0x8), 0x8}) 2018/02/01 16:23:20 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mkdir(&(0x7f000043f000-0x8)='./file0\x00', 0x0) mount(&(0x7f0000018000)='./file0\x00', &(0x7f0000027000)='./file0\x00', &(0x7f0000019000-0x6)='ramfs\x00', 0x40, &(0x7f000000a000)) r0 = creat(&(0x7f0000cd5000)='./file0/bus\x00', 0xbc9dc8fbd81cb4b1) fcntl$lock(r0, 0x7, &(0x7f00007ec000)={0x1}) unshare(0x40600) truncate(&(0x7f0000afe000)='./file0/bus\x00', 0x9) 2018/02/01 16:23:20 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = open(&(0x7f0000fc2000)='./file0\x00', 0x141046, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000fb2000-0x12)='/dev/input/event#\x00', 0x2, 0x101002) write$evdev(r0, &(0x7f0000a12000)=[{{0x0, 0x2710}, 0x1, 0x3a, 0x2}], 0x18) ioctl$EVIOCSMASK(r1, 0x40104593, &(0x7f000095c000-0x10)={0x0, 0x0, &(0x7f0000393000)}) ftruncate(r0, 0x10000) sendfile(r1, r0, 0x0, 0x72439a6f) 2018/02/01 16:23:20 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x2, &(0x7f0000691000-0x4)=0x79, 0x4) bind$inet(r0, &(0x7f0000887000-0x10)={0x2, 0x3, @broadcast=0xffffffff}, 0x10) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000cd5000-0x4), 0x4) sendto$inet(r0, &(0x7f0000d5a000-0x73), 0xfffffc6c, 0x20000804, &(0x7f0000e1e000)={0x2, 0x3, @loopback=0x7f000001}, 0x10) readv(r0, &(0x7f00007d7000-0x50)=[{&(0x7f0000b7e000)=""/4096, 0x1000}], 0x1) 2018/02/01 16:23:20 executing program 4: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)={0xaa}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) fchmodat(0xffffffffffffffff, &(0x7f0000012000)='./file0\x00', 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r1 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12, 0x0, @tid}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r1, 0x15) ioctl$UFFDIO_ZEROPAGE(r0, 0x8010aa02, &(0x7f00000c1000-0x10)={&(0x7f0000011000/0x3000)=nil, 0x3000}) [ 245.880837] binder: 1188:1193 got transaction with invalid offset (0, min 0 max 0) or object. [ 245.903494] binder: 1188:1193 transaction failed 29201/-22, size 0-16 line 2966 2018/02/01 16:23:20 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f000014e000-0x38)={&(0x7f000059d000-0xc)={0x10}, 0xc, &(0x7f0000f9c000-0x10)={&(0x7f0000e45000)=@updpolicy={0xbc, 0x19, 0x20401, 0xffffffffffffffff, 0xffffffffffffffff, {{@in=@broadcast=0xffffffff, @in=@dev={0xac, 0x14}}}, [@tmpl={0x4, 0x5, []}]}, 0xbc}, 0x1}, 0x0) 2018/02/01 16:23:20 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000009000-0x30)={0x4c, 0x0, &(0x7f0000452000-0x4c)=[@transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f0000b5b000-0x50)=[@ptr={0x70742a85, 0x0, &(0x7f00003df000), 0x1}], &(0x7f0000788000-0x20)=[0x0, 0x28]}, 0x1000}}], 0x0, 0x0, &(0x7f0000009000)}) 2018/02/01 16:23:20 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x0, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x2, &(0x7f0000691000-0x4)=0x79, 0x4) bind$inet(r0, &(0x7f0000887000-0x10)={0x2, 0x3, @broadcast=0xffffffff}, 0x10) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000cd5000-0x4), 0x4) sendto$inet(r0, &(0x7f0000d5a000-0x73), 0xfffffc6c, 0x20000804, &(0x7f0000e1e000)={0x2, 0x3, @loopback=0x7f000001}, 0x10) readv(r0, &(0x7f00007d7000-0x50)=[{&(0x7f0000b7e000)=""/4096, 0x1000}], 0x1) 2018/02/01 16:23:20 executing program 4: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)={0xaa}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) fchmodat(0xffffffffffffffff, &(0x7f0000012000)='./file0\x00', 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r1 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12, 0x0, @tid}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r1, 0x15) ioctl$UFFDIO_ZEROPAGE(r0, 0x8010aa02, &(0x7f00000c1000-0x10)={&(0x7f0000011000/0x3000)=nil, 0x3000}) 2018/02/01 16:23:20 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x3, @broadcast=0xffffffff}, 0x10) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f0000945000)=0x330, 0x4) sendto$inet(r0, &(0x7f0000013000), 0x0, 0x200007ff, &(0x7f0000deb000-0x10)={0x2, 0x3, @loopback=0x7f000001}, 0x10) sendmmsg(r0, &(0x7f0000c18000)=[{{&(0x7f0000164000)=@pppoe={0x18, 0x0, {0x0, @empty, @syzn={0x73, 0x79, 0x7a}}}, 0x1e, &(0x7f00003d8000-0x40)=[{&(0x7f00007c2000-0x2)="b3", 0x1}], 0x1, &(0x7f0000c37000)=[]}}], 0x1, 0x0) close(r0) [ 245.956286] binder: undelivered TRANSACTION_ERROR: 29201 [ 245.972806] tc_dump_action: action bad kind 2018/02/01 16:23:20 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = open(&(0x7f0000fc2000)='./file0\x00', 0x141046, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000fb2000-0x12)='/dev/input/event#\x00', 0x2, 0x101002) write$evdev(r0, &(0x7f0000a12000)=[{{0x0, 0x2710}, 0x1, 0x3a, 0x2}], 0x18) ioctl$EVIOCSMASK(r1, 0x40104593, &(0x7f000095c000-0x10)={0x0, 0x0, &(0x7f0000393000)}) ftruncate(r0, 0x10000) sendfile(r1, r0, 0x0, 0x72439a6f) 2018/02/01 16:23:20 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000009000-0x30)={0x4c, 0x0, &(0x7f0000452000-0x4c)=[@transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f0000b5b000-0x50)=[@ptr={0x70742a85, 0x0, &(0x7f00003df000), 0x1}], &(0x7f0000788000-0x20)=[0x0, 0x28]}, 0x1000}}], 0x0, 0x0, &(0x7f0000009000)}) 2018/02/01 16:23:20 executing program 5: mmap(&(0x7f0000000000/0xd000)=nil, 0xd000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$packet(0x11, 0x800000000002, 0x300) mmap(&(0x7f000000d000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) setsockopt$packet_drop_memb(r0, 0x107, 0x2, &(0x7f000000d000-0x10)={0x0, 0x1, 0x0, @random="117a0100"}, 0x390) [ 246.005753] tc_dump_action: action bad kind [ 246.007958] binder: 1226:1228 got transaction with invalid offset (40, min 40 max 40) or object. [ 246.008114] binder: 1226:1228 transaction failed 29201/-22, size 40-16 line 2966 [ 246.016536] binder: undelivered TRANSACTION_ERROR: 29201 [ 246.079413] device lo entered promiscuous mode [ 246.084187] binder: 1245:1250 got transaction with invalid offset (40, min 40 max 40) or object. [ 246.084224] binder: 1245:1250 transaction failed 29201/-22, size 40-16 line 2966 2018/02/01 16:23:20 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) seccomp(0x1, 0x0, &(0x7f0000001000-0x10)={0x2, &(0x7f0000022000)=[{0x0, 0x0, 0x0, 0xffffffffffffffe0}, {0x16}]}) setreuid(0x0, 0x0) 2018/02/01 16:23:20 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000009000-0x30)={0x4c, 0x0, &(0x7f0000452000-0x4c)=[@transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x10, &(0x7f0000b5b000-0x50)=[@ptr={0x70742a85, 0x0, &(0x7f00003df000), 0x1}], &(0x7f0000788000-0x20)=[0x0, 0x28]}, 0x1000}}], 0x0, 0x0, &(0x7f0000009000)}) 2018/02/01 16:23:20 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = open(&(0x7f0000fc2000)='./file0\x00', 0x141046, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000fb2000-0x12)='/dev/input/event#\x00', 0x2, 0x101002) write$evdev(r0, &(0x7f0000a12000)=[{{0x0, 0x2710}, 0x1, 0x3a, 0x2}], 0x18) ioctl$EVIOCSMASK(r1, 0x40104593, &(0x7f000095c000-0x10)={0x0, 0x0, &(0x7f0000393000)}) ftruncate(r0, 0x10000) sendfile(r1, r0, 0x0, 0x72439a6f) 2018/02/01 16:23:20 executing program 5: clone(0x0, &(0x7f0000b26000), &(0x7f0000eaa000-0x4), &(0x7f000039b000), &(0x7f0000bda000)) rename(&(0x7f0000954000)='./file0\x00', &(0x7f0000b5f000)='./file0\x00') 2018/02/01 16:23:20 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f000003a000-0x8)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$unix(0x1, 0x2, 0x0) bind$unix(r2, &(0x7f0000802000-0x8)=@file={0x1, './file0\x00'}, 0xa) r3 = fcntl$dupfd(r0, 0x0, r1) sendmsg$unix(r1, &(0x7f0000ce7000-0x38)={&(0x7f0000f5b000-0xa)=@file={0x1, './file0\x00'}, 0xa, &(0x7f0000471000)=[], 0x0, &(0x7f0000001000-0x10)=[]}, 0x0) dup2(r3, r1) write(r1, &(0x7f00006a6000), 0x0) 2018/02/01 16:23:20 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x0, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x2, &(0x7f0000691000-0x4)=0x79, 0x4) bind$inet(r0, &(0x7f0000887000-0x10)={0x2, 0x3, @broadcast=0xffffffff}, 0x10) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000cd5000-0x4), 0x4) sendto$inet(r0, &(0x7f0000d5a000-0x73), 0xfffffc6c, 0x20000804, &(0x7f0000e1e000)={0x2, 0x3, @loopback=0x7f000001}, 0x10) readv(r0, &(0x7f00007d7000-0x50)=[{&(0x7f0000b7e000)=""/4096, 0x1000}], 0x1) 2018/02/01 16:23:20 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) socket$inet6(0xa, 0x2, 0x0) unshare(0x8000400) select(0x40, &(0x7f0000039000-0x40), &(0x7f0000001000-0x40)={0x80200}, &(0x7f0000032000-0x40), &(0x7f000004c000)={0x77359400}) 2018/02/01 16:23:20 executing program 4: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)={0xaa}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) fchmodat(0xffffffffffffffff, &(0x7f0000012000)='./file0\x00', 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r1 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12, 0x0, @tid}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r1, 0x15) ioctl$UFFDIO_ZEROPAGE(r0, 0x8010aa02, &(0x7f00000c1000-0x10)={&(0x7f0000011000/0x3000)=nil, 0x3000}) 2018/02/01 16:23:20 executing program 1: mmap(&(0x7f0000000000/0xf8a000)=nil, 0xf8a000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r0, 0x1, 0x29, &(0x7f0000f87000)=0x6, 0x4) sendto$inet6(r0, &(0x7f0000f8a000-0x8a), 0x0, 0x0, &(0x7f0000f89000)={0xa, 0x2, 0x0, @mcast1={0xff, 0x1, [], 0x1}}, 0x1c) 2018/02/01 16:23:20 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = open(&(0x7f0000fc2000)='./file0\x00', 0x141046, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000fb2000-0x12)='/dev/input/event#\x00', 0x2, 0x101002) write$evdev(r0, &(0x7f0000a12000)=[{{0x0, 0x2710}, 0x1, 0x3a, 0x2}], 0x18) ioctl$EVIOCSMASK(r1, 0x40104593, &(0x7f000095c000-0x10)={0x0, 0x0, &(0x7f0000393000)}) ftruncate(r0, 0x10000) sendfile(r1, r0, 0x0, 0x72439a6f) 2018/02/01 16:23:20 executing program 5: r0 = socket$inet6(0xa, 0x801, 0x0) setsockopt$inet6_buf(r0, 0x29, 0x35, &(0x7f00009a8000), 0x0) 2018/02/01 16:23:20 executing program 4: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x3, 0x0, 0xffffffffffffffff, 0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)={0xaa}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) fchmodat(0xffffffffffffffff, &(0x7f0000012000)='./file0\x00', 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r1 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12, 0x0, @tid}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r1, 0x15) ioctl$UFFDIO_ZEROPAGE(r0, 0x8010aa02, &(0x7f00000c1000-0x10)={&(0x7f0000011000/0x3000)=nil, 0x3000}) 2018/02/01 16:23:20 executing program 4: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x3, 0x0, 0xffffffffffffffff, 0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)={0xaa}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) fchmodat(0xffffffffffffffff, &(0x7f0000012000)='./file0\x00', 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r1 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12, 0x0, @tid}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r1, 0x15) ioctl$UFFDIO_ZEROPAGE(r0, 0x8010aa02, &(0x7f00000c1000-0x10)={&(0x7f0000011000/0x3000)=nil, 0x3000}) 2018/02/01 16:23:20 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$inet_tcp_int(r0, 0x6, 0x4, &(0x7f000099e000), &(0x7f00008d6000-0x4)=0x4) 2018/02/01 16:23:20 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$unix(0x1, 0x5, 0x0) bind$unix(r0, &(0x7f0000003000)=@file={0x1, "e91f7189591e9233614b"}, 0xc) listen(r0, 0x0) r1 = epoll_create(0x4) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000cbd000-0xc)={0xffffffff80002004}) 2018/02/01 16:23:20 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = open(&(0x7f0000fc2000)='./file0\x00', 0x141046, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000fb2000-0x12)='/dev/input/event#\x00', 0x2, 0x101002) write$evdev(r0, &(0x7f0000a12000)=[{{0x0, 0x2710}, 0x1, 0x3a, 0x2}], 0x18) ioctl$EVIOCSMASK(r1, 0x40104593, &(0x7f000095c000-0x10)={0x0, 0x0, &(0x7f0000393000)}) ftruncate(r0, 0x10000) sendfile(r1, r0, 0x0, 0x72439a6f) 2018/02/01 16:23:20 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket(0x10, 0x2, 0x0) sendmsg$nl_route(r0, &(0x7f0000504000)={&(0x7f0000433000-0xc)={0x10}, 0xc, &(0x7f0000435000-0x10)={&(0x7f0000977000)=@newlink={0x3c, 0x10, 0x9, 0xffffffffffffffff, 0xffffffffffffffff, {}, [@IFLA_IFNAME={0x14, 0x3, @syzn={0x73, 0x79, 0x7a, 0x0}}, @IFLA_OPERSTATE={0x8, 0x10}]}, 0x3c}, 0x1}, 0x0) 2018/02/01 16:23:20 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000009000-0x30)={0x4c, 0x0, &(0x7f0000452000-0x4c)=[@transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f0000b5b000-0x50)=[@ptr={0x70742a85, 0x1, &(0x7f00003df000), 0x1}], &(0x7f0000788000-0x20)=[0x28]}, 0x1000}}], 0x0, 0x0, &(0x7f0000009000)}) 2018/02/01 16:23:20 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000842000-0x18)={0xaa}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000c20000)={{&(0x7f0000068000/0x800000)=nil, 0x80fdfd}, 0x1}) 2018/02/01 16:23:20 executing program 1: mmap(&(0x7f0000000000/0x5000)=nil, 0x5000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket(0xa, 0x1, 0x0) sched_rr_get_interval(0xffffffffffffffff, &(0x7f0000004000)={0x0}) setsockopt$sock_timeval(r0, 0x1, 0x14, &(0x7f0000002000)={r1}, 0x10) listen(r0, 0x0) accept(r0, 0x0, &(0x7f0000001000)) 2018/02/01 16:23:20 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = open(&(0x7f0000fc2000)='./file0\x00', 0x141046, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000fb2000-0x12)='/dev/input/event#\x00', 0x2, 0x101002) write$evdev(r0, &(0x7f0000a12000)=[{{0x0, 0x2710}, 0x1, 0x3a, 0x2}], 0x18) ioctl$EVIOCSMASK(r1, 0x40104593, &(0x7f000095c000-0x10)={0x0, 0x0, &(0x7f0000393000)}) sendfile(r1, r0, 0x0, 0x72439a6f) 2018/02/01 16:23:20 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x0, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x2, &(0x7f0000691000-0x4)=0x79, 0x4) bind$inet(r0, &(0x7f0000887000-0x10)={0x2, 0x3, @broadcast=0xffffffff}, 0x10) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000cd5000-0x4), 0x4) sendto$inet(r0, &(0x7f0000d5a000-0x73), 0xfffffc6c, 0x20000804, &(0x7f0000e1e000)={0x2, 0x3, @loopback=0x7f000001}, 0x10) readv(r0, &(0x7f00007d7000-0x50)=[{&(0x7f0000b7e000)=""/4096, 0x1000}], 0x1) 2018/02/01 16:23:20 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) fsetxattr(r0, &(0x7f00009ac000)=@known='security.selinux\x00', &(0x7f0000254000), 0x0, 0x0) 2018/02/01 16:23:20 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000006000)={0x0, 0x0, &(0x7f0000006000)={&(0x7f0000004000)={0x2, 0xc, 0x0, 0x0, 0x2, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, []}, 0x10}, 0x1}, 0x0) 2018/02/01 16:23:20 executing program 4: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x3, 0x0, 0xffffffffffffffff, 0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)={0xaa}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) fchmodat(0xffffffffffffffff, &(0x7f0000012000)='./file0\x00', 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r1 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12, 0x0, @tid}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r1, 0x15) ioctl$UFFDIO_ZEROPAGE(r0, 0x8010aa02, &(0x7f00000c1000-0x10)={&(0x7f0000011000/0x3000)=nil, 0x3000}) [ 246.092561] binder: undelivered TRANSACTION_ERROR: 29201 [ 246.184012] binder: 1260:1270 got transaction with invalid offset (40, min 40 max 40) or object. [ 246.216466] audit: type=1326 audit(1517502200.507:173): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 pid=1259 comm="syz-executor2" exe="/root/syz-executor2" sig=31 arch=c000003e syscall=202 compat=0 ip=0x453299 code=0xffff0000 [ 246.266558] binder: 1260:1270 transaction failed 29201/-22, size 40-16 line 2966 [ 246.290782] netlink: 'syz-executor2': attribute type 16 has an invalid length. [ 246.299297] binder: undelivered TRANSACTION_ERROR: 29201 [ 246.325806] netlink: 'syz-executor2': attribute type 16 has an invalid length. 2018/02/01 16:23:20 executing program 4: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f0000002000)={0xaa}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) fchmodat(0xffffffffffffffff, &(0x7f0000012000)='./file0\x00', 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r1 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12, 0x0, @tid}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r1, 0x15) ioctl$UFFDIO_ZEROPAGE(r0, 0x8010aa02, &(0x7f00000c1000-0x10)={&(0x7f0000011000/0x3000)=nil, 0x3000}) 2018/02/01 16:23:20 executing program 5: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_mtu(r0, 0x0, 0xa, &(0x7f0000237000), 0x4) [ 246.349406] sock: sock_set_timeout: `syz-executor1' (pid 1316) tries to set negative timeout [ 246.351006] audit: type=1401 audit(1517502200.641:174): op=setxattr invalid_context="" 2018/02/01 16:23:20 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000009000-0x30)={0x4c, 0x0, &(0x7f0000452000-0x4c)=[@transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f0000b5b000-0x50)=[@ptr={0x70742a85, 0x1, &(0x7f00003df000), 0x1}], &(0x7f0000788000-0x20)=[0x28]}, 0x1000}}], 0x0, 0x0, &(0x7f0000009000)}) 2018/02/01 16:23:20 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$inet_tcp_int(r0, 0x6, 0x10, &(0x7f000086b000-0x4), &(0x7f0000382000-0x4)=0x4) 2018/02/01 16:23:20 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = open(&(0x7f0000fc2000)='./file0\x00', 0x141046, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000fb2000-0x12)='/dev/input/event#\x00', 0x2, 0x101002) write$evdev(r0, &(0x7f0000a12000)=[{{0x0, 0x2710}, 0x1, 0x3a, 0x2}], 0x18) ioctl$EVIOCSMASK(r1, 0x40104593, &(0x7f000095c000-0x10)={0x0, 0x0, &(0x7f0000393000)}) sendfile(r1, r0, 0x0, 0x72439a6f) 2018/02/01 16:23:20 executing program 4: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f0000002000)={0xaa}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) fchmodat(0xffffffffffffffff, &(0x7f0000012000)='./file0\x00', 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r1 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12, 0x0, @tid}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r1, 0x15) ioctl$UFFDIO_ZEROPAGE(r0, 0x8010aa02, &(0x7f00000c1000-0x10)={&(0x7f0000011000/0x3000)=nil, 0x3000}) 2018/02/01 16:23:20 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000bc0000-0xa)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSLCKTRMIOS(r0, 0x5457, &(0x7f0000ab8000-0x24)) 2018/02/01 16:23:20 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000d30000)={&(0x7f0000b79000-0xc)={0x10}, 0xc, &(0x7f0000d00000-0x10)={&(0x7f0000d45000)=@newsa={0x1b8, 0x10, 0x29, 0xffffffffffffffff, 0xffffffffffffffff, {{@in=@empty, @in6=@loopback={0x0, 0x1}}, {@in=@remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, 0xffffffffffffffff, 0x33}, @in=@multicast1=0xe0000001, {}, {}, {}, 0xffffffffffffffff, 0xffffffffffffffff, 0x2}, [@algo_auth={0xc8, 0x1, {{'sha256\x00'}, 0x400, "3332501f213838826986f6b5915e2fe18fc2e4a69de5b469f9d8deac0e000000016209aba37bca1d5eafb73773e28fb5efc0c4b81da5a90c2178ea8f62ea299863c7450d336d305814b8312fa46821e8c5e8d0d84a2c4276141b794315d753125f99b7efaba4a0e86165850868765458765a3aca605c24ce070000006d8294c9"}}]}, 0x1b8}, 0x1}, 0x0) 2018/02/01 16:23:20 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x2, &(0x7f0000691000-0x4)=0x79, 0x4) bind$inet(r0, &(0x7f0000887000-0x10)={0x2, 0x3, @broadcast=0xffffffff}, 0x10) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000cd5000-0x4), 0x4) sendto$inet(r0, &(0x7f0000d5a000-0x73), 0xfffffc6c, 0x20000804, &(0x7f0000e1e000)={0x2, 0x3, @loopback=0x7f000001}, 0x10) readv(r0, &(0x7f00007d7000-0x50)=[{&(0x7f0000b7e000)=""/4096, 0x1000}], 0x1) 2018/02/01 16:23:20 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f000000b000)={&(0x7f000000f000)={0x10}, 0xc, &(0x7f00005a7000-0x10)={&(0x7f0000883000-0x274)=@newsa={0x138, 0x10, 0x713, 0xffffffffffffffff, 0xffffffffffffffff, {{@in6=@mcast1={0xff, 0x1, [], 0x1}, @in6=@dev={0xfe, 0x80}}, {@in=@empty, 0xffffffffffffffff, 0x6c}, @in6=@mcast2={0xff, 0x2, [], 0x1}, {}, {}, {}, 0xffffffffffffffff, 0xffffffffffffffff, 0x2}, [@algo_auth={0x48, 0x1, {{'michael_mic\x00'}}}]}, 0x138}, 0x1}, 0x0) [ 246.358503] binder: 1304:1318 got transaction with invalid offset (40, min 0 max 40) or object. [ 246.358543] binder: 1304:1318 transaction failed 29201/-22, size 40-8 line 2966 [ 246.383791] binder: undelivered TRANSACTION_ERROR: 29201 [ 246.436073] sock: sock_set_timeout: `syz-executor1' (pid 1316) tries to set negative timeout 2018/02/01 16:23:20 executing program 4: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f0000002000)={0xaa}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) fchmodat(0xffffffffffffffff, &(0x7f0000012000)='./file0\x00', 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r1 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12, 0x0, @tid}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r1, 0x15) ioctl$UFFDIO_ZEROPAGE(r0, 0x8010aa02, &(0x7f00000c1000-0x10)={&(0x7f0000011000/0x3000)=nil, 0x3000}) 2018/02/01 16:23:20 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = open(&(0x7f0000fc2000)='./file0\x00', 0x141046, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000fb2000-0x12)='/dev/input/event#\x00', 0x2, 0x101002) write$evdev(r0, &(0x7f0000a12000)=[{{0x0, 0x2710}, 0x1, 0x3a, 0x2}], 0x18) ioctl$EVIOCSMASK(r1, 0x40104593, &(0x7f000095c000-0x10)={0x0, 0x0, &(0x7f0000393000)}) sendfile(r1, r0, 0x0, 0x72439a6f) 2018/02/01 16:23:20 executing program 1: r0 = socket$inet6_udp(0xa, 0x2, 0x0) flistxattr(r0, &(0x7f0000fee000), 0x0) 2018/02/01 16:23:20 executing program 2: dup2(0xffffffffffffff9c, 0xffffffffffffff9c) membarrier(0x1, 0x0) clone(0x0, &(0x7f0000623000), &(0x7f00002d0000-0x4), &(0x7f0000907000), &(0x7f0000553000)) [ 246.469553] binder: 1331:1338 got transaction with invalid offset (40, min 0 max 40) or object. 