x10, 0x10e, 0x0, ""}], 0x10, 0x0}, 0x0) [ 298.433761] binder: 14796:14797 BC_INCREFS_DONE u00000000204edf8a node 1259 cookie mismatch 0000000000000000 != 0000000000000001 [ 298.440961] binder: release 14796:14797 transaction 1258 out, still active [ 298.440967] binder: undelivered TRANSACTION_COMPLETE [ 298.441110] binder: send failed reply for transaction 1258, target dead [ 298.634690] binder: 14762:14765 ioctl c0306201 20008000 returned -14 [ 298.646226] binder: undelivered TRANSACTION_ERROR: 29189 2018/02/01 04:11:18 executing program 1: openat$ion(0xffffffffffffff9c, &(0x7f0000801000-0x9)='/dev/ion\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000233000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) write$tun(0xffffffffffffffff, &(0x7f0000577000)=@pi={0x0, 0x0, @eth={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x0}, [], {@canfd={0xd, {{0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0, "feb442a1f43ead325d71fed774c8f6028c2a6b79a4e418aa3c5f391769659fef9f596cdade428c389e511eaad39d2ee4334dee9516a31d00510baaf06efc0980"}}}}}, 0x5a) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004ee000-0x76)='\x00', 0x1, 0x0, 0x0}], &(0x7f000000b000-0x30)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)=""}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00005da000)={0x0, 0x0, &(0x7f00000d8000)=[], 0x48, 0x0, &(0x7f000044c000-0x83)="a410778b7a640ab0384c4ead541b6ee57c5645909ef688d8ac3e5ecfc7039f5f8ba53f127b7f01947cd3689eaf6c090277915bab2a0c450988cb85688e2bcc101a80664d3081fcc0"}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000c5a000)={0x0, 0x0, 0x0, 0x0}) mmap(&(0x7f0000000000/0x13000)=nil, 0x13000, 0x0, 0x32, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000a95000-0x30)={0x14, 0x0, &(0x7f0000b8f000)=[@increfs_done={0x40106308, r3, 0x1}], 0x0, 0x0, &(0x7f00002e4000-0x70)=""}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000436000-0x30)={0x20, 0x0, &(0x7f0000136000)=[@dead_binder_done={0x40086310, 0x3}, @increfs_done={0x40106308, r3, 0x0}], 0x0, 0x0, &(0x7f0000888000-0xb)=""}) 2018/02/01 04:11:18 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x2, 0x0) bind$inet(r0, &(0x7f0000eed000)={0x2, 0x1, @empty=0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x10) r1 = socket$inet(0x2, 0x2, 0x0) r2 = syz_open_dev$audion(&(0x7f0000629000-0xc)='/dev/audio#\x00', 0x40, 0x0) write$selinux_context(r2, &(0x7f0000441000)='system_u:object_r:xen_device_t:s0\x00', 0x22) sendto$inet(r1, &(0x7f0000e87000)="", 0xffba, 0x0, &(0x7f0000eea000-0x10)={0x2, 0x1, @empty=0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x10) syz_emit_ethernet(0x2a, &(0x7f000070b000-0x10f)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @empty=[0x0, 0x0, 0x14, 0x0, 0x0, 0x0], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0xffffffffffffffff, 0x0, 0x0, 0x11, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @broadcast=0xffffffff, {[]}}, @udp={0xffffffffffffffff, 0x1, 0x8, 0x0, ""}}}}}, 0x0) 2018/02/01 04:11:18 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f0000590000-0x8)='./file0\x00', 0x14) write$selinux_create(r0, &(0x7f000074c000)=@access={'system_u:object_r:dpkg_exec_t:s0', 0x20, '/usr/sbin/cups-browsed', 0x20, 0x32, 0x30, 0x0}, 0x3b) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f00007cf000)='/dev/cuse\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_STATUS(r1, 0xc05c5340, &(0x7f0000b85000)={0x6, 0x100, 0x2, {0x0, 0x0}, 0x0, 0x4, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000801000-0x9)='/dev/ion\x00', 0x0, 0x0) r3 = syz_open_dev$binder(&(0x7f0000233000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r4 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0) r5 = dup2(r3, r4) write$tun(0xffffffffffffffff, &(0x7f0000577000)=@pi={0x0, 0x0, @eth={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x0}, [], {@canfd={0xd, {{0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0, "feb442a1f43ead325d71fed774c8f6028c2a6b79a4e418aa3c5f391769659fef9f596cdade428c389e511eaad39d2ee4334dee9516a31d00510baaf06efc0980"}}}}}, 0x5a) r6 = dup2(r4, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000008000)={0x0, 0x0, &(0x7f0000005000-0x44)=[], 0x0, 0x0, &(0x7f0000009000)=""}) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f00005da000)={0x0, 0x0, &(0x7f00000d8000)=[], 0x48, 0x0, &(0x7f000044c000-0x83)="a410778b7a640ab0384c4ead541b6ee57c5645909ef688d8ac3e5ecfc7039f5f8ba53f127b7f01947cd3689eaf6c090277915bab2a0c450988cb85688e2bcc101a80664d3081fcc0"}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000c5a000)={0x0, 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000a95000-0x30)={0x14, 0x0, &(0x7f0000b8f000)=[@increfs_done={0x40106308, r7, 0x1}], 0x0, 0x0, &(0x7f00002e4000-0x70)=""}) getsockopt$inet6_dccp_buf(r5, 0x21, 0xcf, &(0x7f0000e10000-0xcc)=""/204, &(0x7f000037d000-0x4)=0xcc) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000436000-0x30)={0x20, 0x0, &(0x7f0000136000)=[@dead_binder_done={0x40086310, 0x3}, @increfs_done={0x40106308, r7, 0x0}], 0x0, 0x0, &(0x7f0000888000-0xb)=""}) close(r2) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000002000-0x38)={0x0, 0x0, &(0x7f0000003000)=[], 0x0, &(0x7f0000002000)=[{0x10, 0x10e, 0x0, ""}], 0x10, 0x0}, 0x0) [ 298.675144] binder: send failed reply for transaction 1262 to 14811:14813 [ 298.681599] binder: 14808:14818 BC_DEAD_BINDER_DONE 0000000000000003 not found [ 298.681614] binder: 14808:14818 BC_INCREFS_DONE u00000000204edf8a node 1267 cookie mismatch 0000000000000000 != 0000000000000001 [ 298.686147] binder: BINDER_SET_CONTEXT_MGR already set [ 298.686156] binder: 14806:14816 ioctl 40046207 0 returned -16 [ 298.687359] binder: 14806:14816 BC_INCREFS_DONE u0000000000000000 no match 2018/02/01 04:11:18 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) seccomp(0x1, 0x0, &(0x7f000089b000-0x10)={0x1, &(0x7f0000214000)=[{0x7ff, 0x4ea4, 0x7, 0x407ffc0003}]}) r0 = openat(0xffffffffffffff9c, &(0x7f0000226000-0x8)='./file0\x00', 0x60100, 0x60) ioctl$VHOST_SET_VRING_ENDIAN(r0, 0x4008af13, &(0x7f0000721000-0x8)={0x3, 0x8}) r1 = shmget$private(0x0, 0x3000, 0x54004080, &(0x7f0000757000/0x3000)=nil) shmctl$IPC_INFO(r1, 0x3, &(0x7f00007c7000-0x1000)=""/4096) [ 298.725312] binder: 14811:14813 BC_INCREFS_DONE u0000000000000000 no match [ 298.740682] binder_alloc: 14808: binder_alloc_buf, no vma 2018/02/01 04:11:18 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f0000590000-0x8)='./file0\x00', 0x14) write$selinux_create(r0, &(0x7f000074c000)=@access={'system_u:object_r:dpkg_exec_t:s0', 0x20, '/usr/sbin/cups-browsed', 0x20, 0x32, 0x30, 0x0}, 0x3b) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f00007cf000)='/dev/cuse\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_STATUS(r1, 0xc05c5340, &(0x7f0000b85000)={0x6, 0x100, 0x2, {0x0, 0x0}, 0x3bd0, 0x4, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000801000-0x9)='/dev/ion\x00', 0x0, 0x0) r3 = syz_open_dev$binder(&(0x7f0000233000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r4 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0) r5 = dup2(r3, r4) write$tun(0xffffffffffffffff, &(0x7f0000577000)=@pi={0x0, 0x0, @eth={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x0}, [], {@canfd={0xd, {{0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0, "feb442a1f43ead325d71fed774c8f6028c2a6b79a4e418aa3c5f391769659fef9f596cdade428c389e511eaad39d2ee4334dee9516a31d00510baaf06efc0980"}}}}}, 0x5a) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004ee000-0x76)='\x00', 0x1, 0x0, 0x0}], &(0x7f000000b000-0x30)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)=""}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00005da000)={0x0, 0x0, &(0x7f00000d8000)=[], 0x48, 0x0, &(0x7f000044c000-0x83)="a410778b7a640ab0384c4ead541b6ee57c5645909ef688d8ac3e5ecfc7039f5f8ba53f127b7f01947cd3689eaf6c090277915bab2a0c450988cb85688e2bcc101a80664d3081fcc0"}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000c5a000)={0x0, 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000a95000-0x30)={0x14, 0x0, &(0x7f0000b8f000)=[@increfs_done={0x40106308, r6, 0x1}], 0x0, 0x0, &(0x7f00002e4000-0x70)=""}) getsockopt$inet6_dccp_buf(r5, 0x21, 0xcf, &(0x7f0000e10000-0xcc)=""/204, &(0x7f000037d000-0x4)=0xcc) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000436000-0x30)={0x20, 0x0, &(0x7f0000136000)=[@dead_binder_done={0x40086310, 0x3}, @increfs_done={0x40106308, r6, 0x0}], 0x0, 0x0, &(0x7f0000888000-0xb)=""}) close(r2) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000002000-0x38)={0x0, 0x0, &(0x7f0000003000)=[], 0x0, &(0x7f0000002000)=[{0x10, 0x10e, 0x0, ""}], 0x10, 0x0}, 0x0) [ 298.740712] binder: 14815:14822 transaction failed 29189/-3, size 40-8 line 2903 [ 298.743177] binder: 14815:14822 BC_INCREFS_DONE u0000000000000000 no match [ 298.743292] binder: 14815:14822 BC_DEAD_BINDER_DONE 0000000000000003 not found [ 298.743301] binder: 14815:14822 BC_INCREFS_DONE u0000000000000000 no match [ 298.756801] binder: BINDER_SET_CONTEXT_MGR already set [ 298.756811] binder: 14820:14824 ioctl 40046207 0 returned -16 [ 298.759331] binder_alloc: 14808: binder_alloc_buf, no vma [ 298.759360] binder: 14820:14824 transaction failed 29189/-3, size 40-8 line 2903 [ 298.764336] binder: 14820:14824 BC_DEAD_BINDER_DONE 0000000000000003 not found [ 298.764348] binder: 14820:14824 BC_INCREFS_DONE u0000000000000000 no match [ 298.769130] binder: BINDER_SET_CONTEXT_MGR already set [ 298.769140] binder: 14823:14826 ioctl 40046207 0 returned -16 2018/02/01 04:11:18 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f0000590000-0x8)='./file0\x00', 0x14) write$selinux_create(r0, &(0x7f000074c000)=@access={'system_u:object_r:dpkg_exec_t:s0', 0x20, '/usr/sbin/cups-browsed', 0x20, 0x32, 0x30, 0x0}, 0x3b) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f00007cf000)='/dev/cuse\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_STATUS(r1, 0xc05c5340, &(0x7f0000b85000)={0x6, 0x100, 0x2, {0x0, 0x0}, 0x0, 0x4, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000801000-0x9)='/dev/ion\x00', 0x0, 0x0) r3 = syz_open_dev$binder(&(0x7f0000233000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r4 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0) r5 = dup2(r3, r4) write$tun(0xffffffffffffffff, &(0x7f0000577000)=@pi={0x0, 0x0, @eth={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x0}, [], {@canfd={0xd, {{0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0, "feb442a1f43ead325d71fed774c8f6028c2a6b79a4e418aa3c5f391769659fef9f596cdade428c389e511eaad39d2ee4334dee9516a31d00510baaf06efc0980"}}}}}, 0x5a) r6 = dup2(r4, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000008000)={0x0, 0x0, &(0x7f0000005000-0x44)=[], 0x0, 0x0, &(0x7f0000009000)=""}) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f00005da000)={0x0, 0x0, &(0x7f00000d8000)=[], 0x48, 0x0, &(0x7f000044c000-0x83)="a410778b7a640ab0384c4ead541b6ee57c5645909ef688d8ac3e5ecfc7039f5f8ba53f127b7f01947cd3689eaf6c090277915bab2a0c450988cb85688e2bcc101a80664d3081fcc0"}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000c5a000)={0x0, 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000a95000-0x30)={0x14, 0x0, &(0x7f0000b8f000)=[@increfs_done={0x40106308, r7, 0x1}], 0x0, 0x0, &(0x7f00002e4000-0x70)=""}) getsockopt$inet6_dccp_buf(r5, 0x21, 0xcf, &(0x7f0000e10000-0xcc)=""/204, &(0x7f000037d000-0x4)=0xcc) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000436000-0x30)={0x20, 0x0, &(0x7f0000136000)=[@dead_binder_done={0x40086310, 0x3}, @increfs_done={0x40106308, r7, 0x0}], 0x0, 0x0, &(0x7f0000888000-0xb)=""}) close(r2) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000002000-0x38)={0x0, 0x0, &(0x7f0000003000)=[], 0x0, &(0x7f0000002000)=[{0x10, 0x10e, 0x0, ""}], 0x10, 0x0}, 0x0) 2018/02/01 04:11:18 executing program 1: openat$ion(0xffffffffffffff9c, &(0x7f0000801000-0x9)='/dev/ion\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000233000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) write$tun(0xffffffffffffffff, &(0x7f0000577000)=@pi={0x0, 0x0, @eth={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x0}, [], {@canfd={0xd, {{0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0, "feb442a1f43ead325d71fed774c8f6028c2a6b79a4e418aa3c5f391769659fef9f596cdade428c389e511eaad39d2ee4334dee9516a31d00510baaf06efc0980"}}}}}, 0x5a) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004ee000-0x76)='\x00', 0x1, 0x0, 0x0}], &(0x7f000000b000-0x30)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)=""}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00005da000)={0x0, 0x0, &(0x7f00000d8000)=[], 0x48, 0x0, &(0x7f000044c000-0x83)="a410778b7a640ab0384c4ead541b6ee57c5645909ef688d8ac3e5ecfc7039f5f8ba53f127b7f01947cd3689eaf6c090277915bab2a0c450988cb85688e2bcc101a80664d3081fcc0"}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000c5a000)={0x0, 0x0, 0x0, 0x0}) mmap(&(0x7f0000000000/0x13000)=nil, 0x13000, 0x0, 0x32, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000a95000-0x30)={0x14, 0x0, &(0x7f0000b8f000)=[@increfs_done={0x40106308, r3, 0x1}], 0x0, 0x0, &(0x7f00002e4000-0x70)=""}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000436000-0x30)={0x20, 0x0, &(0x7f0000136000)=[@dead_binder_done={0x40086310, 0x3}, @increfs_done={0x40106308, r3, 0x0}], 0x0, 0x0, &(0x7f0000888000-0xb)=""}) 2018/02/01 04:11:18 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000)=0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = epoll_create1(0x0) r1 = perf_event_open(&(0x7f0000223000)={0x2, 0x78, 0xe3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000)=0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0x0, 0xffffffffffffffff, 0x0) epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r1, &(0x7f0000756000)={0x0, 0x0}) epoll_ctl$EPOLL_CTL_MOD(r0, 0x3, r1, &(0x7f00000ad000)={0x0, 0x0}) seccomp(0x1, 0x0, &(0x7f000089b000-0x10)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x407ffc0003}]}) shmctl$IPC_INFO(0x0, 0x3, &(0x7f0000564000)=""/4096) 2018/02/01 04:11:18 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) seccomp(0x1, 0x0, &(0x7f000089b000-0x10)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x407ffc0003}]}) r0 = shmget$private(0x0, 0x1000, 0x78000408, &(0x7f00005c3000/0x1000)=nil) shmctl$IPC_RMID(r0, 0x0) r1 = syz_open_dev$midi(&(0x7f0000730000-0xb)='/dev/midi#\x00', 0x0, 0x100) sendmsg$nfc_llcp(r1, &(0x7f00008f9000-0x38)={&(0x7f0000a85000)={0x27, 0x2, 0x28, 0x6, 0x7fffffff, 0xffff, "ceebccf32840f42ee91941a034738b2c7527e95c32f051777a03c7317816df72d70bdcafa033a15c6cba94197731e92abac7926339658b3ca7039c67170b2f", 0x7ff}, 0x60, &(0x7f0000481000-0x20)=[{&(0x7f00008c0000-0x32)="eeda9527cc39e41df5f96414af1eb210bb7857a62e121c81ba5c732d0075748eb66449dc74c1b79de4d9e2bf607b1b2bb904", 0x32}, {&(0x7f0000110000-0x87)="8372d984730ecd190311c935e9e42050b273eebd18450be806a5ff479360e870b63c45cf42bd52ff00c1a7b4c41f34539666a4ac6b23f52fcc776483cab58c4cf95a3dfe303e06abd253f30adeae5e67e84be60fbc1c4691ce22cb708d1c517d7477a3c0805d600a9db90f337ba1e62a83c0a5b032685843455b60d3bce7978a9b0f15fd211815", 0x87}], 0x2, &(0x7f00008ab000)={0x48, 0x10f, 0x1, "422cb62d3cfff9236edb784ee99d68f40714e71cb39e63bbc18d5ee87ec4eec1a3b3af64be161161b7be1544fbdd6314c707c78e"}, 0x48, 0x8840}, 0x4000000) shmctl$IPC_INFO(0x0, 0x3, &(0x7f0000564000)=""/4096) 2018/02/01 04:11:18 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x2, 0x0) bind$inet(r0, &(0x7f0000eed000)={0x2, 0x1, @empty=0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x10) munlockall() r1 = socket$inet(0x2, 0x2, 0x0) sendto$inet(r1, &(0x7f0000e87000)="", 0xffba, 0x0, &(0x7f0000eea000-0x10)={0x2, 0x1, @empty=0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x10) syz_emit_ethernet(0x2a, &(0x7f000070b000-0x10f)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @empty=[0x0, 0x0, 0x14, 0x0, 0x0, 0x0], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0xffffffffffffffff, 0x0, 0x0, 0x11, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @broadcast=0xffffffff, {[]}}, @udp={0xffffffffffffffff, 0x1, 0x8, 0x0, ""}}}}}, 0x0) 2018/02/01 04:11:18 executing program 4: mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000d28000/0x2000)=nil, 0x2000, 0x65) socketpair$inet_udp(0x2, 0x2, 0x0, &(0x7f0000000000)={0x0, 0x0}) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) getsockopt$inet_opts(r0, 0x0, 0x4, &(0x7f000005a000-0xd8)=""/216, &(0x7f0000913000-0x4)=0xd8) sendmsg$nl_xfrm(r1, &(0x7f0000a8d000)={&(0x7f0000e4e000)={0x10, 0x0, 0x0, 0x0}, 0xc, &(0x7f0000fcf000-0x10)={&(0x7f00005d5000)=@updsa={0x104, 0x1a, 0x1, 0xffffffffffffffff, 0xffffffffffffffff, {{@in6=@local={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0xffffffffffffffff, 0xaa}, @in=@dev={0xac, 0x14, 0xffffffffffffffff, 0x0}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0}, {@in=@broadcast=0xffffffff, 0xffffffffffffffff, 0x2b}, @in=@multicast2=0xe0000002, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, {0x0, 0x0, 0x0, 0x0}, {0x0, 0x0, 0x0}, 0xffffffffffffffff, 0xffffffffffffffff, 0xa, 0x2, 0x0, 0x0}, [@coaddr={0x14, 0xe, @in=@remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}}]}, 0x104}, 0x1, 0x0, 0x0, 0x0}, 0x0) 2018/02/01 04:11:18 executing program 5: openat$ion(0xffffffffffffff9c, &(0x7f0000801000-0x9)='/dev/ion\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000233000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) write$tun(0xffffffffffffffff, &(0x7f0000577000)=@pi={0x0, 0x0, @eth={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x0}, [], {@canfd={0xd, {{0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0, "feb442a1f43ead325d71fed774c8f6028c2a6b79a4e418aa3c5f391769659fef9f596cdade428c389e511eaad39d2ee4334dee9516a31d00510baaf06efc0980"}}}}}, 0x5a) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004ee000-0x76)='\x00', 0x1, 0x0, 0x0}], &(0x7f000000b000-0x30)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)=""}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00005da000)={0x0, 0x0, &(0x7f00000d8000)=[], 0x48, 0x0, &(0x7f000044c000-0x83)="a410778b7a640ab0384c4ead541b6ee57c5645909ef688d8ac3e5ecfc7039f5f8ba53f127b7f01947cd3689eaf6c090277915bab2a0c450988cb85688e2bcc101a80664d3081fcc0"}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000c5a000)={0x0, 0x0, 0x0, 0x0}) mmap(&(0x7f0000000000/0x13000)=nil, 0x13000, 0x0, 0x32, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000a95000-0x30)={0x14, 0x0, &(0x7f0000b8f000)=[@increfs_done={0x40106308, 0x0, 0x1}], 0x0, 0x0, &(0x7f00002e4000-0x70)=""}) 2018/02/01 04:11:18 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000563000-0xd)='/selinux/mls\x00', 0x0, 0x0) write$fuse(r1, &(0x7f00004e2000-0x12)={0x12, 0x0, 0xa, @fuse_notify_poll_wakeup_out={0x8}}, 0x12) sendmsg$nl_xfrm(r0, &(0x7f0000a8d000)={&(0x7f0000e4e000)={0x10, 0x0, 0x0, 0x0}, 0xc, &(0x7f0000fcf000-0x10)={&(0x7f00005d5000)=@getspdinfo={0x104, 0x25, 0x1, 0x1, 0x0, 0x8001, [@coaddr={0x14, 0xe, @in=@loopback=0x7f000001}, @lastused={0x10, 0xf, 0x0}, @sec_ctx={0xcc, 0x8, {0xc6, 0x8, 0x1, 0x100000000, 0xbe, "aee9b55a4662fd7480bf2a71163ff2fe7f8eb280f1291636aa6f7461eb1677991a54cbe15e6adeb4b707084c508d7452aad9c56a5d114e9052e293a797132d241708a8c2044a64feaa8c8b371d40e3f07a5d2e86511eb459e5f04827bcdda214ebb1e79a7a864be0e7c6121bb621cf64a909755c17faa00472c6492bfecbe9f91ab3d8dba5405359de615148bf0f9ab2f7d654f40628354db4ba94c75254adf63795561bbfcf5a2466f81cf2d1fd4373fb46697800cdbe8cdaf842e6a7cb"}}]}, 0x104}, 0x1, 0x0, 0x0, 0x0}, 0x0) [ 298.778470] binder: 14823:14826 BC_INCREFS_DONE u0000000000000000 no match [ 298.819944] binder: send failed reply for transaction 1266 to 14808:14818 [ 298.826216] binder: undelivered TRANSACTION_COMPLETE [ 298.826225] binder: undelivered TRANSACTION_ERROR: 29189 [ 298.826504] binder: 14829:14831 transaction failed 29189/-22, size 40-8 line 2788 [ 298.833447] binder: undelivered TRANSACTION_ERROR: 29189 [ 298.914196] binder: undelivered TRANSACTION_COMPLETE [ 298.919363] binder: undelivered TRANSACTION_ERROR: 29189 2018/02/01 04:11:18 executing program 5: openat$ion(0xffffffffffffff9c, &(0x7f0000801000-0x9)='/dev/ion\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000233000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) write$tun(0xffffffffffffffff, &(0x7f0000577000)=@pi={0x0, 0x0, @eth={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x0}, [], {@canfd={0xd, {{0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0, "feb442a1f43ead325d71fed774c8f6028c2a6b79a4e418aa3c5f391769659fef9f596cdade428c389e511eaad39d2ee4334dee9516a31d00510baaf06efc0980"}}}}}, 0x5a) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004ee000-0x76)='\x00', 0x1, 0x0, 0x0}], &(0x7f000000b000-0x30)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)=""}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00005da000)={0x0, 0x0, &(0x7f00000d8000)=[], 0x48, 0x0, &(0x7f000044c000-0x83)="a410778b7a640ab0384c4ead541b6ee57c5645909ef688d8ac3e5ecfc7039f5f8ba53f127b7f01947cd3689eaf6c090277915bab2a0c450988cb85688e2bcc101a80664d3081fcc0"}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000c5a000)={0x0, 0x0, 0x0, 0x0}) mmap(&(0x7f0000000000/0x13000)=nil, 0x13000, 0x0, 0x32, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000a95000-0x30)={0x14, 0x0, &(0x7f0000b8f000)=[@increfs_done={0x40106308, 0x0, 0x1}], 0x0, 0x0, &(0x7f00002e4000-0x70)=""}) 2018/02/01 04:11:18 executing program 4 (fault-call:2 fault-nth:0): mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) seccomp(0x1, 0x0, &(0x7f000089b000-0x10)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x407ffc0003}]}) shmctl$IPC_INFO(0x0, 0x3, &(0x7f0000564000)=""/4096) 2018/02/01 04:11:18 executing program 7: mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = add_key$user(&(0x7f0000001000-0x5)='user\x00', &(0x7f000074f000)={0x73, 0x79, 0x7a, 0x2, 0x0}, &(0x7f0000001000-0xda)="6cd4930474a1d89bf2e4022fd8f99b908c083418e4e0f219d47324610b0d0f3ce22a1004c9c2716ddae5723f43203bf37316360c4e721c3b2010197b74512877b85d29473606a9c0bb7528e32ad8e5f026fd6fbd9f704707c59cf1ec55d945fa5252c9a627827a066a889e7c64cc8c80ae52f512e2ce3230806aca3d3f1bc391d75fab224f447dc3ae430e303166124d0e5a1fa15b0a950e228b8bbd651e755b56a977ce132b320094faf0ceb561b1c0ffc0617559e501d95df4d30d50bddb0dfc09d5a52491a6244677bf249216ff5234e87024d2a38f0d6804", 0xda, 0xfffffffffffffff8) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r1 = request_key(&(0x7f00009b4000)='.request_key_auth\x00', &(0x7f0000a3f000)={0x73, 0x79, 0x7a, 0x3, 0x0}, &(0x7f0000001000-0x6)='proc%\x00', 0xfffffffffffffffc) keyctl$search(0xa, r0, &(0x7f0000000000)='trusted\x00', &(0x7f0000000000)={0x73, 0x79, 0x7a, 0x2, 0x0}, r1) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) seccomp(0x1, 0x0, &(0x7f000089b000-0x10)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x407ffc0003}]}) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000824000-0x10)='/selinux/status\x00', 0x0, 0x0) r4 = openat(0xffffffffffffffff, &(0x7f0000d43000)='./file0\x00', 0xa0042, 0x106) r5 = syz_open_pts(0xffffffffffffffff, 0x1) r6 = openat$ppp(0xffffffffffffff9c, &(0x7f00001aa000-0x9)='/dev/ppp\x00', 0x500, 0x0) r7 = socket$can_bcm(0x1d, 0x2, 0x2) r8 = socket$inet_udp(0x2, 0x2, 0x0) poll(&(0x7f00004a9000)=[{r2, 0x8, 0x0}, {r3, 0x4000, 0x0}, {r4, 0x1000, 0x0}, {r5, 0x1, 0x0}, {r6, 0x2022, 0x0}, {r7, 0x4000, 0x0}, {r8, 0x200, 0x0}], 0x7, 0xffff) shmctl$IPC_INFO(0x0, 0x3, &(0x7f0000564000)=""/4096) r9 = syz_open_dev$sndmidi(&(0x7f00001e3000)='/dev/snd/midiC#D#\x00', 0x3, 0x101040) getsockopt$netrom_NETROM_T1(r9, 0x103, 0x1, &(0x7f0000bff000)=0x0, &(0x7f0000842000)=0x4) r10 = syz_open_dev$mouse(&(0x7f000076c000-0x12)='/dev/input/mouse#\x00', 0x1, 0x800) ioctl$sock_bt_bnep_BNEPCONNDEL(r10, 0x400442c9, &(0x7f0000aee000)={0x1f, "3d4fe7964178"}) [ 298.951193] binder: send failed reply for transaction 1274 to 14840:14848 [ 298.968226] binder: 14840:14848 BC_DEAD_BINDER_DONE 0000000000000003 not found [ 298.969176] binder: 14847:14851 BC_INCREFS_DONE u0000000000000000 no match [ 298.982842] binder: 14840:14848 BC_INCREFS_DONE u00000000204edf8a node 1275 cookie mismatch 0000000000000000 != 0000000000000001 2018/02/01 04:11:18 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = memfd_create(&(0x7f0000290000-0x5)='ppp1\x00', 0x8003) sync_file_range(r0, 0x8, 0x9f8, 0x4) getsockopt$inet_tcp_int(r0, 0x6, 0xc, &(0x7f0000268000-0x4)=0x0, &(0x7f0000180000)=0x4) tee(r0, r0, 0x900000, 0x2) munmap(&(0x7f0000176000/0x3000)=nil, 0x3000) socket$inet6_sctp(0xa, 0x1, 0x84) syz_open_pts(r0, 0x20000) 2018/02/01 04:11:18 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f0000590000-0x8)='./file0\x00', 0x14) write$selinux_create(r0, &(0x7f000074c000)=@access={'system_u:object_r:dpkg_exec_t:s0', 0x20, '/usr/sbin/cups-browsed', 0x20, 0x32, 0x30, 0x0}, 0x3b) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f00007cf000)='/dev/cuse\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_STATUS(r1, 0xc05c5340, &(0x7f0000b85000)={0x6, 0x100, 0x2, {0x0, 0x0}, 0x0, 0x4, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000801000-0x9)='/dev/ion\x00', 0x0, 0x0) r3 = syz_open_dev$binder(&(0x7f0000233000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r4 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0) r5 = dup2(r3, r4) write$tun(0xffffffffffffffff, &(0x7f0000577000)=@pi={0x0, 0x0, @eth={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x0}, [], {@canfd={0xd, {{0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0, "feb442a1f43ead325d71fed774c8f6028c2a6b79a4e418aa3c5f391769659fef9f596cdade428c389e511eaad39d2ee4334dee9516a31d00510baaf06efc0980"}}}}}, 0x5a) r6 = dup2(r4, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, &(0x7f000026c000)=[], &(0x7f000000b000-0x30)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)=""}) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f00005da000)={0x0, 0x0, &(0x7f00000d8000)=[], 0x48, 0x0, &(0x7f000044c000-0x83)="a410778b7a640ab0384c4ead541b6ee57c5645909ef688d8ac3e5ecfc7039f5f8ba53f127b7f01947cd3689eaf6c090277915bab2a0c450988cb85688e2bcc101a80664d3081fcc0"}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000c5a000)={0x0, 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000a95000-0x30)={0x14, 0x0, &(0x7f0000b8f000)=[@increfs_done={0x40106308, r7, 0x1}], 0x0, 0x0, &(0x7f00002e4000-0x70)=""}) getsockopt$inet6_dccp_buf(r5, 0x21, 0xcf, &(0x7f0000e10000-0xcc)=""/204, &(0x7f000037d000-0x4)=0xcc) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000436000-0x30)={0x20, 0x0, &(0x7f0000136000)=[@dead_binder_done={0x40086310, 0x3}, @increfs_done={0x40106308, r7, 0x0}], 0x0, 0x0, &(0x7f0000888000-0xb)=""}) close(r2) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000002000-0x38)={0x0, 0x0, &(0x7f0000003000)=[], 0x0, &(0x7f0000002000)=[{0x10, 0x10e, 0x0, ""}], 0x10, 0x0}, 0x0) 2018/02/01 04:11:18 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000657000-0x9)='/dev/kvm\x00', 0x0, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000bbc000)='/dev/input/event#\x00', 0xfffffffffffffff8, 0x400000) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) io_setup(0x81, &(0x7f0000e3c000)=0x0) r4 = open(&(0x7f0000973000)='./file0\x00', 0x800, 0x2) r5 = syz_open_dev$mice(&(0x7f0000d6c000-0x10)='/dev/input/mice\x00', 0x0, 0x100) r6 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000138000-0x10)='/selinux/status\x00', 0x0, 0x0) r7 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f00008df000)='/dev/vga_arbiter\x00', 0x0, 0x0) r8 = openat$ppp(0xffffffffffffff9c, &(0x7f0000734000)='/dev/ppp\x00', 0x200000, 0x0) r9 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f000088b000)='/selinux/commit_pending_bools\x00', 0x1, 0x0) r10 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f000030a000-0x11)='/dev/qat_adf_ctl\x00', 0x5c3402, 0x0) r11 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000c3e000)='/dev/vga_arbiter\x00', 0x8800, 0x0) io_submit(r3, 0x9, &(0x7f00008ae000)=[&(0x7f0000e9a000-0x40)={0x0, 0x0, 0x0, 0x7, 0x3, r1, &(0x7f000015b000-0xa8)="9e3ba90a95bcb7558880f1b59fb529eed714594440feda98ca1e0e81c0029a9cfcbe544741ea4e4ec8ad0bb81403ec94a08b68588198e7384bcd862998d7de29c3effc1a3b6a438cf249f524aa0e33ca84ae513cfdc42ea436d139568085e340c5f364484ce01f623ac81c36b14a87e5e23bded6e3e0f7072da8b8fd7ac3b25786f43c0143a228cf7afcad20bf185e0503ec365836b16520d6dcbc222f6e85ae664f30ac5db3be37", 0xa8, 0xff, 0x0, 0x0, r4}, &(0x7f0000860000-0x40)={0x0, 0x0, 0x0, 0x0, 0x10, r2, &(0x7f0000024000)="52a5f4f2d1f3672932231846fa0a034fe9ab705549d7811c4e28329ada0e6ff81e5f9eb3b14b26338633588b18e743573a5abf7ecb21d9a2940ae36fbf611db2110b2661ce2cb16be72774c0b82ef6a3f5818830061dcf8d27d41ed8ec58d07a319f66e497f08678edf8493f9bdd294836d5ab2b64fdb71328eb762d5351d9f4d180ed1a62f0cf6999e58b7a95e1364eb54994c08902d35abef60c18e91e1875a7478ea06f18098a5afc4cd36f0c58b133cdd5b3d14984883b5604a971fce1a82280d5e0fd680a2363b0d60dd9a1d0268ccff453e44b", 0xd6, 0x1, 0x0, 0x1, r5}, &(0x7f00004c7000-0x40)={0x0, 0x0, 0x0, 0x0, 0x230ad91a, r2, &(0x7f0000858000-0x5d)="8709b218ee4a1e040ea7abd1db0916684d37d76728677d830eb1b8227da73ad5560cf41fcc7592021b6b5459657d2e784891c8783c00093486688abb0333f601284ce0ebe58da7d61dda242cd6381509659a3a6aca629328aa4cd4e3dd", 0x5d, 0x8001, 0x0, 0x0, r6}, &(0x7f0000967000-0x40)={0x0, 0x0, 0x0, 0x7, 0xf0, r0, &(0x7f00006b6000-0x57)="0273a730ce4432afa98917a239e951455314d043bea80cbeb924a1321b613be81a08c899a27192481a5a99a530905c91c4b0eb84eeccc7484d9e96a7efdcec0584323966ce5208e7a7472f21550acd95e8b82c981c5363", 0x57, 0x12d, 0x0, 0x1, r7}, &(0x7f000003b000-0x40)={0x0, 0x0, 0x0, 0x6, 0x3ff, r0, &(0x7f0000982000)="42584715abea969f00a45716d9dfe4092f395d454cc73b06d6976c14f06145ec125b53f530546d86a1058a86c8e409e72d0f0f175086914cd1544477f42cca20c80909708ecd5d83115c9d2cf935805433d67ffbcfb03f18a4f492c07ef8c091ef63ee456e200fa2c0830e626f1dda4c5d4008af11277eaded34583cba029944", 0x80, 0x1400000000, 0x0, 0x1, r8}, &(0x7f0000b40000-0x40)={0x0, 0x0, 0x0, 0xf, 0xffffffffffffffe0, r1, &(0x7f00004a6000)="acda42f59c9f778a7970c906687401a3ffb3dd827d887e7ed79e9e8d1eea8c865613607c7b069b6ad3bf4ca77dd5d788ad4a03e19a1840c66e90005bb53e52bb9b03b6d0949a54bd9c8cb81dfa96afd9216aed469dc7ab4dcae524d426a48349ac42b605bf1f844cfb0966f856aac90452c49e35ed586c8e40be467e43785e7d86fd0e4b95c07c0affdd4a558a9718c96874db6bd663ec22c508d33731574048f6f5c500956b4fe41bb3278e082d8bf0ef7cb4aba610fe15d85e3ec068ab800de75d0facf50a77ec2a200d425f68558ffd0c0c55c4513261e7d8d1592b8bc9607de2594c1c1223549e754719fcffd2fa4476ac4a3532ec550ea06d6a3fba", 0xfe, 0x2, 0x0, 0x1, r9}, &(0x7f00003d8000)={0x0, 0x0, 0x0, 0xf, 0x8, r0, &(0x7f0000c82000-0x2e)="4a2f62d219a01c39b6cb0fa866b0456f79fa40931d3b33be7057cb21c50ba0c24188634b036e2a42449988913c4f", 0x2e, 0x7fffffff, 0x0, 0x1, r1}, &(0x7f00009d1000-0x40)={0x0, 0x0, 0x0, 0x8, 0x3fffffffc0, r0, &(0x7f0000440000-0x1000)="932fb9e8a23c4d76d80b2fad20acbeaa3a88ec3bda78fa4055d3e1a1390246fda10253464a2b7e46032bde95f66957ab452ec925e261eb4e79532bf6524c17bb015f5bc5709a145ddcd57a6dff15367bd25bf6124e1d5277b9dc2149de61993c455e2b08a1db629c1a96bd01f3b6e9480b59d4f2a81d99f8cf833a5d1ba1ddf6b1e5169f8fd1598429c57b2d7b89ef536bf8debb18ba2c0d767d5a76198291505f929fed5beefaa022bcc6a125cc5e8b4fc272d9ab2f62864c9addf5477e2b95379e71932f28704085f614b5127715bf159a7694531788729f6f1bca58e7a3e6b4bbb4638ff9b050d7fc3109accf1e0c4cc19ff62599f719d992b3fd8c4fa5231e1fbc56aa94f89edcac61be4189c35cc901c0ba43577a9f31740ee57db4461368d614a558d40ea919773ecee7d7caf24a6ce8771a71d00290af6d959bb588dcf840382f1e380bb553cb17ca2c40a4834a411da143b31372db62d289b995d5b385d1384068d9b46a402150fcb5b5c4855f0b67fe40d232a3e5108c83028822392c270cfc81b14a25e8bf00ef08c2b1db0b8a435560f77dd99210238bd9709366409519ecfd7822829c738a67cbddd4c3b2466b71478679c400a09e20ed41de82e0ee37b9f3a82e358091108a407cb018eb463edffe6ee215ac10b11a970374f0c38355f0b8b17cde4e689b69036c8c33ec5df47c2f0a095521bf2e9590b76348c4b4ea83e8c788256308f486172c6bdfdae92e64bc5bd96717d6ecf4dc7cbd81cd20cde2804ef83de0b9d75ae9ecde8957025fa6e1a7080a2745a08f6475a5b3f3a2046284a6c40ca22dc04134236ad4d903434f52e58d09cc0f2b0675494337b3032abfdd9029eb7d0a10f235783f0f3c720d12b962190a3d22c38afffbb26687b251b12abe1935cfc3a683ec59346767f54cef5e6c00c47814b5523b207eb23a664fb3f0745559ae0d7d22a110ec66c136a868094fefdb5ebdbd69c8651a1922dd4e0c4caa23945abea192d6d789eadbb4e1e0d78da0fdb9bbee2b2b1d7361fd02e6cdb057f30bdb283e2da48756dfe9a23f6eaae5bff35ba9dfb4ec95bdebc58b4a4f6a2aab2b12e8605361ee43b30b378d95b34b4dd5bf41fe3b0443c2a27d4c7d5d8c2d9b5f5e2c8cfe6cf13cd21c43b521f908c197adfc842f428cd293440b65efa092f8e006594f4d5e8282f175929829fc7bbf9e9e562b4c90da4788f39559ede44b8369b62ecd6d9038a60c3973bd6d1758305b608cf08ea77c8ba8e6511766e7c70c33827bf0ab61c9eefcd2702a6b23fac1a9e53c59413975362da7a0256a276a2253908fdee193e0a4c8f45808926703e631bc819637b776c47138fa771041beba30fdafba721e8dea792489dc8fdf7e4d08a4e642a31bf810b611e8b1639221b289bcb9aaf6edddf87eeb415746c52d31851bfeb4179e38ed9775038e3ce6cc675c67e610aa92c0596f3230fc91d6e4eeabccb1084e95407023a242f1813de181ce66d0cb3fb8b45bade9bb2c7ccc6f42487010472302e1e2ff5671336dd376e610004866889ccebfbff0388895f9a9e819a034eedf04c2cb46a55f1681f084a123a793dc4379fcb9227222fa1548beb39b40a223aaea4eba732d07553dbc0f96111537e6d97a8505e2aa46f7f80df0d23479220b5521067de19ed6d2ae12e80763d7a57e8d65a34a0f30eaf07750b574ee63bc96532bd61857cb1e18e62391ee643bcc74ccaff68600e4460d30725bc8f852c039b96ed1f3722b763b074df8b41ccc4b6a2ffd4f5f78ac5ed70fcf92e62a9d720ce6166c9033e53af447ba1b86df93992055288a9fafcd1d6b978cd5a8c51a244fd90facd97b4d813d493bf978496a6d44de251f2a4cd88423c80ededf3a8955fcf65c2b1659afcf89dcd3bf7b1e70ae3debaa59c0cca195e0dd53926942b9dffc521d5aba854b3b88f2c0a4d5fa0201884fce4876d67e33f4c9cd3d596164a6cee0863c9f376eef808743e41e11c7cca1909c2621d6b6e2284f457da7430d996728654d194aee1035978a06d1d88dc8706ad7a3f7f27437ffcf2ad287a5b902f20f67ad2b3ea589d8d4c3d31f2a1d3129278cd1e352cb888c2f3f54ed4ef12b5a1b493b9f6d51fbacf4f87f8e4a74436b9a835dcdc5e255e15f020ea29959258ca3a4337c0618d1c9ff79f2e676ba7b549fc7bb34858cedcd5c4aa14c426129d1d7ccecfcd7aa442dad554706a674d4976e66fa25fe0529101dc789021d30ac115fd635d63c358ae7b5eac0679cf3344cead455aa019a07154f0a0445971c24c6dc2498f035cf2fd2c6aabaeed028ca8a8e1277c9edb547cd5fd6af50a1ac0a4f1e8f3f6c18196fb432aa4e0bc0312fe58794e2e988f39a6b4cf7862c8e220ff0a3717f257848ea50fbc52c8da88c732204f7240c0a8376a52e41731f710d7ba8742da2ea9d518ab9f053ccf52e3896466c0b21cf9d609f9f2192766e5fcc40db13764744115920c6483fd5650286d705d4a14f1d49b349f3b9e5cab4086d80988ca1003f6c9cb504f4470972793fd7b3f246ef43adf1084919b4ede1493251cf7f76df12ffa3a4d3f1ee3906880fd5f680ce52ede01db774a0081e3f5866ae8e063f596d507541315e157ca5ce689adc0fae35ae829a0c99b747d0eb040fff1a625664888f3c8f4ed06a91e4d8313c7aef66c348be523bc75f9c538008f578a39a3becf2176ff39109584ef8bb0ff0e8743dba8c459c3c37c3108a8995152e2642b2ab3b99577c773f0c72a49c3d5ffb9afd314bc70e28c8a38e2e6e468888c53f5eb2a957450b6866d3166d217296cb77bda37968d04653862dad2d5ad40776cca8aa583e8de127e306b188362c6dd07739981dfaf482700cc5e619729ced006a22ba990c59e8e07ec0b6a341d1ddeb6f3099f2b3a49c842ec6ceae2c7c32e61a9f712de837cadd0cecd317fe7a5b785b505a32dd8830d41245db88f7b46af040bb6dc03edbcaac6d1f9769b49bd24911640d1f4fa657a0336db815fff4f53d80432b3cc654640c13a92e46a57f639fe11d8aea157d0aeb9971b7d44602021446db639af20280e91ca6a2f9f5dd8ce7099460ebf8417f1058925b6b2968214fbfaa13f6c1cf83f1228478277dc96118fa975dadd5a06ccc8244520ac1c1033c1f33ed671bf6e0ef725e7dfe97111217d8b7279f5f9f136a3f1523b71a2cc1b45bb629bb92d88579fed5396e5f8aba8e0bae92324bd9f92d1e69323faa461d1141f65f1066e5447e3538528fa5e6bef1f78f2ec41c82ff1722f1e028b1bd795218121a36443e5d8cd8fabcfde7c2c29ff13c6f0f8e88d6ec70835b33e43e556eefa2946b8bfe4f7814e8aade0ecfb93e918fd9b67388cf849137d49fd734335fea11a37abb05aa4be83cdf3255d6a7e7837086d92dcf9e7dc0018a7778f64fe315c1308a8db951fcdad2783fe41bf983e299c944b8a97720f13be6fb60a46b93276201b1603a72de26d43829d4c34430fef4589691cd693a39f26f7c367de3c46e5f20edea65ef3c3714292a3bfe3cf2a2e27babba56bd408bc6df85f310b4ac53c5a93e0e53301cc38d0edec60b1436f215436e58ce0f4889895fce848db0fc41b6ea2c89c851393a910dcf7d0a41b70e7342261e8eade80c64a799172eacfe4faa39860a28eb65ea385f019a4789f10fbc8b83078b92e4b9862816d1ef388f489c94ae9d6fafb9f2210c9260520fcda887c08f5f0e6e5b3dfb011d7bfccf23614c29e5105c684e4448da1570b51fa38f8304571f588ad912b7eb0baf88bcc287f59d6f10f8adaa6a941888f2d46faa3370f30e12bd8e6441b55b6ff34e0b393e505a08208355e44088a49a9632ed7df735825157b7daa54bdeea371dc901c4732a311feaf5da7ce4673814fc9a1cc5e2f849356af45188aeeee86f2d3d1283ce067d6dae3a3fdae62ebfd56380f8bd41b3b0a27f8e6489af1ef93746e85bd3e1050c043edcc031cc02b0dc97e6a5ab949e63c0ccf694d37e8c9bce91804660eafcda5d1dff7e204789623faa294585b5774999251d922a7a0def7a2e5cfbe4a839771d5b8c0490b9f3f487a08b7d443edbcee087979dcd232461b7d87d6350c407972674a48ca494908aa6043aeec7b38f1046680f738b4024708bd3ea0838b5aaba48957ce463d3ceb4d3cd7128aefef7052bf7e6e41d2ec5c8fdc748425e4dc8db7f0d6136a24cec946a3ead8d9dc91807cd90ef07e71c14287bceca91d78e9bb03d570202c3e22b11400ec5b18534fa035fef88739a7e6edfb10b4b7e32861382d7efbbf02b5b262dcd8a26c0f51d984a3616265a3115cc292079ce142020436510dcf26c8a5ee748cdfb8a1859c83a9c9ed2a716f9243c7ee7597bab130bb48b4d25bb32cbe7a7b7d6cdcd73e94366a894b4db3f0ae6270f56505fd6994a5fb658ed563a56b889ebb6854293edf9eba8d0ec6bd58e1a18c179145188befa280758a8d8d0d75e31f3dec2193572c4062db6b5218c99083b2aa1d4b0393e71ec161a6f53745ec3a0260bd25cdb17f4402dc1d327619ee9fbe586c20601704a92a5a39ba6a0d63e3b57284fd716ebe50e583a8d7cbd739d4d0a0f670ed1eee9f2fd172af93e4b2ff62a9831ed6d215b93f2cf96e1db147acd36c0c9cb87397bd26913579c33dd2f97f7d2857af6b2a2792195957d1f32e1b695211b965fff4577a06ab96c0a9bbaba66c052664c0c55a294bdc7b797b869491f6597fc4f8b84f9598693ac24fb615c507b8275418e0c54eaf6427644e1b9d017e414df5042efc1d356cef4b52638a6fc72d7491c184cfa0236e651dfe974b1c1329ee01674f306efe6acac9da290cbf5595fb9fc1c5d5ee8d34e3cac4e64fa00845f087a206f9e644bb63441d4226b7bd5cb1a36efb6bb863b38027def6bb31a5468ce4084516c5e894ed7b81b91de8286123f4a3f4b19722c3a3874c3fba0f230a6b328daf27d35cddf1a20510427f40e4955d6847efa3965279d847f70a082fd82392622cb16db874c7a44aee32fa00431f179853080fe60fa3bb962a3f894bf1ac8d8447a7df82ef7cb206c1e7521d4cfa83428174d44305ac15326afe236358ae43edaa705e0ecbfca7a79e37a892d2b498184868758490f0647a26a410e5bc700a8c7a18f2cdab233a19f07e79da20ad4d46ddb3af8ea7c2925cbf362c67641eb693c5bb20adf2853db3dd1bd7fbcbcb73adfae8fa4c28dc3a6c1de0eb34ed50acd07d1e9ac0d8f810894f51bd0cd52d3f2be8617331826f63e28fb32c1cc34a2b3804e6d13739173583579576aa097fbbc3a6ff93c4af42466d334535797d79afe456752711b050a10d3f4ee7eb44adb26ece12034eaee6bb3288d2ec9c8bf839448719415a8b99cfc471f96ac555a5e511a63f8d8afafad182daac8b5630b3361c417d52399079b12f89dfb20e39630b3be52d3b886aab43fbdb9288588e3a0961e1b15646f29990c831dda7a6723f8059a6d99d576cd9adff5471a3a52f8b282fc56ef9bb0e543e47739611393d5bdb24a41c325c257d26583569d09b8396ad31ae47ba5b25787c4df865a2219dc8df8bfdff06fd296c00b4586f12317b80c43bed90816386fb2be081d2f8a35c41699da5cbbdfef84d362c2640dffe4aca316e280596e010cdc1c76cef8a5991551ba007a51a3fac4715dcde73a8a0981ae6fb0415fdfe8f791c7f69e29adb751d4b65ba45026c057b15874cdf473ddbdc4fc958a456bea1f3040d694080495e3f5724b04f8cf4eaa368c67fa3aea14249be2a286c1822787", 0x1000, 0x100000000, 0x0, 0x1, r10}, &(0x7f000098b000-0x40)={0x0, 0x0, 0x0, 0x7, 0x0, r0, &(0x7f00009ef000-0xb0)="492121f01249c224e81f6c447237b27d554f96eb9fa6876fcd212e5bae022dc83af21c8e783e84f87772d8616d93eb6729acff73abae74c2bc8fadfd1b689fc5bfdc2e9d113aeec0101f4e603a90c9463251263eb654284a2c8a51366cde3a698995912226736aaa02af0ab98110f11c7844ea2b32a810d9956ee6857f8d16b28530cc4da0af2e8a67f747c0bb8d1d40e5226dab9e52a505517882c11edc8745505db54260454e8f9ec1c5b1af8382ad", 0xb0, 0xdd72, 0x0, 0x1, r11}]) r12 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r12, 0xc008ae88, &(0x7f0000b8a000-0x18)={0x1, 0x0, [{0x48e, 0x0, 0x0}]}) socketpair(0x19, 0x80004, 0x8, &(0x7f0000c70000-0x8)={0x0, 0x0}) getsockopt$bt_BT_SNDMTU(r13, 0x112, 0xc, &(0x7f0000365000)=0x3, &(0x7f00009e6000-0x8)=0x2) 2018/02/01 04:11:18 executing program 5: openat$ion(0xffffffffffffff9c, &(0x7f0000801000-0x9)='/dev/ion\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000233000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) write$tun(0xffffffffffffffff, &(0x7f0000577000)=@pi={0x0, 0x0, @eth={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x0}, [], {@canfd={0xd, {{0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0, "feb442a1f43ead325d71fed774c8f6028c2a6b79a4e418aa3c5f391769659fef9f596cdade428c389e511eaad39d2ee4334dee9516a31d00510baaf06efc0980"}}}}}, 0x5a) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004ee000-0x76)='\x00', 0x1, 0x0, 0x0}], &(0x7f000000b000-0x30)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)=""}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00005da000)={0x0, 0x0, &(0x7f00000d8000)=[], 0x48, 0x0, &(0x7f000044c000-0x83)="a410778b7a640ab0384c4ead541b6ee57c5645909ef688d8ac3e5ecfc7039f5f8ba53f127b7f01947cd3689eaf6c090277915bab2a0c450988cb85688e2bcc101a80664d3081fcc0"}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000c5a000)={0x0, 0x0, 0x0, 0x0}) mmap(&(0x7f0000000000/0x13000)=nil, 0x13000, 0x0, 0x32, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000a95000-0x30)={0x14, 0x0, &(0x7f0000b8f000)=[@increfs_done={0x40106308, r3, 0x0}], 0x0, 0x0, &(0x7f00002e4000-0x70)=""}) 2018/02/01 04:11:19 executing program 4 (fault-call:2 fault-nth:1): mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) seccomp(0x1, 0x0, &(0x7f000089b000-0x10)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x407ffc0003}]}) shmctl$IPC_INFO(0x0, 0x3, &(0x7f0000564000)=""/4096) 2018/02/01 04:11:19 executing program 5: openat$ion(0xffffffffffffff9c, &(0x7f0000801000-0x9)='/dev/ion\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000233000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) write$tun(0xffffffffffffffff, &(0x7f0000577000)=@pi={0x0, 0x0, @eth={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x0}, [], {@canfd={0xd, {{0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0, "feb442a1f43ead325d71fed774c8f6028c2a6b79a4e418aa3c5f391769659fef9f596cdade428c389e511eaad39d2ee4334dee9516a31d00510baaf06efc0980"}}}}}, 0x5a) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004ee000-0x76)='\x00', 0x1, 0x0, 0x0}], &(0x7f000000b000-0x30)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)=""}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00005da000)={0x0, 0x0, &(0x7f00000d8000)=[], 0x48, 0x0, &(0x7f000044c000-0x83)="a410778b7a640ab0384c4ead541b6ee57c5645909ef688d8ac3e5ecfc7039f5f8ba53f127b7f01947cd3689eaf6c090277915bab2a0c450988cb85688e2bcc101a80664d3081fcc0"}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000c5a000)={0x0, 0x0, 0x0, 0x0}) mmap(&(0x7f0000000000/0x13000)=nil, 0x13000, 0x0, 0x32, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000a95000-0x30)={0x14, 0x0, &(0x7f0000b8f000)=[@increfs_done={0x40106308, r3, 0x0}], 0x0, 0x0, &(0x7f00002e4000-0x70)=""}) [ 298.999772] netlink: 'syz-executor0': attribute type 15 has an invalid length. [ 299.007244] binder: BINDER_SET_CONTEXT_MGR already set [ 299.007254] binder: 14838:14849 ioctl 40046207 0 returned -16 [ 299.007676] binder: send failed reply for transaction 1278 to 14847:14851 [ 299.015727] binder: undelivered TRANSACTION_COMPLETE [ 299.015738] binder: undelivered TRANSACTION_ERROR: 29189 [ 299.016313] binder: 14838:14849 BC_INCREFS_DONE u0000000000000000 no match [ 299.032395] FAULT_INJECTION: forcing a failure. [ 299.032395] name failslab, interval 1, probability 0, space 0, times 0 [ 299.032405] CPU: 0 PID: 14863 Comm: syz-executor4 Not tainted 4.15.0+ #290 [ 299.032411] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 299.032414] Call Trace: [ 299.032430] dump_stack+0x194/0x257 [ 299.032448] ? arch_local_irq_restore+0x53/0x53 [ 299.032484] should_fail+0x8c0/0xa40 [ 299.032503] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 299.032513] ? check_noncircular+0x20/0x20 [ 299.032523] ? audit_filter+0x40d/0xbf0 [ 299.032535] ? lock_downgrade+0x980/0x980 [ 299.032552] ? lock_release+0xa40/0xa40 [ 299.032574] ? find_held_lock+0x35/0x1d0 [ 299.032636] ? trace_event_raw_event_sched_switch+0x800/0x800 [ 299.032645] ? __lock_is_held+0xb6/0x140 [ 299.032661] ? rcu_note_context_switch+0x710/0x710 [ 299.032687] should_failslab+0xec/0x120 [ 299.032700] kmem_cache_alloc+0x47/0x760 [ 299.032712] ? check_noncircular+0x20/0x20 [ 299.032720] ? _parse_integer+0xe9/0x140 [ 299.032748] audit_log_start+0x4cb/0xa10 [ 299.032769] ? audit_log_task_context+0x260/0x260 [ 299.032782] ? find_held_lock+0x35/0x1d0 [ 299.032807] ? check_noncircular+0x20/0x20 [ 299.032819] ? lock_downgrade+0x980/0x980 [ 299.032839] ? seccomp_run_filters+0x1c9/0x290 [ 299.032853] ? populate_seccomp_data+0xcc0/0xcc0 [ 299.032866] ? find_held_lock+0x35/0x1d0 [ 299.032891] __audit_seccomp+0x31/0x240 [ 299.032913] __seccomp_filter+0xb53/0xe90 [ 299.032928] ? do_seccomp+0x2270/0x2270 [ 299.032951] ? find_held_lock+0x35/0x1d0 [ 299.032970] ? __mutex_unlock_slowpath+0xe9/0xac0 [ 299.032982] ? vfs_write+0x374/0x510 [ 299.032995] ? wait_for_completion+0x770/0x770 [ 299.033015] __secure_computing+0xe6/0x400 [ 299.033032] syscall_trace_enter+0x465/0x1100 [ 299.033053] ? trace_raw_output_sys_exit+0x100/0x100 [ 299.033069] ? __sb_end_write+0xa0/0xd0 [ 299.033089] ? fput+0xd2/0x140 [ 299.033099] ? SyS_write+0x184/0x220 [ 299.033143] do_syscall_64+0x625/0x920 [ 299.033151] ? __do_page_fault+0xc90/0xc90 [ 299.033170] ? syscall_return_slowpath+0x550/0x550 [ 299.033183] ? syscall_return_slowpath+0x2ad/0x550 [ 