2018/02/01 16:23:20 executing program 4: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)={0xaa}) ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) fchmodat(0xffffffffffffffff, &(0x7f0000012000)='./file0\x00', 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r1 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12, 0x0, @tid}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r1, 0x15) ioctl$UFFDIO_ZEROPAGE(r0, 0x8010aa02, &(0x7f00000c1000-0x10)={&(0x7f0000011000/0x3000)=nil, 0x3000}) 2018/02/01 16:23:20 executing program 5: mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x3, 0x32, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000894000-0x8)={0x0, 0x0}) futimesat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', &(0x7f0000001000-0x10)={{0x0, r0/1000+30000}}) 2018/02/01 16:23:20 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = add_key(&(0x7f0000002000)='logon\x00', &(0x7f0000001000)={0x73, 0x79, 0x7a, 0x0}, &(0x7f0000001000)="1c989cc9f58ec796be4720e6160291a2fb7c6445e84b8e9e349ead029fe38d5810bf992b5d51f406a51cc339021268aed6f767582af42dbc8ea1110e4353fcf30b20f1f27ed3b44bef6444f8ca6a808e34ded636ef55e151c11b4ef7a5384f4a0ceb885759dfeeca5aaa540de461d2130755897533032f5639c4ba79988a49d63084f2cbed0a84e5e733146f15192fdabd0e3a", 0x93, 0xfffffffffffffffc) keyctl$read(0xb, r0, &(0x7f0000b17000)=""/125, 0x7d) 2018/02/01 16:23:20 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x1, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000f60000-0x20)={@loopback={0x0, 0x1}, 0x0, 0x0, 0xff, 0x1}, 0x20) memfd_create(&(0x7f0000336000-0x1)='\x00', 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000129000)={@generic="22b35cf297869a6d5fda791aecd2a733", @ifru_names=@generic="174377bb4476e36f15bb0b50444655c5"}) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000c64000)={{{@in6=@local={0xfe, 0x80, [], 0xffffffffffffffff, 0xaa}, @in=@multicast1=0xe0000001, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xa, 0x80}, {0x0, 0x0, 0x0, 0x7fff, 0x0, 0x9}}, {{@in=@remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, 0x1, 0x3c}, 0x0, @in=@remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, 0x0}}, 0xe8) close(r0) 2018/02/01 16:23:20 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000009000-0x30)={0x4c, 0x0, &(0x7f0000452000-0x4c)=[@transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f0000b5b000-0x50)=[@ptr={0x70742a85, 0x1, &(0x7f00003df000), 0x1}], &(0x7f0000788000-0x20)=[0x28]}, 0x1000}}], 0x0, 0x0, &(0x7f0000009000)}) 2018/02/01 16:23:20 executing program 4: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)={0xaa}) ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) fchmodat(0xffffffffffffffff, &(0x7f0000012000)='./file0\x00', 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r1 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12, 0x0, @tid}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r1, 0x15) ioctl$UFFDIO_ZEROPAGE(r0, 0x8010aa02, &(0x7f00000c1000-0x10)={&(0x7f0000011000/0x3000)=nil, 0x3000}) 2018/02/01 16:23:20 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = gettid() timer_create(0x2, &(0x7f0000af8000)={0x0, 0x4, 0x4, @tid=r0}, &(0x7f000016a000)) clock_gettime(0x0, &(0x7f000005b000)={0x0, 0x0}) exit(0x0) timer_settime(0x0, 0x20001, &(0x7f0000041000-0x20)={{0x0, r1}, {0x0, 0x9}}, &(0x7f0000040000)) 2018/02/01 16:23:20 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = open(&(0x7f0000fc2000)='./file0\x00', 0x141046, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000fb2000-0x12)='/dev/input/event#\x00', 0x2, 0x101002) write$evdev(r0, &(0x7f0000a12000)=[{{0x0, 0x2710}, 0x1, 0x3a, 0x2}], 0x18) ftruncate(r0, 0x10000) sendfile(r1, r0, 0x0, 0x72439a6f) 2018/02/01 16:23:20 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = memfd_create(&(0x7f00005c6000-0x14)="706f73fb0000020000090000007a7300000000", 0x0) pwrite64(r0, &(0x7f0000ad1000)="ff2f", 0x2, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x4, 0x11, r0, 0x0) symlink(&(0x7f0000001000)='./file0\x00', &(0x7f0000c96000-0x8)='./file0\x00') listxattr(&(0x7f00006db000-0x8)='./file0\x00', &(0x7f000055e000-0x71), 0x0) [ 246.517256] binder: 1331:1338 transaction failed 29201/-22, size 40-8 line 2966 [ 246.546201] binder: undelivered TRANSACTION_ERROR: 29201 2018/02/01 16:23:20 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = memfd_create(&(0x7f000003e000)='\'', 0x0) r1 = syz_open_dev$sndseq(&(0x7f0000042000)='/dev/snd/seq\x00', 0x0, 0x8000000000102) r2 = dup2(r1, r0) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r2, 0xc08c5332, &(0x7f0000001000)={0x0, 0x0, 0x0, "9ede7a8c5ae95ec8672c93340f643a664f13eeab65c0322901dc6bd36cde2c51f01b7f0b014f9f91eeb7c37c7240f476c8d753d000aa8faf8fb574dbcfa6dc4d"}) write$sndseq(r1, &(0x7f0000002000)=[{0x0, 0x3, 0x0, 0x0, @time={0x77359400}, {}, {}, @ext={0x0, &(0x7f0000ae5000)}}], 0x30) r3 = syz_open_dev$sndseq(&(0x7f0000cea000-0xd)='/dev/snd/seq\x00', 0x0, 0x0) r4 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000e26000)='/dev/sequencer2\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_CLIENT(r3, 0x404c534a, &(0x7f0000643000-0x4c)={0x0, 0x0, 0x10001, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdfd]}) dup2(r4, r3) [ 246.599912] binder: 1372:1375 got transaction with invalid offset (40, min 0 max 40) or object. [ 246.624321] binder: 1372:1375 transaction failed 29201/-22, size 40-8 line 2966 2018/02/01 16:23:20 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x2, &(0x7f0000691000-0x4)=0x79, 0x4) bind$inet(r0, &(0x7f0000887000-0x10)={0x2, 0x3, @broadcast=0xffffffff}, 0x10) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000cd5000-0x4), 0x4) sendto$inet(r0, &(0x7f0000d5a000-0x73), 0xfffffc6c, 0x20000804, &(0x7f0000e1e000)={0x2, 0x3, @loopback=0x7f000001}, 0x10) readv(r0, &(0x7f00007d7000-0x50)=[{&(0x7f0000b7e000)=""/4096, 0x1000}], 0x1) 2018/02/01 16:23:20 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$mice(&(0x7f0000d74000-0x10)='/dev/input/mice\x00', 0x0, 0x82) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000fa7000)={{{@in6=@local={0x0, 0x0, [], 0x0}, @in6=@empty, 0x0, 0x0, 0x0}, {}, {}, 0x0, 0x0}, {{@in6=@remote={0x0, 0x0, [], 0x0}, 0x0}, 0x0, @in=@broadcast, 0x0}}, &(0x7f0000391000+0xcf6)=0xe8) write(r0, &(0x7f000000b000-0x3d)="dc", 0x1) readv(r0, &(0x7f000000e000-0x20)=[{&(0x7f000022b000)=""/1, 0x1}], 0x1) 2018/02/01 16:23:20 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = open(&(0x7f0000fc2000)='./file0\x00', 0x141046, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000fb2000-0x12)='/dev/input/event#\x00', 0x2, 0x101002) ftruncate(r0, 0x10000) sendfile(r1, r0, 0x0, 0x72439a6f) 2018/02/01 16:23:20 executing program 4: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)={0xaa}) ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) fchmodat(0xffffffffffffffff, &(0x7f0000012000)='./file0\x00', 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r1 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12, 0x0, @tid}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r1, 0x15) ioctl$UFFDIO_ZEROPAGE(r0, 0x8010aa02, &(0x7f00000c1000-0x10)={&(0x7f0000011000/0x3000)=nil, 0x3000}) 2018/02/01 16:23:20 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x1, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000f60000-0x20)={@loopback={0x0, 0x1}, 0x0, 0x0, 0xff, 0x1}, 0x20) memfd_create(&(0x7f0000336000-0x1)='\x00', 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000129000)={@generic="22b35cf297869a6d5fda791aecd2a733", @ifru_names=@generic="174377bb4476e36f15bb0b50444655c5"}) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000c64000)={{{@in6=@local={0xfe, 0x80, [], 0xffffffffffffffff, 0xaa}, @in=@multicast1=0xe0000001, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xa, 0x80}, {0x0, 0x0, 0x0, 0x7fff, 0x0, 0x9}}, {{@in=@remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, 0x1, 0x3c}, 0x0, @in=@remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, 0x0}}, 0xe8) close(r0) 2018/02/01 16:23:20 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000009000-0x30)={0x4c, 0x0, &(0x7f0000452000-0x4c)=[@transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f0000b5b000-0x50)=[@ptr={0x70742a85, 0x1, &(0x7f00003df000), 0x1}], &(0x7f0000788000-0x20)=[0x0]}, 0x1000}}], 0x0, 0x0, &(0x7f0000009000)}) 2018/02/01 16:23:21 executing program 5: mmap(&(0x7f0000000000/0x13000)=nil, 0x13000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000002000)={&(0x7f0000008000)={0x10}, 0xc, &(0x7f0000006000-0x10)={&(0x7f0000004000-0x1a4)=@flushpolicy={0x10, 0x1d, 0x719, 0xffffffffffffffff, 0xffffffffffffffff, "", []}, 0x10}, 0x1}, 0x0) 2018/02/01 16:23:21 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = memfd_create(&(0x7f000003e000)='\'', 0x0) r1 = syz_open_dev$sndseq(&(0x7f0000042000)='/dev/snd/seq\x00', 0x0, 0x8000000000102) r2 = dup2(r1, r0) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r2, 0xc08c5332, &(0x7f0000001000)={0x0, 0x0, 0x0, "9ede7a8c5ae95ec8672c93340f643a664f13eeab65c0322901dc6bd36cde2c51f01b7f0b014f9f91eeb7c37c7240f476c8d753d000aa8faf8fb574dbcfa6dc4d"}) write$sndseq(r1, &(0x7f0000002000)=[{0x0, 0x3, 0x0, 0x0, @time={0x77359400}, {}, {}, @ext={0x0, &(0x7f0000ae5000)}}], 0x30) r3 = syz_open_dev$sndseq(&(0x7f0000cea000-0xd)='/dev/snd/seq\x00', 0x0, 0x0) r4 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000e26000)='/dev/sequencer2\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_CLIENT(r3, 0x404c534a, &(0x7f0000643000-0x4c)={0x0, 0x0, 0x10001, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdfd]}) dup2(r4, r3) [ 246.655078] binder: undelivered TRANSACTION_ERROR: 29201 2018/02/01 16:23:21 executing program 4: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)={0xaa}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}}) fchmodat(0xffffffffffffffff, &(0x7f0000012000)='./file0\x00', 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r1 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12, 0x0, @tid}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r1, 0x15) ioctl$UFFDIO_ZEROPAGE(r0, 0x8010aa02, &(0x7f00000c1000-0x10)={&(0x7f0000011000/0x3000)=nil, 0x3000}) 2018/02/01 16:23:21 executing program 3: mmap(&(0x7f0000000000/0xf8b000)=nil, 0xf8b000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000f8b000-0x38)={0x0, 0x0, &(0x7f0000f8a000)={&(0x7f00007de000-0x290)={0x2, 0x3, 0x0, 0x0, 0x6, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, [@sadb_lifetime={0x4, 0x7}]}, 0x30}, 0x1}, 0x0) 2018/02/01 16:23:21 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = memfd_create(&(0x7f000003e000)='\'', 0x0) r1 = syz_open_dev$sndseq(&(0x7f0000042000)='/dev/snd/seq\x00', 0x0, 0x8000000000102) r2 = dup2(r1, r0) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r2, 0xc08c5332, &(0x7f0000001000)={0x0, 0x0, 0x0, "9ede7a8c5ae95ec8672c93340f643a664f13eeab65c0322901dc6bd36cde2c51f01b7f0b014f9f91eeb7c37c7240f476c8d753d000aa8faf8fb574dbcfa6dc4d"}) write$sndseq(r1, &(0x7f0000002000)=[{0x0, 0x3, 0x0, 0x0, @time={0x77359400}, {}, {}, @ext={0x0, &(0x7f0000ae5000)}}], 0x30) r3 = syz_open_dev$sndseq(&(0x7f0000cea000-0xd)='/dev/snd/seq\x00', 0x0, 0x0) r4 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000e26000)='/dev/sequencer2\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_CLIENT(r3, 0x404c534a, &(0x7f0000643000-0x4c)={0x0, 0x0, 0x10001, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdfd]}) dup2(r4, r3) 2018/02/01 16:23:21 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = open(&(0x7f0000fc2000)='./file0\x00', 0x141046, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000fb2000-0x12)='/dev/input/event#\x00', 0x2, 0x101002) ftruncate(r0, 0x10000) sendfile(r1, r0, 0x0, 0x72439a6f) 2018/02/01 16:23:21 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000bc0000-0xa)='/dev/ptmx\x00', 0x0, 0x0) socketpair$inet6_sctp(0xa, 0x0, 0x84, &(0x7f000048e000-0x8)) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003ba000-0x24)) r1 = syz_open_pts(r0, 0x11) ioctl$int_in(r1, 0x5452, &(0x7f0000f28000-0x8)=0x81) write(r1, &(0x7f0000fd6000)='z', 0x1) ioctl$TIOCSETD(r1, 0x5423, &(0x7f00001c3000)=0x3) dup2(r1, r0) 2018/02/01 16:23:21 executing program 2: r0 = socket$inet(0x2, 0x1, 0x0) r1 = dup(r0) setsockopt$inet_tcp_int(r1, 0x6, 0x0, &(0x7f00007b6000-0x4), 0x4) 2018/02/01 16:23:21 executing program 4: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)={0xaa}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}}) fchmodat(0xffffffffffffffff, &(0x7f0000012000)='./file0\x00', 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r1 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12, 0x0, @tid}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r1, 0x15) ioctl$UFFDIO_ZEROPAGE(r0, 0x8010aa02, &(0x7f00000c1000-0x10)={&(0x7f0000011000/0x3000)=nil, 0x3000}) [ 246.728328] binder: 1395:1403 got transaction with invalid parent offset or type [ 246.746469] binder: 1395:1403 transaction failed 29201/-22, size 40-8 line 3088 2018/02/01 16:23:21 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000009000-0x30)={0x4c, 0x0, &(0x7f0000452000-0x4c)=[@transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f0000b5b000-0x50)=[@ptr={0x70742a85, 0x1, &(0x7f00003df000), 0x1}], &(0x7f0000788000-0x20)=[0x0]}, 0x1000}}], 0x0, 0x0, &(0x7f0000009000)}) [ 246.796967] binder: undelivered TRANSACTION_ERROR: 29201 2018/02/01 16:23:21 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x2, &(0x7f0000691000-0x4)=0x79, 0x4) bind$inet(r0, &(0x7f0000887000-0x10)={0x2, 0x3, @broadcast=0xffffffff}, 0x10) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000cd5000-0x4), 0x4) sendto$inet(r0, &(0x7f0000d5a000-0x73), 0xfffffc6c, 0x20000804, &(0x7f0000e1e000)={0x2, 0x3, @loopback=0x7f000001}, 0x10) readv(r0, &(0x7f00007d7000-0x50)=[{&(0x7f0000b7e000)=""/4096, 0x1000}], 0x1) 2018/02/01 16:23:21 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = memfd_create(&(0x7f000003e000)='\'', 0x0) r1 = syz_open_dev$sndseq(&(0x7f0000042000)='/dev/snd/seq\x00', 0x0, 0x8000000000102) r2 = dup2(r1, r0) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r2, 0xc08c5332, &(0x7f0000001000)={0x0, 0x0, 0x0, "9ede7a8c5ae95ec8672c93340f643a664f13eeab65c0322901dc6bd36cde2c51f01b7f0b014f9f91eeb7c37c7240f476c8d753d000aa8faf8fb574dbcfa6dc4d"}) write$sndseq(r1, &(0x7f0000002000)=[{0x0, 0x3, 0x0, 0x0, @time={0x77359400}, {}, {}, @ext={0x0, &(0x7f0000ae5000)}}], 0x30) r3 = syz_open_dev$sndseq(&(0x7f0000cea000-0xd)='/dev/snd/seq\x00', 0x0, 0x0) r4 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000e26000)='/dev/sequencer2\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_CLIENT(r3, 0x404c534a, &(0x7f0000643000-0x4c)={0x0, 0x0, 0x10001, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdfd]}) dup2(r4, r3) 2018/02/01 16:23:21 executing program 4: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)={0xaa}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}}) fchmodat(0xffffffffffffffff, &(0x7f0000012000)='./file0\x00', 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r1 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12, 0x0, @tid}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r1, 0x15) ioctl$UFFDIO_ZEROPAGE(r0, 0x8010aa02, &(0x7f00000c1000-0x10)={&(0x7f0000011000/0x3000)=nil, 0x3000}) 2018/02/01 16:23:21 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$loop(&(0x7f00000fb000-0xb)='/dev/loop#\x00', 0x0, 0x4000000006) mmap(&(0x7f000001a000/0x4000)=nil, 0x4000, 0x7, 0x51, r0, 0x0) getresuid(&(0x7f0000012000-0x4), &(0x7f000001a000), &(0x7f000002a000)) close(r0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x0, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xf64000)=nil, 0xf64000, 0x3, 0x32, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x2, 0x78, 0x9eb5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x8, 0x10000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) keyctl$restrict_keyring(0x1d, 0x0, &(0x7f0000937000-0x6)='rxrpc\x00', &(0x7f0000b04000-0x8)='/)ppp1!\x00') 2018/02/01 16:23:21 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = open(&(0x7f0000fc2000)='./file0\x00', 0x141046, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000fb2000-0x12)='/dev/input/event#\x00', 0x2, 0x101002) ftruncate(r0, 0x10000) sendfile(r1, r0, 0x0, 0x72439a6f) 2018/02/01 16:23:21 executing program 2: mmap(&(0x7f0000000000/0xe71000)=nil, 0xe71000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = signalfd4(0xffffffffffffffff, &(0x7f000004a000), 0x8, 0x0) signalfd(r0, &(0x7f0000c2d000), 0x8) 2018/02/01 16:23:21 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000009000-0x30)={0x4c, 0x0, &(0x7f0000452000-0x4c)=[@transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f0000b5b000-0x50)=[@ptr={0x70742a85, 0x1, &(0x7f00003df000), 0x1}], &(0x7f0000788000-0x20)=[0x0]}}}], 0x0, 0x0, &(0x7f0000009000)}) 2018/02/01 16:23:21 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x4, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000-0x18)={0xaa}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000ee4000-0x20)={{&(0x7f0000012000/0x2000)=nil, 0x2000}, 0x1}) r1 = syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x0) ioctl$EVIOCGMTSLOTS(r1, 0x8040450a, &(0x7f0000013000)) execve(&(0x7f0000f62000-0x8)='./file0\x00', &(0x7f0000f86000)=[], &(0x7f0000149000-0x4)=[]) ioctl$EVIOCSCLOCKID(r1, 0x400445a0, &(0x7f00000c9000)) close(r0) [ 246.843539] binder: 1432:1434 got transaction with invalid parent offset or type [ 246.851212] binder: 1432:1434 transaction failed 29201/-22, size 40-8 line 3088 [ 246.866402] binder: undelivered TRANSACTION_ERROR: 29201 2018/02/01 16:23:21 executing program 4: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)={0xaa}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) fchmodat(0xffffffffffffffff, &(0x7f0000012000)='./file0\x00', 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x0, 0x32, 0xffffffffffffffff, 0x0) r1 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12, 0x0, @tid}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r1, 0x15) ioctl$UFFDIO_ZEROPAGE(r0, 0x8010aa02, &(0x7f00000c1000-0x10)={&(0x7f0000011000/0x3000)=nil, 0x3000}) 2018/02/01 16:23:21 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = open(&(0x7f0000fc2000)='./file0\x00', 0x141046, 0x0) write$evdev(r0, &(0x7f0000a12000)=[{{0x0, 0x2710}, 0x1, 0x3a, 0x2}], 0x18) ftruncate(r0, 0x10000) sendfile(0xffffffffffffffff, r0, 0x0, 0x72439a6f) 2018/02/01 16:23:21 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = memfd_create(&(0x7f000003e000)='\'', 0x0) r1 = syz_open_dev$sndseq(&(0x7f0000042000)='/dev/snd/seq\x00', 0x0, 0x8000000000102) r2 = dup2(r1, r0) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r2, 0xc08c5332, &(0x7f0000001000)={0x0, 0x0, 0x0, "9ede7a8c5ae95ec8672c93340f643a664f13eeab65c0322901dc6bd36cde2c51f01b7f0b014f9f91eeb7c37c7240f476c8d753d000aa8faf8fb574dbcfa6dc4d"}) write$sndseq(r1, &(0x7f0000002000)=[{0x0, 0x3, 0x0, 0x0, @time={0x77359400}, {}, {}, @ext={0x0, &(0x7f0000ae5000)}}], 0x30) r3 = syz_open_dev$sndseq(&(0x7f0000cea000-0xd)='/dev/snd/seq\x00', 0x0, 0x0) r4 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000e26000)='/dev/sequencer2\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_CLIENT(r3, 0x404c534a, &(0x7f0000643000-0x4c)={0x0, 0x0, 0x10001, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdfd]}) dup2(r4, r3) 2018/02/01 16:23:21 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = open(&(0x7f0000fc2000)='./file0\x00', 0x141046, 0x0) write$evdev(r0, &(0x7f0000a12000)=[{{0x0, 0x2710}, 0x1, 0x3a, 0x2}], 0x18) ftruncate(r0, 0x10000) sendfile(0xffffffffffffffff, r0, 0x0, 0x72439a6f) 2018/02/01 16:23:21 executing program 3: mmap(&(0x7f0000000000/0xea2000)=nil, 0xea2000, 0x1, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ea4000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) capset(&(0x7f0000ea5000-0x8)={0x20080522}, &(0x7f0000004000)) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) 2018/02/01 16:23:21 executing program 2: mmap(&(0x7f000002d000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f000002e000-0x8)={0xffffffffffffffff, 0xffffffffffffffff}) mmap(&(0x7f0000010000/0x10000)=nil, 0x10000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) recvmmsg(r0, &(0x7f0000002000-0xb4)=[{{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000017000-0xd7)=""/215, 0xd7}], 0x1, &(0x7f000002f000)=""/7, 0x7}}, {{&(0x7f0000003000-0x58)=@alg, 0x58, &(0x7f000001c000)=[], 0x0, &(0x7f0000030000-0x57)=""/87, 0x57}}], 0x2, 0x10000, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) sendto(r1, &(0x7f0000018000)="f8", 0x1, 0x0, 0x0, 0x0) [ 246.948939] binder: 1450:1452 got transaction with too large buffer [ 246.970199] binder: 1450:1452 transaction failed 29201/-22, size 40-8 line 3062 2018/02/01 16:23:21 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000009000-0x30)={0x4c, 0x0, &(0x7f0000452000-0x4c)=[@transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f0000b5b000-0x50)=[@ptr={0x70742a85, 0x1, &(0x7f00003df000), 0x1}], &(0x7f0000788000-0x20)=[0x0]}}}], 0x0, 0x0, &(0x7f0000009000)}) 2018/02/01 16:23:21 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = open(&(0x7f0000fc2000)='./file0\x00', 0x141046, 0x0) write$evdev(r0, &(0x7f0000a12000)=[{{0x0, 0x2710}, 0x1, 0x3a, 0x2}], 0x18) ftruncate(r0, 0x10000) sendfile(0xffffffffffffffff, r0, 0x0, 0x72439a6f) [ 247.005365] binder: undelivered TRANSACTION_ERROR: 29201 [ 247.032700] binder: 1471:1473 got transaction with too large buffer [ 247.040668] binder: 1471:1473 transaction failed 29201/-22, size 40-8 line 3062 [ 247.060038] binder: undelivered TRANSACTION_ERROR: 29201 2018/02/01 16:23:21 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x0, &(0x7f0000691000-0x4)=0x79, 0x4) bind$inet(r0, &(0x7f0000887000-0x10)={0x2, 0x3, @broadcast=0xffffffff}, 0x10) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000cd5000-0x4), 0x4) sendto$inet(r0, &(0x7f0000d5a000-0x73), 0xfffffc6c, 0x20000804, &(0x7f0000e1e000)={0x2, 0x3, @loopback=0x7f000001}, 0x10) readv(r0, &(0x7f00007d7000-0x50)=[{&(0x7f0000b7e000)=""/4096, 0x1000}], 0x1) 2018/02/01 16:23:21 executing program 4: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)={0xaa}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) fchmodat(0xffffffffffffffff, &(0x7f0000012000)='./file0\x00', 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x0, 0x32, 0xffffffffffffffff, 0x0) r1 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12, 0x0, @tid}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r1, 0x15) ioctl$UFFDIO_ZEROPAGE(r0, 0x8010aa02, &(0x7f00000c1000-0x10)={&(0x7f0000011000/0x3000)=nil, 0x3000}) 2018/02/01 16:23:21 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket(0x20000000000000a, 0x2, 0x0) sendmsg(r0, &(0x7f0000bae000)={&(0x7f0000aee000-0x1c)=@in6={0xa, 0x0, 0x0, @empty}, 0x1c, &(0x7f00008d5000-0x60)=[], 0x0, &(0x7f0000836000-0x220)=[{0x10, 0x29}], 0x10}, 0x0) 2018/02/01 16:23:21 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$evdev(&(0x7f0000fb2000-0x12)='/dev/input/event#\x00', 0x2, 0x101002) write$evdev(0xffffffffffffffff, &(0x7f0000a12000)=[{{0x0, 0x2710}, 0x1, 0x3a, 0x2}], 0x18) ftruncate(0xffffffffffffffff, 0x10000) sendfile(r0, 0xffffffffffffffff, 0x0, 0x72439a6f) 2018/02/01 16:23:21 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) sendmsg$unix(0xffffffffffffffff, &(0x7f0000833000)={&(0x7f0000564000)=@abs, 0x8, &(0x7f0000452000-0x10)=[{&(0x7f0000007000)="002a932f01000000cf960802e02348f800000000001c0003f2a576", 0x1b}], 0x1, &(0x7f00001fa000-0x20)=[]}, 0x0) r0 = syz_open_dev$sg(&(0x7f00000c6000-0x9)='/dev/sg#\x00', 0x0, 0x0) ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, &(0x7f0000007000)={0x0, 0x0, 0x533, 0x30001}) ioctl$SNDRV_SEQ_IOCTL_GET_NAMED_QUEUE(0xffffffffffffffff, 0xc08c5336, &(0x7f000082c000)={0x4, 0x0, 0x0, 'queue0\x00', 0x1}) socket$inet_tcp(0x2, 0x1, 0x0) ioctl(r0, 0x2285, &(0x7f0000007000)='S') 2018/02/01 16:23:21 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x9) bind$netlink(r0, &(0x7f0000c29000)={0x10, 0x0, 0x0, 0xfffffffffffffffe}, 0xc) bind$netlink(r0, &(0x7f0000317000-0xc)={0x2000000000000010, 0x0, 0x0}, 0xc) 2018/02/01 16:23:21 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = memfd_create(&(0x7f000003e000)='\'', 0x0) r1 = syz_open_dev$sndseq(&(0x7f0000042000)='/dev/snd/seq\x00', 0x0, 0x8000000000102) r2 = dup2(r1, r0) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r2, 0xc08c5332, &(0x7f0000001000)={0x0, 0x0, 0x0, "9ede7a8c5ae95ec8672c93340f643a664f13eeab65c0322901dc6bd36cde2c51f01b7f0b014f9f91eeb7c37c7240f476c8d753d000aa8faf8fb574dbcfa6dc4d"}) write$sndseq(r1, &(0x7f0000002000)=[{0x0, 0x3, 0x0, 0x0, @time={0x77359400}, {}, {}, @ext={0x0, &(0x7f0000ae5000)}}], 0x30) r3 = syz_open_dev$sndseq(&(0x7f0000cea000-0xd)='/dev/snd/seq\x00', 0x0, 0x0) r4 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000e26000)='/dev/sequencer2\x00', 0x0, 0x0) dup2(r4, r3) 2018/02/01 16:23:21 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000009000-0x30)={0x4c, 0x0, &(0x7f0000452000-0x4c)=[@transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f0000b5b000-0x50)=[@ptr={0x70742a85, 0x1, &(0x7f00003df000), 0x1}], &(0x7f0000788000-0x20)=[0x0]}}}], 0x0, 0x0, &(0x7f0000009000)}) 2018/02/01 16:23:21 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = memfd_create(&(0x7f000003e000)='\'', 0x0) r1 = syz_open_dev$sndseq(&(0x7f0000042000)='/dev/snd/seq\x00', 0x0, 0x8000000000102) r2 = dup2(r1, r0) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r2, 0xc08c5332, &(0x7f0000001000)={0x0, 0x0, 0x0, "9ede7a8c5ae95ec8672c93340f643a664f13eeab65c0322901dc6bd36cde2c51f01b7f0b014f9f91eeb7c37c7240f476c8d753d000aa8faf8fb574dbcfa6dc4d"}) write$sndseq(r1, &(0x7f0000002000)=[{0x0, 0x3, 0x0, 0x0, @time={0x77359400}, {}, {}, @ext={0x0, &(0x7f0000ae5000)}}], 0x30) r3 = syz_open_dev$sndseq(&(0x7f0000cea000-0xd)='/dev/snd/seq\x00', 0x0, 0x0) r4 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000e26000)='/dev/sequencer2\x00', 0x0, 0x0) dup2(r4, r3) 2018/02/01 16:23:21 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket(0x18, 0x0, 0x1) sendmmsg(0xffffffffffffffff, &(0x7f0000005000-0x3c)=[{{&(0x7f0000003000)=@in6={0xa, 0xffffffffffffffff, 0x0, @remote={0xfe, 0x80, [], 0xffffffffffffffff, 0xbb}}, 0x1c, &(0x7f0000005000-0x60)=[{&(0x7f0000002000)="4c5614c00401a0dbf8a669ebdedd102c4f7a79e606457dfdf09e2ec2ed253b", 0x1f}], 0x1, &(0x7f0000003000-0x2d0)=[]}}], 0x1, 0x0) connect(r0, &(0x7f0000002000)=@sco={0x1f, {0x1}}, 0x26) sendmmsg$inet_sctp(r0, &(0x7f0000b3f000)=[{&(0x7f0000cca000)=@in6={0xa, 0xffffffffffffffff, 0x0, @mcast2={0xff, 0x2, [], 0x1}}, 0x1c, &(0x7f0000a52000-0x30)=[], 0x0, &(0x7f0000e7f000)=[]}], 0x1, 0x0) 2018/02/01 16:23:21 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$evdev(&(0x7f0000fb2000-0x12)='/dev/input/event#\x00', 0x2, 0x101002) write$evdev(0xffffffffffffffff, &(0x7f0000a12000)=[{{0x0, 0x2710}, 0x1, 0x3a, 0x2}], 0x18) ftruncate(0xffffffffffffffff, 0x10000) sendfile(r0, 0xffffffffffffffff, 0x0, 0x72439a6f) 2018/02/01 16:23:21 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000632000)='./file0\x00', 0x0) mount(&(0x7f000000a000)='./file0\x00', &(0x7f0000015000-0x8)='./file0\x00', &(0x7f0000014000)='ramfs\x00', 0x0, &(0x7f000000a000)) r0 = openat(0xffffffffffffff9c, &(0x7f0000013000-0x8)='./file0\x00', 0x0, 0x0) symlinkat(&(0x7f000001f000-0x3)='./file1\x00', r0, &(0x7f0000013000-0x8)='./file0\x00') linkat(r0, &(0x7f000001b000)='./file0\x00', r0, &(0x7f0000017000)='./file1\x00', 0x0) 2018/02/01 16:23:21 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000064000)={{{@in6=@dev={0xfe, 0x80}, @in6=@loopback={0x0, 0x1}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xa}, {}, {}, 0x0, 0xffffffffffffffff, 0x1}, {{@in=@dev={0xac, 0x14}}, 0x0, @in=@empty, 0xffffffffffffffff, 0x1}}, 0xe8) connect$inet6(r0, &(0x7f0000389000)={0xa, 0xffffffffffffffff, 