299.033194] ? prepare_exit_to_usermode+0x340/0x340 [ 299.033209] ? return_from_SYSCALL_64+0x10/0x75 [ 299.033230] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 299.033254] entry_SYSCALL64_slow_path+0x25/0x25 [ 299.033261] RIP: 0033:0x453299 [ 299.033266] RSP: 002b:00007f581a0b0c58 EFLAGS: 00000212 ORIG_RAX: 000000000000001f [ 299.033275] RAX: ffffffffffffffda RBX: 000000000071bea0 RCX: 0000000000453299 [ 299.033280] RDX: 0000000020564000 RSI: 0000000000000003 RDI: 0000000000000000 [ 299.033285] RBP: 00000000000005a9 R08: 0000000000000000 R09: 0000000000000000 [ 299.033290] R10: 0000000000000000 R11: 0000000000000212 R12: 00000000006f7878 [ 299.033295] R13: 0000000000000013 R14: 00007f581a0b16d4 R15: ffffffffffffffff [ 299.042305] binder: send failed reply for transaction 1282 to 14859:14860 [ 299.043224] binder: 14859:14860 BC_INCREFS_DONE u0000000000000000 no match [ 299.058316] binder: undelivered TRANSACTION_COMPLETE [ 299.058326] binder: undelivered TRANSACTION_ERROR: 29189 [ 299.080121] binder: send failed reply for transaction 1286 to 14872:14873 [ 299.081517] binder: 14872:14873 BC_INCREFS_DONE u00000000204edf8a node 1287 cookie mismatch 0000000000000000 != 0000000000000001 [ 299.089737] binder: 14866:14870 transaction failed 29189/-22, size 0-8 line 2788 [ 299.101743] binder: undelivered TRANSACTION_COMPLETE [ 299.101754] binder: undelivered TRANSACTION_ERROR: 29189 [ 299.102213] netlink: 'syz-executor0': attribute type 15 has an invalid length. [ 299.119316] binder: undelivered TRANSACTION_ERROR: 29189 [ 299.137205] binder: send failed reply for transaction 1292 to 14878:14880 [ 299.139202] binder: 14878:14880 BC_INCREFS_DONE u00000000204edf8a node 1293 cookie mismatch 0000000000000000 != 0000000000000001 [ 299.147088] FAULT_INJECTION: forcing a failure. [ 299.147088] name failslab, interval 1, probability 0, space 0, times 0 [ 299.147099] CPU: 1 PID: 14877 Comm: syz-executor4 Not tainted 4.15.0+ #290 [ 299.147105] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 299.147109] Call Trace: [ 299.147125] dump_stack+0x194/0x257 [ 299.147143] ? arch_local_irq_restore+0x53/0x53 [ 299.147153] ? lock_downgrade+0x980/0x980 [ 299.147181] should_fail+0x8c0/0xa40 [ 299.147201] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 299.147224] ? kernel_text_address+0x102/0x140 [ 299.147253] ? find_held_lock+0x35/0x1d0 [ 299.147302] ? trace_event_raw_event_sched_switch+0x800/0x800 [ 299.147311] ? __seccomp_filter+0xb53/0xe90 [ 299.147319] ? __secure_computing+0xe6/0x400 [ 299.147328] ? syscall_trace_enter+0x465/0x1100 [ 299.147340] ? rcu_note_context_switch+0x710/0x710 [ 299.147350] ? lock_release+0xa40/0xa40 [ 299.147368] should_failslab+0xec/0x120 [ 299.147379] kmem_cache_alloc_node+0x56/0x760 [ 299.147408] __alloc_skb+0xf1/0x780 [ 299.147425] ? skb_copy_and_csum_dev+0x370/0x370 [ 299.147427] binder: undelivered TRANSACTION_COMPLETE [ 299.147433] ? trace_event_raw_event_sched_switch+0x800/0x800 [ 299.147436] binder: undelivered TRANSACTION_ERROR: 29189 [ 299.147444] ? rcu_pm_notify+0xc0/0xc0 [ 299.147460] ? audit_log_start+0x4cb/0xa10 [ 299.147478] ? rcu_read_lock_sched_held+0x108/0x120 [ 299.147488] ? kmem_cache_alloc+0x466/0x760 [ 299.147498] ? check_noncircular+0x20/0x20 [ 299.147506] ? _parse_integer+0xe9/0x140 [ 299.147528] audit_log_start+0x4ef/0xa10 [ 299.147544] ? audit_log_task_context+0x260/0x260 [ 299.147554] ? find_held_lock+0x35/0x1d0 [ 299.147572] ? check_noncircular+0x20/0x20 [ 299.147582] ? lock_downgrade+0x980/0x980 [ 299.147594] ? seccomp_run_filters+0x1c9/0x290 [ 299.147605] ? populate_seccomp_data+0xcc0/0xcc0 [ 299.147617] ? find_held_lock+0x35/0x1d0 [ 299.147638] __audit_seccomp+0x31/0x240 [ 299.147655] __seccomp_filter+0xb53/0xe90 [ 299.147667] ? do_seccomp+0x2270/0x2270 [ 299.147691] ? find_held_lock+0x35/0x1d0 [ 299.147707] ? __mutex_unlock_slowpath+0xe9/0xac0 [ 299.147718] ? vfs_write+0x374/0x510 [ 299.147731] ? wait_for_completion+0x770/0x770 [ 299.147749] __secure_computing+0xe6/0x400 [ 299.147765] syscall_trace_enter+0x465/0x1100 [ 299.147784] ? trace_raw_output_sys_exit+0x100/0x100 [ 299.147802] ? __sb_end_write+0xa0/0xd0 [ 299.147819] ? fput+0xd2/0x140 [ 299.147830] ? SyS_write+0x184/0x220 [ 299.147867] do_syscall_64+0x625/0x920 [ 299.147878] ? __do_page_fault+0xc90/0xc90 [ 299.147895] ? syscall_return_slowpath+0x550/0x550 [ 299.147908] ? syscall_return_slowpath+0x2ad/0x550 [ 299.147918] ? prepare_exit_to_usermode+0x340/0x340 [ 299.147930] ? return_from_SYSCALL_64+0x10/0x75 [ 299.147947] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 299.147967] entry_SYSCALL64_slow_path+0x25/0x25 [ 299.147973] RIP: 0033:0x453299 [ 299.147978] RSP: 002b:00007f581a0b0c58 EFLAGS: 00000212 ORIG_RAX: 000000000000001f [ 299.147987] RAX: ffffffffffffffda RBX: 000000000071bea0 RCX: 0000000000453299 [ 299.147991] RDX: 0000000020564000 RSI: 0000000000000003 RDI: 0000000000000000 [ 299.147996] RBP: 00000000000005a9 R08: 0000000000000000 R09: 0000000000000000 [ 299.148000] R10: 0000000000000000 R11: 0000000000000212 R12: 00000000006f7878 [ 299.148005] R13: 0000000000000013 R14: 00007f581a0b16d4 R15: ffffffffffffffff 2018/02/01 04:11:19 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndpcmc(&(0x7f000048b000)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_TIMER(r0, 0xc0605345, &(0x7f0000197000)={0xf67, 0x3, {0x2, 0x2, 0x10000000000, 0x3, 0xe0}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) mmap$binder(&(0x7f0000aff000/0x4000)=nil, 0x4000, 0xfffffffffffffffd, 0x13, r0, 0x81000000) ioctl$DRM_IOCTL_RES_CTX(r0, 0xc0106426, &(0x7f0000450000)={0x11e, &(0x7f0000840000)=[{0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}]}) ioctl$sock_bt_cmtp_CMTPGETCONNLIST(r0, 0x800443d2, &(0x7f0000e27000-0x10)={0x4, &(0x7f0000ea1000)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0x0, 0x0}, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0x0, 0x0}, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0x0, 0x0}, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0x0, 0x0}]}) bind$nfc_llcp(r0, &(0x7f0000358000-0x60)={0x27, 0x954, 0x400, 0x7, 0x6, 0x9, "448290b1b75f0e6d540081c09dd1cd35f7ad7e005679f78cae01cc98d698802ecb4e3c23b2a503b5d6389a35aac97d078109fb631800e237e7b8e1e2376923", 0x5}, 0x60) mmap(&(0x7f0000000000/0x8000)=nil, 0x8000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$sndpcmc(&(0x7f0000002000-0x12)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) ioctl(r1, 0x4142, &(0x7f0000007000)="") writev(r0, &(0x7f0000f70000)=[{&(0x7f0000f79000-0x5b)="f838432440e289a523aa5b8f836e68c79103dc1bbf6a6dfdd32834adefea89f297f0125b1230d31ed05440496e5c307f9117b17cab040812e4da25aa1a15fa18fd3f2a2510fdb9c0571c486ff5023a9f533532305b91bf4429889b", 0x5b}, {&(0x7f0000a96000+0x405)="068f787ba86bb470f072fee418ce3e94ea404bb0813996b34c21d9a1ee80125214da8bfec1d2900b31d4ad5748766ab4aadba0196068d7111ba5e44dde109e0ca4047c58a684b0fd536b263ac4fbc0d366205abb26bc123f2b6a2867a78a3895b43c0877ced710aa9d5bab8c1b0f1117805af0abda65a20ca2427a8c1c560778031f19c19d462064d3eaf9a9ac66dc1c042ce351f6d9c647a6463ffbdeeae3ccbf99777c5c477492f19c5fe0bda9789562c2d9b66208fc0fcdac0b9a3cef", 0xbe}, {&(0x7f0000565000-0x9c)="150dadbda294746917084a7643275fd0824d5bbb37902e17be9dd1fcd3e957a35bb8e92b9e2ddc34d6a0429087db535eff0fe6bb0a35a6b2bd2200f390c23bee198032de70af7bf06285761efada3dacd8b930554d80f4f9a49130ad4dc2fb6f7593b1afe600038f1bec5264809366a321e407491a22fb0621567a1a4e2f1db45c6a84ca1cdb9f511335b5d202b181af79e81023605996b55f3f9def", 0x9c}], 0x3) 2018/02/01 04:11:19 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$audion(&(0x7f00001c8000)='/dev/audio#\x00', 0x3, 0x40) ioctl$KDADDIO(r0, 0x4b34, 0x3) r1 = perf_event_open(&(0x7f000001d000)={0x2, 0x78, 0xe2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000)=0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = socket$inet(0x10, 0x3, 0x10) ioctl$KVM_CREATE_DEVICE(0xffffffffffffff9c, 0xc00caee0, &(0x7f0000c4f000+0x3b1)={0x6, r1, 0x1}) getsockopt$inet_sctp6_SCTP_EVENTS(r3, 0x84, 0xb, &(0x7f0000674000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f0000528000)=0xb) sendmsg(r2, &(0x7f0000003000)={0x0, 0x158, &(0x7f0000004000)=[{&(0x7f0000e31000-0x23)="2300000024009115460000000000001201000000000000270400000000000011007352", 0x23}], 0x1, 0x0, 0x0, 0x0}, 0x0) 2018/02/01 04:11:19 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f0000590000-0x8)='./file0\x00', 0x14) write$selinux_create(r0, &(0x7f000074c000)=@access={'system_u:object_r:dpkg_exec_t:s0', 0x20, '/usr/sbin/cups-browsed', 0x20, 0x32, 0x30, 0x0}, 0x3b) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f00007cf000)='/dev/cuse\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_STATUS(r1, 0xc05c5340, &(0x7f0000b85000)={0x6, 0x100, 0x2, {0x0, 0x0}, 0x0, 0x4, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000801000-0x9)='/dev/ion\x00', 0x0, 0x0) r3 = syz_open_dev$binder(&(0x7f0000233000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r4 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0) r5 = dup2(r3, r4) write$tun(0xffffffffffffffff, &(0x7f0000577000)=@pi={0x0, 0x0, @eth={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x0}, [], {@canfd={0xd, {{0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0, "feb442a1f43ead325d71fed774c8f6028c2a6b79a4e418aa3c5f391769659fef9f596cdade428c389e511eaad39d2ee4334dee9516a31d00510baaf06efc0980"}}}}}, 0x5a) r6 = dup2(r4, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, &(0x7f000026c000)=[], &(0x7f000000b000-0x30)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)=""}) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f00005da000)={0x0, 0x0, &(0x7f00000d8000)=[], 0x48, 0x0, &(0x7f000044c000-0x83)="a410778b7a640ab0384c4ead541b6ee57c5645909ef688d8ac3e5ecfc7039f5f8ba53f127b7f01947cd3689eaf6c090277915bab2a0c450988cb85688e2bcc101a80664d3081fcc0"}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000c5a000)={0x0, 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000a95000-0x30)={0x14, 0x0, &(0x7f0000b8f000)=[@increfs_done={0x40106308, r7, 0x1}], 0x0, 0x0, &(0x7f00002e4000-0x70)=""}) getsockopt$inet6_dccp_buf(r5, 0x21, 0xcf, &(0x7f0000e10000-0xcc)=""/204, &(0x7f000037d000-0x4)=0xcc) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000436000-0x30)={0x20, 0x0, &(0x7f0000136000)=[@dead_binder_done={0x40086310, 0x3}, @increfs_done={0x40106308, r7, 0x0}], 0x0, 0x0, &(0x7f0000888000-0xb)=""}) close(r2) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000002000-0x38)={0x0, 0x0, &(0x7f0000003000)=[], 0x0, &(0x7f0000002000)=[{0x10, 0x10e, 0x0, ""}], 0x10, 0x0}, 0x0) 2018/02/01 04:11:19 executing program 5: openat$ion(0xffffffffffffff9c, &(0x7f0000801000-0x9)='/dev/ion\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000233000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) write$tun(0xffffffffffffffff, &(0x7f0000577000)=@pi={0x0, 0x0, @eth={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x0}, [], {@canfd={0xd, {{0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0, "feb442a1f43ead325d71fed774c8f6028c2a6b79a4e418aa3c5f391769659fef9f596cdade428c389e511eaad39d2ee4334dee9516a31d00510baaf06efc0980"}}}}}, 0x5a) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004ee000-0x76)='\x00', 0x1, 0x0, 0x0}], &(0x7f000000b000-0x30)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)=""}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00005da000)={0x0, 0x0, &(0x7f00000d8000)=[], 0x48, 0x0, &(0x7f000044c000-0x83)="a410778b7a640ab0384c4ead541b6ee57c5645909ef688d8ac3e5ecfc7039f5f8ba53f127b7f01947cd3689eaf6c090277915bab2a0c450988cb85688e2bcc101a80664d3081fcc0"}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000c5a000)={0x0, 0x0, 0x0, 0x0}) mmap(&(0x7f0000000000/0x13000)=nil, 0x13000, 0x0, 0x32, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000a95000-0x30)={0x14, 0x0, &(0x7f0000b8f000)=[@increfs_done={0x40106308, r3, 0x0}], 0x0, 0x0, &(0x7f00002e4000-0x70)=""}) 2018/02/01 04:11:19 executing program 4 (fault-call:2 fault-nth:2): mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) seccomp(0x1, 0x0, &(0x7f000089b000-0x10)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x407ffc0003}]}) shmctl$IPC_INFO(0x0, 0x3, &(0x7f0000564000)=""/4096) 2018/02/01 04:11:19 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) ioctl$DRM_IOCTL_GET_CAP(r0, 0xc010640c, &(0x7f0000841000-0x10)={0x6, 0x4b05}) sendmsg$nl_xfrm(r0, &(0x7f0000a8d000)={&(0x7f0000e4e000)={0x10, 0x0, 0x0, 0x0}, 0xc, &(0x7f0000fcf000-0x10)={&(0x7f00005d5000)=@updsa={0x104, 0x1a, 0x1, 0xffffffffffffffff, 0xffffffffffffffff, {{@in6=@local={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0xffffffffffffffff, 0xaa}, @in=@dev={0xac, 0x14, 0xffffffffffffffff, 0x0}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0}, {@in=@broadcast=0xffffffff, 0xffffffffffffffff, 0x2b}, @in=@multicast2=0xe0000002, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, {0x0, 0x0, 0x0, 0x0}, {0x0, 0x0, 0x0}, 0xffffffffffffffff, 0xffffffffffffffff, 0xa, 0x2, 0x0, 0x0}, [@coaddr={0x14, 0xe, @in=@remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}}]}, 0x104}, 0x1, 0x0, 0x0, 0x0}, 0x0) 2018/02/01 04:11:19 executing program 1: openat$ion(0xffffffffffffff9c, &(0x7f0000801000-0x9)='/dev/ion\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000233000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) write$tun(0xffffffffffffffff, &(0x7f0000577000)=@pi={0x0, 0x0, @eth={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x0}, [], {@canfd={0xd, {{0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0, "feb442a1f43ead325d71fed774c8f6028c2a6b79a4e418aa3c5f391769659fef9f596cdade428c389e511eaad39d2ee4334dee9516a31d00510baaf06efc0980"}}}}}, 0x5a) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004ee000-0x76)='\x00', 0x1, 0x0, 0x0}], &(0x7f000000b000-0x30)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)=""}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00005da000)={0x0, 0x0, &(0x7f00000d8000)=[], 0x48, 0x0, &(0x7f000044c000-0x83)="a410778b7a640ab0384c4ead541b6ee57c5645909ef688d8ac3e5ecfc7039f5f8ba53f127b7f01947cd3689eaf6c090277915bab2a0c450988cb85688e2bcc101a80664d3081fcc0"}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000c5a000)={0x0, 0x0, 0x0, 0x0}) mmap(&(0x7f0000000000/0x13000)=nil, 0x13000, 0x0, 0x32, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000a95000-0x30)={0x0, 0x0, &(0x7f0000b8f000)=[], 0x0, 0x0, &(0x7f00002e4000-0x70)=""}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000436000-0x30)={0x20, 0x0, &(0x7f0000136000)=[@dead_binder_done={0x40086310, 0x3}, @increfs_done={0x40106308, r3, 0x0}], 0x0, 0x0, &(0x7f0000888000-0xb)=""}) 2018/02/01 04:11:19 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$selinux_load(0xffffffffffffff9c, &(0x7f0000ab2000-0xe)='/selinux/load\x00', 0x2, 0x0) r1 = syz_open_dev$vcsn(&(0x7f0000f1e000-0xa)='/dev/vcs#\x00', 0x1, 0xa7fff) ioctl$KDSIGACCEPT(r1, 0x4b4e, 0x3c) write$selinux_load(r0, &(0x7f000006f000)={0xf97cff8c, 0x8, 'SE Linux', ""}, 0x10) [ 299.864474] binder: undelivered TRANSACTION_COMPLETE [ 299.869671] binder: undelivered TRANSACTION_ERROR: 29189 [ 299.892371] SELinux: failed to load policy 2018/02/01 04:11:19 executing program 1: openat$ion(0xffffffffffffff9c, &(0x7f0000801000-0x9)='/dev/ion\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000233000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) write$tun(0xffffffffffffffff, &(0x7f0000577000)=@pi={0x0, 0x0, @eth={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x0}, [], {@canfd={0xd, {{0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0, "feb442a1f43ead325d71fed774c8f6028c2a6b79a4e418aa3c5f391769659fef9f596cdade428c389e511eaad39d2ee4334dee9516a31d00510baaf06efc0980"}}}}}, 0x5a) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004ee000-0x76)='\x00', 0x1, 0x0, 0x0}], &(0x7f000000b000-0x30)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)=""}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00005da000)={0x0, 0x0, &(0x7f00000d8000)=[], 0x48, 0x0, &(0x7f000044c000-0x83)="a410778b7a640ab0384c4ead541b6ee57c5645909ef688d8ac3e5ecfc7039f5f8ba53f127b7f01947cd3689eaf6c090277915bab2a0c450988cb85688e2bcc101a80664d3081fcc0"}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000c5a000)={0x0, 0x0, 0x0, 0x0}) mmap(&(0x7f0000000000/0x13000)=nil, 0x13000, 0x0, 0x32, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000a95000-0x30)={0x0, 0x0, &(0x7f0000b8f000)=[], 0x0, 0x0, &(0x7f00002e4000-0x70)=""}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000436000-0x30)={0x20, 0x0, &(0x7f0000136000)=[@dead_binder_done={0x40086310, 0x3}, @increfs_done={0x40106308, r3, 0x0}], 0x0, 0x0, &(0x7f0000888000-0xb)=""}) 2018/02/01 04:11:19 executing program 5: openat$ion(0xffffffffffffff9c, &(0x7f0000801000-0x9)='/dev/ion\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000233000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) write$tun(0xffffffffffffffff, &(0x7f0000577000)=@pi={0x0, 0x0, @eth={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x0}, [], {@canfd={0xd, {{0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0, "feb442a1f43ead325d71fed774c8f6028c2a6b79a4e418aa3c5f391769659fef9f596cdade428c389e511eaad39d2ee4334dee9516a31d00510baaf06efc0980"}}}}}, 0x5a) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004ee000-0x76)='\x00', 0x1, 0x0, 0x0}], &(0x7f000000b000-0x30)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)=""}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00005da000)={0x0, 0x0, &(0x7f00000d8000)=[], 0x48, 0x0, &(0x7f000044c000-0x83)="a410778b7a640ab0384c4ead541b6ee57c5645909ef688d8ac3e5ecfc7039f5f8ba53f127b7f01947cd3689eaf6c090277915bab2a0c450988cb85688e2bcc101a80664d3081fcc0"}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000c5a000)={0x0, 0x0, 0x0, 0x0}) mmap(&(0x7f0000000000/0x13000)=nil, 0x13000, 0x0, 0x32, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000a95000-0x30)={0x0, 0x0, &(0x7f0000b8f000)=[], 0x0, 0x0, &(0x7f00002e4000-0x70)=""}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000436000-0x30)={0x20, 0x0, &(0x7f0000136000)=[@dead_binder_done={0x40086310, 0x3}, @increfs_done={0x40106308, r3, 0x0}], 0x0, 0x0, &(0x7f0000888000-0xb)=""}) 2018/02/01 04:11:19 executing program 4 (fault-call:2 fault-nth:3): mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) seccomp(0x1, 0x0, &(0x7f000089b000-0x10)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x407ffc0003}]}) shmctl$IPC_INFO(0x0, 0x3, &(0x7f0000564000)=""/4096) 2018/02/01 04:11:19 executing program 2 (fault-call:13 fault-nth:0): openat$ion(0xffffffffffffff9c, &(0x7f0000801000-0x9)='/dev/ion\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000233000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) write$tun(0xffffffffffffffff, &(0x7f0000577000)=@pi={0x0, 0x0, @eth={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x0}, [], {@canfd={0xd, {{0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0, "feb442a1f43ead325d71fed774c8f6028c2a6b79a4e418aa3c5f391769659fef9f596cdade428c389e511eaad39d2ee4334dee9516a31d00510baaf06efc0980"}}}}}, 0x5a) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004ee000-0x76)='\x00', 0x1, 0x0, 0x0}], &(0x7f000000b000-0x30)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)=""}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00005da000)={0x0, 0x0, &(0x7f00000d8000)=[], 0x48, 0x0, &(0x7f000044c000-0x83)="a410778b7a640ab0384c4ead541b6ee57c5645909ef688d8ac3e5ecfc7039f5f8ba53f127b7f01947cd3689eaf6c090277915bab2a0c450988cb85688e2bcc101a80664d3081fcc0"}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000c5a000)={0x0, 0x0, 0x0, 0x0}) mmap(&(0x7f0000000000/0x13000)=nil, 0x13000, 0x0, 0x32, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000a95000-0x30)={0x14, 0x0, &(0x7f0000b8f000)=[@increfs_done={0x40106308, r3, 0x1}], 0x0, 0x0, &(0x7f00002e4000-0x70)=""}) 2018/02/01 04:11:19 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f0000590000-0x8)='./file0\x00', 0x14) write$selinux_create(r0, &(0x7f000074c000)=@access={'system_u:object_r:dpkg_exec_t:s0', 0x20, '/usr/sbin/cups-browsed', 0x20, 0x32, 0x30, 0x0}, 0x3b) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f00007cf000)='/dev/cuse\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_STATUS(r1, 0xc05c5340, &(0x7f0000b85000)={0x6, 0x100, 0x2, {0x0, 0x0}, 0x0, 0x4, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000801000-0x9)='/dev/ion\x00', 0x0, 0x0) r3 = syz_open_dev$binder(&(0x7f0000233000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r4 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0) r5 = dup2(r3, r4) write$tun(0xffffffffffffffff, &(0x7f0000577000)=@pi={0x0, 0x0, @eth={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x0}, [], {@canfd={0xd, {{0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0, "feb442a1f43ead325d71fed774c8f6028c2a6b79a4e418aa3c5f391769659fef9f596cdade428c389e511eaad39d2ee4334dee9516a31d00510baaf06efc0980"}}}}}, 0x5a) r6 = dup2(r4, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, &(0x7f000026c000)=[], &(0x7f000000b000-0x30)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)=""}) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f00005da000)={0x0, 0x0, &(0x7f00000d8000)=[], 0x48, 0x0, &(0x7f000044c000-0x83)="a410778b7a640ab0384c4ead541b6ee57c5645909ef688d8ac3e5ecfc7039f5f8ba53f127b7f01947cd3689eaf6c090277915bab2a0c450988cb85688e2bcc101a80664d3081fcc0"}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000c5a000)={0x0, 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000a95000-0x30)={0x14, 0x0, &(0x7f0000b8f000)=[@increfs_done={0x40106308, r7, 0x1}], 0x0, 0x0, &(0x7f00002e4000-0x70)=""}) getsockopt$inet6_dccp_buf(r5, 0x21, 0xcf, &(0x7f0000e10000-0xcc)=""/204, &(0x7f000037d000-0x4)=0xcc) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000436000-0x30)={0x20, 0x0, &(0x7f0000136000)=[@dead_binder_done={0x40086310, 0x3}, @increfs_done={0x40106308, r7, 0x0}], 0x0, 0x0, &(0x7f0000888000-0xb)=""}) close(r2) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000002000-0x38)={0x0, 0x0, &(0x7f0000003000)=[], 0x0, &(0x7f0000002000)=[{0x10, 0x10e, 0x0, ""}], 0x10, 0x0}, 0x0) [ 299.892763] binder: BINDER_SET_CONTEXT_MGR already set [ 299.892771] binder: 14889:14895 ioctl 40046207 0 returned -16 2018/02/01 04:11:19 executing program 1: openat$ion(0xffffffffffffff9c, &(0x7f0000801000-0x9)='/dev/ion\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000233000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) write$tun(0xffffffffffffffff, &(0x7f0000577000)=@pi={0x0, 0x0, @eth={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x0}, [], {@canfd={0xd, {{0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0, "feb442a1f43ead325d71fed774c8f6028c2a6b79a4e418aa3c5f391769659fef9f596cdade428c389e511eaad39d2ee4334dee9516a31d00510baaf06efc0980"}}}}}, 0x5a) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004ee000-0x76)='\x00', 0x1, 0x0, 0x0}], &(0x7f000000b000-0x30)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)=""}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00005da000)={0x0, 0x0, &(0x7f00000d8000)=[], 0x48, 0x0, &(0x7f000044c000-0x83)="a410778b7a640ab0384c4ead541b6ee57c5645909ef688d8ac3e5ecfc7039f5f8ba53f127b7f01947cd3689eaf6c090277915bab2a0c450988cb85688e2bcc101a80664d3081fcc0"}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000c5a000)={0x0, 0x0, 0x0, 0x0}) mmap(&(0x7f0000000000/0x13000)=nil, 0x13000, 0x0, 0x32, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000a95000-0x30)={0x0, 0x0, &(0x7f0000b8f000)=[], 0x0, 0x0, &(0x7f00002e4000-0x70)=""}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000436000-0x30)={0x20, 0x0, &(0x7f0000136000)=[@dead_binder_done={0x40086310, 0x3}, @increfs_done={0x40106308, r3, 0x0}], 0x0, 0x0, &(0x7f0000888000-0xb)=""}) 2018/02/01 04:11:19 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0xa8, &(0x7f0000a82000)={@local={[0xaa, 0xaa, 0xaa, 0xaa], 0x0, 0xaa}, @empty=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x9a, 0xffffffffffffffff, 0x718, 0x0, 0x100000006, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @remote={0xac, 0x14, 0x0, 0xbb}, {[]}}, @dccp={{0x3, 0x1, 0x4, 0x1, 0x3, 0x0, 0x0, 0xb, 0x8, "cb9527", 0x5, '6xM'}, "aff1112caa6a3fbc08c458a7469ba96e7c426945ec7c41e735a06e86d01d40660bcb24ac0b2bc397c763ec825d681d960c64f460deccdccbfbb19620dd6c829fce00ec19c3f8603ee8a2291784f87993c5d903c263d337449799959ac0b1b686eb1d3ce5781960cee28fae45acebcf3adc3c8febfd2c"}}}}}, &(0x7f0000754000)={0x0, 0x0, []}) r0 = dup2(0xffffffffffffff9c, 0xffffffffffffff9c) socketpair$inet_dccp(0x2, 0x6, 0x0, &(0x7f0000c94000)={0x0, 0x0}) dup2(r0, r1) 2018/02/01 04:11:19 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x80005, 0x0) setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, &(0x7f0000012000)=@filter={'filter\x00', 0xe, 0x4, 0x358, 0xffffffff, 0x0, 0x0, 0x0, 0xffffffff, 0xffffffff, 0x0, 0x0, 0x0, 0xffffffff, 0x4, &(0x7f0000001000)=[{0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}], {{{[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0x70, 0x98, 0x0, {0x0, 0x0}}, {0x28, '\x00', 0x0, 0xfffffffffffffffe}}, [{{@ip={@broadcast=0xffffffff, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, 0x0, 0x0, @common='bcsh0\x00', @syzn={0x73, 0x79, 0x7a, 0xffffffffffffffff, 0x0}, {0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, {0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x0, 0x0, 0x0}, 0x0, 0x70, 0x98, 0x0, {0x0, 0x0}, []}, @REJECT={0x28, 'REJECT\x00', 0x0, {0x0}}}, {{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0x168, 0x190, 0x0, {0x0, 0x0}, [@common=@unspec=@recent0={0xf8, 'recent\x00', 0x0, {0x0, 0x0, 0x4, 0x0, 'syz1\x00', 0x0}}]}, @REJECT={0x28, 'REJECT\x00', 0x0, {0x0}}}, {{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0x70, 0x98, 0x0, {0x0, 0x0}, []}, @REJECT={0x28, 'REJECT\x00', 0x0, {0x0}}}]}}, 0x3b8) r1 = socket$inet(0x2, 0x80005, 0x0) setsockopt$IPT_SO_SET_REPLACE(r1, 0x0, 0x40, &(0x7f0000f9e000)=@filter={'filter\x00', 0xe, 0x4, 0x390, 0xffffffff, 0x0, 0x0, 0x0, 0xffffffff, 0xffffffff, 0x0, 0x0, 0x0, 0xffffffff, 0x4, &(0x7f0000001000)=[{0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}], {{{[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0x70, 0x98, 0x0, {0x0, 0x0}}, {0x28, '\x00', 0x0, 0xfffffffffffffffe}}, [{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0x70, 0x98, 0x0, {0x0, 0x0}, []}, @REJECT={0x28, 'REJECT\x00', 0x0, {0x0}}}, {{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0x168, 0x190, 0x0, {0x0, 0x0}, [@common=@unspec=@recent0={0xf8, 'recent\x00', 0x0, {0x0, 0x0, 0x4, 0x0, 'syz0\x00', 0x0}}]}, @REJECT={0x28, 'REJECT\x00', 0x0, {0x0}}}, {{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0x70, 0xd0, 0x0, {0x0, 0x0}, []}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x0}, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0x0, 0x0}}}]}}, 0x3f0) r2 = accept4(r1, &(0x7f0000a16000)=@ax25={0x0, {""/7}, 0x0}, &(0x7f00008a1000-0x4)=0x10, 0x80800) r3 = openat$selinux_status(0xffffffffffffff9c, &(0x7f00009fe000)='/selinux/status\x00', 0x0, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r3, 0x770a, 0x0) getsockname$unix(r2, &(0x7f0000724000)=@file={0x0, ""/108}, &(0x7f0000806000)=0x6e) [ 299.898419] binder: send failed reply for transaction 1296 to 14888:14892 [ 299.898433] binder: send failed reply for transaction 1299 to 14889:14895 2018/02/01 04:11:19 executing program 4 (fault-call:2 fault-nth:4): mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) seccomp(0x1, 0x0, &(0x7f000089b000-0x10)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x407ffc0003}]}) shmctl$IPC_INFO(0x0, 0x3, &(0x7f0000564000)=""/4096) 2018/02/01 04:11:19 executing program 2: openat$ion(0xffffffffffffff9c, &(0x7f0000801000-0x9)='/dev/ion\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000233000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) write$tun(0xffffffffffffffff, &(0x7f0000577000)=@pi={0x0, 0x0, @eth={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x0}, [], {@canfd={0xd, {{0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0, "feb442a1f43ead325d71fed774c8f6028c2a6b79a4e418aa3c5f391769659fef9f596cdade428c389e511eaad39d2ee4334dee9516a31d00510baaf06efc0980"}}}}}, 0x5a) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004ee000-0x76)='\x00', 0x1, 0x0, 0x0}], &(0x7f000000b000-0x30)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)=""}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00005da000)={0x0, 0x0, &(0x7f00000d8000)=[], 0x48, 0x0, &(0x7f000044c000-0x83)="a410778b7a640ab0384c4ead541b6ee57c5645909ef688d8ac3e5ecfc7039f5f8ba53f127b7f01947cd3689eaf6c090277915bab2a0c450988cb85688e2bcc101a80664d3081fcc0"}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000c5a000)={0x0, 0x0, 0x0, 0x0}) mmap(&(0x7f0000000000/0x13000)=nil, 0x13000, 0x0, 0x32, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000a95000-0x30)={0x14, 0x0, &(0x7f0000b8f000)=[@increfs_done={0x40106308, r3, 0x1}], 0x0, 0x0, &(0x7f00002e4000-0x70)=""}) [ 299.902490] binder: 14888:14892 BC_INCREFS_DONE u00000000204edf8a node 1297 cookie mismatch 0000000000000000 != 0000000000000001 [ 299.902742] FAULT_INJECTION: forcing a failure. [ 299.902742] name failslab, interval 1, probability 0, space 0, times 0 [ 299.902752] CPU: 1 PID: 14897 Comm: syz-executor4 Not tainted 4.15.0+ #290 [ 299.902757] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 299.902761] Call Trace: [ 299.902778] dump_stack+0x194/0x257 [ 299.902797] ? arch_local_irq_restore+0x53/0x53 [ 299.902836] should_fail+0x8c0/0xa40 [ 299.902855] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 299.902881] ? save_stack+0xa3/0xd0 [ 299.902894] ? save_stack+0x43/0xd0 [ 299.902901] ? kasan_kmalloc+0xad/0xe0 [ 299.902909] ? kasan_slab_alloc+0x12/0x20 [ 299.902927] ? find_held_lock+0x35/0x1d0 [ 299.902977] ? trace_event_raw_event_sched_switch+0x800/0x800 [ 299.902994] ? rcu_note_context_switch+0x710/0x710 [ 299.903028] should_failslab+0xec/0x120 [ 299.903042] kmem_cache_alloc_node_trace+0x5a/0x750 [ 299.903075] __kmalloc_node_track_caller+0x33/0x70 [ 299.903092] __kmalloc_reserve.isra.39+0x41/0xd0 [ 299.903112] __alloc_skb+0x13b/0x780 [ 299.903129] ? skb_copy_and_csum_dev+0x370/0x370 [ 299.903137] ? trace_event_raw_event_sched_switch+0x800/0x800 [ 299.903150] ? rcu_pm_notify+0xc0/0xc0 [ 299.903167] ? audit_log_start+0x4cb/0xa10 [ 299.903188] ? rcu_read_lock_sched_held+0x108/0x120 [ 299.903198] ? kmem_cache_alloc+0x466/0x760 [ 299.903218] ? check_noncircular+0x20/0x20 [ 299.903228] ? _parse_integer+0xe9/0x140 [ 299.903254] audit_log_start+0x4ef/0xa10 [ 299.903274] ? audit_log_task_context+0x260/0x260 [ 299.903285] ? find_held_lock+0x35/0x1d0 [ 299.903312] ? check_noncircular+0x20/0x20 [ 299.903324] ? lock_downgrade+0x980/0x980 [ 299.903345] ? seccomp_run_filters+0x1c9/0x290 [ 299.903360] ? populate_seccomp_data+0xcc0/0xcc0 [ 299.903373] ? find_held_lock+0x35/0x1d0 [ 299.903400] __audit_seccomp+0x31/0x240 [ 299.903421] __seccomp_filter+0xb53/0xe90 [ 299.903436] ? do_seccomp+0x2270/0x2270 [ 299.903459] ? find_held_lock+0x35/0x1d0 [ 299.903478] ? __mutex_unlock_slowpath+0xe9/0xac0 [ 299.903490] ? vfs_write+0x374/0x510 [ 299.903502] ? wait_for_completion+0x770/0x770 [ 299.903522] __secure_computing+0xe6/0x400 [ 299.903540] syscall_trace_enter+0x465/0x1100 [ 299.903562] ? trace_raw_output_sys_exit+0x100/0x100 [ 299.903583] ? __sb_end_write+0xa0/0xd0 [ 299.903602] ? fput+0xd2/0x140 [ 299.903612] ? SyS_write+0x184/0x220 [ 299.903656] do_syscall_64+0x625/0x920 [ 299.903665] ? __do_page_fault+0xc90/0xc90 [ 299.903684] ? syscall_return_slowpath+0x550/0x550 [ 299.903702] ? do_futex+0x22a0/0x22a0 [ 299.903715] ? return_from_SYSCALL_64+0x10/0x75 [ 299.903737] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 299.903762] entry_SYSCALL64_slow_path+0x25/0x25 [ 299.903768] RIP: 0033:0x453299 [ 299.903773] RSP: 002b:00007f581a0b0c58 EFLAGS: 00000212 ORIG_RAX: 000000000000001f [ 299.903782] RAX: ffffffffffffffda RBX: 000000000071bea0 RCX: 0000000000453299 [ 299.903787] RDX: 0000000020564000 RSI: 0000000000000003 RDI: 0000000000000000 [ 299.903791] RBP: 00000000000005a9 R08: 0000000000000000 R09: 0000000000000000 [ 299.903796] R10: 0000000000000000 R11: 0000000000000212 R12: 00000000006f7878 [ 299.903801] R13: 0000000000000013 R14: 00007f581a0b16d4 R15: ffffffffffffffff [ 299.904315] binder: 14889:14895 BC_DEAD_BINDER_DONE 0000000000000003 not found [ 299.904329] binder: 14889:14895 BC_INCREFS_DONE u00000000204edf8a node 1300 cookie mismatch 0000000000000000 != 0000000000000001 [ 299.914485] binder: 14886:14890 transaction failed 29189/-22, size 0-8 line 2788 [ 299.924659] binder: undelivered TRANSACTION_COMPLETE [ 299.924670] binder: undelivered TRANSACTION_ERROR: 29189 [ 299.925401] binder: undelivered TRANSACTION_COMPLETE [ 299.925408] binder: undelivered TRANSACTION_ERROR: 29189 [ 299.949424] binder: send failed reply for transaction 1305 to 14901:14902 [ 299.951182] binder: 14901:14902 BC_DEAD_BINDER_DONE 0000000000000003 not found [ 299.951197] binder: 14901:14902 BC_INCREFS_DONE u00000000204edf8a node 1306 cookie mismatch 0000000000000000 != 0000000000000001 [ 299.958707] binder: undelivered TRANSACTION_ERROR: 29189 [ 299.971451] binder: send failed reply for transaction 1309 to 14906:14907 [ 299.975982] binder: 14906:14907 BC_DEAD_BINDER_DONE 0000000000000003 not found [ 299.975997] binder: 14906:14907 BC_INCREFS_DONE u00000000204edf8a node 1310 cookie mismatch 0000000000000000 != 0000000000000001 [ 299.979424] binder: undelivered TRANSACTION_COMPLETE [ 299.979434] binder: undelivered TRANSACTION_ERROR: 29189 [ 299.989305] FAULT_INJECTION: forcing a failure. [ 299.989305] name failslab, interval 1, probability 0, space 0, times 0 [ 299.989317] CPU: 1 PID: 14909 Comm: syz-executor4 Not tainted 4.15.0+ #290 [ 299.989323] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 299.989327] Call Trace: [ 299.989345] dump_stack+0x194/0x257 [ 299.989364] ? arch_local_irq_restore+0x53/0x53 [ 299.989378] ? debug_check_no_locks_freed+0x3c0/0x3c0 [ 299.989408] should_fail+0x8c0/0xa40 [ 299.989426] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 299.989456] ? save_stack+0x43/0xd0 [ 299.989465] ? kasan_kmalloc+0xad/0xe0 [ 299.989475] ? __kmalloc_node_track_caller+0x47/0x70 [ 299.989485] ? __kmalloc_reserve.isra.39+0x41/0xd0 [ 299.989495] ? __alloc_skb+0x13b/0x780 [ 299.989505] ? audit_log_start+0x4ef/0xa10 [ 299.989514] ? __audit_seccomp+0x31/0x240 [ 299.989522] ? __seccomp_filter+0xb53/0xe90 [ 299.989529] ? __secure_computing+0xe6/0x400 [ 299.989538] ? syscall_trace_enter+0x465/0x1100 [ 299.989545] ? do_syscall_64+0x625/0x920 [ 299.989555] ? entry_SYSCALL64_slow_path+0x25/0x25 [ 299.989564] ? put_dec_trunc8+0x13f/0x2d0 [ 299.989578] ? put_dec+0x2e/0xd0 [ 299.989594] ? check_noncircular+0x20/0x20 [ 299.989615] ? put_dec_trunc8+0x13f/0x2d0 [ 299.989629] ? put_dec+0x2e/0xd0 [ 299.989651] should_failslab+0xec/0x120 [ 299.989663] __kmalloc+0x63/0x760 [ 299.989676] ? mls_compute_context_len+0x40e/0x5d0 [ 299.989691] ? context_struct_to_string+0x353/0x720 [ 299.989708] context_struct_to_string+0x353/0x720 [ 299.989722] ? get_permissions_callback+0xb0/0xb0 [ 299.989736] ? sidtab_search_core+0x1c8/0x320 [ 299.989759] security_sid_to_context_core+0x18a/0x250 [ 299.989775] security_sid_to_context+0x25/0x30 [ 299.989791] selinux_secid_to_secctx+0x23/0x30 [ 299.989806] security_secid_to_secctx+0x83/0xc0 [ 299.989825] audit_log_task_context+0x15a/0x260 [ 299.989839] ? audit_log_format+0x140/0x140 [ 299.989855] ? audit_log_format+0xb3/0x140 [ 299.989867] ? audit_log_vformat+0x920/0x920 [ 299.989885] ? audit_log_task_context+0x260/0x260 [ 299.989897] ? find_held_lock+0x35/0x1d0 [ 299.989918] audit_log_task+0x256/0x3f0 [ 299.989931] ? unroll_tree_refs+0x3e0/0x3e0 [ 299.989947] ? seccomp_run_filters+0x1c9/0x290 [ 299.989961] ? populate_seccomp_data+0xcc0/0xcc0 [ 299.989973] ? find_held_lock+0x35/0x1d0 [ 299.989995] __audit_seccomp+0x4a/0x240 [ 299.990014] __seccomp_filter+0xb53/0xe90 [ 299.990027] ? do_seccomp+0x2270/0x2270 [ 299.990048] ? find_held_lock+0x35/0x1d0 [ 299.990063] ? __mutex_unlock_slowpath+0xe9/0xac0 [ 299.990073] ? vfs_write+0x374/0x510 [ 299.990083] ? wait_for_completion+0x770/0x770 [ 299.990098] __secure_computing+0xe6/0x400 [ 299.990112] syscall_trace_enter+0x465/0x1100 [ 299.990131] ? trace_raw_output_sys_exit+0x100/0x100 [ 299.990147] ? __sb_end_write+0xa0/0xd0 [ 299.990162] ? fput+0xd2/0x140 [ 299.990171] ? SyS_write+0x184/0x220 [ 299.990215] do_syscall_64+0x625/0x920 [ 299.990225] ? __do_page_fault+0xc90/0xc90 [ 299.990243] ? syscall_return_slowpath+0x550/0x550 [ 299.990259] ? do_futex+0x22a0/0x22a0 [ 299.990271] ? return_from_SYSCALL_64+0x10/0x75 [ 299.990288] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 299.990308] entry_SYSCALL64_slow_path+0x25/0x25 [ 299.990316] RIP: 0033:0x453299 [ 299.990320] RSP: 002b:00007f581a0b0c58 EFLAGS: 00000212 ORIG_RAX: 000000000000001f [ 299.990330] RAX: ffffffffffffffda RBX: 000000000071bea0 RCX: 0000000000453299 [ 299.990334] RDX: 0000000020564000 RSI: 0000000000000003 RDI: 0000000000000000 [ 299.990338] RBP: 00000000000005a9 R08: 0000000000000000 R09: 0000000000000000 [ 299.990343] R10: 0000000000000000 R11: 0000000000000212 R12: 00000000006f7878 [ 299.990348] R13: 0000000000000013 R14: 00007f581a0b16d4 R15: ffffffffffffffff [ 299.997460] binder: undelivered TRANSACTION_COMPLETE [ 299.997470] binder: undelivered TRANSACTION_ERROR: 29189 [ 299.999125] binder: BINDER_SET_CONTEXT_MGR already set [ 299.999134] binder: 14910:14912 ioctl 40046207 0 returned -16 [ 299.999555] binder: 14910:14912 got transaction with invalid offset (0, min 0 max 0) or object. [ 299.999588] binder: 14910:14912 transaction failed 29201/-22, size 0-8 line 2966 [ 300.004903] binder: send failed reply for transaction 1313 to 14908:14911 [ 300.026464] ipt_CLUSTERIP: Please specify destination IP [ 300.030570] binder: undelivered TRANSACTION_ERROR: 29201 [ 300.030715] binder: undelivered TRANSACTION_COMPLETE [ 300.030723] binder: undelivered TRANSACTION_ERROR: 29189 [ 300.034727] ipt_CLUSTERIP: Please specify destination IP [ 300.037809] binder: send failed reply for transaction 1318 to 14913:14915 [ 300.052669] binder: 14913:14915 BC_DEAD_BINDER_DONE 0000000000000003 not found [ 300.052682] binder: 14913:14915 BC_INCREFS_DONE u00000000204edf8a node 1319 cookie mismatch 0000000000000000 != 0000000000000001 [ 300.081639] binder: send failed reply for transaction 1322 to 14922:14925 2018/02/01 04:11:20 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f0000590000-0x8)='./file0\x00', 0x14) write$selinux_create(r0, &(0x7f000074c000)=@access={'system_u:object_r:dpkg_exec_t:s0', 0x20, '/usr/sbin/cups-browsed', 0x20, 0x32, 0x30, 0x0}, 0x3b) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f00007cf000)='/dev/cuse\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_STATUS(r1, 0xc05c5340, &(0x7f0000b85000)={0x6, 0x100, 0x2, {0x0, 0x0}, 0x0, 0x4, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000801000-0x9)='/dev/ion\x00', 0x0, 0x0) r3 = syz_open_dev$binder(&(0x7f0000233000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r4 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0) r5 = dup2(r3, r4) write$tun(0xffffffffffffffff, &(0x7f0000577000)=@pi={0x0, 0x0, @eth={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x0}, [], {@canfd={0xd, {{0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0, "feb442a1f43ead325d71fed774c8f6028c2a6b79a4e418aa3c5f391769659fef9f596cdade428c389e511eaad39d2ee4334dee9516a31d00510baaf06efc0980"}}}}}, 0x5a) r6 = dup2(r4, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004ee000-0x76)='\x00', 0x1, 0x0, 0x0}], &(0x7f000000b000-0x30)=[]}}], 0x0, 0x0, &(0x7f0000009000)=""}) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f00005da000)={0x0, 0x0, &(0x7f00000d8000)=[], 0x48, 0x0, &(0x7f000044c000-0x83)="a410778b7a640ab0384c4ead541b6ee57c5645909ef688d8ac3e5ecfc7039f5f8ba53f127b7f01947cd3689eaf6c090277915bab2a0c450988cb85688e2bcc101a80664d3081fcc0"}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000c5a000)={0x0, 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000a95000-0x30)={0x14, 0x0, &(0x7f0000b8f000)=[@increfs_done={0x40106308, r7, 0x1}], 0x0, 0x0, &(0x7f00002e4000-0x70)=""}) getsockopt$inet6_dccp_buf(r5, 0x21, 0xcf, &(0x7f0000e10000-0xcc)=""/204, &(0x7f000037d000-0x4)=0xcc) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000436000-0x30)={0x20, 0x0, &(0x7f0000136000)=[@dead_binder_done={0x40086310, 0x3}, @increfs_done={0x40106308, r7, 0x0}], 0x0, 0x0, &(0x7f0000888000-0xb)=""}) close(r2) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000002000-0x38)={0x0, 0x0, &(0x7f0000003000)=[], 0x0, &(0x7f0000002000)=[{0x10, 0x10e, 0x0, ""}], 0x10, 0x0}, 0x0) 2018/02/01 04:11:20 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x2, 0x78, 0xe2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000ca9000)=0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$netlink(0x10, 0x3, 0xf) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_INFO(r0, 0xc08c5334, &(0x7f000081d000)={0x1, 0xa0c6, 0x9ecd, 'queue0\x00', 0x726b, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) writev(r1, &(0x7f0000eb5000-0x10)=[{&(0x7f0000ed0000)="390000001000094700bb61e1c30500000700004a02000000450001070000801419001a000400070021000007de000008000300ffff06001ee4", 0x39}], 0x1) r2 = openat$sequencer(0xffffffffffffff9c, &(0x7f00001b9000-0xf)='/dev/sequencer\x00', 0x800, 0x0) ioctl$TCSBRK(r2, 0x5409, 0xf7b) r3 = syz_open_dev$sndpcmp(&(0x7f0000f41000)='/dev/snd/pcmC#D#p\x00', 0x8, 0x200000) r4 = memfd_create(&(0x7f0000a80000+0x2ae)='GPL.