0x0, @loopback={0x0, 0x1}}, 0x1c) [ 247.520271] binder: 1485:1488 got transaction with too large buffer [ 247.548154] binder: 1485:1488 transaction failed 29201/-22, size 40-8 line 3062 2018/02/01 16:23:21 executing program 0: mmap(&(0x7f0000000000/0xfd2000)=nil, 0xfd2000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = gettid() rt_sigprocmask(0x0, &(0x7f000021f000)={0xfffffffffffffffe}, 0x0, 0x8) timer_create(0x0, &(0x7f0000fd0000)={0x0, 0x14, 0x4, @tid=r0}, &(0x7f0000044000)) clock_gettime(0x0, &(0x7f0000000000)={0x0}) timer_settime(0x0, 0xfffffffffffffffd, &(0x7f0000011000)={{r1}, {r1}}, &(0x7f0000001000-0x10)) timer_gettime(0x0, &(0x7f0000fd2000-0x8)) 2018/02/01 16:23:21 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = memfd_create(&(0x7f000003e000)='\'', 0x0) r1 = syz_open_dev$sndseq(&(0x7f0000042000)='/dev/snd/seq\x00', 0x0, 0x8000000000102) r2 = dup2(r1, r0) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r2, 0xc08c5332, &(0x7f0000001000)={0x0, 0x0, 0x0, "9ede7a8c5ae95ec8672c93340f643a664f13eeab65c0322901dc6bd36cde2c51f01b7f0b014f9f91eeb7c37c7240f476c8d753d000aa8faf8fb574dbcfa6dc4d"}) write$sndseq(r1, &(0x7f0000002000)=[{0x0, 0x3, 0x0, 0x0, @time={0x77359400}, {}, {}, @ext={0x0, &(0x7f0000ae5000)}}], 0x30) r3 = syz_open_dev$sndseq(&(0x7f0000cea000-0xd)='/dev/snd/seq\x00', 0x0, 0x0) r4 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000e26000)='/dev/sequencer2\x00', 0x0, 0x0) dup2(r4, r3) 2018/02/01 16:23:21 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$evdev(&(0x7f0000fb2000-0x12)='/dev/input/event#\x00', 0x2, 0x101002) write$evdev(0xffffffffffffffff, &(0x7f0000a12000)=[{{0x0, 0x2710}, 0x1, 0x3a, 0x2}], 0x18) ftruncate(0xffffffffffffffff, 0x10000) sendfile(r0, 0xffffffffffffffff, 0x0, 0x72439a6f) [ 247.573806] binder: undelivered TRANSACTION_ERROR: 29201 2018/02/01 16:23:22 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x0, &(0x7f0000691000-0x4)=0x79, 0x4) bind$inet(r0, &(0x7f0000887000-0x10)={0x2, 0x3, @broadcast=0xffffffff}, 0x10) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000cd5000-0x4), 0x4) sendto$inet(r0, &(0x7f0000d5a000-0x73), 0xfffffc6c, 0x20000804, &(0x7f0000e1e000)={0x2, 0x3, @loopback=0x7f000001}, 0x10) readv(r0, &(0x7f00007d7000-0x50)=[{&(0x7f0000b7e000)=""/4096, 0x1000}], 0x1) 2018/02/01 16:23:22 executing program 7: r0 = open(&(0x7f0000fc2000)='./file0\x00', 0x141046, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000fb2000-0x12)='/dev/input/event#\x00', 0x2, 0x101002) write$evdev(r0, &(0x7f0000a12000)=[{{0x0, 0x2710}, 0x1, 0x3a, 0x2}], 0x18) ftruncate(r0, 0x10000) sendfile(r1, r0, 0x0, 0x72439a6f) 2018/02/01 16:23:22 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f00001ff000-0x1c)={0xa, 0x2, 0x0, @empty}, 0x1c) r2 = dup2(r0, r0) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000eba000-0x1), 0xfffffd65, 0x20000004, &(0x7f000031e000)={0xa, 0x2, 0x0, @empty}, 0x1c) setsockopt$inet_opts(r2, 0x0, 0x4, &(0x7f0000220000), 0x0) 2018/02/01 16:23:22 executing program 4: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)={0xaa}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) fchmodat(0xffffffffffffffff, &(0x7f0000012000)='./file0\x00', 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x0, 0x32, 0xffffffffffffffff, 0x0) r1 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12, 0x0, @tid}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r1, 0x15) ioctl$UFFDIO_ZEROPAGE(r0, 0x8010aa02, &(0x7f00000c1000-0x10)={&(0x7f0000011000/0x3000)=nil, 0x3000}) 2018/02/01 16:23:22 executing program 3: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)={0xaa}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r1 = inotify_init() inotify_add_watch(r1, &(0x7f0000013000)='./file0\x00', 0x100) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) clone(0x0, &(0x7f0000557000), &(0x7f0000eaa000-0x4), &(0x7f000059c000-0x4), &(0x7f00005ec000)) ioctl$UFFDIO_ZEROPAGE(r0, 0x8010aa02, &(0x7f0000bce000)={&(0x7f0000011000/0x3000)=nil, 0x3000}) 2018/02/01 16:23:22 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) sendto$inet6(r0, &(0x7f0000d66000-0x7a), 0x0, 0x8004, &(0x7f0000826000)={0xa, 0x0, 0x0, @empty}, 0x1c) sendmsg(r0, &(0x7f00000dc000-0x38)={&(0x7f0000f61000)=@in={0x2, 0xffffffffffffffff, @broadcast=0xffffffff}, 0x10, &(0x7f0000b16000)=[], 0x0, &(0x7f000086f000-0x18)=[]}, 0x0) 2018/02/01 16:23:22 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f0000bf6000)=0x177, 0x4) setsockopt$inet6_int(r0, 0x29, 0x4, &(0x7f00003e6000)=0x4, 0x4) sendto$inet6(r0, &(0x7f00009f1000-0x3d), 0x0, 0x0, &(0x7f0000f5b000-0x1c)={0xa, 0x0, 0x0, @empty}, 0x1c) recvmmsg(r0, &(0x7f0000f61000)=[{{&(0x7f0000f63000-0x10)=@ipx, 0x10, &(0x7f0000f5d000)=[], 0x0, &(0x7f0000f62000)}}], 0x1, 0x2041, 0x0) 2018/02/01 16:23:22 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = memfd_create(&(0x7f000003e000)='\'', 0x0) r1 = syz_open_dev$sndseq(&(0x7f0000042000)='/dev/snd/seq\x00', 0x0, 0x8000000000102) r2 = dup2(r1, r0) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r2, 0xc08c5332, &(0x7f0000001000)={0x0, 0x0, 0x0, "9ede7a8c5ae95ec8672c93340f643a664f13eeab65c0322901dc6bd36cde2c51f01b7f0b014f9f91eeb7c37c7240f476c8d753d000aa8faf8fb574dbcfa6dc4d"}) write$sndseq(r1, &(0x7f0000002000)=[{0x0, 0x3, 0x0, 0x0, @time={0x77359400}, {}, {}, @ext={0x0, &(0x7f0000ae5000)}}], 0x30) r3 = syz_open_dev$sndseq(&(0x7f0000cea000-0xd)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_CLIENT(r3, 0x404c534a, &(0x7f0000643000-0x4c)={0x0, 0x0, 0x10001, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdfd]}) dup2(0xffffffffffffffff, r3) 2018/02/01 16:23:22 executing program 7: r0 = open(&(0x7f0000fc2000)='./file0\x00', 0x141046, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000fb2000-0x12)='/dev/input/event#\x00', 0x2, 0x101002) write$evdev(r0, &(0x7f0000a12000)=[{{0x0, 0x2710}, 0x1, 0x3a, 0x2}], 0x18) ftruncate(r0, 0x10000) sendfile(r1, r0, 0x0, 0x72439a6f) 2018/02/01 16:23:22 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = memfd_create(&(0x7f000003e000)='\'', 0x0) r1 = syz_open_dev$sndseq(&(0x7f0000042000)='/dev/snd/seq\x00', 0x0, 0x8000000000102) r2 = dup2(r1, r0) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r2, 0xc08c5332, &(0x7f0000001000)={0x0, 0x0, 0x0, "9ede7a8c5ae95ec8672c93340f643a664f13eeab65c0322901dc6bd36cde2c51f01b7f0b014f9f91eeb7c37c7240f476c8d753d000aa8faf8fb574dbcfa6dc4d"}) write$sndseq(r1, &(0x7f0000002000)=[{0x0, 0x3, 0x0, 0x0, @time={0x77359400}, {}, {}, @ext={0x0, &(0x7f0000ae5000)}}], 0x30) r3 = syz_open_dev$sndseq(&(0x7f0000cea000-0xd)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_CLIENT(r3, 0x404c534a, &(0x7f0000643000-0x4c)={0x0, 0x0, 0x10001, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdfd]}) dup2(0xffffffffffffffff, r3) 2018/02/01 16:23:22 executing program 5: mmap(&(0x7f0000000000/0xfcf000)=nil, 0xfcf000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_int(r0, 0x29, 0x49, &(0x7f0000fce000-0x4), 0x4) 2018/02/01 16:23:22 executing program 7: r0 = open(&(0x7f0000fc2000)='./file0\x00', 0x141046, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000fb2000-0x12)='/dev/input/event#\x00', 0x2, 0x101002) write$evdev(r0, &(0x7f0000a12000)=[{{0x0, 0x2710}, 0x1, 0x3a, 0x2}], 0x18) ftruncate(r0, 0x10000) sendfile(r1, r0, 0x0, 0x72439a6f) 2018/02/01 16:23:22 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) seccomp(0x1, 0x0, &(0x7f0000ad6000-0x10)={0x2, &(0x7f00001d2000)=[{0x0, 0x0, 0x0, 0xffffffffffffffe0}, {0x20000016}]}) getrlimit(0x0, &(0x7f00000a6000)) 2018/02/01 16:23:22 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = memfd_create(&(0x7f000003e000)='\'', 0x0) r1 = syz_open_dev$sndseq(&(0x7f0000042000)='/dev/snd/seq\x00', 0x0, 0x8000000000102) r2 = dup2(r1, r0) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r2, 0xc08c5332, &(0x7f0000001000)={0x0, 0x0, 0x0, "9ede7a8c5ae95ec8672c93340f643a664f13eeab65c0322901dc6bd36cde2c51f01b7f0b014f9f91eeb7c37c7240f476c8d753d000aa8faf8fb574dbcfa6dc4d"}) write$sndseq(r1, &(0x7f0000002000)=[{0x0, 0x3, 0x0, 0x0, @time={0x77359400}, {}, {}, @ext={0x0, &(0x7f0000ae5000)}}], 0x30) r3 = syz_open_dev$sndseq(&(0x7f0000cea000-0xd)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_CLIENT(r3, 0x404c534a, &(0x7f0000643000-0x4c)={0x0, 0x0, 0x10001, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdfd]}) dup2(0xffffffffffffffff, r3) 2018/02/01 16:23:22 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x0, 0x32, 0xffffffffffffffff, 0x0) r0 = open(&(0x7f0000fc2000)='./file0\x00', 0x141046, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000fb2000-0x12)='/dev/input/event#\x00', 0x2, 0x101002) write$evdev(r0, &(0x7f0000a12000)=[{{0x0, 0x2710}, 0x1, 0x3a, 0x2}], 0x18) ftruncate(r0, 0x10000) sendfile(r1, r0, 0x0, 0x72439a6f) [ 248.173770] TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Sending cookies. Check SNMP counters. 2018/02/01 16:23:22 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000001000-0x8)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000014000-0x10)={0x2, &(0x7f00005a6000)=[{0x35}, {0x6}]}, 0x10) write(r1, &(0x7f00007b1000+0xd7a), 0x0) [ 248.261076] kauditd_printk_skb: 1 callbacks suppressed [ 248.261084] audit: type=1326 audit(1517502202.551:176): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 pid=1551 comm="syz-executor2" exe="/root/syz-executor2" sig=31 arch=c000003e syscall=202 compat=0 ip=0x453299 code=0xffff0000 [ 248.305515] audit: type=1326 audit(1517502202.595:177): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 pid=1551 comm="syz-executor2" exe="/root/syz-executor2" sig=31 arch=c000003e syscall=202 compat=0 ip=0x453299 code=0xffff0000 2018/02/01 16:23:23 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x0, &(0x7f0000691000-0x4)=0x79, 0x4) bind$inet(r0, &(0x7f0000887000-0x10)={0x2, 0x3, @broadcast=0xffffffff}, 0x10) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000cd5000-0x4), 0x4) sendto$inet(r0, &(0x7f0000d5a000-0x73), 0xfffffc6c, 0x20000804, &(0x7f0000e1e000)={0x2, 0x3, @loopback=0x7f000001}, 0x10) readv(r0, &(0x7f00007d7000-0x50)=[{&(0x7f0000b7e000)=""/4096, 0x1000}], 0x1) 2018/02/01 16:23:23 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSARP(r0, 0x8955, &(0x7f000022d000-0x44)={{0x2, 0xffffffffffffffff, @broadcast=0xffffffff}, {0x0, @dev={[0xaa, 0xaa, 0xaa, 0xaa]}}, 0x0, {0x2, 0xffffffffffffffff, @broadcast=0xffffffff}, @common='bridge0\x00'}) 2018/02/01 16:23:23 executing program 2: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)={0xaa}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) lstat(&(0x7f0000012000)='./file0\x00', &(0x7f0000000000)) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) clone(0x0, &(0x7f0000f39000), &(0x7f0000eaa000-0x4), &(0x7f0000bf3000-0x4), &(0x7f00003b9000-0xcd)) ioctl$UFFDIO_ZEROPAGE(r0, 0x8010aa02, &(0x7f0000a80000-0x10)={&(0x7f0000011000/0x3000)=nil, 0x3000}) 2018/02/01 16:23:23 executing program 4: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)={0xaa}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) fchmodat(0xffffffffffffffff, &(0x7f0000012000)='./file0\x00', 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x0, 0xffffffffffffffff, 0x0) r1 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12, 0x0, @tid}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r1, 0x15) ioctl$UFFDIO_ZEROPAGE(r0, 0x8010aa02, &(0x7f00000c1000-0x10)={&(0x7f0000011000/0x3000)=nil, 0x3000}) 2018/02/01 16:23:23 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f00007f3000-0x28)={@syzn={0x73, 0x79, 0x7a, 0x0}, &(0x7f00009e2000-0x48)=@ethtool_stats={0x1d, 0x0, []}}) 2018/02/01 16:23:23 executing program 5: mmap(&(0x7f0000000000/0x16000)=nil, 0x16000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$loop(&(0x7f0000010000)='/dev/loop#\x00', 0x0, 0x0) ioctl(r0, 0x4400000000001279, &(0x7f0000003000)) 2018/02/01 16:23:23 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x0, 0x32, 0xffffffffffffffff, 0x0) r0 = open(&(0x7f0000fc2000)='./file0\x00', 0x141046, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000fb2000-0x12)='/dev/input/event#\x00', 0x2, 0x101002) write$evdev(r0, &(0x7f0000a12000)=[{{0x0, 0x2710}, 0x1, 0x3a, 0x2}], 0x18) ftruncate(r0, 0x10000) sendfile(r1, r0, 0x0, 0x72439a6f) 2018/02/01 16:23:23 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = memfd_create(&(0x7f000003e000)='\'', 0x0) r1 = syz_open_dev$sndseq(&(0x7f0000042000)='/dev/snd/seq\x00', 0x0, 0x8000000000102) r2 = dup2(r1, r0) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r2, 0xc08c5332, &(0x7f0000001000)={0x0, 0x0, 0x0, "9ede7a8c5ae95ec8672c93340f643a664f13eeab65c0322901dc6bd36cde2c51f01b7f0b014f9f91eeb7c37c7240f476c8d753d000aa8faf8fb574dbcfa6dc4d"}) write$sndseq(r1, &(0x7f0000002000)=[{0x0, 0x3, 0x0, 0x0, @time={0x77359400}, {}, {}, @ext={0x0, &(0x7f0000ae5000)}}], 0x30) r3 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000e26000)='/dev/sequencer2\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_CLIENT(0xffffffffffffffff, 0x404c534a, &(0x7f0000643000-0x4c)={0x0, 0x0, 0x10001, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdfd]}) dup2(r3, 0xffffffffffffffff) 2018/02/01 16:23:23 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x0, 0x32, 0xffffffffffffffff, 0x0) r0 = open(&(0x7f0000fc2000)='./file0\x00', 0x141046, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000fb2000-0x12)='/dev/input/event#\x00', 0x2, 0x101002) write$evdev(r0, &(0x7f0000a12000)=[{{0x0, 0x2710}, 0x1, 0x3a, 0x2}], 0x18) ftruncate(r0, 0x10000) sendfile(r1, r0, 0x0, 0x72439a6f) 2018/02/01 16:23:23 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = memfd_create(&(0x7f000003e000)='\'', 0x0) r1 = syz_open_dev$sndseq(&(0x7f0000042000)='/dev/snd/seq\x00', 0x0, 0x8000000000102) r2 = dup2(r1, r0) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r2, 0xc08c5332, &(0x7f0000001000)={0x0, 0x0, 0x0, "9ede7a8c5ae95ec8672c93340f643a664f13eeab65c0322901dc6bd36cde2c51f01b7f0b014f9f91eeb7c37c7240f476c8d753d000aa8faf8fb574dbcfa6dc4d"}) write$sndseq(r1, &(0x7f0000002000)=[{0x0, 0x3, 0x0, 0x0, @time={0x77359400}, {}, {}, @ext={0x0, &(0x7f0000ae5000)}}], 0x30) r3 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000e26000)='/dev/sequencer2\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_CLIENT(0xffffffffffffffff, 0x404c534a, &(0x7f0000643000-0x4c)={0x0, 0x0, 0x10001, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdfd]}) dup2(r3, 0xffffffffffffffff) 2018/02/01 16:23:23 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x0, 0xffffffffffffffff, 0x0) r0 = open(&(0x7f0000fc2000)='./file0\x00', 0x141046, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000fb2000-0x12)='/dev/input/event#\x00', 0x2, 0x101002) write$evdev(r0, &(0x7f0000a12000)=[{{0x0, 0x2710}, 0x1, 0x3a, 0x2}], 0x18) ftruncate(r0, 0x10000) sendfile(r1, r0, 0x0, 0x72439a6f) 2018/02/01 16:23:23 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = inotify_init1(0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000c10000)={0x0}, &(0x7f0000959000)=0xc) fcntl$setown(r0, 0x8, r1) fcntl$getownex(r0, 0x10, &(0x7f0000a83000-0x8)={0x0, 0x0}) ptrace$setopts(0x4206, r2, 0x0, 0x0) tkill(r2, 0x31) ptrace$setopts(0x420b, r2, 0x0, 0x0) 2018/02/01 16:23:23 executing program 5: mmap(&(0x7f0000000000/0xfda000)=nil, 0xfda000, 0x4, 0x31, 0xffffffffffffffff, 0x0) r0 = socket(0xa, 0x2, 0x0) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000a1b000-0x9)={@empty}, 0x14) 2018/02/01 16:23:23 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqn(r0, 0x0, 0x27, &(0x7f0000000000)={@multicast2=0xe0000002, @loopback=0x7f000001}, 0xc) setsockopt$inet_msfilter(r0, 0x0, 0x29, &(0x7f000023b000-0x18)={@multicast2=0xe0000002, @loopback=0x7f000001, 0x1, 0x1, [@empty]}, 0x14) 2018/02/01 16:23:23 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = memfd_create(&(0x7f000003e000)='\'', 0x0) r1 = syz_open_dev$sndseq(&(0x7f0000042000)='/dev/snd/seq\x00', 0x0, 0x8000000000102) r2 = dup2(r1, r0) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r2, 0xc08c5332, &(0x7f0000001000)={0x0, 0x0, 0x0, "9ede7a8c5ae95ec8672c93340f643a664f13eeab65c0322901dc6bd36cde2c51f01b7f0b014f9f91eeb7c37c7240f476c8d753d000aa8faf8fb574dbcfa6dc4d"}) write$sndseq(r1, &(0x7f0000002000)=[{0x0, 0x3, 0x0, 0x0, @time={0x77359400}, {}, {}, @ext={0x0, &(0x7f0000ae5000)}}], 0x30) r3 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000e26000)='/dev/sequencer2\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_CLIENT(0xffffffffffffffff, 0x404c534a, &(0x7f0000643000-0x4c)={0x0, 0x0, 0x10001, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdfd]}) dup2(r3, 0xffffffffffffffff) 2018/02/01 16:23:23 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x0, 0xffffffffffffffff, 0x0) r0 = open(&(0x7f0000fc2000)='./file0\x00', 0x141046, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000fb2000-0x12)='/dev/input/event#\x00', 0x2, 0x101002) write$evdev(r0, &(0x7f0000a12000)=[{{0x0, 0x2710}, 0x1, 0x3a, 0x2}], 0x18) ftruncate(r0, 0x10000) sendfile(r1, r0, 0x0, 0x72439a6f) [ 248.812343] ptrace attach of "/root/syz-executor0"[4064] was attempted by "/root/syz-executor0"[1606] 2018/02/01 16:23:23 executing program 4: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)={0xaa}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) fchmodat(0xffffffffffffffff, &(0x7f0000012000)='./file0\x00', 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x0, 0xffffffffffffffff, 0x0) r1 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12, 0x0, @tid}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r1, 0x15) ioctl$UFFDIO_ZEROPAGE(r0, 0x8010aa02, &(0x7f00000c1000-0x10)={&(0x7f0000011000/0x3000)=nil, 0x3000}) 2018/02/01 16:23:23 executing program 5: mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x3, 0x32, 0xffffffffffffffff, 0x0) wait4(0x0, &(0x7f0000001000-0x4), 0x0, &(0x7f0000002000-0x90)={{}, {0x0, 0x0}}) select(0x40, &(0x7f0000987000-0x40), &(0x7f00009eb000), &(0x7f0000000000), &(0x7f0000000000)={0x77359400, r0}) 2018/02/01 16:23:23 executing program 0: mmap(&(0x7f0000000000/0xd29000)=nil, 0xd29000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = open(&(0x7f0000521000-0x8)='./file0\x00', 0x141042, 0x0) ftruncate(r0, 0x7fff) mmap(&(0x7f0000d29000/0x1000)=nil, 0x1000, 0x3, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f000051c000-0xa)='/dev/ptmx\x00', 0x802, 0x0) sendfile(0xffffffffffffffff, r0, &(0x7f0000336000-0x8), 0xffffffff) ioctl$TIOCSSOFTCAR(r1, 0x541a, &(0x7f0000d27000-0x4)) 2018/02/01 16:23:23 executing program 2: mmap(&(0x7f0000000000/0xd000)=nil, 0xd000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket(0x18, 0x0, 0x1) sendmmsg(0xffffffffffffffff, &(0x7f0000005000)=[{{&(0x7f0000007000)=@in6={0xa, 0xffffffffffffffff, 0x0, @remote={0xfe, 0x80, [], 0xffffffffffffffff, 0xbb}}, 0x1c, &(0x7f0000005000-0x60)=[{&(0x7f0000002000)="4c5614c00401a0dbf8a669ebdedd102c4f7a79e606457dfdf09e2ec2ed253b", 0x1f}], 0x1, &(0x7f0000009000-0x438)=[]}}], 0x1, 0x0) connect(r0, &(0x7f0000002000)=@sco={0x1f, {0x1}}, 0x26) 2018/02/01 16:23:23 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x2, &(0x7f0000691000-0x4), 0x4) bind$inet(r0, &(0x7f0000887000-0x10)={0x2, 0x3, @broadcast=0xffffffff}, 0x10) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000cd5000-0x4), 0x4) sendto$inet(r0, &(0x7f0000d5a000-0x73), 0xfffffc6c, 0x20000804, &(0x7f0000e1e000)={0x2, 0x3, @loopback=0x7f000001}, 0x10) readv(r0, &(0x7f00007d7000-0x50)=[{&(0x7f0000b7e000)=""/4096, 0x1000}], 0x1) 2018/02/01 16:23:23 executing program 3: socketpair$inet_udp(0x2, 0x2, 0x0, &(0x7f0000f8b000)) 2018/02/01 16:23:23 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = memfd_create(&(0x7f000003e000)='\'', 0x0) r1 = syz_open_dev$sndseq(&(0x7f0000042000)='/dev/snd/seq\x00', 0x0, 0x8000000000102) r2 = dup2(r1, r0) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r2, 0xc08c5332, &(0x7f0000001000)={0x0, 0x0, 0x0, "9ede7a8c5ae95ec8672c93340f643a664f13eeab65c0322901dc6bd36cde2c51f01b7f0b014f9f91eeb7c37c7240f476c8d753d000aa8faf8fb574dbcfa6dc4d"}) r3 = syz_open_dev$sndseq(&(0x7f0000cea000-0xd)='/dev/snd/seq\x00', 0x0, 0x0) r4 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000e26000)='/dev/sequencer2\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_CLIENT(r3, 0x404c534a, &(0x7f0000643000-0x4c)={0x0, 0x0, 0x10001, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdfd]}) dup2(r4, r3) 2018/02/01 16:23:23 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x0, 0xffffffffffffffff, 0x0) r0 = open(&(0x7f0000fc2000)='./file0\x00', 0x141046, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000fb2000-0x12)='/dev/input/event#\x00', 0x2, 0x101002) write$evdev(r0, &(0x7f0000a12000)=[{{0x0, 0x2710}, 0x1, 0x3a, 0x2}], 0x18) ftruncate(r0, 0x10000) sendfile(r1, r0, 0x0, 0x72439a6f) 2018/02/01 16:23:23 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket(0x11, 0x803, 0x300) r1 = socket$inet(0x2, 0x1, 0x0) connect$inet(r1, &(0x7f000089c000-0x10)={0x2, 0xffffffffffffffff, @empty}, 0x10) setsockopt$packet_int(r0, 0x107, 0xf, &(0x7f0000daf000-0x4)=0x9, 0x4) recvmmsg(r0, &(0x7f000094f000)=[{{&(0x7f0000e19000)=@nfc, 0x10, &(0x7f00006ca000)=[], 0x0, &(0x7f0000560000)=""/129, 0x81}}], 0x1, 0x0, 0x0) 2018/02/01 16:23:23 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = memfd_create(&(0x7f000003e000)='\'', 0x0) r1 = syz_open_dev$sndseq(&(0x7f0000042000)='/dev/snd/seq\x00', 0x0, 0x8000000000102) r2 = dup2(r1, r0) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r2, 0xc08c5332, &(0x7f0000001000)={0x0, 0x0, 0x0, "9ede7a8c5ae95ec8672c93340f643a664f13eeab65c0322901dc6bd36cde2c51f01b7f0b014f9f91eeb7c37c7240f476c8d753d000aa8faf8fb574dbcfa6dc4d"}) r3 = syz_open_dev$sndseq(&(0x7f0000cea000-0xd)='/dev/snd/seq\x00', 0x0, 0x0) r4 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000e26000)='/dev/sequencer2\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_CLIENT(r3, 0x404c534a, &(0x7f0000643000-0x4c)={0x0, 0x0, 0x10001, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdfd]}) dup2(r4, r3) 2018/02/01 16:23:23 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_mtu(r0, 0x29, 0x17, &(0x7f0000a63000)=0x3, 0x4) sendto$inet6(r0, &(0x7f0000fac000-0xf), 0x0, 0x0, &(0x7f00006e5000-0x1c)={0xa, 0x0, 0x0, @loopback={0x0, 0x1}}, 0x1c) 2018/02/01 16:23:23 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mkdir(&(0x7f000043f000-0x8)='./file0\x00', 0x0) mount(&(0x7f0000018000)='./file0\x00', &(0x7f0000027000)='./file0\x00', &(0x7f0000019000-0x6)='ramfs\x00', 0x40, &(0x7f000000a000)) r0 = creat(&(0x7f0000cd5000)='./file0/bus\x00', 0xbc9dc8fbd81cb4b1) fcntl$lock(r0, 0x7, &(0x7f00007ec000)={0x1}) writev(r0, &(0x7f0000729000-0x60)=[{&(0x7f0000ccb000-0x47)="1c", 0x1}], 0x1) truncate(&(0x7f0000afe000)='./file0/bus\x00', 0x0) 2018/02/01 16:23:23 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mq_notify(0xffffffffffffffff, &(0x7f0000000000)={0xfffffffffffffffe, 0x7e, 0x0, @tid}) 2018/02/01 16:23:23 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = open(&(0x7f0000fc2000)='./file0\x00', 0x0, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000fb2000-0x12)='/dev/input/event#\x00', 0x2, 0x101002) write$evdev(r0, &(0x7f0000a12000)=[{{0x0, 0x2710}, 0x1, 0x3a, 0x2}], 0x18) ftruncate(r0, 0x10000) sendfile(r1, r0, 0x0, 0x72439a6f) 2018/02/01 16:23:23 executing program 5: mmap(&(0x7f0000000000/0x8000)=nil, 0x8000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000002000)) listen(r0, 0x0) epoll_pwait(r1, &(0x7f0000005000-0x3c)=[{}], 0x1, 0x0, &(0x7f0000004000-0x8), 0x8) 2018/02/01 16:23:23 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = memfd_create(&(0x7f000003e000)='\'', 0x0) r1 = syz_open_dev$sndseq(&(0x7f0000042000)='/dev/snd/seq\x00', 0x0, 0x8000000000102) r2 = dup2(r1, r0) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r2, 0xc08c5332, &(0x7f0000001000)={0x0, 0x0, 0x0, "9ede7a8c5ae95ec8672c93340f643a664f13eeab65c0322901dc6bd36cde2c51f01b7f0b014f9f91eeb7c37c7240f476c8d753d000aa8faf8fb574dbcfa6dc4d"}) r3 = syz_open_dev$sndseq(&(0x7f0000cea000-0xd)='/dev/snd/seq\x00', 0x0, 0x0) r4 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000e26000)='/dev/sequencer2\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_CLIENT(r3, 0x404c534a, &(0x7f0000643000-0x4c)={0x0, 0x0, 0x10001, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdfd]}) dup2(r4, r3) 2018/02/01 16:23:24 executing program 4: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)={0xaa}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) fchmodat(0xffffffffffffffff, &(0x7f0000012000)='./file0\x00', 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x0, 0xffffffffffffffff, 0x0) r1 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12, 0x0, @tid}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r1, 0x15) ioctl$UFFDIO_ZEROPAGE(r0, 0x8010aa02, &(0x7f00000c1000-0x10)={&(0x7f0000011000/0x3000)=nil, 0x3000}) 2018/02/01 16:23:24 executing program 2: mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) recvmsg(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000000)=[], 0x0, &(0x7f0000d8f000)=""/155, 0x9b}, 0x2000) 2018/02/01 16:23:24 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000510000)={@loopback}, &(0x7f00007f6000)=0x14) r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f00005d6000-0xd)={0x2, 0x0, @rand_addr}, 0x10) sendto$inet(r0, &(0x7f0000de2000-0x1), 0x0, 0x20008005, &(0x7f0000db5000-0x10)={0x2, 0x0, @loopback=0x7f000001}, 0x10) sendto$inet(r0, &(0x7f0000b0c000)="11a58fde7649496403db92ed306004b3d3cbfc195485c3b895d864ab91a3aebde4f70a917a91ec9612d004000a7b43a35bb73249ede41bf5c05ab608fb7b74ffd57f6e8e43cf9cb723fc0d8d8cabbbbae3a5fde8ad6f52d667c512596f50b9962aa2193688d872a7eeca57801742d74d39c4b003a5e292e077ed102e7999329aab95a3d96363505f76c86a6d2352dd8025207ae531701f1ce353d6b017eb64000000bc2e9f8b66fe4a8e64f0fc7a0aa55d4103e1d7d5b0dd5750071e9b3a786021678a86fcbb0b9f9364ec0f0310306fef9c21b3b20d8b44423b495299cea2c6f40c377a72534453ad7f5af27b1efb2514ace1f9a68cf205a9ddb8fd954e34bde3612e6e05686cf3b968a14bd3a356f7b8d20214c0f7a388ef5ea8d063c65f2aabff685e69f86b4a0b3697f8bfbfe66796f0489ad2e49bdbc1742941c28c88cb93e1f8ccc3db4782cdf9cbd797ddc8d7b1364da50ad48e081a38622280169eba5c6a3bf9b5f15bdf8a8b6483340a3297c31154905db209195c28f15d10153204fbe0586516c714ddc939e0eb68c73969e81fc6f215b476ddf3fcf1a604603360089dadba2779cfed9027ac163067fc0d7592ac8a013b907372a42b242405241ac1f63f85a52fff2d78b30e87a156b5cfa133dabc259bb027bec5eb8c8eb623e9776a13d3ce972a6769de8a78153f498084a244b0146b77be3d1cba7b02fe8906ed8a88f105c763d1772825b986d52823bf38b6f95eca494fd9c64497874b9f450bec65311493cc108b27611eaa6819305a3730d29368f25f7e816d60884a1e0271c3c786ad36391366ac3b65f04c148974f6973005c5ff73d6f0b3f7e44c65da7c4115c4ee543991e4ad26938384cafffffffc8f7e79aaf1b8ef37f627e3c7168ecda2cf224a491bea6129fcd954b88dbb2d29464931bcd5378041db67ddc70ee856ae09c1b26b9ada008a7d52bf1a160606865a29794f36b2a3811c66e9fe27af8fc8356374e37f3eca244367fb535dde71fae4683710761b89f18820d4f06065450c3d1f76fa26ef28320edf6c36480af14f4444edb40ebb3f8ea264486ec31c40c7f0007a69c24da10db6f60da3e648f16b5fc6b5a5c6217e46c1f3ff354a8b49beb3b46a69dcb4c5d547a7b7ba8fe22da0173f9fe80f4bd47afbec4d2e0d3c91b1a326d8bb9fded873e87f847032af52bd6d129f3ce3f11ea9d0b4250af7eaa2649d9972b9b8dc773c869b3a431eac7f55d6bb92dc29f08d7d8959e2af7571efb7ec88eac4b62850e8f6b60d4a5d06d66875b4bd260a9014a2eb88621f4c6eb3f9ed2190b48acf0358d8b82fb4794535fcb8dd50ba86d23d230a94f07a768142ff3b4c8558dac21726b6279980c238041f26e86c8e3fa83028345999464e3e37d610ab7c15daaffb744a505a3dd9802b3721f29553ee23e1cf376f12cc3fe6b7ac76bd13da44356855be096155e355c9cad31fcdeedc6679c531bc1a2765dc8777108ec5e31d793005e718a9ced77d6505e44f649128a29f5264fecba132f9f5016eaf690751edd64d903b36ceb2b08042c60e9e97f8bc985476e6088a5ebd3743c2358171b30b16d730a5dd49c92fa19cc267e2c1927f200fc3d23a804f0a12b06a6a88a2685051ab28f1721209ada2c14b557a49423795b07040d510bb21ce5d15acedd18cb7cb7a93389ceb934206e4ffb220048a7a82fb3c251d0a31ba5af9eb0c16e29f33f9d0a78f5e6300cf04d17eb5f67711cafa0d4e99eeaf0f8fdbd34170318879a0d12c01891127ba7b677d204268524c5af1d7dc27176826302e34f9d35d2f2eefad5f22f68929d3456c11d5f00d4a8ce8b784bca8088805731eff2d47024c2da68abc2d2c0f7806d7d76cdf489f3bffa75cb826bc0809331d89a3255a498b8150d4ae31d03414ab244939455b6377c2917cb2d8a9f9ebf282657e417860e49ac94f4a838aefd34f28960a78da47933252d8cb2fdb27d413ee54502cd1bf75585468b77b8dca627cab29ef0a5297ee3dcb4c987520804e9a5f45e8241019281bab7e30f4b008bf0edf3b6fb5e8d1c2ab619b2eb84293d636a6a37d716cd8e102b7099676693cb7b01031b57ee93fd22cb18229893fd4d4ef87f1596879ac9f61b2f0c35be34cb6e6f75087ff963c188d43bcb464a95e956e75559eb1f6f2224fb2ca8f0bdc90ae5c2ce712498ee4026b13b8f3137000aa1545a75e5b48e80da30e6dac5529cac1099244e79ad542f45dcfbf16c62b5eb63daee8185c5e79ebfa1ca60880f9e2895f54ab95bbae38ae62200c1e439d73fa63d0bff75935a8ad2ae73b82132e8d4eb4bd55844b2f55c65d5ffa0c65aaf0cc5bc73925d05cf7c1c4383af074feb3a53919d2a3b5bef96115aab966821dbfc4577d19d85911a485c58a5b87cf44d230cfdc255486bb09d5c16f2164397f0fc5f652a171f0269bdcd98291410c010cc377d2690a6032fe5701117adbd0f6b847c9617a9b3d20529024d8d9749b9c49827694d346d3b1bbe434122331986b9f6e84430dfd75d123f3e307d6f5514f3da09b527408bfb6816da54beeefad160e4b095517f3292c2e17fb3bba47527671d0afe7c35d54d25ab307b15d069a05395a9cddd4b519224fe3c689d14827ede6d91ebace2a80afaad3dcd1f8ce20e92012b8934d7ff3ebdd285cc24202a86d70b96674a6af05a3c29065afa4e38b9c34006cb3eb9c87985cfc511a8c261cdeb0c7a3c7a682c40c5b9f1d7d5ef6f97e32d02fdd3f2ded413f4a36c4db899b96c8e40d91c2743cd1d435013e3c3431c82fc5b3345b66cce79fa49f10baa4ef28535eee8c5c1a4b38bace2fb14ec11d34d620b1cc2396dc1fa857ac6ac9f5689b5935f2f25184edd40f8f5c70714f941beae3e1bc9af757edd9d68fb24218e2a02aad4dc0b3c2e5ff94ce547f358f38e52673473fd0e57497978324aee16559e9cdbe5b3a0b96dd69fe5bc97e644487274b6158a0412bd60172bb66f774b8eae7bc1f52ed64d44c553bdc26823e35f18683554e7359802173d1fa86a66104abb1977c3e9fa6970ed7ee483b14b65673a81786fe0ed301f8edb0669fd25bfa0d565e3e93b19b8572c98dbacb103053527a95ee758be002e13df756bbc486def0db079124db72fadc26f0a26b42e21f260f902bb4cd881baae57eff1c3cc15063be17e48208b9a69622adfc03991d204fe0f5ae2528b22c7743f97e0669a1c3c0d0d90f39846fd954d681be0265d14b12285fb1b20bcbaa95915ad51ab8f84094674cbac0071021b261c39a46b0177b98f1662100ef31a3e981236d51e6c1429144a89d46b149301873ef99959f8ab15c12309620d5d548b62ff92233a3f200e0d0a9c2122be615dd91e6a6cd89290d24895540635fead9a56f481ee3fd7890852e271fa7c37b1836a3e1764574960e1ab9fda1d25693cfc33defea84f65c08cce479c66dc16b28d453a1b717fdd9f6ff46b1fa1b6866b4a8c1ad53439c5958403953b3a844b660b28b11d427b392a7c710edbf25725a65e6b94e4c64ae458a8c97c9f7a05a7d8ebf6c76e3afc0204ced97be84986da5403ef31eff1790c039fe00a89976ccab7638d2e217fc64609a41f3a008ed78b25d1a9420b782deef6ce2db0c6d427580087b69c75c1357ed2908c32cffee1c6ddd08510562ab015507a4eb4f54ae5c097cdca34f521f9fa8df7667645a696a472650c1ca9c035e95f34db54722897159c31dc6be5693a5f3871ccbb48a7ead233d03b76875590fa20bae4f37a2011622d0203a3e9d9e198cb075aba26f5e78a8f0b0cd27052527daf0f8e77858dbddec7038c198b868e93ae32f1745d166afed4129460e07af8cb6c3debb6503e87f3cb309e39ed3d682d24adec48ea22702c4d8d48386977a89b73e585f8c2c5fcb0a693cd5028a601b04b833a41ec705735c767c70d316b60aba2da24bd6523533f3180accade90f47e412b393ee1d2456cf8bb430289ddb824350764985c5e35f738f830a378bfa65fd167c7307c13acb912beefa69e499d4a750e820a7af08a7c204ffb64e09fcc921a4e79999757d608880bfd52255bbc16369af4f779edfd9439cfcd17fcc02d5aaa81bac66fa2e551cef55779bd90e8be587ee698575918fced59ec652af26718b3afd1471379132ba0b5143a78f84605b1ef51e49e820a8a8c1639f66bca5afd83602287e982eb125a3a032e4cc5b5be91ab4d8d958fd4dc4cbd310eddc91d89ada4d33fcc963d259e222520281d14e13577906e33665a31afa7cb501cc0c1198d1f755005e82f29bcda62bbf8680bc23d09cac6a8c89709b30c91d27ea148f01ba745346f1ba9ce89cd9b71ff18668a0254c07479762dbb78117c50450506e2a0a606309aa383ec55a49d2569c3a3fef8aad456aa81cb859519765de18a4b92194e8a6a43f1dade801f71eb56699bc021fa48f320f4128d6c153a2ec1fba1c5ca55c5058641692365d311c8902aaf1428d83281aa970af5d98591cd3af30fbb5ee4a1b697491ff6dd727a329feb17b782f254d691f949baf96afa195c62f2c3fd1855a79b25268cef9822e3c6a1b3aa226ec494b070a8774426a5f8877714fe206e569635805208ac7823c8546ec33e4482a85d6fddf86a37a1c60f0a19b5dfe88031b7541af0e93cac8a3bb1ff3e60190b96faedc3b6f63d38f3ee4286fbaa053e8e27ed13b77b2c576d824d777ca53df76d9572e71f74ff180778bf57458b37fe9dbaa6f9927b48b059e5c7fd908ac826aed8f68764285022f4b5cb6b73ef7222ecb0d701c782ed5c16a7c94235fe7c3e0bef9da7310c5f3cda407c5ae7ecfb6b392ad576610b48af17b3fc8a2fd6cd2eee1153cc48a21ba6768a88367a807be008bea547402da4c92c2006c83d74c9d0ef2ca711c54036c8e76ac26c7d22060c9bfc2e67f1d1c6f6bd2f751879295ee21fcf8588c9504cacb02fa3e3fc6e2bed352447a5c2677caba0538960357d6d1706adef5e7d4f6298ed4ecacb7776de15d9bbd672f9991f4bdc4f07401f67cf3a74c0495ea58d0f76a2e6060cecc1d04b93808dc8d61130305740b408359d5552cc23a7b1eff4285d563b4b6b011a4a11372a2bb01cbda724482f95c4487b02c85cc121012b3213041ff6a689072daa4d86a4c125b110f4e2eeed2dd73db0f94ce995896e0b8a9f8f3e9559024251a5b1726b0b3775bac9fabed968d2d4ea31bbdfb2910331d92cb4ff5cc9037cc08cd35f88c4d7b89e46a8cbd05e3c35732b5046b33060dce5372b171daa526a46c3444b331e71f0455fb8b43dc46e2c9f2c4effccf040e56de00000007b16de337f13e7a610feac2f336e75405a530815366e7edfbb429babfd0e68db56892b94621edd9df6ff454ab1dcdb8d39d282fa7932ec7ba5203df2f4196538a1fa040c8014d20ff57fdb8515325a6997b9b71f2094e053f126402a47e628eeb7d8f665fbabe8f1a409ca9c7c5c25baaa0e9945acf27e96f8241a445f7d3352494ba4210b348fa0ec11ea67dead4fc1e5e4f9202931386468882bee59f8d12174198142ef7764d6b930e937e20d018c0cc5a780490356f5521aac74d2c1736e20ae5e0cd8cf6676ac337e8a8976aac75a698e34e72bac561038f228c13b6e974bc21bb79618111db507f3ba314dd2d05fd050d684cf33d8da5f8e5f723a092098ac5b180a6579d543515c2e1d0eb502193aedab526d354b625990c7d5a9f90d86c4e374054f1d14270b603065293e7fa3840de575413b74bfbc4f8c139947ade9a6f48907053f1ae3a95c2", 0x1001, 0xc004, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000b9f000-0x8)='net/tcp\x00') preadv(r1, &(0x7f0000b79000-0x70)=[{&(0x7f00006a5000-0x86)=""/134, 0x86}, {&(0x7f00006da000)=""/195, 0xc3}], 0x2, 0x0) 2018/02/01 16:23:24 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x2000000800000002) read(r0, &(0x7f00002cc000)=""/24, 0x18) write$evdev(r0, &(0x7f0000001000-0x30)=[{{}, 0x0, 0x100000001}, {}], 0x30) 2018/02/01 16:23:24 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = open(&(0x7f0000fc2000)='./file0\x00', 0x0, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000fb2000-0x12)='/dev/input/event#\x00', 0x2, 0x101002) write$evdev(r0, &(0x7f0000a12000)=[{{0x0, 0x2710}, 0x1, 0x3a, 0x2}], 0x18) ftruncate(r0, 0x10000) sendfile(r1, r0, 0x0, 0x72439a6f) 2018/02/01 16:23:24 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = memfd_create(&(0x7f000003e000)='\'', 0x0) r1 = syz_open_dev$sndseq(&(0x7f0000042000)='/dev/snd/seq\x00', 0x0, 0x8000000000102) dup2(r1, r0) write$sndseq(r1, &(0x7f0000002000)=[{0x0, 0x3, 0x0, 0x0, @time={0x77359400}, {}, {}, @ext={0x0, &(0x7f0000ae5000)}}], 0x30) r2 = syz_open_dev$sndseq(&(0x7f0000cea000-0xd)='/dev/snd/seq\x00', 0x0, 0x0) r3 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000e26000)='/dev/sequencer2\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_CLIENT(r2, 0x404c534a, &(0x7f0000643000-0x4c)={0x0, 0x0, 0x10001, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdfd]}) dup2(r3, r2) 2018/02/01 16:23:24 executing program 5: mmap(&(0x7f0000000000/0xfd7000)=nil, 0xfd7000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x80002, 0x88) connect$inet6(r0, &(0x7f0000fd5000)={0xa, 0xffffffffffffffff, 0x0, @empty}, 0x1c) 2018/02/01 16:23:24 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x2, &(0x7f0000691000-0x4), 0x4) bind$inet(r0, &(0x7f0000887000-0x10)={0x2, 0x3, @broadcast=0xffffffff}, 0x10) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000cd5000-0x4), 0x4) sendto$inet(r0, &(0x7f0000d5a000-0x73), 0xfffffc6c, 0x20000804, &(0x7f0000e1e000)={0x2, 0x3, @loopback=0x7f000001}, 0x10) readv(r0, &(0x7f00007d7000-0x50)=[{&(0x7f0000b7e000)=""/4096, 0x1000}], 0x1) 2018/02/01 16:23:24 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) socket(0x11, 0x3, 0x0) socket$inet(0x2, 0xa, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000c77000)='net/packet\x00') pread64(r0, &(0x7f00006f6000), 0x0, 0x2000000) 2018/02/01 16:23:24 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)={0xaa}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000-0x20)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000011000)={{&(0x7f0000797000/0x4000)=nil, 0x4000}}) ioctl$UFFDIO_ZEROPAGE(r0, 0x8010aa02, &(0x7f0000002000-0x10)={&(0x7f0000011000/0x3000)=nil, 0x3000}) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$UFFDIO_ZEROPAGE(r0, 0x8010aa02, &(0x7f00000c1000-0x10)={&(0x7f0000011000/0x3000)=nil, 0x3000}) 2018/02/01 16:23:24 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = open(&(0x7f0000fc2000)='./file0\x00', 0x0, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000fb2000-0x12)='/dev/input/event#\x00', 0x2, 0x101002) write$evdev(r0, &(0x7f0000a12000)=[{{0x0, 0x2710}, 0x1, 0x3a, 0x2}], 0x18) ftruncate(r0, 0x10000) sendfile(r1, r0, 0x0, 0x72439a6f) 2018/02/01 16:23:24 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = memfd_create(&(0x7f000003e000)='\'', 0x0) r1 = syz_open_dev$sndseq(&(0x7f0000042000)='/dev/snd/seq\x00', 0x0, 0x8000000000102) dup2(r1, r0) write$sndseq(r1, &(0x7f0000002000)=[{0x0, 0x3, 0x0, 0x0, @time={0x77359400}, {}, {}, @ext={0x0, &(0x7f0000ae5000)}}], 0x30) r2 = syz_open_dev$sndseq(&(0x7f0000cea000-0xd)='/dev/snd/seq\x00', 0x0, 0x0) r3 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000e26000)='/dev/sequencer2\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_CLIENT(r2, 0x404c534a, &(0x7f0000643000-0x4c)={0x0, 0x0, 0x10001, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdfd]}) dup2(r3, r2) [ 249.957454] FAULT_FLAG_ALLOW_RETRY missing 30 [ 249.962222] CPU: 1 PID: 1681 Comm: syz-executor2 Not tainted 4.15.0+ #290 [ 249.969148] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 249.978481] Call Trace: [ 249.981051] dump_stack+0x194/0x257 [ 249.984659] ? arch_local_irq_restore+0x53/0x53 [ 249.989304] ? gup_pgd_range+0x843/0x2cf0 [ 249.993429] ? handle_userfault+0xb97/0x2500 [ 249.997817] handle_userfault+0xbd9/0x2500 [ 250.002028] ? handle_userfault+0x185a/0x2500 [ 250.006511] ? userfaultfd_ioctl+0x4520/0x4520 [ 250.011066] ? debug_check_no_locks_freed+0x3c0/0x3c0 [ 250.016230] ? __gup_device_huge+0x170/0x170 [ 250.020627] ? print_irqtrace_events+0x270/0x270 [ 250.025358] ? print_irqtrace_events+0x270/0x270 [ 250.030092] ? __lock_acquire+0x664/0x3e00 [ 250.034315] ? __lock_acquire+0x664/0x3e00 [ 250.038525] ? __lock_acquire+0x664/0x3e00 [ 250.042739] ? check_noncircular+0x20/0x20 [ 250.046957] ? debug_check_no_locks_freed+0x3c0/0x3c0 [ 250.052122] ? debug_check_no_locks_freed+0x3c0/0x3c0 [ 250.057283] ? rb_next+0x140/0x140 [ 250.060802] ? find_held_lock+0x35/0x1d0 [ 250.064846] ? __handle_mm_fault+0x3296/0x3ce0 [ 250.069406] ? lock_downgrade+0x980/0x980 [ 250.073527] ? print_irqtrace_events+0x270/0x270 [ 250.078259] ? lock_release+0xa40/0xa40 [ 250.082210] ? check_noncircular+0x20/0x20 [ 250.086419] ? do_raw_spin_trylock+0x190/0x190 [ 250.090975] ? userfaultfd_ctx_put+0x720/0x720 [ 250.095535] ? print_irqtrace_events+0x231/0x270 [ 250.100265] ? check_noncircular+0x20/0x20 [ 250.104486] __handle_mm_fault+0x32a3/0x3ce0 [ 250.108876] ? __pmd_alloc+0x4e0/0x4e0 [ 250.112738] ? check_noncircular+0x20/0x20 [ 250.116946] ? cpuacct_charge+0x2e6/0x5c0 [ 250.121073] ? find_held_lock+0x35/0x1d0 [ 250.125118] ? handle_mm_fault+0x2a0/0x930 [ 250.129328] ? lock_downgrade+0x980/0x980 [ 250.133476] handle_mm_fault+0x38f/0x930 [ 250.137514] ? __handle_mm_fault+0x3ce0/0x3ce0 [ 250.142071] ? vmacache_find+0x5f/0x280 [ 250.146027] ? find_vma+0x30/0x150 [ 250.149549] __do_page_fault+0x5c9/0xc90 [ 250.153596] ? mm_fault_error+0x2c0/0x2c0 [ 250.157722] ? check_noncircular+0x20/0x20 [ 250.161938] do_page_fault+0xee/0x720 [ 250.165715] ? __do_page_fault+0xc90/0xc90 [ 250.169928] ? find_held_lock+0x35/0x1d0 [ 250.173974] ? __might_fault+0x110/0x1d0 [ 250.178022] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 250.182849] page_fault+0x2c/0x60 [ 250.186280] RIP: 0010:copy_user_generic_unrolled+0x86/0xc0 [ 250.191874] RSP: 0018:ffff8801ce9f7530 EFLAGS: 00010206 [ 250.197213] RAX: ffffed0039d3ef8f RBX: 0000000020011000 RCX: 0000000000000003 [ 250.204455] RDX: 0000000000000000 RSI: 0000000020011000 RDI: ffff8801ce9f7c60 [ 250.211698] RBP: ffff8801ce9f7560 R08: ffffed0039d3ef8f R09: ffffed0039d3ef8f [ 250.218941] R10: 0000000000000003 R11: ffffed0039d3ef8e R12: 0000000000000018 [ 250.226184] R13: ffff8801ce9f7c60 R14: 00007ffffffff000 R15: 0000000020011018 [ 250.233453] ? _copy_from_user+0xc5/0x110 [ 250.237581] userfaultfd_ioctl+0x1edb/0x4520 [ 250.241964] ? check_noncircular+0x20/0x20 [ 250.246188] ? debug_check_no_locks_freed+0x3c0/0x3c0 [ 250.251360] ? userfaultfd_read+0x220/0x220 [ 250.255660] ? __lock_is_held+0xb6/0x140 [ 250.259702] ? print_irqtrace_events+0x270/0x270 [ 250.264437] ? __lock_is_held+0xb6/0x140 [ 250.268484] ? set_next_entity+0x2ed/0xd70 [ 250.272698] ? __lock_acquire+0x664/0x3e00 [ 250.276905] ? check_noncircular+0x20/0x20 [ 250.281117] ? __enqueue_entity+0x109/0x1e0 [ 250.285424] ? debug_check_no_locks_freed+0x3c0/0x3c0 [ 250.290589] ? find_held_lock+0x35/0x1d0 [ 250.294634] ? finish_task_switch+0x1d3/0x740 [ 250.299105] ? lock_downgrade+0x980/0x980 [ 250.303227] ? load_balance+0x34c0/0x34c0 [ 250.307353] ? lock_release+0xa40/0xa40 [ 250.311304] ? compat_start_thread+0x80/0x80 [ 250.315688] ? do_raw_spin_trylock+0x190/0x190 [ 250.320247] ? _raw_spin_unlock_irq+0x27/0x70 [ 250.324721] ? trace_hardirqs_on_caller+0x421/0x5c0 [ 250.329712] ? trace_hardirqs_on+0xd/0x10 [ 250.333835] ? _raw_spin_unlock_irq+0x27/0x70 [ 250.338304] ? finish_task_switch+0x1d3/0x740 [ 250.342769] ? finish_task_switch+0x1aa/0x740 [ 250.347241] ? check_noncircular+0x20/0x20 [ 250.351448] ? copy_overflow+0x20/0x20 [ 250.355327] ? find_held_lock+0x35/0x1d0 [ 250.359372] ? __fget+0x333/0x570 [ 250.362804] ? lock_downgrade+0x980/0x980 [ 250.366929] ? lock_release+0xa40/0xa40 [ 250.370882] ? __lock_is_held+0xb6/0x140 [ 250.374930] ? __fget+0x35c/0x570 [ 250.378365] ? iterate_fd+0x3f0/0x3f0 [ 250.382138] ? __fd_install+0x288/0x740 [ 250.386094] ? get_unused_fd_flags+0x190/0x190 [ 250.390657] ? userfaultfd_read+0x220/0x220 [ 250.394951] do_vfs_ioctl+0x1b1/0x1520 [ 250.398810] ? do_vfs_ioctl+0x1b1/0x1520 [ 250.402873] ? ioctl_preallocate+0x2b0/0x2b0 [ 250.407260] ? selinux_capable+0x40/0x40 [ 250.411310] ? syscall_return_slowpath+0x2ad/0x550 [ 250.416223] ? security_file_ioctl+0x89/0xb0 [ 250.420610] SyS_ioctl+0x8f/0xc0 [ 250.423955] entry_SYSCALL_64_fastpath+0x29/0xa0 [ 250.428683] RIP: 0033:0x453299 [ 250.431847] RSP: 002b:00007fe2f145dc58 EFLAGS: 00000212 ORIG_RAX: 0000000000000010 [ 250.439528] RAX: ffffffffffffffda RBX: 000000000071bea0 RCX: 0000000000453299 [ 250.446772] RDX: 0000000020011000 RSI: 00000000c020aa00 RDI: 0000000000000013 2018/02/01 16:23:24 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = add_key$keyring(&(0x7f0000789000-0x8)='keyring\x00', &(0x7f00006f1000)={0x73, 0x79, 0x7a}, 0x0, 0x0, 0xfffffffffffffffe) keyctl$assume_authority(0x10, r0) 2018/02/01 16:23:24 executing program 5: mmap(&(0x7f0000000000/0xffa000)=nil, 0xffa000, 0x3, 0x32, 0xffffffffffffffff, 0x0) seccomp(0x1, 0x0, &(0x7f0000029000-0x10)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0xffffffff}]}) fstat(0xffffffffffffffff, &(0x7f0000001000-0x44)) 2018/02/01 16:23:24 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = memfd_create(&(0x7f000003e000)='\'', 0x0) r1 = syz_open_dev$sndseq(&(0x7f0000042000)='/dev/snd/seq\x00', 0x0, 0x8000000000102) dup2(r1, r0) write$sndseq(r1, &(0x7f0000002000)=[{0x0, 0x3, 0x0, 0x0, @time={0x77359400}, {}, {}, @ext={0x0, &(0x7f0000ae5000)}}], 0x30) r2 = syz_open_dev$sndseq(&(0x7f0000cea000-0xd)='/dev/snd/seq\x00', 0x0, 0x0) r3 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000e26000)='/dev/sequencer2\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_CLIENT(r2, 0x404c534a, &(0x7f0000643000-0x4c)={0x0, 0x0, 0x10001, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdfd]}) dup2(r3, r2) 2018/02/01 16:23:24 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00003de000)='attr/keycreate\x00') sendfile(r0, r0, &(0x7f0000643000-0x8), 0x114a) 2018/02/01 16:23:24 executing program 4: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)={0xaa}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) fchmodat(0xffffffffffffffff, &(0x7f0000012000)='./file0\x00', 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r1 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x0, 0x0, @tid}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r1, 0x15) ioctl$UFFDIO_ZEROPAGE(r0, 0x8010aa02, &(0x7f00000c1000-0x10)={&(0x7f0000011000/0x3000)=nil, 0x3000}) 2018/02/01 16:23:24 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12, 0x0, @thr={&(0x7f0000140000-0x1a), &(0x7f0000e22000-0xf)}}, &(0x7f0000044000)) clock_gettime(0x0, &(0x7f0000926000)={0x0, 0x0}) select(0x40, &(0x7f000012d000-0x40), &(0x7f0000892000-0x40), &(0x7f0000367000), &(0x7f0000fb1000)={0x0, r0/1000+10000}) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) clone(0x0, &(0x7f0000f94000-0xb3), &(0x7f0000d3e000), &(0x7f0000827000), &(0x7f0000528000)) mmap(&(0x7f0000000000/0x95c000)=nil, 0x95c000, 0x0, 0x44031, 0xffffffffffffffff, 0x0) r1 = getpgid(0x0) tkill(r1, 0x1100000000016) 2018/02/01 16:23:24 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x2, &(0x7f0000691000-0x4), 0x4) bind$inet(r0, &(0x7f0000887000-0x10)={0x2, 0x3, @broadcast=0xffffffff}, 0x10) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000cd5000-0x4), 0x4) sendto$inet(r0, &(0x7f0000d5a000-0x73), 0xfffffc6c, 0x20000804, &(0x7f0000e1e000)={0x2, 0x3, @loopback=0x7f000001}, 0x10) readv(r0, &(0x7f00007d7000-0x50)=[{&(0x7f0000b7e000)=""/4096, 0x1000}], 0x1) 2018/02/01 16:23:24 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = open(&(0x7f0000fc2000)='./file0\x00', 0x141046, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000fb2000-0x12)='/dev/input/event#\x00', 0x0, 0x101002) write$evdev(r0, &(0x7f0000a12000)=[{{0x0, 0x2710}, 0x1, 0x3a, 0x2}], 0x18) ftruncate(r0, 0x10000) sendfile(r1, r0, 0x0, 0x72439a6f) [ 250.454018] RBP: 000000000000031e R08: 0000000000000000 R09: 0000000000000000 [ 250.461261] R10: 0000000000000000 R11: 0000000000000212 R12: 00000000006f3b70 [ 250.468504] R13: 00000000ffffffff R14: 00007fe2f145e6d4 R15: 0000000000000000 2018/02/01 16:23:24 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) memfd_create(&(0x7f000003e000)='\'', 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000042000)='/dev/snd/seq\x00', 0x0, 0x8000000000102) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(0xffffffffffffffff, 0xc08c5332, &(0x7f0000001000)={0x0, 0x0, 0x0, "9ede7a8c5ae95ec8672c93340f643a664f13eeab65c0322901dc6bd36cde2c51f01b7f0b014f9f91eeb7c37c7240f476c8d753d000aa8faf8fb574dbcfa6dc4d"}) write$sndseq(r0, &(0x7f0000002000)=[{0x0, 0x3, 0x0, 0x0, @time={0x77359400}, {}, {}, @ext={0x0, &(0x7f0000ae5000)}}], 0x30) r1 = syz_open_dev$sndseq(&(0x7f0000cea000-0xd)='/dev/snd/seq\x00', 0x0, 0x0) r2 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000e26000)='/dev/sequencer2\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_CLIENT(r1, 0x404c534a, &(0x7f0000643000-0x4c)={0x0, 0x0, 0x10001, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdfd]}) dup2(r2, r1) 2018/02/01 16:23:24 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mkdir(&(0x7f00003c2000-0x8)='./file0\x00', 0x0) mount(&(0x7f00006d3000)='./file0\x00', &(0x7f0000236000-0x8)='./file0\x00', &(0x7f0000319000)='ramfs\x00', 0xd, &(0x7f00000e5000-0x2)) chmod(&(0x7f0000a24000-0x8)='./file0\x00', 0x0) 2018/02/01 16:23:24 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = epoll_create1(0x0) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00008d2000)='/dev/sequencer2\x00', 0x2, 0x0) epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r1, &(0x7f000001a000-0xc)) write$sndseq(r1, &(0x7f000000a000)=[{0x81, 0x5, 0x0, 0x0, @tick, {}, {}, @addr}], 0x30) 2018/02/01 16:23:24 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = open(&(0x7f0000fc2000)='./file0\x00', 0x141046, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000fb2000-0x12)='/dev/input/event#\x00', 0x0, 0x101002) write$evdev(r0, &(0x7f0000a12000)=[{{0x0, 0x2710}, 0x1, 0x3a, 0x2}], 0x18) ftruncate(r0, 0x10000) sendfile(r1, r0, 0x0, 0x72439a6f) [ 250.533534] audit: type=1326 audit(1517502204.824:178): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 pid=1697 comm="syz-executor5" exe="/root/syz-executor5" sig=31 arch=c000003e syscall=202 compat=0 ip=0x453299 code=0xffff0000 2018/02/01 16:23:24 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) rt_sigaction(0x36, &(0x7f0000a04000), &(0x7f0000972000), 0x8, &(0x7f0000e12000)) 2018/02/01 16:23:24 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) unshare(0x8000000) r0 = mq_open(&(0x7f0000000000)='*GPL[vmnet1@vmnet1{-vmnet@vboxnet0!vboxnet1+M\x00', 0x6e93ebbbcc0884ef, 0x0, &(0x7f0000665000-0x40)={0x0, 0x7, 0x2}) mq_getsetattr(r0, &(0x7f0000fb2000)={0x800}, &(0x7f000066a000-0x40)) 2018/02/01 16:23:24 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = open(&(0x7f0000fc2000)='./file0\x00', 0x141046, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000fb2000-0x12)='/dev/input/event#\x00', 0x0, 0x101002) write$evdev(r0, &(0x7f0000a12000)=[{{0x0, 0x2710}, 0x1, 0x3a, 0x2}], 0x18) ftruncate(r0, 0x10000) sendfile(r1, r0, 0x0, 0x72439a6f) 2018/02/01 16:23:24 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) memfd_create(&(0x7f000003e000)='\'', 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000042000)='/dev/snd/seq\x00', 0x0, 