\x00', 0x0) r5 = syz_open_dev$sndseq(&(0x7f0000fca000-0xd)='/dev/snd/seq\x00', 0x0, 0x200008000020002) getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r4, 0x84, 0xf, &(0x7f0000b5e000)={0x0, @in6={{0xa, 0x2, 0x2, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x1}, 0x3ff}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x9, 0x7fff, 0x0, 0x7, 0x5}, &(0x7f000038a000-0x4)=0xa0) getsockopt$inet_sctp_SCTP_DEFAULT_PRINFO(r4, 0x84, 0x72, &(0x7f0000ccd000)={0x0, 0x7, 0x0}, &(0x7f0000bfb000-0x4)=0xc) getsockopt$inet_sctp6_SCTP_STATUS(r4, 0x84, 0xe, &(0x7f0000bbd000-0xb8)={r6, 0x3, 0x7, 0x1, 0x6, 0x5, 0xc9, 0x3, {r7, @in6={{0xa, 0x3, 0xb3, @remote={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0xbb}, 0x4}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x4, 0x2, 0x9000, 0x100000000, 0x3f}}, &(0x7f00008f0000)=0xb8) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000dcc000)={r4, &(0x7f000061f000-0xdf)="1bfaa1d20b4e607e8f656b91355dccd62521ff4f7ce6c72ce116cd889ab92d73e0c24db2d18e3a35b5fcdb58545b116d3c3b0643e66a7e9789ba24c6c803537e67a3a34655af75ed60dc75cfeab40bf4d6fecb7c21957724c98764e62a2def2211ac751b816ed8bdc7d8bc9238274aee404b308defa822bce0d1a5aa88f9942152e2918a6e016b3eac7278ae3fdbb333468294cecde5b89f8a1b6dc88627f163aa57bf2f1e0ccbe9a7e0a6f4559eb55ec75f8d863f31f6cd0de3aa19d616e21611f1f872e513c33452e1df0d20ae75184956f62168b4f93270d029b8c86b4a", &(0x7f0000bc5000)=""/57}, 0x18) getsockopt$bt_l2cap_L2CAP_LM(r3, 0x6, 0x3, &(0x7f0000477000-0x4)=0x0, &(0x7f0000eb7000-0x4)=0x4) r8 = dup2(r5, r4) ioctl$ASHMEM_GET_PIN_STATUS(r3, 0x7709, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_NEXT_CLIENT(r8, 0xc0bc5351, &(0x7f0000b68000-0xbc)={0x8001, 0x3, 'client0\x00', 0x2, "67ebb478b4d1030f", "0ae4d949ab9ae42837bcc625226fb460cfee36b8b2621c040d71dec79d5f2108", 0x20, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) 2018/02/01 04:11:20 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000233000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) write$tun(0xffffffffffffffff, &(0x7f0000577000)=@pi={0x0, 0x0, @eth={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x0}, [], {@canfd={0xd, {{0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0, "feb442a1f43ead325d71fed774c8f6028c2a6b79a4e418aa3c5f391769659fef9f596cdade428c389e511eaad39d2ee4334dee9516a31d00510baaf06efc0980"}}}}}, 0x5a) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004ee000-0x76)='\x00', 0x1, 0x0, 0x0}], &(0x7f000000b000-0x30)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)=""}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00005da000)={0x0, 0x0, &(0x7f00000d8000)=[], 0x48, 0x0, &(0x7f000044c000-0x83)="a410778b7a640ab0384c4ead541b6ee57c5645909ef688d8ac3e5ecfc7039f5f8ba53f127b7f01947cd3689eaf6c090277915bab2a0c450988cb85688e2bcc101a80664d3081fcc0"}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000c5a000)={0x0, 0x0, 0x0, 0x0}) mmap(&(0x7f0000000000/0x13000)=nil, 0x13000, 0x0, 0x32, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000a95000-0x30)={0x14, 0x0, &(0x7f0000b8f000)=[@increfs_done={0x40106308, r3, 0x1}], 0x0, 0x0, &(0x7f00002e4000-0x70)=""}) 2018/02/01 04:11:20 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000861000)='/dev/sequencer\x00', 0x200000, 0x0) recvmsg$kcm(r1, &(0x7f0000538000-0x38)={&(0x7f0000932000)=@nfc_llcp={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/63, 0x0}, 0x60, &(0x7f00004c2000-0x90)=[{&(0x7f00001b2000-0xf2)=""/242, 0xf2}, {&(0x7f000037b000)=""/24, 0x18}, {&(0x7f0000419000-0x9d)=""/157, 0x9d}, {&(0x7f0000b10000)=""/218, 0xda}, {&(0x7f0000914000)=""/93, 0x5d}, {&(0x7f0000a82000)=""/135, 0x87}, {&(0x7f0000947000-0x93)=""/147, 0x93}, {&(0x7f000009b000-0x3)=""/3, 0x3}, {&(0x7f0000831000-0xec)=""/236, 0xec}], 0x9, 0x0, 0x0, 0xd725}, 0x160) pivot_root(&(0x7f00006e3000)='./file0\x00', &(0x7f0000739000-0x8)='./file0\x00') listen(r0, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0xa, &(0x7f0000d06000)=0x0, 0x4) ioctl$EVIOCGBITSND(r1, 0x80404532, &(0x7f0000416000+0xfdc)=""/143) 2018/02/01 04:11:20 executing program 1: openat$ion(0xffffffffffffff9c, &(0x7f0000801000-0x9)='/dev/ion\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000233000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) write$tun(0xffffffffffffffff, &(0x7f0000577000)=@pi={0x0, 0x0, @eth={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x0}, [], {@canfd={0xd, {{0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0, "feb442a1f43ead325d71fed774c8f6028c2a6b79a4e418aa3c5f391769659fef9f596cdade428c389e511eaad39d2ee4334dee9516a31d00510baaf06efc0980"}}}}}, 0x5a) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004ee000-0x76)='\x00', 0x1, 0x0, 0x0}], &(0x7f000000b000-0x30)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)=""}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00005da000)={0x0, 0x0, &(0x7f00000d8000)=[], 0x48, 0x0, &(0x7f000044c000-0x83)="a410778b7a640ab0384c4ead541b6ee57c5645909ef688d8ac3e5ecfc7039f5f8ba53f127b7f01947cd3689eaf6c090277915bab2a0c450988cb85688e2bcc101a80664d3081fcc0"}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000c5a000)={0x0, 0x0, 0x0, 0x0}) mmap(&(0x7f0000000000/0x13000)=nil, 0x13000, 0x0, 0x32, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000a95000-0x30)={0x14, 0x0, &(0x7f0000b8f000)=[@increfs_done={0x40106308, 0x0, 0x1}], 0x0, 0x0, &(0x7f00002e4000-0x70)=""}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000436000-0x30)={0x20, 0x0, &(0x7f0000136000)=[@dead_binder_done={0x40086310, 0x3}, @increfs_done={0x40106308, r3, 0x0}], 0x0, 0x0, &(0x7f0000888000-0xb)=""}) 2018/02/01 04:11:20 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x3, 0xfffffffffffffffe) getsockopt$inet6_buf(r0, 0x29, 0x30, &(0x7f0000744000-0x1d)=""/29, &(0x7f0000d0f000-0x4)=0xfffffffffffffdc6) 2018/02/01 04:11:20 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) seccomp(0x1, 0x0, &(0x7f000089b000-0x10)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x407ffc0003}]}) shmctl$IPC_INFO(0x0, 0x3, &(0x7f0000564000)=""/4096) 2018/02/01 04:11:20 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = socket$inet_icmp(0x2, 0x2, 0x1) ioctl$sock_inet_SIOCADDRT(r1, 0x890b, &(0x7f0000026000)={0x9af, {0x2, 0x2, @empty=0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, {0x2, 0x1, @loopback=0x7f000001, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, {0x2, 0x3, @rand_addr=0x7fffffff, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x10, 0x10001, 0xfffffffffffffffc, 0x2, 0x6, &(0x7f000002c000-0x10)=@common='ipddp0\x00', 0x400, 0x8, 0x5}) sendmsg$nl_xfrm(r0, &(0x7f0000a8d000)={&(0x7f0000e4e000)={0x10, 0x0, 0x0, 0x0}, 0xc, &(0x7f0000fcf000-0x10)={&(0x7f00005d5000)=@updsa={0x104, 0x1a, 0x1, 0xffffffffffffffff, 0xffffffffffffffff, {{@in6=@local={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0xffffffffffffffff, 0xaa}, @in=@dev={0xac, 0x14, 0xffffffffffffffff, 0x0}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0}, {@in=@broadcast=0xffffffff, 0xffffffffffffffff, 0x2b}, @in=@multicast2=0xe0000002, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, {0x0, 0x0, 0x0, 0x0}, {0x0, 0x0, 0x0}, 0xffffffffffffffff, 0xffffffffffffffff, 0xa, 0x2, 0x0, 0x0}, [@coaddr={0x14, 0xe, @in=@remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}}]}, 0x104}, 0x1, 0x0, 0x0, 0x0}, 0x0) [ 300.085543] binder: undelivered TRANSACTION_COMPLETE [ 300.085552] binder: undelivered TRANSACTION_ERROR: 29189 [ 300.087941] binder: undelivered TRANSACTION_COMPLETE [ 300.087950] binder: undelivered TRANSACTION_ERROR: 29189 [ 300.957578] SELinux: failed to load policy 2018/02/01 04:11:20 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket(0x10, 0x3, 0xfffffffffffffffb) symlink(&(0x7f0000a25000)='./file0\x00', &(0x7f0000ef8000-0x8)='./file0\x00') rename(&(0x7f0000129000-0x8)='./file0\x00', &(0x7f0000673000-0x8)='./file0\x00') getsockopt$inet_sctp_SCTP_STATUS(r0, 0x84, 0xe, &(0x7f0000113000-0xb8)={0x0, 0x9, 0x1, 0x5, 0x6, 0x3, 0x100000000, 0x81, {0x0, @in6={{0xa, 0x2, 0x5, @loopback={0x0, 0x1}, 0x4}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x3, 0x40, 0x5b3, 0x5, 0x400}}, &(0x7f0000bf4000)=0xb8) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r0, 0x84, 0x18, &(0x7f00002f1000-0x6)={r1, 0x100}, &(0x7f000058e000-0x4)=0x6) recvfrom(r0, &(0x7f0000f2b000)=""/0, 0x0, 0x0, 0x0, 0x0) write(r0, &(0x7f000033e000)="240000005200079314f9f3f500070a000201030600000000400001000000000700000081", 0x24) [ 300.993408] binder: send failed reply for transaction 1326 to 14934:14938 [ 301.002181] kauditd_printk_skb: 692 callbacks suppressed 2018/02/01 04:11:20 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) seccomp(0x1, 0x0, &(0x7f000089b000-0x10)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x407ffc0003}]}) seccomp(0x1, 0x1, &(0x7f0000c9f000)={0x6, &(0x7f00004b2000)=[{0x8, 0x6, 0xff, 0x7c8bc3d3}, {0xffffffff, 0x4, 0x9, 0x600}, {0x0, 0x80000001, 0x9, 0x9}, {0x4, 0x53, 0x7ff, 0x7ff}, {0x401, 0x80000001, 0x400, 0x400}, {0x2, 0xfffffffffffffff8, 0x1ff, 0x9}]}) shmctl$IPC_INFO(0x0, 0x3, &(0x7f0000564000)=""/4096) 2018/02/01 04:11:20 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f0000590000-0x8)='./file0\x00', 0x14) write$selinux_create(r0, &(0x7f000074c000)=@access={'system_u:object_r:dpkg_exec_t:s0', 0x20, '/usr/sbin/cups-browsed', 0x20, 0x32, 0x30, 0x0}, 0x3b) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f00007cf000)='/dev/cuse\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_STATUS(r1, 0xc05c5340, &(0x7f0000b85000)={0x6, 0x100, 0x2, {0x0, 0x0}, 0x0, 0x4, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000801000-0x9)='/dev/ion\x00', 0x0, 0x0) r3 = syz_open_dev$binder(&(0x7f0000233000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r4 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0) r5 = dup2(r3, r4) write$tun(0xffffffffffffffff, &(0x7f0000577000)=@pi={0x0, 0x0, @eth={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x0}, [], {@canfd={0xd, {{0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0, "feb442a1f43ead325d71fed774c8f6028c2a6b79a4e418aa3c5f391769659fef9f596cdade428c389e511eaad39d2ee4334dee9516a31d00510baaf06efc0980"}}}}}, 0x5a) r6 = dup2(r4, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004ee000-0x76)='\x00', 0x1, 0x0, 0x0}], &(0x7f000000b000-0x30)=[]}}], 0x0, 0x0, &(0x7f0000009000)=""}) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f00005da000)={0x0, 0x0, &(0x7f00000d8000)=[], 0x48, 0x0, &(0x7f000044c000-0x83)="a410778b7a640ab0384c4ead541b6ee57c5645909ef688d8ac3e5ecfc7039f5f8ba53f127b7f01947cd3689eaf6c090277915bab2a0c450988cb85688e2bcc101a80664d3081fcc0"}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000c5a000)={0x0, 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000a95000-0x30)={0x14, 0x0, &(0x7f0000b8f000)=[@increfs_done={0x40106308, r7, 0x1}], 0x0, 0x0, &(0x7f00002e4000-0x70)=""}) getsockopt$inet6_dccp_buf(r5, 0x21, 0xcf, &(0x7f0000e10000-0xcc)=""/204, &(0x7f000037d000-0x4)=0xcc) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000436000-0x30)={0x20, 0x0, &(0x7f0000136000)=[@dead_binder_done={0x40086310, 0x3}, @increfs_done={0x40106308, r7, 0x0}], 0x0, 0x0, &(0x7f0000888000-0xb)=""}) close(r2) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000002000-0x38)={0x0, 0x0, &(0x7f0000003000)=[], 0x0, &(0x7f0000002000)=[{0x10, 0x10e, 0x0, ""}], 0x10, 0x0}, 0x0) 2018/02/01 04:11:21 executing program 1: openat$ion(0xffffffffffffff9c, &(0x7f0000801000-0x9)='/dev/ion\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000233000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) write$tun(0xffffffffffffffff, &(0x7f0000577000)=@pi={0x0, 0x0, @eth={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x0}, [], {@canfd={0xd, {{0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0, "feb442a1f43ead325d71fed774c8f6028c2a6b79a4e418aa3c5f391769659fef9f596cdade428c389e511eaad39d2ee4334dee9516a31d00510baaf06efc0980"}}}}}, 0x5a) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004ee000-0x76)='\x00', 0x1, 0x0, 0x0}], &(0x7f000000b000-0x30)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)=""}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00005da000)={0x0, 0x0, &(0x7f00000d8000)=[], 0x48, 0x0, &(0x7f000044c000-0x83)="a410778b7a640ab0384c4ead541b6ee57c5645909ef688d8ac3e5ecfc7039f5f8ba53f127b7f01947cd3689eaf6c090277915bab2a0c450988cb85688e2bcc101a80664d3081fcc0"}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000c5a000)={0x0, 0x0, 0x0, 0x0}) mmap(&(0x7f0000000000/0x13000)=nil, 0x13000, 0x0, 0x32, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000a95000-0x30)={0x14, 0x0, &(0x7f0000b8f000)=[@increfs_done={0x40106308, 0x0, 0x1}], 0x0, 0x0, &(0x7f00002e4000-0x70)=""}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000436000-0x30)={0x20, 0x0, &(0x7f0000136000)=[@dead_binder_done={0x40086310, 0x3}, @increfs_done={0x40106308, r3, 0x0}], 0x0, 0x0, &(0x7f0000888000-0xb)=""}) 2018/02/01 04:11:21 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$unix(0x1, 0x3, 0x0) bind$unix(r0, &(0x7f0000003000)=@file={0x1, "e91f7189591e9233614b"}, 0xc) getsockname(r0, &(0x7f0000a73000)=@pppol2tpv3in6={0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x0}}}, &(0x7f0000316000-0x4)=0x3a) r1 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000a05000-0x1e)='/selinux/commit_pending_bools\x00', 0x1, 0x0) ioctl$EVIOCGSND(r1, 0x8040451a, &(0x7f00002a9000-0x4e)=""/78) 2018/02/01 04:11:21 executing program 2: openat$ion(0xffffffffffffff9c, &(0x7f0000801000-0x9)='/dev/ion\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000233000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f00002b9000)='/dev/binder#\x00', 0xffffffffffffffff, 0x800000000000) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) write$tun(0xffffffffffffffff, &(0x7f0000577000)=@pi={0x0, 0x0, @eth={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x0}, [], {@canfd={0xd, {{0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0, "feb442a1f43ead325d71fed774c8f6028c2a6b79a4e418aa3c5f391769659fef9f596cdade428c389e511eaad39d2ee4334dee9516a31d00510baaf06efc0980"}}}}}, 0x5a) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004ee000-0x76)='\x00', 0x1, 0x0, 0x0}], &(0x7f000000b000-0x30)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)=""}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00005da000)={0x0, 0x0, &(0x7f00000d8000)=[], 0x48, 0x0, &(0x7f000044c000-0x83)="a410778b7a640ab0384c4ead541b6ee57c5645909ef688d8ac3e5ecfc7039f5f8ba53f127b7f01947cd3689eaf6c090277915bab2a0c450988cb85688e2bcc101a80664d3081fcc0"}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000c5a000)={0x0, 0x0, 0x0, 0x0}) mmap(&(0x7f0000000000/0x13000)=nil, 0x13000, 0x0, 0x32, 0xffffffffffffffff, 0x0) times(&(0x7f00006c1000-0x20)={0x0, 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000a95000-0x30)={0x14, 0x0, &(0x7f0000b8f000)=[@increfs_done={0x40106308, r3, 0x1}], 0x0, 0x0, &(0x7f00002e4000-0x70)=""}) 2018/02/01 04:11:21 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000)=0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000531000)='cpuset\x00') sendfile(r0, r0, &(0x7f00003a7000)=0x0, 0x400000ff) getsockopt$inet_sctp_SCTP_MAXSEG(r0, 0x84, 0xd, &(0x7f000058a000)=@assoc_id=0x0, &(0x7f0000d21000)=0x4) getsockopt$inet_sctp6_SCTP_MAXSEG(r0, 0x84, 0xd, &(0x7f0000015000)=@assoc_value={r1, 0x2}, &(0x7f00003db000-0x4)=0x8) ioctl$SNDRV_CTL_IOCTL_TLV_COMMAND(r0, 0xc008551c, &(0x7f00005ec000-0x24)={0x1f, 0x1c, [0x4, 0x2, 0x6, 0x20000000, 0x101, 0xcb13, 0x78b7]}) ioctl$EVIOCRMFF(r0, 0x40044581, &(0x7f0000dff000)=0x401) [ 301.002190] audit: type=1326 audit(1517458280.925:5312): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 pid=14936 comm="syz-executor4" exe="/root/syz-executor4" sig=0 arch=c000003e syscall=202 compat=0 ip=0x453299 code=0x7ffc0000 2018/02/01 04:11:21 executing program 7: mmap(&(0x7f0000000000/0x56000)=nil, 0x56000, 0x3, 0x32, 0xffffffffffffffff, 0x0) unshare(0x8000400) mq_open(&(0x7f000004b000)='/$cgrouplo\x00', 0x42, 0x0, &(0x7f000004b000)={0x3, 0x7, 0x3, 0x0, 0x0, 0x3, 0x0, 0x0}) select(0x40, &(0x7f0000039000-0x40)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f0000001000-0x40)={0x80200, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f0000032000-0x40)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f000004c000)={0x77359400, 0x0}) [ 301.004290] binder: 14934:14938 BC_INCREFS_DONE u0000000000000000 no match [ 301.004372] binder: 14934:14938 BC_DEAD_BINDER_DONE 0000000000000003 not found [ 301.004384] binder: 14934:14938 BC_INCREFS_DONE u00000000204edf8a node 1327 cookie mismatch 0000000000000000 != 0000000000000001 [ 301.012068] binder: BINDER_SET_CONTEXT_MGR already set [ 301.012076] binder: 14930:14939 ioctl 40046207 0 returned -16 [ 301.015138] binder: 14930:14939 BC_INCREFS_DONE u0000000000000000 no match 2018/02/01 04:11:21 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f0000590000-0x8)='./file0\x00', 0x14) write$selinux_create(r0, &(0x7f000074c000)=@access={'system_u:object_r:dpkg_exec_t:s0', 0x20, '/usr/sbin/cups-browsed', 0x20, 0x32, 0x30, 0x0}, 0x3b) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f00007cf000)='/dev/cuse\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_STATUS(r1, 0xc05c5340, &(0x7f0000b85000)={0x6, 0x100, 0x2, {0x0, 0x0}, 0x0, 0x4, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000801000-0x9)='/dev/ion\x00', 0x0, 0x0) r3 = syz_open_dev$binder(&(0x7f0000233000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r4 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0) r5 = dup2(r3, r4) write$tun(0xffffffffffffffff, &(0x7f0000577000)=@pi={0x0, 0x0, @eth={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x0}, [], {@canfd={0xd, {{0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0, "feb442a1f43ead325d71fed774c8f6028c2a6b79a4e418aa3c5f391769659fef9f596cdade428c389e511eaad39d2ee4334dee9516a31d00510baaf06efc0980"}}}}}, 0x5a) r6 = dup2(r4, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004ee000-0x76)='\x00', 0x1, 0x0, 0x0}], &(0x7f000000b000-0x30)=[]}}], 0x0, 0x0, &(0x7f0000009000)=""}) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f00005da000)={0x0, 0x0, &(0x7f00000d8000)=[], 0x48, 0x0, &(0x7f000044c000-0x83)="a410778b7a640ab0384c4ead541b6ee57c5645909ef688d8ac3e5ecfc7039f5f8ba53f127b7f01947cd3689eaf6c090277915bab2a0c450988cb85688e2bcc101a80664d3081fcc0"}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000c5a000)={0x0, 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000a95000-0x30)={0x14, 0x0, &(0x7f0000b8f000)=[@increfs_done={0x40106308, r7, 0x1}], 0x0, 0x0, &(0x7f00002e4000-0x70)=""}) getsockopt$inet6_dccp_buf(r5, 0x21, 0xcf, &(0x7f0000e10000-0xcc)=""/204, &(0x7f000037d000-0x4)=0xcc) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000436000-0x30)={0x20, 0x0, &(0x7f0000136000)=[@dead_binder_done={0x40086310, 0x3}, @increfs_done={0x40106308, r7, 0x0}], 0x0, 0x0, &(0x7f0000888000-0xb)=""}) close(r2) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000002000-0x38)={0x0, 0x0, &(0x7f0000003000)=[], 0x0, &(0x7f0000002000)=[{0x10, 0x10e, 0x0, ""}], 0x10, 0x0}, 0x0) 2018/02/01 04:11:21 executing program 1: openat$ion(0xffffffffffffff9c, &(0x7f0000801000-0x9)='/dev/ion\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000233000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) write$tun(0xffffffffffffffff, &(0x7f0000577000)=@pi={0x0, 0x0, @eth={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x0}, [], {@canfd={0xd, {{0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0, "feb442a1f43ead325d71fed774c8f6028c2a6b79a4e418aa3c5f391769659fef9f596cdade428c389e511eaad39d2ee4334dee9516a31d00510baaf06efc0980"}}}}}, 0x5a) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004ee000-0x76)='\x00', 0x1, 0x0, 0x0}], &(0x7f000000b000-0x30)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)=""}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00005da000)={0x0, 0x0, &(0x7f00000d8000)=[], 0x48, 0x0, &(0x7f000044c000-0x83)="a410778b7a640ab0384c4ead541b6ee57c5645909ef688d8ac3e5ecfc7039f5f8ba53f127b7f01947cd3689eaf6c090277915bab2a0c450988cb85688e2bcc101a80664d3081fcc0"}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000c5a000)={0x0, 0x0, 0x0, 0x0}) mmap(&(0x7f0000000000/0x13000)=nil, 0x13000, 0x0, 0x32, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000a95000-0x30)={0x14, 0x0, &(0x7f0000b8f000)=[@increfs_done={0x40106308, 0x0, 0x1}], 0x0, 0x0, &(0x7f00002e4000-0x70)=""}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000436000-0x30)={0x20, 0x0, &(0x7f0000136000)=[@dead_binder_done={0x40086310, 0x3}, @increfs_done={0x40106308, r3, 0x0}], 0x0, 0x0, &(0x7f0000888000-0xb)=""}) 2018/02/01 04:11:21 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) seccomp(0x1, 0x0, &(0x7f000089b000-0x10)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x407ffc0003}]}) pipe2(&(0x7f0000138000)={0x0, 0x0}, 0x80000) ioctl$EVIOCGID(r0, 0x80084502, &(0x7f000033b000-0x1000)=""/4096) 2018/02/01 04:11:21 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket(0x0, 0x0, 0x0) perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000)=0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$getownex(r0, 0x10, &(0x7f0000304000-0x8)={0x0, 0x0}) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f00001d4000)='/dev/cuse\x00', 0x2, 0x0) ioctl$KVM_SET_REGS(r1, 0x4090ae82, &(0x7f00007ff000)={[0x1, 0x9, 0x7, 0x7fffffff, 0x1f, 0x8d, 0x101, 0x1f, 0xfff, 0x400, 0x10001, 0x80, 0x8, 0x21f6, 0x3, 0xa06], 0x0, 0x201}) pread64(r1, &(0x7f0000a4c000)=""/56, 0x6, 0x0) getsockopt$inet_sctp_SCTP_CONTEXT(r0, 0x84, 0x11, &(0x7f00005d9000-0x8)={0x0, 0x2}, &(0x7f000052c000)=0x8) ioctl$SNDRV_TIMER_IOCTL_STOP(r1, 0x54a1) setsockopt$inet_sctp6_SCTP_AUTH_DELETE_KEY(r0, 0x84, 0x19, &(0x7f0000c85000)={r2, 0x9a88}, 0x6) write$fuse(r1, &(0x7f0000391000-0x21)={0x28, 0x0, 0x1, @fuse_notify_inval_inode_out={0x0, 0x0, 0x0}}, 0x28) 2018/02/01 04:11:21 executing program 3: mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$audion(&(0x7f0000001000-0xc)='/dev/audio#\x00', 0x9, 0xa4040) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) setsockopt$kcm_KCM_RECV_DISABLE(r0, 0x119, 0x1, &(0x7f0000001000-0x4)=0x1, 0x4) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$evdev(&(0x7f000007a000-0x12)='/dev/input/event#\x00', 0x0, 0x1) r2 = epoll_create(0x5) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r1, &(0x7f000070d000-0xc)={0x0, 0x0}) write$evdev(r1, &(0x7f0000058000-0x60)=[{{0x100000, 0x0}, 0x0, 0x100000001, 0x0}, {{0x0, 0x0}, 0x0, 0x0, 0x0}], 0x30) 2018/02/01 04:11:21 executing program 2: openat$ion(0xffffffffffffff9c, &(0x7f0000801000-0x9)='/dev/ion\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000233000-0xd)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$dspn(&(0x7f0000a42000-0xa)='/dev/dsp#\x00', 0x0, 0x200000) ioctl$EVIOCSREP(r2, 0x40084503, &(0x7f000016a000-0x8)=[0x7, 0x5]) dup2(r2, r0) write$tun(0xffffffffffffffff, &(0x7f0000577000)=@pi={0x0, 0x0, @eth={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x0}, [], {@canfd={0xd, {{0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0, "feb442a1f43ead325d71fed774c8f6028c2a6b79a4e418aa3c5f391769659fef9f596cdade428c389e511eaad39d2ee4334dee9516a31d00510baaf06efc0980"}}}}}, 0x5a) r3 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004ee000-0x76)='\x00', 0x1, 0x0, 0x0}], &(0x7f000000b000-0x30)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)=""}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00005da000)={0x0, 0x0, &(0x7f00000d8000)=[], 0x48, 0x0, &(0x7f000044c000-0x83)="a410778b7a640ab0384c4ead541b6ee57c5645909ef688d8ac3e5ecfc7039f5f8ba53f127b7f01947cd3689eaf6c090277915bab2a0c450988cb85688e2bcc101a80664d3081fcc0"}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000c5a000)={0x0, 0x0, 0x0, 0x0}) mmap(&(0x7f0000000000/0x13000)=nil, 0x13000, 0x0, 0x32, 0xffffffffffffffff, 0x0) mq_timedsend(r2, &(0x7f0000c42000)="cd5a396d885398d2302aad5b7c2cf97ac4a9b1738bbb42ac5852ca0e534fb95bcafcfa1c8d5b1678757d4c27fa3e2d763e1d5d9b595788ab75dfef61dee506fb0e76c8640f1ac42e4eaa1c35206a5b0f087927d54a497fe99f9b6520e34828a5a6a4d31aa0d662a954ec3039d7a129d98555d956de2741b81b7bf654bab73f9d6d20e1a52086baf6295e730a1bc857da4bd2a7108482d3b05a884a2db30bb3790950e23456d6068d194b86f629125dc8dc77cf01bee2f3849de82dbcf75409920e844917428f8f3e304302973f812e71521953e50eacb1f3bec4e47b005cfdac", 0xe0, 0x1000, &(0x7f0000636000)={0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000a95000-0x30)={0x14, 0x0, &(0x7f0000b8f000)=[@increfs_done={0x40106308, r4, 0x1}], 0x0, 0x0, &(0x7f00002e4000-0x70)=""}) 2018/02/01 04:11:21 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) futex(&(0x7f00001d7000)=0x0, 0x4000000005, 0x0, &(0x7f0000199000-0x10)={0x0, 0x0}, &(0x7f0000a29000-0x4)=0x0, 0x55da77f243942654) clock_gettime(0x0, &(0x7f0000bc7000-0x10)={0x0, 0x0}) pselect6(0x40, &(0x7f0000cf3000)={0x10001, 0x1, 0xe2, 0x6, 0xffffffffffffff01, 0x3ff, 0x9, 0x6}, &(0x7f0000209000-0x40)={0x1, 0x3ff, 0x4, 0x5, 0x5, 0x2, 0x7, 0x3}, &(0x7f00008f3000-0x40)={0x0, 0x101, 0x3, 0x2, 0x0, 0x1000, 0x1541275a, 0x3}, &(0x7f0000751000)={r0, r1+30000000}, &(0x7f00004b3000)={&(0x7f0000787000)={0x80}, 0x8}) 2018/02/01 04:11:21 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = accept4(0xffffffffffffffff, &(0x7f0000d50000)=@rc={0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0}, &(0x7f0000aae000-0x4)=0x1bfb00964e2bd037, 0x7fffe) r1 = syz_open_dev$sg(&(0x7f000060b000)='/dev/sg#\x00', 0xffffffffffffffe1, 0x200000) bpf$BPF_PROG_ATTACH(0x8, &(0x7f000010c000)={r0, r1, 0x4, 0x3}, 0x10) getsockopt$inet_sctp_SCTP_HMAC_IDENT(r0, 0x84, 0x16, &(0x7f000046a000-0x10)={0x6, [0x90000000, 0x9, 0x7f, 0x5, 0x5, 0x5]}, &(0x7f000056b000)=0x10) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000a8d000)={&(0x7f0000e4e000)={0x10, 0x0, 0x0, 0x0}, 0xc, &(0x7f0000fcf000-0x10)={&(0x7f00005d5000)=@updsa={0x104, 0x1a, 0x1, 0xffffffffffffffff, 0xffffffffffffffff, {{@in6=@local={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0xffffffffffffffff, 0xaa}, @in=@dev={0xac, 0x14, 0xffffffffffffffff, 0x0}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0}, {@in=@broadcast=0xffffffff, 0xffffffffffffffff, 0x2b}, @in=@multicast2=0xe0000002, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, {0x0, 0x0, 0x0, 0x0}, {0x0, 0x0, 0x0}, 0xffffffffffffffff, 0xffffffffffffffff, 0xa, 0x2, 0x0, 0x0}, [@coaddr={0x14, 0xe, @in=@remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}}]}, 0x104}, 0x1, 0x0, 0x0, 0x0}, 0x0) [ 301.025300] binder: send failed reply for transaction 1330 to 14930:14939 [ 301.025313] binder: send failed reply for transaction 1331 to 14933:14937 [ 301.036837] binder: send failed reply for transaction 1335 to 14933:14937 2018/02/01 04:11:21 executing program 1: openat$ion(0xffffffffffffff9c, &(0x7f0000801000-0x9)='/dev/ion\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000233000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) write$tun(0xffffffffffffffff, &(0x7f0000577000)=@pi={0x0, 0x0, @eth={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x0}, [], {@canfd={0xd, {{0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0, "feb442a1f43ead325d71fed774c8f6028c2a6b79a4e418aa3c5f391769659fef9f596cdade428c389e511eaad39d2ee4334dee9516a31d00510baaf06efc0980"}}}}}, 0x5a) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004ee000-0x76)='\x00', 0x1, 0x0, 0x0}], &(0x7f000000b000-0x30)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)=""}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00005da000)={0x0, 0x0, &(0x7f00000d8000)=[], 0x48, 0x0, &(0x7f000044c000-0x83)="a410778b7a640ab0384c4ead541b6ee57c5645909ef688d8ac3e5ecfc7039f5f8ba53f127b7f01947cd3689eaf6c090277915bab2a0c450988cb85688e2bcc101a80664d3081fcc0"}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000c5a000)={0x0, 0x0, 0x0, 0x0}) mmap(&(0x7f0000000000/0x13000)=nil, 0x13000, 0x0, 0x32, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000a95000-0x30)={0x14, 0x0, &(0x7f0000b8f000)=[@increfs_done={0x40106308, r3, 0x0}], 0x0, 0x0, &(0x7f00002e4000-0x70)=""}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000436000-0x30)={0x20, 0x0, &(0x7f0000136000)=[@dead_binder_done={0x40086310, 0x3}, @increfs_done={0x40106308, r3, 0x0}], 0x0, 0x0, &(0x7f0000888000-0xb)=""}) [ 301.103408] binder: undelivered TRANSACTION_COMPLETE 2018/02/01 04:11:21 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) unshare(0x8000400) perf_event_open(&(0x7f00000bf000)={0x0, 0x78, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000)=0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0x0, 0xffffffffffffffff, 0xc) seccomp(0x1, 0x0, &(0x7f000089b000-0x10)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x407ffc0003}]}) shmctl$IPC_INFO(0x0, 0x3, &(0x7f0000564000)=""/4096) 2018/02/01 04:11:21 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f0000590000-0x8)='./file0\x00', 0x14) write$selinux_create(r0, &(0x7f000074c000)=@access={'system_u:object_r:dpkg_exec_t:s0', 0x20, '/usr/sbin/cups-browsed', 0x20, 0x32, 0x30, 0x0}, 0x3b) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f00007cf000)='/dev/cuse\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_STATUS(r1, 0xc05c5340, &(0x7f0000b85000)={0x6, 0x100, 0x2, {0x0, 0x0}, 0x0, 0x4, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000801000-0x9)='/dev/ion\x00', 0x0, 0x0) r3 = syz_open_dev$binder(&(0x7f0000233000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r4 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0) r5 = dup2(r3, r4) write$tun(0xffffffffffffffff, &(0x7f0000577000)=@pi={0x0, 0x0, @eth={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x0}, [], {@canfd={0xd, {{0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0, "feb442a1f43ead325d71fed774c8f6028c2a6b79a4e418aa3c5f391769659fef9f596cdade428c389e511eaad39d2ee4334dee9516a31d00510baaf06efc0980"}}}}}, 0x5a) r6 = dup2(r4, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004ee000-0x76)='\x00', 0x1, 0x0, 0x0}], &(0x7f000000b000-0x30)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)=""}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00005da000)={0x0, 0x0, &(0x7f00000d8000)=[], 0x48, 0x0, &(0x7f000044c000-0x83)="a410778b7a640ab0384c4ead541b6ee57c5645909ef688d8ac3e5ecfc7039f5f8ba53f127b7f01947cd3689eaf6c090277915bab2a0c450988cb85688e2bcc101a80664d3081fcc0"}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000c5a000)={0x0, 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000a95000-0x30)={0x14, 0x0, &(0x7f0000b8f000)=[@increfs_done={0x40106308, r7, 0x1}], 0x0, 0x0, &(0x7f00002e4000-0x70)=""}) getsockopt$inet6_dccp_buf(r5, 0x21, 0xcf, &(0x7f0000e10000-0xcc)=""/204, &(0x7f000037d000-0x4)=0xcc) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000436000-0x30)={0x20, 0x0, &(0x7f0000136000)=[@dead_binder_done={0x40086310, 0x3}, @increfs_done={0x40106308, r7, 0x0}], 0x0, 0x0, &(0x7f0000888000-0xb)=""}) close(r2) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000002000-0x38)={0x0, 0x0, &(0x7f0000003000)=[], 0x0, &(0x7f0000002000)=[{0x10, 0x10e, 0x0, ""}], 0x10, 0x0}, 0x0) 2018/02/01 04:11:21 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp\x00', 0x0, 0x0) r1 = getpgrp(0xffffffffffffffff) ioprio_get$pid(0x2, r1) read$eventfd(r0, &(0x7f0000001000)=0x0, 0x8) mmap$binder(&(0x7f0000fba000/0x12000)=nil, 0x12000, 0x3000005, 0x4012, r0, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12, 0x0, @tid=0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, &(0x7f0000044000)=0x0) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)={{0x0, 0x0}, {0x0, 0x0}}) tkill(r2, 0x15) 2018/02/01 04:11:21 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$rds(0x15, 0x5, 0x0) ioctl$sock_inet_SIOCSIFDSTADDR(r0, 0x8918, &(0x7f0000f4d000-0x20)={@syzn={0x73, 0x79, 0x7a, 0x0, 0x0}, @ifru_addrs={0x2, 0x0, @loopback=0x7f000001, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}}) r1 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f00004c1000)='/selinux/commit_pending_bools\x00', 0x1, 0x0) clock_gettime(0x9, &(0x7f00004f8000)={0x0, 0x0}) request_key(&(0x7f0000d9e000-0xa)='id_legacy\x00', &(0x7f000012d000)={0x73, 0x79, 0x7a, 0xffffffffffffffff, 0x0}, &(0x7f00008eb000-0x34)='selinuxprocposix_acl_access^.)em0)vmnet1security(/(\x00', 0xfffffffffffffffe) getsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000624000-0xa0)={0x0, @in={{0x2, 0x1, @multicast1=0xe0000001, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x5, 0xffffffff, 0x4f4a, 0x2c8, 0x0}, &(0x7f0000d5f000-0x4)=0xa0) setsockopt$inet_sctp6_SCTP_MAXSEG(r1, 0x84, 0xd, &(0x7f00001dc000)=@assoc_value={r2, 0x0}, 0x8) keyctl$revoke(0x3, 0x0) ioctl$sock_SIOCGPGRP(r1, 0x8904, &(0x7f00008bd000)=0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(r1, 0xc1105511, &(0x7f0000aa3000)={{0x4, 0x0, 0x9, 0x6, "cb5b960f9496f1bfe8318df57a89c223a9b952ee975717c402bc6acc00b17652401e7c9e098f2e5fd7cde452", 0x10001}, 0x0, 0x0, 0x1, r3, 0x1, 0x101, "1c865fca4fe757c85a99b6b3ea0f24a6f06ec2be18f6d8ef380f5f66dab0226bbe317c256b7df5385e3a9832372e8748f37838c289b6a1e7c7ec4df96ddfa202", &(0x7f0000dec000)='id_legacy\x00', 0xa, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], [0x3, 0xfff, 0x41, 0x400000000000000], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) getsockopt$sock_int(r1, 0x1, 0x2f, &(0x7f0000571000-0x4)=0x0, &(0x7f0000523000-0x4)=0x4) [ 301.103417] binder: undelivered TRANSACTION_ERROR: 29189 [ 301.103448] binder: undelivered TRANSACTION_COMPLETE [ 301.103454] binder: undelivered TRANSACTION_ERROR: 29189 2018/02/01 04:11:21 executing program 2: openat$ion(0xffffffffffffff9c, &(0x7f0000801000-0x9)='/dev/ion\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000233000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) socket(0x0, 0x800, 0xdc79) r2 = syz_open_dev$usbmon(&(0x7f000042b000)='/dev/usbmon#\x00', 0x4, 0x20000) ioctl$RNDZAPENTCNT(r2, 0x5204, &(0x7f0000f67000)=0x6) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) write$tun(0xffffffffffffffff, &(0x7f0000577000)=@pi={0x0, 0x0, @eth={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x0}, [], {@canfd={0xd, {{0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0, "feb442a1f43ead325d71fed774c8f6028c2a6b79a4e418aa3c5f391769659fef9f596cdade428c389e511eaad39d2ee4334dee9516a31d00510baaf06efc0980"}}}}}, 0x5a) r3 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004ee000-0x76)='\x00', 0x1, 0x0, 0x0}], &(0x7f000000b000-0x30)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)=""}) socket$nl_crypto(0x10, 0x3, 0x15) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00005da000)={0x0, 0x0, &(0x7f00000d8000)=[], 0x48, 0x0, &(0x7f000044c000-0x83)="a410778b7a640ab0384c4ead541b6ee57c5645909ef688d8ac3e5ecfc7039f5f8ba53f127b7f01947cd3689eaf6c090277915bab2a0c450988cb85688e2bcc101a80664d3081fcc0"}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000c5a000)={0x0, 0x0, 0x0, 0x0}) mmap(&(0x7f0000000000/0x13000)=nil, 0x13000, 0x0, 0x32, 0xffffffffffffffff, 0x0) ioctl$DRM_IOCTL_CONTROL(r3, 0x40086414, &(0x7f0000970000)={0x0, 0x1000}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000a95000-0x30)={0x14, 0x0, &(0x7f0000b8f000)=[@increfs_done={0x40106308, r4, 0x1}], 0x0, 0x0, &(0x7f00002e4000-0x70)=""}) getsockopt$ax25_buf(r3, 0x101, 0x19, &(0x7f000007b000-0xbf)=""/191, &(0x7f0000620000-0x4)=0xbf) [ 301.103506] binder: undelivered TRANSACTION_COMPLETE [ 301.103512] binder: undelivered TRANSACTION_ERROR: 29189 [ 301.103561] binder: undelivered TRANSACTION_COMPLETE [ 301.103567] binder: undelivered TRANSACTION_ERROR: 29189 [ 301.108518] binder: BINDER_SET_CONTEXT_MGR already set [ 301.108527] binder: 14951:14954 ioctl 40046207 0 returned -16 [ 301.110936] binder: 14951:14954 BC_INCREFS_DONE u0000000000000000 no match [ 301.114254] binder: send failed reply for transaction 1339 to 14951:14954 [ 301.114269] binder: send failed reply for transaction 1340 to 14953:14955 [ 301.119233] binder: 14953:14955 BC_INCREFS_DONE u0000000000000000 no match [ 301.124656] binder: 14953:14955 BC_DEAD_BINDER_DONE 0000000000000003 not found 2018/02/01 04:11:21 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f0000590000-0x8)='./file0\x00', 0x14) write$selinux_create(r0, &(0x7f000074c000)=@access={'system_u:object_r:dpkg_exec_t:s0', 0x20, '/usr/sbin/cups-browsed', 0x20, 0x32, 0x30, 0x0}, 0x3b) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f00007cf000)='/dev/cuse\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_STATUS(r1, 0xc05c5340, &(0x7f0000b85000)={0x6, 0x100, 0x2, {0x0, 0x0}, 0x0, 0x4, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000801000-0x9)='/dev/ion\x00', 0x0, 0x0) r3 = syz_open_dev$binder(&(0x7f0000233000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r4 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0) r5 = dup2(r3, r4) write$tun(0xffffffffffffffff, &(0x7f0000577000)=@pi={0x0, 0x0, @eth={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x0}, [], {@canfd={0xd, {{0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0, "feb442a1f43ead325d71fed774c8f6028c2a6b79a4e418aa3c5f391769659fef9f596cdade428c389e511eaad39d2ee4334dee9516a31d00510baaf06efc0980"}}}}}, 0x5a) r6 = dup2(r4, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004ee000-0x76)='\x00', 0x1, 0x0, 0x0}], &(0x7f000000b000-0x30)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)=""}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00005da000)={0x0, 0x0, &(0x7f00000d8000)=[], 0x48, 0x0, &(0x7f000044c000-0x83)="a410778b7a640ab0384c4ead541b6ee57c5645909ef688d8ac3e5ecfc7039f5f8ba53f127b7f01947cd3689eaf6c090277915bab2a0c450988cb85688e2bcc101a80664d3081fcc0"}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000c5a000)={0x0, 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000a95000-0x30)={0x14, 0x0, &(0x7f0000b8f000)=[@increfs_done={0x40106308, r7, 0x1}], 0x0, 0x0, &(0x7f00002e4000-0x70)=""}) getsockopt$inet6_dccp_buf(r5, 0x21, 0xcf, &(0x7f0000e10000-0xcc)=""/204, &(0x7f000037d000-0x4)=0xcc) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000436000-0x30)={0x20, 0x0, &(0x7f0000136000)=[@dead_binder_done={0x40086310, 0x3}, @increfs_done={0x40106308, r7, 0x0}], 0x0, 0x0, &(0x7f0000888000-0xb)=""}) close(r2) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000002000-0x38)={0x0, 0x0, &(0x7f0000003000)=[], 0x0, &(0x7f0000002000)=[{0x10, 0x10e, 0x0, ""}], 0x10, 0x0}, 0x0) 2018/02/01 04:11:21 executing program 1: openat$ion(0xffffffffffffff9c, &(0x7f0000801000-0x9)='/dev/ion\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000233000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) write$tun(0xffffffffffffffff, &(0x7f0000577000)=@pi={0x0, 0x0, @eth={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x0}, [], {@canfd={0xd, {{0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0, "feb442a1f43ead325d71fed774c8f6028c2a6b79a4e418aa3c5f391769659fef9f596cdade428c389e511eaad39d2ee4334dee9516a31d00510baaf06efc0980"}}}}}, 0x5a) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004ee000-0x76)='\x00', 0x1, 0x0, 0x0}], &(0x7f000000b000-0x30)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)=""}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00005da000)={0x0, 0x0, &(0x7f00000d8000)=[], 0x48, 0x0, &(0x7f000044c000-0x83)="a410778b7a640ab0384c4ead541b6ee57c5645909ef688d8ac3e5ecfc7039f5f8ba53f127b7f01947cd3689eaf6c090277915bab2a0c450988cb85688e2bcc101a80664d3081fcc0"}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000c5a000)={0x0, 0x0, 0x0, 0x0}) mmap(&(0x7f0000000000/0x13000)=nil, 0x13000, 0x0, 0x32, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000a95000-0x30)={0x14, 0x0, &(0x7f0000b8f000)=[@increfs_done={0x40106308, r3, 0x0}], 0x0, 0x0, &(0x7f00002e4000-0x70)=""}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000436000-0x30)={0x20, 0x0, &(0x7f0000136000)=[@dead_binder_done={0x40086310, 0x3}, @increfs_done={0x40106308, r3, 0x0}], 0x0, 0x0, &(0x7f0000888000-0xb)=""}) 2018/02/01 04:11:21 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$evdev(&(0x7f00003fc000-0x12)='/dev/input/event#\x00', 0xafd, 0x8000040000001) write$evdev(r0, &(0x7f0000585000-0x48)=[{{0x0, 0x0}, 0x2, 0x800, 0x0}], 0x18) r1 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f00009d5000-0x11)='/dev/vga_arbiter\x00', 0xa40, 0x0) setsockopt$ax25_int(r1, 0x101, 0xc, &(0x7f0000a35000-0x4)=0x9, 0x4) 2018/02/01 04:11:21 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) seccomp(0x1, 0x0, &(0x7f000089b000-0x10)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x407ffc0003}]}) shmget(0x3, 0x4000, 0xe00, &(0x7f0000a24000/0x4000)=nil) shmctl$IPC_INFO(0x0, 0x3, &(0x7f0000564000)=""/4096) 2018/02/01 04:11:21 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000)=0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fchmod(r0, 0x1) r1 = syz_open_procfs(0x0, &(0x7f0000bdb000-0x11)='net/ip6_mr_cache\x00') prctl$getreaper(0x19, &(0x7f00004f0000)=0x0) read(r1, &(0x7f0000486000-0x8c)=""/140, 0x8c) 2018/02/01 04:11:21 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$vnet(0xffffffffffffff9c, &(0x7f00003de000)='/dev/vhost-net\x00', 0x2, 0x0) perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000)=0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0x0, 0xffffffffffffffff, 0x0) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000e55000)={{{@in6=@ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], [0x0, 0x0], @local={0x0, 0x0, 0xffffffffffffffff, 0x0}}, @in=@local={0x0, 0x0, 0xffffffffffffffff, 0x0}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, {0x0, 0x0, 0x0, 0x0}, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, {{@in=@multicast1=0x0, 0xffffffffffffffff, 0x0}, 0x0, @in=@multicast1=0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, &(0x7f000073f000-0x4)=0xe8) ioctl$TUNSETOWNER(r0, 0x400454cc, &(0x7f00004ad000-0x4)=r1) ioctl$int_in(r0, 0x0, &(0x7f00001e3000)=0x0) 2018/02/01 04:11:21 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000a8d000)={&(0x7f0000e4e000)={0x10, 0x0, 0x0, 0x0}, 0xc, &(0x7f0000fcf000-0x10)={&(0x7f00005d5000)=@updsa={0x104, 0x1a, 0x1, 0xffffffffffffffff, 0xffffffffffffffff, {{@in6=@local={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0xffffffffffffffff, 0xaa}, @in=@dev={0xac, 0x14, 0xffffffffffffffff, 0x0}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0}, {@in=@broadcast=0xffffffff, 0xffffffffffffffff, 0x2b}, @in=@multicast2=0xe0000002, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, {0x0, 0x0, 0x0, 0x0}, {0x0, 0x0, 0x0}, 0xffffffffffffffff, 0xffffffffffffffff, 0xa, 0x2, 0x0, 0x0}, [@coaddr={0x14, 0xe, @in=@remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}}]}, 0x104}, 0x1, 0x0, 0x0, 0x0}, 0x0) socketpair$inet6(0xa, 0x4, 0x10001, &(0x7f0000306000)={0x0, 0x0}) socket$nl_crypto(0x10, 0x3, 0x15) 2018/02/01 04:11:21 executing program 2: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000801000-0x9)='/dev/ion\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000233000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) dup2(r1, r2) write$tun(0xffffffffffffffff, &(0x7f0000577000)=@pi={0x0, 0x0, @eth={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x0}, [], {@canfd={0xd, {{0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0, "feb442a1f43ead325d71fed774c8f6028c2a6b79a4e418aa3c5f391769659fef9f596cdade428c389e511eaad39d2ee4334dee9516a31d00510baaf06efc0980"}}}}}, 0x5a) r3 = dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004ee000-0x76)='\x00', 0x1, 0x0, 0x0}], &(0x7f000000b000-0x30)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)=""}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00005da000)={0x0, 0x0, &(0x7f00000d8000)=[], 0x48, 0x0, &(0x7f000044c000-0x83)="a410778b7a640ab0384c4ead541b6ee57c5645909ef688d8ac3e5ecfc7039f5f8ba53f127b7f01947cd3689eaf6c090277915bab2a0c450988cb85688e2bcc101a80664d3081fcc0"}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000c5a000)={0x0, 0x0, 0x0, 0x0}) mmap(&(0x7f0000000000/0x13000)=nil, 0x13000, 0x0, 0x32, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000a95000-0x30)={0x14, 0x0, &(0x7f0000b8f000)=[@increfs_done={0x40106308, r4, 0x1}], 0x0, 0x0, &(0x7f00002e4000-0x70)=""}) [ 301.124678] binder: 14953:14955 BC_INCREFS_DONE u00000000204edf8a node 1341 cookie mismatch 0000000000000000 != 0000000000000001 [ 301.133707] binder: send failed reply for transaction 1344 to 14957:14962 [ 301.135197] binder: undelivered TRANSACTION_COMPLETE [ 301.135209] binder: undelivered TRANSACTION_ERROR: 29189 [ 301.146220] binder: undelivered TRANSACTION_COMPLETE [ 301.146235] binder: undelivered TRANSACTION_ERROR: 29189 [ 301.180471] binder: 14957:14962 transaction failed 29189/-22, size 40-8 line 2788 2018/02/01 04:11:21 executing program 1: openat$ion(0xffffffffffffff9c, &(0x7f0000801000-0x9)='/dev/ion\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000233000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) write$tun(0xffffffffffffffff, &(0x7f0000577000)=@pi={0x0, 0x0, @eth={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x0}, [], {@canfd={0xd, {{0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0, "feb442a1f43ead325d71fed774c8f6028c2a6b79a4e418aa3c5f391769659fef9f596cdade428c389e511eaad39d2ee4334dee9516a31d00510baaf06efc0980"}}}}}, 0x5a) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004ee000-0x76)='\x00', 0x1, 0x0, 0x0}], &(0x7f000000b000-0x30)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)=""}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00005da000)={0x0, 0x0, &(0x7f00000d8000)=[], 0x48, 0x0, &(0x7f000044c000-0x83)="a410778b7a640ab0384c4ead541b6ee57c5645909ef688d8ac3e5ecfc7039f5f8ba53f127b7f01947cd3689eaf6c090277915bab2a0c450988cb85688e2bcc101a80664d3081fcc0"}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000c5a000)={0x0, 0x0, 0x0, 0x0}) mmap(&(0x7f0000000000/0x13000)=nil, 0x13000, 0x0, 0x32, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000a95000-0x30)={0x14, 0x0, &(0x7f0000b8f000)=[@increfs_done={0x40106308, r3, 0x0}], 0x0, 0x0, &(0x7f00002e4000-0x70)=""}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000436000-0x30)={0x20, 0x0, &(0x7f0000136000)=[@dead_binder_done={0x40086310, 0x3}, @increfs_done={0x40106308, r3, 0x0}], 0x0, 0x0, &(0x7f0000888000-0xb)=""}) 2018/02/01 04:11:21 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f0000590000-0x8)='./file0\x00', 0x14) write$selinux_create(r0, &(0x7f000074c000)=@access={'system_u:object_r:dpkg_exec_t:s0', 0x20, '/usr/sbin/cups-browsed', 0x20, 0x32, 0x30, 0x0}, 0x3b) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f00007cf000)='/dev/cuse\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_STATUS(r1, 0xc05c5340, &(0x7f0000b85000)={0x6, 0x100, 0x2, {0x0, 0x0}, 0x0, 0x4, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000801000-0x9)='/dev/ion\x00', 0x0, 0x0) r3 = syz_open_dev$binder(&(0x7f0000233000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r4 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0) r5 = dup2(r3, r4) write$tun(0xffffffffffffffff, &(0x7f0000577000)=@pi={0x0, 0x0, @eth={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x0}, [], {@canfd={0xd, {{0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0, "feb442a1f43ead325d71fed774c8f6028c2a6b79a4e418aa3c5f391769659fef9f596cdade428c389e511eaad39d2ee4334dee9516a31d00510baaf06efc0980"}}}}}, 0x5a) r6 = dup2(r4, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004ee000-0x76)='\x00', 0x1, 0x0, 0x0}], &(0x7f000000b000-0x30)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)=""}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00005da000)={0x0, 0x0, &(0x7f00000d8000)=[], 0x48, 0x0, &(0x7f000044c000-0x83)="a410778b7a640ab0384c4ead541b6ee57c5645909ef688d8ac3e5ecfc7039f5f8ba53f127b7f01947cd3689eaf6c090277915bab2a0c450988cb85688e2bcc101a80664d3081fcc0"}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000c5a000)={0x0, 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000a95000-0x30)={0x14, 0x0, &(0x7f0000b8f000)=[@increfs_done={0x40106308, r7, 0x1}], 0x0, 0x0, &(0x7f00002e4000-0x70)=""}) getsockopt$inet6_dccp_buf(r5, 0x21, 0xcf, &(0x7f0000e10000-0xcc)=""/204, &(0x7f000037d000-0x4)=0xcc) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000436000-0x30)={0x20, 0x0, &(0x7f0000136000)=[@dead_binder_done={0x40086310, 0x3}, @increfs_done={0x40106308, r7, 0x0}], 0x0, 0x0, &(0x7f0000888000-0xb)=""}) close(r2) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000002000-0x38)={0x0, 0x0, &(0x7f0000003000)=[], 0x0, &(0x7f0000002000)=[{0x10, 0x10e, 0x0, ""}], 0x10, 0x0}, 0x0) 2018/02/01 04:11:21 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000)=0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fchmod(r0, 0x1) r1 = syz_open_procfs(0x0, &(0x7f0000bdb000-0x11)='net/ip6_mr_cache\x00') prctl$getreaper(0x19, &(0x7f00004f0000)=0x0) read(r1, &(0x7f0000486000-0x8c)=""/140, 0x8c) [ 301.185377] binder: 14957:14968 BC_INCREFS_DONE node 1345 has no pending increfs request [ 301.201417] binder: undelivered TRANSACTION_COMPLETE 2018/02/01 04:11:21 executing program 2: openat$ion(0xffffffffffffff9c, &(0x7f0000801000-0x9)='/dev/ion\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000233000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = dup2(r0, r1) write$tun(0xffffffffffffffff, &(0x7f0000577000)=@pi={0x0, 