0x8000000000102) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(0xffffffffffffffff, 0xc08c5332, &(0x7f0000001000)={0x0, 0x0, 0x0, "9ede7a8c5ae95ec8672c93340f643a664f13eeab65c0322901dc6bd36cde2c51f01b7f0b014f9f91eeb7c37c7240f476c8d753d000aa8faf8fb574dbcfa6dc4d"}) write$sndseq(r0, &(0x7f0000002000)=[{0x0, 0x3, 0x0, 0x0, @time={0x77359400}, {}, {}, @ext={0x0, &(0x7f0000ae5000)}}], 0x30) r1 = syz_open_dev$sndseq(&(0x7f0000cea000-0xd)='/dev/snd/seq\x00', 0x0, 0x0) r2 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000e26000)='/dev/sequencer2\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_CLIENT(r1, 0x404c534a, &(0x7f0000643000-0x4c)={0x0, 0x0, 0x10001, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdfd]}) dup2(r2, r1) 2018/02/01 16:23:24 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000a71000-0x1c)={0xa, 0x2, 0x0, @mcast1={0xff, 0x1, [], 0x1}, 0x1}, 0x1c) r1 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r1, &(0x7f0000739000)={0x2, 0x2, @multicast1=0xe0000001}, 0x10) 2018/02/01 16:23:24 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) memfd_create(&(0x7f000003e000)='\'', 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000042000)='/dev/snd/seq\x00', 0x0, 0x8000000000102) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(0xffffffffffffffff, 0xc08c5332, &(0x7f0000001000)={0x0, 0x0, 0x0, "9ede7a8c5ae95ec8672c93340f643a664f13eeab65c0322901dc6bd36cde2c51f01b7f0b014f9f91eeb7c37c7240f476c8d753d000aa8faf8fb574dbcfa6dc4d"}) write$sndseq(r0, &(0x7f0000002000)=[{0x0, 0x3, 0x0, 0x0, @time={0x77359400}, {}, {}, @ext={0x0, &(0x7f0000ae5000)}}], 0x30) r1 = syz_open_dev$sndseq(&(0x7f0000cea000-0xd)='/dev/snd/seq\x00', 0x0, 0x0) r2 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000e26000)='/dev/sequencer2\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_CLIENT(r1, 0x404c534a, &(0x7f0000643000-0x4c)={0x0, 0x0, 0x10001, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdfd]}) dup2(r2, r1) 2018/02/01 16:23:24 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x2, &(0x7f0000691000-0x4)=0x79, 0x4) bind$inet(0xffffffffffffffff, &(0x7f0000887000-0x10)={0x2, 0x3, @broadcast=0xffffffff}, 0x10) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000cd5000-0x4), 0x4) sendto$inet(r0, &(0x7f0000d5a000-0x73), 0xfffffc6c, 0x20000804, &(0x7f0000e1e000)={0x2, 0x3, @loopback=0x7f000001}, 0x10) readv(r0, &(0x7f00007d7000-0x50)=[{&(0x7f0000b7e000)=""/4096, 0x1000}], 0x1) 2018/02/01 16:23:24 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000cc8000)='/dev/ptmx\x00', 0x80000000000002, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003ba000-0x24)) r1 = syz_open_pts(r0, 0x0) read(r1, &(0x7f000007c000-0x6f)=""/111, 0x6f) ioctl$TCSETS(r0, 0x5402, &(0x7f0000273000-0x24)) openat$ptmx(0xffffffffffffff9c, &(0x7f0000d76000)='/dev/ptmx\x00', 0x0, 0x0) write(r0, &(0x7f0000b85000-0x13a)="9c", 0x1) [ 250.651505] audit: type=1326 audit(1517502204.878:179): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 pid=1697 comm="syz-executor5" exe="/root/syz-executor5" sig=31 arch=c000003e syscall=202 compat=0 ip=0x453299 code=0xffff0000 2018/02/01 16:23:25 executing program 4: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)={0xaa}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) fchmodat(0xffffffffffffffff, &(0x7f0000012000)='./file0\x00', 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r1 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x0, 0x0, @tid}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r1, 0x15) ioctl$UFFDIO_ZEROPAGE(r0, 0x8010aa02, &(0x7f00000c1000-0x10)={&(0x7f0000011000/0x3000)=nil, 0x3000}) 2018/02/01 16:23:25 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) r2 = epoll_create1(0x0) r3 = timerfd_create(0x0, 0x0) timerfd_settime(r3, 0x3, &(0x7f0000005000)={{}, {0x0, 0x989680}}, &(0x7f0000ca4000)) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000559000)={0xffffffff80000009}) epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r3, &(0x7f0000022000-0xc)={0x2003}) epoll_ctl$EPOLL_CTL_MOD(r0, 0x3, r3, &(0x7f0000c83000)) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r1, &(0x7f0000019000)) 2018/02/01 16:23:25 executing program 0: r0 = add_key$user(&(0x7f0000006000-0x5)='user\x00', &(0x7f0000003000)={0x73, 0x79, 0x7a}, &(0x7f0000001000), 0x0, 0x0) keyctl$assume_authority(0x10, r0) 2018/02/01 16:23:25 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = memfd_create(&(0x7f000003e000)='\'', 0x0) r1 = dup2(0xffffffffffffffff, r0) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r1, 0xc08c5332, &(0x7f0000001000)={0x0, 0x0, 0x0, "9ede7a8c5ae95ec8672c93340f643a664f13eeab65c0322901dc6bd36cde2c51f01b7f0b014f9f91eeb7c37c7240f476c8d753d000aa8faf8fb574dbcfa6dc4d"}) write$sndseq(0xffffffffffffffff, &(0x7f0000002000)=[{0x0, 0x3, 0x0, 0x0, @time={0x77359400}, {}, {}, @ext={0x0, &(0x7f0000ae5000)}}], 0x30) r2 = syz_open_dev$sndseq(&(0x7f0000cea000-0xd)='/dev/snd/seq\x00', 0x0, 0x0) r3 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000e26000)='/dev/sequencer2\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_CLIENT(r2, 0x404c534a, &(0x7f0000643000-0x4c)={0x0, 0x0, 0x10001, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdfd]}) dup2(r3, r2) 2018/02/01 16:23:25 executing program 5: mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000001000-0xd)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_CLIENT(r0, 0x404c534a, &(0x7f0000a1d000)) 2018/02/01 16:23:25 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x2, &(0x7f0000691000-0x4)=0x79, 0x4) bind$inet(0xffffffffffffffff, &(0x7f0000887000-0x10)={0x2, 0x3, @broadcast=0xffffffff}, 0x10) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000cd5000-0x4), 0x4) sendto$inet(r0, &(0x7f0000d5a000-0x73), 0xfffffc6c, 0x20000804, &(0x7f0000e1e000)={0x2, 0x3, @loopback=0x7f000001}, 0x10) readv(r0, &(0x7f00007d7000-0x50)=[{&(0x7f0000b7e000)=""/4096, 0x1000}], 0x1) 2018/02/01 16:23:25 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = open(&(0x7f0000fc2000)='./file0\x00', 0x141046, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000fb2000-0x12)='/dev/input/event#\x00', 0x2, 0x0) write$evdev(r0, &(0x7f0000a12000)=[{{0x0, 0x2710}, 0x1, 0x3a, 0x2}], 0x18) ftruncate(r0, 0x10000) sendfile(r1, r0, 0x0, 0x72439a6f) 2018/02/01 16:23:25 executing program 3: mmap(&(0x7f0000000000/0xfe6000)=nil, 0xfe6000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = open(&(0x7f00003b7000-0x8)='./file0\x00', 0x10000000080040, 0x0) fcntl$setlease(r0, 0x400, 0x0) rename(&(0x7f0000fde000-0x8)='./file0\x00', &(0x7f00007c7000)='./file1\x00') rt_sigprocmask(0x0, &(0x7f0000033000-0x8)={0xfffffffffffffffe}, 0x0, 0x8) rt_sigtimedwait(&(0x7f00009ac000)={0xfffffffffffffffd}, &(0x7f0000fe6000-0x10), &(0x7f000003a000-0x10)={0x0, 0x8000000}, 0x8) fcntl$setsig(r0, 0xa, 0xe) creat(&(0x7f0000fdf000-0x8)='./file1\x00', 0x0) 2018/02/01 16:23:25 executing program 0: mmap(&(0x7f0000000000/0x13000)=nil, 0x13000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$packet(0x11, 0x8000000003, 0x300) sendto$inet6(r0, &(0x7f0000011000), 0x0, 0x0, &(0x7f0000008000)={0xa, 0xffffffffffffffff, 0x3, @empty}, 0x1c) 2018/02/01 16:23:25 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x2, &(0x7f0000691000-0x4)=0x79, 0x4) bind$inet(0xffffffffffffffff, &(0x7f0000887000-0x10)={0x2, 0x3, @broadcast=0xffffffff}, 0x10) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000cd5000-0x4), 0x4) sendto$inet(r0, &(0x7f0000d5a000-0x73), 0xfffffc6c, 0x20000804, &(0x7f0000e1e000)={0x2, 0x3, @loopback=0x7f000001}, 0x10) readv(r0, &(0x7f00007d7000-0x50)=[{&(0x7f0000b7e000)=""/4096, 0x1000}], 0x1) 2018/02/01 16:23:25 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = memfd_create(&(0x7f000003e000)='\'', 0x0) r1 = dup2(0xffffffffffffffff, r0) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r1, 0xc08c5332, &(0x7f0000001000)={0x0, 0x0, 0x0, "9ede7a8c5ae95ec8672c93340f643a664f13eeab65c0322901dc6bd36cde2c51f01b7f0b014f9f91eeb7c37c7240f476c8d753d000aa8faf8fb574dbcfa6dc4d"}) write$sndseq(0xffffffffffffffff, &(0x7f0000002000)=[{0x0, 0x3, 0x0, 0x0, @time={0x77359400}, {}, {}, @ext={0x0, &(0x7f0000ae5000)}}], 0x30) r2 = syz_open_dev$sndseq(&(0x7f0000cea000-0xd)='/dev/snd/seq\x00', 0x0, 0x0) r3 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000e26000)='/dev/sequencer2\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_CLIENT(r2, 0x404c534a, &(0x7f0000643000-0x4c)={0x0, 0x0, 0x10001, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdfd]}) dup2(r3, r2) 2018/02/01 16:23:25 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = open(&(0x7f0000fc2000)='./file0\x00', 0x141046, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000fb2000-0x12)='/dev/input/event#\x00', 0x2, 0x0) write$evdev(r0, &(0x7f0000a12000)=[{{0x0, 0x2710}, 0x1, 0x3a, 0x2}], 0x18) ftruncate(r0, 0x10000) sendfile(r1, r0, 0x0, 0x72439a6f) 2018/02/01 16:23:25 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000001000-0x8)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f00008d6000)={0x2, &(0x7f00008d6000-0x18)=[{0x50}, {0x6}]}, 0x10) sendto$unix(r1, &(0x7f00008d6000), 0x0, 0x0, &(0x7f00008b6000-0x8)=@abs={0x0, 0x0, 0x0}, 0x8) 2018/02/01 16:23:25 executing program 2: mmap(&(0x7f0000000000/0x22000)=nil, 0x22000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket(0x18, 0x0, 0x1) sendmmsg(0xffffffffffffffff, &(0x7f0000002000)=[{{0x0, 0x0, &(0x7f0000003000-0x30)=[], 0x0, &(0x7f0000008000-0x2a0)=[]}}], 0x1, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000011000)=[{{&(0x7f0000003000)=@in6={0xa, 0xffffffffffffffff, 0x0, @mcast1={0xff, 0x1, [], 0x1}}, 0x1c, &(0x7f0000005000-0x60)=[{&(0x7f0000002000)="4c5614c00401a0dbf8a669ebdedd102c4f7a79e606457dfdf09e2ec2ed253b", 0x1f}], 0x1, &(0x7f0000003000-0x2d0)=[]}}], 0x1, 0x0) connect(r0, &(0x7f0000002000)=@sco={0x1f, {0x1}}, 0x26) ioctl$PPPIOCGFLAGS(r0, 0x8004745a, &(0x7f0000022000-0x4)) 2018/02/01 16:23:25 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = memfd_create(&(0x7f000003e000)='\'', 0x0) r1 = dup2(0xffffffffffffffff, r0) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r1, 0xc08c5332, &(0x7f0000001000)={0x0, 0x0, 0x0, "9ede7a8c5ae95ec8672c93340f643a664f13eeab65c0322901dc6bd36cde2c51f01b7f0b014f9f91eeb7c37c7240f476c8d753d000aa8faf8fb574dbcfa6dc4d"}) write$sndseq(0xffffffffffffffff, &(0x7f0000002000)=[{0x0, 0x3, 0x0, 0x0, @time={0x77359400}, {}, {}, @ext={0x0, &(0x7f0000ae5000)}}], 0x30) r2 = syz_open_dev$sndseq(&(0x7f0000cea000-0xd)='/dev/snd/seq\x00', 0x0, 0x0) r3 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000e26000)='/dev/sequencer2\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_CLIENT(r2, 0x404c534a, &(0x7f0000643000-0x4c)={0x0, 0x0, 0x10001, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdfd]}) dup2(r3, r2) 2018/02/01 16:23:25 executing program 0: mmap(&(0x7f0000000000/0x55000)=nil, 0x55000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = memfd_create(&(0x7f0000035000-0x2)='\x00 ', 0x0) r1 = syz_open_dev$sndseq(&(0x7f0000054000-0xd)='/dev/snd/seq\x00', 0x0, 0x101802) r2 = dup2(r1, r0) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r2, 0xc08c5332, &(0x7f000002b000)={0x0, 0x0, 0x0, "9ede7a8c5ae95ec8672c93340f643b564f13eeab65c0322901dc6bd36cde2c51f01b7f0b014f9f91eeb7c37c7240f476c8d753d0030000008fb574dbcfa6dc4d"}) write$sndseq(r0, &(0x7f0000045000-0x30)=[{0x0, 0x1, 0x0, 0x0, @tick=0x3, {}, {}, @ext={0x0, &(0x7f0000051000)}}], 0x30) write$sndseq(r2, &(0x7f0000049000-0x1c)=[{0x0, 0x1ff, 0x0, 0x0, @tick=0x3, {}, {}, @control}], 0x1c) 2018/02/01 16:23:25 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000042000)='/dev/snd/seq\x00', 0x0, 0x8000000000102) r1 = dup2(r0, 0xffffffffffffffff) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r1, 0xc08c5332, &(0x7f0000001000)={0x0, 0x0, 0x0, "9ede7a8c5ae95ec8672c93340f643a664f13eeab65c0322901dc6bd36cde2c51f01b7f0b014f9f91eeb7c37c7240f476c8d753d000aa8faf8fb574dbcfa6dc4d"}) write$sndseq(r0, &(0x7f0000002000)=[{0x0, 0x3, 0x0, 0x0, @time={0x77359400}, {}, {}, @ext={0x0, &(0x7f0000ae5000)}}], 0x30) r2 = syz_open_dev$sndseq(&(0x7f0000cea000-0xd)='/dev/snd/seq\x00', 0x0, 0x0) r3 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000e26000)='/dev/sequencer2\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_CLIENT(r2, 0x404c534a, &(0x7f0000643000-0x4c)={0x0, 0x0, 0x10001, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdfd]}) dup2(r3, r2) 2018/02/01 16:23:25 executing program 4: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)={0xaa}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) fchmodat(0xffffffffffffffff, &(0x7f0000012000)='./file0\x00', 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r1 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x0, 0x0, @tid}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r1, 0x15) ioctl$UFFDIO_ZEROPAGE(r0, 0x8010aa02, &(0x7f00000c1000-0x10)={&(0x7f0000011000/0x3000)=nil, 0x3000}) 2018/02/01 16:23:25 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x2, &(0x7f0000691000-0x4)=0x79, 0x4) bind$inet(r0, &(0x7f0000887000-0x10)={0x2, 0xffffffffffffffff, @broadcast=0xffffffff}, 0x10) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000cd5000-0x4), 0x4) sendto$inet(r0, &(0x7f0000d5a000-0x73), 0xfffffc6c, 0x20000804, &(0x7f0000e1e000)={0x2, 0x3, @loopback=0x7f000001}, 0x10) readv(r0, &(0x7f00007d7000-0x50)=[{&(0x7f0000b7e000)=""/4096, 0x1000}], 0x1) 2018/02/01 16:23:25 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f00003f2000-0x8)='./file0\x00', 0x0) unshare(0x40600) mq_timedsend(r0, &(0x7f0000c2a000), 0x0, 0x0, 0x0) 2018/02/01 16:23:25 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000f4f000-0x8)='./file0\x00', 0x0) mount(&(0x7f000003b000)='./file0\x00', &(0x7f00005df000)='./file0\x00', &(0x7f000000c000)='ramfs\x00', 0x0, &(0x7f0000b7a000)) mkdir(&(0x7f0000915000-0x10)='./file0/control\x00', 0x0) symlink(&(0x7f0000747000)='./file0\x00', &(0x7f0000ab9000)='./file0/control/file0\x00') rmdir(&(0x7f0000125000-0x10)='./file0/control\x00') 2018/02/01 16:23:25 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = open(&(0x7f0000fc2000)='./file0\x00', 0x141046, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000fb2000-0x12)='/dev/input/event#\x00', 0x2, 0x0) write$evdev(r0, &(0x7f0000a12000)=[{{0x0, 0x2710}, 0x1, 0x3a, 0x2}], 0x18) ftruncate(r0, 0x10000) sendfile(r1, r0, 0x0, 0x72439a6f) 2018/02/01 16:23:25 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) socket$packet(0x11, 0x3, 0x300) r0 = socket$inet(0x2, 0x2, 0x0) setsockopt$inet_mtu(r0, 0x0, 0xa, &(0x7f0000ff1000-0x4)=0x8000000000004, 0x9c) socket$packet(0x11, 0x200000000a, 0x300) sendto$inet(r0, &(0x7f0000865000), 0xffe4, 0x0, &(0x7f0000fda000-0x10)={0x2, 0x0, @rand_addr}, 0x10) 2018/02/01 16:23:25 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000009000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000f000-0x30)={0x14, 0x0, &(0x7f000000e000)=[@increfs_done={0x40106308}], 0x0, 0xfdfd, &(0x7f000000d000-0x68)}) [ 251.691294] IPv4: Oversized IP packet from 127.0.0.1 [ 251.697922] binder: 1796:1804 BC_INCREFS_DONE node 577 has no pending increfs request [ 251.717314] binder: BINDER_SET_CONTEXT_MGR already set [ 251.723086] binder: 1796:1808 ioctl 40046207 0 returned -16 2018/02/01 16:23:26 executing program 4: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)={0xaa}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) fchmodat(0xffffffffffffffff, &(0x7f0000012000)='./file0\x00', 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r1 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12, 0x0, @tid}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(0x0, 0x15) ioctl$UFFDIO_ZEROPAGE(r0, 0x8010aa02, &(0x7f00000c1000-0x10)={&(0x7f0000011000/0x3000)=nil, 0x3000}) 2018/02/01 16:23:26 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000042000)='/dev/snd/seq\x00', 0x0, 0x8000000000102) r1 = dup2(r0, 0xffffffffffffffff) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r1, 0xc08c5332, &(0x7f0000001000)={0x0, 0x0, 0x0, "9ede7a8c5ae95ec8672c93340f643a664f13eeab65c0322901dc6bd36cde2c51f01b7f0b014f9f91eeb7c37c7240f476c8d753d000aa8faf8fb574dbcfa6dc4d"}) write$sndseq(r0, &(0x7f0000002000)=[{0x0, 0x3, 0x0, 0x0, @time={0x77359400}, {}, {}, @ext={0x0, &(0x7f0000ae5000)}}], 0x30) r2 = syz_open_dev$sndseq(&(0x7f0000cea000-0xd)='/dev/snd/seq\x00', 0x0, 0x0) r3 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000e26000)='/dev/sequencer2\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_CLIENT(r2, 0x404c534a, &(0x7f0000643000-0x4c)={0x0, 0x0, 0x10001, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdfd]}) dup2(r3, r2) 2018/02/01 16:23:26 executing program 0: mmap(&(0x7f0000000000/0xfda000)=nil, 0xfda000, 0x4, 0x31, 0xffffffffffffffff, 0x0) utimensat(0xffffffffffffffff, &(0x7f0000fdd000)='./file0\x00', &(0x7f00007cd000-0x20), 0x104) 2018/02/01 16:23:26 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$evdev(&(0x7f0000073000-0x12)='/dev/input/event#\x00', 0x0, 0x2) read(r0, &(0x7f000077f000+0x9d8)=""/24, 0x18) write$evdev(r0, &(0x7f0000708000)=[{{0x0, 0x2710}, 0x0, 0x2}, {}], 0x30) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) mlock(&(0x7f0000db9000/0x12000)=nil, 0x12000) socket$inet6_icmp(0xa, 0x2, 0x3a) 2018/02/01 16:23:26 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = memfd_create(&(0x7f000001d000-0x5)='.\x00', 0x0) r1 = syz_open_dev$sndseq(&(0x7f0000042000-0xd)='/dev/snd/seq\x00', 0x0, 0x20002) dup2(r1, r0) write$sndseq(r0, &(0x7f0000001000-0x1b0)=[{0x0, 0x0, 0x0, 0xfffffffffffffffe, @tick, {}, {}, @result}], 0x30) 2018/02/01 16:23:26 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x2, &(0x7f0000691000-0x4)=0x79, 0x4) bind$inet(r0, &(0x7f0000887000-0x10)={0x2, 0xffffffffffffffff, @broadcast=0xffffffff}, 0x10) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000cd5000-0x4), 0x4) sendto$inet(r0, &(0x7f0000d5a000-0x73), 0xfffffc6c, 0x20000804, &(0x7f0000e1e000)={0x2, 0x3, @loopback=0x7f000001}, 0x10) readv(r0, &(0x7f00007d7000-0x50)=[{&(0x7f0000b7e000)=""/4096, 0x1000}], 0x1) 2018/02/01 16:23:26 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) sched_rr_get_interval(0x0, &(0x7f00004a1000)) 2018/02/01 16:23:26 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = open(&(0x7f0000fc2000)='./file0\x00', 0x141046, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000fb2000-0x12)='/dev/input/event#\x00', 0x2, 0x101002) write$evdev(0xffffffffffffffff, &(0x7f0000a12000)=[{{0x0, 0x2710}, 0x1, 0x3a, 0x2}], 0x18) ftruncate(r0, 0x10000) sendfile(r1, r0, 0x0, 0x72439a6f) 2018/02/01 16:23:26 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = inotify_init1(0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000c10000)={0x0}, &(0x7f0000959000)=0xc) fcntl$setown(r0, 0x8, r1) fcntl$getownex(r0, 0x10, &(0x7f0000f9d000-0x8)={0x0, 0x0}) ptrace$setopts(0x4206, r2, 0x0, 0x0) tkill(r2, 0x8000000000000023) mq_notify(0xffffffffffffffff, &(0x7f000007b000-0x58)={0x0, 0x0, 0x0, @tid}) ptrace$setopts(0x420b, r2, 0x8, 0x20000008) 2018/02/01 16:23:26 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000042000)='/dev/snd/seq\x00', 0x0, 0x8000000000102) r1 = dup2(r0, 0xffffffffffffffff) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r1, 0xc08c5332, &(0x7f0000001000)={0x0, 0x0, 0x0, "9ede7a8c5ae95ec8672c93340f643a664f13eeab65c0322901dc6bd36cde2c51f01b7f0b014f9f91eeb7c37c7240f476c8d753d000aa8faf8fb574dbcfa6dc4d"}) write$sndseq(r0, &(0x7f0000002000)=[{0x0, 0x3, 0x0, 0x0, @time={0x77359400}, {}, {}, @ext={0x0, &(0x7f0000ae5000)}}], 0x30) r2 = syz_open_dev$sndseq(&(0x7f0000cea000-0xd)='/dev/snd/seq\x00', 0x0, 0x0) r3 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000e26000)='/dev/sequencer2\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_CLIENT(r2, 0x404c534a, &(0x7f0000643000-0x4c)={0x0, 0x0, 0x10001, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdfd]}) dup2(r3, r2) 2018/02/01 16:23:26 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f00000ef000)='/selinux/avc/hash_stats\x00', 0x0, 0x0) read$eventfd(r0, &(0x7f000054c000-0x8), 0x8) 2018/02/01 16:23:26 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x2, &(0x7f0000691000-0x4)=0x79, 0x4) bind$inet(r0, &(0x7f0000887000-0x10)={0x2, 0xffffffffffffffff, @broadcast=0xffffffff}, 0x10) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000cd5000-0x4), 0x4) sendto$inet(r0, &(0x7f0000d5a000-0x73), 0xfffffc6c, 0x20000804, &(0x7f0000e1e000)={0x2, 0x3, @loopback=0x7f000001}, 0x10) readv(r0, &(0x7f00007d7000-0x50)=[{&(0x7f0000b7e000)=""/4096, 0x1000}], 0x1) 2018/02/01 16:23:26 executing program 2: mmap(&(0x7f0000000000/0xfda000)=nil, 0xfda000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003ba000-0x24)) r1 = syz_open_pts(r0, 0x0) ioctl$TCXONC(r1, 0x5429, 0x0) 2018/02/01 16:23:26 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = open(&(0x7f0000fc2000)='./file0\x00', 0x141046, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000fb2000-0x12)='/dev/input/event#\x00', 0x2, 0x101002) write$evdev(0xffffffffffffffff, &(0x7f0000a12000)=[{{0x0, 0x2710}, 0x1, 0x3a, 0x2}], 0x18) ftruncate(r0, 0x10000) sendfile(r1, r0, 0x0, 0x72439a6f) 2018/02/01 16:23:26 executing program 3: mmap(&(0x7f0000000000/0x14000)=nil, 0x14000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000010000-0xc)='net/rt_acct\x00') r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_MOD(r1, 0x3, r0, &(0x7f000000f000)) 2018/02/01 16:23:26 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x2, &(0x7f0000691000-0x4)=0x79, 0x4) bind$inet(r0, &(0x7f0000887000-0x10)={0x2, 0x3, @broadcast=0xffffffff}, 0x10) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x8, &(0x7f0000cd5000-0x4), 0x4) sendto$inet(r0, &(0x7f0000d5a000-0x73), 0xfffffc6c, 0x20000804, &(0x7f0000e1e000)={0x2, 0x3, @loopback=0x7f000001}, 0x10) readv(r0, &(0x7f00007d7000-0x50)=[{&(0x7f0000b7e000)=""/4096, 0x1000}], 0x1) 2018/02/01 16:23:26 executing program 4: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)={0xaa}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) fchmodat(0xffffffffffffffff, &(0x7f0000012000)='./file0\x00', 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r1 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12, 0x0, @tid}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(0x0, 0x15) ioctl$UFFDIO_ZEROPAGE(r0, 0x8010aa02, &(0x7f00000c1000-0x10)={&(0x7f0000011000/0x3000)=nil, 0x3000}) 2018/02/01 16:23:26 executing program 1: r0 = memfd_create(&(0x7f000003e000)='\'', 0x0) r1 = syz_open_dev$sndseq(&(0x7f0000042000)='/dev/snd/seq\x00', 0x0, 0x8000000000102) r2 = dup2(r1, r0) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r2, 0xc08c5332, &(0x7f0000001000)={0x0, 0x0, 0x0, "9ede7a8c5ae95ec8672c93340f643a664f13eeab65c0322901dc6bd36cde2c51f01b7f0b014f9f91eeb7c37c7240f476c8d753d000aa8faf8fb574dbcfa6dc4d"}) write$sndseq(r1, &(0x7f0000002000)=[{0x0, 0x3, 0x0, 0x0, @time={0x77359400}, {}, {}, @ext={0x0, &(0x7f0000ae5000)}}], 0x30) r3 = syz_open_dev$sndseq(&(0x7f0000cea000-0xd)='/dev/snd/seq\x00', 0x0, 0x0) r4 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000e26000)='/dev/sequencer2\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_CLIENT(r3, 0x404c534a, &(0x7f0000643000-0x4c)={0x0, 0x0, 0x10001, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdfd]}) dup2(r4, r3) 2018/02/01 16:23:26 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$unix(0x1, 0x1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f000005a000-0x8)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$unix(r1, &(0x7f0000001000-0x38)={&(0x7f0000239000-0x8)=@abs={0x0, 0x0, 0x0}, 0x8, &(0x7f0000008000)=[], 0x0, &(0x7f0000001000-0x10)=[@rights={0x200, 0x1, 0x1, [r0]}], 0x1}, 0x0) syz_fuseblk_mount(&(0x7f00000a2000-0x8)='./file0\x00', &(0x7f000094f000-0x8)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) recvmsg(r2, &(0x7f000000e000)={0x0, 0x0, &(0x7f000008b000)=[], 0x0, &(0x7f000000c000), 0xfc13}, 0x0) pselect6(0x40, &(0x7f0000cc9000-0x40), &(0x7f0000cc9000-0x40), &(0x7f00000de000-0x40)={0xffffffffffffffe1}, &(0x7f00008e6000-0x10)={0x0, 0x989680}, &(0x7f0000205000-0x10)={&(0x7f0000cc9000-0x8), 0x8}) 2018/02/01 16:23:26 executing program 1: r0 = memfd_create(&(0x7f000003e000)='\'', 0x0) r1 = syz_open_dev$sndseq(&(0x7f0000042000)='/dev/snd/seq\x00', 0x0, 0x8000000000102) r2 = dup2(r1, r0) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r2, 0xc08c5332, &(0x7f0000001000)={0x0, 0x0, 0x0, "9ede7a8c5ae95ec8672c93340f643a664f13eeab65c0322901dc6bd36cde2c51f01b7f0b014f9f91eeb7c37c7240f476c8d753d000aa8faf8fb574dbcfa6dc4d"}) write$sndseq(r1, &(0x7f0000002000)=[{0x0, 0x3, 0x0, 0x0, @time={0x77359400}, {}, {}, @ext={0x0, &(0x7f0000ae5000)}}], 0x30) r3 = syz_open_dev$sndseq(&(0x7f0000cea000-0xd)='/dev/snd/seq\x00', 0x0, 0x0) r4 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000e26000)='/dev/sequencer2\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_CLIENT(r3, 