0x0, @eth={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x0}, [], {@canfd={0xd, {{0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0, "feb442a1f43ead325d71fed774c8f6028c2a6b79a4e418aa3c5f391769659fef9f596cdade428c389e511eaad39d2ee4334dee9516a31d00510baaf06efc0980"}}}}}, 0x5a) r3 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004ee000-0x76)='\x00', 0x1, 0x0, 0x0}], &(0x7f000000b000-0x30)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)=""}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00005da000)={0x0, 0x0, &(0x7f00000d8000)=[], 0x48, 0x0, &(0x7f000044c000-0x83)="a410778b7a640ab0384c4ead541b6ee57c5645909ef688d8ac3e5ecfc7039f5f8ba53f127b7f01947cd3689eaf6c090277915bab2a0c450988cb85688e2bcc101a80664d3081fcc0"}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000c5a000)={0x0, 0x0, 0x0, 0x0}) mmap(&(0x7f0000000000/0x13000)=nil, 0x13000, 0x0, 0x32, 0xffffffffffffffff, 0x0) getsockopt$inet_mreqn(r2, 0x0, 0x24, &(0x7f00005a2000)={@broadcast=0x0, @dev={0x0, 0x0, 0xffffffffffffffff, 0x0}, 0x0}, &(0x7f0000461000-0x4)=0xc) bind$packet(r3, &(0x7f0000228000)={0x11, 0x0, r5, 0x1, 0x100000001, 0x6, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [0x0, 0x0]}, 0x14) ioctl$KDGKBMETA(r3, 0x4b62, &(0x7f000025a000)=0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000a95000-0x30)={0x14, 0x0, &(0x7f0000b8f000)=[@increfs_done={0x40106308, r4, 0x1}], 0x0, 0x0, &(0x7f00002e4000-0x70)=""}) 2018/02/01 04:11:21 executing program 4: r0 = dup2(0xffffffffffffff9c, 0xffffffffffffff9c) ioctl$KDSKBSENT(r0, 0x4b49, &(0x7f0000aa9000-0xc5)="05b48fe4c3fe1d8a08644b0afecf1ddc2551a88ad25d6a3004f54a240281be4e81aff5068875bc7dfc56dab3aa8d89dc4cf9a63ef667fbf75b9129caaa81d92d97bac792e12f3f55159d3fadbf9b10c77ff08f0f5190455cb11d0bdffb6cc344e019bbebd1bfea881d3f1fbda4785a05a44cbc4bc8f5112f3b065ac398580445d0107d07a708aa34c36e5bd3b54053f7e785ddc1031219141803f62d17b722744e8dae32b3b9f48356550cecea89753f49c3c0c39f6d2b991cef1cc30bf921668e44eba543") mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) seccomp(0x1, 0x0, &(0x7f000089b000-0x10)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x407ffc0003}]}) shmctl$IPC_INFO(0x0, 0x3, &(0x7f0000564000)=""/4096) pipe2(&(0x7f0000a82000)={0x0, 0x0}, 0x0) connect$vsock_dgram(r1, &(0x7f0000627000)={0x28, 0x0, 0x0, @hyper=0x0, 0x0}, 0x10) r2 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000dfa000-0xf)='/dev/sequencer\x00', 0x400, 0x0) ioctl$KDSKBLED(r2, 0x4b65, 0x7) 2018/02/01 04:11:21 executing program 1: openat$ion(0xffffffffffffff9c, &(0x7f0000801000-0x9)='/dev/ion\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000233000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) write$tun(0xffffffffffffffff, &(0x7f0000577000)=@pi={0x0, 0x0, @eth={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x0}, [], {@canfd={0xd, {{0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0, "feb442a1f43ead325d71fed774c8f6028c2a6b79a4e418aa3c5f391769659fef9f596cdade428c389e511eaad39d2ee4334dee9516a31d00510baaf06efc0980"}}}}}, 0x5a) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004ee000-0x76)='\x00', 0x1, 0x0, 0x0}], &(0x7f000000b000-0x30)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)=""}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00005da000)={0x0, 0x0, &(0x7f00000d8000)=[], 0x48, 0x0, &(0x7f000044c000-0x83)="a410778b7a640ab0384c4ead541b6ee57c5645909ef688d8ac3e5ecfc7039f5f8ba53f127b7f01947cd3689eaf6c090277915bab2a0c450988cb85688e2bcc101a80664d3081fcc0"}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000c5a000)={0x0, 0x0, 0x0, 0x0}) mmap(&(0x7f0000000000/0x13000)=nil, 0x13000, 0x0, 0x32, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000a95000-0x30)={0x14, 0x0, &(0x7f0000b8f000)=[@increfs_done={0x40106308, r3, 0x1}], 0x0, 0x0, &(0x7f00002e4000-0x70)=""}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000436000-0x30)={0x20, 0x0, &(0x7f0000136000)=[@dead_binder_done={0x40086310, 0x3}, @increfs_done={0x40106308, r3, 0x0}], 0x0, 0x0, &(0x7f0000888000-0xb)=""}) 2018/02/01 04:11:21 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000b6e000-0x38)={0x0, 0x0, &(0x7f00008ff000-0x10)={&(0x7f0000328000-0x98)={0x2, 0x400000000000003, 0x0, 0x0, 0x13, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, [@sadb_address={0x5, 0x6, 0x0, 0x0, 0x0, @in6={0xa, 0xffffffffffffffff, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0xfffffffffffffffc}}, @sadb_address={0x5, 0x8, 0x0, 0x0, 0x0, @in6={0xa, 0xffffffffffffffff, 0x0, @remote={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0xffffffffffffffff, 0xbb}, 0x0}}, @sadb_sa={0x2, 0x1, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, @sadb_address={0x5, 0x5, 0x0, 0x0, 0x0, @in6={0xa, 0xffffffffffffffff, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x1}, 0x0}}]}, 0x98}, 0x1, 0x0, 0x0, 0x0}, 0x0) 2018/02/01 04:11:21 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000)=0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0x0, 0xffffffffffffffff, 0x0) alarm(0x3) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f000010f000)={&(0x7f000000f000-0xc)={0x10, 0x34000, 0x0, 0x0}, 0xc, &(0x7f0000220000)={&(0x7f00004e1000-0x10a4)={0x14, 0x23, 0x2fd, 0xffffffffffffffff, 0xffffffffffffffff, {0x12, 0x0, 0x0}, []}, 0x14}, 0x1, 0x0, 0x0, 0x0}, 0x0) [ 301.201427] binder: undelivered TRANSACTION_ERROR: 29189 [ 301.201430] binder: undelivered TRANSACTION_ERROR: 29189 [ 301.240810] binder: send failed reply for transaction 1350 to 14974:14984 [ 301.241368] binder: 14973:14978 transaction failed 29189/-22, size 40-0 line 2788 2018/02/01 04:11:21 executing program 1: openat$ion(0xffffffffffffff9c, &(0x7f0000801000-0x9)='/dev/ion\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000233000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) write$tun(0xffffffffffffffff, &(0x7f0000577000)=@pi={0x0, 0x0, @eth={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x0}, [], {@canfd={0xd, {{0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0, "feb442a1f43ead325d71fed774c8f6028c2a6b79a4e418aa3c5f391769659fef9f596cdade428c389e511eaad39d2ee4334dee9516a31d00510baaf06efc0980"}}}}}, 0x5a) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004ee000-0x76)='\x00', 0x1, 0x0, 0x0}], &(0x7f000000b000-0x30)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)=""}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00005da000)={0x0, 0x0, &(0x7f00000d8000)=[], 0x48, 0x0, &(0x7f000044c000-0x83)="a410778b7a640ab0384c4ead541b6ee57c5645909ef688d8ac3e5ecfc7039f5f8ba53f127b7f01947cd3689eaf6c090277915bab2a0c450988cb85688e2bcc101a80664d3081fcc0"}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000c5a000)={0x0, 0x0, 0x0, 0x0}) mmap(&(0x7f0000000000/0x13000)=nil, 0x13000, 0x0, 0x32, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000a95000-0x30)={0x14, 0x0, &(0x7f0000b8f000)=[@increfs_done={0x40106308, r3, 0x1}], 0x0, 0x0, &(0x7f00002e4000-0x70)=""}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000436000-0x30)={0x20, 0x0, &(0x7f0000136000)=[@dead_binder_done={0x40086310, 0x3}, @increfs_done={0x40106308, r3, 0x0}], 0x0, 0x0, &(0x7f0000888000-0xb)=""}) 2018/02/01 04:11:21 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f0000590000-0x8)='./file0\x00', 0x14) write$selinux_create(r0, &(0x7f000074c000)=@access={'system_u:object_r:dpkg_exec_t:s0', 0x20, '/usr/sbin/cups-browsed', 0x20, 0x32, 0x30, 0x0}, 0x3b) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f00007cf000)='/dev/cuse\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_STATUS(r1, 0xc05c5340, &(0x7f0000b85000)={0x6, 0x100, 0x2, {0x0, 0x0}, 0x0, 0x4, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000801000-0x9)='/dev/ion\x00', 0x0, 0x0) r3 = syz_open_dev$binder(&(0x7f0000233000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r4 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0) r5 = dup2(r3, r4) write$tun(0xffffffffffffffff, &(0x7f0000577000)=@pi={0x0, 0x0, @eth={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x0}, [], {@canfd={0xd, {{0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0, "feb442a1f43ead325d71fed774c8f6028c2a6b79a4e418aa3c5f391769659fef9f596cdade428c389e511eaad39d2ee4334dee9516a31d00510baaf06efc0980"}}}}}, 0x5a) r6 = dup2(r4, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004ee000-0x76)='\x00', 0x1, 0x0, 0x0}], &(0x7f000000b000-0x30)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)=""}) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f00005da000)={0x0, 0x0, &(0x7f00000d8000)=[], 0x0, 0x0, &(0x7f000044c000-0x83)=""}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000c5a000)={0x0, 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000a95000-0x30)={0x14, 0x0, &(0x7f0000b8f000)=[@increfs_done={0x40106308, r7, 0x1}], 0x0, 0x0, &(0x7f00002e4000-0x70)=""}) getsockopt$inet6_dccp_buf(r5, 0x21, 0xcf, &(0x7f0000e10000-0xcc)=""/204, &(0x7f000037d000-0x4)=0xcc) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000436000-0x30)={0x20, 0x0, &(0x7f0000136000)=[@dead_binder_done={0x40086310, 0x3}, @increfs_done={0x40106308, r7, 0x0}], 0x0, 0x0, &(0x7f0000888000-0xb)=""}) close(r2) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000002000-0x38)={0x0, 0x0, &(0x7f0000003000)=[], 0x0, &(0x7f0000002000)=[{0x10, 0x10e, 0x0, ""}], 0x10, 0x0}, 0x0) 2018/02/01 04:11:21 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000)=0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fchmod(r0, 0x1) r1 = syz_open_procfs(0x0, &(0x7f0000bdb000-0x11)='net/ip6_mr_cache\x00') prctl$getreaper(0x19, &(0x7f00004f0000)=0x0) read(r1, &(0x7f0000486000-0x8c)=""/140, 0x8c) 2018/02/01 04:11:21 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x4000000000000001, 0x0) ioctl$sock_inet_SIOCSARP(r0, 0x8955, &(0x7f0000ac0000-0x44)={{0x2, 0xffffffffffffffff, @broadcast=0xffffffff, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, {0x0, @empty=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x28, {0x2, 0xffffffffffffffff, @empty=0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, @syzn={0x73, 0x79, 0x7a, 0x0, 0x0}}) r1 = eventfd(0x80000001) ioctl$VHOST_SET_LOG_FD(r0, 0x4004af07, &(0x7f0000f3b000-0x4)=r1) [ 301.241803] binder: 14974:14984 BC_INCREFS_DONE u0000000000000000 no match [ 301.245364] binder: 14974:14984 BC_DEAD_BINDER_DONE 0000000000000003 not found [ 301.245377] binder: 14974:14984 BC_INCREFS_DONE u00000000204edf8a node 1351 cookie mismatch 0000000000000000 != 0000000000000001 2018/02/01 04:11:21 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f0000590000-0x8)='./file0\x00', 0x14) write$selinux_create(r0, &(0x7f000074c000)=@access={'system_u:object_r:dpkg_exec_t:s0', 0x20, '/usr/sbin/cups-browsed', 0x20, 0x32, 0x30, 0x0}, 0x3b) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f00007cf000)='/dev/cuse\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_STATUS(r1, 0xc05c5340, &(0x7f0000b85000)={0x6, 0x100, 0x2, {0x0, 0x0}, 0x0, 0x4, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000801000-0x9)='/dev/ion\x00', 0x0, 0x0) r3 = syz_open_dev$binder(&(0x7f0000233000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r4 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0) r5 = dup2(r3, r4) write$tun(0xffffffffffffffff, &(0x7f0000577000)=@pi={0x0, 0x0, @eth={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x0}, [], {@canfd={0xd, {{0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0, "feb442a1f43ead325d71fed774c8f6028c2a6b79a4e418aa3c5f391769659fef9f596cdade428c389e511eaad39d2ee4334dee9516a31d00510baaf06efc0980"}}}}}, 0x5a) r6 = dup2(r4, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004ee000-0x76)='\x00', 0x1, 0x0, 0x0}], &(0x7f000000b000-0x30)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)=""}) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f00005da000)={0x0, 0x0, &(0x7f00000d8000)=[], 0x0, 0x0, &(0x7f000044c000-0x83)=""}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000c5a000)={0x0, 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000a95000-0x30)={0x14, 0x0, &(0x7f0000b8f000)=[@increfs_done={0x40106308, r7, 0x1}], 0x0, 0x0, &(0x7f00002e4000-0x70)=""}) getsockopt$inet6_dccp_buf(r5, 0x21, 0xcf, &(0x7f0000e10000-0xcc)=""/204, &(0x7f000037d000-0x4)=0xcc) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000436000-0x30)={0x20, 0x0, &(0x7f0000136000)=[@dead_binder_done={0x40086310, 0x3}, @increfs_done={0x40106308, r7, 0x0}], 0x0, 0x0, &(0x7f0000888000-0xb)=""}) close(r2) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000002000-0x38)={0x0, 0x0, &(0x7f0000003000)=[], 0x0, &(0x7f0000002000)=[{0x10, 0x10e, 0x0, ""}], 0x10, 0x0}, 0x0) 2018/02/01 04:11:21 executing program 5: mmap(&(0x7f0000000000/0x39e000)=nil, 0x39e000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x80005, 0x0) r1 = syz_open_dev$evdev(&(0x7f00002e4000-0x12)='/dev/input/event#\x00', 0x1ff, 0x2000) ioctl$EVIOCGVERSION(r1, 0x80044501, &(0x7f0000164000)=""/150) r2 = openat$dsp(0xffffffffffffff9c, &(0x7f000034e000)='/dev/dsp\x00', 0x80, 0x0) mmap(&(0x7f000039e000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f000039e000)='/selinux/commit_pending_bools\x00', 0x1, 0x0) ioctl$DRM_IOCTL_INFO_BUFS(r2, 0xc0106418, &(0x7f00000a9000-0x20)={0x9, 0x0, 0x9, 0x6, 0x11, 0x7772}) setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, &(0x7f0000387000-0x418)=@filter={'filter\x00', 0xe, 0x4, 0x3b8, 0xffffffff, 0x0, 0x0, 0x0, 0xffffffff, 0xffffffff, 0x0, 0x0, 0x0, 0xffffffff, 0x4, &(0x7f0000001000)=[{0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}], {{{[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0x70, 0x98, 0x0, {0x0, 0x0}}, {0x28, '\x00', 0x0, 0xfffffffffffffffe}}, [{{@ip={@broadcast=0xffffffff, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, 0x0, 0x0, @common='bcsh0\x00', @syzn={0x73, 0x79, 0x7a, 0xffffffffffffffff, 0x0}, {0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, {0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x0, 0x0, 0x0}, 0x0, 0x70, 0x98, 0x0, {0x0, 0x0}, []}, @REJECT={0x28, 'REJECT\x00', 0x0, {0x0}}}, {{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0x1c8, 0x1f0, 0x0, {0x0, 0x0}, [@common=@unspec=@hashlimit3={0x158, 'hashlimit\x00', 0x3, {'gretap0\x00', {0x0, 0x0, 0x20, 0x0, 0x0, 0x100005, 0x8, 0x0, 0x0, 0x0}, 0x0}}]}, @REJECT={0x28, 'REJECT\x00', 0x0, {0x0}}}, {{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0x70, 0x98, 0x0, {0x0, 0x0}, []}, @REJECT={0x28, 'REJECT\x00', 0x0, {0x0}}}]}}, 0x418) [ 301.263620] binder: undelivered TRANSACTION_COMPLETE [ 301.263629] binder: undelivered TRANSACTION_ERROR: 29189 [ 301.272007] binder: undelivered TRANSACTION_ERROR: 29189 [ 301.297956] binder_alloc: binder_alloc_mmap_handler: 14981 20000000-20002000 already mapped failed -16 2018/02/01 04:11:21 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) ioctl$TIOCGPGRP(0xffffffffffffff9c, 0x540f, &(0x7f0000db4000)=0x0) r2 = getuid() fstat(r0, &(0x7f0000fec000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) setsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000418000)={r1, r2, r3}, 0xc) sendmsg$nl_xfrm(r0, &(0x7f0000a8d000)={&(0x7f0000e4e000)={0x10, 0x0, 0x0, 0x0}, 0xc, &(0x7f0000fcf000-0x10)={&(0x7f00005d5000)=@updsa={0x104, 0x1a, 0x1, 0xffffffffffffffff, 0xffffffffffffffff, {{@in6=@local={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0xffffffffffffffff, 0xaa}, @in=@dev={0xac, 0x14, 0xffffffffffffffff, 0x0}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0}, {@in=@broadcast=0xffffffff, 0xffffffffffffffff, 0x2b}, @in=@multicast2=0xe0000002, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, {0x0, 0x0, 0x0, 0x0}, {0x0, 0x0, 0x0}, 0xffffffffffffffff, 0xffffffffffffffff, 0xa, 0x2, 0x0, 0x0}, [@coaddr={0x14, 0xe, @in=@remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}}]}, 0x104}, 0x1, 0x0, 0x0, 0x0}, 0x0) r4 = openat$ppp(0xffffffffffffff9c, &(0x7f0000c1d000-0x9)='/dev/ppp\x00', 0x101000, 0x0) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(0xffffffffffffff9c, 0x84, 0x1d, &(0x7f0000236000)={0x7, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, &(0x7f000031a000)=0x20) getsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r4, 0x84, 0x75, &(0x7f000057e000)={r5, 0x3}, &(0x7f0000c43000)=0x8) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000645000)={0x0, 0x0}) 2018/02/01 04:11:21 executing program 2: openat$ion(0xffffffffffffff9c, &(0x7f0000801000-0x9)='/dev/ion\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000233000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) write$tun(0xffffffffffffffff, &(0x7f0000577000)=@pi={0x0, 0x0, @eth={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x0}, [], {@canfd={0xd, {{0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0, "feb442a1f43ead325d71fed774c8f6028c2a6b79a4e418aa3c5f391769659fef9f596cdade428c389e511eaad39d2ee4334dee9516a31d00510baaf06efc0980"}}}}}, 0x5a) r2 = dup2(r1, r0) sysfs$3(0x3) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004ee000-0x76)='\x00', 0x1, 0x0, 0x0}], &(0x7f000000b000-0x30)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)=""}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00005da000)={0x0, 0x0, &(0x7f00000d8000)=[], 0x48, 0x0, &(0x7f000044c000-0x83)="a410778b7a640ab0384c4ead541b6ee57c5645909ef688d8ac3e5ecfc7039f5f8ba53f127b7f01947cd3689eaf6c090277915bab2a0c450988cb85688e2bcc101a80664d3081fcc0"}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000c5a000)={0x0, 0x0, 0x0, 0x0}) mmap(&(0x7f0000000000/0x13000)=nil, 0x13000, 0x0, 0x32, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000a95000-0x30)={0x14, 0x0, &(0x7f0000b8f000)=[@increfs_done={0x40106308, r3, 0x1}], 0x0, 0x0, &(0x7f00002e4000-0x70)=""}) 2018/02/01 04:11:21 executing program 1: openat$ion(0xffffffffffffff9c, &(0x7f0000801000-0x9)='/dev/ion\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000233000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) write$tun(0xffffffffffffffff, &(0x7f0000577000)=@pi={0x0, 0x0, @eth={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x0}, [], {@canfd={0xd, {{0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0, "feb442a1f43ead325d71fed774c8f6028c2a6b79a4e418aa3c5f391769659fef9f596cdade428c389e511eaad39d2ee4334dee9516a31d00510baaf06efc0980"}}}}}, 0x5a) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004ee000-0x76)='\x00', 0x1, 0x0, 0x0}], &(0x7f000000b000-0x30)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)=""}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00005da000)={0x0, 0x0, &(0x7f00000d8000)=[], 0x48, 0x0, &(0x7f000044c000-0x83)="a410778b7a640ab0384c4ead541b6ee57c5645909ef688d8ac3e5ecfc7039f5f8ba53f127b7f01947cd3689eaf6c090277915bab2a0c450988cb85688e2bcc101a80664d3081fcc0"}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000c5a000)={0x0, 0x0, 0x0, 0x0}) mmap(&(0x7f0000000000/0x13000)=nil, 0x13000, 0x0, 0x32, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000a95000-0x30)={0x14, 0x0, &(0x7f0000b8f000)=[@increfs_done={0x40106308, r3, 0x1}], 0x0, 0x0, &(0x7f00002e4000-0x70)=""}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000436000-0x30)={0x20, 0x0, &(0x7f0000136000)=[@dead_binder_done={0x40086310, 0x3}, @increfs_done={0x40106308, r3, 0x0}], 0x0, 0x0, &(0x7f0000888000-0xb)=""}) 2018/02/01 04:11:21 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000236000-0x8)='./file0\x00', 0x8c000, 0x1) ioctl$KVM_GET_XCRS(r0, 0x8188aea6, &(0x7f0000102000)={0x4, 0x3b0, [{0x1249fb4f, 0x0, 0x7}, {0x0, 0x0, 0x8}, {0x3, 0x0, 0x5}, {0x4, 0x0, 0x4}]}) r1 = socket(0x10, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f00005fa000)={@syzn={0x73, 0x79, 0x7a, 0x0, 0x0}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) getsockopt$inet6_buf(r1, 0x29, 0x15, &(0x7f0000e33000)=""/47, &(0x7f0000dfc000-0x4)=0x2f) sendmsg$nl_route(r1, &(0x7f000094e000)={&(0x7f00005ed000-0xc)={0x10, 0x0, 0x0, 0x0}, 0xc, &(0x7f0000dc3000)={&(0x7f0000461000)=@newlink={0x28, 0x10, 0x9, 0xffffffffffffffff, 0xffffffffffffffff, {0x0, 0x0, 0x0, r2, 0x0, 0x0}, [@IFLA_AF_SPEC={0x8, 0x1a, [{0x2, 0x0, ""}]}]}, 0x28}, 0x1, 0x0, 0x0, 0x0}, 0x0) 2018/02/01 04:11:21 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000)=0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$amidi(&(0x7f00003a9000-0xc)='/dev/amidi#\x00', 0x0, 0x101000) ioctl$TUNGETIFF(r1, 0x800454d2, &(0x7f0000d2f000-0x4)=0x7e) syslog(0x3, &(0x7f0000a63000-0xb3)=""/179, 0xb3) fcntl$setflags(r0, 0x2, 0x0) 2018/02/01 04:11:21 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f0000590000-0x8)='./file0\x00', 0x14) write$selinux_create(r0, &(0x7f000074c000)=@access={'system_u:object_r:dpkg_exec_t:s0', 0x20, '/usr/sbin/cups-browsed', 0x20, 0x32, 0x30, 0x0}, 0x3b) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f00007cf000)='/dev/cuse\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_STATUS(r1, 0xc05c5340, &(0x7f0000b85000)={0x6, 0x100, 0x2, {0x0, 0x0}, 0x0, 0x4, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000801000-0x9)='/dev/ion\x00', 0x0, 0x0) r3 = syz_open_dev$binder(&(0x7f0000233000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r4 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0) r5 = dup2(r3, r4) write$tun(0xffffffffffffffff, &(0x7f0000577000)=@pi={0x0, 0x0, @eth={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x0}, [], {@canfd={0xd, {{0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0, "feb442a1f43ead325d71fed774c8f6028c2a6b79a4e418aa3c5f391769659fef9f596cdade428c389e511eaad39d2ee4334dee9516a31d00510baaf06efc0980"}}}}}, 0x5a) r6 = dup2(r4, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004ee000-0x76)='\x00', 0x1, 0x0, 0x0}], &(0x7f000000b000-0x30)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)=""}) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f00005da000)={0x0, 0x0, &(0x7f00000d8000)=[], 0x0, 0x0, &(0x7f000044c000-0x83)=""}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000c5a000)={0x0, 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000a95000-0x30)={0x14, 0x0, &(0x7f0000b8f000)=[@increfs_done={0x40106308, r7, 0x1}], 0x0, 0x0, &(0x7f00002e4000-0x70)=""}) getsockopt$inet6_dccp_buf(r5, 0x21, 0xcf, &(0x7f0000e10000-0xcc)=""/204, &(0x7f000037d000-0x4)=0xcc) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000436000-0x30)={0x20, 0x0, &(0x7f0000136000)=[@dead_binder_done={0x40086310, 0x3}, @increfs_done={0x40106308, r7, 0x0}], 0x0, 0x0, &(0x7f0000888000-0xb)=""}) close(r2) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000002000-0x38)={0x0, 0x0, &(0x7f0000003000)=[], 0x0, &(0x7f0000002000)=[{0x10, 0x10e, 0x0, ""}], 0x10, 0x0}, 0x0) [ 301.304385] binder: BINDER_SET_CONTEXT_MGR already set [ 301.304396] binder: 14991:14996 ioctl 40046207 0 returned -16 [ 301.304881] binder: BINDER_SET_CONTEXT_MGR already set [ 301.304890] binder: 14981:14987 ioctl 40046207 0 returned -16 [ 301.306486] binder_alloc: 14981: binder_alloc_buf, no vma [ 301.306516] binder: 14991:14996 transaction failed 29189/-3, size 40-8 line 2903 [ 301.310880] binder_alloc: 14981: binder_alloc_buf, no vma [ 301.310907] binder: 14981:14987 transaction failed 29189/-3, size 40-8 line 2903 [ 301.322531] binder: BINDER_SET_CONTEXT_MGR already set [ 301.322541] binder: 14993:14998 ioctl 40046207 0 returned -16 [ 301.323381] binder_alloc: 14981: binder_alloc_buf, no vma [ 301.323406] binder: 14993:14998 transaction failed 29189/-3, size 40-8 line 2903 [ 301.331241] binder: undelivered TRANSACTION_ERROR: 29189 [ 301.331336] binder: release 14981:14987 transaction 1356 out, still active [ 301.331341] binder: undelivered TRANSACTION_COMPLETE [ 301.331384] binder: send failed reply for transaction 1356, target dead [ 301.332056] binder: 14991:14996 BC_INCREFS_DONE u0000000000000000 no match [ 301.343221] binder: undelivered TRANSACTION_ERROR: 29189 [ 301.349555] binder: 14991:14996 BC_DEAD_BINDER_DONE 0000000000000003 not found [ 301.349566] binder: 14991:14996 BC_INCREFS_DONE u0000000000000000 no match [ 301.378062] binder: send failed reply for transaction 1363 to 15003:15006 [ 301.379156] binder: 15003:15006 ioctl 40086414 20970000 returned -22 [ 301.416777] binder: 15003:15010 transaction failed 29189/-22, size 40-8 line 2788 [ 301.451061] binder: 15003:15006 ioctl 40086414 20970000 returned -22 [ 301.451094] binder: 15003:15010 BC_INCREFS_DONE u0000000000000000 no match [ 301.466690] binder: undelivered TRANSACTION_COMPLETE [ 301.466698] binder: undelivered TRANSACTION_ERROR: 29189 [ 301.500210] binder: send failed reply for transaction 1369 to 15020:15027 [ 301.501306] binder: 15020:15027 BC_INCREFS_DONE u00000000204edf8a no match [ 301.517243] binder: send failed reply for transaction 1373 to 15024:15030 [ 301.518340] binder: 15024:15030 BC_INCREFS_DONE u00000000204edf8a node 1374 cookie mismatch 0000000000000000 != 0000000000000001 [ 301.518808] binder: 15024:15030 BC_DEAD_BINDER_DONE 0000000000000003 not found [ 301.518818] binder: 15024:15030 BC_INCREFS_DONE u00000000204edf8a node 1374 cookie mismatch 0000000000000000 != 0000000000000001 [ 301.526242] binder: 15021:15028 transaction failed 29189/-22, size 40-8 line 2788 [ 301.535964] binder: 15020:15027 BC_INCREFS_DONE u0000000000000000 no match [ 301.538891] binder: undelivered TRANSACTION_COMPLETE [ 301.538902] binder: undelivered TRANSACTION_ERROR: 29189 [ 301.545375] binder: undelivered TRANSACTION_ERROR: 29189 [ 301.559904] binder: send failed reply for transaction 1380 to 15038:15039 [ 301.560782] binder: 15038:15039 BC_INCREFS_DONE u00000000204edf8a node 1381 cookie mismatch 0000000000000000 != 0000000000000001 [ 301.562073] binder: 15038:15039 BC_DEAD_BINDER_DONE 0000000000000003 not found [ 301.562086] binder: 15038:15039 BC_INCREFS_DONE u00000000204edf8a node 1381 cookie mismatch 0000000000000000 != 0000000000000001 [ 301.567488] binder: undelivered TRANSACTION_COMPLETE [ 301.567499] binder: undelivered TRANSACTION_ERROR: 29189 [ 301.575210] binder: undelivered TRANSACTION_COMPLETE [ 301.575220] binder: undelivered TRANSACTION_ERROR: 29189 [ 301.610336] binder: 15044:15046 transaction failed 29189/-22, size 40-8 line 2788 [ 301.615173] binder: send failed reply for transaction 1386 to 15041:15048 [ 301.636779] binder: 15043:15049 ioctl 4b62 2025a000 returned -22 [ 301.643307] binder: send failed reply for transaction 1390 to 15043:15049 [ 301.653273] binder: undelivered TRANSACTION_COMPLETE [ 301.653284] binder: undelivered TRANSACTION_ERROR: 29189 [ 301.653678] binder: undelivered TRANSACTION_ERROR: 29189 [ 301.678779] binder: 15043:15049 transaction failed 29189/-22, size 40-8 line 2788 [ 301.688672] binder: send failed reply for transaction 1396 to 15056:15060 [ 301.697768] binder: 15043:15049 ioctl 4b62 2025a000 returned -22 [ 301.697774] binder: 15043:15055 BC_INCREFS_DONE node 1391 has no pending increfs request [ 301.697810] binder: 15057:15061 transaction failed 29189/-22, size 40-8 line 2788 [ 301.706629] binder: undelivered TRANSACTION_ERROR: 29189 [ 301.724337] binder: undelivered TRANSACTION_COMPLETE [ 301.724346] binder: undelivered TRANSACTION_ERROR: 29189 [ 301.724350] binder: undelivered TRANSACTION_ERROR: 29189 [ 301.730826] binder: undelivered TRANSACTION_COMPLETE [ 301.730835] binder: undelivered TRANSACTION_ERROR: 29189 [ 301.738586] xt_hashlimit: overflow, rate too high: 0 [ 301.771268] xt_hashlimit: overflow, rate too high: 0 [ 301.774774] binder: 15064:15068 transaction failed 29189/-22, size 40-8 line 2788 [ 301.782640] binder: undelivered TRANSACTION_ERROR: 29189 [ 301.825562] binder: send failed reply for transaction 1404 to 15080:15083 [ 301.835629] binder: 15082:15085 transaction failed 29189/-22, size 40-8 line 2788 [ 301.844463] binder: undelivered TRANSACTION_ERROR: 29189 [ 301.869518] binder: send failed reply for transaction 1411 to 15081:15084 [ 301.878765] binder: undelivered TRANSACTION_COMPLETE [ 301.878774] binder: undelivered TRANSACTION_ERROR: 29189 [ 301.886519] binder: 15080:15087 transaction failed 29189/-22, size 40-8 line 2788 [ 301.915156] binder: undelivered TRANSACTION_ERROR: 29189 [ 301.915169] binder: undelivered TRANSACTION_ERROR: 29189 2018/02/01 04:11:22 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) seccomp(0x1, 0x0, &(0x7f000089b000-0x10)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x407ffc0003}]}) shmctl$IPC_INFO(0x0, 0x3, &(0x7f0000c30000-0x1000)=""/4096) 2018/02/01 04:11:22 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r0, &(0x7f000067f000-0x1c)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x0}, 0x1c) sendto$inet6(r0, &(0x7f00005a1000-0x1)='8', 0x1, 0x0, &(0x7f00007bd000-0x1c)={0xa, 0x0, 0x0, @loopback={0x0, 0x1}, 0x0}, 0x1c) setsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r0, 0x84, 0x72, &(0x7f0000bd7000-0xc)={0x0, 0x4, 0x4000020030}, 0xc) write(r0, &(0x7f0000cbe000-0x48)='v', 0x1) sendmsg(r0, &(0x7f0000ece000)={0x0, 0x0, &(0x7f00004a1000-0x60)=[{&(0x7f00007ac000-0x82)="dd", 0x1}], 0x1, &(0x7f00009e9000)=[], 0x0, 0x0}, 0x0) setsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r0, 0x84, 0x72, &(0x7f0000010000-0xc)={0x0, 0x0, 0x0}, 0xc) setsockopt$sock_int(r0, 0x1, 0x7, &(0x7f00007c0000)=0x0, 0x4) sendto$inet6(r0, &(0x7f00009eb000)="84b49a40a76c78f0769e4a395a78bbd1d97ece9e374f34257497eb3acfec4b7040bb4344183700596e81834a3af617296e8db16358ec9fb6f4c3c7f0e7947609533883b5d83e276617b5683f97a326e3f9315b6ef401c7f71e34055cd5a9fa8f2550c4d0b1901b79363cddd081b572b7ef2c178dc0d994a321ec103685fdb92bb2e74d37fd3e61116de31b6dd04377a7dd14711a5a3a981379e205277ac3aef4bf09b066d73729cede4dd4096d2f688428", 0xb1, 0x0, &(0x7f0000623000)={0xa, 0x0, 0x0, @loopback={0x0, 0x1}, 0x0}, 0x1c) sendto$inet6(r0, &(0x7f0000b11000-0x5e)='>', 0x1, 0x0, &(0x7f0000477000-0x1c)={0xa, 0x0, 0x0, @loopback={0x0, 0x1}, 0x0}, 0x1c) sendto$inet6(r0, &(0x7f0000b17000)="bd2e32ffa825fcec451d2b7a89598d49681459593dc8b0d95a423b46ccc92f3a06e5fdf31c06f1da539671e12db8e31091b12045ee8ad740b2ee9bb7549c258e913d5128f5c4c8e755223c612050f5d89303a236aacd593998b37213572aad42c3188a083689ce3248030feaccdd929c03403326f6b736195c9aea8d43e07317db6b8647e3aa9eb04ea150e799f354f1ed86c3170fff52351ff2e2d295b6d8b70ac31c4b15326d2df54c3b660711703d0f2338c39aacdf7bd9bb234c0236ed2bce67c75dc382057c96eb889e3e08d1b838cb417c58a40069c40d300b2e5410b8a0b9ea351ed371e648cd30a30755d3e50f2c6b39bf7eca642b7531eb1d63af771e94f4b25ffb3255b7e32a4d4cf4c7e7ff86bf6b3496219605bea5ddf556f83421814a6b4076f4eb097d0e1650dec7087843524c942053c7eb8837262d25d7269ca919b942c0506ef2ba0ea5cc05dcde40679300fb3c1d89498ebc23f151567db27bfc491873bc34b213a1950063f7a8c25c8809b5c5dac97f01078e3668d83883ee64b0e035d47c3f1de992ac9f72d7f73ba87c1318df1084d27019310fe6a835d5d47e159e638563ed06772eb3e452e513e3737f49878b8c3f0f3c5b6a39c8e7b01a97a2648a61aeb4c2799a84db31184ea11030a096636448ff60fa7b3094e4c5ccbd1de6bc01d866", 0x1ea, 0x0, &(0x7f0000fec000-0x1c)={0xa, 0x0, 0x0, @loopback={0x0, 0x1}, 0x0}, 0x1c) 2018/02/01 04:11:22 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f0000590000-0x8)='./file0\x00', 0x14) write$selinux_create(r0, &(0x7f000074c000)=@access={'system_u:object_r:dpkg_exec_t:s0', 0x20, '/usr/sbin/cups-browsed', 0x20, 0x32, 0x30, 0x0}, 0x3b) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f00007cf000)='/dev/cuse\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_STATUS(r1, 0xc05c5340, &(0x7f0000b85000)={0x6, 0x100, 0x2, {0x0, 0x0}, 0x0, 0x4, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000801000-0x9)='/dev/ion\x00', 0x0, 0x0) r3 = syz_open_dev$binder(&(0x7f0000233000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r4 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0) r5 = dup2(r3, r4) write$tun(0xffffffffffffffff, &(0x7f0000577000)=@pi={0x0, 0x0, @eth={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x0}, [], {@canfd={0xd, {{0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0, "feb442a1f43ead325d71fed774c8f6028c2a6b79a4e418aa3c5f391769659fef9f596cdade428c389e511eaad39d2ee4334dee9516a31d00510baaf06efc0980"}}}}}, 0x5a) r6 = dup2(r4, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004ee000-0x76)='\x00', 0x1, 0x0, 0x0}], &(0x7f000000b000-0x30)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)=""}) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f00005da000)={0x0, 0x0, &(0x7f00000d8000)=[], 0x24, 0x0, &(0x7f000044c000-0x83)="a410778b7a640ab0384c4ead541b6ee57c5645909ef688d8ac3e5ecfc7039f5f8ba53f12"}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000c5a000)={0x0, 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000a95000-0x30)={0x14, 0x0, &(0x7f0000b8f000)=[@increfs_done={0x40106308, r7, 0x1}], 0x0, 0x0, &(0x7f00002e4000-0x70)=""}) getsockopt$inet6_dccp_buf(r5, 0x21, 0xcf, &(0x7f0000e10000-0xcc)=""/204, &(0x7f000037d000-0x4)=0xcc) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000436000-0x30)={0x20, 0x0, &(0x7f0000136000)=[@dead_binder_done={0x40086310, 0x3}, @increfs_done={0x40106308, r7, 0x0}], 0x0, 0x0, &(0x7f0000888000-0xb)=""}) close(r2) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000002000-0x38)={0x0, 0x0, &(0x7f0000003000)=[], 0x0, &(0x7f0000002000)=[{0x10, 0x10e, 0x0, ""}], 0x10, 0x0}, 0x0) 2018/02/01 04:11:22 executing program 7: r0 = memfd_create(&(0x7f0000e45000-0x16)='(eth0\\user\\{mime_type\x00', 0x2) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) getsockopt$inet_sctp_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffff9c, 0x84, 0x7c, &(0x7f0000503000)={0x0, 0x3, 0xffff}, &(0x7f0000001000-0x4)=0x8) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(r0, 0x84, 0x73, &(0x7f0000cc2000)={r1, 0x8000, 0x0, 0x6, 0x40}, &(0x7f0000000000)=0x18) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r2 = socket$inet6(0xa, 0x80003, 0xfb) sendto$inet6(r2, &(0x7f000089c000)="", 0x0, 0x40010, &(0x7f0000003000)={0xa, 0xffffffffffffffff, 0x0, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x1}, 0x0}, 0x1c) setsockopt$inet6_opts(r0, 0x29, 0x37, &(0x7f00002fd000)=@fragment={0x2b, 0x0, 0x20, 0x8, 0x0, 0x7, 0x0}, 0x8) 2018/02/01 04:11:22 executing program 1: openat$ion(0xffffffffffffff9c, &(0x7f0000801000-0x9)='/dev/ion\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000233000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) write$tun(0xffffffffffffffff, &(0x7f0000577000)=@pi={0x0, 0x0, @eth={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x0}, [], {@canfd={0xd, {{0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0, "feb442a1f43ead325d71fed774c8f6028c2a6b79a4e418aa3c5f391769659fef9f596cdade428c389e511eaad39d2ee4334dee9516a31d00510baaf06efc0980"}}}}}, 0x5a) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004ee000-0x76)='\x00', 0x1, 0x0, 0x0}], &(0x7f000000b000-0x30)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)=""}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00005da000)={0x0, 0x0, &(0x7f00000d8000)=[], 0x48, 0x0, &(0x7f000044c000-0x83)="a410778b7a640ab0384c4ead541b6ee57c5645909ef688d8ac3e5ecfc7039f5f8ba53f127b7f01947cd3689eaf6c090277915bab2a0c450988cb85688e2bcc101a80664d3081fcc0"}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000c5a000)={0x0, 0x0, 0x0, 0x0}) mmap(&(0x7f0000000000/0x13000)=nil, 0x13000, 0x0, 0x32, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000a95000-0x30)={0x14, 0x0, &(0x7f0000b8f000)=[@increfs_done={0x40106308, r3, 0x1}], 0x0, 0x0, &(0x7f00002e4000-0x70)=""}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000436000-0x30)={0x14, 0x0, &(0x7f0000136000)=[@increfs_done={0x40106308, r3, 0x0}], 0x0, 0x0, &(0x7f0000888000-0xb)=""}) 2018/02/01 04:11:22 executing program 3: mmap(&(0x7f0000000000/0x1f000)=nil, 0x1f000, 0x3, 0x32, 0xffffffffffffffff, 0x0) syz_open_dev$admmidi(&(0x7f000000d000)='/dev/admmidi#\x00', 0x3, 0x204400) r0 = socket(0xf, 0x0, 0x1) sendmmsg(0xffffffffffffffff, &(0x7f0000011000)=[{{&(0x7f0000003000)=@in6={0xa, 0xffffffffffffffff, 0x0, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x1}, 0x0}, 0x1c, &(0x7f0000005000-0x60)=[{&(0x7f0000002000)="4c5614c00401a0dbf8a669ebdedd102c4f7a79e606457dfdf09e2ec2ed253b", 0x1f}], 0x1, &(0x7f0000003000-0x2d0)=[], 0x0, 0x0}, 0x0}], 0x1, 0x0) connect(r0, &(0x7f0000002000)=@sco={0x1f, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0}}, 0x8) setsockopt(r0, 0x111, 0x0, &(0x7f000000c000-0x5)="0ed4550f", 0x4) 2018/02/01 04:11:22 executing program 2: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000801000-0x9)='/dev/ion\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000233000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) r3 = dup2(r1, r2) write$tun(0xffffffffffffffff, &(0x7f0000577000)=@pi={0x0, 0x0, @eth={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x0}, [], {@canfd={0xd, {{0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0, "feb442a1f43ead325d71fed774c8f6028c2a6b79a4e418aa3c5f391769659fef9f596cdade428c389e511eaad39d2ee4334dee9516a31d00510baaf06efc0980"}}}}}, 0x5a) r4 = dup2(r2, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004ee000-0x76)='\x00', 0x1, 0x0, 0x0}], &(0x7f000000b000-0x30)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)=""}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00005da000)={0x0, 0x0, &(0x7f00000d8000)=[], 0x48, 0x0, &(0x7f000044c000-0x83)="a410778b7a640ab0384c4ead541b6ee57c5645909ef688d8ac3e5ecfc7039f5f8ba53f127b7f01947cd3689eaf6c090277915bab2a0c450988cb85688e2bcc101a80664d3081fcc0"}) fcntl$setsig(r0, 0xa, 0xc) ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000c5a000)={0x0, 0x0, 0x0, 0x0}) mmap(&(0x7f0000000000/0x13000)=nil, 0x13000, 0x0, 0x32, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000a95000-0x30)={0x14, 0x0, &(0x7f0000b8f000)=[@increfs_done={0x40106308, r5, 0x1}], 0x0, 0x0, &(0x7f00002e4000-0x70)=""}) preadv(r3, &(0x7f0000ab1000-0x10)=[{&(0x7f0000d55000)=""/93, 0x5d}], 0x1, 0x0) 2018/02/01 04:11:22 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000197000)='veno\x00', 0x5) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) r2 = syz_open_dev$sndpcmp(&(0x7f000045d000-0x12)='/dev/snd/pcmC#D#p\x00', 0x8, 0x0) r3 = openat(r2, &(0x7f0000d79000)='./file0\x00', 0x0, 0x94) setsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX(r3, 0x84, 0x6e, &(0x7f00006c8000-0x2c)=[@in={0x2, 0x0, @multicast2=0xe0000002, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, @in6={0xa, 0x1, 0x2, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x1}, 0x4}], 0x2c) sendmsg$nl_xfrm(r1, &(0x7f0000a8d000)={&(0x7f0000e4e000)={0x10, 0x0, 0x0, 0x0}, 0xc, &(0x7f0000fcf000-0x10)={&(0x7f00005d5000)=@updsa={0x104, 0x1a, 0x1, 0xffffffffffffffff, 0xffffffffffffffff, {{@in6=@local={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0xffffffffffffffff, 0xaa}, @in=@dev={0xac, 0x14, 0xffffffffffffffff, 0x0}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0}, {@in=@broadcast=0xffffffff, 0xffffffffffffffff, 0x2b}, @in=@multicast2=0xe0000002, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, {0x0, 0x0, 0x0, 0x0}, {0x0, 0x0, 0x0}, 0xffffffffffffffff, 0xffffffffffffffff, 0xa, 0x2, 0x0, 0x0}, [@coaddr={0x14, 0xe, @in=@remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}}]}, 0x104}, 0x1, 0x0, 0x0, 0x0}, 0x0) 2018/02/01 04:11:22 executing program 1: openat$ion(0xffffffffffffff9c, &(0x7f0000801000-0x9)='/dev/ion\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000233000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) write$tun(0xffffffffffffffff, &(0x7f0000577000)=@pi={0x0, 0x0, @eth={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x0}, [], {@canfd={0xd, {{0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0, "feb442a1f43ead325d71fed774c8f6028c2a6b79a4e418aa3c5f391769659fef9f596cdade428c389e511eaad39d2ee4334dee9516a31d00510baaf06efc0980"}}}}}, 0x5a) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004ee000-0x76)='\x00', 0x1, 0x0, 0x0}], &(0x7f000000b000-0x30)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)=""}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00005da000)={0x0, 0x0, &(0x7f00000d8000)=[], 0x48, 0x0, &(0x7f000044c000-0x83)="a410778b7a640ab0384c4ead541b6ee57c5645909ef688d8ac3e5ecfc7039f5f8ba53f127b7f01947cd3689eaf6c090277915bab2a0c450988cb85688e2bcc101a80664d3081fcc0"}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000c5a000)={0x0, 0x0, 0x0, 0x0}) mmap(&(0x7f0000000000/0x13000)=nil, 0x13000, 0x0, 0x32, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000a95000-0x30)={0x14, 0x0, &(0x7f0000b8f000)=[@increfs_done={0x40106308, r3, 0x1}], 0x0, 0x0, &(0x7f00002e4000-0x70)=""}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000436000-0x30)={0x14, 0x0, &(0x7f0000136000)=[@increfs_done={0x40106308, r3, 0x0}], 0x0, 0x0, &(0x7f0000888000-0xb)=""}) [ 302.308857] audit: type=1326 audit(1517458280.934:5313): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 pid=14936 comm="syz-executor4" exe="/root/syz-executor4" sig=0 arch=c000003e syscall=31 compat=0 ip=0x453299 code=0x7ffc0000 2018/02/01 04:11:22 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet_sctp(0x2, 0x1, 0x84) r1 = syz_open_dev$usbmon(&(0x7f0000e20000-0xd)='/dev/usbmon#\x00', 0x3ff, 0x0) fcntl$getown(r0, 0x9) ioctl$sock_bt(r1, 0x541b, &(0x7f0000286000)="8450912f1e8652ea023ad265f83d8c8c92b3d292db61dc404db259352853ca255d0940f05b8c1fc0ed32cd375f1c15ebc80d3d150853397ef50035ae0cad56fcf4e9d6f7acb4b350a6f274e459d4f2e79f060b9326475958b4b91f86fd1991d2a5cf401907c0f3bfb876b5cea809ffd88894dcf961e217ce3b96afdc2d3a6c63473f1bd1fd09f6ebfe0c91b0321120be8ee835806cd0c7c57b1e9f2f5b191412af0837db2998670a2f26abff9be97aa145b0dff1b2ef1e") sendto$inet(r0, &(0x7f0000022000-0x16)="01", 0x1, 0x0, &(0x7f0000031000-0x10)={0x2, 0xffffffffffffffff, @local={0xac, 0x14, 0xffffffffffffffff, 0xaa}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x10) sendto$inet(r0, &(0x7f0000035000-0x95)="c6", 0x1, 0x0, &(0x7f0000034000-0x10)={0x2, 0xffffffffffffffff, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x10) ioctl$LOOP_SET_DIRECT_IO(r1, 0x4c08, 0x9) shutdown(r0, 0x1) getsockopt$inet_sctp_SCTP_STATUS(r0, 0x84, 0x74, &(0x7f0000030000-0xb8)={0x0, 0x100080, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, @in={{0x2, 0xffffffffffffffff, @multicast1=0xe0000001, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x0, 0x0, 0x0, 0x0, 0x0}}, &(0x7f0000024000-0x4)=0xb8) 2018/02/01 04:11:22 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f0000590000-0x8)='./file0\x00', 0x14) write$selinux_create(r0, &(0x7f000074c000)=@access={'system_u:object_r:dpkg_exec_t:s0', 0x20, '/usr/sbin/cups-browsed', 0x20, 0x32, 0x30, 0x0}, 0x3b) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f00007cf000)='/dev/cuse\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_STATUS(r1, 0xc05c5340, &(0x7f0000b85000)={0x6, 0x100, 0x2, {0x0, 0x0}, 0x0, 0x4, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000801000-0x9)='/dev/ion\x00', 0x0, 0x0) r3 = syz_open_dev$binder(&(0x7f0000233000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r4 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0) r5 = dup2(r3, r4) write$tun(0xffffffffffffffff, &(0x7f0000577000)=@pi={0x0, 0x0, @eth={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x0}, [], {@canfd={0xd, {{0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0, "feb442a1f43ead325d71fed774c8f6028c2a6b79a4e418aa3c5f391769659fef9f596cdade428c389e511eaad39d2ee4334dee9516a31d00510baaf06efc0980"}}}}}, 0x5a) r6 = dup2(r4, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004ee000-0x76)='\x00', 0x1, 0x0, 0x0}], &(0x7f000000b000-0x30)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)=""}) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f00005da000)={0x0, 0x0, &(0x7f00000d8000)=[], 0x24, 0x0, &(0x7f000044c000-0x83)="a410778b7a640ab0384c4ead541b6ee57c5645909ef688d8ac3e5ecfc7039f5f8ba53f12"}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000c5a000)={0x0, 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000a95000-0x30)={0x14, 0x0, &(0x7f0000b8f000)=[@increfs_done={0x40106308, r7, 0x1}], 0x0, 0x0, &(0x7f00002e4000-0x70)=""}) getsockopt$inet6_dccp_buf(r5, 0x21, 0xcf, &(0x7f0000e10000-0xcc)=""/204, &(0x7f000037d000-0x4)=0xcc) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000436000-0x30)={0x20, 0x0, &(0x7f0000136000)=[@dead_binder_done={0x40086310, 0x3}, @increfs_done={0x40106308, r7, 0x0}], 0x0, 0x0, &(0x7f0000888000-0xb)=""}) close(r2) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000002000-0x38)={0x0, 0x0, &(0x7f0000003000)=[], 0x0, &(0x7f0000002000)=[{0x10, 0x10e, 0x0, ""}], 0x10, 0x0}, 0x0) [ 302.308868] audit: type=1326 audit(1517458280.940:5314): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 pid=14936 comm="syz-executor4" exe="/root/syz-executor4" sig=0 arch=c000003e syscall=202 compat=0 ip=0x453299 code=0x7ffc0000 [ 302.308879] audit: type=1326 audit(1517458281.010:5315): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 pid=14949 comm="syz-executor4" exe="/root/syz-executor4" sig=0 arch=c000003e syscall=202 compat=0 ip=0x453299 code=0x7ffc0000 [ 302.308890] audit: type=1326 audit(1517458281.010:5316): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 pid=14949 comm="syz-executor4" exe="/root/syz-executor4" sig=0 arch=c000003e syscall=202 compat=0 ip=0x453299 code=0x7ffc0000 [ 302.308901] audit: type=1326 audit(1517458281.015:5317): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 pid=14949 comm="syz-executor4" exe="/root/syz-executor4" sig=0 arch=c000003e syscall=317 compat=0 ip=0x453299 code=0x7ffc0000 [ 302.308911] audit: type=1326 audit(1517458281.015:5318): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 