0x404c534a, &(0x7f0000643000-0x4c)={0x0, 0x0, 0x10001, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdfd]}) dup2(r4, r3) [ 252.320709] ptrace attach of "/root/syz-executor0"[4064] was attempted by "/root/syz-executor0"[1839] 2018/02/01 16:23:26 executing program 5: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)={0xaa}) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000-0x20)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) mq_getsetattr(0xffffffffffffffff, &(0x7f0000014000-0x40), &(0x7f0000001000)) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) clone(0x0, &(0x7f0000a55000), &(0x7f0000eaa000-0x4), &(0x7f0000bf3000-0x4), &(0x7f00003b9000-0xcd)) ioctl$UFFDIO_ZEROPAGE(r0, 0x8010aa02, &(0x7f00000c1000-0x10)={&(0x7f0000011000/0x3000)=nil, 0x3000}) 2018/02/01 16:23:26 executing program 1: r0 = memfd_create(&(0x7f000003e000)='\'', 0x0) r1 = syz_open_dev$sndseq(&(0x7f0000042000)='/dev/snd/seq\x00', 0x0, 0x8000000000102) r2 = dup2(r1, r0) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r2, 0xc08c5332, &(0x7f0000001000)={0x0, 0x0, 0x0, "9ede7a8c5ae95ec8672c93340f643a664f13eeab65c0322901dc6bd36cde2c51f01b7f0b014f9f91eeb7c37c7240f476c8d753d000aa8faf8fb574dbcfa6dc4d"}) write$sndseq(r1, &(0x7f0000002000)=[{0x0, 0x3, 0x0, 0x0, @time={0x77359400}, {}, {}, @ext={0x0, &(0x7f0000ae5000)}}], 0x30) r3 = syz_open_dev$sndseq(&(0x7f0000cea000-0xd)='/dev/snd/seq\x00', 0x0, 0x0) r4 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000e26000)='/dev/sequencer2\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_CLIENT(r3, 0x404c534a, &(0x7f0000643000-0x4c)={0x0, 0x0, 0x10001, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdfd]}) dup2(r4, r3) 2018/02/01 16:23:26 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = open(&(0x7f0000fc2000)='./file0\x00', 0x141046, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000fb2000-0x12)='/dev/input/event#\x00', 0x2, 0x101002) write$evdev(0xffffffffffffffff, &(0x7f0000a12000)=[{{0x0, 0x2710}, 0x1, 0x3a, 0x2}], 0x18) ftruncate(r0, 0x10000) sendfile(r1, r0, 0x0, 0x72439a6f) 2018/02/01 16:23:26 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x2, &(0x7f0000691000-0x4)=0x79, 0x4) bind$inet(r0, &(0x7f0000887000-0x10)={0x2, 0x3, @broadcast=0xffffffff}, 0x10) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x8, &(0x7f0000cd5000-0x4), 0x4) sendto$inet(r0, &(0x7f0000d5a000-0x73), 0xfffffc6c, 0x20000804, &(0x7f0000e1e000)={0x2, 0x3, @loopback=0x7f000001}, 0x10) readv(r0, &(0x7f00007d7000-0x50)=[{&(0x7f0000b7e000)=""/4096, 0x1000}], 0x1) 2018/02/01 16:23:26 executing program 2: mmap(&(0x7f0000000000/0x9000)=nil, 0x9000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$selinux_access(0xffffffffffffff9c, &(0x7f0000007000)='/selinux/access\x00', 0x2, 0x0) write$selinux_access(r0, &(0x7f0000007000)={'system_u:object_r:kmsg_device_t:s0', 0x20, 'system_u:system_r:kernel_t:s0', 0x20}, 0x44) r1 = openat$selinux_relabel(0xffffffffffffff9c, &(0x7f0000008000)='/selinux/relabel\x00', 0x2, 0x0) dup3(r1, r0, 0x0) 2018/02/01 16:23:26 executing program 3: mmap(&(0x7f0000000000/0xfed000)=nil, 0xfed000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003ba000-0x24)) r1 = syz_open_pts(r0, 0x0) clock_gettime(0x0, &(0x7f00003d6000)={0x0}) ppoll(&(0x7f0000fe7000-0x30)=[{r1}], 0x1, &(0x7f0000036000-0x10)={r2}, &(0x7f000078d000-0x8), 0x8) ioctl$TCXONC(r0, 0x540a, 0x2) ioctl$TCSETA(r0, 0x5402, &(0x7f0000fd8000)) 2018/02/01 16:23:26 executing program 4: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)={0xaa}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) fchmodat(0xffffffffffffffff, &(0x7f0000012000)='./file0\x00', 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r1 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12, 0x0, @tid}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(0x0, 0x15) ioctl$UFFDIO_ZEROPAGE(r0, 0x8010aa02, &(0x7f00000c1000-0x10)={&(0x7f0000011000/0x3000)=nil, 0x3000}) 2018/02/01 16:23:26 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000066000-0x38)={&(0x7f00002e0000-0xc)={0x10}, 0xc, &(0x7f0000fd1000)={&(0x7f0000663000)={0x14, 0x0, 0xa, 0x5, 0xffffffffffffffff, 0xffffffffffffffff, {}, []}, 0x14}, 0x1}, 0x0) 2018/02/01 16:23:26 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x0, 0x32, 0xffffffffffffffff, 0x0) r0 = memfd_create(&(0x7f000003e000)='\'', 0x0) r1 = syz_open_dev$sndseq(&(0x7f0000042000)='/dev/snd/seq\x00', 0x0, 0x8000000000102) r2 = dup2(r1, r0) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r2, 0xc08c5332, &(0x7f0000001000)={0x0, 0x0, 0x0, "9ede7a8c5ae95ec8672c93340f643a664f13eeab65c0322901dc6bd36cde2c51f01b7f0b014f9f91eeb7c37c7240f476c8d753d000aa8faf8fb574dbcfa6dc4d"}) write$sndseq(r1, &(0x7f0000002000)=[{0x0, 0x3, 0x0, 0x0, @time={0x77359400}, {}, {}, @ext={0x0, &(0x7f0000ae5000)}}], 0x30) r3 = syz_open_dev$sndseq(&(0x7f0000cea000-0xd)='/dev/snd/seq\x00', 0x0, 0x0) r4 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000e26000)='/dev/sequencer2\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_CLIENT(r3, 0x404c534a, &(0x7f0000643000-0x4c)={0x0, 0x0, 0x10001, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdfd]}) dup2(r4, r3) 2018/02/01 16:23:26 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = open(&(0x7f0000fc2000)='./file0\x00', 0x141046, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000fb2000-0x12)='/dev/input/event#\x00', 0x2, 0x101002) write$evdev(r0, &(0x7f0000a12000)=[], 0x0) ftruncate(r0, 0x10000) sendfile(r1, r0, 0x0, 0x72439a6f) 2018/02/01 16:23:26 executing program 0: mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket(0x18, 0x0, 0x4) connect(r0, &(0x7f0000002000)=@l2={0x1f}, 0xe) 2018/02/01 16:23:26 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x0, 0x32, 0xffffffffffffffff, 0x0) r0 = memfd_create(&(0x7f000003e000)='\'', 0x0) r1 = syz_open_dev$sndseq(&(0x7f0000042000)='/dev/snd/seq\x00', 0x0, 0x8000000000102) r2 = dup2(r1, r0) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r2, 0xc08c5332, &(0x7f0000001000)={0x0, 0x0, 0x0, "9ede7a8c5ae95ec8672c93340f643a664f13eeab65c0322901dc6bd36cde2c51f01b7f0b014f9f91eeb7c37c7240f476c8d753d000aa8faf8fb574dbcfa6dc4d"}) write$sndseq(r1, &(0x7f0000002000)=[{0x0, 0x3, 0x0, 0x0, @time={0x77359400}, {}, {}, @ext={0x0, &(0x7f0000ae5000)}}], 0x30) r3 = syz_open_dev$sndseq(&(0x7f0000cea000-0xd)='/dev/snd/seq\x00', 0x0, 0x0) r4 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000e26000)='/dev/sequencer2\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_CLIENT(r3, 0x404c534a, &(0x7f0000643000-0x4c)={0x0, 0x0, 0x10001, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdfd]}) dup2(r4, r3) 2018/02/01 16:23:26 executing program 2: mmap(&(0x7f0000000000/0x9000)=nil, 0x9000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$selinux_access(0xffffffffffffff9c, &(0x7f0000007000)='/selinux/access\x00', 0x2, 0x0) write$selinux_access(r0, &(0x7f0000007000)={'system_u:object_r:kmsg_device_t:s0', 0x20, 'system_u:system_r:kernel_t:s0', 0x20}, 0x44) r1 = openat$selinux_relabel(0xffffffffffffff9c, &(0x7f0000008000)='/selinux/relabel\x00', 0x2, 0x0) dup3(r1, r0, 0x0) 2018/02/01 16:23:26 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = open(&(0x7f0000fc2000)='./file0\x00', 0x141046, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000fb2000-0x12)='/dev/input/event#\x00', 0x2, 0x101002) write$evdev(r0, &(0x7f0000a12000)=[], 0x0) ftruncate(r0, 0x10000) sendfile(r1, r0, 0x0, 0x72439a6f) 2018/02/01 16:23:26 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x0, 0x32, 0xffffffffffffffff, 0x0) r0 = memfd_create(&(0x7f000003e000)='\'', 0x0) r1 = syz_open_dev$sndseq(&(0x7f0000042000)='/dev/snd/seq\x00', 0x0, 0x8000000000102) r2 = dup2(r1, r0) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r2, 0xc08c5332, &(0x7f0000001000)={0x0, 0x0, 0x0, "9ede7a8c5ae95ec8672c93340f643a664f13eeab65c0322901dc6bd36cde2c51f01b7f0b014f9f91eeb7c37c7240f476c8d753d000aa8faf8fb574dbcfa6dc4d"}) write$sndseq(r1, &(0x7f0000002000)=[{0x0, 0x3, 0x0, 0x0, @time={0x77359400}, {}, {}, @ext={0x0, &(0x7f0000ae5000)}}], 0x30) r3 = syz_open_dev$sndseq(&(0x7f0000cea000-0xd)='/dev/snd/seq\x00', 0x0, 0x0) r4 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000e26000)='/dev/sequencer2\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_CLIENT(r3, 0x404c534a, &(0x7f0000643000-0x4c)={0x0, 0x0, 0x10001, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdfd]}) dup2(r4, r3) 2018/02/01 16:23:26 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x2, &(0x7f0000691000-0x4)=0x79, 0x4) bind$inet(r0, &(0x7f0000887000-0x10)={0x2, 0x3, @broadcast=0xffffffff}, 0x10) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x8, &(0x7f0000cd5000-0x4), 0x4) sendto$inet(r0, &(0x7f0000d5a000-0x73), 0xfffffc6c, 0x20000804, &(0x7f0000e1e000)={0x2, 0x3, @loopback=0x7f000001}, 0x10) readv(r0, &(0x7f00007d7000-0x50)=[{&(0x7f0000b7e000)=""/4096, 0x1000}], 0x1) 2018/02/01 16:23:26 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f000000b000)={&(0x7f000000f000)={0x10}, 0xc, &(0x7f0000667000)={&(0x7f0000e48000-0x218)=@newsa={0x13c, 0x10, 0x721, 0xffffffffffffffff, 0xffffffffffffffff, {{@in=@rand_addr, @in6=@dev={0xfe, 0x80}}, {@in6=@mcast2={0xff, 0x2, [], 0x1}, 0xffffffffffffffff, 0x2b}, @in6=@loopback={0x0, 0x1}, {}, {}, {}, 0xffffffffffffffff, 0xffffffffffffffff, 0x200000000000002}, [@algo_auth_trunc={0x4c, 0x14, {{'sha1_mb\x00'}}}]}, 0x13c}, 0x1}, 0x0) 2018/02/01 16:23:26 executing program 4: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)={0xaa}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) fchmodat(0xffffffffffffffff, &(0x7f0000012000)='./file0\x00', 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r1 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12, 0x0, @tid}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r1, 0x0) ioctl$UFFDIO_ZEROPAGE(r0, 0x8010aa02, &(0x7f00000c1000-0x10)={&(0x7f0000011000/0x3000)=nil, 0x3000}) 2018/02/01 16:23:26 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x0, 0xffffffffffffffff, 0x0) r0 = memfd_create(&(0x7f000003e000)='\'', 0x0) r1 = syz_open_dev$sndseq(&(0x7f0000042000)='/dev/snd/seq\x00', 0x0, 0x8000000000102) r2 = dup2(r1, r0) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r2, 0xc08c5332, &(0x7f0000001000)={0x0, 0x0, 0x0, "9ede7a8c5ae95ec8672c93340f643a664f13eeab65c0322901dc6bd36cde2c51f01b7f0b014f9f91eeb7c37c7240f476c8d753d000aa8faf8fb574dbcfa6dc4d"}) write$sndseq(r1, &(0x7f0000002000)=[{0x0, 0x3, 0x0, 0x0, @time={0x77359400}, {}, {}, @ext={0x0, &(0x7f0000ae5000)}}], 0x30) r3 = syz_open_dev$sndseq(&(0x7f0000cea000-0xd)='/dev/snd/seq\x00', 0x0, 0x0) r4 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000e26000)='/dev/sequencer2\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_CLIENT(r3, 0x404c534a, &(0x7f0000643000-0x4c)={0x0, 0x0, 0x10001, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdfd]}) dup2(r4, r3) 2018/02/01 16:23:26 executing program 3: mmap(&(0x7f0000000000/0x4ee000)=nil, 0x4ee000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000005000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) close(r0) r1 = syz_open_dev$binder(&(0x7f0000009000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000007000)={0x0, 0x0, &(0x7f0000006000-0x2c)=[], 0x0, 0x0, &(0x7f0000002000)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000004000)={0x4c, 0x0, &(0x7f000000c000-0x80)=[@reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20, 0x0, &(0x7f000000a000)=[@fda={0x77622a85, 0xfffffffffffffffe}], &(0x7f000000b000)=[]}}}], 0x0, 0x0, &(0x7f000000b000)}) getpid() getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffff9c, 0x0, 0x10, &(0x7f0000006000-0xe8)={{{@in=@local, @in=@multicast2}}, {{@in6=@mcast1}, 0x0, @in=@empty}}, &(0x7f0000002000-0x4)=0xe8) getresgid(&(0x7f0000003000), &(0x7f0000009000-0x4), &(0x7f0000009000-0x4)) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000009000)={0x0, 0x0, &(0x7f000000e000-0x54)=[], 0x26, 0x0, &(0x7f0000009000)="1225bd0ce6ffb6fa93cf990803ad59007904cf4b9e3e9f751ec47ac3d78c463c71d1cc332cbe"}) 2018/02/01 16:23:26 executing program 2: clone(0x0, &(0x7f0000a55000), &(0x7f0000eaa000-0x4), &(0x7f0000bf3000-0x4), &(0x7f00003b9000-0xcd)) timerfd_gettime(0xffffffffffffff9c, &(0x7f000022c000)) 2018/02/01 16:23:26 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = open(&(0x7f0000fc2000)='./file0\x00', 0x141046, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000fb2000-0x12)='/dev/input/event#\x00', 0x2, 0x101002) write$evdev(r0, &(0x7f0000a12000)=[], 0x0) ftruncate(r0, 0x10000) sendfile(r1, r0, 0x0, 0x72439a6f) 2018/02/01 16:23:26 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000bf8000-0xa)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSPGRP(r0, 0x540f, &(0x7f0000000000)) [ 252.669090] binder: 1912:1926 got reply transaction with no transaction stack [ 252.700283] binder: 1912:1926 transaction failed 29201/-71, size 32-0 line 2703 [ 252.711726] binder: 1912:1926 ioctl c0306201 20009000 returned -14 2018/02/01 16:23:27 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) socket$unix(0x1, 0x1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000e80000)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$unix(r0, &(0x7f0000001000-0x38)={&(0x7f0000239000-0x8)=@abs, 0x8, &(0x7f0000008000)=[], 0x0, &(0x7f0000001000-0x10)=[]}, 0x0) sendmsg$unix(r0, &(0x7f0000c1b000)={&(0x7f0000671000-0x8)=@abs, 0x8, &(0x7f00003bc000-0x70)=[], 0x0, &(0x7f00000d3000)=[@rights={0x18, 0x1, 0x1, [r0, r1]}], 0x18}, 0x0) 2018/02/01 16:23:27 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00008f7000-0x7)='mounts\x00') mkdir(&(0x7f0000635000+0x43e)='./file0\x00', 0x0) mount(&(0x7f0000018000)='./file0\x00', &(0x7f0000a9f000-0x8)='./file0\x00', &(0x7f00000db000)='ramfs\x00', 0x0, &(0x7f000000a000)) preadv(r0, &(0x7f000074d000)=[{&(0x7f0000519000-0x80)=""/128, 0x80}, {&(0x7f00006d1000)=""/147, 0x93}], 0x2, 0x0) 2018/02/01 16:23:27 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x0, 0xffffffffffffffff, 0x0) r0 = memfd_create(&(0x7f000003e000)='\'', 0x0) r1 = syz_open_dev$sndseq(&(0x7f0000042000)='/dev/snd/seq\x00', 0x0, 0x8000000000102) r2 = dup2(r1, r0) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r2, 0xc08c5332, &(0x7f0000001000)={0x0, 0x0, 0x0, "9ede7a8c5ae95ec8672c93340f643a664f13eeab65c0322901dc6bd36cde2c51f01b7f0b014f9f91eeb7c37c7240f476c8d753d000aa8faf8fb574dbcfa6dc4d"}) write$sndseq(r1, &(0x7f0000002000)=[{0x0, 0x3, 0x0, 0x0, @time={0x77359400}, {}, {}, @ext={0x0, &(0x7f0000ae5000)}}], 0x30) r3 = syz_open_dev$sndseq(&(0x7f0000cea000-0xd)='/dev/snd/seq\x00', 0x0, 0x0) r4 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000e26000)='/dev/sequencer2\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_CLIENT(r3, 0x404c534a, &(0x7f0000643000-0x4c)={0x0, 0x0, 0x10001, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdfd]}) dup2(r4, r3) 2018/02/01 16:23:27 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = open(&(0x7f0000fc2000)='./file0\x00', 0x141046, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000fb2000-0x12)='/dev/input/event#\x00', 0x2, 0x101002) write$evdev(r0, &(0x7f0000a12000)=[{{0x0, 0x2710}, 0x0, 0x3a, 0x2}], 0x18) ftruncate(r0, 0x10000) sendfile(r1, r0, 0x0, 0x72439a6f) 2018/02/01 16:23:27 executing program 0: mmap(&(0x7f0000000000/0x19000)=nil, 0x19000, 0x3, 0x32, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000009000)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000005000-0x10)={0x3, &(0x7f000000b000)=[{0x15, 0x0, 0x100000001, 0x1}, {}, {0x6}]}, 0x10) writev(r1, &(0x7f0000009000)=[{&(0x7f000000f000-0x1000)="8f", 0x1}], 0x1) 2018/02/01 16:23:27 executing program 4: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)={0xaa}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) fchmodat(0xffffffffffffffff, &(0x7f0000012000)='./file0\x00', 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r1 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12, 0x0, @tid}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r1, 0x0) ioctl$UFFDIO_ZEROPAGE(r0, 0x8010aa02, &(0x7f00000c1000-0x10)={&(0x7f0000011000/0x3000)=nil, 0x3000}) 2018/02/01 16:23:27 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x2, &(0x7f0000691000-0x4)=0x79, 0x4) bind$inet(r0, &(0x7f0000887000-0x10)={0x2, 0x3, @broadcast=0xffffffff}, 0x10) setsockopt$sock_int(r0, 0x1, 0x0, &(0x7f0000cd5000-0x4), 0x4) sendto$inet(r0, &(0x7f0000d5a000-0x73), 0xfffffc6c, 0x20000804, &(0x7f0000e1e000)={0x2, 0x3, @loopback=0x7f000001}, 0x10) readv(r0, &(0x7f00007d7000-0x50)=[{&(0x7f0000b7e000)=""/4096, 0x1000}], 0x1) 2018/02/01 16:23:27 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000fb2000-0x18)='/selinux/avc/hash_stats\x00', 0x0, 0x0) sendmsg$nl_xfrm(r0, &(0x7f000000b000)={&(0x7f000000f000)={0x10}, 0xc, &(0x7f000063c000)={&(0x7f00004f3000-0x1dc)=@newsa={0x1b4, 0x10, 0x721, 0xffffffffffffffff, 0xffffffffffffffff, {{@in=@empty, @in=@rand_addr}, {@in=@broadcast=0xffffffff, 0xffffffffffffffff, 0x833}, @in6=@empty, {}, {}, {}, 0xffffffffffffffff, 0xffffffffffffffff, 0x200000000000002}, [@algo_auth_trunc={0xc4, 0x14, {{'sha1\x00'}, 0x3c0, 0x0, "938777e1092893c8c156e35f6cce6e2be93f15e4c1793d4d01de8f03880a547e10d9f2c2795657d50c005d7818dbae34c91612eae3cc5a187a396002d804e7706cc3d6e16913ac76efd084d767a9983f518d946b52adfd57ddcffc6a4eba10520d431e4c3150604beea9bc0d49c991e56eb694f69eff2cd7"}}]}, 0x1b4}, 0x1}, 0x0) 2018/02/01 16:23:27 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x0, 0xffffffffffffffff, 0x0) r0 = memfd_create(&(0x7f000003e000)='\'', 0x0) r1 = syz_open_dev$sndseq(&(0x7f0000042000)='/dev/snd/seq\x00', 0x0, 0x8000000000102) r2 = dup2(r1, r0) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r2, 0xc08c5332, &(0x7f0000001000)={0x0, 0x0, 0x0, "9ede7a8c5ae95ec8672c93340f643a664f13eeab65c0322901dc6bd36cde2c51f01b7f0b014f9f91eeb7c37c7240f476c8d753d000aa8faf8fb574dbcfa6dc4d"}) write$sndseq(r1, &(0x7f0000002000)=[{0x0, 0x3, 0x0, 0x0, @time={0x77359400}, {}, {}, @ext={0x0, &(0x7f0000ae5000)}}], 0x30) r3 = syz_open_dev$sndseq(&(0x7f0000cea000-0xd)='/dev/snd/seq\x00', 0x0, 0x0) r4 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000e26000)='/dev/sequencer2\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_CLIENT(r3, 0x404c534a, &(0x7f0000643000-0x4c)={0x0, 0x0, 0x10001, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdfd]}) dup2(r4, r3) [ 252.730830] binder: 1912:1926 got reply transaction with no transaction stack [ 252.738200] binder: 1912:1926 transaction failed 29201/-71, size 32-0 line 2703 [ 252.748075] binder: undelivered TRANSACTION_ERROR: 29201 2018/02/01 16:23:27 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket(0xa, 0x1, 0x0) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000000000)={0x0, 0x808000000000002, 0x0, 0x3, 0xfb, []}) ioctl(r0, 0x8916, &(0x7f0000000000)) 2018/02/01 16:23:27 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f0000626000)='attr/keycreate\x00') signalfd(0xffffffffffffffff, &(0x7f000055a000-0x8), 0x8) syz_open_dev$usbmon(&(0x7f0000da1000)='/dev/usbmon#\x00', 0x0, 0x1) pselect6(0x40, &(0x7f00000ac000-0x40)={0x3ffffd}, &(0x7f0000f09000-0x40), &(0x7f0000086000), &(0x7f0000349000)={0x0, 0x989680}, &(0x7f0000d0a000)={&(0x7f00001da000), 0x8}) 2018/02/01 16:23:27 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0xc, 0x32, 0xffffffffffffffff, 0x0) r0 = socket(0xa, 0x802, 0x0) sendmmsg$inet_sctp(r0, &(0x7f0000e10000-0x1c)=[{&(0x7f0000d0e000)=@in6={0xa, 0x0, 0x0, @loopback={0x0, 0x1}}, 0x1c, &(0x7f0000cd7000)=[], 0x0, &(0x7f0000a6b000)=[]}], 0x1, 0x0) 2018/02/01 16:23:27 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = open(&(0x7f0000fc2000)='./file0\x00', 0x141046, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000fb2000-0x12)='/dev/input/event#\x00', 0x2, 0x101002) write$evdev(r0, &(0x7f0000a12000)=[{{0x0, 0x2710}, 0x0, 0x3a, 0x2}], 0x18) ftruncate(r0, 0x10000) sendfile(r1, r0, 0x0, 0x72439a6f) 2018/02/01 16:23:27 executing program 4: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)={0xaa}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) fchmodat(0xffffffffffffffff, &(0x7f0000012000)='./file0\x00', 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r1 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12, 0x0, @tid}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r1, 0x0) ioctl$UFFDIO_ZEROPAGE(r0, 0x8010aa02, &(0x7f00000c1000-0x10)={&(0x7f0000011000/0x3000)=nil, 0x3000}) 2018/02/01 16:23:27 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x2, &(0x7f0000691000-0x4)=0x79, 0x4) bind$inet(r0, &(0x7f0000887000-0x10)={0x2, 0x3, @broadcast=0xffffffff}, 0x10) setsockopt$sock_int(r0, 0x1, 0x0, &(0x7f0000cd5000-0x4), 0x4) sendto$inet(r0, &(0x7f0000d5a000-0x73), 0xfffffc6c, 0x20000804, &(0x7f0000e1e000)={0x2, 0x3, @loopback=0x7f000001}, 0x10) readv(r0, &(0x7f00007d7000-0x50)=[{&(0x7f0000b7e000)=""/4096, 0x1000}], 0x1) 2018/02/01 16:23:27 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = memfd_create(&(0x7f000003e000)='\'', 0x0) r1 = syz_open_dev$sndseq(&(0x7f0000042000)='/dev/snd/seq\x00', 0x0, 0x0) r2 = dup2(r1, r0) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r2, 0xc08c5332, &(0x7f0000001000)={0x0, 0x0, 0x0, "9ede7a8c5ae95ec8672c93340f643a664f13eeab65c0322901dc6bd36cde2c51f01b7f0b014f9f91eeb7c37c7240f476c8d753d000aa8faf8fb574dbcfa6dc4d"}) write$sndseq(r1, &(0x7f0000002000)=[{0x0, 0x3, 0x0, 0x0, @time={0x77359400}, {}, {}, @ext={0x0, &(0x7f0000ae5000)}}], 0x30) r3 = syz_open_dev$sndseq(&(0x7f0000cea000-0xd)='/dev/snd/seq\x00', 0x0, 0x0) r4 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000e26000)='/dev/sequencer2\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_CLIENT(r3, 0x404c534a, &(0x7f0000643000-0x4c)={0x0, 0x0, 0x10001, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdfd]}) dup2(r4, r3) 2018/02/01 16:23:27 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2000000000001, 0x0) setsockopt$inet6_MCAST_LEAVE_GROUP(r0, 0x29, 0x2d, &(0x7f0000402000-0x88)={0x5, {{0xa, 0x2, 0x7f, @mcast2={0xff, 0x2, [], 0x1}, 0xe61}}}, 0x88) setsockopt$inet6_int(r0, 0x29, 0x2f, &(0x7f00002c6000)=0x3f73, 0x0) bind$inet6(r0, &(0x7f0000402000)={0xa, 0x0, 0x0, @loopback={0x0, 0x1}}, 0x1c) openat$selinux_status(0xffffffffffffff9c, &(0x7f0000658000-0x10)='/selinux/status\x00', 0x0, 0x0) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f00005c0000)=[{0x4, 0x402}, {0x7, 0x3f}, {0xf, 0xf53}, {0xe, 0x98}, {0x3, 0x8}, {0x0, 0x4}], 0x6) r1 = socket$inet6(0xa, 0x0, 0x80) sendto$inet6(r0, &(0x7f00007a9000-0x1), 0x0, 0xfffffefffffffffe, &(0x7f0000f63000-0x1c)={0xa, 0x0, 0x0, @loopback={0x0, 0x1}}, 0x1c) readv(r1, &(0x7f0000b43000)=[{&(0x7f0000f85000-0x45)=""/69, 0x45}, {&(0x7f0000f7f000-0xf4)=""/244, 0xf4}, {&(0x7f0000c82000-0xa7)=""/167, 0xa7}, {&(0x7f0000ae3000)=""/203, 0xcb}, {&(0x7f0000851000)=""/107, 0x6b}, {&(0x7f0000dea000)=""/61, 0x3d}], 0x6) setsockopt$inet6_int(r0, 0x29, 0xb, &(0x7f00007d3000)=0x57b6, 0x1f0) sendto$inet6(r0, &(0x7f0000fa3000)="2160616d2f698f6c7795c074cd3c8b6439bc7e8847fd34367b110ce2f08faa56c377075cfd5e445ec6491fe07a8922b92f279ff4fe699f38afbd235c8c320ecfbcb1d2511b9a78d982fb530833ef57b58f8d821701e404bd2b9b17c2f834bf6644aca462cae011f3178ed09f8fd162d3564c070f1d2796391840480df077340703fa20a296c63ebce63a4bbb9c48826949f5a521d704c008127095fa9acc63f2edc024dd32cc330a54ef12874bfefa3478dac9694ee9f2aba4", 0xb9, 0xc000, 0x0, 0x0) close(r0) 2018/02/01 16:23:27 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000e1e000-0x8)={0xffffffffffffffff, 0xffffffffffffffff}) readv(r0, &(0x7f0000b3b000-0x30)=[{&(0x7f0000b13000-0xe7)=""/231, 0xe7}], 0x1) close(r0) sendto$unix(r1, &(0x7f0000010000), 0xfffffffffffff000, 0x0, 0x0, 0x0) 2018/02/01 16:23:27 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) unshare(0x8000000) r0 = mq_open(&(0x7f0000000000)='-$\x00', 0x6e93ebbbcc0884f2, 0x0, &(0x7f0000665000-0x40)={0x0, 0x1, 0x2}) mq_notify(r0, &(0x7f00003da000)={0x0, 0x0, 0x0, @thr={&(0x7f0000b77000+0x4fc), &(0x7f00000bb000)}}) read(r0, &(0x7f0000458000-0xce)=""/206, 0xce) 2018/02/01 16:23:27 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x80001, 0x0) setsockopt$inet6_group_source_req(r0, 0x29, 0x2e, &(0x7f0000a3a000-0x108)={0x0, {{0xa, 0xffffffffffffffff, 0x0, @dev={0xfe, 0x80}}}, {{0xa, 0xffffffffffffffff, 0x0, @loopback={0x0, 0x1}}}}, 0x108) 2018/02/01 16:23:27 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = open(&(0x7f0000fc2000)='./file0\x00', 0x141046, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000fb2000-0x12)='/dev/input/event#\x00', 0x2, 0x101002) write$evdev(r0, &(0x7f0000a12000)=[{{0x0, 0x2710}, 0x0, 0x3a, 0x2}], 0x18) ftruncate(r0, 0x10000) sendfile(r1, r0, 0x0, 0x72439a6f) 2018/02/01 16:23:27 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x2, &(0x7f0000691000-0x4)=0x79, 0x4) bind$inet(r0, &(0x7f0000887000-0x10)={0x2, 0x3, @broadcast=0xffffffff}, 