pid=14949 comm="syz-executor4" exe="/root/syz-executor4" sig=0 arch=c000003e syscall=202 compat=0 ip=0x453299 code=0x7ffc0000 2018/02/01 04:11:22 executing program 4: mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x12801, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$amidi(&(0x7f0000735000)='/dev/amidi#\x00', 0x7ff, 0x103000) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r1, 0x40045532, &(0x7f0000350000-0x4)=0x7fffffff) finit_module(r0, &(0x7f00000f8000-0x8)='keyring\x00', 0x1) fchdir(r0) seccomp(0x1, 0x0, &(0x7f0000457000)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x407ffc0003}]}) ioctl$TIOCLINUX7(r1, 0x541c, &(0x7f000020d000-0x2)={0x7, 0x7fff}) shmctl$IPC_INFO(0x0, 0x3, &(0x7f0000cac000-0x1000)=""/4096) 2018/02/01 04:11:22 executing program 3: mmap(&(0x7f0000000000/0xf21000)=nil, 0xf21000, 0x3, 0x32, 0xffffffffffffffff, 0x0) socketpair$inet(0x1e, 0x1, 0x0, &(0x7f00001b7000-0x8)={0x0, 0x0}) sendmsg$key(r1, &(0x7f0000d4c000)={0x0, 0x0, &(0x7f000089c000)={&(0x7f0000e6d000-0x1f8)={0x2, 0x0, 0x0, 0x0, 0x2, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, []}, 0xffffffa3}, 0x1, 0x0, 0x0, 0x0}, 0x0) close(r1) ioctl$KVM_CREATE_DEVICE(0xffffffffffffff9c, 0xc00caee0, &(0x7f0000611000-0xc)={0xd81c1355b0b61a83, r0, 0x1}) mmap(&(0x7f0000f21000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) setsockopt$inet_int(r2, 0x0, 0x1f, &(0x7f0000f22000-0x4)=0x400, 0x4) ioctl$KVM_SET_LAPIC(r2, 0x4400ae8f, &(0x7f0000a1d000-0x400)={"ba9bd21924a8c83a68e7bafde3722cd75957bfff6dd1d9717b088d4c093e45e383009435a7c488f2f59292dd4b310f9aebb4e21edf01a4f8862763bc50003ed97d77634be7466efa402f449072bd9f4063dee77b4a279a9d0f4bc2f5f1709a82a027afa4e03d9036d8600f9d71125d3e8cffd308f87de39bafb0f196fa37a82fc924ca9273ebcb44c0b1d0329feb3d7fe751a80ac4ba7d84931ee14747eb551cc8e7e27f4fb3664a20d1578edcbf11b17b2d744808fd4024109120de93f9420b88527d6c8b2282bcdb82610fc544d52d70b789bd027aca8c4ee476e49bdec4949e0ee1ab7002fa5fb6a490503424efc67df10b93033ba595d6acafa45ae1341db4ae5ea9a7acf42ac2e8de8347fb9caa082def45f0a2a3c837b16f9a21159cc37f92fb58c884e8c7c9b17c8f7c24e8eca25fd9acae4ffa886e5c87f113065ff7e7392abefe0c4f8a0ca9dc65bb50e146ea76a3fd31624c45ee7aad6fb54f24fe516a707fa3f4582b54a35769ef3f19f9f4c590fc002710640d394d503f2e48c28325425d3eea6f220d62a858e7658ece235ff7a0a818ebb19b402d68a0711db43143f5a5a7885693a115a1f42b46b15a9e415a723ad00af513bd593fd536305e60b8c6354affd01cd0556f7c47955a7415d2aa040ba7d799b7ee01ec65cd0439d6b911fc807cf9a396b76f83a0b4c5c2a086a307864404aa71a26e33c4ad50e65638d21fac86fb2f5816bb6a49d243f99ae505f74259970aadf2c1e464a4dfc098bf47225ebc773c7d91c25708cc87f751f5d8839caa70169738f7e38a1e25a556968d94a43618defe010cd4476c2841d866f672c497020aba6ec312e9448a9ce2bc8fc8a6f99db42ca87890e1e1267e55106ade517d66d433e2ef60a835239cf988fa37c0891a05f69f1699824fc834766643215ee3e2f64a701ef958263f0b4687aadee616122be0dfd19f263fb1809219be40cc412566df630a9264c6c851814de53bb0cb06e356235aca513274bc5d33c0beb22e9b80ccc2ec69b3f0c42498df651df0d7eb974b8721a0d7a34ceb8b7fc4d6b7fe018dc177feb76ef5d08daa8305f2baec8f257cc8314af2d55ecc14ca80db1decab0bc078f44e648cdecc4c1751901ac416728d0e0286283ad24f78217d4a9c2848c621f3765d36cc60250633a14885960927ba27892c087ae5a297622a90d049ccee8baea666b57c89dcf036109e1eb9c2c5f299f10a0e86ef92cad201806b49c1d4669c429aa67da5a610516932623a443085b0716b849121c6fcd234a987ba1289627e912a9fe146af6da125422dae6defa027d6da4a3a6d2981ea84dc40335b00a68e4e86ef4a3e03eb02986234256d7a0936cdf9d27dbfbc161149e662c02f131ca4749af89af5f8e29f90ffa92251a8e2751bd4cf41bfe884907f0d36db8986d878f0c112f5577d"}) recvmsg(r0, &(0x7f00002ed000)={&(0x7f000055a000-0x14)=@ll={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @random=""/6, [0x0, 0x0]}, 0x14, &(0x7f0000687000-0x60)=[{&(0x7f0000ae3000)=""/22, 0xffffff08}], 0x1, &(0x7f0000f1c000-0x1000)=""/4096, 0xffffffffffffff73, 0x0}, 0x121) 2018/02/01 04:11:22 executing program 1: openat$ion(0xffffffffffffff9c, &(0x7f0000801000-0x9)='/dev/ion\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000233000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) write$tun(0xffffffffffffffff, &(0x7f0000577000)=@pi={0x0, 0x0, @eth={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x0}, [], {@canfd={0xd, {{0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0, "feb442a1f43ead325d71fed774c8f6028c2a6b79a4e418aa3c5f391769659fef9f596cdade428c389e511eaad39d2ee4334dee9516a31d00510baaf06efc0980"}}}}}, 0x5a) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004ee000-0x76)='\x00', 0x1, 0x0, 0x0}], &(0x7f000000b000-0x30)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)=""}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00005da000)={0x0, 0x0, &(0x7f00000d8000)=[], 0x48, 0x0, &(0x7f000044c000-0x83)="a410778b7a640ab0384c4ead541b6ee57c5645909ef688d8ac3e5ecfc7039f5f8ba53f127b7f01947cd3689eaf6c090277915bab2a0c450988cb85688e2bcc101a80664d3081fcc0"}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000c5a000)={0x0, 0x0, 0x0, 0x0}) mmap(&(0x7f0000000000/0x13000)=nil, 0x13000, 0x0, 0x32, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000a95000-0x30)={0x14, 0x0, &(0x7f0000b8f000)=[@increfs_done={0x40106308, r3, 0x1}], 0x0, 0x0, &(0x7f00002e4000-0x70)=""}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000436000-0x30)={0x14, 0x0, &(0x7f0000136000)=[@increfs_done={0x40106308, r3, 0x0}], 0x0, 0x0, &(0x7f0000888000-0xb)=""}) 2018/02/01 04:11:22 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f0000590000-0x8)='./file0\x00', 0x14) write$selinux_create(r0, &(0x7f000074c000)=@access={'system_u:object_r:dpkg_exec_t:s0', 0x20, '/usr/sbin/cups-browsed', 0x20, 0x32, 0x30, 0x0}, 0x3b) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f00007cf000)='/dev/cuse\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_STATUS(r1, 0xc05c5340, &(0x7f0000b85000)={0x6, 0x100, 0x2, {0x0, 0x0}, 0x0, 0x4, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000801000-0x9)='/dev/ion\x00', 0x0, 0x0) r3 = syz_open_dev$binder(&(0x7f0000233000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r4 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0) r5 = dup2(r3, r4) write$tun(0xffffffffffffffff, &(0x7f0000577000)=@pi={0x0, 0x0, @eth={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x0}, [], {@canfd={0xd, {{0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0, "feb442a1f43ead325d71fed774c8f6028c2a6b79a4e418aa3c5f391769659fef9f596cdade428c389e511eaad39d2ee4334dee9516a31d00510baaf06efc0980"}}}}}, 0x5a) r6 = dup2(r4, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004ee000-0x76)='\x00', 0x1, 0x0, 0x0}], &(0x7f000000b000-0x30)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)=""}) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f00005da000)={0x0, 0x0, &(0x7f00000d8000)=[], 0x24, 0x0, &(0x7f000044c000-0x83)="a410778b7a640ab0384c4ead541b6ee57c5645909ef688d8ac3e5ecfc7039f5f8ba53f12"}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000c5a000)={0x0, 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000a95000-0x30)={0x14, 0x0, &(0x7f0000b8f000)=[@increfs_done={0x40106308, r7, 0x1}], 0x0, 0x0, &(0x7f00002e4000-0x70)=""}) getsockopt$inet6_dccp_buf(r5, 0x21, 0xcf, &(0x7f0000e10000-0xcc)=""/204, &(0x7f000037d000-0x4)=0xcc) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000436000-0x30)={0x20, 0x0, &(0x7f0000136000)=[@dead_binder_done={0x40086310, 0x3}, @increfs_done={0x40106308, r7, 0x0}], 0x0, 0x0, &(0x7f0000888000-0xb)=""}) close(r2) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000002000-0x38)={0x0, 0x0, &(0x7f0000003000)=[], 0x0, &(0x7f0000002000)=[{0x10, 0x10e, 0x0, ""}], 0x10, 0x0}, 0x0) 2018/02/01 04:11:22 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = syz_open_dev$amidi(&(0x7f0000fb7000)='/dev/amidi#\x00', 0xffffffffffffff80, 0x4000) getsockopt$inet_sctp6_SCTP_LOCAL_AUTH_CHUNKS(r1, 0x84, 0x1b, &(0x7f0000aa3000)={0x0, 0x12, "4ee91e9cc90c146c918ed8cd8fb1b2712187"}, &(0x7f000004b000-0x4)=0x1a) setsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r1, 0x84, 0x72, &(0x7f00003ac000+0x93a)={r2, 0x3, 0x471b692c7cb971b5}, 0xc) ioctl$SNDRV_CTL_IOCTL_TLV_WRITE(r1, 0xc008551b, &(0x7f000093b000-0xc)={0x4, 0x4, [0x3]}) socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000)=0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bind$inet6(r0, &(0x7f000039d000-0x1c)={0xa, 0x2, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x0}, 0x1c) ioctl$DRM_IOCTL_AGP_ALLOC(r1, 0xc0206434, &(0x7f0000e55000-0x20)={0x6, 0x0, 0x3, 0xfffffffffffffffb}) ioctl$DRM_IOCTL_AGP_ALLOC(r1, 0xc0206434, &(0x7f0000d31000-0x20)={0x80, 0x0, 0x10000, 0xa11c}) ioctl$DRM_IOCTL_AGP_UNBIND(r1, 0x40106437, &(0x7f00004c3000)={0x0, 0x3ff}) listen(r1, 0x0) ioctl$TCSETAF(r1, 0x5408, &(0x7f00009b1000-0x14)={0x100000000, 0x9, 0x80, 0x7, 0x2, 0x6, 0x2, 0x97, 0x7fffffff, 0x4}) syz_emit_ethernet(0x4a, &(0x7f00007b1000)={@local={[0xaa, 0xaa, 0xaa, 0xaa], 0x0, 0xaa}, @dev={[0xaa, 0xaa, 0xaa, 0xaa], 0xffffffffffffffff, 0x0}, [], {@ipv6={0x86dd, {0x0, 0x6, "01ff00", 0x14, 0x6, 0x0, @remote={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0xffffffffffffffff, 0xbb}, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x1}, {[], @tcp={{0xffffffffffffffff, 0x2, 0x42424242, 0x42424242, 0x0, 0x0, 0x5, 0x10, 0x0, 0x0, 0x0, {[]}}, {""}}}}}}}, 0x0) ioctl$EVIOCGREP(r1, 0x80084503, &(0x7f0000d27000)=""/76) 2018/02/01 04:11:22 executing program 2: openat$ion(0xffffffffffffff9c, &(0x7f0000801000-0x9)='/dev/ion\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000233000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = dup2(r0, r1) write$tun(0xffffffffffffffff, &(0x7f0000577000)=@pi={0x0, 0x0, @eth={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x0}, [], {@canfd={0xd, {{0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0, "feb442a1f43ead325d71fed774c8f6028c2a6b79a4e418aa3c5f391769659fef9f596cdade428c389e511eaad39d2ee4334dee9516a31d00510baaf06efc0980"}}}}}, 0x5a) ioctl$TIOCGSID(r2, 0x5429, &(0x7f000004b000-0x4)=0x0) getpid() r3 = dup2(r1, r0) ioctl$TIOCGPGRP(r3, 0x540f, &(0x7f00005e6000-0x4)=0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004ee000-0x76)='\x00', 0x1, 0x0, 0x0}], &(0x7f000000b000-0x30)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)=""}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00005da000)={0x0, 0x0, &(0x7f00000d8000)=[], 0x48, 0x0, &(0x7f000044c000-0x83)="a410778b7a640ab0384c4ead541b6ee57c5645909ef688d8ac3e5ecfc7039f5f8ba53f127b7f01947cd3689eaf6c090277915bab2a0c450988cb85688e2bcc101a80664d3081fcc0"}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000c5a000)={0x0, 0x0, 0x0, 0x0}) mmap(&(0x7f0000000000/0x13000)=nil, 0x13000, 0x0, 0x32, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000a95000-0x30)={0x14, 0x0, &(0x7f0000b8f000)=[@increfs_done={0x40106308, r4, 0x1}], 0x0, 0x0, &(0x7f00002e4000-0x70)=""}) 2018/02/01 04:11:22 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet_sctp(0x2, 0x1, 0x84) r1 = syz_open_dev$usbmon(&(0x7f0000e20000-0xd)='/dev/usbmon#\x00', 0x3ff, 0x0) fcntl$getown(r0, 0x9) ioctl$sock_bt(r1, 0x541b, &(0x7f0000286000)="8450912f1e8652ea023ad265f83d8c8c92b3d292db61dc404db259352853ca255d0940f05b8c1fc0ed32cd375f1c15ebc80d3d150853397ef50035ae0cad56fcf4e9d6f7acb4b350a6f274e459d4f2e79f060b9326475958b4b91f86fd1991d2a5cf401907c0f3bfb876b5cea809ffd88894dcf961e217ce3b96afdc2d3a6c63473f1bd1fd09f6ebfe0c91b0321120be8ee835806cd0c7c57b1e9f2f5b191412af0837db2998670a2f26abff9be97aa145b0dff1b2ef1e") sendto$inet(r0, &(0x7f0000022000-0x16)="01", 0x1, 0x0, &(0x7f0000031000-0x10)={0x2, 0xffffffffffffffff, @local={0xac, 0x14, 0xffffffffffffffff, 0xaa}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x10) sendto$inet(r0, &(0x7f0000035000-0x95)="c6", 0x1, 0x0, &(0x7f0000034000-0x10)={0x2, 0xffffffffffffffff, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x10) ioctl$LOOP_SET_DIRECT_IO(r1, 0x4c08, 0x9) shutdown(r0, 0x1) getsockopt$inet_sctp_SCTP_STATUS(r0, 0x84, 0x74, &(0x7f0000030000-0xb8)={0x0, 0x100080, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, @in={{0x2, 0xffffffffffffffff, @multicast1=0xe0000001, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x0, 0x0, 0x0, 0x0, 0x0}}, &(0x7f0000024000-0x4)=0xb8) 2018/02/01 04:11:22 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) kexec_load(0x0, 0x1, &(0x7f00000ec000)=[{&(0x7f00000a5000)="4804d3c1cc0ba3355b1baf661a653160e1d623a1684dd31e6c28c4b29b5abd203b2d74faa1fc26452b657bcf15fb3762d31eb6f46d4c2d0a36492485b1e80d5d48c86d035af106c664367dae779fb8e3fa9a72a7b75a31838f179e1b321eb7c98f3e28bcc80980b422901fc3e23844fee4c977e25b793d26bae1d6f310e82c0c8ea6954c775f7acbd1e874eb", 0x8c, 0x7f, 0x37}], 0x3e0000) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000a8d000)={&(0x7f0000e4e000)={0x10, 0x0, 0x0, 0x0}, 0xc, &(0x7f0000fcf000-0x10)={&(0x7f00005d5000)=@updsa={0x104, 0x1a, 0x1, 0xffffffffffffffff, 0xffffffffffffffff, {{@in6=@local={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0xffffffffffffffff, 0xaa}, @in=@dev={0xac, 0x14, 0xffffffffffffffff, 0x0}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0}, {@in=@broadcast=0xffffffff, 0xffffffffffffffff, 0x2b}, @in=@multicast2=0xe0000002, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, {0x0, 0x0, 0x0, 0x0}, {0x0, 0x0, 0x0}, 0xffffffffffffffff, 0xffffffffffffffff, 0xa, 0x2, 0x0, 0x0}, [@coaddr={0x14, 0xe, @in=@remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}}]}, 0x104}, 0x1, 0x0, 0x0, 0x0}, 0x0) [ 302.308922] audit: type=1326 audit(1517458281.023:5319): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 pid=14949 comm="syz-executor4" exe="/root/syz-executor4" sig=0 arch=c000003e syscall=202 compat=0 ip=0x453299 code=0x7ffc0000 [ 302.308933] audit: type=1326 audit(1517458281.026:5320): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 pid=14949 comm="syz-executor4" exe="/root/syz-executor4" sig=0 arch=c000003e syscall=31 compat=0 ip=0x453299 code=0x7ffc0000 2018/02/01 04:11:22 executing program 1: openat$ion(0xffffffffffffff9c, &(0x7f0000801000-0x9)='/dev/ion\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000233000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) write$tun(0xffffffffffffffff, &(0x7f0000577000)=@pi={0x0, 0x0, @eth={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x0}, [], {@canfd={0xd, {{0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0, "feb442a1f43ead325d71fed774c8f6028c2a6b79a4e418aa3c5f391769659fef9f596cdade428c389e511eaad39d2ee4334dee9516a31d00510baaf06efc0980"}}}}}, 0x5a) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004ee000-0x76)='\x00', 0x1, 0x0, 0x0}], &(0x7f000000b000-0x30)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)=""}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00005da000)={0x0, 0x0, &(0x7f00000d8000)=[], 0x48, 0x0, &(0x7f000044c000-0x83)="a410778b7a640ab0384c4ead541b6ee57c5645909ef688d8ac3e5ecfc7039f5f8ba53f127b7f01947cd3689eaf6c090277915bab2a0c450988cb85688e2bcc101a80664d3081fcc0"}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000c5a000)={0x0, 0x0, 0x0, 0x0}) mmap(&(0x7f0000000000/0x13000)=nil, 0x13000, 0x0, 0x32, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000a95000-0x30)={0x14, 0x0, &(0x7f0000b8f000)=[@increfs_done={0x40106308, r3, 0x1}], 0x0, 0x0, &(0x7f00002e4000-0x70)=""}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000436000-0x30)={0x20, 0x0, &(0x7f0000136000)=[@dead_binder_done={0x40086310, 0x0}, @increfs_done={0x40106308, r3, 0x0}], 0x0, 0x0, &(0x7f0000888000-0xb)=""}) 2018/02/01 04:11:22 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f0000590000-0x8)='./file0\x00', 0x14) write$selinux_create(r0, &(0x7f000074c000)=@access={'system_u:object_r:dpkg_exec_t:s0', 0x20, '/usr/sbin/cups-browsed', 0x20, 0x32, 0x30, 0x0}, 0x3b) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f00007cf000)='/dev/cuse\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_STATUS(r1, 0xc05c5340, &(0x7f0000b85000)={0x6, 0x100, 0x2, {0x0, 0x0}, 0x0, 0x4, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000801000-0x9)='/dev/ion\x00', 0x0, 0x0) r3 = syz_open_dev$binder(&(0x7f0000233000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r4 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0) r5 = dup2(r3, r4) write$tun(0xffffffffffffffff, &(0x7f0000577000)=@pi={0x0, 0x0, @eth={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x0}, [], {@canfd={0xd, {{0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0, "feb442a1f43ead325d71fed774c8f6028c2a6b79a4e418aa3c5f391769659fef9f596cdade428c389e511eaad39d2ee4334dee9516a31d00510baaf06efc0980"}}}}}, 0x5a) r6 = dup2(r4, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004ee000-0x76)='\x00', 0x1, 0x0, 0x0}], &(0x7f000000b000-0x30)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)=""}) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f00005da000)={0x0, 0x0, &(0x7f00000d8000)=[], 0x36, 0x0, &(0x7f000044c000-0x83)="a410778b7a640ab0384c4ead541b6ee57c5645909ef688d8ac3e5ecfc7039f5f8ba53f127b7f01947cd3689eaf6c090277915bab2a0c"}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000c5a000)={0x0, 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000a95000-0x30)={0x14, 0x0, &(0x7f0000b8f000)=[@increfs_done={0x40106308, r7, 0x1}], 0x0, 0x0, &(0x7f00002e4000-0x70)=""}) getsockopt$inet6_dccp_buf(r5, 0x21, 0xcf, &(0x7f0000e10000-0xcc)=""/204, &(0x7f000037d000-0x4)=0xcc) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000436000-0x30)={0x20, 0x0, &(0x7f0000136000)=[@dead_binder_done={0x40086310, 0x3}, @increfs_done={0x40106308, r7, 0x0}], 0x0, 0x0, &(0x7f0000888000-0xb)=""}) close(r2) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000002000-0x38)={0x0, 0x0, &(0x7f0000003000)=[], 0x0, &(0x7f0000002000)=[{0x10, 0x10e, 0x0, ""}], 0x10, 0x0}, 0x0) [ 302.308943] audit: type=1326 audit(1517458281.026:5321): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 pid=14949 comm="syz-executor4" exe="/root/syz-executor4" sig=0 arch=c000003e syscall=202 compat=0 ip=0x453299 code=0x7ffc0000 2018/02/01 04:11:22 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f000079b000)='/dev/hwrng\x00', 0x4000, 0x0) setsockopt$inet_sctp_SCTP_NODELAY(r0, 0x84, 0x3, &(0x7f00004c0000)=0x45, 0x4) seccomp(0x1, 0x0, &(0x7f000089b000-0x10)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x407ffc0003}]}) setsockopt$inet_MCAST_LEAVE_GROUP(r0, 0x0, 0x2d, &(0x7f00006d6000-0x90)={0x9, {{0x2, 0x3, @loopback=0x7f000001, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}}, 0x90) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r0, 0x84, 0x7c, &(0x7f0000c32000)={0x0, 0x1, 0x80000001}, &(0x7f0000527000)=0x8) rt_sigreturn() setsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r0, 0x84, 0xa, &(0x7f0000bad000)={0x10001, 0x9, 0x1, 0x0, 0x3f, 0x1b7d7de, 0x9, 0x7f, r1}, 0x20) setsockopt$inet_sctp_SCTP_PEER_ADDR_THLDS(r0, 0x84, 0x1f, &(0x7f0000651000-0x98)={r1, @in6={{0xa, 0x3, 0x2, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x1}, 0x7}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x4, 0x10001}, 0x98) shmctl$IPC_INFO(0x0, 0x3, &(0x7f0000564000)=""/4096) 2018/02/01 04:11:22 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x4) bind$netlink(r0, &(0x7f0000706000-0xc)={0x10, 0x0, 0x0, 0x6}, 0xc) getsockopt$netlink(r0, 0x10e, 0x9, &(0x7f0000c5a000)=""/0, &(0x7f0000fb2000-0x4)=0x0) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000948000)='/dev/sequencer2\x00', 0x40000, 0x0) r2 = syz_open_dev$mouse(&(0x7f00008fe000-0x12)='/dev/input/mouse#\x00', 0x1, 0x80000) ioctl$ION_IOC_HEAP_QUERY(r1, 0xc0184908, &(0x7f0000323000-0x18)={0x6, 0x1, 0x1, r2, 0x0}) r3 = socket(0xa, 0x2000000001, 0x0) getsockopt$inet_sctp_SCTP_LOCAL_AUTH_CHUNKS(r3, 0x84, 0x1b, &(0x7f0000551000-0x2d)={0x0, 0x25, "1d99cc1a7b75b2b5e9de5f54df6f34169664f3b640587f9373c3eec667929470ff8da6fb5a"}, &(0x7f0000cd4000-0x4)=0x2d) getsockopt$inet_sctp_SCTP_MAXSEG(r3, 0x84, 0xd, &(0x7f0000629000-0x4)=@assoc_id=r4, &(0x7f0000ce7000-0x4)=0x4) ioctl$DRM_IOCTL_MODE_GETCRTC(0xffffffffffffffff, 0xc06864a1, &(0x7f0000fee000-0x68)={&(0x7f000000d000)=[0x7, 0x6], 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, "8cfbc89fefc282b0e9b6d1b29d5500b5ff74b06ccbd9dee8c886586975b5446e"}}) getsockopt$inet_sctp6_SCTP_RTOINFO(r1, 0x84, 0x0, &(0x7f00007be000)={r4, 0x0, 0x0, 0x2}, &(0x7f0000bab000)=0x10) getsockopt(r3, 0x0, 0x53, &(0x7f000000d000)=""/8, &(0x7f0000736000-0x4)=0x8) 2018/02/01 04:11:22 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet_sctp(0x2, 0x1, 0x84) r1 = syz_open_dev$usbmon(&(0x7f0000e20000-0xd)='/dev/usbmon#\x00', 0x3ff, 0x0) fcntl$getown(r0, 0x9) ioctl$sock_bt(r1, 0x541b, &(0x7f0000286000)="8450912f1e8652ea023ad265f83d8c8c92b3d292db61dc404db259352853ca255d0940f05b8c1fc0ed32cd375f1c15ebc80d3d150853397ef50035ae0cad56fcf4e9d6f7acb4b350a6f274e459d4f2e79f060b9326475958b4b91f86fd1991d2a5cf401907c0f3bfb876b5cea809ffd88894dcf961e217ce3b96afdc2d3a6c63473f1bd1fd09f6ebfe0c91b0321120be8ee835806cd0c7c57b1e9f2f5b191412af0837db2998670a2f26abff9be97aa145b0dff1b2ef1e") sendto$inet(r0, &(0x7f0000022000-0x16)="01", 0x1, 0x0, &(0x7f0000031000-0x10)={0x2, 0xffffffffffffffff, @local={0xac, 0x14, 0xffffffffffffffff, 0xaa}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x10) sendto$inet(r0, &(0x7f0000035000-0x95)="c6", 0x1, 0x0, &(0x7f0000034000-0x10)={0x2, 0xffffffffffffffff, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x10) ioctl$LOOP_SET_DIRECT_IO(r1, 0x4c08, 0x9) shutdown(r0, 0x1) getsockopt$inet_sctp_SCTP_STATUS(r0, 0x84, 0x74, &(0x7f0000030000-0xb8)={0x0, 0x100080, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, @in={{0x2, 0xffffffffffffffff, @multicast1=0xe0000001, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x0, 0x0, 0x0, 0x0, 0x0}}, &(0x7f0000024000-0x4)=0xb8) 2018/02/01 04:11:22 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f0000590000-0x8)='./file0\x00', 0x14) write$selinux_create(r0, &(0x7f000074c000)=@access={'system_u:object_r:dpkg_exec_t:s0', 0x20, '/usr/sbin/cups-browsed', 0x20, 0x32, 0x30, 0x0}, 0x3b) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f00007cf000)='/dev/cuse\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_STATUS(r1, 0xc05c5340, &(0x7f0000b85000)={0x6, 0x100, 0x2, {0x0, 0x0}, 0x0, 0x4, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000801000-0x9)='/dev/ion\x00', 0x0, 0x0) r3 = syz_open_dev$binder(&(0x7f0000233000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r4 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0) r5 = dup2(r3, r4) write$tun(0xffffffffffffffff, &(0x7f0000577000)=@pi={0x0, 0x0, @eth={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x0}, [], {@canfd={0xd, {{0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0, "feb442a1f43ead325d71fed774c8f6028c2a6b79a4e418aa3c5f391769659fef9f596cdade428c389e511eaad39d2ee4334dee9516a31d00510baaf06efc0980"}}}}}, 0x5a) r6 = dup2(r4, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004ee000-0x76)='\x00', 0x1, 0x0, 0x0}], &(0x7f000000b000-0x30)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)=""}) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f00005da000)={0x0, 0x0, &(0x7f00000d8000)=[], 0x36, 0x0, &(0x7f000044c000-0x83)="a410778b7a640ab0384c4ead541b6ee57c5645909ef688d8ac3e5ecfc7039f5f8ba53f127b7f01947cd3689eaf6c090277915bab2a0c"}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000c5a000)={0x0, 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000a95000-0x30)={0x14, 0x0, &(0x7f0000b8f000)=[@increfs_done={0x40106308, r7, 0x1}], 0x0, 0x0, &(0x7f00002e4000-0x70)=""}) getsockopt$inet6_dccp_buf(r5, 0x21, 0xcf, &(0x7f0000e10000-0xcc)=""/204, &(0x7f000037d000-0x4)=0xcc) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000436000-0x30)={0x20, 0x0, &(0x7f0000136000)=[@dead_binder_done={0x40086310, 0x3}, @increfs_done={0x40106308, r7, 0x0}], 0x0, 0x0, &(0x7f0000888000-0xb)=""}) close(r2) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000002000-0x38)={0x0, 0x0, &(0x7f0000003000)=[], 0x0, &(0x7f0000002000)=[{0x10, 0x10e, 0x0, ""}], 0x10, 0x0}, 0x0) 2018/02/01 04:11:22 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f000035c000-0x16)='/selinux/checkreqprot\x00', 0x400, 0x0) bind$bt_l2cap(r0, &(0x7f0000162000-0xe)={0x1f, 0xffffffffffffa6cb, {0xffffffffa6e18377, 0x0, 0x46, 0x5, 0x7, 0xb5}, 0x401, 0x3}, 0xe) seccomp(0x1, 0x0, &(0x7f000089b000-0x10)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x407ffc0003}]}) shmctl$IPC_INFO(0x0, 0x3, &(0x7f0000564000)=""/4096) [ 302.347913] binder: 15097:15102 BC_INCREFS_DONE u00000000204edf8a node 1417 cookie mismatch 0000000000000000 != 0000000000000001 [ 302.355801] binder: BINDER_SET_CONTEXT_MGR already set [ 302.355810] binder: 15099:15107 ioctl 40046207 0 returned -16 [ 302.357049] binder_alloc: 15097: binder_alloc_buf, no vma [ 302.357072] binder: 15099:15107 transaction failed 29189/-3, size 40-8 line 2903 [ 302.365674] binder: 15099:15107 BC_INCREFS_DONE u0000000000000000 no match [ 302.373437] binder: BINDER_SET_CONTEXT_MGR already set [ 302.373447] binder: 15112:15113 ioctl 40046207 0 returned -16 [ 302.374498] binder_alloc: 15097: binder_alloc_buf, no vma [ 302.374522] binder: 15112:15113 transaction failed 29189/-3, size 40-8 line 2903 [ 302.381284] binder: BINDER_SET_CONTEXT_MGR already set 2018/02/01 04:11:22 executing program 2: openat$ion(0xffffffffffffff9c, &(0x7f0000801000-0x9)='/dev/ion\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000233000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) write$tun(0xffffffffffffffff, &(0x7f0000577000)=@pi={0x0, 0x0, @eth={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x0}, [], {@canfd={0xd, {{0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0, "feb442a1f43ead325d71fed774c8f6028c2a6b79a4e418aa3c5f391769659fef9f596cdade428c389e511eaad39d2ee4334dee9516a31d00510baaf06efc0980"}}}}}, 0x5a) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004ee000-0x76)='\x00', 0x1, 0x0, 0x0}], &(0x7f000000b000-0x30)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)=""}) r3 = mmap$binder(&(0x7f000044d000/0x1000)=nil, 0x1000, 0x8, 0x8b013, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00005e5000)={0x94, 0x0, &(0x7f0000931000)=[@reply_sg={0x40486312, {{0x4, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x38, &(0x7f0000c0b000-0x50)=[@fda={0x66646185, 0x884, 0x1, 0x18}, @fd={0x66642a85, 0x0, r1, 0x0, 0x6}, @fd={0x66642a85, 0x0, r2, 0x0, 0x0}], &(0x7f0000b77000-0x38)=[0x0, 0x40, 0x18, 0x38, 0x38, 0x30, 0x0]}, 0x7f}}, @register_looper={0x630b}, @increfs_done={0x40106308, r3, 0x1}, @decrefs={0x40046307, 0x1}, @exit_looper={0x630d}, @dead_binder_done={0x40086310, 0x1}, @increfs={0x40046304, 0x3}, @enter_looper={0x630c}, @dead_binder_done={0x40086310, 0x4}], 0xd2, 0x0, &(0x7f0000bb8000-0xd2)="95366fc1495d52fae5e68fab091ad57712b0825b3ec0beff149b709aa5c578693b70839036bbbe783cd51a6c8a83000e3074d80e9d4f71693ee07c1ffb3ce51b386d5a07485f0e33beb9cf7e18f6cbf1a3271d4d459cb5ac931cb930886bc861418d3231b5015b3bad6f1ace82b82c451c00ccdab5387739ba5c2d8903f1c7efde3994900b455a33b48d87aa2c9201bf98ca01706259f08954133c69e1e09718968af1a6f6cbfece9f67cd7674486531dfc8b1adacdaf939597b4ac6ed7d15f4dbdf0642e35eb81d8855b4ac59f44c0c4f05"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00005da000)={0x0, 0x0, &(0x7f00000d8000)=[], 0x48, 0x0, &(0x7f000044c000-0x83)="a410778b7a640ab0384c4ead541b6ee57c5645909ef688d8ac3e5ecfc7039f5f8ba53f127b7f01947cd3689eaf6c090277915bab2a0c450988cb85688e2bcc101a80664d3081fcc0"}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000c5a000)={0x0, 0x0, 0x0, 0x0}) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r1, &(0x7f0000696000)={0x8, 0x0}) mmap(&(0x7f0000000000/0x13000)=nil, 0x13000, 0x0, 0x32, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000a95000-0x30)={0x14, 0x0, &(0x7f0000b8f000)=[@increfs_done={0x40106308, r4, 0x1}], 0x0, 0x0, &(0x7f00002e4000-0x70)=""}) 2018/02/01 04:11:22 executing program 1: openat$ion(0xffffffffffffff9c, &(0x7f0000801000-0x9)='/dev/ion\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000233000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) write$tun(0xffffffffffffffff, &(0x7f0000577000)=@pi={0x0, 0x0, @eth={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x0}, [], {@canfd={0xd, {{0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0, "feb442a1f43ead325d71fed774c8f6028c2a6b79a4e418aa3c5f391769659fef9f596cdade428c389e511eaad39d2ee4334dee9516a31d00510baaf06efc0980"}}}}}, 0x5a) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004ee000-0x76)='\x00', 0x1, 0x0, 0x0}], &(0x7f000000b000-0x30)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)=""}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00005da000)={0x0, 0x0, &(0x7f00000d8000)=[], 0x48, 0x0, &(0x7f000044c000-0x83)="a410778b7a640ab0384c4ead541b6ee57c5645909ef688d8ac3e5ecfc7039f5f8ba53f127b7f01947cd3689eaf6c090277915bab2a0c450988cb85688e2bcc101a80664d3081fcc0"}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000c5a000)={0x0, 0x0, 0x0, 0x0}) mmap(&(0x7f0000000000/0x13000)=nil, 0x13000, 0x0, 0x32, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000a95000-0x30)={0x14, 0x0, &(0x7f0000b8f000)=[@increfs_done={0x40106308, r3, 0x1}], 0x0, 0x0, &(0x7f00002e4000-0x70)=""}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000436000-0x30)={0x20, 0x0, &(0x7f0000136000)=[@dead_binder_done={0x40086310, 0x0}, @increfs_done={0x40106308, r3, 0x0}], 0x0, 0x0, &(0x7f0000888000-0xb)=""}) 2018/02/01 04:11:22 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = open(&(0x7f000019c000-0x8)='./file0\x00', 0x141046, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000fb2000-0x12)='/dev/input/event#\x00', 0x20, 0x101002) write$evdev(r0, &(0x7f0000548000-0x18)=[{{0x0, 0x0}, 0x1, 0x52, 0x400000002}], 0x18) ftruncate(r0, 0x10007) getsockopt$bt_BT_SECURITY(r0, 0x112, 0x4, &(0x7f0000526000-0x2)={0x0, 0x0}, 0x2) ioctl$KVM_CREATE_DEVICE(r0, 0xc00caee0, &(0x7f0000240000)={0x0, r1, 0x1}) sendfile(r1, r0, 0x0, 0x72439a6a) prctl$getname(0x10, &(0x7f00007e8000)=""/4096) ioctl$KVM_CREATE_DEVICE(r0, 0xc00caee0, &(0x7f0000ddb000)={0x4, r0, 0x1}) 2018/02/01 04:11:22 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f0000590000-0x8)='./file0\x00', 0x14) write$selinux_create(r0, &(0x7f000074c000)=@access={'system_u:object_r:dpkg_exec_t:s0', 0x20, '/usr/sbin/cups-browsed', 0x20, 0x32, 0x30, 0x0}, 0x3b) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f00007cf000)='/dev/cuse\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_STATUS(r1, 0xc05c5340, &(0x7f0000b85000)={0x6, 0x100, 0x2, {0x0, 0x0}, 0x0, 0x4, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000801000-0x9)='/dev/ion\x00', 0x0, 0x0) r3 = syz_open_dev$binder(&(0x7f0000233000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r4 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0) r5 = dup2(r3, r4) write$tun(0xffffffffffffffff, &(0x7f0000577000)=@pi={0x0, 0x0, @eth={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x0}, [], {@canfd={0xd, {{0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0, "feb442a1f43ead325d71fed774c8f6028c2a6b79a4e418aa3c5f391769659fef9f596cdade428c389e511eaad39d2ee4334dee9516a31d00510baaf06efc0980"}}}}}, 0x5a) r6 = dup2(r4, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004ee000-0x76)='\x00', 0x1, 0x0, 0x0}], &(0x7f000000b000-0x30)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)=""}) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f00005da000)={0x0, 0x0, &(0x7f00000d8000)=[], 0x36, 0x0, &(0x7f000044c000-0x83)="a410778b7a640ab0384c4ead541b6ee57c5645909ef688d8ac3e5ecfc7039f5f8ba53f127b7f01947cd3689eaf6c090277915bab2a0c"}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000c5a000)={0x0, 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000a95000-0x30)={0x14, 0x0, &(0x7f0000b8f000)=[@increfs_done={0x40106308, r7, 0x1}], 0x0, 0x0, &(0x7f00002e4000-0x70)=""}) getsockopt$inet6_dccp_buf(r5, 0x21, 0xcf, &(0x7f0000e10000-0xcc)=""/204, &(0x7f000037d000-0x4)=0xcc) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000436000-0x30)={0x20, 0x0, &(0x7f0000136000)=[@dead_binder_done={0x40086310, 0x3}, @increfs_done={0x40106308, r7, 0x0}], 0x0, 0x0, &(0x7f0000888000-0xb)=""}) close(r2) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000002000-0x38)={0x0, 0x0, &(0x7f0000003000)=[], 0x0, &(0x7f0000002000)=[{0x10, 0x10e, 0x0, ""}], 0x10, 0x0}, 0x0) 2018/02/01 04:11:22 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) seccomp(0x1, 0x0, &(0x7f000089b000-0x10)={0x1, &(0x7f0000000000)=[{0x40000000006, 0x0, 0x0, 0x407ffc0003}]}) r0 = openat$audio(0xffffffffffffff9c, &(0x7f00006a3000)='/dev/audio\x00', 0x0, 0x0) setsockopt$inet_tcp_TCP_FASTOPEN_KEY(r0, 0x6, 0x21, &(0x7f0000c99000)="862408852d75b8c2e0ddf8dd7f17e067", 0x10) shmctl$IPC_INFO(0x0, 0x3, &(0x7f0000564000)=""/4096) 2018/02/01 04:11:22 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet_sctp(0x2, 0x1, 0x84) r1 = syz_open_dev$usbmon(&(0x7f0000e20000-0xd)='/dev/usbmon#\x00', 0x3ff, 0x0) fcntl$getown(r0, 0x9) ioctl$sock_bt(r1, 0x541b, &(0x7f0000286000)="8450912f1e8652ea023ad265f83d8c8c92b3d292db61dc404db259352853ca255d0940f05b8c1fc0ed32cd375f1c15ebc80d3d150853397ef50035ae0cad56fcf4e9d6f7acb4b350a6f274e459d4f2e79f060b9326475958b4b91f86fd1991d2a5cf401907c0f3bfb876b5cea809ffd88894dcf961e217ce3b96afdc2d3a6c63473f1bd1fd09f6ebfe0c91b0321120be8ee835806cd0c7c57b1e9f2f5b191412af0837db2998670a2f26abff9be97aa145b0dff1b2ef1e") sendto$inet(r0, &(0x7f0000022000-0x16)="01", 0x1, 0x0, &(0x7f0000031000-0x10)={0x2, 0xffffffffffffffff, @local={0xac, 0x14, 0xffffffffffffffff, 0xaa}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x10) sendto$inet(r0, &(0x7f0000035000-0x95)="c6", 0x1, 0x0, &(0x7f0000034000-0x10)={0x2, 0xffffffffffffffff, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x10) ioctl$LOOP_SET_DIRECT_IO(r1, 0x4c08, 0x9) shutdown(r0, 0x1) getsockopt$inet_sctp_SCTP_STATUS(r0, 0x84, 0x74, &(0x7f0000030000-0xb8)={0x0, 0x100080, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, @in={{0x2, 0xffffffffffffffff, @multicast1=0xe0000001, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x0, 0x0, 0x0, 0x0, 0x0}}, &(0x7f0000024000-0x4)=0xb8) 2018/02/01 04:11:22 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000a8d000)={&(0x7f0000e4e000)={0x10, 0x0, 0x0, 0x0}, 0xc, &(0x7f0000fcf000-0x10)={&(0x7f00005d5000)=@updsa={0x104, 0x1a, 0x1, 0xffffffffffffffff, 0xffffffffffffffff, {{@in6=@local={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0xffffffffffffffff, 0xaa}, @in6=@remote={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0xbb}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0}, {@in=@broadcast=0xffffffff, 0x2, 0x2b}, @in=@multicast2=0xe0000002, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, {0x0, 0x0, 0x0, 0x0}, {0x0, 0x0, 0x0}, 0xffffffffffffffff, 0xffffffffffffffff, 0xa, 0x2, 0x0, 0x0}, [@coaddr={0x14, 0xe, @in=@remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}}]}, 0x104}, 0x1, 0x0, 0x0, 0x0}, 0x0) 2018/02/01 04:11:22 executing program 5: mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$vsock_stream(0x28, 0x1, 0x0) r1 = dup2(r0, r0) mmap(&(0x7f0000003000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) write$selinux_create(r1, &(0x7f0000003000)=@access={'system_u:object_r:ld_so_t:s0', 0x20, '/usr/sbin/cups-browsed', 0x20, 0x39, 0x35, 0x0}, 0x37) mmap(&(0x7f0000004000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$sock_inet_tcp_SIOCOUTQNSD(r1, 0x894b, &(0x7f0000005000-0x4)=0x0) getsockopt$inet_IP_IPSEC_POLICY(r0, 0x28, 0x2, &(0x7f0000003000-0xe8)={{{@in=@rand_addr=0x0, @in6=@mcast2={0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, {0x0, 0x0, 0x0, 0x0}, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, {{@in=@empty=0x0, 0xffffffffffffffff, 0x0}, 0x0, @in=@rand_addr=0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, &(0x7f0000000000)=0xfffffffffffffeb2) [ 302.381293] binder: 15095:15100 ioctl 40046207 0 returned -16 [ 302.381582] binder_alloc: 15097: binder_alloc_buf, no vma [ 302.381605] binder: 15095:15100 transaction failed 29189/-3, size 40-8 line 2903 [ 302.402432] binder: BINDER_SET_CONTEXT_MGR already set [ 302.402443] binder: 15099:15107 ioctl 40046207 0 returned -16 [ 302.406251] binder_alloc: 15097: binder_alloc_buf, no vma 2018/02/01 04:11:22 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f0000590000-0x8)='./file0\x00', 0x14) write$selinux_create(r0, &(0x7f000074c000)=@access={'system_u:object_r:dpkg_exec_t:s0', 0x20, '/usr/sbin/cups-browsed', 0x20, 0x32, 0x30, 0x0}, 0x3b) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f00007cf000)='/dev/cuse\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_STATUS(r1, 0xc05c5340, &(0x7f0000b85000)={0x6, 0x100, 0x2, {0x0, 0x0}, 0x0, 0x4, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000801000-0x9)='/dev/ion\x00', 0x0, 0x0) r3 = syz_open_dev$binder(&(0x7f0000233000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r4 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0) r5 = dup2(r3, r4) write$tun(0xffffffffffffffff, &(0x7f0000577000)=@pi={0x0, 0x0, @eth={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x0}, [], {@canfd={0xd, {{0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0, "feb442a1f43ead325d71fed774c8f6028c2a6b79a4e418aa3c5f391769659fef9f596cdade428c389e511eaad39d2ee4334dee9516a31d00510baaf06efc0980"}}}}}, 0x5a) r6 = dup2(r4, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004ee000-0x76)='\x00', 0x1, 0x0, 0x0}], &(0x7f000000b000-0x30)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)=""}) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f00005da000)={0x0, 0x0, &(0x7f00000d8000)=[], 0x3f, 0x0, &(0x7f000044c000-0x83)="a410778b7a640ab0384c4ead541b6ee57c5645909ef688d8ac3e5ecfc7039f5f8ba53f127b7f01947cd3689eaf6c090277915bab2a0c450988cb85688e2bcc"}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000c5a000)={0x0, 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000a95000-0x30)={0x14, 0x0, &(0x7f0000b8f000)=[@increfs_done={0x40106308, r7, 0x1}], 0x0, 0x0, &(0x7f00002e4000-0x70)=""}) getsockopt$inet6_dccp_buf(r5, 0x21, 0xcf, &(0x7f0000e10000-0xcc)=""/204, &(0x7f000037d000-0x4)=0xcc) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000436000-0x30)={0x20, 0x0, &(0x7f0000136000)=[@dead_binder_done={0x40086310, 0x3}, @increfs_done={0x40106308, r7, 0x0}], 0x0, 0x0, &(0x7f0000888000-0xb)=""}) close(r2) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000002000-0x38)={0x0, 0x0, &(0x7f0000003000)=[], 0x0, &(0x7f0000002000)=[{0x10, 0x10e, 0x0, ""}], 0x10, 0x0}, 0x0) 2018/02/01 04:11:22 executing program 1: openat$ion(0xffffffffffffff9c, &(0x7f0000801000-0x9)='/dev/ion\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000233000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) write$tun(0xffffffffffffffff, &(0x7f0000577000)=@pi={0x0, 0x0, @eth={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x0}, [], {@canfd={0xd, {{0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0, "feb442a1f43ead325d71fed774c8f6028c2a6b79a4e418aa3c5f391769659fef9f596cdade428c389e511eaad39d2ee4334dee9516a31d00510baaf06efc0980"}}}}}, 0x5a) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004ee000-0x76)='\x00', 0x1, 0x0, 0x0}], &(0x7f000000b000-0x30)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)=""}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00005da000)={0x0, 0x0, &(0x7f00000d8000)=[], 0x48, 0x0, &(0x7f000044c000-0x83)="a410778b7a640ab0384c4ead541b6ee57c5645909ef688d8ac3e5ecfc7039f5f8ba53f127b7f01947cd3689eaf6c090277915bab2a0c450988cb85688e2bcc101a80664d3081fcc0"}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000c5a000)={0x0, 0x0, 0x0, 0x0}) mmap(&(0x7f0000000000/0x13000)=nil, 0x13000, 0x0, 0x32, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000a95000-0x30)={0x14, 0x0, &(0x7f0000b8f000)=[@increfs_done={0x40106308, r3, 0x1}], 0x0, 0x0, &(0x7f00002e4000-0x70)=""}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000436000-0x30)={0x20, 0x0, &(0x7f0000136000)=[@dead_binder_done={0x40086310, 0x0}, @increfs_done={0x40106308, r3, 0x0}], 0x0, 0x0, &(0x7f0000888000-0xb)=""}) 2018/02/01 04:11:22 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x1, 0x0) r1 = syz_open_dev$tun(&(0x7f0000a9e000-0xd)='/dev/net/tun\x00', 0x0, 0x6) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000d89000)={@common='eql\x00', @ifru_names=@generic="c15c9a8b74308b1b2c5d0ce63d9d8226"}) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000486000)={@common='eql\x00', @ifru_flags=0x301}) write$tun(r1, &(0x7f0000e62000)=@hdr={0x1, 0x0, 0x0, 0x0, 0x0, 0x0, @ipv4={{0x5, 0x4, 0x0, 0x0, 0xfc0, 0xffffffffffffffff, 0x0, 0x0, 0x20000000000004, 0x0, @empty=0x0, @broadcast=0xffffffff, {[]}}, @tcp={{0xffffffffffffffff, 0xffffffffffffffff, 0x42424242, 0x42424242, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, {[@generic={0x0, 0x2, ""}]}}, {"8571dc48841a02d1d9d335faa1649dfbfdc89324cc1090ea0b77d8158b50074e261b0be93331d2a74b50c3734fc61b8a0eae79785170ced916a6cd18f61e365d4201932b195527653f8510bd7dd69eb2b4b9798f28f9b026c6bb84f1b3359ed9f3fd128217a6b2d31e9b2c058d597bad0861e6f586f051da944a19ae10450f9d9445152283621ebbe8d1da1129bac565b62e7a5bc65615dd7830ca84a5251a77e977e3f5279e0ca91a5d2c1b20b6efc94941cd8eed2b5365a160f93c6827c30fb7354d85c5b077f6af5dc0a68e84534c7d041c5894e557f9227e65b43d9207c6b287911e6faadfdde7071ffb7fb399f99c4482d5fcdca36839824acfc97ba366d548a841616b68fe78b20c0367faa82af1e230b7db9664bebd82ecc9162d121a052be5b95e4101d89562b2926d2db811cf03f27998f52ad9e8452bea0021cf976c09c2166e7949cd863e875aed198657eae956270f3a084545157c1a8e9fc3f7929e798c97ebac7a83420f4e1e254428152bd696c82959ae6d15d0a2a891c6c9c33ebe42084856276d59a0f95671b99e0ef3b6b3e6744f5ff3613153bc46fbc49c2868fb17b6da0913c8fb20e6eebedac5f154c56bda3a72f847969f01fee263c0ad201de4d3eb87aeb63ab870d9fa1e7f7ba529dfb6221545e4cedae7414d71a021dd9327180cb0ab13bbcf2690cb34e304d0e2cd2686cd003399e2cf2556fde2c69e39c05cb7666efede46326e7ae40819e7119c2cc94c37753bd1971ddc10c683298aacb75c550a2928e35503d437c237c593e06a515727afd71a46b94b2ab0a5d4d70cb16e63320aa714ca00e41d834a07ddefa0bfed71a3af9b34739a0cc8c732da41110ce2187a101d7f2c9ac1bf26c3469c27d5b8f15c579b9e25746b4420140ac89bd1a5fe30892069c31bd5773cb70fb3d7226dcd3b7296188ccffc9fa11fd0080dda8fe4041eae295af9af7d16b790f5c7dda1c597b9af5684c7b2d7d8746c6c1dae590e254d24f97cacebc5a7a3a60d36ae7fd2c7644afd7f778f64959d298bfd720ae620f5f894ada603a01b7da4e93cf685e1759860f44108b5acc7f9f881dad0a02b2c4fb998bfeea03faf548b6513c258c6673b476ef67e3219559eacc2132278a9f81cc956eb695a15e3dcbd6f03b07ed36fdd66755cca86bf5455343dbf47395e47aa57cddfb2e76f337bd1b4b019a8e67dda70906d66b9662b8c6948589e379f7da71795dc9d8beff97f0d71a6cfca640444274b9247a0eca4df21889e006b1aa4efc5c95737436e369aacfff374b9ea291b8a42395a88de39522589fda4a9ac55965fb09fe4bae6f5c82e0b11531fa5601fad4eed518b4ef7a24f7ba14261e4d4e6d7d49aacdcddad6f3c95c5cc1b6fdec8f5b5c0466f2984eaabef645d1cd872c1bbbcb71d85831b48849ddb5d656c1773b13f9071432c0817945bc446094ddc967e4fb31ccea6008d65d2bc4dc9e8c2cc50b77b22af4d60cd395e509b700f0120ab216914feadbf7e7d63e528685d78d2040ba35c0a7bf37603d67cb45b928e3f04f74190ad8a9037235bc48d486cf829797d24dd94ae0d6c3b2d6b1687a6c5c30ddf0a526ed24d3d289512a4d6addb4f3e3472ed640f18832bc4cdfbdaf38ce7992a20c909d7b238bf8bd9f5281af2bf357e1481e7e9430ea75e6e56a6c4923ee58a2656ded3e61742c648ea154d5bf0cad24aabac8218d00a3f18f36b9ab67e9edae8ae11b1113d3f77515934be3c6f85fd4806f0fdf2b738d7666aca4bf8ff31b9d195bdabe0949d8212d22b574a09da488cb3bd27a2eb5192786b416a8ac69d0c383fef59e3990c5c39660ba1078bec031666f3a61b6cf98381165bee35e6c5cd6366e856f006db700dcf6d38744c1e2b98f879934be80a7bd6f00f88527067b1b1a6fc26f9986040cc0195d12aef3446fff63c758488b9fe2b65b874bcb1c2396cc41d440299d24ff0c4dcefe10c31035e3d6cc470faff3bb88b4ecfc9a5a6299ecc0247ecd6f32e754cce49d1f35df5f5a6895e2de6757fd312546fc5498d1531fbf11a6414c25777163d239e03ce52f0dfbd095f4f609a657f8a93f47286a770d69aa5012542b00ee25870deddca3121899bb59132c5dd77bd73d9ad0138dc348c7427989eb72b4c2055f46783416a145a74f7fe061d9b27bb7e80edaaba792c479ab3f0d0f762e59710a28a37148a5ec48de6fc3315ae9f9a4ae087df6087b0f343a1165802be4f9c853ab62a9c8513d28f6d409cf640cd29a8e0fa2f08d6481e7b94dbcf85e6d83c5c26fc04aff723f5d2053d8ef32486d54e7167a93ee862cd9d3d02ea5b754bf44d7b400c683d5b1b117d123cf822ea60d4de108c2e9a185dea2b43ed5ee56420e8c6a2cdb04986a948f6bdefac70e3d1de5d89d6ea9e86a331199551423a0c1b7f4c993fc6b1f2c6a9ff879f422e6dffbc02e7abe3d9a45fb20b4687e5733f3c2c66e233a7f895d4e6b2292cea10abe8d6e5577708eafb2b604ded50be9fd29fd76698e27f4d5e1c75b7363ffd2582f2e4e7324c0d67c1f22d5a0f41cc66863c08da70b87c0424d9c9b284fa0f0f565132c6212811fd396f769f233baa6708d458864f0cdca98da0f135594e2f69291ae87e39e8e46e1bd17e7001de1f0813f881f3ead478958a06451d802d62fe511aa6e6ed9910e837124eb69e49eb2d8b917756fd54ac554e5674b8aafc6ddc8ca7e3826106d9cca344720284eeac05f25799482a2eb7c79391f036134d6934d573a93b37097f62f083cf418e1e30787178a2094dbe1cea94c218b6a24f4f6d9fc5903cfd5b7832750f0bac9859ef32f34aef9d0f19ae42161023220546c39dfe8d0bf60b895c46c4981cd2881d5b605c7a32a7d8b56dfd9184898e3463cf91b2270f9daf25f7b0494f36dacbf997743cbf1682eb009ffe477ffb8caa6fdb32e511cffc4df65feddbbf7fcad8c6ab1ef1aec110a3ec5a3287d42507d1e91822247cad068788e9113602c889d4117a7c897e0e4f017a53f8c88fc87c761f7a46c491796e9da44da5dc24b936ed778f479661bd301d01246facc4f84beab3f88ac7d571fe355edc5c4891f88a10adbbbd7812e19aadfe8ced9e33b2b39e7a2e7a2f9a389378330500e50e26cc0599334270319aa53fe701a257c3880ccf8142b64ec0ea0ab28ba67fb831001ba0fdc49a62ec40d0486698d44e878d1de9907cd993c729ff2a3db3c79f013c6710642b28bee754adc4bbd2e3ef0d8edac2358d3e323bd8bc7dc353f3a0c39d1fdf769edcad3274a8dc76d7ea76f34ebd790e270574f8c2fe2dcfda435df98a421490e21a6e1277b22ff4eef4c2c172a9f6c2d65707c8931988abd7555de72212589088ebc2fce246e906d6472dacb9ffc9d137fc6e6d66419b0fe215ebf5ead7be43850082cc6be9261aa9727ea5d63d30fd87e698c828df592fff5dde22641c86951a005f205bc10b12086afd39c751d94016e4d761911b83916da7be1ca4b492bd834173b08d2268f0c88f062b2ba6f96897855c1717873f50d038b5a67a2656baafcd48c516e85e5ee1f4d52de9aa170eda5142466fa2d722323c19c189110c95966e312c0f532ee204465890374fb57999009c67228bb7431ec366be4e1cf8f2adffb6d545257a9aaee8b5b8793f6e2ee43da13d6e720355a94cfa819fe61769411b506496d117dc11f054811c9088d82de1a77909823b8c3ab38dde94fbc7512333d13a6f6ccef5a868d9e776567628213b13d199926ce1b71f96648685f8614673bc85f051423a0d2995e682944799756b1152c9b8e086078432fe6fae04db1b799559d9cbcbb3618631032a36069eb73f7c0c27e34af5233e6cc6c39b6253bc9f62e6b09295d78a353787991ad30c0347d3ec1f2bc6b695a5b3c061191e89af2de61a47358963bf7cfdadf164da4f4576a3bac44b463abb2a86cdb7fa57d2cc536323e01ca06410d170cb75278c3b0fc50869c0878733e3ea557e5d3de8e9bb0932360d6273b9e67587eecb1e9e3ba9fcbfa0dff7b1211a661ab6d41a3d33c9462ae10eb6d89c29f8d3879f88779343d4e27963c00ecaa3b0f190e82cf5b300ebc8fc27cd3e0e7029c11bb85730548f556faaf6ed2f22e8492b770655cd1404cf6d877a760843cb2e12e42100932066ba6c7e841d201c7e6b221f2996242ab4e47e8804f9adcf7bc946a4a76671db32234128736177a208bf6e531682c68f8a7a3b5f5310ea213c51ea25c58c6d9a4f2b0dc8284ba278ec752b215f575e590d85143fd545456f29144b89fe9216a57048f50ef9a16489c09d9f61ca77f9f54fa497ff7cd05e4ea4b8644e1f903a6eb6a4b4f43f63ae0e0cceed147f07e40f7d8275968c287850c2e915812556a5806e18214abe4db243f19b1c011521d94d09f2c1d6893e569315ef930361eb2817840b8d9983e5d90bd842b95d98ab1e0d027401f2cd92a31311fc4129e09ea68eb49c53eb88de115cd2d6e81038b14ade54462ab4d07188dd0a9e01a5b67583b152a50cdbf97eccb290c6afb2cb3969d43bb71e024f9bfa320dd3ec3eb0b16e520b5c5d870b4086e88208a8daa06fb7940e045db1944157200be2a6e4aa8caae8ca9d4cd5f1c0f1a140d3b570aabdedb30d0cb1fd1a6a86afa1815caeb5a6f1d3c41ed8def8b5cc4cf45b13ba38026e321e05a2cfdac554c610f2a1ca97d016b134ccb1bee2c7c5818d107e27ea82e4f60e188a6487d43b38444355872f5214e757506e94c152de0ef576aa779a43e054ad5432687f47b172c0ef490d66f0711fc4acad8522cf7812bd9cbd4bfeb9bef56ae72f6db62449e9dc490e2e8424e62ed20bdec17954c686fd667b9e66c8876298e6d3614dfb97f8d259c5b32ed6ecf3da13e70aac8292a2442455d5bff3a84df87c871a91d21af6aa644d4f3b42cdaca91d3082c35e669de3ff63d56ba5656f3ed4588555494ff61243246131d1c447ea7eaf549ec46440693659ad3a77a1afb73725c64cf903bccf52b7d7703edd546e798a351b3a87051bc4a18545dad0a5b743a7ddd7a58548163a00bb21a9dda155602d153052685d857e46b74c5e60a12c702b05cecce801d3783644b4571c34211be1b3b0294d27ad7064b4df8dac216d6c8f44da06c207234000a80ab1e8509da3632c0ae4d1720f605114855fe5c0c35bab2a56801e1dcb21ebdddc382775991edc6ed1643256b8ca5d8d36693463b048a16beaf2a4897013e7a0f50b48f57bb93091af003f8993ee5adbd50824f6e69cea70480315a892d828b6c1e80b2d5985160aff6bddf33963c1e6fa594fcf21aa0ffe156671789a242844731233190b92bfe06466a621cdfa545c127baf188d153380c626a26fdf6bdb0f23be29f354c3121e4418ab93837f058310da12180b8d7bdad0156d94d808025137b42cdc0215cab31d5e8d0750be15a02ad83eeca6b311c2578872733f2c63f044f7462a3e78451cc5bf6e28d488e8e001a20b2940d219fb1d37d9eea9091e1a5bd1607140454a87faa753b66336fb38ab79e307563f723df15faae164b12ae9e59b111a8c751a8ef11b02ac2e4a49d55fc02e358e248363430c9d77990d518cdf4a518cb41fdd63bdc9009aff1a8b82e3d560f64a"}}}}, 0xfca) r2 = syz_open_dev$sndpcmp(&(0x7f000089a000)='/dev/snd/pcmC#D#p\x00', 0x10000, 0x2000) sendmsg$kcm(r2, &(0x7f000051e000-0x38)={&(0x7f0000ea4000)=@pppol2tp={0x18, 0x1, {0x0, r0, {0x2, 0x1, @multicast1=0xe0000001, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x0, 0x1, 0x1, 0x2}}, 0x26, &(0x7f00002e0000-0xa0)=[{&(0x7f000036a000)="e3f8111796e9138c70551d8e644e5270efe0d0fc5a96aaa14c0a1a09a1a04c7fd8f5945da8d9871bd01e2afd989d3b796498891a2a72ca17afef457e60d77c057234e3350609682b454c8767e765d3f7d293e7e312999544b8bc55e32087339f88f1503804220eaf9d36a4977b10edfaa7b37a9375855ee3b871a4dc835a03d309c6e0c4cef8626e7935f208e5656b95eb753c529b5816598dfea8ea40cc8694edbc9271a16cd334b501912c8453bd85cbd87db4cc47a05ed1ea127ff215ea52940d6d0f4f517db730685e415663220ef5e0f4bccdfaefaf6b425250d3bdb7f99f3ae445e890389682b5df672178208bc47d33aaea569ec5517a056f31", 0xfd}, {&(0x7f0000e7d000)="", 0x0}, {&(0x7f000038e000)="98a749b8bdc97d98017a8a60060728b048c34628e68df347830ce83f388e87ee1c8b7466c840d8424fbecfe502a4f62c54328ab409690e5ae423", 0x3a}, {&(0x7f0000881000)="f1eba25143be40b3f3fb40097e2f8c9cac064ddb41c25a112e465c4ff2a748f905dea6f91b38590909e5288a39ef2779dd56c65501e9da84e00e71f6526315d8a459064ee5923918254ca81f6a2bbde39a9711d640ab29deb740b766a800ab4ac09e39a67698f13732c32538e379795ad924bb74f0eae65952b3e7d3b2dcb3968d8743057d487487d52f87533f5dc5cf18aecee400d3e884afacc9c78dc2bccf18cda5fb2b77c3d242565c267dca49b822dfcf3c607e4d8b4edd9dc29ea0d19c3c1b7703bedc3a6170765219dc3532fb5a995a0f0282088ec354d99e8b3f7a41e13eb135ba91bf175e6ad2ecde1930cc8b0f882fa818823a084f83db1340456cbf88c5160e24eb4a7e15246df72761ba46672de9fc0e0fd7b0d7f4512114199f281d5c6b6aa611ac821e272c4c4d3ef39b52e8c102bdd8a689e1dabde8e2c8af94ad74f053998616fd45a7fa107cd6e0f053494ccc4569b51d97818c557034250fdfe4993e2711fcd68ad49f49bb9a418e785b8f8a961f24d6bab47671e79b8809765b600b6bfad454f96662672861117945f9e8e101a3785adef667180e55283d92e4c1ece539531a9b210519281ad228a6cc4ee66b434a663013ef981f371dedd8e16168e4d10a1019b51b766be772fa0d068982b0f224b40484bf282b87b0b28a01b85059e52a9cb834ce5b593969f04c8103858e4f7710fea4b731c6a968630ec56897ca91a2c5ccccb685fd97e3311002cb863f719d01a259c33ee5759b52edb1e6a6c68ba8d92b625457283dc9e7ec638551f79958308e076765dbd42c0f26c64f8a42951af547b1bfbf8cd8f503c63729fabca7e1fb210560d0a672c7cc92a48d0a0df85db15da1ffbbe10de02c5cba255c9839404332d9c74691b49f1f357177c7e49f2809fe44ee65986079ded0cb5c49e6efdbe2c6f0b9c67c01056b8093de7a1a1ac8c402fd6092d5f2f0c04e68246c15c3f094d201c905c573db71624d42e6d7a2750d8c69f66811791042a84cd24c4f3e23bef8ed68f72a0174fa3e1284d2f737c7543b58c41dedfa9f5e816f028b39de95d66580c291172952369648ac7a496092cd6d2422817b7fcc48324a25e6e455df7f638e6b565799d3ffa813c0a7c0a1e11453bb36f870e0cf35adfcb368ae544efcb3c9ee94d2691f0799221e17100ef7c3027be58095a75f3c97566f670c7c9d697822c5ff04f8987dc9dd454de50726f71f8efc883160b82ff97ba19b1ae5a935a6afc214d58136fd88c724cc6d45bc5e6a5f2614848450f108f774349f8a280ae3bb2cd12e48f42653c11ef5d0fded2189c001359c5df158b4cc6023e4d03760458f52d1c7fa02cfa4e8a74c7d12997a68714a849f060154cdf1d7d805fc792fc203dadd049983869d09583d4723921d255a5490593b7abaf326f485756f91a54ba370d27216373143425be7c48cf830f86a99eaacea51f803e42f17bd94c7c3e05dbd41b8996ca42a93b209b7ef65f9357e05d63ec994e0063296709ae555e69813e3617f20935a37654d0d4ed9f00731812447ce3c5a6c899da7ac67871ff668b9adac2afe0b6d01ffed39f8af4269362fa8c296e82aa880946385bf8208c851e2cce2fdcdb2a5e0df226726c2bed597fb07ea529f6822610e191c65c6754a65d2c401e8b19377b85782b7caba7f70bca37bb9a9234cbb5e7cbbdb9db2f80e26ea91a7a7642984fd41d66d1c42819501454a34dea8275e8ac9453f86bd55cb542fb8dc393f2537c644b8bc782e057874b168733e7e785452fa523f2d2305590dde20d1915ea7fa4ed1a10fa03e3494a2ab3546c563d6869a67af71aab520ca31c1705e5e875cb44545cb07ba33a2532cd7c5cfbbc9dc15f1fcdf0247dbad5ee69e762fd7b3c3d2f28a058da86139913e5c31d15b1f7f14c939f186ebe3af5587f3123c702073f0b43517f10df9558d1b8a3b282bf6473db726e5d18ed82fa6f8a185ff5c69e8d3bc403c2426a1965c8487da3dc2cc0260a29448d1bb75be719e858fda5371a702448025292b5d8978c64b525aa948ed2bcd27bf8f346724f89381a37fb242a01598a3caa0e2c3a9179c2372c3075f9323009eddf053c6772745c35a1fb515a6b026af96b285421cc02b7a443c608a302e2f3a795846a138e933a18297bb32a4cb1571f0233c1b448f190e13bd2e82b75cc7aff585dfd89f7923f57dfd41c7327a6f41b42d83442f893b7c4610645fdb29a51d1ed1033362645606b4ca693f507a1e4a3a2725daf8d2b83a2ecf6b526db7f9e7107bfd3a078434af2fa3e89350c2572420b612e313a7c021debe26c21976d5e44cd585d4bd36ead8cbf4c2989b72d16a309dc0f4d16524fd78c4c8f04aee0652b1d6097c872f7067e95a5e562739c5f0a196aaac7deff3c3cd5e16adde309fec2c8cb14b53f13173f77d59b4b5ee2bba60b83f76d15a273b443968ddea20aafc288923ea8cfbf969057090ba057402220504b2119c0f224daeadbe1e3708be3fccfb79fa8d8192ef7c2deef401e985b1f14312c612f48daf5a2cba07ed0248d04d8dd534296b7aabb5bb215807b59e9d1d12c7616da0bf6e295ca56826bd44b4813aebd91083b9f358804f8a97a16e5ed997ff09abd615bf7af248e193a3747189684a2b3305b1d90cc02e124dbb899af6b0b931cea9306af5f507be19eb2a0795cb6b33ae456930803c4583765ebba1eb07082727e90db0a787bd9ead8c6fb16c77786e52b7039a2d50778cc33d780be05a37430ec58ca1394579dd6bf072b7768d79590105e205003e7e899e9365b7de398606d86e7c6c9c2373a0f26d15118bef906f1cc9fcad3aa0a350b1a761e6214f2aba471083d4a7c83d931aa8084af3c17971833b95b227011e66207c88e469f758027253cde54a2675db20ce10454125ab36bea576302f0c6e5b1d86a612712f517f4bc68fec6ebd1ab47b07537b8d70d93f88b3641a8ede714c184c6dda67067d079a3bfdfd30b90a80b8c6dce7b6203838f2df7798573525edada9146495c5838eba4d13c5963a42e56f146a7e20d58858abf29fad6736bc3939882cde34190f9abde9c1b040e49c21ac1c7cd972ef3b6b8c7ef0c27b10c60d18ccd6aad8925270410bf2326a99a2e443bc248986dd943fc84275bc4521d8ca9fc215936e89718d01c226c1c4270197ff7477b28c630e433dc34648605ebb0e12c3d745ae4ce462d441c774710291ee3fb7fa13bc2acbb1e9b7786c2f051f64cde098aae19d6df76077fe62103daffd96bf69b5711b42acf4a4c6c462a3db2aca4b8871fd809c7d91e5e0ba6a97ea597cc782cf9b941ade7b4530955cff7820287e2a597f4082754eab0012c74dfda954d68b39d6e0010a892c2b7a2a1fae0c693e78cd2bc9e64b2c7f8fd2c4113d13f0f57961f26afaacfa35f8c980b7934a9a0db28791e737f6f96a60c90a0d9fe2f77d3dad1920f3201e77dd1a31906f34c31a7a557071f8e742a23e6ab5c4f159b08c3e5f1222bd8676f2e4fef298abf0a0cc561a39400f63e9f8ad6ab14ce0f1b5c9caab5ed9bd1fd36bf2a7fd09aa78f6ba1562b9958b362d4a74eecf1dfd689b827544bd27bb361ad8dcf5c4e88e542bb8c3db6df46ed9777658b2b1a9e28a5540980e375af76ffc437cfea18fc64e90fb7647eff7211b1a701062e7d643cd98e05d14608defb9468d921a5a0de89b00ddada41ec54f61eefe1ad75e999292c831c81e1af9b105b0e35e2714e6b31d25dcbaf5302ee2745d561175a0a0fbcfda7983b9f3d700a4f0a2b0bedf326d5a999607eb9143e94673892167879a6c0e51ee883ff86a27bfaa5e85efa77b59b72f6558a4b496278d5b1b750ed43c1028fb9f023175a9a9eac7ba3a95a0dab29f03c5f1d32596b178d389b77b39357e1a040b4b76f0c298ba5588a614a16d86197ae2a8ffc56e747a09951b338b9a2b569473948751f50117b41d0ceffe952b1535712c4dd61097fc420c0a468e67cdd2114f414ab90133361cec329dd48973824d6ad30698a9e8f93123044025a227c6c207ad03abfd3b5ede61b871c1a3e4569170260b6144f0c4fb0e01041decfc2753faf06aceea773918676b49dc7dfe5f7361dba9bc88f0127daf466e65c4e349dd8f912b1073dbd718241b74187bcac51a63ea813a9054918ad15c1a55c98be9221c66a280ab22648ba31e7e66ffbb958c7c4707807ae0756baa714c3ca524ae8ebb9e2e85b5a0b1ba8796a02d82487966736d2efa5cf4d66a568cfea7ddeea2947d27e33d2043abadcc533732cd7f1828b693dd5e27b99225b651b12240507d97b890c11fb88f92f2e6af4dc3fbceee710fc805f84adc43b9f388c2b4f0efdba273d13f7093970def270bfdde3a586e9e676a7b8ac8641c2fc957e3eab47b294c171632df55c8bb6424ca024ad01b1d80d76a6799363368a9524f888fbe0b80d807b4e4321c7b0a9dd703c6edac4127e016d65e5f3dc3efaf71191cf2bf07539f0b6f1304b3f7ed56f9aee7fd2b13734453d68023328ef5472987034a5c4963a677784b0f29499b1e1debb7283e648cc6cfc08568cf0c1163a57a7c18f89283c7559a620132809159c9d28532efc24a8a49b0cf5d682afe08ccfc3640285123f3ea2d6005fa01e5791a146b31143887399b68b8272766b635cf33dbd29fdbd107b0f68b4785e763f0aaa5f92c7cf77fe2f05d44584745ebae67f58389d323c98e74403eaea234a4fdf489289d668ff2a19446f7d5210c6a97a7a245325c545c79eade5b3d2383baa5d6def85170cef60bf516dba054d0d1508057569c7626b091155fbc5c9a4ee886b6424e1dbad441f105548bf4ca19be17a81d912eba7e527621618f609374e0dce10feda6664254bd731107bdedac28115a3ad48a24f2d57af257827e5f916d57009a48a62fb2dbd3cc83d990ffee44a9202109a32466b887b73a8f6fe0092578ceee57fa175805e5a3ff56eaf245fd409f38384a15399fd91c75c042383f4222234014b20bee6c86dd6c67f0598c8bb6d6346a35bcfd5aa49f3ee9644a8cf259534e99da8e35684d4eb8770528fb530e61f7e29e512a863a811fe2faf9f8007244072206d14d8a3dfba23b9ba3789ffb89f330068b08246fc878841818ccb937ebdfd512b2757d130cc73d82f6b6a870f7870138a1ee65ae9bb735932fe7c2b800cd1b516a6498bf5a1a580639de08dc0f78f63e0d9676b4c344c51f8bd808e522a5fccb86281dbae19cec57c4b0a3a933c5f9a2228f8e6cd4a5f15d85a8114cdb5d85a4a54272ade559f0b9b1c73ac0a6882a07b2af8be288b0b6f60c098b1cade70eb5e54b46ce5d1699cc33d0b89692ebe117016af81054b6040ae1df9bf7ee8635645d897ef3b09d98f3d12e876ca9268b70fc6e94e4fe297b913af4aba8a28d5ca89a48c42a6525a7b9705bf098d4d067926c11fcbde7b1b9aa85b9541de0e729d2619bb5cfea507c4a25f700cc6e7b474b58f440756a5ca7369c89f2ba0ff524453e1341c0d881a0ab7ecf01886ac6b174ee837d2d0a970fc36a59a65316f0b47d3021d1560be00f7cd91a9529ad8456ee7534f30c0098c8fa3bdedbfc6537165cce00380afbba19e62bf670af8768d85920e3a207983cd90fda7f557a882c166970199b8382af46452d56f991a432f9fbcb55d3870da1b68a079a4ef102f4a6e5dbf3a1913713a5810fca2033393f15c93437c2672fec762d4113ac9aa57f92475956286b225c73f1b60af0f631c3115a563304704a321bf7843e858707f2ccba23d74161", 0x1000}, {&(0x7f0000301000-0x80)="7e9ecbcaab31810f52d07c64f59487c296d3be872cca7eea72f79fbc3e9babef82f9f35519313f0b0075d144ab93b58a671a240c832d523ac47a1ee1d24c01c2273fc8ef7a2ae14399b8e1fec1e5ea38712955d704a13faa56d1cce6829d37bebe67074af88f05a7b65b5275eedb0875d98dda30cf8a273cff71eeae3b346c73", 0x80}, {&(0x7f0000eb9000)="a165f26f01837fd232b3e52e5b8e5c7b8acf9df7aeced6bfd0c683ef4c028965b857d6c7373ab843762def0ef95fbf84646063142da165a8f06810765d6a", 0x3e}, {&(0x7f00007fd000-0x1000)="a765d5fc33315918b043d9360b9cf251f1a3041b443bdde4bde0609e22b4d6e7c2fc1013baf99ac857cc53b767b69dc8e0e9ca3aebcdbfbfff2c1031f97f6aafb9ca121fcec6840b9a4cb3d96116cc55202d93fec2c8577b2c65aa6843cce8e3834c56c1487d8b8a79e87a8b7d8fc989f3256fdd9f65e411d3c44a98f429c0cfa979475c6487f66dd0e1564b23c42a07c31d06a67a56452809fe263e970d51a614b87d9f2c22f013db48ef74caf0a15c8646a3f238000075a6fb55771be21c7c74dc4a5671d0f56595e95a14db7cb4a7b24882232b5101b56d992240d1690d4ccb0246dd99292a6cd6063db60795d9282cd31749351c90c218bb7db5aef999537015c66a60e3cf440ddb95805601b3b45ca320efe25e27cac737acb1902c7f94588adfdd2b1fba325f460c770892ce726b45ab5659e750945afbfe4db2330b7150ed8b81c5f3680eb00221b616d4720c40f1ddb7a0de91a53fd48bc9a3954e8ebd5019092b03dc0416d2e53caf9d22104ea5a8cab2ff887c80abab8be6d3c2cdfa3e578bd523a46a99dab6175217010230115202d7e40595399b8d87cd3216fa8428129b2e3dec18e7902af1bc82804946d1f7194b1ba5ea06306121b4d5f1162ecbf237a8c2681b9ab27f83ca55a7979b56af975834f8352e846385f51e166d89b109680d63c22b0a459dc3807bbfde18b184e31457e8927421feccbcae4c347ba1c1f352aaf61e9d498b08ddeaf90b421f50fbd7d4bea8a9fd71d322bcf323b5e022f321954355265694273b5fca774326609faef1a2aa7f61d0712f606995a9a5fdeecc86d65e8db9ba83b21396209ff25333722e03de6b1bfb546a93261a7115ed11e8faf641e9180b966595e63f32c16c5e4508e899e4767007f18684e50d5fb963c34cc7df48d4631342839ca3b7c578425895e2a396a90cb096bdc7bbcc423021c85bf0a0e1ec74ee9e998737271727d46386b8197e91f86ebea46503959c923f97d7a61fd381bbdfb07d5fe53c9da8919c8cd43ce0e54b73ad8b245010e2b2141e4ea1c91684d0864a1f26d98a8f5784be528ccc29318334d1d222d3979651b006056ac3db6395c9bd5e0bd37b1e94faf453209c1af2c0a7eaf9666de78c76c2cbcc3a539104114c50d763a66b38034d44234ab1ef4897669149ac95798a03f9c9d85e79b0bc18d70708889569c1ef330b5d49ef1a0b6f697c4b670736665db316417210ba019b52551d4783bd9104d06f10c4be7995c99bc3e52a3fca129e987dff3b47e0f1ed799abff8f02ab8b5134a13e022db472115464ef5ec9142463e35c0a393a5b75f238409c907acaafad1ff5a012f756cb51883ec284488412153d73f8aceeb63cda80be0b5b3a93e66443e1f5327cb7f0da2b2734b592393287db440f66d1797fc9d8bae8d556163e48af824e3da64a40c9db9611aaa029d2b85c1ab6b735c54233fb6511b68a58faf9dccabf071f43d844a9fae75399e6d553cbc5c6fba4f99768bfd919001c49723cef7c40168d8f58a076a6644ec5775a010b1074f55f68c0c18e15128c447fd6e1851b16bd29baf89d485543d04372ab442dd027be638a6144d537556a92687613488d5e91c0d2bd4be0e4941fd63df842666b366ea150ebd04fa8d5c6e652ab14d8a20aabaa9b0621dd90355a19528a7829921726edb96cad329dd6e94dfe575b86c399f0fafa10bc9b6ab233b1d99bbe2cbf59bea4780031bad6a2c5a05f49f665cbfd96f455c6bbe2f90c6c21362a12a9106ff9bfb2e924f254e17021e9cd6811297e48d162347935b536a5a979284ade5e8c4c5c7d992aa36409841c229718f0b7ac4e90455c2e1e41c55b10437ce467473cbc3f3b01c35c7fe94b1d646fef2c991984f9f9a0d231621e2a1e476ab411d988d18eca87bd427913fce7caefa5e633ed378877ac1ddeb0324c05b98ae741ebc744636307947339127b822cb24a896fe9f96d9f94dff46bae33e359c492c01c2297b211f78249572efac35662dc94ab1655533ad744e4ea622d5f969247a26e89a5b77c18769256298be62855bb3e0e3108d7a4bff471f90e4a5fa3d998cf9df4959104bf461e7fd2ee0cc226a2bf390b4157f101bc600d8a9f66ca48d1d659707ba6033d6057e2880f07bc976eb3e7228dae31c44d89d1b3ba84465da0c42b62b8a457646cc9d255a160591638307e6183a317cf116975e852083e37c49cf9549b04dd2fecdc299d0feef6b7b0d66c89a96420052cea81258b744ffc4b333c0feafe69c3899d2a3764404c901a3650173f2bcf9453535413b426ba734bc09ceb130ccaab9782f076bca4f0a367a200e2d6883bb7a18f6a8cac5267808e10505b9ee2f4f844b91d7bca7d5596b40f1022a0170ab26e38ad95e4722d577dfd099065ce23fc5559f766b6ad26782752b91bb350a00960dbd6366d0e917c839b55cca49338f9852bc763a0b2c5b722162e3fc5785e40903ab28fb92c05148d0df597bc9233c1516545c470f211df2173e1051b06ac250af09d3c91618234b0f0cb0e10471aef06db50caf1b8dba1e4745e1c5da2c5140fc77c06078b0c1742f79a3d15fbb35989f80c4b98b152349d809a9058e0db9912d5d885ce36190950d13666495c4d54f781cbf1477531b80d74b174d15d32d3094ec3cfe0ed68977e78c2ac63bcb4fa47c76ce83fd6cdd363f36ceb8b6868f8c9d9484b870011d51aaeeebd221189ff042178a59a10c256ad1739e5458893c739a6c7379a01e809b88d97e1b17a9ec804d74caa7daf61c33da1da4128ed6a41db159c436c60280dba032a0d8f2668347c99ee51b889c0dc05e3754f2a443818edf0ca0b46fa7768873e38b5e1d76fd089e759bd530f8ee1a938145afaf76988a63bd77314078459818ffd86bc871f12c7611a2912c9b74d72cf31d3d5c4f70f510fe9ab1aa58264718268e3bd52620b228faa6a12d9a1aed67bf2eb85070d7fc98782abb2630a240af70106365c1e3bf0f55de79d8acd77bd4803c4047b208aded93586859dd2e27c28d77a1928c1af9cdb9475303a03a0d7fcea465f8b8bd653bdbfbef06e1e82606d57f7f0689845c4e366582a7db7d2bb873888214216b6e99556f419ea0d0d99d91714e3af5c2d5463ee3b77e6a1f24018a4d71d710ef21b58eaf0c13822ad93da9cfd5de388f1c4cb8c48e86d139fbfcae5f095bade19c3d7268aa4101a4efc563f14322f4c8cc1fb6c8488ac913b779760e8ccfc99ce09277d3e2f70570ceeb2c87a192ee3ced29da29e104a7fbbbc4aabb0e76c908ffead977727a4464ae8c89be6771ebe8c3b28638a5dd06ca48a9fb22e5c0b92f235e50f538617ee3eaccc13bf7dc8d85ed50f5c039dc4422ba7fbfc2c0cd281292c8e21ff492fcf8e788846140b2f5a37663f94273f613fb756ca45252cde3cc16718d1abf04c5146987229f04202d505de600948704292ac12fafda0e8cc01ab2bad79348e438718a3e1ed71e46e971e38b5969e795b921a824b5df8721682557c2833df28e07e206b12c50883c27b46b978312ad78f1b96a0f0c62865b6dc52db1d071358fa323e4e9e7808122fb9e23b3c7cb0ab6676b766263b849cd5f676339922f69660b659c90f8912536bb49ea545d1faed814394bec8f3e1678360bed47ed10efe485839bed6482ad74fa11d29dcff4000e8804c2e5e17b62abf279c7d0523ba84d538f3d2b355a405cbec2cd99f92625315098766b1271ea6e7417e9abc72600b222dc3bb9572b8b32bf5488a46a734c9006d324daa6c2be9023ebb374fdabedcc1d5b139cfbdf2878ee96f411172f48591eb27c29b5dbef74f729e8d511bbbab8a76ada323f123fcf707f290899506cf4bbb4450b7b5f1ed04f975e76e3c2c3c4c3e1e3359c5671133b61f31109d64192c81461d455914940fa8df0469372188e6117bf3f8e8b690fe0ca1364165319100ccedc57726995a28d69387822096aaa87400907d4b2f23f9035aea11d4aadd486306626de69693625ddfe790469333003ed77f4bc651d4f085258a60c7b97c11d817f4a4d6dde5b55964e44067a3601b377ca26d6259d5673bf987d999bc671600a09b43ac22a09f89e55456cdc1d2ba11e83a3f3b403d8aa6241c3d4a82ba8addea0e67565a1543abe3f611cdcee90f4b460ae990e33a978e69d3aaca389f39765050fbfe1a0e1a711f545074f91c63c097f3e64acb77cfae57add954a97feda61e999f400e068e203470c288de268eda23dca6cbb111474c6fb58b957b8d7bf394e8888ee2455df52d2812bc8db06a7329c83735ab276905774f0db1a7741b923476e1a9d18292a9385ebf75e375182970dfa2e90b07f1470f592e20a9e24cc3064bee65bd35b65e7f731de0fd8b5b78ce1927766a690eb9174828bb2e124ea6dfd835742c18a1435042817410b3be5016b67cbce8fdaf97849160f10319d6d29da2ede20f3fcbed6f82bad0301d1d6fc9b014560f8e552e3f3b2641bb43265ec0a13e10a2c39e497a92fd4c48cb02c49cb046822d99b650c5c0f561ceb7695b79a4129fbb926233fb6f07655f0dc82d5913a6aff3d5ea475aaee6b2d80e15eb37591af4f1a2c94e491410496fdbadb161b40c58032a0bc6aa7b280741de93b127de38c2b4c34ff273af903a623d632d3d54968b06712ecd463eab07322fab9245c515e63ceaaa0792d85ac95d21fab935587815a6d88a8549b1e3b6453f205c8a2885a4c61001672e6d854a5ce6205af660115586e0fbc58f8000820a2a1ca18613724c0a7a11edbd708f4a341433ca9ac8c0fc052a255289a1a7c31521709c158ddd161711c4432f16c207abbb9de7630aee0d16083316c7815755ad888013d23796bae961ec3515cf81b984cb720dce1c679ff59358c3d3eb5ab6b86a931ab941972477e2f32b450628a8c1d9fee5fdd7167c7512de5bcbd508b3cc651e78b89cbfc940836fdf9ba17ca89582100e2566946b328c58ed6a765ea2f3eab987bfc90a666d46d5efccbc38f6e05129e9cc016f2bfd4c51b9d62e79c8c9aba3b37e2942b08920e24e1196a39413a5e043862c1fd16e0c8901a57c3d04394ad80952d4a8761c24f8cf060c3ab1ecc419542920f446c61d5c611cb9f300d7d8e9b5338eeef39ad4e618fda24c8e3264ad4669cd591d73738f992ccb2236ce5fb668318c72928e97c35da139179b382d4af17bc866d82e0868d39c4d476be9e87e94235170ab32cc56a299e57254e0f8f14e3d09ae0123f82af38d3e7abfdbc36241d6038093a8a6d6b906556f7b6a66baa9d1360e8022177a87ccb6072bb2a8bc8c98dbc925ac40f03dee76a538d0d9d4e838dce2bf57a5b19f1ac1e337fbcbd0e0bf6387373ec0d5c38057c2a76e06bf5638065b380023a7aba0c21e07ae59ac938ddea12ace6f804d28dd83d8d691d8fcc724c9469673683cfd08597ba23991279ca1210184374ac215c5b59cdfe6fc49cd5f3caba017fb933a2e038c907085313261e3a90a160fd010bcf4654e3af61709da09f574c9a23c57a8a98eadedf6e30b7fb386081d7b126177848f68b918fbc0b992196b192d1d1f84ef5cda6889c51a016d3cf82f7f8731118794521a3374f444a6f79c3e91e6329a677c8f0daa7761af55b88b35d5e8640c88bec40f8e0d1aa70f85cdddf9505aae28749ceb02d037ae4c1591f65a999e8ebdb2d750801f9776e8ef2ddf67c7bf35dc52b150fdb71fdf97dc2133dac76eac8b67f37dc9aefd16f38cda8784a9bedb0e8b0201216897df3ad31af35efcb1d96aefd1ad3", 0x1000}, {&(0x7f00009a0000)="d9cbb4c222191404de51a819976ee19d9f64303ee69b0ef0dc237b69e310c638ddd14a5487468b987996ebc12d7c599f27607b85f7314f3edba5a4142919de0f55bcfd5fe9a75be00f1ee74405c8a83265707c3d30b4ccd249e218d1f1b511182911f2", 0x63}, {&(0x7f0000fef000)="a40c26bd0692fbe3e53d833195a46cc20e3bcb2e61e48335a44909c4134225f6d3bcf76f3e34841dc72579f887f28a9d12c440434baccc92c0acf02a39633471e7a77cf898d398e2d912baa89724950a1d7dc8e989e866a2dfac9e6e6d5faa79b45e4b37118222bbb8481f1ad219acd5bb2af3ab0cde0bbd44c275805e95c573b65cfafb28dbaac23a1409b0f1e4668f1bcbaf2ae965f5cfa957b1ba2c8f51d989e29c88633d9e7673dca99c2d76a722a12cd436e7c3645bf8b956dc5c1a1bcaaeea2e71a15783b2453a0a50d1b1bc6c036efa6c27e1fc5cdaa21b88a7", 0xdd}, {&(0x7f000082c000)="de82fe3bc5c4075a8f8b382734c5fd9feb599199321069e93f4cc2c86eef6b5c5ce2e402cd548dd5324e6442b6ba4d68a8fcb0d14dfc629f712511cd6e74cb624ef14d9b752495a24b14935a9608a6342d950fdd8bd0b8ebeaf38320dd687d80f5f73e840c4d6a72d207a3825ac00277638792b96a4a75aae3b2f78df13b93bacf69005db7e99ad820b086e7a4cb1decae908281fbe5a5d7ac49c149e19caf62a10ea06766", 0xa5}], 0xa, 0x0, 0x0, 0x4}, 0x40801) [ 302.406275] binder: 15099:15107 transaction failed 29189/-3, size 40-8 line 2903 [ 302.410874] binder: 15112:15113 BC_INCREFS_DONE u0000000000000000 no match [ 302.411048] binder: 15112:15113 BC_INCREFS_DONE u0000000000000000 no match [ 302.421312] binder: 15099:15114 BC_INCREFS_DONE u0000000000000000 no match 2018/02/01 04:11:22 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) seccomp(0x1, 0x0, &(0x7f000089b000-0x10)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x407ffc0003}]}) lremovexattr(&(0x7f00008c3000-0x8)='./file0\x00', &(0x7f00004c6000-0x15)=@known='system.sockprotoname\x00') shmctl$IPC_INFO(0x0, 0x3, &(0x7f0000564000)=""/4096) 2018/02/01 04:11:22 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f0000590000-0x8)='./file0\x00', 0x14) write$selinux_create(r0, &(0x7f000074c000)=@access={'system_u:object_r:dpkg_exec_t:s0', 0x20, '/usr/sbin/cups-browsed', 0x20, 0x32, 0x30, 0x0}, 0x3b) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f00007cf000)='/dev/cuse\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_STATUS(r1, 0xc05c5340, &(0x7f0000b85000)={0x6, 0x100, 0x2, {0x0, 0x0}, 0x0, 0x4, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000801000-0x9)='/dev/ion\x00', 0x0, 0x0) r3 = syz_open_dev$binder(&(0x7f0000233000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r4 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0) r5 = dup2(r3, r4) write$tun(0xffffffffffffffff, &(0x7f0000577000)=@pi={0x0, 0x0, @eth={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x0}, [], {@canfd={0xd, {{0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0, "feb442a1f43ead325d71fed774c8f6028c2a6b79a4e418aa3c5f391769659fef9f596cdade428c389e511eaad39d2ee4334dee9516a31d00510baaf06efc0980"}}}}}, 0x5a) r6 = dup2(r4, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004ee000-0x76)='\x00', 0x1, 0x0, 0x0}], &(0x7f000000b000-0x30)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)=""}) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f00005da000)={0x0, 0x0, &(0x7f00000d8000)=[], 0x3f, 0x0, &(0x7f000044c000-0x83)="a410778b7a640ab0384c4ead541b6ee57c5645909ef688d8ac3e5ecfc7039f5f8ba53f127b7f01947cd3689eaf6c090277915bab2a0c450988cb85688e2bcc"}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000c5a000)={0x0, 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000a95000-0x30)={0x14, 0x0, &(0x7f0000b8f000)=[@increfs_done={0x40106308, r7, 0x1}], 0x0, 0x0, &(0x7f00002e4000-0x70)=""}) getsockopt$inet6_dccp_buf(r5, 0x21, 0xcf, &(0x7f0000e10000-0xcc)=""/204, &(0x7f000037d000-0x4)=0xcc) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000436000-0x30)={0x20, 0x0, &(0x7f0000136000)=[@dead_binder_done={0x40086310, 0x3}, @increfs_done={0x40106308, r7, 0x0}], 0x0, 0x0, &(0x7f0000888000-0xb)=""}) close(r2) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000002000-0x38)={0x0, 0x0, &(0x7f0000003000)=[], 0x0, &(0x7f0000002000)=[{0x10, 0x10e, 0x0, ""}], 0x10, 0x0}, 0x0) 2018/02/01 04:11:22 executing program 1: openat$ion(0xffffffffffffff9c, &(0x7f0000801000-0x9)='/dev/ion\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000233000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) write$tun(0xffffffffffffffff, &(0x7f0000577000)=@pi={0x0, 0x0, @eth={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x0}, [], {@canfd={0xd, {{0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0, "feb442a1f43ead325d71fed774c8f6028c2a6b79a4e418aa3c5f391769659fef9f596cdade428c389e511eaad39d2ee4334dee9516a31d00510baaf06efc0980"}}}}}, 0x5a) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004ee000-0x76)='\x00', 0x1, 0x0, 0x0}], &(0x7f000000b000-0x30)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)=""}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00005da000)={0x0, 0x0, &(0x7f00000d8000)=[], 0x48, 0x0, &(0x7f000044c000-0x83)="a410778b7a640ab0384c4ead541b6ee57c5645909ef688d8ac3e5ecfc7039f5f8ba53f127b7f01947cd3689eaf6c090277915bab2a0c450988cb85688e2bcc101a80664d3081fcc0"}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000c5a000)={0x0, 0x0, 0x0, 0x0}) mmap(&(0x7f0000000000/0x13000)=nil, 0x13000, 0x0, 0x32, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000a95000-0x30)={0x14, 0x0, &(0x7f0000b8f000)=[@increfs_done={0x40106308, r3, 0x1}], 0x0, 0x0, &(0x7f00002e4000-0x70)=""}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000436000-0x30)={0xc, 0x0, &(0x7f0000136000)=[@dead_binder_done={0x40086310, 0x3}], 0x0, 0x0, &(0x7f0000888000-0xb)=""}) 2018/02/01 04:11:22 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet_sctp(0x2, 0x1, 0x84) r1 = syz_open_dev$usbmon(&(0x7f0000e20000-0xd)='/dev/usbmon#\x00', 0x3ff, 0x0) fcntl$getown(r0, 0x9) ioctl$sock_bt(r1, 0x541b, &(0x7f0000286000)="8450912f1e8652ea023ad265f83d8c8c92b3d292db61dc404db259352853ca255d0940f05b8c1fc0ed32cd375f1c15ebc80d3d150853397ef50035ae0cad56fcf4e9d6f7acb4b350a6f274e459d4f2e79f060b9326475958b4b91f86fd1991d2a5cf401907c0f3bfb876b5cea809ffd88894dcf961e217ce3b96afdc2d3a6c63473f1bd1fd09f6ebfe0c91b0321120be8ee835806cd0c7c57b1e9f2f5b191412af0837db2998670a2f26abff9be97aa145b0dff1b2ef1e") sendto$inet(r0, &(0x7f0000022000-0x16)="01", 0x1, 0x0, &(0x7f0000031000-0x10)={0x2, 0xffffffffffffffff, @local={0xac, 0x14, 0xffffffffffffffff, 0xaa}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x10) sendto$inet(r0, &(0x7f0000035000-0x95)="c6", 0x1, 0x0, &(0x7f0000034000-0x10)={0x2, 0xffffffffffffffff, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x10) ioctl$LOOP_SET_DIRECT_IO(r1, 0x4c08, 0x9) shutdown(r0, 0x1) getsockopt$inet_sctp_SCTP_STATUS(r0, 0x84, 0x74, &(0x7f0000030000-0xb8)={0x0, 0x100080, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, @in={{0x2, 0xffffffffffffffff, @multicast1=0xe0000001, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x0, 0x0, 0x0, 0x0, 0x0}}, &(0x7f0000024000-0x4)=0xb8) 2018/02/01 04:11:22 executing program 3: mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffffff, 0x89e2, &(0x7f0000000000)={0xffffffffffffff9c}) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$TIOCPKT(r0, 0x5420, &(0x7f0000001000)=0x800) sendmsg$key(r0, &(0x7f0000297000)={0x0, 0x0, &(0x7f0000c79000-0x10)={&(0x7f0000000000)={0x2, 0x9, 0x9, 0x9, 0x2c, 0x0, 0x3, 0x2, [@sadb_sa={0x0, 0x1, 0x1, 0x4, 0x404a, 0xad, 0x4, 0x80000000}, @sadb_ident={0x2, 0xa, 0x2, 0x0, 0xffffffffe2c11b85}, @sadb_sa={0x2, 0x1, 0x1, 0x7f, 0x1ff, 0xd7, 0x2, 0xe0000000}, @sadb_x_sec_ctx={0x153, 0x18, 0x0, 0x8, 0xe1, "e9e09bf9a05cf896762ef51ab9451149096f7dc626b3323df6eac1cf6b5f25c0efe28c199b19016e74fa0e4d056f2e6f662448066a65a9181700c476e996edc0f1ad84747105adf5d0f0c671d1bcb540a60cc9a837c73c9f593af5e091f24599b2f9756dd53e4d99a82ca9e29ad304140c342389aa55822fd20a9f17fe27cd60d5fcc8238d567c47e60ce28a3a84b29cf5131caebd44fc734e22382574055b459fc3c2d7399cf9967c7c17c5c23b138649170e28507eba39a590813cbfa9d05c918884a9a733dc862b18c7547b2a3d30599be6fb0a03f1a99c766f4bced9871a37"}, @sadb_address={0x5, 0x5, 0xff, 0x80, 0x0, @in6={0xa, 0x3, 0xff, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x1}, 0x7}}, @sadb_address={0x0, 0x7, 0x2b, 0x20, 0x0, @in={0x2, 0x3, @rand_addr=0xffffffffffff0000, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}}]}, 0x160}, 0x1, 0x0, 0x0, 0x0}, 0x8000) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r1 = socket(0x1e, 0x1, 0x0) connect$bt_rfcomm(r0, &(0x7f0000d99000)={0x1f, {0x1, 0x7f, 0xd4b, 0xff, 0x8, 0x1}, 0xa445}, 0x9) sendmsg$rds(r0, &(0x7f000015e000-0x38)={&(0x7f00007b3000)={0x2, 0x1, @local={0xac, 0x14, 0x0, 0xaa}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x10, &(0x7f0000246000)=[{&(0x7f00006de000)=""/72, 0x48}, {&(0x7f0000304000)=""/84, 0x54}, {&(0x7f00007b0000)=""/243, 0xf3}, {&(0x7f0000863000)=""/0, 0x0}, {&(0x7f00005cc000-0xdd)=""/221, 0xdd}, {&(0x7f0000a94000-0x83)=""/131, 0x83}], 0x6, &(0x7f000050b000-0xb8)=[@mask_cswp={0x58, 0x114, 0x9, {{0x79, 0x3}, &(0x7f0000bd3000)=0xfffffffffffffffb, &(0x7f0000915000)=0x2, 0x8001, 0x2, 0x66, 0x0, 0x4, 0x80000001}}, @rdma_args={0x48, 0x114, 0x1, {{0x7, 0xffffffffffffffff}, {&(0x7f000037a000-0xf7)=""/247, 0xf7}, &(0x7f0000243000)=[{&(0x7f0000216000-0xa1)=""/161, 0xa1}, {&(0x7f0000945000)=""/120, 0x78}, {&(0x7f00001e7000-0xfa)=""/250, 0xfa}, {&(0x7f000052a000-0xa2)=""/162, 0xa2}, {&(0x7f000079c000)=""/241, 0xf1}, {&(0x7f000073a000-0x1d)=""/29, 0x1d}], 0x6, 0x10, 0x1}}, @rdma_dest={0x18, 0x114, 0x2, {0x0, 0x4}}], 0xb8, 0x20000000}, 0x4000) setsockopt(r1, 0x20001000000010f, 0x80000000007f, &(0x7f0000005000)="00008000", 0x4) [ 302.442258] binder: BINDER_SET_CONTEXT_MGR already set [ 302.442267] binder: 15119:15120 ioctl 40046207 0 returned -16 [ 302.442497] binder_alloc: 15097: binder_alloc_buf, no vma [ 302.442518] binder: 15119:15120 transaction failed 29189/-3, size 40-8 line 2903 2018/02/01 04:11:22 executing program 2: openat$ion(0xffffffffffffff9c, &(0x7f0000801000-0x9)='/dev/ion\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000233000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$audion(&(0x7f00001ed000)='/dev/audio#\x00', 0x5, 0x400) getsockopt$inet_dccp_buf(r2, 0x21, 0xcd, &(0x7f0000ef4000)=""/25, &(0x7f0000e4a000-0x4)=0x19) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) write$tun(0xffffffffffffffff, &(0x7f0000577000)=@pi={0x0, 0x0, @eth={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x0}, [], {@canfd={0xd, {{0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0, "feb442a1f43ead325d71fed774c8f6028c2a6b79a4e418aa3c5f391769659fef9f596cdade428c389e511eaad39d2ee4334dee9516a31d00510baaf06efc0980"}}}}}, 0x5a) r3 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004ee000-0x76)='\x00', 0x1, 0x0, 0x0}], &(0x7f000000b000-0x30)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)=""}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00005da000)={0x0, 0x0, &(0x7f00000d8000)=[], 0x48, 0x0, &(0x7f000044c000-0x83)="a410778b7a640ab0384c4ead541b6ee57c5645909ef688d8ac3e5ecfc7039f5f8ba53f127b7f01947cd3689eaf6c090277915bab2a0c450988cb85688e2bcc101a80664d3081fcc0"}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000c5a000)={0x0, 0x0, 0x0, 0x0}) mmap(&(0x7f0000000000/0x13000)=nil, 0x13000, 0x0, 0x32, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000a95000-0x30)={0x14, 0x0, &(0x7f0000b8f000)=[@increfs_done={0x40106308, r4, 0x1}], 0x0, 0x0, &(0x7f00002e4000-0x70)=""}) 2018/02/01 04:11:22 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) seccomp(0x1, 0x0, &(0x7f000089b000-0x10)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x407ffc0003}]}) shmctl$IPC_INFO(0x0, 0x3, &(0x7f0000564000)=""/4096) r0 = socket$inet_icmp(0x2, 0x2, 0x1) getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f000089b000)={{{@in=@remote={0x0, 0x0, 0xffffffffffffffff, 0x0}, @in=@local={0x0, 0x0, 0xffffffffffffffff, 0x0}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, {0x0, 0x0, 0x0, 0x0}, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, {{@in=@multicast1=0x0, 0xffffffffffffffff, 0x0}, 0x0, @in=@empty=0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, &(0x7f0000987000)=0xe8) 2018/02/01 04:11:22 executing program 1: openat$ion(0xffffffffffffff9c, &(0x7f0000801000-0x9)='/dev/ion\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000233000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) write$tun(0xffffffffffffffff, &(0x7f0000577000)=@pi={0x0, 0x0, @eth={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x0}, [], {@canfd={0xd, {{0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0, "feb442a1f43ead325d71fed774c8f6028c2a6b79a4e418aa3c5f391769659fef9f596cdade428c389e511eaad39d2ee4334dee9516a31d00510baaf06efc0980"}}}}}, 0x5a) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004ee000-0x76)='\x00', 0x1, 0x0, 0x0}], &(0x7f000000b000-0x30)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)=""}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00005da000)={0x0, 0x0, &(0x7f00000d8000)=[], 0x48, 0x0, &(0x7f000044c000-0x83)="a410778b7a640ab0384c4ead541b6ee57c5645909ef688d8ac3e5ecfc7039f5f8ba53f127b7f01947cd3689eaf6c090277915bab2a0c450988cb85688e2bcc101a80664d3081fcc0"}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000c5a000)={0x0, 0x0, 0x0, 0x0}) mmap(&(0x7f0000000000/0x13000)=nil, 0x13000, 0x0, 0x32, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000a95000-0x30)={0x14, 0x0, &(0x7f0000b8f000)=[@increfs_done={0x40106308, r3, 0x1}], 0x0, 0x0, &(0x7f00002e4000-0x70)=""}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000436000-0x30)={0xc, 0x0, &(0x7f0000136000)=[@dead_binder_done={0x40086310, 0x3}], 0x0, 0x0, &(0x7f0000888000-0xb)=""}) 2018/02/01 04:11:22 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f0000590000-0x8)='./file0\x00', 0x14) write$selinux_create(r0, &(0x7f000074c000)=@access={'system_u:object_r:dpkg_exec_t:s0', 0x20, '/usr/sbin/cups-browsed', 0x20, 0x32, 0x30, 0x0}, 0x3b) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f00007cf000)='/dev/cuse\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_STATUS(r1, 0xc05c5340, &(0x7f0000b85000)={0x6, 0x100, 0x2, {0x0, 0x0}, 0x0, 0x4, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000801000-0x9)='/dev/ion\x00', 0x0, 0x0) r3 = syz_open_dev$binder(&(0x7f0000233000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r4 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0) r5 = dup2(r3, r4) write$tun(0xffffffffffffffff, &(0x7f0000577000)=@pi={0x0, 0x0, @eth={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x0}, [], {@canfd={0xd, {{0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0, "feb442a1f43ead325d71fed774c8f6028c2a6b79a4e418aa3c5f391769659fef9f596cdade428c389e511eaad39d2ee4334dee9516a31d00510baaf06efc0980"}}}}}, 0x5a) r6 = dup2(r4, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004ee000-0x76)='\x00', 0x1, 0x0, 0x0}], &(0x7f000000b000-0x30)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)=""}) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f00005da000)={0x0, 0x0, &(0x7f00000d8000)=[], 0x3f, 0x0, &(0x7f000044c000-0x83)="a410778b7a640ab0384c4ead541b6ee57c5645909ef688d8ac3e5ecfc7039f5f8ba53f127b7f01947cd3689eaf6c090277915bab2a0c450988cb85688e2bcc"}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000c5a000)={0x0, 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000a95000-0x30)={0x14, 0x0, &(0x7f0000b8f000)=[@increfs_done={0x40106308, r7, 0x1}], 0x0, 0x0, &(0x7f00002e4000-0x70)=""}) getsockopt$inet6_dccp_buf(r5, 0x21, 0xcf, &(0x7f0000e10000-0xcc)=""/204, &(0x7f000037d000-0x4)=0xcc) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000436000-0x30)={0x20, 0x0, &(0x7f0000136000)=[@dead_binder_done={0x40086310, 0x3}, @increfs_done={0x40106308, r7, 0x0}], 0x0, 0x0, &(0x7f0000888000-0xb)=""}) close(r2) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000002000-0x38)={0x0, 0x0, &(0x7f0000003000)=[], 0x0, &(0x7f0000002000)=[{0x10, 0x10e, 0x0, ""}], 0x10, 0x0}, 0x0) [ 302.589871] binder: BINDER_SET_CONTEXT_MGR already set [ 302.589882] binder: 15131:15136 ioctl 40046207 0 returned -16 [ 302.590345] binder_alloc: 15097: binder_alloc_buf, no vma [ 302.590371] binder: 15131:15136 transaction failed 29189/-3, size 40-8 line 2903 2018/02/01 04:11:22 executing program 5: mmap(&(0x7f0000000000/0x2b000)=nil, 0x2b000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f000001c000-0x38)={&(0x7f0000016000)={0x10, 0x0, 0x0, 0x0}, 0xc, &(0x7f000000b000)={&(0x7f0000021000)=@ipv4_newroute={0x24, 0x18, 0x21, 0xffffffffffffffff, 0xffffffffffffffff, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x1, 0x0}, [@RTA_GATEWAY={0x8, 0x5, @local={0xac, 0x14, 0xffffffffffffffff, 0xaa}}]}, 0x24}, 0x1, 0x0, 0x0, 0x0}, 0x0) recvfrom(r0, &(0x7f0000016000-0x14)=""/20, 0x14, 0x10100, 0x0, 0x0) 2018/02/01 04:11:22 executing program 3: mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = accept$ax25(0xffffffffffffff9c, 0x0, &(0x7f0000000000)=0x0) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) pread64(r0, &(0x7f0000001000-0x13)=""/19, 0x13, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) nanosleep(&(0x7f0000d1e000)={0x0, 0x1c9c380}, &(0x7f0000183000-0x10)={0x0, 0x0}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) shmat(0xffffffffffffffff, &(0x7f00001fd000/0x2000)=nil, 0x2000) shmat(0xffffffffffffffff, &(0x7f0000f9f000/0x4000)=nil, 0x4000) r1 = shmat(0x0, &(0x7f0000601000/0x3000)=nil, 0x1000) shmdt(r1) openat$mixer(0xffffffffffffff9c, &(0x7f00002a3000-0xb)='/dev/mixer\x00', 0x2, 0x0) [ 302.593663] binder: BINDER_SET_CONTEXT_MGR already set [ 302.593674] binder: 15130:15140 ioctl 40046207 0 returned -16 [ 302.596548] binder_alloc: 15097: binder_alloc_buf, no vma [ 302.596573] binder: 15130:15140 transaction failed 29189/-3, size 40-8 line 2903 [ 302.598183] binder: BINDER_SET_CONTEXT_MGR already set [ 302.598193] binder: 15133:15138 ioctl 40046207 0 returned -16 [ 302.598516] binder: 15130:15140 BC_INCREFS_DONE u0000000000000000 no match [ 302.598652] binder: 15130:15140 BC_INCREFS_DONE u0000000000000000 no match [ 302.599344] binder: 15133:15138 ioctl 5429 2004affc returned -22 [ 302.599518] binder: 15133:15138 ioctl 540f 205e5ffc returned -22 [ 302.599624] binder_alloc: 15097: binder_alloc_buf, no vma [ 302.599649] binder: 15133:15138 transaction failed 29189/-3, size 40-8 line 2903 [ 302.601975] binder: 15133:15138 BC_INCREFS_DONE u0000000000000000 no match [ 302.628273] binder: BINDER_SET_CONTEXT_MGR already set [ 302.628285] binder: 15133:15138 ioctl 40046207 0 returned -16 [ 302.630281] binder: 15133:15145 ioctl 5429 2004affc returned -22 [ 302.633756] binder: 15133:15138 ioctl 540f 205e5ffc returned -22 [ 302.633833] binder_alloc: 15097: binder_alloc_buf, no vma [ 302.633859] binder: 15133:15145 transaction failed 29189/-3, size 40-8 line 2903 [ 302.653176] binder: BINDER_SET_CONTEXT_MGR already set [ 302.653185] binder: 15149:15151 ioctl 40046207 0 returned -16 [ 302.659390] binder_alloc: 15097: binder_alloc_buf, no vma [ 302.659417] binder: 15149:15151 transaction failed 29189/-3, size 40-8 line 2903 [ 302.666258] binder: 15133:15152 BC_INCREFS_DONE u0000000000000000 no match [ 302.701118] binder: BINDER_SET_CONTEXT_MGR already set [ 302.701126] binder: 15147:15154 ioctl 40046207 0 returned -16 [ 302.702320] binder_alloc: 15097: binder_alloc_buf, no vma [ 302.702345] binder: 15147:15154 transaction failed 29189/-3, size 40-8 line 2903 [ 302.704620] binder: 15147:15154 BC_INCREFS_DONE u0000000000000000 no match [ 302.704705] binder: 15147:15154 BC_DEAD_BINDER_DONE 0000000000000000 not found 2018/02/01 04:11:23 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000a8d000)={&(0x7f0000e4e000)={0x10, 0x0, 0x0, 0x0}, 0xc, &(0x7f0000fcf000-0x10)={&(0x7f00005d5000)=@updsa={0x104, 0x1a, 0x1, 0xffffffffffffffff, 0xffffffffffffffff, {{@in6=@local={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0xffffffffffffffff, 0xaa}, @in=@dev={0xac, 0x14, 0xffffffffffffffff, 0x0}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0}, {@in=@broadcast=0xffffffff, 0xffffffffffffffff, 0x2b}, @in=@multicast2=0xe0000002, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, {0x0, 0x0, 0x0, 0x0}, {0x0, 0x0, 0x0}, 0xffffffffffffffff, 0xffffffffffffffff, 0xa, 0x2, 0x0, 0x0}, [@coaddr={0x14, 0xe, @in=@remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}}]}, 0x104}, 0x1, 0x0, 0x0, 0x0}, 0x0) r1 = openat$dsp(0xffffffffffffff9c, &(0x7f0000fac000-0x9)='/dev/dsp\x00', 0x0, 0x0) io_setup(0x671, &(0x7f0000521000)=0x0) ioctl$KVM_CREATE_DEVICE(r1, 0xc00caee0, &(0x7f0000c37000)={0x3, r0, 0x0}) ioctl$LOOP_SET_FD(r3, 0x4c00, r0) io_cancel(r2, &(0x7f0000521000)={0x0, 0x0, 0x0, 0x6, 0x800, r1, &(0x7f0000e54000)="7939be4be7de96adbe96326d9defaba28b7fa32db55343b0e123d084f34dabd0a204a529a9c28cd13518fe50d9d6e64ca020a66a98e566c6ccf2b43fe1c693f142e156fc37ab59bb204301f4033b6dc8c895d1bc6e09c1373896fca05dfe9886edd2e6a1c5e04fe564157fcffccda0fc34db46627d2b05cf38512d942743839ffb9b5407a84c5524f645461afac54a2d78c92b63cc234a73abdabeb72edce1f8febbd32f2af238762f2014d5b502848c3ce99aeac01225f97a093b221b0a9fb3be162d8efcd946109042595f3749ccf16819d60d48764e5fab9fb1f7e6ed65809e7d02f300721298", 0xe8, 0x20, 0x0, 0x1, r1}, &(0x7f0000ec2000-0x20)={0x0, 0x0, 0x0, 0x0}) ioctl$KVM_DEASSIGN_DEV_IRQ(r1, 0x4040ae75, &(0x7f00006f5000-0x10)={0x401, 0x20, 0x8, 0x101}) ioctl$SNDRV_CTL_IOCTL_PVERSION(r1, 0x80045500, &(0x7f000038a000-0x82)=""/130) setsockopt$inet6_dccp_int(r1, 0x21, 0xf, &(0x7f0000ac0000-0x4)=0x4, 0x4) 2018/02/01 04:11:23 executing program 1: openat$ion(0xffffffffffffff9c, &(0x7f0000801000-0x9)='/dev/ion\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000233000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) write$tun(0xffffffffffffffff, &(0x7f0000577000)=@pi={0x0, 0x0, @eth={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x0}, [], {@canfd={0xd, {{0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0, "feb442a1f43ead325d71fed774c8f6028c2a6b79a4e418aa3c5f391769659fef9f596cdade428c389e511eaad39d2ee4334dee9516a31d00510baaf06efc0980"}}}}}, 0x5a) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004ee000-0x76)='\x00', 0x1, 0x0, 0x0}], &(0x7f000000b000-0x30)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)=""}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00005da000)={0x0, 0x0, &(0x7f00000d8000)=[], 0x48, 0x0, &(0x7f000044c000-0x83)="a410778b7a640ab0384c4ead541b6ee57c5645909ef688d8ac3e5ecfc7039f5f8ba53f127b7f01947cd3689eaf6c090277915bab2a0c450988cb85688e2bcc101a80664d3081fcc0"}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000c5a000)={0x0, 0x0, 0x0, 0x0}) mmap(&(0x7f0000000000/0x13000)=nil, 0x13000, 0x0, 0x32, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000a95000-0x30)={0x14, 0x0, &(0x7f0000b8f000)=[@increfs_done={0x40106308, r3, 0x1}], 0x0, 0x0, &(0x7f00002e4000-0x70)=""}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000436000-0x30)={0xc, 0x0, &(0x7f0000136000)=[@dead_binder_done={0x40086310, 0x3}], 0x0, 0x0, &(0x7f0000888000-0xb)=""}) 2018/02/01 04:11:23 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f0000590000-0x8)='./file0\x00', 0x14) write$selinux_create(r0, &(0x7f000074c000)=@access={'system_u:object_r:dpkg_exec_t:s0', 0x20, '/usr/sbin/cups-browsed', 0x20, 0x32, 0x30, 0x0}, 0x3b) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f00007cf000)='/dev/cuse\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_STATUS(r1, 0xc05c5340, &(0x7f0000b85000)={0x6, 0x100, 0x2, {0x0, 0x0}, 0x0, 0x4, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000801000-0x9)='/dev/ion\x00', 0x0, 0x0) r3 = syz_open_dev$binder(&(0x7f0000233000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r4 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0) r5 = dup2(r3, r4) write$tun(0xffffffffffffffff, &(0x7f0000577000)=@pi={0x0, 0x0, @eth={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x0}, [], {@canfd={0xd, {{0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0, "feb442a1f43ead325d71fed774c8f6028c2a6b79a4e418aa3c5f391769659fef9f596cdade428c389e511eaad39d2ee4334dee9516a31d00510baaf06efc0980"}}}}}, 0x5a) r6 = dup2(r4, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004ee000-0x76)='\x00', 0x1, 0x0, 0x0}], &(0x7f000000b000-0x30)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)=""}) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f00005da000)={0x0, 0x0, &(0x7f00000d8000)=[], 0x44, 0x0, &(0x7f000044c000-0x83)="a410778b7a640ab0384c4ead541b6ee57c5645909ef688d8ac3e5ecfc7039f5f8ba53f127b7f01947cd3689eaf6c090277915bab2a0c450988cb85688e2bcc101a80664d"}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000c5a000)={0x0, 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000a95000-0x30)={0x14, 0x0, &(0x7f0000b8f000)=[@increfs_done={0x40106308, r7, 0x1}], 0x0, 0x0, &(0x7f00002e4000-0x70)=""}) getsockopt$inet6_dccp_buf(r5, 0x21, 0xcf, &(0x7f0000e10000-0xcc)=""/204, &(0x7f000037d000-0x4)=0xcc) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000436000-0x30)={0x20, 0x0, &(0x7f0000136000)=[@dead_binder_done={0x40086310, 0x3}, @increfs_done={0x40106308, r7, 0x0}], 0x0, 0x0, &(0x7f0000888000-0xb)=""}) close(r2) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000002000-0x38)={0x0, 0x0, &(0x7f0000003000)=[], 0x0, &(0x7f0000002000)=[{0x10, 0x10e, 0x0, ""}], 0x10, 0x0}, 0x0) 2018/02/01 04:11:23 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000310000)={0x1, 0x3, 0xeff, 0x7, 0x0, 0x0, 0x0, [0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x2c) r1 = dup2(r0, r0) fadvise64(r1, 0x57, 0x6, 0x0) ioctl$SNDRV_TIMER_IOCTL_GINFO(r1, 0xc0f85403, &(0x7f0000cb7000)={{0x1, 0x0, 0x2, 0x1, 0x7}, 0x0, 0x1ff, 'id1\x00', 'timer1\x00', 0x0, 0x6, 0x1ff, 0xa3, 0x9, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) getsockopt$bt_sco_SCO_OPTIONS(r1, 0x11, 0x1, &(0x7f000069d000-0xd2)=""/210, &(0x7f00009d9000)=0xd2) 2018/02/01 04:11:23 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet_sctp(0x2, 0x1, 0x84) r1 = syz_open_dev$usbmon(&(0x7f0000e20000-0xd)='/dev/usbmon#\x00', 0x3ff, 0x0) fcntl$getown(r0, 0x9) ioctl$sock_bt(r1, 0x541b, &(0x7f0000286000)="8450912f1e8652ea023ad265f83d8c8c92b3d292db61dc404db259352853ca255d0940f05b8c1fc0ed32cd375f1c15ebc80d3d150853397ef50035ae0cad56fcf4e9d6f7acb4b350a6f274e459d4f2e79f060b9326475958b4b91f86fd1991d2a5cf401907c0f3bfb876b5cea809ffd88894dcf961e217ce3b96afdc2d3a6c63473f1bd1fd09f6ebfe0c91b0321120be8ee835806cd0c7c57b1e9f2f5b191412af0837db2998670a2f26abff9be97aa145b0dff1b2ef1e") sendto$inet(r0, &(0x7f0000022000-0x16)="01", 0x1, 0x0, &(0x7f0000031000-0x10)={0x2, 0xffffffffffffffff, @local={0xac, 0x14, 0xffffffffffffffff, 0xaa}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x10) sendto$inet(r0, &(0x7f0000035000-0x95)="c6", 0x1, 0x0, &(0x7f0000034000-0x10)={0x2, 0xffffffffffffffff, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x10) ioctl$LOOP_SET_DIRECT_IO(r1, 0x4c08, 0x9) shutdown(r0, 0x1) 2018/02/01 04:11:23 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dmmidi(&(0x7f0000208000)='/dev/dmmidi#\x00', 0x7fff, 0x400000) name_to_handle_at(r0, &(0x7f0000ecf000-0x8)='./file0\x00', &(0x7f0000f82000-0x7e)={0x7e, 0x9, "f925f42226eeda865bb884cca1f1edfed83c7bbee1a556f2d7593f4940eacbe6517da7bd082385cb2bb4c2c13a633dc52004a09dfd1f4902b80e64b32406a162b0fb0181704a089095570401fad0fdb841852fe9d5594cd8a957064b835f9921a27a3faee36c452b97b88c50cb32709aa93356cab3e2"}, &(0x7f0000f91000)=0x0, 0x1400) seccomp(0x1, 0x0, &(0x7f000089b000-0x10)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x407ffc0003}]}) shmctl$IPC_INFO(0x0, 0x3, &(0x7f0000564000)=""/4096) r1 = creat(&(0x7f00004aa000-0x8)='./file0\x00', 0x188) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000413000)={0x0, r1, 0x7, 0x2, 0x0}, 0x14) 2018/02/01 04:11:23 executing program 2: openat$ion(0xffffffffffffff9c, &(0x7f0000801000-0x9)='/dev/ion\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000233000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r2 = dup2(r0, r1) write$tun(0xffffffffffffffff, &(0x7f0000577000)=@pi={0x0, 0x0, @eth={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x0}, [], {@canfd={0xd, {{0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0, "feb442a1f43ead325d71fed774c8f6028c2a6b79a4e418aa3c5f391769659fef9f596cdade428c389e511eaad39d2ee4334dee9516a31d00510baaf06efc0980"}}}}}, 0x5a) r3 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004ee000-0x76)='\x00', 0x1, 0x0, 0x0}], &(0x7f000000b000-0x30)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)=""}) syz_emit_ethernet(0x26, &(0x7f0000e1d000)={@random="72548dc451d3", @remote={[0xaa, 0xaa, 0xaa, 0xaa], 0x0, 0xbb}, [{[{0x9100, 0x101, 0x46, 0x5e482458}], {0x8100, 0x6, 0x80, 0x6683}}], {@can={0xc, {{0x0, 0x100000001, 0xfff, 0x7}, 0x0, 0x3, 0x0, 0x0, "d4c995f3c394c309"}}}}, &(0x7f0000f93000)={0x1, 0x1, [0x671]}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00005da000)={0x0, 0x0, &(0x7f00000d8000)=[], 0x48, 0x0, &(0x7f000044c000-0x83)="a410778b7a640ab0384c4ead541b6ee57c5645909ef688d8ac3e5ecfc7039f5f8ba53f127b7f01947cd3689eaf6c090277915bab2a0c450988cb85688e2bcc101a80664d3081fcc0"}) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r2, 0x84, 0x7c, &(0x7f0000a1d000)={0x0, 0xffffffff, 0x8}, &(0x7f0000da8000)=0x8) getsockopt$inet_sctp_SCTP_ENABLE_STREAM_RESET(r2, 0x84, 0x76, &(0x7f0000b0b000)={r4, 0x4}, &(0x7f0000869000-0x4)=0x8) r5 = openat$autofs(0xffffffffffffff9c, &(0x7f00005f5000-0xc)='/dev/autofs\x00', 0x204041, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000c5a000)={0x0, 0x0, 0x0, 0x0}) mmap(&(0x7f0000000000/0x13000)=nil, 0x13000, 0x0, 0x32, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000a95000-0x30)={0x14, 0x0, &(0x7f0000b8f000)=[@increfs_done={0x40106308, r6, 0x1}], 0x0, 0x0, &(0x7f00002e4000-0x70)=""}) tee(r5, r5, 0xe, 0xa) 2018/02/01 04:11:23 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket(0x1e, 0x1, 0x0) getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f0000f45000-0xe8)={{{@in=@local={0x0, 0x0, 0xffffffffffffffff, 0x0}, @in6=@mcast2={0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, {0x0, 0x0, 0x0, 0x0}, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, {{@in6=@mcast1={0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0}, 0xffffffffffffffff, 0x0}, 0x0, @in=@dev={0x0, 0x0, 0xffffffffffffffff, 0x0}, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, &(0x7f0000c6a000)=0xe8) bind(r0, &(0x7f00006ca000-0x32)=@pppol2tpin6={0x18, 0x1, {0x0, r0, 0x2, 0x2, 0x0, 0x3, {0xa, 0x2, 0x401, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x1}, 0x81}}}, 0x32) bind(r0, &(0x7f0000afb000)=@generic={0x1e, "01030000000000b9000000004700000000a979f321b30c7bc8790405c7bad62e0a63a632ed4938d36d73fb8f8401a3ff59829a2b0afe7ce43a4b2470a0c5216669ca021f6f65dcf160e7e58f358c0002f0000158d19bcb3151d24acef1f1622ca5bdb9c8ea31000077aeb81c90001d6d7c980400000000f70dc136cb184a"}, 0x80) r1 = socket(0x1e, 0x2, 0x0) bind(r1, &(0x7f0000d81000-0x80)=@generic={0x1e, "0103000000000000000000000000000009a979f321b30c7bc8790405c7bad62e0a43a632ed4938d36d73fb8f8401a3ff59829a2b0afe7ce43a4b2470a0c5216669ca021f6f65dcf160e7e58f358c0002f0000158d19bcb31f1314a8ef151622ca5bdb9c8ead2000077aeb81c90001d6d7c980ee590c8b9f70dc136cb184a"}, 0x80) r2 = socket(0x1e, 0x2, 0x0) bind(r2, &(0x7f0000afb000)=@generic={0x1e, "01030000000000b9000000004700000000a979f321b30c7bc8790405c7bad62e0a63a632ed4938d36d73fb8f8401a3ff59829a2b0afe7ce43a4b2470a0c5216669ca021f6f65dcf160e7e58f358c0002f0000158d19bcb3151d24acef1f1622ca5bdb9c8ea31000077aeb81c90001b6d7c980400000000f70dc136cb184a"}, 0x80) r3 = socket(0x1e, 0x1, 0x0) bind(r3, &(0x7f0000afb000)=@generic={0x1e, "01030000000000b9000000004700000000a979f321b30c7bc8790405c7bad62e0a63a632ed4938d36d73fb8f8401a3ff59829a2b0afe7ce43a4b2470a0c5216669ca021f6f65dcf160e7e58f358c0002f0000158d19bcb3151d24acef1f1622ca5bdb9c8ea31000077aeb81c90001d6d7c980400000000f70dc136cb184a"}, 0x80) r4 = socket(0x1e, 0x5, 0x0) sendmsg(r4, &(0x7f0000316000)={&(0x7f0000dd7000)=@generic={0x10000000001e, "010000000000000000000001e526cc573c5bf86c483724c71e14dd6a739effea1b48006be61ffe06d79f00000000000000076c3f010039d8f986ff03000000000000af50d5fe32c419d67bcbc7e3ad316a198356ed0008341c1fd45624281e27800ece70b076cf979ac40000bd767e2e78a1dfd300981a1565b3b16d7436"}, 0x80, &(0x7f0000d0c000-0x30)=[], 0x0, &(0x7f00002d4000)=[], 0x0, 0x0}, 0x0) [ 302.704713] binder: 15147:15154 BC_INCREFS_DONE u0000000000000000 no match [ 302.787143] binder: BINDER_SET_CONTEXT_MGR already set [ 302.787154] binder: 15160:15165 ioctl 40046207 0 returned -16 [ 302.794290] binder_alloc: 15097: binder_alloc_buf, no vma [ 302.794315] binder: 15160:15165 transaction failed 29189/-3, size 40-8 line 2903 [ 302.845268] binder: BINDER_SET_CONTEXT_MGR already set [ 302.845280] binder: 15180:15185 ioctl 40046207 0 returned -16 [ 302.847335] binder_alloc: 15097: binder_alloc_buf, no vma 2018/02/01 04:11:23 executing program 1: openat$ion(0xffffffffffffff9c, &(0x7f0000801000-0x9)='/dev/ion\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000233000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) write$tun(0xffffffffffffffff, &(0x7f0000577000)=@pi={0x0, 0x0, @eth={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x0}, [], {@canfd={0xd, {{0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0, "feb442a1f43ead325d71fed774c8f6028c2a6b79a4e418aa3c5f391769659fef9f596cdade428c389e511eaad39d2ee4334dee9516a31d00510baaf06efc0980"}}}}}, 0x5a) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004ee000-0x76)='\x00', 0x1, 0x0, 0x0}], &(0x7f000000b000-0x30)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)=""}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00005da000)={0x0, 0x0, &(0x7f00000d8000)=[], 0x48, 0x0, &(0x7f000044c000-0x83)="a410778b7a640ab0384c4ead541b6ee57c5645909ef688d8ac3e5ecfc7039f5f8ba53f127b7f01947cd3689eaf6c090277915bab2a0c450988cb85688e2bcc101a80664d3081fcc0"}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000c5a000)={0x0, 0x0, 0x0, 0x0}) mmap(&(0x7f0000000000/0x13000)=nil, 0x13000, 0x0, 0x32, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000a95000-0x30)={0x14, 0x0, &(0x7f0000b8f000)=[@increfs_done={0x40106308, r3, 0x1}], 0x0, 0x0, &(0x7f00002e4000-0x70)=""}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000436000-0x30)={0x20, 0x0, &(0x7f0000136000)=[@dead_binder_done={0x40086310, 0x3}, @increfs_done={0x40106308, 0x0, 0x0}], 0x0, 0x0, &(0x7f0000888000-0xb)=""}) [ 302.847357] binder: 15180:15185 transaction failed 29189/-3, size 40-8 line 2903 [ 302.847646] binder: BINDER_SET_CONTEXT_MGR already set 2018/02/01 04:11:23 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f0000590000-0x8)='./file0\x00', 0x14) write$selinux_create(r0, &(0x7f000074c000)=@access={'system_u:object_r:dpkg_exec_t:s0', 0x20, '/usr/sbin/cups-browsed', 0x20, 0x32, 0x30, 0x0}, 0x3b) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f00007cf000)='/dev/cuse\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_STATUS(r1, 0xc05c5340, &(0x7f0000b85000)={0x6, 0x100, 0x2, {0x0, 0x0}, 0x0, 0x4, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000801000-0x9)='/dev/ion\x00', 0x0, 0x0) r3 = syz_open_dev$binder(&(0x7f0000233000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r4 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0) r5 = dup2(r3, r4) write$tun(0xffffffffffffffff, &(0x7f0000577000)=@pi={0x0, 0x0, @eth={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x0}, [], {@canfd={0xd, {{0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0, "feb442a1f43ead325d71fed774c8f6028c2a6b79a4e418aa3c5f391769659fef9f596cdade428c389e511eaad39d2ee4334dee9516a31d00510baaf06efc0980"}}}}}, 0x5a) r6 = dup2(r4, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004ee000-0x76)='\x00', 0x1, 0x0, 0x0}], &(0x7f000000b000-0x30)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)=""}) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f00005da000)={0x0, 0x0, &(0x7f00000d8000)=[], 0x44, 0x0, &(0x7f000044c000-0x83)="a410778b7a640ab0384c4ead541b6ee57c5645909ef688d8ac3e5ecfc7039f5f8ba53f127b7f01947cd3689eaf6c090277915bab2a0c450988cb85688e2bcc101a80664d"}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000c5a000)={0x0, 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000a95000-0x30)={0x14, 0x0, &(0x7f0000b8f000)=[@increfs_done={0x40106308, r7, 0x1}], 0x0, 0x0, &(0x7f00002e4000-0x70)=""}) getsockopt$inet6_dccp_buf(r5, 0x21, 0xcf, &(0x7f0000e10000-0xcc)=""/204, &(0x7f000037d000-0x4)=0xcc) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000436000-0x30)={0x20, 0x0, &(0x7f0000136000)=[@dead_binder_done={0x40086310, 0x3}, @increfs_done={0x40106308, r7, 0x0}], 0x0, 0x0, &(0x7f0000888000-0xb)=""}) close(r2) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000002000-0x38)={0x0, 0x0, &(0x7f0000003000)=[], 0x0, &(0x7f0000002000)=[{0x10, 0x10e, 0x0, ""}], 0x10, 0x0}, 0x0) 2018/02/01 04:11:23 executing program 5: r0 = syz_open_dev$midi(&(0x7f0000501000-0xb)='/dev/midi#\x00', 0x3, 0x20000) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) getpeername$packet(0xffffffffffffff9c, &(0x7f0000001000-0x14)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0], [0x0, 0x0]}, &(0x7f0000001000-0x4)=0x14) ioctl$sock_inet6_SIOCADDRT(r0, 0x890b, &(0x7f00008f4000)={@dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0x17}, @local={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0xaa}, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0xfc00000000000000, 0x8, 0x8, 0x400, 0x1, 0xc0800000, r1}) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r2 = userfaultfd(0x0) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000001000-0x18)={0xaa, 0x0, 0x0}) ioctl$UFFDIO_REGISTER(r2, 0xc028aa03, &(0x7f0000003000-0x20)={{&(0x7f0000012000/0x2000)=nil, 0x2000}, 0x20000000000, 0x0}) ioctl$TTUNGETFILTER(r0, 0x801054db, &(0x7f0000001000)=""/195) 2018/02/01 04:11:23 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet_sctp(0x2, 0x1, 0x84) r1 = syz_open_dev$usbmon(&(0x7f0000e20000-0xd)='/dev/usbmon#\x00', 0x3ff, 0x0) fcntl$getown(r0, 0x9) ioctl$sock_bt(r1, 0x541b, &(0x7f0000286000)="8450912f1e8652ea023ad265f83d8c8c92b3d292db61dc404db259352853ca255d0940f05b8c1fc0ed32cd375f1c15ebc80d3d150853397ef50035ae0cad56fcf4e9d6f7acb4b350a6f274e459d4f2e79f060b9326475958b4b91f86fd1991d2a5cf401907c0f3bfb876b5cea809ffd88894dcf961e217ce3b96afdc2d3a6c63473f1bd1fd09f6ebfe0c91b0321120be8ee835806cd0c7c57b1e9f2f5b191412af0837db2998670a2f26abff9be97aa145b0dff1b2ef1e") sendto$inet(r0, &(0x7f0000022000-0x16)="01", 0x1, 0x0, &(0x7f0000031000-0x10)={0x2, 0xffffffffffffffff, @local={0xac, 0x14, 0xffffffffffffffff, 0xaa}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x10) sendto$inet(r0, &(0x7f0000035000-0x95)="c6", 0x1, 0x0, &(0x7f0000034000-0x10)={0x2, 0xffffffffffffffff, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x10) shutdown(r0, 0x1) [ 302.847654] binder: 15179:15183 ioctl 40046207 0 returned -16 [ 302.848667] binder_alloc: 15097: binder_alloc_buf, no vma [ 302.848689] binder: 15179:15183 transaction failed 29189/-3, size 40-8 line 2903 [ 302.860153] binder: BINDER_SET_CONTEXT_MGR already set 2018/02/01 04:11:23 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f0000590000-0x8)='./file0\x00', 0x14) write$selinux_create(r0, &(0x7f000074c000)=@access={'system_u:object_r:dpkg_exec_t:s0', 0x20, '/usr/sbin/cups-browsed', 0x20, 0x32, 0x30, 0x0}, 0x3b) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f00007cf000)='/dev/cuse\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_STATUS(r1, 0xc05c5340, &(0x7f0000b85000)={0x6, 0x100, 0x2, {0x0, 0x0}, 0x0, 0x4, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000801000-0x9)='/dev/ion\x00', 0x0, 0x0) r3 = syz_open_dev$binder(&(0x7f0000233000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r4 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0) r5 = dup2(r3, r4) write$tun(0xffffffffffffffff, &(0x7f0000577000)=@pi={0x0, 0x0, @eth={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x0}, [], {@canfd={0xd, {{0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0, "feb442a1f43ead325d71fed774c8f6028c2a6b79a4e418aa3c5f391769659fef9f596cdade428c389e511eaad39d2ee4334dee9516a31d00510baaf06efc0980"}}}}}, 0x5a) r6 = dup2(r4, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004ee000-0x76)='\x00', 0x1, 0x0, 0x0}], &(0x7f000000b000-0x30)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)=""}) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f00005da000)={0x0, 0x0, &(0x7f00000d8000)=[], 0x44, 0x0, &(0x7f000044c000-0x83)="a410778b7a640ab0384c4ead541b6ee57c5645909ef688d8ac3e5ecfc7039f5f8ba53f127b7f01947cd3689eaf6c090277915bab2a0c450988cb85688e2bcc101a80664d"}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000c5a000)={0x0, 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000a95000-0x30)={0x14, 0x0, &(0x7f0000b8f000)=[@increfs_done={0x40106308, r7, 0x1}], 0x0, 0x0, &(0x7f00002e4000-0x70)=""}) getsockopt$inet6_dccp_buf(r5, 0x21, 0xcf, &(0x7f0000e10000-0xcc)=""/204, &(0x7f000037d000-0x4)=0xcc) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000436000-0x30)={0x20, 0x0, &(0x7f0000136000)=[@dead_binder_done={0x40086310, 0x3}, @increfs_done={0x40106308, r7, 0x0}], 0x0, 0x0, &(0x7f0000888000-0xb)=""}) close(r2) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000002000-0x38)={0x0, 0x0, &(0x7f0000003000)=[], 0x0, &(0x7f0000002000)=[{0x10, 0x10e, 0x0, ""}], 0x10, 0x0}, 0x0) 2018/02/01 04:11:23 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) seccomp(0x1, 0x0, &(0x7f000089b000-0x10)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x407ffc0003}]}) shmctl$IPC_INFO(0x0, 0x3, &(0x7f0000564000)=""/4096) r0 = openat$selinux_status(0xffffffffffffff9c, &(0x7f000052a000-0x10)='/selinux/status\x00', 0x0, 0x0) ioctl$sock_inet6_tcp_SIOCOUTQNSD(r0, 0x894b, &(0x7f0000ee2000-0x4)=0x0) 2018/02/01 04:11:23 executing program 3: r0 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f00003ea000)='/selinux/avc/cache_stats\x00', 0x0, 0x0) ftruncate(r0, 0x9) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000005000-0x9)='/dev/kvm\x00', 0x0, 0x0) eventfd(0x4388) ioctl$KVM_CHECK_EXTENSION(r1, 0xae03, 0x80) 2018/02/01 04:11:23 executing program 1: openat$ion(0xffffffffffffff9c, &(0x7f0000801000-0x9)='/dev/ion\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000233000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) write$tun(0xffffffffffffffff, &(0x7f0000577000)=@pi={0x0, 0x0, @eth={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x0}, [], {@canfd={0xd, {{0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0, "feb442a1f43ead325d71fed774c8f6028c2a6b79a4e418aa3c5f391769659fef9f596cdade428c389e511eaad39d2ee4334dee9516a31d00510baaf06efc0980"}}}}}, 0x5a) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004ee000-0x76)='\x00', 0x1, 0x0, 0x0}], &(0x7f000000b000-0x30)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)=""}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00005da000)={0x0, 0x0, &(0x7f00000d8000)=[], 0x48, 0x0, &(0x7f000044c000-0x83)="a410778b7a640ab0384c4ead541b6ee57c5645909ef688d8ac3e5ecfc7039f5f8ba53f127b7f01947cd3689eaf6c090277915bab2a0c450988cb85688e2bcc101a80664d3081fcc0"}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000c5a000)={0x0, 0x0, 0x0, 0x0}) mmap(&(0x7f0000000000/0x13000)=nil, 0x13000, 0x0, 0x32, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000a95000-0x30)={0x14, 0x0, &(0x7f0000b8f000)=[@increfs_done={0x40106308, r3, 0x1}], 0x0, 0x0, &(0x7f00002e4000-0x70)=""}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000436000-0x30)={0x20, 0x0, &(0x7f0000136000)=[@dead_binder_done={0x40086310, 0x3}, @increfs_done={0x40106308, 0x0, 0x0}], 0x0, 0x0, &(0x7f0000888000-0xb)=""}) [ 302.860163] binder: 15181:15186 ioctl 40046207 0 returned -16 [ 302.861715] binder_alloc: 15097: binder_alloc_buf, no vma [ 302.861738] binder: 15181:15186 transaction failed 29189/-3, size 40-8 line 2903 [ 302.862631] binder: 15180:15185 BC_INCREFS_DONE u0000000000000000 no match [ 302.863322] binder: 15180:15185 BC_DEAD_BINDER_DONE 0000000000000000 not found [ 302.863332] binder: 15180:15185 BC_INCREFS_DONE u0000000000000000 no match [ 302.900103] binder: 15179:15196 BC_INCREFS_DONE u0000000000000000 no match [ 302.904476] binder: BINDER_SET_CONTEXT_MGR already set [ 302.904485] binder: 15194:15198 ioctl 40046207 0 returned -16 [ 302.913179] binder_alloc: 15097: binder_alloc_buf, no vma [ 302.913207] binder: 15194:15198 transaction failed 29189/-3, size 40-8 line 2903 [ 302.915340] binder: BINDER_SET_CONTEXT_MGR already set [ 302.915348] binder: 15199:15201 ioctl 40046207 0 returned -16 [ 302.916538] binder_alloc: 15097: binder_alloc_buf, no vma [ 302.916562] binder: 15199:15201 transaction failed 29189/-3, size 40-8 line 2903 [ 302.918845] binder: 15199:15201 BC_INCREFS_DONE u0000000000000000 no match [ 302.918911] binder: 15199:15201 BC_DEAD_BINDER_DONE 0000000000000000 not found [ 302.918919] binder: 15199:15201 BC_INCREFS_DONE u0000000000000000 no match [ 302.946329] binder: BINDER_SET_CONTEXT_MGR already set [ 302.946340] binder: 15179:15196 ioctl 40046207 0 returned -16 [ 302.960574] binder: 15179:15202 got reply transaction with no transaction stack [ 302.960601] binder: 15179:15202 transaction failed 29201/-71, size 80-56 line 2703 [ 302.963959] binder_alloc: 15097: binder_alloc_buf, no vma [ 302.963984] binder: 15179:15196 transaction failed 29189/-3, size 40-8 line 2903 [ 302.965512] device eql entered promiscuous mode [ 302.980641] binder: BINDER_SET_CONTEXT_MGR already set [ 302.980650] binder: 15209:15211 ioctl 40046207 0 returned -16 [ 302.981744] binder_alloc: 15097: binder_alloc_buf, no vma [ 302.981769] binder: 15209:15211 transaction failed 29189/-3, size 40-8 line 2903 [ 302.987101] binder: 15209:15211 BC_INCREFS_DONE u0000000000000000 no match [ 302.987240] binder: 15209:15211 BC_DEAD_BINDER_DONE 0000000000000003 not found [ 302.991543] binder: BINDER_SET_CONTEXT_MGR already set [ 302.991553] binder: 15205:15207 ioctl 40046207 0 returned -16 [ 302.991912] binder_alloc: 15097: binder_alloc_buf, no vma [ 302.991936] binder: 15205:15207 transaction failed 29189/-3, size 40-8 line 2903 [ 303.044278] binder: BINDER_SET_CONTEXT_MGR already set [ 303.044288] binder: 15219:15221 ioctl 40046207 0 returned -16 [ 303.045853] binder_alloc: 15097: binder_alloc_buf, no vma [ 303.045877] binder: 15219:15221 transaction failed 29189/-3, size 40-8 line 2903 [ 303.051312] binder: 15219:15221 BC_INCREFS_DONE u0000000000000000 no match [ 303.062481] binder: BINDER_SET_CONTEXT_MGR already set [ 303.062490] binder: 15220:15224 ioctl 40046207 0 returned -16 [ 303.064734] binder_alloc: 15097: binder_alloc_buf, no vma [ 303.064759] binder: 15220:15224 transaction failed 29189/-3, size 40-8 line 2903 [ 303.067930] binder: 15220:15224 BC_INCREFS_DONE u0000000000000000 no match [ 303.068038] binder: 15220:15224 BC_DEAD_BINDER_DONE 0000000000000003 not found [ 303.070042] binder: BINDER_SET_CONTEXT_MGR already set [ 303.070050] binder: 15223:15226 ioctl 40046207 0 returned -16 [ 303.070651] binder_alloc: 15097: binder_alloc_buf, no vma [ 303.070674] binder: 15223:15226 transaction failed 29189/-3, size 40-8 line 2903 [ 303.083905] binder: BINDER_SET_CONTEXT_MGR already set [ 303.083916] binder: 15219:15221 ioctl 40046207 0 returned -16 [ 303.092180] binder_alloc: 15097: binder_alloc_buf, no vma [ 303.092234] binder: 15219:15229 transaction failed 29189/-3, size 40-8 line 2903 [ 303.343718] binder: BINDER_SET_CONTEXT_MGR already set [ 303.343728] binder: 15245:15250 ioctl 40046207 0 returned -16 [ 303.344758] binder_alloc: 15097: binder_alloc_buf, no vma [ 303.344782] binder: 15245:15250 transaction failed 29189/-3, size 40-8 line 2903 [ 303.351067] binder: 15245:15250 BC_INCREFS_DONE u0000000000000000 no match [ 303.354487] binder: BINDER_SET_CONTEXT_MGR already set [ 303.354497] binder: 15249:15256 ioctl 40046207 0 returned -16 [ 303.355782] binder_alloc: 15097: binder_alloc_buf, no vma [ 303.355805] binder: 15249:15256 transaction failed 29189/-3, size 40-8 line 2903 [ 303.356456] binder: 15245:15250 BC_DEAD_BINDER_DONE 0000000000000003 not found [ 303.361165] binder: 15249:15256 BC_INCREFS_DONE u0000000000000000 no match [ 303.363521] binder: BINDER_SET_CONTEXT_MGR already set [ 303.363529] binder: 15246:15251 ioctl 40046207 0 returned -16 [ 303.363848] binder_alloc: 15097: binder_alloc_buf, no vma [ 303.363869] binder: 15246:15251 transaction failed 29189/-3, size 40-8 line 2903 [ 303.387184] binder: BINDER_SET_CONTEXT_MGR already set [ 303.387194] binder: 15249:15256 ioctl 40046207 0 returned -16 [ 303.391365] binder_alloc: 15097: binder_alloc_buf, no vma 2018/02/01 04:11:23 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = socket$inet_sctp(0x2, 0x5, 0x84) setsockopt$inet_sctp_SCTP_RECVNXTINFO(r1, 0x84, 0x21, &(0x7f000084e000-0x4)=0x7e0000000000000, 0x4) getsockopt$inet_sctp_SCTP_FRAGMENT_INTERLEAVE(r1, 0x84, 0x12, &(0x7f00000bc000-0x4)=0x0, &(0x7f0000f34000)=0x4) sendmsg$nl_xfrm(r0, &(0x7f0000a8d000)={&(0x7f0000e4e000)={0x10, 0x0, 0x0, 0x0}, 0xc, &(0x7f0000fcf000-0x10)={&(0x7f00005d5000)=@updsa={0x104, 0x1a, 0x1, 0xffffffffffffffff, 0xffffffffffffffff, {{@in6=@local={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0xffffffffffffffff, 0xaa}, @in=@dev={0xac, 0x14, 0xffffffffffffffff, 0x0}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0}, {@in=@broadcast=0xffffffff, 0xffffffffffffffff, 0x2b}, @in=@multicast2=0xe0000002, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, {0x0, 0x0, 0x0, 0x0}, {0x0, 0x0, 0x0}, 0xffffffffffffffff, 0xffffffffffffffff, 0xa, 0x2, 0x0, 0x0}, [@coaddr={0x14, 0xe, @in=@remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}}]}, 0x104}, 0x1, 0x0, 0x0, 0x0}, 0x0) sendmsg(r0, &(0x7f00000fb000)={&(0x7f0000ef3000)=@ipx={0x4, 0x2, 0xfffffffffffffffb, "601b90823478", 0x400, 0x0}, 0x10, &(0x7f0000577000)=[{&(0x7f0000263000-0xfd)="36948727a7e3ae3e98cc83711018026fb1dbb9a211d61b5be47799aa3ac1dec63c98e2077f008f016826a44bdf571eccad22fbfe18e3b53a26bda4a348f16dfc0c56715ff472fa6f6ba38fd03daf7a182b12fc60d651744e0418dcab8487bc1293370ac3d2a0a44752031b24656a1dc0a1ce495e4284643659b7dd3d9476314f553cd1a73b9a5d0a0d5cdb556f33d9f18d77f0630b7effb670b98fafa2090d554f96545f9084e3ac5fee0f872a7455d0ce3c1dd821b67f062a9d3d5f4a0ef4b20076fc7afaebe41c0d093aec1f494292eec57e989b277e5b526d49de94a756d62375650aae2e1f9a90939c62ee0dda62ccbccf49ce44376bbfd130ed35", 0xfd}, {&(0x7f000066e000)="dbe2731091bcdb53fcb459ad09ee7976de24df8f08f9b81085661453703779718b5f7fe0dc921d0e954a98c0764c296ac9a845e0dee6cc3b231bdc24bfc8e1fe4160950eba0a5f0ed1377035f09b08f1c5669cbe509362e9d6eb3875c546a3dc28c3a375bec1b0f29b62b2639e0a92f3def3fd92dcbe81242ff91b6da24dddb8e4480396892fd4c0185faf80d1021453ff353873a41a9d9f34b4a77ca6e2f591c77154", 0xa3}, {&(0x7f0000eb4000)="41a789f672d5ed14575290f6f64587235cc79deba14154b788bed600a8f3a909d271b210f8be6191c7cbcc6a01def344fdfa454f167496d4449febe11ebe0bcf156c1ef4ac9c2b32458fb30814468e48de9e9bc6daa9f61c", 0x58}], 0x3, &(0x7f0000172000)=[{0x1010, 0x10f, 0x2, "65cfd54fe83d5ff94dc8c9b57ee9843fbba5df1aeb91953c569ffaea56b65f9155248728220194da41f0ce063f88347cf7d5b105c57bf7b542fd5ad96c8c8a1d1b52d486b8ad6d6b84233099a915da561d16d3f9eeeea726a10045edffdffe59365b5a2c5c41789f36ed9973df82fefb0262cd038618e71bc548dcd0c7fd3dbd46d377090accab8d277373487130a7de47a96edce42fc0a8b8df566718e6a2f865f3c7ddc8639c8aaae0b1e7f7f6d848fa60ab88c7e55e8d708ab3f90d220c5960d0e69d48a20166359009cc6128d6785eb949b430d437dc8e65f9dfc29ea152d74dba721e7a734343f18ac3c9735f670355157253f46b9517c7cf3daaa92c8d91d6ed779c0b9df9953e2a03113a88cff3a0bcf4992acf4ebfcc6065dcfc44d6ac058474c14167b8b2bcaaa9197651f024f1867636fc646096103a9c4a77f4f44e28c2e6a93ec25fe6e5d83d4c7c1e47f86f4f88e065b65be5fb015478381dd30f2d9c3a0e415fdf9f128ba56ddfbc917644f0a5c41db7c4c9a1b742b8bf61e4c73e86e8e0abd8affdc3893c65d6b8471c55a4ae793fbd47951939dae430803a41307f591559f4064b94081a0a8ea464a9578e2a8f2b01a71c9dbfa5e48ad397ca1e90a5a43587ab6b286ffbfca4ab3c2e20e9454dc873037b898f3e04d5ccf115fdedfe5cad7a1ad21f2c6b34b7ebb76e308e61fb14ed49315848dc54c069a5ef26b2dc103e95ade9ce4f8d14ab511f379ba85e2aad045c5b2606f6cf7c3b66c3389db73ae84043e49311ff51be1a02e17b1bf192b6ee04e3e5013a5c218a987e6dcf2512fcd60e57b30464c2ae6b8c827bb6d9d1a25e040ff00b2ea80f668316cebf37c5405f0424afb07f3efd77d979ee4787cba37eb67f9afce25bcd7111b6fe6c13a758f7f9b598a7f6caed3c59ba79444c63d7611bac579df5c8f0f3d39af1dc5d5be7ab426ac6b2e2efbf879d51152a6e48bc7f9606918207f909e7dbbf0383eb6b08cb3794b6109e27e285d6fa972217be8b504cf447f836f93a62f210a52af312f8569a77efd1016eacb4149a83dad22d1c5533fa28864551d6b050aa360d57c4989f972ae34040d32d0964059aaf79c26ecc06389dc85daf2105b1f01d39f0012b133aec64f3681fa6f4991f0decce8b71c4cea9de72d39ef210f2509ced396c05f932f56ea8cbaebc898eee93e022197e91eed526f1af0eee3cfd6370f353e56f9bf4423af31c6830df5a24d3c25862958f1ed084148d7c82d324dffe6308c9335c30722a441558acbd95023c75a30f0bb88e09ef35f26dbee28a817d5fed8b263747008595ea72e637ec43ea7abcc31243903d6c1a2b1b0d9396caed4f38afa79c1fa89236efe7b59a5d1fb0a8480923cd95d94cf9c95e89c74d15818002c3963a4d107e845e0cb1827f47b553a432cf40ecb4b0cab631eee6f5441addef2b2222a1c8024390d3f53b59a839609d82c63fbb35ea8824caa7c4d482963f53ae491a372ea798c5015a5d33d2d96386b9742f8fc37ca3f83dec9709970d0b497b068b96edd649a78b89aa7e23dffee94e594e2b8a3d4afc8b176178b5a070f061af2b7bbc25b3055a5f0e73980bce1d00eacbf71b4930c398a397a292c18afd40a3d973b1e184654b9685b5a0faf0f5beb7373f157364a137e3443c03d262879fe61a10410e53f7a1d84b64053756318fe92a47370cb33df9d86a4eba022140fd22166740edec582892e60d8512751adc2d5d1cbaa57492bc58c7505b8cc34fa0001c822d8142c4b79ae281c659cde4da24b1e7a5ad734c4f00851d702412af8bdd11abb26692ba76b88c380a6f8825acabb829324a0a3d99bad1fb5d2c25cba54efed4724589b007507ebf6ca4adfedfff960e7f27dd9200634d6ed8fdcc767f100fa77e957d11a4f200328c71df3865d13a86bf741b9a7e3bda55b43136c381edf1790fca7d1e29957b6712651a325f2eb56318858262275f11fe91d1fcd0491424b75b0eb150698c3db6af7f8f166f0572825224b523585c89d6518d345cfbb8ea2caebd3f135dc07132d0e3f57c0531d4ef3633bd61e6ddd5afd4f98a3ca12bde6d812b291b6ed8338e217d5a84d58c41e6ec557b68dbfbb6c50ce81b3f4d385ecf46febbcc3f7aeeca8dd02fd35b598e25716273b082992464fe2647580a116cb26c3a97e63387ecc807eae0d5c1ce6e4e18cd92aec7094f562659a738cc49ca60bb6939f1f33418f1ab05742eef72e3d7206b0fe73ace9d9340eca770941a4da68c0386ea4382e395232ca1ff45c0fcc357484baf008be8454c69610b5b887202880205ef90b994838e15cfb989c0a9266397ef48c6ed69fefd52b9c97c7a65e40ab14a84bd8493e4d8f558b64579a3e734fe07ef3c0196d4c4bbc80b1dfb9c60589ccb40ad03dbadb54f7782b64ae47569f9b9ca2abf3827d341d4572b30ad9114ea3918c1f4516ebba3168b266c22f9b7b2eec2be057bc550ac7b9b27ae00f2c871bbc7ff60b057c0fcdedaf784787343ab9ff2b084b7f19cf058cfb9756ad034c55a1589cefe2a9b5558d7423558a4bf207891bf9ed6a7ca292adef7d736ae3c0426ba40ae16d4689c7384652a65840630fcf649ba85747d6f55152e0bf51059622fc6821d5064ed0ed081954601f2540050d5eac9a053b935db2ddc576baf2aea02c1678cc3f3b4d58f0eb613b1a54c93409faa62b4f1afb4e1750787941c6cec47f69844add5a3ab5198c81288e40be8444be80bf36be2a56bd8c75520227cb110abe13d332346a3f42edd57815bd47437497c885890deec12f870a7c3f33fe717e25fa6274b8ced743385e194c616974d6078d3f3e240b773609f4a247e086802584ffcbc2b45e0c2eaa0993053177d941323893702e4f459d992e1b0263182befdb321b787d4926c5e018d65a003f22740f25e7dd3242692f90321a3dacfe83be769f22df82524adff6a38be2203b76c01b6f77423bd83dbc1bdc3faab83c1fc3b7138841344ad42b16fbd316672cc13b25fa6814f8b3467da9301f96e2debe7845dd791a73e9a0a9dfb4aa6837cbc98cacbb7e3e94c5c0d5b5781746d0f868533d3c25360f724e2d0e7ea5eb5887bd382c536d7eec14a1be5b315b915e891d288cecba0169784a4b198c318786bc8601137ca827f8da8ae4fb6505a0a5ed963c803100be7a5ada69bb91ace268b2f2fded0c9a5259e46b7f0adeac59e78611b0be50bb8cbd7986eb9d94332587c0f573f59e5d181e60eebdfe53df989efe3be4116fe36ec515c77102377561a20ea4de9bdec498ac8a9e9988fae1e7a8b3d0be93544cd38763bb1b866251a5a8dbeabfaede4b87da4a0c0d5ae6b2b8693be7e6c62674e341f9b5dd24536373e5722b3acbf282921039d7dfc27d98d662ccde29c815dd11da4e40ba910eca5b88fa67ca622337f5cd16878027431f9e287a277d978e28b4c85c0e07386bd067a9d0b7dcfee5936d1d04d3a11dcddfbb717b841559f159bc5fd91ccb02cb5080d163867bd516e1f594b73b18108037243636e8ac89dfabd36551cb6656368f5a69d9e780d2ab802bb9b8622ad224e373a12d326c8227e9e48d0efdf7f0336cfd186bcac0416d8779a704270350efa65af0a8dbb397c8d081724da3cc8366798cefd262d3ac96f8f15d96455e8b8e66a960137cdad90e437d6783cdc6e7923743512d89d83bc28260df0ea9b51038aa423c28f17faf6aa10fd5d668a616edfbe430428d2a2f5996a33287974f0b3f55d68c0151f67ce76affeb46ffb7e898c7a9158530dd5fbff30f54337dd0ecab3c675a1ca8de698502ba4817f68e33b3354fc9af4a42ed1ec0548cf61829d378069893b9a47ee07736c7b7f12fea9cf0d436e842a6aa0fc206526f9646c5fb2262335f9fdbcc495e3165df35610adccaf86ef00fb38558081e40a9262780ee7d7d5052d22d24ccf7d18fadf7e570a988103bfb5e655ebfffa6c6093ecd59295bd4cb86259447acfb6ee0e1f15f409f92772d0786b9ef203fe0d96bfd329f2189071f7a760ef304bd55634c27f000e02860cf5c531169d76350ad61c2f2d8a593fc1ed962ee3838f75f4fea65fa3759436e321331acf71e0c72bf60c4946709e6868ad26c26ae8a12b86bc8f9f89976809107d530effdd53180178a79d078a2da80705cf633c4319c838a730f5ef4434e50d53344cc57bcb51cdcf444154164e67b9e8ba19610696202124e42d33c7d46ebfc0acef47071631946f18fc0f25825c73703b66c6ecfece3d090b050e7c4b57dfb2db76a3dff81440e7c66b5985dfc5920e9178d5b1370bcd6aca73d6fecbed527311aaf1c0a5064fe8471a8f33e793391b77f63cf4019abf6af25f9d02479dca62f0ca1696e9ee0f3a81d096fc0c6c6ad53f02343cedc03562b276388d5a0e370e96206e19e84d90f1bbe52c225d39c01fc9ebfa391c157edac6fbae31c1291048a94332f95b061065401795b26ff9e6edaeef544bfee9df4fd048127dd7373666d453fc345730405f20e488427ed2a011b520bb8fc18bee79b5840c81ada2dd19de6ce7f96c3fd62892cc46f3ced909d0e34b47bc25db4f2b36cfa2c3f60caabe108cbb56a000534a9e581ee7bd31d780d6cc56167ec62f49df147b98b2fdeeccc4483bc2eb2fc48141e814d93012cd817d695d3c2f23b9c1672e4e95b833c12c0335a6a69e3c549ccb4c100d7f35778e0e5998f9331181cefb46c35e412b01be46e297391466c1b9ce5fbf4f286bd3c45fac8eab7aff4c0291927e63ab935b6bd17758b4bdd2cac7c52a841f6430146531696c3d970148706f12f0c5a460f976061ed7f933897611c79b8e44ee0de173a1eebe02af4a152f7a34208ed9e2ca5e584ce1574a0b7f9f23fa3a2b0d482edec6c3844709ad6403de20f38bc88bc86543cbbe32c5cb610ba8e30f66c06f8f7448c1f0766f603d7c883641da29b1fa3cebb3bc278350d15b757c40412c5ebad1807b755d8226bce3ea28f086f1cdae2a8ed5a9aa2e7f3ed7e7e69ea841ba02bd30018c548a23d7f576302c49bf3e6601ce42e4288dfdf3fe03bb459dfd721c7c46643c3dc7bf6138caff14e57c3ef5247e5560af2ac8819aca0a6b46bbb59c3c250dce96085270ccbfdddc0ba7071daf3b038c87c0bae7126eeb175d283ea2ede3a7298fbf8a3c953a9b29500db7a3260f23291144e6e98f8aff46d858de7c706d4312d993f3f36871649ed5e1b96fd23db885a7f0bf85970011312dfa44b809608c89cf18806d31155c87953a4557c5fe35dd6c959a9f20e90b4351c589ab91513d04da4843a628075714d090d0b839b87abb4b7d80c67e941de8b1d4109fa92b3ffebb1063a0a2a387f9177863c48f247dafcd8dc386ddc8726a6e5991df644a4a646b351df9f35bf3674c4a1fd4e02a17fbf894604c69c1bd24fb22c80e494d15fe0904dd2929cea67f3ba9a7302d0902bbdd3e1a090091e8e6d11653becbf0d56cde75591160ae45a31e43aa81608560cfbac6ccd3b1b5d3b60c1d74889b18983fbbaa7a7c4e41bd80d091ea6aa5228a4dc7cc142708e24ba8a8858445b27fa81c5d23c5b5e5d64e5d8704599cc252057c273f55adc1c730b4c640b47dcf7ecc6400a63dc116297e74ddc056af8981b84046a1e348335c9a7becc54eab882e6b72746edd0b0e32d9d0e8b2be00b1b029363863be546ec3959c03dd71445928767c6b9692af41b3b4acc1939e6ef7f60d9649c69002c39ddeb30760a6418b52a8c4b97bf2c764febcfd33f921f7222f097d29379729a1"}, {0xa0, 0x101, 0x7fff, "6a59d2ddd4a003984ead1d04fafc0a3d825ad5389ea60ee7ab9a6479b1a87e5f3d04fbfef328816ed79fc57e4da1997f9b5db331f9474deee4d84667b16111b559dd9dc14ae2e21d754a837656defdc0cdb89e78800a875a7d42ae66b00a5fc715872e4cf107f63024e77ba8c308df574726a56080f04194193ca096c1cf219b857ab0226d9ea33b5cce5e63b9d2"}, {0xb0, 0x10d, 0xae, "1b62439230aa4800d0dd7883ce85eb89a46974baac587cb75b576d950d78b228c62e2f6df4c202ca2c5627c6d3626a7dbc4d438212ad1e6d2a1b29af53e5e2a7054ca8cf837fdcafca34c2181f2573ed4db86b40c030155a531a12b06f420dc2bca4b3496034e3c56dddbf30f9eb3beaf874134c965d660bea1f5071f189b46c5e4cc63039fbc54ee6fa78db26a0265f0e5ff39d2e584cec018ad8c766"}], 0x1160, 0x4004014}, 0x1) 2018/02/01 04:11:23 executing program 2: openat$ion(0xffffffffffffff9c, &(0x7f0000801000-0x9)='/dev/ion\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000233000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) write$tun(0xffffffffffffffff, &(0x7f0000577000)=@pi={0x0, 0x0, @eth={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x0}, [], {@canfd={0xd, {{0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0, "feb442a1f43ead325d71fed774c8f6028c2a6b79a4e418aa3c5f391769659fef9f596cdade428c389e511eaad39d2ee4334dee9516a31d00510baaf06efc0980"}}}}}, 0x5a) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004ee000-0x76)='\x00', 0x1, 0x0, 0x0}], &(0x7f000000b000-0x30)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)=""}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00005da000)={0x0, 0x0, &(0x7f00000d8000)=[], 0x48, 0x0, &(0x7f000044c000-0x83)="a410778b7a640ab0384c4ead541b6ee57c5645909ef688d8ac3e5ecfc7039f5f8ba53f127b7f01947cd3689eaf6c090277915bab2a0c450988cb85688e2bcc101a80664d3081fcc0"}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000c5a000)={0x0, 0x0, 0x0, 0x0}) mmap(&(0x7f0000000000/0x13000)=nil, 0x13000, 0x0, 0x32, 0xffffffffffffffff, 0x0) open_by_handle_at(r0, &(0x7f00001b2000)={0xbe, 0x7fff, "2421843ac5484919946fff3f0f2a8da6b26770661d7abe079b660958647d3ad1e8046072af57f38803841be53f90024515d52e764facdc4b686f19370df186d074fe775ea30083e9353ab2ac2faba93ee4d31d145bbde3fcec863395d0c7c68ceced98b5b0d8aa940e0a5ade9eba38a48ae924ba4afb3ae0f0514fd6e63051e89130a9b0fc77bb689193a3e66cd8e360fecbb111658493b85f6d3020754e48202c0454fa30c47606ba1220b3978ae55d81fad380256b"}, 0x400000) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000a95000-0x30)={0x14, 0x0, &(0x7f0000b8f000)=[@increfs_done={0x40106308, r3, 0x1}], 0x0, 0x0, &(0x7f00002e4000-0x70)=""}) 2018/02/01 04:11:23 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f0000590000-0x8)='./file0\x00', 0x14) write$selinux_create(r0, &(0x7f000074c000)=@access={'system_u:object_r:dpkg_exec_t:s0', 0x20, '/usr/sbin/cups-browsed', 0x20, 0x32, 0x30, 0x0}, 0x3b) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f00007cf000)='/dev/cuse\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_STATUS(r1, 0xc05c5340, &(0x7f0000b85000)={0x6, 0x100, 0x2, {0x0, 0x0}, 0x0, 0x4, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000801000-0x9)='/dev/ion\x00', 0x0, 0x0) r3 = syz_open_dev$binder(&(0x7f0000233000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r4 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0) r5 = dup2(r3, r4) write$tun(0xffffffffffffffff, &(0x7f0000577000)=@pi={0x0, 0x0, @eth={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x0}, [], {@canfd={0xd, {{0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0, "feb442a1f43ead325d71fed774c8f6028c2a6b79a4e418aa3c5f391769659fef9f596cdade428c389e511eaad39d2ee4334dee9516a31d00510baaf06efc0980"}}}}}, 0x5a) r6 = dup2(r4, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004ee000-0x76)='\x00', 0x1, 0x0, 0x0}], &(0x7f000000b000-0x30)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)=""}) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f00005da000)={0x0, 0x0, &(0x7f00000d8000)=[], 0x46, 0x0, &(0x7f000044c000-0x83)="a410778b7a640ab0384c4ead541b6ee57c5645909ef688d8ac3e5ecfc7039f5f8ba53f127b7f01947cd3689eaf6c090277915bab2a0c450988cb85688e2bcc101a80664d3081"}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000c5a000)={0x0, 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000a95000-0x30)={0x14, 0x0, &(0x7f0000b8f000)=[@increfs_done={0x40106308, r7, 0x1}], 0x0, 0x0, &(0x7f00002e4000-0x70)=""}) getsockopt$inet6_dccp_buf(r5, 0x21, 0xcf, &(0x7f0000e10000-0xcc)=""/204, &(0x7f000037d000-0x4)=0xcc) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000436000-0x30)={0x20, 0x0, &(0x7f0000136000)=[@dead_binder_done={0x40086310, 0x3}, @increfs_done={0x40106308, r7, 0x0}], 0x0, 0x0, &(0x7f0000888000-0xb)=""}) close(r2) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000002000-0x38)={0x0, 0x0, &(0x7f0000003000)=[], 0x0, &(0x7f0000002000)=[{0x10, 0x10e, 0x0, ""}], 0x10, 0x0}, 0x0) 2018/02/01 04:11:23 executing program 4: r0 = socket$nl_crypto(0x10, 0x3, 0x15) close(r0) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) modify_ldt$write(0x1, &(0x7f0000000000)={0x1e7, 0xffffffff, 0x1000, 0x100, 0xc408, 0x8000, 0x3fffffff80000000, 0x7ff, 0x8001, 0xe014}, 0x10) clock_getres(0x7, &(0x7f0000001000-0x10)={0x0, 0x0}) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) seccomp(0x1, 0x0, &(0x7f0000086000)={0x1, &(0x7f000070a000-0x8)=[{0x6, 0x9a, 0xfb, 0x407ffc0003}]}) shmctl$IPC_INFO(0x0, 0x3, &(0x7f0000564000)=""/4096) ioctl$KVM_CREATE_DEVICE(0xffffffffffffffff, 0xc00caee0, &(0x7f0000606000)={0x7, r0, 0x1}) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f00003e2000)={0x0, @multicast2=0x0, @dev={0x0, 0x0, 0xffffffffffffffff, 0x0}}, &(0x7f00004fd000-0x4)=0xc) bind$packet(r1, &(0x7f0000ded000)={0x11, 0xf5, r2, 0x1, 0x7fffffff, 0x6, @random="87bde33da564", [0x0, 0x0]}, 0x14) r3 = syz_open_dev$admmidi(&(0x7f000027b000)='/dev/admmidi#\x00', 0x0, 0x80) ioctl$KVM_S390_UCAS_MAP(r1, 0x4018ae50, &(0x7f0000eaf000)={0x3f, 0x7, 0xffffffffffffffff}) getsockopt$inet_sctp6_SCTP_STATUS(r3, 0x84, 0xe, &(0x7f0000b8a000-0xb8)={0x0, 0x5, 0x3, 0x28, 0x8e63, 0x1, 0x3, 0x2, {0x0, @in={{0x2, 0x1, @multicast2=0xe0000002, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x0, 0x81, 0x390, 0x76, 0x12eb0dd5}}, &(0x7f000093b000)=0xb8) getsockopt$inet_sctp6_SCTP_LOCAL_AUTH_CHUNKS(r1, 0x84, 0x1b, &(0x7f0000c5c000-0xff)={r4, 0xf7, "1ad3ac6dd9cae0d4c867bd481b8fd1f0e8518307545208467af8ee9f192a2b98ecc2a20c829d606b73e40c3eee5866bc688bc3675172af44548c3945a9e623a81010b62bbaa28c6a9b92752ab4283febb208bb685c9a1b7a432f24727d2ea57a1a0bd5a0d0065af8fffe8f82620ffa828b72bc52a3ebff5c4982dcc569aa91f1a89afde8ef24df0763ba147ed6e292eed0532252d2c50450e9c3a57c0cb08ee76d233ad1c4bc2a956d55b0eaed9ede6dd9ec45e810ac7f79afd4165eb018574cbeb3f20324ba6a800e08febbcc3b0aaf822691ea6c8be3ee034e51733935e1f7957aec79607bb1557a2c79e2a4bd64a93f29939802eae7"}, &(0x7f000047a000)=0xff) ioctl$TIOCLINUX3(r3, 0x541c, &(0x7f0000268000)=0x3) 2018/02/01 04:11:23 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$KVM_CREATE_DEVICE(0xffffffffffffff9c, 0xc00caee0, &(0x7f0000279000)={0x4, 0xffffffffffffff9c, 0x0}) ioctl$KVM_SET_BOOT_CPU_ID(r0, 0xae78, &(0x7f0000a59000-0x8)=0x1) capset(&(0x7f0000595000-0x8)={0x19980330, 0x0}, &(0x7f0000244000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = semget$private(0x0, 0x4, 0x24a659dcdbe66d69) semctl$GETZCNT(r1, 0x0, 0xf, &(0x7f0000d11000-0xe2)=""/226) r2 = socket$netlink(0x10, 0x3, 0x5) sendmsg$nl_route(r2, &(0x7f000001c000-0x38)={&(0x7f0000016000)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f000000b000)={&(0x7f000001d000)=@ipv6_newroute={0x1c, 0x18, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, {0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, []}, 0x1c}, 0x1, 0x0, 0x0, 0x0}, 0x0) fstat(r2, &(0x7f000059b000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) fstat(r2, &(0x7f00001a1000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) fstat(r2, &(0x7f00002cf000-0x44)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) fstat(r2, &(0x7f00004c6000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) getgroups(0x4, &(0x7f0000920000-0x10)=[r3, r4, r5, r6]) getsockopt$SO_TIMESTAMPING(r2, 0x1, 0x25, &(0x7f0000641000)=0x0, &(0x7f0000f79000)=0x4) ioctl$KVM_GET_DEBUGREGS(r0, 0x8080aea1, &(0x7f0000162000)={[0x0, 0x0, 0x0, 0x0], 0x0, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) ioctl$SNDRV_CTL_IOCTL_PVERSION(r2, 0x80045500, &(0x7f0000fe0000-0x78)=""/120) 2018/02/01 04:11:23 executing program 1: openat$ion(0xffffffffffffff9c, &(0x7f0000801000-0x9)='/dev/ion\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000233000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) write$tun(0xffffffffffffffff, &(0x7f0000577000)=@pi={0x0, 0x0, @eth={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x0}, [], {@canfd={0xd, {{0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0, "feb442a1f43ead325d71fed774c8f6028c2a6b79a4e418aa3c5f391769659fef9f596cdade428c389e511eaad39d2ee4334dee9516a31d00510baaf06efc0980"}}}}}, 0x5a) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004ee000-0x76)='\x00', 0x1, 0x0, 0x0}], &(0x7f000000b000-0x30)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)=""}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00005da000)={0x0, 0x0, &(0x7f00000d8000)=[], 0x48, 0x0, &(0x7f000044c000-0x83)="a410778b7a640ab0384c4ead541b6ee57c5645909ef688d8ac3e5ecfc7039f5f8ba53f127b7f01947cd3689eaf6c090277915bab2a0c450988cb85688e2bcc101a80664d3081fcc0"}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000c5a000)={0x0, 0x0, 0x0, 0x0}) mmap(&(0x7f0000000000/0x13000)=nil, 0x13000, 0x0, 0x32, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000a95000-0x30)={0x14, 0x0, &(0x7f0000b8f000)=[@increfs_done={0x40106308, r3, 0x1}], 0x0, 0x0, &(0x7f00002e4000-0x70)=""}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000436000-0x30)={0x20, 0x0, &(0x7f0000136000)=[@dead_binder_done={0x40086310, 0x3}, @increfs_done={0x40106308, 0x0, 0x0}], 0x0, 0x0, &(0x7f0000888000-0xb)=""}) 2018/02/01 04:11:23 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet_sctp(0x2, 0x1, 0x84) r1 = syz_open_dev$usbmon(&(0x7f0000e20000-0xd)='/dev/usbmon#\x00', 0x3ff, 0x0) fcntl$getown(r0, 0x9) ioctl$sock_bt(r1, 