0x10) setsockopt$sock_int(r0, 0x1, 0x0, &(0x7f0000cd5000-0x4), 0x4) sendto$inet(r0, &(0x7f0000d5a000-0x73), 0xfffffc6c, 0x20000804, &(0x7f0000e1e000)={0x2, 0x3, @loopback=0x7f000001}, 0x10) readv(r0, &(0x7f00007d7000-0x50)=[{&(0x7f0000b7e000)=""/4096, 0x1000}], 0x1) 2018/02/01 16:23:27 executing program 4: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)={0xaa}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) fchmodat(0xffffffffffffffff, &(0x7f0000012000)='./file0\x00', 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r1 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12, 0x0, @tid}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r1, 0x15) ioctl$UFFDIO_ZEROPAGE(0xffffffffffffffff, 0x8010aa02, &(0x7f00000c1000-0x10)={&(0x7f0000011000/0x3000)=nil, 0x3000}) 2018/02/01 16:23:27 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) clock_adjtime(0x0, &(0x7f0000d53000)={0x5f5e0ff}) 2018/02/01 16:23:27 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = memfd_create(&(0x7f000003e000)='\'', 0x0) r1 = syz_open_dev$sndseq(&(0x7f0000042000)='/dev/snd/seq\x00', 0x0, 0x0) r2 = dup2(r1, r0) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r2, 0xc08c5332, &(0x7f0000001000)={0x0, 0x0, 0x0, "9ede7a8c5ae95ec8672c93340f643a664f13eeab65c0322901dc6bd36cde2c51f01b7f0b014f9f91eeb7c37c7240f476c8d753d000aa8faf8fb574dbcfa6dc4d"}) write$sndseq(r1, &(0x7f0000002000)=[{0x0, 0x3, 0x0, 0x0, @time={0x77359400}, {}, {}, @ext={0x0, &(0x7f0000ae5000)}}], 0x30) r3 = syz_open_dev$sndseq(&(0x7f0000cea000-0xd)='/dev/snd/seq\x00', 0x0, 0x0) r4 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000e26000)='/dev/sequencer2\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_CLIENT(r3, 0x404c534a, &(0x7f0000643000-0x4c)={0x0, 0x0, 0x10001, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdfd]}) dup2(r4, r3) 2018/02/01 16:23:27 executing program 0: mmap(&(0x7f0000000000/0xef1000)=nil, 0xef1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x2, 0x0) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f0000eec000)=0x7fe, 0x4) poll(&(0x7f0000ef0000)=[{r0, 0x1}], 0x1, 0x106) sendto$inet(r0, &(0x7f0000edf000), 0x0, 0x0, &(0x7f0000eea000-0x10)={0x2, 0x0, @empty}, 0x10) 2018/02/01 16:23:27 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000e1e000-0x8)={0xffffffffffffffff, 0xffffffffffffffff}) readv(r0, &(0x7f0000b3b000-0x30)=[{&(0x7f0000b13000-0xe7)=""/231, 0xe7}], 0x1) close(r0) sendto$unix(r1, &(0x7f0000010000), 0xfffffffffffff000, 0x0, 0x0, 0x0) 2018/02/01 16:23:27 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = open(&(0x7f0000fc2000)='./file0\x00', 0x141046, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000fb2000-0x12)='/dev/input/event#\x00', 0x2, 0x101002) write$evdev(r0, &(0x7f0000a12000)=[{{0x0, 0x2710}, 0x1, 0x0, 0x2}], 0x18) ftruncate(r0, 0x10000) sendfile(r1, r0, 0x0, 0x72439a6f) 2018/02/01 16:23:27 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$unix(0x1, 0x2, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000178000-0xa)='net/snmp\x00') sendfile(r0, r1, &(0x7f00004db000), 0x4) 2018/02/01 16:23:27 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x2, &(0x7f0000691000-0x4)=0x79, 0x4) bind$inet(r0, &(0x7f0000887000-0x10)={0x2, 0x3, @broadcast=0xffffffff}, 0x10) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000cd5000-0x4), 0x4) sendto$inet(0xffffffffffffffff, &(0x7f0000d5a000-0x73), 0xfffffc6c, 0x20000804, &(0x7f0000e1e000)={0x2, 0x3, @loopback=0x7f000001}, 0x10) readv(r0, &(0x7f00007d7000-0x50)=[{&(0x7f0000b7e000)=""/4096, 0x1000}], 0x1) 2018/02/01 16:23:27 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x2, &(0x7f0000691000-0x4)=0x79, 0x4) bind$inet(r0, &(0x7f0000887000-0x10)={0x2, 0x3, @broadcast=0xffffffff}, 0x10) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000cd5000-0x4), 0x4) sendto$inet(0xffffffffffffffff, &(0x7f0000d5a000-0x73), 0xfffffc6c, 0x20000804, &(0x7f0000e1e000)={0x2, 0x3, @loopback=0x7f000001}, 0x10) readv(r0, &(0x7f00007d7000-0x50)=[{&(0x7f0000b7e000)=""/4096, 0x1000}], 0x1) 2018/02/01 16:23:27 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) capset(&(0x7f0000958000)={0x19980330}, &(0x7f0000db4000-0x18)) unshare(0x28060400) 2018/02/01 16:23:27 executing program 5: mmap(&(0x7f0000000000/0xf84000)=nil, 0xf84000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) sendto$inet6(r0, &(0x7f0000f84000-0x7e), 0x0, 0x0, &(0x7f0000323000-0x1c)={0xa, 0x0, 0x0, @mcast1={0xff, 0x1, [], 0x1}, 0x9}, 0x1c) 2018/02/01 16:23:27 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000006000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) close(r0) r1 = syz_open_dev$binder(&(0x7f0000009000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000a000)={0x4, 0x0, &(0x7f000000b000-0x10)=[@enter_looper={0x630c}], 0x48, 0x0, &(0x7f0000004000)="2716c84bf81a477ad3318aa4e22d244b801491b0ab3199a92b022cdb390aa97e9ed8e452dae8d724c26d0eb93c4d31a71851a3526cb61fba5ea33823f4f692f013167a905e9788f0"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f000000c000)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f0000002000-0x1)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000b000-0x30)={0x44, 0x0, &(0x7f000000a000-0x7c)=[@reply={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f000000a000)=[], &(0x7f0000003000)=[]}}], 0x0, 0x0, &(0x7f0000004000-0x4d)}) ioctl$BINDER_THREAD_EXIT(r1, 0x40046208, 0x0) 2018/02/01 16:23:27 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = memfd_create(&(0x7f000003e000)='\'', 0x0) r1 = syz_open_dev$sndseq(&(0x7f0000042000)='/dev/snd/seq\x00', 0x0, 0x0) r2 = dup2(r1, r0) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r2, 0xc08c5332, &(0x7f0000001000)={0x0, 0x0, 0x0, "9ede7a8c5ae95ec8672c93340f643a664f13eeab65c0322901dc6bd36cde2c51f01b7f0b014f9f91eeb7c37c7240f476c8d753d000aa8faf8fb574dbcfa6dc4d"}) write$sndseq(r1, &(0x7f0000002000)=[{0x0, 0x3, 0x0, 0x0, @time={0x77359400}, {}, {}, @ext={0x0, &(0x7f0000ae5000)}}], 0x30) r3 = syz_open_dev$sndseq(&(0x7f0000cea000-0xd)='/dev/snd/seq\x00', 0x0, 0x0) r4 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000e26000)='/dev/sequencer2\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_CLIENT(r3, 0x404c534a, &(0x7f0000643000-0x4c)={0x0, 0x0, 0x10001, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdfd]}) dup2(r4, r3) 2018/02/01 16:23:27 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000e1e000-0x8)={0xffffffffffffffff, 0xffffffffffffffff}) readv(r0, &(0x7f0000b3b000-0x30)=[{&(0x7f0000b13000-0xe7)=""/231, 0xe7}], 0x1) close(r0) sendto$unix(r1, &(0x7f0000010000), 0xfffffffffffff000, 0x0, 0x0, 0x0) 2018/02/01 16:23:27 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = open(&(0x7f0000fc2000)='./file0\x00', 0x141046, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000fb2000-0x12)='/dev/input/event#\x00', 0x2, 0x101002) write$evdev(r0, &(0x7f0000a12000)=[{{0x0, 0x2710}, 0x1, 0x0, 0x2}], 0x18) ftruncate(r0, 0x10000) sendfile(r1, r0, 0x0, 0x72439a6f) 2018/02/01 16:23:27 executing program 4: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)={0xaa}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) fchmodat(0xffffffffffffffff, &(0x7f0000012000)='./file0\x00', 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r1 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12, 0x0, @tid}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r1, 0x15) ioctl$UFFDIO_ZEROPAGE(0xffffffffffffffff, 0x8010aa02, &(0x7f00000c1000-0x10)={&(0x7f0000011000/0x3000)=nil, 0x3000}) 2018/02/01 16:23:27 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = memfd_create(&(0x7f000003e000)='\'', 0x0) r1 = syz_open_dev$sndseq(&(0x7f0000042000)='/dev/snd/seq\x00', 0x0, 0x8000000000102) r2 = dup2(0xffffffffffffffff, r0) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r2, 0xc08c5332, &(0x7f0000001000)={0x0, 0x0, 0x0, "9ede7a8c5ae95ec8672c93340f643a664f13eeab65c0322901dc6bd36cde2c51f01b7f0b014f9f91eeb7c37c7240f476c8d753d000aa8faf8fb574dbcfa6dc4d"}) write$sndseq(r1, &(0x7f0000002000)=[{0x0, 0x3, 0x0, 0x0, @time={0x77359400}, {}, {}, @ext={0x0, &(0x7f0000ae5000)}}], 0x30) r3 = syz_open_dev$sndseq(&(0x7f0000cea000-0xd)='/dev/snd/seq\x00', 0x0, 0x0) r4 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000e26000)='/dev/sequencer2\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_CLIENT(r3, 0x404c534a, &(0x7f0000643000-0x4c)={0x0, 0x0, 0x10001, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdfd]}) dup2(r4, r3) 2018/02/01 16:23:27 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x2, &(0x7f0000691000-0x4)=0x79, 0x4) bind$inet(r0, &(0x7f0000887000-0x10)={0x2, 0x3, @broadcast=0xffffffff}, 0x10) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000cd5000-0x4), 0x4) sendto$inet(0xffffffffffffffff, &(0x7f0000d5a000-0x73), 0xfffffc6c, 0x20000804, &(0x7f0000e1e000)={0x2, 0x3, @loopback=0x7f000001}, 0x10) readv(r0, &(0x7f00007d7000-0x50)=[{&(0x7f0000b7e000)=""/4096, 0x1000}], 0x1) [ 253.068215] binder: 2031 RLIMIT_NICE not set 2018/02/01 16:23:27 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_generic(r0, &(0x7f00001cb000)={&(0x7f00008e6000-0xc)={0x10}, 0xc, &(0x7f0000f4a000)={&(0x7f000019d000-0x1065)={0x14, 0x28, 0x311, 0xffffffffffffffff, 0xffffffffffffffff, {}, []}, 0x14}, 0x1}, 0x0) 2018/02/01 16:23:27 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = open(&(0x7f0000fc2000)='./file0\x00', 0x141046, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000fb2000-0x12)='/dev/input/event#\x00', 0x2, 0x101002) write$evdev(r0, &(0x7f0000a12000)=[{{0x0, 0x2710}, 0x1, 0x0, 0x2}], 0x18) ftruncate(r0, 0x10000) sendfile(r1, r0, 0x0, 0x72439a6f) 2018/02/01 16:23:27 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x2, &(0x7f0000691000-0x4)=0x79, 0x4) bind$inet(r0, &(0x7f0000887000-0x10)={0x2, 0x3, @broadcast=0xffffffff}, 0x10) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000cd5000-0x4), 0x4) sendto$inet(r0, &(0x7f0000d5a000-0x73), 0xfffffc6c, 0x0, &(0x7f0000e1e000)={0x2, 0x3, @loopback=0x7f000001}, 0x10) readv(r0, &(0x7f00007d7000-0x50)=[{&(0x7f0000b7e000)=""/4096, 0x1000}], 0x1) 2018/02/01 16:23:27 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x2, &(0x7f0000691000-0x4)=0x79, 0x4) bind$inet(r0, &(0x7f0000887000-0x10)={0x2, 0x3, @broadcast=0xffffffff}, 0x10) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000cd5000-0x4), 0x4) sendto$inet(r0, &(0x7f0000d5a000-0x73), 0xfffffc6c, 0x0, &(0x7f0000e1e000)={0x2, 0x3, @loopback=0x7f000001}, 0x10) readv(r0, &(0x7f00007d7000-0x50)=[{&(0x7f0000b7e000)=""/4096, 0x1000}], 0x1) 2018/02/01 16:23:27 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000e1e000-0x8)={0xffffffffffffffff, 0xffffffffffffffff}) readv(r0, &(0x7f0000b3b000-0x30)=[{&(0x7f0000b13000-0xe7)=""/231, 0xe7}], 0x1) close(r0) sendto$unix(r1, &(0x7f0000010000), 0xfffffffffffff000, 0x0, 0x0, 0x0) 2018/02/01 16:23:27 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f000097e000)={@local={0xfe, 0x80, [], 0xffffffffffffffff, 0xaa}}, 0xff32) 2018/02/01 16:23:27 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = open(&(0x7f0000fc2000)='./file0\x00', 0x141046, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000fb2000-0x12)='/dev/input/event#\x00', 0x2, 0x101002) write$evdev(r0, &(0x7f0000a12000)=[{{0x0, 0x2710}, 0x1, 0x3a}], 0x18) ftruncate(r0, 0x10000) sendfile(r1, r0, 0x0, 0x72439a6f) 2018/02/01 16:23:27 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = memfd_create(&(0x7f000003e000)='\'', 0x0) r1 = syz_open_dev$sndseq(&(0x7f0000042000)='/dev/snd/seq\x00', 0x0, 0x8000000000102) r2 = dup2(0xffffffffffffffff, r0) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r2, 0xc08c5332, &(0x7f0000001000)={0x0, 0x0, 0x0, "9ede7a8c5ae95ec8672c93340f643a664f13eeab65c0322901dc6bd36cde2c51f01b7f0b014f9f91eeb7c37c7240f476c8d753d000aa8faf8fb574dbcfa6dc4d"}) write$sndseq(r1, &(0x7f0000002000)=[{0x0, 0x3, 0x0, 0x0, @time={0x77359400}, {}, {}, @ext={0x0, &(0x7f0000ae5000)}}], 0x30) r3 = syz_open_dev$sndseq(&(0x7f0000cea000-0xd)='/dev/snd/seq\x00', 0x0, 0x0) r4 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000e26000)='/dev/sequencer2\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_CLIENT(r3, 0x404c534a, &(0x7f0000643000-0x4c)={0x0, 0x0, 0x10001, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdfd]}) dup2(r4, r3) [ 253.098133] binder: 2031 RLIMIT_NICE not set [ 253.112583] binder: release 2026:2031 transaction 582 out, still active [ 253.119522] binder: release 2026:2031 transaction 581 in, still active [ 253.126263] binder: undelivered TRANSACTION_COMPLETE [ 253.165814] binder: BINDER_SET_CONTEXT_MGR already set [ 253.165825] binder: 2026:2047 ioctl 40046207 0 returned -16 [ 253.165865] binder: 2057 RLIMIT_NICE not set [ 253.167212] binder_alloc: 2026: binder_alloc_buf, no vma [ 253.167236] binder: 2026:2047 transaction failed 29189/-3, size 0-0 line 2903 [ 253.167284] binder_alloc: 2026: binder_alloc_buf, no vma [ 253.167303] binder: 2026:2057 transaction failed 29189/-3, size 0-0 line 2903 2018/02/01 16:23:27 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$loop(&(0x7f00000fb000-0xb)='/dev/loop#\x00', 0x0, 0x4000000006) openat$ptmx(0xffffffffffffff9c, &(0x7f00001ae000)='/dev/ptmx\x00', 0x0, 0x0) mmap(&(0x7f000001a000/0x4000)=nil, 0x4000, 0x7, 0x51, r0, 0x0) getresuid(&(0x7f0000012000-0x4), &(0x7f000001a000), &(0x7f000002a000)) close(r0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x0, 0x32, 0xffffffffffffffff, 0x0) bind$inet6(0xffffffffffffffff, &(0x7f00003fa000)={0xa, 0xffffffffffffffff, 0x0, @empty}, 0x1c) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000b8e000-0x38)={&(0x7f000097b000-0xc)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000aae000)={&(0x7f0000a4b000-0xdf)=@flushsa={0x135, 0x1c, 0x0, 0x6, 0x0, {0x7f}, []}, 0x3c}, 0x1}, 0x0) setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, &(0x7f0000759000-0x10)=@common="6c6f0000000000000000000000000e00", 0x10) add_key(&(0x7f0000a5d000)='id_resolver\x00', &(0x7f00003f3000)={0x73, 0x79, 0x7a}, &(0x7f0000977000-0x1)='J', 0x1, 0xfffffffffffffffd) 2018/02/01 16:23:27 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000e1e000-0x8)={0xffffffffffffffff, 0xffffffffffffffff}) readv(r0, &(0x7f0000b3b000-0x30)=[{&(0x7f0000b13000-0xe7)=""/231, 0xe7}], 0x1) close(r0) sendto$unix(r1, &(0x7f0000010000), 0xfffffffffffff000, 0x0, 0x0, 0x0) 2018/02/01 16:23:27 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = open(&(0x7f0000fc2000)='./file0\x00', 0x141046, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000fb2000-0x12)='/dev/input/event#\x00', 0x2, 0x101002) write$evdev(r0, &(0x7f0000a12000)=[{{0x0, 0x2710}, 0x1, 0x3a}], 0x18) ftruncate(r0, 0x10000) sendfile(r1, r0, 0x0, 0x72439a6f) 2018/02/01 16:23:27 executing program 3: mmap(&(0x7f0000000000/0x7000)=nil, 0x7000, 0x3, 0x32, 0xffffffffffffffff, 0x0) setsockopt$inet6_tcp_TCP_FASTOPEN_KEY(0xffffffffffffffff, 0x6, 0x21, &(0x7f0000002000)="0d576aa5b72ceb3f97738795af87125e", 0x10) r0 = socket(0x18, 0x0, 0x1) connect(r0, &(0x7f0000002000)=@sco={0x1f, {0x1}}, 0x3a) getpeername(r0, &(0x7f0000007000-0x1c)=@in6={0x0, 0x0, 0x0, @mcast1}, &(0x7f0000005000-0x4)=0x1c) 2018/02/01 16:23:27 executing program 4: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002000)={0xaa}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) fchmodat(0xffffffffffffffff, &(0x7f0000012000)='./file0\x00', 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r1 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12, 0x0, @tid}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r1, 0x15) ioctl$UFFDIO_ZEROPAGE(0xffffffffffffffff, 0x8010aa02, &(0x7f00000c1000-0x10)={&(0x7f0000011000/0x3000)=nil, 0x3000}) 2018/02/01 16:23:27 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000248000)={{{@in=@broadcast=0xffffffff, @in6=@remote={0xfe, 0x80, [], 0xffffffffffffffff, 0xbb}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x2}, {}, {}, 0x0, 0xffffffffffffffff, 0x1}, {{@in6=@remote={0xfe, 0x80, [], 0xffffffffffffffff, 0xbb}}, 0x0, @in=@rand_addr, 0xffffffffffffffff, 0x8000000001}}, 0xe8) sendmsg(r0, &(0x7f00001f1000)={&(0x7f0000843000-0x1c)=@in6={0x2, 0x3, 0x0, @local={0xfe, 0x80, [], 0xffffffffffffffff, 0xaa}}, 0x1c, &(0x7f0000367000-0x80)=[], 0x0, &(0x7f0000dad000)=[]}, 0x0) 2018/02/01 16:23:27 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x2, &(0x7f0000691000-0x4)=0x79, 0x4) bind$inet(r0, &(0x7f0000887000-0x10)={0x2, 0x3, @broadcast=0xffffffff}, 0x10) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000cd5000-0x4), 0x4) sendto$inet(r0, &(0x7f0000d5a000-0x73), 0xfffffc6c, 0x0, &(0x7f0000e1e000)={0x2, 0x3, @loopback=0x7f000001}, 0x10) readv(r0, &(0x7f00007d7000-0x50)=[{&(0x7f0000b7e000)=""/4096, 0x1000}], 0x1) 2018/02/01 16:23:27 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = memfd_create(&(0x7f000003e000)='\'', 0x0) r1 = syz_open_dev$sndseq(&(0x7f0000042000)='/dev/snd/seq\x00', 0x0, 0x8000000000102) r2 = dup2(0xffffffffffffffff, r0) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r2, 0xc08c5332, &(0x7f0000001000)={0x0, 0x0, 0x0, "9ede7a8c5ae95ec8672c93340f643a664f13eeab65c0322901dc6bd36cde2c51f01b7f0b014f9f91eeb7c37c7240f476c8d753d000aa8faf8fb574dbcfa6dc4d"}) write$sndseq(r1, &(0x7f0000002000)=[{0x0, 0x3, 0x0, 0x0, @time={0x77359400}, {}, {}, @ext={0x0, &(0x7f0000ae5000)}}], 0x30) r3 = syz_open_dev$sndseq(&(0x7f0000cea000-0xd)='/dev/snd/seq\x00', 0x0, 0x0) r4 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000e26000)='/dev/sequencer2\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_CLIENT(r3, 0x404c534a, &(0x7f0000643000-0x4c)={0x0, 0x0, 0x10001, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdfd]}) dup2(r4, r3) 2018/02/01 16:23:27 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x2, &(0x7f0000691000-0x4)=0x79, 0x4) bind$inet(r0, &(0x7f0000887000-0x10)={0x2, 0x3, @broadcast=0xffffffff}, 0x10) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000cd5000-0x4), 0x4) sendto$inet(r0, &(0x7f0000d5a000-0x73), 0xfffffc6c, 0x20000804, &(0x7f0000e1e000)={0x2, 0xffffffffffffffff, @loopback=0x7f000001}, 0x10) readv(r0, &(0x7f00007d7000-0x50)=[{&(0x7f0000b7e000)=""/4096, 0x1000}], 0x1) 2018/02/01 16:23:27 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = inotify_init1(0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f00007dd000)={0x0}, &(0x7f0000360000)=0xc) fcntl$setown(r0, 0x8, r1) fcntl$getownex(r0, 0x10, &(0x7f000066c000)={0x0, 0x0}) ptrace$setopts(0x4206, r2, 0x0, 0x0) ptrace(0x4207, r2) ptrace$setsig(0x4203, r2, 0x0, &(0x7f0000de6000)) ptrace(0x4208, r2) [ 253.223596] binder: release 2026:2047 transaction 581 out, still active [ 253.230403] binder: undelivered TRANSACTION_COMPLETE [ 253.235549] binder: send failed reply for transaction 582, target dead [ 253.242268] binder: send failed reply for transaction 581, target dead [ 253.252623] binder: undelivered TRANSACTION_ERROR: 29189 [ 253.258192] binder: undelivered TRANSACTION_ERROR: 29189 2018/02/01 16:23:27 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = memfd_create(&(0x7f000003e000)='\'', 0x0) r1 = syz_open_dev$sndseq(&(0x7f0000042000)='/dev/snd/seq\x00', 0x0, 0x8000000000102) r2 = dup2(r1, 0xffffffffffffffff) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r2, 0xc08c5332, &(0x7f0000001000)={0x0, 0x0, 0x0, "9ede7a8c5ae95ec8672c93340f643a664f13eeab65c0322901dc6bd36cde2c51f01b7f0b014f9f91eeb7c37c7240f476c8d753d000aa8faf8fb574dbcfa6dc4d"}) write$sndseq(r1, &(0x7f0000002000)=[{0x0, 0x3, 0x0, 0x0, @time={0x77359400}, {}, {}, @ext={0x0, &(0x7f0000ae5000)}}], 0x30) r3 = syz_open_dev$sndseq(&(0x7f0000cea000-0xd)='/dev/snd/seq\x00', 0x0, 0x0) r4 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000e26000)='/dev/sequencer2\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_CLIENT(r3, 0x404c534a, &(0x7f0000643000-0x4c)={0x0, 0x0, 0x10001, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdfd]}) dup2(r4, r3) 2018/02/01 16:23:27 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x1, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000f60000-0x20)={@loopback={0x0, 0x1}, 0x0, 0x0, 0xff, 0x1}, 0x20) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000d74000)={@local={0xfe, 0x80, [], 0x0, 0xaa}, 0x0, 0x0, 0x3, 0x200b}, 0x20) getsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f00007ff000-0x20)={@remote={0xfe, 0x80, [], 0x0, 0xbb}}, &(0x7f0000f64000-0x4)=0x20) 2018/02/01 16:23:27 executing program 4: mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sg(&(0x7f0000001000-0x9)='/dev/sg#\x00', 0x0, 0x0) ioctl(r0, 0xc0481273, &(0x7f0000007000)) 2018/02/01 16:23:27 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) unshare(0x8000000) r0 = mq_open(&(0x7f0000000000)='-$\x00', 0x843, 0x0, &(0x7f0000665000-0x40)={0x0, 0x1, 0x2}) mq_timedsend(r0, &(0x7f0000a10000-0x1), 0x0, 0x0, &(0x7f000066d000-0x10)={0x77359400}) 2018/02/01 16:23:27 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = open(&(0x7f0000fc2000)='./file0\x00', 0x141046, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000fb2000-0x12)='/dev/input/event#\x00', 0x2, 0x101002) write$evdev(r0, &(0x7f0000a12000)=[{{0x0, 0x2710}, 0x1, 0x3a}], 0x18) ftruncate(r0, 0x10000) sendfile(r1, r0, 0x0, 0x72439a6f) 2018/02/01 16:23:27 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000e1e000-0x8)={0xffffffffffffffff, 0xffffffffffffffff}) readv(r0, &(0x7f0000b3b000-0x30)=[{&(0x7f0000b13000-0xe7)=""/231, 0xe7}], 0x1) sendto$unix(r1, &(0x7f0000010000), 0xfffffffffffff000, 0x0, 0x0, 0x0) 2018/02/01 16:23:27 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x2, &(0x7f0000691000-0x4)=0x79, 0x4) bind$inet(r0, &(0x7f0000887000-0x10)={0x2, 0x3, @broadcast=0xffffffff}, 0x10) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000cd5000-0x4), 0x4) sendto$inet(r0, &(0x7f0000d5a000-0x73), 0xfffffc6c, 0x20000804, &(0x7f0000e1e000)={0x2, 0xffffffffffffffff, @loopback=0x7f000001}, 0x10) readv(r0, &(0x7f00007d7000-0x50)=[{&(0x7f0000b7e000)=""/4096, 0x1000}], 0x1) 2018/02/01 16:23:27 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = memfd_create(&(0x7f000003e000)='\'', 0x0) r1 = syz_open_dev$sndseq(&(0x7f0000042000)='/dev/snd/seq\x00', 0x0, 0x8000000000102) r2 = dup2(r1, 0xffffffffffffffff) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r2, 0xc08c5332, &(0x7f0000001000)={0x0, 0x0, 0x0, "9ede7a8c5ae95ec8672c93340f643a664f13eeab65c0322901dc6bd36cde2c51f01b7f0b014f9f91eeb7c37c7240f476c8d753d000aa8faf8fb574dbcfa6dc4d"}) write$sndseq(r1, &(0x7f0000002000)=[{0x0, 0x3, 0x0, 0x0, @time={0x77359400}, {}, {}, @ext={0x0, &(0x7f0000ae5000)}}], 0x30) r3 = syz_open_dev$sndseq(&(0x7f0000cea000-0xd)='/dev/snd/seq\x00', 0x0, 0x0) r4 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000e26000)='/dev/sequencer2\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_CLIENT(r3, 0x404c534a, &(0x7f0000643000-0x4c)={0x0, 0x0, 0x10001, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdfd]}) dup2(r4, r3) [ 253.330359] ptrace attach of "/root/syz-executor5"[4076] was attempted by "/root/syz-executor5"[2093] [ 253.360842] ptrace attach of "/root/syz-executor5"[4076] was attempted by "/root/syz-executor5"[2093] 2018/02/01 16:23:27 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) seccomp(0x1, 0x0, &(0x7f0000001000-0x10)={0x2, &(0x7f0000022000)=[{0x0, 0x0, 0x0, 0xffffffffffffffe0}, {0x16}]}) dup3(0xffffffffffffffff, 0xffffffffffffff9c, 0x0) 2018/02/01 16:23:27 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = open(&(0x7f0000fc2000)='./file0\x00', 0x141046, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000fb2000-0x12)='/dev/input/event#\x00', 0x2, 0x101002) write$evdev(r0, &(0x7f0000a12000)=[{{0x0, 0x2710}, 0x1, 0x3a, 0x2}], 0x18) ftruncate(0xffffffffffffffff, 0x10000) sendfile(r1, r0, 0x0, 0x72439a6f) 2018/02/01 16:23:27 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x2, &(0x7f0000691000-0x4)=0x79, 0x4) bind$inet(r0, &(0x7f0000887000-0x10)={0x2, 0x3, @broadcast=0xffffffff}, 0x10) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000cd5000-0x4), 0x4) sendto$inet(r0, &(0x7f0000d5a000-0x73), 0xfffffc6c, 0x20000804, &(0x7f0000e1e000)={0x2, 0xffffffffffffffff, @loopback=0x7f000001}, 0x10) readv(r0, &(0x7f00007d7000-0x50)=[{&(0x7f0000b7e000)=""/4096, 0x1000}], 0x1) 2018/02/01 16:23:27 executing program 3: mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r0, 0x107, 0x100000000e, &(0x7f0000001000-0x4), 0x4) 2018/02/01 16:23:27 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = memfd_create(&(0x7f000003e000)='\'', 0x0) r1 = syz_open_dev$sndseq(&(0x7f0000042000)='/dev/snd/seq\x00', 0x0, 0x8000000000102) r2 = dup2(r1, 0xffffffffffffffff) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r2, 0xc08c5332, &(0x7f0000001000)={0x0, 0x0, 0x0, "9ede7a8c5ae95ec8672c93340f643a664f13eeab65c0322901dc6bd36cde2c51f01b7f0b014f9f91eeb7c37c7240f476c8d753d000aa8faf8fb574dbcfa6dc4d"}) write$sndseq(r1, &(0x7f0000002000)=[{0x0, 0x3, 0x0, 0x0, @time={0x77359400}, {}, {}, @ext={0x0, &(0x7f0000ae5000)}}], 0x30) r3 = syz_open_dev$sndseq(&(0x7f0000cea000-0xd)='/dev/snd/seq\x00', 0x0, 0x0) r4 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000e26000)='/dev/sequencer2\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_CLIENT(r3, 0x404c534a, &(0x7f0000643000-0x4c)={0x0, 0x0, 0x10001, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdfd]}) dup2(r4, r3) 2018/02/01 16:23:27 executing program 4: mmap(&(0x7f0000000000/0x48000)=nil, 0x48000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = memfd_create(&(0x7f0000041000)="6500000005", 0x0) r1 = syz_open_dev$sndseq(&(0x7f0000042000-0xd)='/dev/snd/seq\x00', 0x0, 0x20002) r2 = dup2(r1, r0) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r2, 0xc08c5332, &(0x7f0000042000-0x8c)={0x0, 0x0, 0x0, 'queue1\x00'}) write$sndseq(r0, &(0x7f0000001000-0x1b0)=[{0x0, 0xe91e, 0x0, 0x0, @tick, {}, {}, @result}], 0x30) 2018/02/01 16:23:27 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000e1e000-0x8)={0xffffffffffffffff, 0xffffffffffffffff}) readv(r0, &(0x7f0000b3b000-0x30)=[{&(0x7f0000b13000-0xe7)=""/231, 0xe7}], 0x1) sendto$unix(r1, &(0x7f0000010000), 0xfffffffffffff000, 0x0, 0x0, 0x0) 2018/02/01 16:23:27 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000cc5000)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r0, 0xc08c5332, &(0x7f0000b0c000-0x8c)={0x0, 0x0, 0x0, 'queue0\x00'}) r1 = memfd_create(&(0x7f000003e000)='\'', 0x0) r2 = syz_open_dev$sndseq(&(0x7f0000d82000)='/dev/snd/seq\x00', 0x0, 0x8000000040102) r3 = dup2(r2, r1) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r3, 0x40605346, &(0x7f000013e000)={0x0, 0x0, {0x200000}}) write$sndseq(r1, &(0x7f0000e70000-0x30)=[{0x1e, 0x0, 0x0, 0x3fd, @time, {}, {}, @note}], 0x30) 2018/02/01 16:23:27 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket(0x10, 0x803, 0x0) write(r0, &(0x7f0000df9000-0x27)="2600000022004701056807008980e8ff06006d20002b1f00c0e9ff094a51f10101c7033500b0", 0x26) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f000077f000), 0x4) sendto(r0, &(0x7f0000cff000-0x12)="120000001200e7ff00ffe90009144a000ae9", 0x12, 0x0, 0x0, 0x0) poll(&(0x7f0000d23000)=[{r0}], 0x1, 0x0) 2018/02/01 16:23:27 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x2, &(0x7f0000691000-0x4)=0x79, 0x4) bind$inet(r0, &(0x7f0000887000-0x10)={0x2, 0x3, @broadcast=0xffffffff}, 0x10) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000cd5000-0x4), 0x4) sendto$inet(r0, &(0x7f0000d5a000-0x73), 0xfffffc6c, 0x20000804, &(0x7f0000e1e000)={0x2, 0x3, @loopback=0x7f000001}, 0x10) readv(0xffffffffffffffff, &(0x7f00007d7000-0x50)=[{&(0x7f0000b7e000)=""/4096, 0x1000}], 0x1) 2018/02/01 16:23:27 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = open(&(0x7f0000fc2000)='./file0\x00', 0x141046, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000fb2000-0x12)='/dev/input/event#\x00', 0x2, 0x101002) write$evdev(r0, &(0x7f0000a12000)=[{{0x0, 0x2710}, 0x1, 0x3a, 0x2}], 0x18) ftruncate(0xffffffffffffffff, 0x10000) sendfile(r1, r0, 0x0, 0x72439a6f) 2018/02/01 16:23:27 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x10000000000002, 0x0) sendmmsg$inet_sctp(r0, &(0x7f000076a000-0x118)=[{&(0x7f000069c000-0x10)=@in={0x2, 0x0, @empty}, 0x10, &(0x7f0000f47000-0x60)=[{&(0x7f00004db000)="fb", 0x1}], 0x1}], 0x1, 0x4008010) 2018/02/01 16:23:27 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = memfd_create(&(0x7f000003e000)='\'', 0x0) r1 = syz_open_dev$sndseq(&(0x7f0000042000)='/dev/snd/seq\x00', 0x0, 0x8000000000102) r2 = dup2(r1, r0) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(0xffffffffffffffff, 0xc08c5332, &(0x7f0000001000)={0x0, 0x0, 0x0, "9ede7a8c5ae95ec8672c93340f643a664f13eeab65c0322901dc6bd36cde2c51f01b7f0b014f9f91eeb7c37c7240f476c8d753d000aa8faf8fb574dbcfa6dc4d"}) write$sndseq(r1, &(0x7f0000002000)=[{0x0, 0x3, 0x0, 0x0, @time={0x77359400}, {}, {}, @ext={0x0, &(0x7f0000ae5000)}}], 0x30) r3 = syz_open_dev$sndseq(&(0x7f0000cea000-0xd)='/dev/snd/seq\x00', 0x0, 0x0) r4 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000e26000)='/dev/sequencer2\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_CLIENT(r3, 0x404c534a, &(0x7f0000643000-0x4c)={0x0, 0x0, 0x10001, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdfd]}) dup2(r4, r3) 2018/02/01 16:23:27 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = open(&(0x7f0000fc2000)='./file0\x00', 0x141046, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000fb2000-0x12)='/dev/input/event#\x00', 0x2, 0x101002) write$evdev(r0, &(0x7f0000a12000)=[{{0x0, 0x2710}, 0x1, 0x3a, 0x2}], 0x18) ftruncate(0xffffffffffffffff, 0x10000) sendfile(r1, r0, 0x0, 0x72439a6f) 2018/02/01 16:23:27 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = memfd_create(&(0x7f000003e000)='\'', 0x0) r1 = syz_open_dev$sndseq(&(0x7f0000042000)='/dev/snd/seq\x00', 0x0, 0x8000000000102) r2 = dup2(r1, r0) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(0xffffffffffffffff, 0xc08c5332, &(0x7f0000001000)={0x0, 0x0, 0x0, "9ede7a8c5ae95ec8672c93340f643a664f13eeab65c0322901dc6bd36cde2c51f01b7f0b014f9f91eeb7c37c7240f476c8d753d000aa8faf8fb574dbcfa6dc4d"}) write$sndseq(r1, &(0x7f0000002000)=[{0x0, 0x3, 0x0, 0x0, @time={0x77359400}, {}, {}, @ext={0x0, &(0x7f0000ae5000)}}], 0x30) r3 = syz_open_dev$sndseq(&(0x7f0000cea000-0xd)='/dev/snd/seq\x00', 0x0, 0x0) r4 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000e26000)='/dev/sequencer2\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_CLIENT(r3, 0x404c534a, &(0x7f0000643000-0x4c)={0x0, 0x0, 0x10001, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdfd]}) dup2(r4, r3) 2018/02/01 16:23:27 executing program 5: clone(0x0, &(0x7f0000f39000), &(0x7f0000eaa000-0x4), &(0x7f0000bf3000-0x4), &(0x7f00003b9000-0xcd)) accept(0xffffffffffffff9c, 0x0, &(0x7f00000e5000-0x4)=0x309) [ 253.455215] audit: type=1326 audit(1517502207.745:180): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 pid=2118 comm="syz-executor0" exe="/root/syz-executor0" sig=31 arch=c000003e syscall=202 compat=0 ip=0x453299 code=0xffff0000 2018/02/01 16:23:27 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x8000000000000802, 0x0) sendmsg$inet_sctp(r0, &(0x7f0000a29000)={&(0x7f00006d9000-0x1c)=@in6={0xa, 0x3, 0x0, @remote={0xfe, 0x80, [], 0xffffffffffffffff, 0xbb}}, 0x1c, &(0x7f0000fc8000)=[]}, 0x8000) sendto$inet6(r0, &(0x7f0000b0d000-0x92), 0xffed, 0x0, &(0x7f000001b000)={0xa, 0xffffffffffffffff, 0x0, @empty}, 0x1c) 2018/02/01 16:23:27 executing program 3: mmap(&(0x7f0000000000/0x4f1000)=nil, 0x4f1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000002000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000004000)={0x4, 0x0, &(0x7f000000d000-0x70)=[@enter_looper={0x630c}], 0x0, 0x0, &(0x7f0000005000)}) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000-0x30)={0x0, 0x0, &(0x7f0000004000)=[], 0x48, 0x0, &(0x7f000000d000)="62164b44a5c310affb2298c023c7036e8915400419dae89c459e387ad57913e733b1615bd7c2d55328b9dff40f10d1fc0e41a052600c822c2d8d8f871ff1edbf244f0f2cc508303a"}) r1 = mmap$binder(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x0, 0x12, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000006000-0x2c)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f0000002000)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f00004ee000-0x48)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00004ed000)=[], &(0x7f00003c3000)=[]}}], 0x0, 0x0, &(0x7f00001b0000)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000003000-0x30)={0x58, 0x0, &(0x7f0000268000)=[@free_buffer={0x40086303, r1}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000373000-0x40)=[], &(0x7f0000043000)=[]}}}], 0x0, 0x0, &(0x7f0000002000)}) 2018/02/01 16:23:27 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000e1e000-0x8)={0xffffffffffffffff, 0xffffffffffffffff}) readv(r0, &(0x7f0000b3b000-0x30)=[{&(0x7f0000b13000-0xe7)=""/231, 0xe7}], 0x1) sendto$unix(r1, &(0x7f0000010000), 0xfffffffffffff000, 0x0, 0x0, 0x0) 2018/02/01 16:23:27 executing program 5: mmap(&(0x7f0000000000/0xf7f000)=nil, 0xf7f000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x2, 0x2000000088) bind$inet(r0, &(0x7f0000b9b000-0x10)={0x2, 0x0, @empty}, 0x10) sendto$inet(r0, &(0x7f0000e7c000), 0x0, 0x8084, &(0x7f000031a000-0x10)={0x2, 0x0, @empty}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000ba5000-0xe8)={{{@in=@dev={0xac, 0x14}, @in6=@mcast2={0xff, 0x2, [], 0x1}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xa, 0x0, 0xa0}}, {{@in=@dev={0xac, 0x14}}, 0x0, @in=@rand_addr}}, 0xe8) sendto$inet(r0, &(0x7f00008c9000), 0x0, 0x0, &(0x7f0000917000-0x10)={0x2, 0xffffffffffffffff, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}}, 0x10) 2018/02/01 16:23:27 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = memfd_create(&(0x7f000003e000)='\'', 0x0) r1 = syz_open_dev$sndseq(&(0x7f0000042000)='/dev/snd/seq\x00', 0x0, 0x8000000000102) r2 = dup2(r1, r0) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(0xffffffffffffffff, 0xc08c5332, &(0x7f0000001000)={0x0, 0x0, 0x0, "9ede7a8c5ae95ec8672c93340f643a664f13eeab65c0322901dc6bd36cde2c51f01b7f0b014f9f91eeb7c37c7240f476c8d753d000aa8faf8fb574dbcfa6dc4d"}) write$sndseq(r1, &(0x7f0000002000)=[{0x0, 0x3, 0x0, 0x0, @time={0x77359400}, {}, {}, @ext={0x0, &(0x7f0000ae5000)}}], 0x30) r3 = syz_open_dev$sndseq(&(0x7f0000cea000-0xd)='/dev/snd/seq\x00', 0x0, 0x0) r4 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000e26000)='/dev/sequencer2\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_CLIENT(r3, 0x404c534a, &(0x7f0000643000-0x4c)={0x0, 0x0, 0x10001, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdfd]}) dup2(r4, r3) 2018/02/01 16:23:27 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) connect$inet6(r0, &(0x7f0000d37000)={0xa, 0xffffffffffffffff, 0x0, @remote={0xfe, 0x80, [], 0xffffffffffffffff, 0xbb}, 0x4}, 0x1c) 2018/02/01 16:23:27 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = open(&(0x7f0000fc2000)='./file0\x00', 0x141046, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000fb2000-0x12)='/dev/input/event#\x00', 0x2, 0x101002) write$evdev(r0, &(0x7f0000a12000)=[{{0x0, 0x2710}, 0x1, 0x3a, 0x2}], 0x18) ftruncate(r0, 0x0) sendfile(r1, r0, 0x0, 0x72439a6f) 2018/02/01 16:23:27 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x2, &(0x7f0000691000-0x4)=0x79, 0x4) bind$inet(r0, &(0x7f0000887000-0x10)={0x2, 0x3, @broadcast=0xffffffff}, 0x10) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000cd5000-0x4), 0x4) sendto$inet(r0, &(0x7f0000d5a000-0x73), 0xfffffc6c, 0x20000804, &(0x7f0000e1e000)={0x2, 0x3, @loopback=0x7f000001}, 0x10) readv(0xffffffffffffffff, &(0x7f00007d7000-0x50)=[{&(0x7f0000b7e000)=""/4096, 0x1000}], 0x1) [ 253.520767] audit: type=1326 audit(1517502207.801:181): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 pid=2118 comm="syz-executor0" exe="/root/syz-executor0" sig=31 arch=c000003e syscall=202 compat=0 ip=0x453299 code=0xffff0000 2018/02/01 16:23:27 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = memfd_create(&(0x7f000003e000)='\'', 0x0) r1 = syz_open_dev$sndseq(&(0x7f0000042000)='/dev/snd/seq\x00', 0x0, 0x8000000000102) r2 = dup2(r1, r0) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r2, 0xc08c5332, &(0x7f0000001000)={0x0, 0x0, 0x0, "9ede7a8c5ae95ec8672c93340f643a664f13eeab65c0322901dc6bd36cde2c51f01b7f0b014f9f91eeb7c37c7240f476c8d753d000aa8faf8fb574dbcfa6dc4d"}) write$sndseq(0xffffffffffffffff, &(0x7f0000002000)=[{0x0, 0x3, 0x0, 0x0, @time={0x77359400}, {}, {}, @ext={0x0, &(0x7f0000ae5000)}}], 0x30) r3 = syz_open_dev$sndseq(&(0x7f0000cea000-0xd)='/dev/snd/seq\x00', 0x0, 0x0) r4 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000e26000)='/dev/sequencer2\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_CLIENT(r3, 0x404c534a, &(0x7f0000643000-0x4c)={0x0, 0x0, 0x10001, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdfd]}) dup2(r4, r3) [ 253.569952] binder: 2166 RLIMIT_NICE not set 2018/02/01 16:23:27 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = memfd_create(&(0x7f000003e000)='\'', 0x0) r1 = syz_open_dev$sndseq(&(0x7f0000042000)='/dev/snd/seq\x00', 0x0, 0x8000000000102) r2 = dup2(r1, r0) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r2, 0xc08c5332, &(0x7f0000001000)={0x0, 0x0, 0x0, "9ede7a8c5ae95ec8672c93340f643a664f13eeab65c0322901dc6bd36cde2c51f01b7f0b014f9f91eeb7c37c7240f476c8d753d000aa8faf8fb574dbcfa6dc4d"}) write$sndseq(0xffffffffffffffff, &(0x7f0000002000)=[{0x0, 0x3, 0x0, 0x0, @time={0x77359400}, {}, {}, @ext={0x0, &(0x7f0000ae5000)}}], 0x30) r3 = syz_open_dev$sndseq(&(0x7f0000cea000-0xd)='/dev/snd/seq\x00', 0x0, 0x0) r4 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000e26000)='/dev/sequencer2\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_CLIENT(r3, 0x404c534a, &(0x7f0000643000-0x4c)={0x0, 0x0, 0x10001, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdfd]}) dup2(r4, r3) 2018/02/01 16:23:27 executing program 5: mmap(&(0x7f0000000000/0xc38000)=nil, 0xc38000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = inotify_init1(0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000c36000)={0x0}, &(0x7f0000048000)=0xc) fcntl$setown(r0, 0x8, r1) fcntl$getownex(r0, 0x10, &(0x7f0000390000)={0x0, 0x0}) ptrace$setopts(0x4206, r2, 0x0, 0x0) ptrace(0x4207, r2) tkill(r2, 0x12) ptrace(0x4208, r2) 2018/02/01 16:23:27 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = open(&(0x7f0000fc2000)='./file0\x00', 0x141046, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000fb2000-0x12)='/dev/input/event#\x00', 0x2, 0x101002) write$evdev(r0, &(0x7f0000a12000)=[{{0x0, 0x2710}, 0x1, 0x3a, 0x2}], 0x18) ftruncate(r0, 0x0) sendfile(r1, r0, 0x0, 0x72439a6f) 2018/02/01 16:23:27 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = memfd_create(&(0x7f000003e000)='\'', 0x0) r1 = syz_open_dev$sndseq(&(0x7f0000042000)='/dev/snd/seq\x00', 0x0, 0x8000000000102) r2 = dup2(r1, r0) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r2, 0xc08c5332, &(0x7f0000001000)={0x0, 0x0, 0x0, "9ede7a8c5ae95ec8672c93340f643a664f13eeab65c0322901dc6bd36cde2c51f01b7f0b014f9f91eeb7c37c7240f476c8d753d000aa8faf8fb574dbcfa6dc4d"}) write$sndseq(0xffffffffffffffff, &(0x7f0000002000)=[{0x0, 0x3, 0x0, 0x0, @time={0x77359400}, {}, {}, @ext={0x0, &(0x7f0000ae5000)}}], 0x30) r3 = syz_open_dev$sndseq(&(0x7f0000cea000-0xd)='/dev/snd/seq\x00', 0x0, 0x0) r4 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000e26000)='/dev/sequencer2\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_CLIENT(r3, 0x404c534a, &(0x7f0000643000-0x4c)={0x0, 0x0, 0x10001, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdfd]}) dup2(r4, r3) 2018/02/01 16:23:27 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$loop(&(0x7f00000e5000)='/dev/loop#\x00', 0x400000000000, 0x0) ioctl$LOOP_SET_STATUS(r0, 0xc0481273, &(0x7f00009d0000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, "000000000100000001001bf3ff000000006500ff00010000007db0e6f10efbf9a219d8f6aa6bd58d1c43473100e85026e7ff40f9b55bd1b3335d5bffff0001f3", "cfa40005000000f7ffffffff00000000000000ffb833220182ab867d00"}) 2018/02/01 16:23:27 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000e1e000-0x8)={0xffffffffffffffff, 0xffffffffffffffff}) close(r0) sendto$unix(r1, &(0x7f0000010000), 0xfffffffffffff000, 0x0, 0x0, 0x0) 2018/02/01 16:23:27 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x2, &(0x7f0000691000-0x4)=0x79, 0x4) bind$inet(r0, &(0x7f0000887000-0x10)={0x2, 0x3, @broadcast=0xffffffff}, 0x10) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000cd5000-0x4), 0x4) sendto$inet(r0, &(0x7f0000d5a000-0x73), 0xfffffc6c, 0x20000804, &(0x7f0000e1e000)={0x2, 0x3, @loopback=0x7f000001}, 0x10) readv(0xffffffffffffffff, &(0x7f00007d7000-0x50)=[{&(0x7f0000b7e000)=""/4096, 0x1000}], 0x1) [ 253.601206] binder: 2166 RLIMIT_NICE not set [ 253.607502] binder: 2162:2178 got reply transaction with bad transaction stack, transaction 586 has target 2162:0 [ 253.607514] binder: 2162:2178 transaction failed 29201/-71, size 0-0 line 2718 [ 253.642211] binder: BINDER_SET_CONTEXT_MGR already set [ 253.642223] binder: 2162:2178 ioctl 40046207 0 returned -16 [ 253.650588] ptrace attach of "/root/syz-executor5"[4076] was attempted by "/root/syz-executor5"[2193] [ 253.652980] binder_alloc: 2162: binder_alloc_buf, no vma [ 253.653011] binder: 2162:2189 transaction failed 29189/-3, size 0-0 line 2903 [ 253.655167] binder: 2162:2178 got reply transaction with no transaction stack [ 253.655177] binder: 2162:2178 transaction failed 29201/-71, size 0-0 line 2703 [ 253.655551] ================================================================== [ 253.655573] BUG: KASAN: double-free or invalid-free in relay_open+0x6a1/0xa40 [ 253.655576] [ 253.655588] CPU: 0 PID: 2194 Comm: syz-executor4 Not tainted 4.15.0+ #290 [ 253.655594] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 253.655597] Call Trace: [ 253.655612] dump_stack+0x194/0x257 [ 253.655627] ? arch_local_irq_restore+0x53/0x53 [ 253.655640] ? show_regs_print_info+0x18/0x18 [ 253.655649] ? __lock_is_held+0xb6/0x140 [ 253.655668] ? relay_open+0x6a1/0xa40 [ 253.655680] print_address_description+0x73/0x250 [ 253.655689] ? relay_open+0x6a1/0xa40 [ 253.655697] ? relay_open+0x6a1/0xa40 [ 253.655708] kasan_report_double_free+0x55/0x80 [ 253.655720] kasan_slab_free+0xa3/0xc0 [ 253.655732] kfree+0xd6/0x260 [ 253.655745] relay_open+0x6a1/0xa40 [ 253.655760] ? relay_open_buf.part.10+0x9b0/0x9b0 [ 253.655778] ? __debugfs_create_file+0x2cf/0x3d0 [ 253.655800] ? debugfs_create_file+0x57/0x70 [ 253.655817] do_blk_trace_setup+0x4a4/0xcd0 [ 253.655836] ? blk_tracer_print_line+0x40/0x40 [ 253.655848] ? __might_sleep+0x95/0x190 [ 253.655869] ? kasan_check_write+0x14/0x20 [ 253.655881] ? _copy_from_user+0x99/0x110 [ 253.655899] __blk_trace_setup+0xbe/0x150 [ 253.655912] ? do_blk_trace_setup+0xcd0/0xcd0 [ 253.655936] ? disk_name+0x98/0x100 [ 253.655958] blk_trace_ioctl+0x206/0x2e0 [ 253.655970] ? blk_add_trace_rq_remap+0x680/0x680 [ 253.655993] ? avc_has_extended_perms+0x7fa/0x12c0 [ 253.656016] blkdev_ioctl+0x1845/0x1e00 [ 253.656031] ? blkpg_ioctl+0xb40/0xb40 [ 253.656042] ? avc_ss_reset+0x110/0x110 [ 253.656053] ? lock_downgrade+0x980/0x980 [ 253.656071] ? lock_release+0xa40/0xa40 [ 253.656089] ? __lock_is_held+0xb6/0x140 [ 253.656137] ? trace_event_raw_event_sched_switch+0x800/0x800 [ 253.656149] ? get_unused_fd_flags+0x190/0x190 [ 253.656161] ? rcu_note_context_switch+0x710/0x710 [ 253.656177] block_ioctl+0xde/0x120 [ 253.656190] ? blkdev_fallocate+0x3b0/0x3b0 [ 253.656199] do_vfs_ioctl+0x1b1/0x1520 [ 253.656207] ? _cond_resched+0x14/0x30 [ 253.656226] ? ioctl_preallocate+0x2b0/0x2b0 [ 253.656241] ? selinux_capable+0x40/0x40 [ 253.656270] ? syscall_return_slowpath+0x2ad/0x550 [ 253.656291] ? security_file_ioctl+0x89/0xb0 [ 253.656308] SyS_ioctl+0x8f/0xc0 [ 253.656328] entry_SYSCALL_64_fastpath+0x29/0xa0 [ 253.656336] RIP: 0033:0x453299 [ 253.656341] RSP: 002b:00007f6049ee4c58 EFLAGS: 00000212 ORIG_RAX: 0000000000000010 [ 253.656351] RAX: ffffffffffffffda RBX: 000000000071bea0 RCX: 0000000000453299 [ 253.656357] RDX: 00000000209d0000 RSI: 00000000c0481273 RDI: 0000000000000013 [ 253.656362] RBP: 000000000000061d R08: 0000000000000000 R09: 0000000000000000 [ 253.656367] R10: 0000000000000000 R11: 0000000000000212 R12: 00000000006f8358 [ 253.656372] R13: 00000000ffffffff R14: 00007f6049ee56d4 R15: 0000000000000000 [ 253.656411] [ 253.656415] Allocated by task 2194: [ 253.656424] save_stack+0x43/0xd0 [ 253.656433] kasan_kmalloc+0xad/0xe0 [ 253.656442] kmem_cache_alloc_trace+0x136/0x750 [ 253.656449] relay_open+0xf2/0xa40 [ 253.656458] do_blk_trace_setup+0x4a4/0xcd0 [ 253.656465] __blk_trace_setup+0xbe/0x150 [ 253.656471] blk_trace_ioctl+0x206/0x2e0 [ 253.656478] blkdev_ioctl+0x1845/0x1e00 [ 253.656484] block_ioctl+0xde/0x120 [ 253.656491] do_vfs_ioctl+0x1b1/0x1520 [ 253.656497] SyS_ioctl+0x8f/0xc0 [ 253.656505] entry_SYSCALL_64_fastpath+0x29/0xa0 [ 253.656507] [ 253.656511] Freed by task 2194: [ 253.656519] save_stack+0x43/0xd0 [ 253.656526] kasan_slab_free+0x71/0xc0 [ 253.656533] kfree+0xd6/0x260 [ 253.656538] relay_open+0x84a/0xa40 [ 253.656545] do_blk_trace_setup+0x4a4/0xcd0 [ 253.656553] __blk_trace_setup+0xbe/0x150 [ 253.656558] blk_trace_ioctl+0x206/0x2e0 [ 253.656565] blkdev_ioctl+0x1845/0x1e00 [ 253.656571] block_ioctl+0xde/0x120 [ 253.656577] do_vfs_ioctl+0x1b1/0x1520 [ 253.656584] SyS_ioctl+0x8f/0xc0 [ 253.656592] entry_SYSCALL_64_fastpath+0x29/0xa0 [ 253.656594] [ 253.656599] The buggy address belongs to the object at ffff8801d00a17c0 [ 253.656599] which belongs to the cache kmalloc-512 of size 512 [ 253.656605] The buggy address is located 0 bytes inside of [ 253.656605] 512-byte region [ffff8801d00a17c0, ffff8801d00a19c0) [ 253.656607] The buggy address belongs to the page: [ 253.656612] page:ffffea0007402840 count:1 mapcount:0 mapping:ffff8801d00a1040 index:0x0 [ 253.656619] flags: 0x2fffc0000000100(slab) [ 253.656628] raw: 02fffc0000000100 ffff8801d00a1040 0000000000000000 0000000100000006 [ 253.656636] raw: ffffea00073517e0 ffffea0007634ae0 ffff8801db000940 0000000000000000 [ 253.656639] page dumped because: kasan: bad access detected [ 253.656641] [ 253.656643] Memory state around the buggy address: [ 253.656648] ffff8801d00a1680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 253.656653] ffff8801d00a1700: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 253.656658] >ffff8801d00a1780: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb [ 253.656661] ^ [ 253.656666] ffff8801d00a1800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 253.656671] ffff8801d00a1880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 253.656674] ================================================================== [ 253.656676] Disabling lock debugging due to kernel taint [ 253.656680] Kernel panic - not syncing: panic_on_warn set ... [ 253.656680] [ 253.656687] CPU: 0 PID: 2194 Comm: syz-executor4 Tainted: G B 4.15.0+ #290 [ 253.656691] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 253.656693] Call Trace: [ 253.656702] dump_stack+0x194/0x257 [ 253.656712] ? arch_local_irq_restore+0x53/0x53 [ 253.656718] ? kasan_end_report+0x32/0x50 [ 253.656726] ? lock_downgrade+0x980/0x980 [ 253.656735] ? vsnprintf+0x1ed/0x1900 [ 253.656746] panic+0x1e4/0x41c [ 253.656752] ? refcount_error_report+0x214/0x214 [ 253.656760] ? add_taint+0x40/0x50 [ 253.656765] ? add_taint+0x1c/0x50 [ 253.656771] ? relay_open+0x6a1/0xa40 [ 253.656776] ? relay_open+0x6a1/0xa40 [ 253.656782] kasan_end_report+0x50/0x50 [ 253.656790] kasan_report_double_free+0x72/0x80 [ 253.656799] kasan_slab_free+0xa3/0xc0 [ 253.656807] kfree+0xd6/0x260 [ 253.656815] relay_open+0x6a1/0xa40 [ 253.656825] ? relay_open_buf.part.10+0x9b0/0x9b0 [ 253.656835] ? __debugfs_create_file+0x2cf/0x3d0 [ 253.656846] ? debugfs_create_file+0x57/0x70 [ 253.656858] do_blk_trace_setup+0x4a4/0xcd0 [ 253.656871] ? blk_tracer_print_line+0x40/0x40 [ 253.656879] ? __might_sleep+0x95/0x190 [ 253.656892] ? kasan_check_write+0x14/0x20 [ 253.656899] ? _copy_from_user+0x99/0x110 [ 253.656910] __blk_trace_setup+0xbe/0x150 [ 253.656919] ? do_blk_trace_setup+0xcd0/0xcd0 [ 253.656933] ? disk_name+0x98/0x100 [ 253.656946] blk_trace_ioctl+0x206/0x2e0 [ 253.656954] ? blk_add_trace_rq_remap+0x680/0x680 [ 253.656969] ? avc_has_extended_perms+0x7fa/0x12c0 [ 253.656981] blkdev_ioctl+0x1845/0x1e00 [ 253.656989] ? blkpg_ioctl+0xb40/0xb40 [ 253.656996] ? avc_ss_reset+0x110/0x110 [ 253.657003] ? lock_downgrade+0x980/0x980 [ 253.657013] ? lock_release+0xa40/0xa40 [ 253.657023] ? __lock_is_held+0xb6/0x140 [ 253.657054] ? trace_event_raw_event_sched_switch+0x800/0x800 [ 253.657063] ? get_unused_fd_flags+0x190/0x190 [ 253.657072] ? rcu_note_context_switch+0x710/0x710 [ 253.657081] block_ioctl+0xde/0x120 [ 253.657088] ? blkdev_fallocate+0x3b0/0x3b0 [ 253.657095] do_vfs_ioctl+0x1b1/0x1520 [ 253.657100] ? _cond_resched+0x14/0x30 [ 253.657110] ? ioctl_preallocate+0x2b0/0x2b0 [ 253.657119] ? selinux_capable+0x40/0x40 [ 253.657134] ? syscall_return_slowpath+0x2ad/0x550 [ 253.657146] ? security_file_ioctl+0x89/0xb0 [ 253.657155] SyS_ioctl+0x8f/0xc0 [ 253.657166] entry_SYSCALL_64_fastpath+0x29/0xa0 [ 253.657170] RIP: 0033:0x453299 [ 253.657173] RSP: 002b:00007f6049ee4c58 EFLAGS: 00000212 ORIG_RAX: 0000000000000010 [ 253.657180] RAX: ffffffffffffffda RBX: 000000000071bea0 RCX: 0000000000453299 [ 253.657184] RDX: 00000000209d0000 RSI: 00000000c0481273 RDI: 0000000000000013 [ 253.657187] RBP: 000000000000061d R08: 0000000000000000 R09: 0000000000000000 [ 253.657191] R10: 0000000000000000 R11: 0000000000000212 R12: 00000000006f8358 [ 253.657195] R13: 00000000ffffffff R14: 00007f6049ee56d4 R15: 0000000000000000 [ 253.657655] Dumping ftrace buffer: [ 253.657658] (ftrace buffer empty) [ 253.657661] Kernel Offset: disabled [ 254.501096] Rebooting in 86400 seconds..