0x541b, &(0x7f0000286000)="8450912f1e8652ea023ad265f83d8c8c92b3d292db61dc404db259352853ca255d0940f05b8c1fc0ed32cd375f1c15ebc80d3d150853397ef50035ae0cad56fcf4e9d6f7acb4b350a6f274e459d4f2e79f060b9326475958b4b91f86fd1991d2a5cf401907c0f3bfb876b5cea809ffd88894dcf961e217ce3b96afdc2d3a6c63473f1bd1fd09f6ebfe0c91b0321120be8ee835806cd0c7c57b1e9f2f5b191412af0837db2998670a2f26abff9be97aa145b0dff1b2ef1e") sendto$inet(r0, &(0x7f0000022000-0x16)="01", 0x1, 0x0, &(0x7f0000031000-0x10)={0x2, 0xffffffffffffffff, @local={0xac, 0x14, 0xffffffffffffffff, 0xaa}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x10) shutdown(r0, 0x1) 2018/02/01 04:11:23 executing program 3: r0 = socket$vsock_stream(0x28, 0x1, 0x0) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000)='/dev/loop-control\x00', 0x8001, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r1 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000001000)='/selinux/avc/cache_stats\x00', 0x0, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_INFO(r1, 0xc08c5334, &(0x7f0000002000-0x8c)={0xbd7d, 0x1, 0x7fffffff, 'queue0\x00', 0xba, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) r2 = fcntl$dupfd(r0, 0x0, r0) r3 = ioctl$LOOP_CTL_GET_FREE(r2, 0x4c82) ioctl$LOOP_CTL_ADD(r2, 0x4c80, r3) recvfrom$ax25(r2, &(0x7f0000001000)=""/167, 0xa7, 0x0, &(0x7f0000002000-0x10)={0x3, {"37878f5a0ee84c"}, 0x0}, 0x10) ioctl$DMA_BUF_IOCTL_SYNC(r1, 0x40086200, &(0x7f0000002000-0x8)=0x4) [ 303.391391] binder: 15249:15256 transaction failed 29189/-3, size 40-8 line 2903 [ 303.408725] binder: 15249:15256 BC_INCREFS_DONE u0000000000000000 no match [ 303.417288] binder: BINDER_SET_CONTEXT_MGR already set [ 303.417298] binder: 15261:15266 ioctl 40046207 0 returned -16 [ 303.418603] binder_alloc: 15097: binder_alloc_buf, no vma [ 303.418626] binder: 15261:15266 transaction failed 29189/-3, size 40-8 line 2903 [ 303.425939] binder: BINDER_SET_CONTEXT_MGR already set [ 303.425948] binder: 15269:15271 ioctl 40046207 0 returned -16 [ 303.426461] binder_alloc: 15097: binder_alloc_buf, no vma 2018/02/01 04:11:23 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f0000590000-0x8)='./file0\x00', 0x14) write$selinux_create(r0, &(0x7f000074c000)=@access={'system_u:object_r:dpkg_exec_t:s0', 0x20, '/usr/sbin/cups-browsed', 0x20, 0x32, 0x30, 0x0}, 0x3b) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f00007cf000)='/dev/cuse\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_STATUS(r1, 0xc05c5340, &(0x7f0000b85000)={0x6, 0x100, 0x2, {0x0, 0x0}, 0x0, 0x4, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000801000-0x9)='/dev/ion\x00', 0x0, 0x0) r3 = syz_open_dev$binder(&(0x7f0000233000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r4 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0) r5 = dup2(r3, r4) write$tun(0xffffffffffffffff, &(0x7f0000577000)=@pi={0x0, 0x0, @eth={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x0}, [], {@canfd={0xd, {{0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0, "feb442a1f43ead325d71fed774c8f6028c2a6b79a4e418aa3c5f391769659fef9f596cdade428c389e511eaad39d2ee4334dee9516a31d00510baaf06efc0980"}}}}}, 0x5a) r6 = dup2(r4, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004ee000-0x76)='\x00', 0x1, 0x0, 0x0}], &(0x7f000000b000-0x30)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)=""}) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f00005da000)={0x0, 0x0, &(0x7f00000d8000)=[], 0x46, 0x0, &(0x7f000044c000-0x83)="a410778b7a640ab0384c4ead541b6ee57c5645909ef688d8ac3e5ecfc7039f5f8ba53f127b7f01947cd3689eaf6c090277915bab2a0c450988cb85688e2bcc101a80664d3081"}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000c5a000)={0x0, 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000a95000-0x30)={0x14, 0x0, &(0x7f0000b8f000)=[@increfs_done={0x40106308, r7, 0x1}], 0x0, 0x0, &(0x7f00002e4000-0x70)=""}) getsockopt$inet6_dccp_buf(r5, 0x21, 0xcf, &(0x7f0000e10000-0xcc)=""/204, &(0x7f000037d000-0x4)=0xcc) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000436000-0x30)={0x20, 0x0, &(0x7f0000136000)=[@dead_binder_done={0x40086310, 0x3}, @increfs_done={0x40106308, r7, 0x0}], 0x0, 0x0, &(0x7f0000888000-0xb)=""}) close(r2) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000002000-0x38)={0x0, 0x0, &(0x7f0000003000)=[], 0x0, &(0x7f0000002000)=[{0x10, 0x10e, 0x0, ""}], 0x10, 0x0}, 0x0) 2018/02/01 04:11:23 executing program 1 (fault-call:14 fault-nth:0): openat$ion(0xffffffffffffff9c, &(0x7f0000801000-0x9)='/dev/ion\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000233000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) write$tun(0xffffffffffffffff, &(0x7f0000577000)=@pi={0x0, 0x0, @eth={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x0}, [], {@canfd={0xd, {{0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0, "feb442a1f43ead325d71fed774c8f6028c2a6b79a4e418aa3c5f391769659fef9f596cdade428c389e511eaad39d2ee4334dee9516a31d00510baaf06efc0980"}}}}}, 0x5a) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004ee000-0x76)='\x00', 0x1, 0x0, 0x0}], &(0x7f000000b000-0x30)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)=""}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00005da000)={0x0, 0x0, &(0x7f00000d8000)=[], 0x48, 0x0, &(0x7f000044c000-0x83)="a410778b7a640ab0384c4ead541b6ee57c5645909ef688d8ac3e5ecfc7039f5f8ba53f127b7f01947cd3689eaf6c090277915bab2a0c450988cb85688e2bcc101a80664d3081fcc0"}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000c5a000)={0x0, 0x0, 0x0, 0x0}) mmap(&(0x7f0000000000/0x13000)=nil, 0x13000, 0x0, 0x32, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000a95000-0x30)={0x14, 0x0, &(0x7f0000b8f000)=[@increfs_done={0x40106308, r3, 0x1}], 0x0, 0x0, &(0x7f00002e4000-0x70)=""}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000436000-0x30)={0x20, 0x0, &(0x7f0000136000)=[@dead_binder_done={0x40086310, 0x3}, @increfs_done={0x40106308, r3, 0x0}], 0x0, 0x0, &(0x7f0000888000-0xb)=""}) 2018/02/01 04:11:23 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x1, 0x8010000400000084) r1 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000cbf000-0x16)='/selinux/checkreqprot\x00', 0x20000, 0x0) r2 = syz_open_dev$audion(&(0x7f0000ada000-0xc)='/dev/audio#\x00', 0x200, 0x80000) ioctl$PIO_UNISCRNMAP(r2, 0x4b6a, &(0x7f0000113000-0xda)="b4e7966bf9b049c493fab0f5fbacd8b26365287716083645fdfded2e121594ed29e47d014057b2182a279e3a79ebc1607aceaa79839fafdaf04d40c18f4f58474515a593b4a931c5f9dba42ab056928bf3f2ca1e8eeed30fea96ed6f301eb9effdf4479d064252a2c94193ff66f123c9a6d72901023bcce7841581d8d59fce6838a7d260e957a95607fdb4c767bf9e4ee78cf06d4aa358983c22b543b79d971f23f76725590825fe0ade5df97d52eb9ca7a5c5e45b41b81bddebb2ab3a8999307ed5955750dcff63c2de34addb5bc585b90ee3d10e87d81ba1e9") r3 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f000010c000)='/dev/vga_arbiter\x00', 0x20400, 0x0) mmap(&(0x7f0000a5d000/0x1000)=nil, 0x1000, 0x100000a, 0x10010, r1, 0x0) bind$inet6(r0, &(0x7f00001c1000)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x0}, 0x1c) setsockopt$inet_sctp6_SCTP_MAXSEG(r0, 0x84, 0xd, &(0x7f0000dad000-0x8)=@assoc_value={0x0, 0x200}, 0x8) sendto$inet6(r0, &(0x7f00009f1000)='G', 0x1, 0x0, &(0x7f0000109000-0x1c)={0xa, 0x0, 0x0, @loopback={0x0, 0x1}, 0x0}, 0x1c) ioctl$sock_netdev_private(r0, 0x89f4, &(0x7f000056e000-0xdc)="41db29fdc6a2a803e126abc34360f52f7f9756fb6e6062800b151d287de66c0e9ed7f417ae19f400bf8be5c778b31e163f14a265e7931c6a42493d0d0d34dcf55f3d66176bc1687af59b15e1bf1e5aec482f65e18d30c9441e4805a09a5fdbfea8b29b2e1328e456ce5dd6c8a61b016352d1a704061f9907394971ed32c193eaee206bb381de3944eb61b782c0baf4606c057bea9431daaa265f24ffa262bab7089c42027939e2eb55c767f1a2eaf31c25856049a8c43dff1529553fe2043d227e71cf451ce09cbf9bf78f01eb9590d63ae0baa6d30d7b082a7deac0") setsockopt$inet_sctp6_SCTP_PARTIAL_DELIVERY_POINT(r0, 0x84, 0x13, &(0x7f0000d24000-0x4)=0x104, 0x4) writev(r0, &(0x7f00007f2000)=[{&(0x7f000036c000-0x1000)="b6b23ebe2094b6c296b7f43c2ff9cec9a414ac8ab00820fbde9a0f4a1bd2773a23ca881cb2b8f6f7676ec3e23411c9a7b90c0d98413505ae48a6f9680b3b1c7d9d2083981adb57cc49d7c44eb888269d5ddad8a8ece4937a8c1bd5f6d54eb2fee4344a60a71f21a02b71241caa5bfb30ef20735987815557dd0712275e1cab0562f6e71d00f07d832fff291844ad8c73a6b27652f46020e42eebd5fd185751187d8455017d6e42c6492f282d3fcea50ef7e26862684165a175a262d5fdb1562a9dd53028ed11564d449b40c3dc6e1500aff5eb7c7ac29b27bcac0249c746425160e164ce64e5180f5b19b180bfa5a14ff6d6bac621a1723ffe9dbd05f91bed6ffd9ba2ca0ea7f3eca738786c6cf9be08976ab48f5ce579d5053ef537ba15f9ca286ef7299567bf2b50512cba39ca22e4eafa46593dfb19b29e524a5e0b527f23c3fd666357e9b397f2e720146853c8a4e590b620fd4f0c83a6a0d626fbc2d018596b5bd8b2b9496d3a83f8760b1fb0a6ec9de29b146334717e8cab34996e8474bbde59447f2cc876096f80b10134ed5d69027a9cdd109de0d161003880d10536725ab38afdff82208b8ca05f7661bc482b841d815c35660d7f7b036d0426f3cbfcd1448782af41483936f20b09e239d53be9df805d1a4dced5167eb9b8c8c681451329adcea047a3a00461916692c523647ed2b81b39080417072cf26db77335331fd9d49b1bea2ba448e3e7822109d5a115c5da661c65193ae60923e37b8751d7f6eb2511fc9b55963fca553c0c6d065240b94c889af1781a8671ce4ec91744820d8c3905b2eafb38d909b45175801885e1a1059a9b3db85a95f2172947697e56244fd7b4b412a33b9adc061fca8c742d05f50ce0d2b4280749ce13488259d37074ba94540a5b9cdf426fdf4563163e81c9769b7a84db101c03d88cec1eb18b7ded9b957734dde7b896b0b9c1a76e63104a02a06e917a0e3b608276ad2860a17c76e5c5a07dd6917fa497adc8ff56e2ec6f2bcc09d8061f504c5d5128b4e89bcb2207df70db9d7cceff2fc266443b6d34bb651d0def84768f750279e8b8ab42a8ba7f4f265e0051333f346bc113c56b179b81421601bd60cd071ee198d84ca6abd13eb3ecbc6aaab47aaae592f97c3747c37266e8ad2358029989919b7f5dcee8b60e1d32a0a94d91cc073174ef180d1b3cd4aedb77f1e898f6df02cf3fe57db328abb0ac8d88e5f0d3015f10e74f00e90ab3acbd2e8917e130d2961b1895b5e3252e8a74a0fe0579330407de6a6644cdb7cef78f6ebdf9ef2aa07b32c587d93be72cce852d1ccdf83d1740e0b5c2971b340d98e584b883878ebcac7c91c0c7ce6c23b459b8feb49133d78e965ece4c3f5e11f929d5ef541e2ad8311c4c7412c045b4abf9d14e0f8fd1fd5f851511519e45bee4f00ebb6fddcf38b0936c7aaec7", 0x401}], 0x1) ioctl$EVIOCSABS2F(r1, 0x401845ef, &(0x7f000086b000-0x18)={0x7f0, 0x100000001, 0x8, 0x0, 0xfffffffffffffffc, 0xffff}) r4 = openat$selinux_status(0xffffffffffffff9c, &(0x7f000057e000)='/selinux/status\x00', 0x0, 0x0) getsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffff9c, 0x84, 0x6f, &(0x7f0000408000-0x10)={0x0, 0x7c, &(0x7f0000d2f000-0x7c)=[@in={0x2, 0x3, @broadcast=0xffffffff, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, @in={0x2, 0x3, @rand_addr=0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, @in={0x2, 0x1, @broadcast=0xffffffff, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, @in={0x2, 0x2, @multicast2=0xe0000002, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, @in6={0xa, 0x2, 0x9, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x1}, 0xfffffffffffffffa}, @in={0x2, 0x2, @empty=0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, @in={0x2, 0x2, @loopback=0x7f000001, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}]}, &(0x7f0000eee000-0x4)=0x10) ioctl$TCFLSH(r3, 0x540b, 0x400) getsockopt$inet_sctp_SCTP_PR_SUPPORTED(0xffffffffffffffff, 0x84, 0x71, &(0x7f0000e5f000)={r5, 0x62}, &(0x7f00000fa000-0x4)=0xffffffffffffff3b) ioctl$TCSETAF(r4, 0x5408, &(0x7f0000e19000-0x14)={0x8, 0x8001, 0xcc6, 0xffffffff, 0x7, 0x3e, 0x800, 0x2, 0x100000000, 0x7fffffff}) 2018/02/01 04:11:24 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet_sctp(0x2, 0x1, 0x84) r1 = syz_open_dev$usbmon(&(0x7f0000e20000-0xd)='/dev/usbmon#\x00', 0x3ff, 0x0) fcntl$getown(r0, 0x9) ioctl$sock_bt(r1, 0x541b, &(0x7f0000286000)="8450912f1e8652ea023ad265f83d8c8c92b3d292db61dc404db259352853ca255d0940f05b8c1fc0ed32cd375f1c15ebc80d3d150853397ef50035ae0cad56fcf4e9d6f7acb4b350a6f274e459d4f2e79f060b9326475958b4b91f86fd1991d2a5cf401907c0f3bfb876b5cea809ffd88894dcf961e217ce3b96afdc2d3a6c63473f1bd1fd09f6ebfe0c91b0321120be8ee835806cd0c7c57b1e9f2f5b191412af0837db2998670a2f26abff9be97aa145b0dff1b2ef1e") shutdown(r0, 0x1) [ 303.426484] binder: 15269:15271 transaction failed 29189/-3, size 40-8 line 2903 [ 303.432916] binder: 15261:15266 BC_INCREFS_DONE u0000000000000000 no match 2018/02/01 04:11:24 executing program 2: openat$ion(0xffffffffffffff9c, &(0x7f0000801000-0x9)='/dev/ion\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000233000-0xd)='/dev/binder#\x00', 0x0, 0xfffffffffffffffe) r1 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) write$tun(0xffffffffffffffff, &(0x7f0000577000)=@pi={0x0, 0x0, @eth={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x0}, [], {@canfd={0xd, {{0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0, "feb442a1f43ead325d71fed774c8f6028c2a6b79a4e418aa3c5f391769659fef9f596cdade428c389e511eaad39d2ee4334dee9516a31d00510baaf06efc0980"}}}}}, 0x5a) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004ee000-0x76)='\x00', 0x1, 0x0, 0x0}], &(0x7f000000b000-0x30)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)=""}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00005da000)={0x0, 0x0, &(0x7f00000d8000)=[], 0x48, 0x0, &(0x7f000044c000-0x83)="a410778b7a640ab0384c4ead541b6ee57c5645909ef688d8ac3e5ecfc7039f5f8ba53f127b7f01947cd3689eaf6c090277915bab2a0c450988cb85688e2bcc101a80664d3081fcc0"}) sysfs$2(0x2, 0x7f, &(0x7f0000606000-0x74)=""/213) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000c5a000)={0x0, 0x0, 0x0, 0x0}) mmap(&(0x7f0000000000/0x13000)=nil, 0x13000, 0x0, 0x32, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000a95000-0x30)={0x14, 0x0, &(0x7f0000b8f000)=[@increfs_done={0x40106308, r3, 0x1}], 0x0, 0x0, &(0x7f00002e4000-0x70)=""}) 2018/02/01 04:11:24 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f0000590000-0x8)='./file0\x00', 0x14) write$selinux_create(r0, &(0x7f000074c000)=@access={'system_u:object_r:dpkg_exec_t:s0', 0x20, '/usr/sbin/cups-browsed', 0x20, 0x32, 0x30, 0x0}, 0x3b) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f00007cf000)='/dev/cuse\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_STATUS(r1, 0xc05c5340, &(0x7f0000b85000)={0x6, 0x100, 0x2, {0x0, 0x0}, 0x0, 0x4, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000801000-0x9)='/dev/ion\x00', 0x0, 0x0) r3 = syz_open_dev$binder(&(0x7f0000233000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r4 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0) r5 = dup2(r3, r4) write$tun(0xffffffffffffffff, &(0x7f0000577000)=@pi={0x0, 0x0, @eth={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x0}, [], {@canfd={0xd, {{0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0, "feb442a1f43ead325d71fed774c8f6028c2a6b79a4e418aa3c5f391769659fef9f596cdade428c389e511eaad39d2ee4334dee9516a31d00510baaf06efc0980"}}}}}, 0x5a) r6 = dup2(r4, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004ee000-0x76)='\x00', 0x1, 0x0, 0x0}], &(0x7f000000b000-0x30)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)=""}) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f00005da000)={0x0, 0x0, &(0x7f00000d8000)=[], 0x46, 0x0, &(0x7f000044c000-0x83)="a410778b7a640ab0384c4ead541b6ee57c5645909ef688d8ac3e5ecfc7039f5f8ba53f127b7f01947cd3689eaf6c090277915bab2a0c450988cb85688e2bcc101a80664d3081"}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000c5a000)={0x0, 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000a95000-0x30)={0x14, 0x0, &(0x7f0000b8f000)=[@increfs_done={0x40106308, r7, 0x1}], 0x0, 0x0, &(0x7f00002e4000-0x70)=""}) getsockopt$inet6_dccp_buf(r5, 0x21, 0xcf, &(0x7f0000e10000-0xcc)=""/204, &(0x7f000037d000-0x4)=0xcc) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000436000-0x30)={0x20, 0x0, &(0x7f0000136000)=[@dead_binder_done={0x40086310, 0x3}, @increfs_done={0x40106308, r7, 0x0}], 0x0, 0x0, &(0x7f0000888000-0xb)=""}) close(r2) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000002000-0x38)={0x0, 0x0, &(0x7f0000003000)=[], 0x0, &(0x7f0000002000)=[{0x10, 0x10e, 0x0, ""}], 0x10, 0x0}, 0x0) 2018/02/01 04:11:24 executing program 1: openat$ion(0xffffffffffffff9c, &(0x7f0000801000-0x9)='/dev/ion\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000233000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) write$tun(0xffffffffffffffff, &(0x7f0000577000)=@pi={0x0, 0x0, @eth={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x0}, [], {@canfd={0xd, {{0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0, "feb442a1f43ead325d71fed774c8f6028c2a6b79a4e418aa3c5f391769659fef9f596cdade428c389e511eaad39d2ee4334dee9516a31d00510baaf06efc0980"}}}}}, 0x5a) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004ee000-0x76)='\x00', 0x1, 0x0, 0x0}], &(0x7f000000b000-0x30)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)=""}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00005da000)={0x0, 0x0, &(0x7f00000d8000)=[], 0x48, 0x0, &(0x7f000044c000-0x83)="a410778b7a640ab0384c4ead541b6ee57c5645909ef688d8ac3e5ecfc7039f5f8ba53f127b7f01947cd3689eaf6c090277915bab2a0c450988cb85688e2bcc101a80664d3081fcc0"}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000c5a000)={0x0, 0x0, 0x0, 0x0}) mmap(&(0x7f0000000000/0x13000)=nil, 0x13000, 0x0, 0x32, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000a95000-0x30)={0x14, 0x0, &(0x7f0000b8f000)=[@increfs_done={0x40106308, r3, 0x1}], 0x0, 0x0, &(0x7f00002e4000-0x70)=""}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000436000-0x30)={0x20, 0x0, &(0x7f0000136000)=[@dead_binder_done={0x40086310, 0x3}, @increfs_done={0x40106308, r3, 0x0}], 0x0, 0x0, &(0x7f0000888000-0xb)=""}) 2018/02/01 04:11:24 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$audio(0xffffffffffffff9c, &(0x7f00005d4000)='/dev/audio\x00', 0x200000, 0x0) ioctl$KVM_GET_TSC_KHZ(r0, 0xaea3) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$VHOST_RESET_OWNER(r0, 0xaf02, 0x0) seccomp(0x1, 0x0, &(0x7f000089b000-0x10)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x407ffc0003}]}) shmctl$IPC_INFO(0x0, 0x3, &(0x7f0000564000)=""/4096) [ 303.433029] binder: 15261:15266 BC_DEAD_BINDER_DONE 0000000000000003 not found [ 303.433038] binder: 15261:15266 BC_INCREFS_DONE u0000000000000000 no match [ 303.457563] binder: BINDER_SET_CONTEXT_MGR already set [ 303.457572] binder: 15276:15277 ioctl 40046207 0 returned -16 [ 303.457907] binder_alloc: 15097: binder_alloc_buf, no vma [ 303.457931] binder: 15276:15277 transaction failed 29189/-3, size 40-8 line 2903 [ 303.487639] binder: BINDER_SET_CONTEXT_MGR already set [ 303.487651] binder: 15280:15284 ioctl 40046207 0 returned -16 [ 303.488651] binder_alloc: 15097: binder_alloc_buf, no vma [ 303.488672] binder: 15280:15284 transaction failed 29189/-3, size 40-8 line 2903 [ 303.490520] binder: 15280:15284 BC_INCREFS_DONE u0000000000000000 no match [ 303.490610] binder: 15280:15284 BC_DEAD_BINDER_DONE 0000000000000003 not found [ 303.490618] binder: 15280:15284 BC_INCREFS_DONE u0000000000000000 no match [ 303.992450] binder: BINDER_SET_CONTEXT_MGR already set [ 303.992459] binder: 15294:15298 ioctl 40046207 0 returned -16 [ 303.993683] binder_alloc: 15097: binder_alloc_buf, no vma 2018/02/01 04:11:24 executing program 0: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000b25000-0xd)='net/fib_trie\x00') mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) setsockopt$bt_BT_SNDMTU(r0, 0x112, 0xc, &(0x7f0000001000-0x2)=0x9, 0x2) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) r2 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f00002e8000-0x11)='/dev/vga_arbiter\x00', 0x2, 0x0) ioctl$KVM_GET_SUPPORTED_CPUID(r2, 0xc008ae05, &(0x7f00004a5000-0xc8)=""/200) sendmsg$nl_xfrm(r1, &(0x7f0000a8d000)={&(0x7f0000e4e000)={0x10, 0x0, 0x0, 0x0}, 0xc, &(0x7f0000fcf000-0x10)={&(0x7f00005d5000)=@updsa={0x104, 0x1a, 0x1, 0xffffffffffffffff, 0xffffffffffffffff, {{@in6=@local={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0xffffffffffffffff, 0xaa}, @in=@dev={0xac, 0x14, 0xffffffffffffffff, 0x0}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0}, {@in=@broadcast=0xffffffff, 0xffffffffffffffff, 0x2b}, @in=@multicast2=0xe0000002, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, {0x0, 0x0, 0x0, 0x0}, {0x0, 0x0, 0x0}, 0xffffffffffffffff, 0xffffffffffffffff, 0xa, 0x2, 0x0, 0x0}, [@coaddr={0x14, 0xe, @in=@remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}}]}, 0x104}, 0x1, 0x0, 0x0, 0x0}, 0x0) socketpair(0xb, 0x3, 0x3, &(0x7f00004d7000)={0x0, 0x0}) 2018/02/01 04:11:24 executing program 5: mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = memfd_create(&(0x7f0000000000)='k^em0em0trustedkeyring:\x00', 0x1) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) signalfd(r0, &(0x7f0000001000-0x8)={0x4}, 0x8) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000acd000-0x9)='/dev/kvm\x00', 0x40, 0x0) r1 = perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000)=0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$KVM_SET_CPUID(r0, 0x4008ae8a, &(0x7f0000124000)={0x1, 0x0, [{0x8000000b, 0x3ff, 0x0, 0x10000, 0x1, 0x0}]}) socket$inet_dccp(0x2, 0x6, 0x0) ioctl$KVM_SET_TSS_ADDR(0xffffffffffffffff, 0xae47, 0x0) openat$rfkill(0xffffffffffffff9c, &(0x7f00009e0000-0xc)='/dev/rfkill\x00', 0x80000, 0x0) syz_open_dev$amidi(&(0x7f0000304000)='/dev/amidi#\x00', 0x100, 0x40) openat$hwrng(0xffffffffffffff9c, &(0x7f0000af3000)='/dev/hwrng\x00', 0x440, 0x0) fcntl$dupfd(r1, 0x406, r1) syz_open_dev$dmmidi(&(0x7f00001ce000)='/dev/dmmidi#\x00', 0x201, 0x80000) syz_open_dev$mouse(&(0x7f0000d6d000-0x12)='/dev/input/mouse#\x00', 0xffffffff, 0x101000) ioctl$VT_RELDISP(r0, 0x5605) openat$autofs(0xffffffffffffff9c, &(0x7f0000536000)='/dev/autofs\x00', 0x4002, 0x0) r2 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f00005d3000)='/dev/qat_adf_ctl\x00', 0x121000, 0x0) ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) 2018/02/01 04:11:24 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet_sctp(0x2, 0x1, 0x84) r1 = syz_open_dev$usbmon(&(0x7f0000e20000-0xd)='/dev/usbmon#\x00', 0x3ff, 0x0) fcntl$getown(r0, 0x9) ioctl$sock_bt(r1, 0x541b, &(0x7f0000286000)="8450912f1e8652ea023ad265f83d8c8c92b3d292db61dc404db259352853ca255d0940f05b8c1fc0ed32cd375f1c15ebc80d3d150853397ef50035ae0cad56fcf4e9d6f7acb4b350a6f274e459d4f2e79f060b9326475958b4b91f86fd1991d2a5cf401907c0f3bfb876b5cea809ffd88894dcf961e217ce3b96afdc2d3a6c63473f1bd1fd09f6ebfe0c91b0321120be8ee835806cd0c7c57b1e9f2f5b191412af0837db2998670a2f26abff9be97aa145b0dff1b2ef1e") shutdown(r0, 0x1) 2018/02/01 04:11:24 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = open(&(0x7f000000d000-0x8)='./file0\x00', 0x80040, 0x0) fcntl$setlease(r0, 0x400, 0x3) getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f0000d41000-0xe8)={{{@in6=@dev={0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0xffffffffffffffff, 0x0}, @in6=@loopback={0x0, 0x0}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, {0x0, 0x0, 0x0, 0x0}, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, {{@in=@loopback=0x0, 0xffffffffffffffff, 0x0}, 0x0, @in=@multicast1=0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, &(0x7f0000221000-0x4)=0xe8) readahead(r0, 0x80, 0x0) lstat(&(0x7f00003b0000-0x8)='./file0\x00', &(0x7f0000d6a000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) setsockopt$inet6_IPV6_IPSEC_POLICY(r0, 0x29, 0x22, &(0x7f00003eb000)={{{@in=@local={0xac, 0x14, 0x0, 0xaa}, @in6=@loopback={0x0, 0x1}, 0x0, 0x0, 0x2, 0x4, 0x2, 0x20, 0xa0, 0xc, r1, r2}, {0x3, 0x20, 0x100000000000, 0x0, 0x8001, 0x2, 0x2, 0x1f}, {0x8, 0x2, 0x5, 0xac}, 0x4, 0x3, 0x2, 0x1, 0x0, 0x3}, {{@in=@local={0xac, 0x14, 0x0, 0xaa}, 0x2, 0xff}, 0x2, @in=@remote={0xac, 0x14, 0x0, 0xbb}, 0x4, 0x2, 0x0, 0x40, 0x2, 0xdc2, 0x6c}}, 0xe8) r3 = semget$private(0x0, 0x4, 0x5) semtimedop(r3, &(0x7f000034a000)=[{0x0, 0x100000000, 0x800}, {0x2, 0x2, 0x800}, {0x6, 0x6, 0x1800}, {0x5, 0x3, 0x1000}, {0x3, 0x3, 0x800}], 0x5, &(0x7f00001ea000)={0x0, 0x0}) ioctl$sock_SIOCGSKNS(0xffffffffffffffff, 0x894c, &(0x7f0000a8b000-0x4)=0x3) r4 = inotify_add_watch(r0, &(0x7f0000551000)='./file0\x00', 0x82000001) getsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000a46000-0x14)={0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f0000d90000)=0x14) inotify_rm_watch(r0, r4) setsockopt$inet_mreq(r0, 0x0, 0x0, &(0x7f0000ee8000)={@multicast1=0xe0000001, @broadcast=0xffffffff}, 0x8) 2018/02/01 04:11:24 executing program 1: openat$ion(0xffffffffffffff9c, &(0x7f0000801000-0x9)='/dev/ion\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000233000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) write$tun(0xffffffffffffffff, &(0x7f0000577000)=@pi={0x0, 0x0, @eth={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x0}, [], {@canfd={0xd, {{0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0, "feb442a1f43ead325d71fed774c8f6028c2a6b79a4e418aa3c5f391769659fef9f596cdade428c389e511eaad39d2ee4334dee9516a31d00510baaf06efc0980"}}}}}, 0x5a) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004ee000-0x76)='\x00', 0x1, 0x0, 0x0}], &(0x7f000000b000-0x30)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)=""}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00005da000)={0x0, 0x0, &(0x7f00000d8000)=[], 0x48, 0x0, &(0x7f000044c000-0x83)="a410778b7a640ab0384c4ead541b6ee57c5645909ef688d8ac3e5ecfc7039f5f8ba53f127b7f01947cd3689eaf6c090277915bab2a0c450988cb85688e2bcc101a80664d3081fcc0"}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000c5a000)={0x0, 0x0, 0x0, 0x0}) mmap(&(0x7f0000000000/0x13000)=nil, 0x13000, 0x0, 0x32, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000436000-0x30)={0x20, 0x0, &(0x7f0000136000)=[@dead_binder_done={0x40086310, 0x3}, @increfs_done={0x40106308, r3, 0x0}], 0x0, 0x0, &(0x7f0000888000-0xb)=""}) 2018/02/01 04:11:24 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) seccomp(0x1, 0x0, &(0x7f000089b000-0x10)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x407ffc0003}]}) shmctl$IPC_INFO(0x0, 0x3, &(0x7f0000564000)=""/4096) r0 = syz_open_dev$amidi(&(0x7f0000002000)='/dev/amidi#\x00', 0x6, 0x900) getsockopt$netrom_NETROM_T1(r0, 0x103, 0x1, &(0x7f0000f33000)=0x0, &(0x7f0000bbf000-0x4)=0x4) 2018/02/01 04:11:24 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f0000590000-0x8)='./file0\x00', 0x14) write$selinux_create(r0, &(0x7f000074c000)=@access={'system_u:object_r:dpkg_exec_t:s0', 0x20, '/usr/sbin/cups-browsed', 0x20, 0x32, 0x30, 0x0}, 0x3b) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f00007cf000)='/dev/cuse\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_STATUS(r1, 0xc05c5340, &(0x7f0000b85000)={0x6, 0x100, 0x2, {0x0, 0x0}, 0x0, 0x4, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000801000-0x9)='/dev/ion\x00', 0x0, 0x0) r3 = syz_open_dev$binder(&(0x7f0000233000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r4 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0) r5 = dup2(r3, r4) write$tun(0xffffffffffffffff, &(0x7f0000577000)=@pi={0x0, 0x0, @eth={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x0}, [], {@canfd={0xd, {{0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0, "feb442a1f43ead325d71fed774c8f6028c2a6b79a4e418aa3c5f391769659fef9f596cdade428c389e511eaad39d2ee4334dee9516a31d00510baaf06efc0980"}}}}}, 0x5a) r6 = dup2(r4, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004ee000-0x76)='\x00', 0x1, 0x0, 0x0}], &(0x7f000000b000-0x30)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)=""}) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f00005da000)={0x0, 0x0, &(0x7f00000d8000)=[], 0x47, 0x0, &(0x7f000044c000-0x83)="a410778b7a640ab0384c4ead541b6ee57c5645909ef688d8ac3e5ecfc7039f5f8ba53f127b7f01947cd3689eaf6c090277915bab2a0c450988cb85688e2bcc101a80664d3081fc"}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000c5a000)={0x0, 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000a95000-0x30)={0x14, 0x0, &(0x7f0000b8f000)=[@increfs_done={0x40106308, r7, 0x1}], 0x0, 0x0, &(0x7f00002e4000-0x70)=""}) getsockopt$inet6_dccp_buf(r5, 0x21, 0xcf, &(0x7f0000e10000-0xcc)=""/204, &(0x7f000037d000-0x4)=0xcc) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000436000-0x30)={0x20, 0x0, &(0x7f0000136000)=[@dead_binder_done={0x40086310, 0x3}, @increfs_done={0x40106308, r7, 0x0}], 0x0, 0x0, &(0x7f0000888000-0xb)=""}) close(r2) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000002000-0x38)={0x0, 0x0, &(0x7f0000003000)=[], 0x0, &(0x7f0000002000)=[{0x10, 0x10e, 0x0, ""}], 0x10, 0x0}, 0x0) 2018/02/01 04:11:24 executing program 2: openat$ion(0xffffffffffffff9c, &(0x7f0000801000-0x9)='/dev/ion\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) socketpair$inet(0x2, 0x0, 0xc5, &(0x7f000023d000)={0x0, 0x0}) getsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(0xffffffffffffffff, 0x84, 0x1f, &(0x7f0000fdd000-0x98)={0x0, @in6={{0xa, 0x1, 0x1, @local={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0xaa}, 0x2}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0xdcfa, 0x1}, &(0x7f0000bf3000-0x4)=0x98) getsockopt$inet_sctp_SCTP_MAXSEG(r0, 0x84, 0xd, &(0x7f0000b5a000)=@assoc_value={r1, 0x5}, &(0x7f0000f76000-0x4)=0x8) r2 = syz_open_dev$binder(&(0x7f0000233000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) dup2(r2, r3) ioctl$sock_inet_SIOCGIFADDR(r0, 0x8915, &(0x7f000041d000-0x20)={@syzn={0x73, 0x79, 0x7a, 0x0, 0x0}, @ifru_flags=0x1800}) write$tun(0xffffffffffffffff, &(0x7f0000577000)=@pi={0x0, 0x0, @eth={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x0}, [], {@canfd={0xd, {{0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0, "feb442a1f43ead325d71fed774c8f6028c2a6b79a4e418aa3c5f391769659fef9f596cdade428c389e511eaad39d2ee4334dee9516a31d00510baaf06efc0980"}}}}}, 0x5a) r4 = dup2(r3, r2) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004ee000-0x76)='\x00', 0x1, 0x0, 0x0}], &(0x7f000000b000-0x30)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)=""}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00005da000)={0x0, 0x0, &(0x7f00000d8000)=[], 0x48, 0x0, &(0x7f000044c000-0x83)="a410778b7a640ab0384c4ead541b6ee57c5645909ef688d8ac3e5ecfc7039f5f8ba53f127b7f01947cd3689eaf6c090277915bab2a0c450988cb85688e2bcc101a80664d3081fcc0"}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r3, 0xc018620b, &(0x7f0000c5a000)={0x0, 0x0, 0x0, 0x0}) mmap(&(0x7f0000000000/0x13000)=nil, 0x13000, 0x0, 0x32, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000a95000-0x30)={0x14, 0x0, &(0x7f0000b8f000)=[@increfs_done={0x40106308, r5, 0x1}], 0x0, 0x0, &(0x7f00002e4000-0x70)=""}) [ 303.993705] binder: 15294:15298 transaction failed 29189/-3, size 40-8 line 2903 [ 303.999539] binder: 15294:15298 BC_INCREFS_DONE u0000000000000000 no match [ 304.001114] binder: BINDER_SET_CONTEXT_MGR already set 2018/02/01 04:11:24 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet_sctp(0x2, 0x1, 0x84) r1 = syz_open_dev$usbmon(&(0x7f0000e20000-0xd)='/dev/usbmon#\x00', 0x3ff, 0x0) fcntl$getown(r0, 0x9) ioctl$sock_bt(r1, 0x541b, &(0x7f0000286000)="8450912f1e8652ea023ad265f83d8c8c92b3d292db61dc404db259352853ca255d0940f05b8c1fc0ed32cd375f1c15ebc80d3d150853397ef50035ae0cad56fcf4e9d6f7acb4b350a6f274e459d4f2e79f060b9326475958b4b91f86fd1991d2a5cf401907c0f3bfb876b5cea809ffd88894dcf961e217ce3b96afdc2d3a6c63473f1bd1fd09f6ebfe0c91b0321120be8ee835806cd0c7c57b1e9f2f5b191412af0837db2998670a2f26abff9be97aa145b0dff1b2ef1e") shutdown(r0, 0x1) 2018/02/01 04:11:24 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f0000590000-0x8)='./file0\x00', 0x14) write$selinux_create(r0, &(0x7f000074c000)=@access={'system_u:object_r:dpkg_exec_t:s0', 0x20, '/usr/sbin/cups-browsed', 0x20, 0x32, 0x30, 0x0}, 0x3b) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f00007cf000)='/dev/cuse\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_STATUS(r1, 0xc05c5340, &(0x7f0000b85000)={0x6, 0x100, 0x2, {0x0, 0x0}, 0x0, 0x4, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000801000-0x9)='/dev/ion\x00', 0x0, 0x0) r3 = syz_open_dev$binder(&(0x7f0000233000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r4 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0) r5 = dup2(r3, r4) write$tun(0xffffffffffffffff, &(0x7f0000577000)=@pi={0x0, 0x0, @eth={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x0}, [], {@canfd={0xd, {{0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0, "feb442a1f43ead325d71fed774c8f6028c2a6b79a4e418aa3c5f391769659fef9f596cdade428c389e511eaad39d2ee4334dee9516a31d00510baaf06efc0980"}}}}}, 0x5a) r6 = dup2(r4, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004ee000-0x76)='\x00', 0x1, 0x0, 0x0}], &(0x7f000000b000-0x30)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)=""}) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f00005da000)={0x0, 0x0, &(0x7f00000d8000)=[], 0x47, 0x0, &(0x7f000044c000-0x83)="a410778b7a640ab0384c4ead541b6ee57c5645909ef688d8ac3e5ecfc7039f5f8ba53f127b7f01947cd3689eaf6c090277915bab2a0c450988cb85688e2bcc101a80664d3081fc"}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000c5a000)={0x0, 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000a95000-0x30)={0x14, 0x0, &(0x7f0000b8f000)=[@increfs_done={0x40106308, r7, 0x1}], 0x0, 0x0, &(0x7f00002e4000-0x70)=""}) getsockopt$inet6_dccp_buf(r5, 0x21, 0xcf, &(0x7f0000e10000-0xcc)=""/204, &(0x7f000037d000-0x4)=0xcc) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000436000-0x30)={0x20, 0x0, &(0x7f0000136000)=[@dead_binder_done={0x40086310, 0x3}, @increfs_done={0x40106308, r7, 0x0}], 0x0, 0x0, &(0x7f0000888000-0xb)=""}) close(r2) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000002000-0x38)={0x0, 0x0, &(0x7f0000003000)=[], 0x0, &(0x7f0000002000)=[{0x10, 0x10e, 0x0, ""}], 0x10, 0x0}, 0x0) 2018/02/01 04:11:24 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) seccomp(0x1, 0x0, &(0x7f000089b000-0x10)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x407ffc0003}]}) r0 = fcntl$dupfd(0xffffffffffffffff, 0x406, 0xffffffffffffffff) openat(r0, &(0x7f0000616000)='./file0\x00', 0x0, 0x4) shmctl$IPC_INFO(0x0, 0x3, &(0x7f0000564000)=""/4096) sysinfo(&(0x7f0000976000)=""/122) r1 = syz_open_dev$usbmon(&(0x7f0000dc7000-0xd)='/dev/usbmon#\x00', 0x9, 0x8000) setsockopt$SO_VM_SOCKETS_CONNECT_TIMEOUT(r1, 0x28, 0x6, &(0x7f00006f9000-0x10)={0x77359400, 0x0}, 0x10) r2 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000e84000-0x19)='/selinux/avc/cache_stats\x00', 0x0, 0x0) getsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r2, 0x6, 0x1d, &(0x7f0000228000-0x14)={0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f0000691000)=0x14) [ 304.001123] binder: 15297:15301 ioctl 40046207 0 returned -16 [ 304.003485] binder_alloc: 15097: binder_alloc_buf, no vma [ 304.003508] binder: 15297:15301 transaction failed 29189/-3, size 40-8 line 2903 2018/02/01 04:11:24 executing program 3: 2018/02/01 04:11:24 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet_sctp(0x2, 0x1, 0x84) syz_open_dev$usbmon(&(0x7f0000e20000-0xd)='/dev/usbmon#\x00', 0x3ff, 0x0) fcntl$getown(r0, 0x9) sendto$inet(r0, &(0x7f0000022000-0x16)="01", 0x1, 0x0, &(0x7f0000031000-0x10)={0x2, 0xffffffffffffffff, @local={0xac, 0x14, 0xffffffffffffffff, 0xaa}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x10) shutdown(r0, 0x1) 2018/02/01 04:11:24 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f0000590000-0x8)='./file0\x00', 0x14) write$selinux_create(r0, &(0x7f000074c000)=@access={'system_u:object_r:dpkg_exec_t:s0', 0x20, '/usr/sbin/cups-browsed', 0x20, 0x32, 0x30, 0x0}, 0x3b) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f00007cf000)='/dev/cuse\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_STATUS(r1, 0xc05c5340, &(0x7f0000b85000)={0x6, 0x100, 0x2, {0x0, 0x0}, 0x0, 0x4, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000801000-0x9)='/dev/ion\x00', 0x0, 0x0) r3 = syz_open_dev$binder(&(0x7f0000233000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r4 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0) r5 = dup2(r3, r4) write$tun(0xffffffffffffffff, &(0x7f0000577000)=@pi={0x0, 0x0, @eth={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x0}, [], {@canfd={0xd, {{0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0, "feb442a1f43ead325d71fed774c8f6028c2a6b79a4e418aa3c5f391769659fef9f596cdade428c389e511eaad39d2ee4334dee9516a31d00510baaf06efc0980"}}}}}, 0x5a) r6 = dup2(r4, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004ee000-0x76)='\x00', 0x1, 0x0, 0x0}], &(0x7f000000b000-0x30)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)=""}) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f00005da000)={0x0, 0x0, &(0x7f00000d8000)=[], 0x47, 0x0, &(0x7f000044c000-0x83)="a410778b7a640ab0384c4ead541b6ee57c5645909ef688d8ac3e5ecfc7039f5f8ba53f127b7f01947cd3689eaf6c090277915bab2a0c450988cb85688e2bcc101a80664d3081fc"}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000c5a000)={0x0, 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000a95000-0x30)={0x14, 0x0, &(0x7f0000b8f000)=[@increfs_done={0x40106308, r7, 0x1}], 0x0, 0x0, &(0x7f00002e4000-0x70)=""}) getsockopt$inet6_dccp_buf(r5, 0x21, 0xcf, &(0x7f0000e10000-0xcc)=""/204, &(0x7f000037d000-0x4)=0xcc) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000436000-0x30)={0x20, 0x0, &(0x7f0000136000)=[@dead_binder_done={0x40086310, 0x3}, @increfs_done={0x40106308, r7, 0x0}], 0x0, 0x0, &(0x7f0000888000-0xb)=""}) close(r2) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000002000-0x38)={0x0, 0x0, &(0x7f0000003000)=[], 0x0, &(0x7f0000002000)=[{0x10, 0x10e, 0x0, ""}], 0x10, 0x0}, 0x0) 2018/02/01 04:11:24 executing program 3: 2018/02/01 04:11:24 executing program 1: openat$ion(0xffffffffffffff9c, &(0x7f0000801000-0x9)='/dev/ion\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000233000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = dup2(r0, r1) write$tun(0xffffffffffffffff, &(0x7f0000577000)=@pi={0x0, 0x0, @eth={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x0}, [], {@canfd={0xd, {{0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0, "feb442a1f43ead325d71fed774c8f6028c2a6b79a4e418aa3c5f391769659fef9f596cdade428c389e511eaad39d2ee4334dee9516a31d00510baaf06efc0980"}}}}}, 0x5a) r3 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004ee000-0x76)='\x00', 0x1, 0x0, 0x0}], &(0x7f000000b000-0x30)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)=""}) setsockopt$inet6_tcp_TCP_ULP(r2, 0x6, 0x1f, &(0x7f0000f0b000-0x4)='tls\x00', 0x4) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00005da000)={0x0, 0x0, &(0x7f00000d8000)=[], 0x48, 0x0, &(0x7f000044c000-0x83)="a410778b7a640ab0384c4ead541b6ee57c5645909ef688d8ac3e5ecfc7039f5f8ba53f127b7f01947cd3689eaf6c090277915bab2a0c450988cb85688e2bcc101a80664d3081fcc0"}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000c5a000)={0x0, 0x0, 0x0, 0x0}) mmap(&(0x7f0000000000/0x13000)=nil, 0x13000, 0x0, 0x32, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000a95000-0x30)={0x14, 0x0, &(0x7f0000b8f000)=[@increfs_done={0x40106308, r4, 0x1}], 0x0, 0x0, &(0x7f00002e4000-0x70)=""}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000436000-0x30)={0x20, 0x0, &(0x7f0000136000)=[@dead_binder_done={0x40086310, 0x3}, @increfs_done={0x40106308, r4, 0x0}], 0x0, 0x0, &(0x7f0000888000-0xb)=""}) [ 304.005439] binder: 15297:15301 BC_INCREFS_DONE u0000000000000000 no match [ 304.007322] binder: 15297:15301 BC_DEAD_BINDER_DONE 0000000000000003 not found [ 304.007331] binder: 15297:15301 BC_INCREFS_DONE u0000000000000000 no match [ 304.019440] binder: BINDER_SET_CONTEXT_MGR already set [ 304.019449] binder: 15293:15304 ioctl 40046207 0 returned -16 [ 304.019853] binder_alloc: 15097: binder_alloc_buf, no vma [ 304.019875] binder: 15293:15304 transaction failed 29189/-3, size 40-8 line 2903 [ 304.027300] binder: BINDER_SET_CONTEXT_MGR already set 2018/02/01 04:11:24 executing program 0: mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/autofs\x00', 0x488001, 0x0) getpeername$packet(0xffffffffffffffff, &(0x7f0000bee000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0], [0x0, 0x0]}, &(0x7f0000c97000-0x4)=0x14) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) connect$packet(r0, &(0x7f0000000000)={0x11, 0x1e, r1, 0x1, 0x5, 0x6, @dev={[0xaa, 0xaa, 0xaa, 0xaa], 0x0, 0x16}, [0x0, 0x0]}, 0x14) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000a8d000)={&(0x7f0000e4e000)={0x10, 0x0, 0x0, 0x0}, 0xc, &(0x7f0000fcf000-0x10)={&(0x7f00005d5000)=@updsa={0x104, 0x1a, 0x1, 0xffffffffffffffff, 0xffffffffffffffff, {{@in6=@local={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0xffffffffffffffff, 0xaa}, @in=@dev={0xac, 0x14, 0xffffffffffffffff, 0x0}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0}, {@in=@broadcast=0xffffffff, 0xffffffffffffffff, 0x2b}, @in=@multicast2=0xe0000002, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, {0x0, 0x0, 0x0, 0x0}, {0x0, 0x0, 0x0}, 0xffffffffffffffff, 0xffffffffffffffff, 0xa, 0x2, 0x0, 0x0}, [@coaddr={0x14, 0xe, @in=@remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}}]}, 0x104}, 0x1, 0x0, 0x0, 0x0}, 0x0) 2018/02/01 04:11:24 executing program 5: setpriority(0x0, 0x0, 0x1) 2018/02/01 04:11:24 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet_sctp(0x2, 0x5, 0x84) sendmsg$inet_sctp(r0, &(0x7f000071e000-0x1c)={&(0x7f0000ec3000-0x10)=@in={0x2, 0xffffffffffffffff, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x10, &(0x7f0000709000-0x30)=[{&(0x7f0000d14000)="f6", 0x1}], 0x1, &(0x7f0000d5e000-0x2c)=[], 0x0, 0x4000000}, 0x40000) 2018/02/01 04:11:24 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f0000590000-0x8)='./file0\x00', 0x14) write$selinux_create(r0, &(0x7f000074c000)=@access={'system_u:object_r:dpkg_exec_t:s0', 0x20, '/usr/sbin/cups-browsed', 0x20, 0x32, 0x30, 0x0}, 0x3b) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f00007cf000)='/dev/cuse\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_STATUS(r1, 0xc05c5340, &(0x7f0000b85000)={0x6, 0x100, 0x2, {0x0, 0x0}, 0x0, 0x4, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000801000-0x9)='/dev/ion\x00', 0x0, 0x0) r3 = syz_open_dev$binder(&(0x7f0000233000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r4 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0) r5 = dup2(r3, r4) write$tun(0xffffffffffffffff, &(0x7f0000577000)=@pi={0x0, 0x0, @eth={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x0}, [], {@canfd={0xd, {{0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0, "feb442a1f43ead325d71fed774c8f6028c2a6b79a4e418aa3c5f391769659fef9f596cdade428c389e511eaad39d2ee4334dee9516a31d00510baaf06efc0980"}}}}}, 0x5a) r6 = dup2(r4, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004ee000-0x76)='\x00', 0x1, 0x0, 0x0}], &(0x7f000000b000-0x30)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)=""}) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f00005da000)={0x0, 0x0, &(0x7f00000d8000)=[], 0x48, 0x0, &(0x7f000044c000-0x83)="a410778b7a640ab0384c4ead541b6ee57c5645909ef688d8ac3e5ecfc7039f5f8ba53f127b7f01947cd3689eaf6c090277915bab2a0c450988cb85688e2bcc101a80664d3081fcc0"}) ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000c5a000)={0x0, 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000a95000-0x30)={0x14, 0x0, &(0x7f0000b8f000)=[@increfs_done={0x40106308, r7, 0x1}], 0x0, 0x0, &(0x7f00002e4000-0x70)=""}) getsockopt$inet6_dccp_buf(r5, 0x21, 0xcf, &(0x7f0000e10000-0xcc)=""/204, &(0x7f000037d000-0x4)=0xcc) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000436000-0x30)={0x20, 0x0, &(0x7f0000136000)=[@dead_binder_done={0x40086310, 0x3}, @increfs_done={0x40106308, r7, 0x0}], 0x0, 0x0, &(0x7f0000888000-0xb)=""}) close(r2) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000002000-0x38)={0x0, 0x0, &(0x7f0000003000)=[], 0x0, &(0x7f0000002000)=[{0x10, 0x10e, 0x0, ""}], 0x10, 0x0}, 0x0) 2018/02/01 04:11:24 executing program 2: openat$ion(0xffffffffffffff9c, &(0x7f0000801000-0x9)='/dev/ion\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000233000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x800) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = dup2(r0, r1) write$tun(0xffffffffffffffff, &(0x7f0000577000)=@pi={0x0, 0x0, @eth={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x0}, [], {@canfd={0xd, {{0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0, "feb442a1f43ead325d71fed774c8f6028c2a6b79a4e418aa3c5f391769659fef9f596cdade428c389e511eaad39d2ee4334dee9516a31d00510baaf06efc0980"}}}}}, 0x5a) ioctl$EVIOCGBITKEY(r2, 0x80404521, &(0x7f00000ec000)=""/5) r3 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004ee000-0x76)='\x00', 0x1, 0x0, 0x0}], &(0x7f000000b000-0x30)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)=""}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00005da000)={0x0, 0x0, &(0x7f00000d8000)=[], 0x48, 0x0, &(0x7f000044c000-0x83)="a410778b7a640ab0384c4ead541b6ee57c5645909ef688d8ac3e5ecfc7039f5f8ba53f127b7f01947cd3689eaf6c090277915bab2a0c450988cb85688e2bcc101a80664d3081fcc0"}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000c5a000)={0x0, 0x0, 0x0, 0x0}) mmap(&(0x7f0000000000/0x13000)=nil, 0x13000, 0x0, 0x32, 0xffffffffffffffff, 0x0) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(r2, 0x84, 0xf, &(0x7f0000896000)={0x0, @in6={{0xa, 0x3, 0x4, @loopback={0x0, 0x1}, 0x4}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x6, 0x3, 0x101, 0x7e, 0x400}, &(0x7f0000ced000)=0xa0) getsockopt$inet_sctp_SCTP_AUTH_ACTIVE_KEY(r2, 0x84, 0x18, &(0x7f0000bd0000)={r5, 0x9}, &(0x7f000057e000)=0x6) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000a95000-0x30)={0x14, 0x0, &(0x7f0000b8f000)=[@increfs_done={0x40106308, r4, 0x1}], 0x0, 0x0, &(0x7f00002e4000-0x70)=""}) 2018/02/01 04:11:24 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) openat$dsp(0xffffffffffffff9c, &(0x7f0000c7a000)='/dev/dsp\x00', 0x2, 0x0) seccomp(0x1, 0x0, &(0x7f000089b000-0x10)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x407ffc0003}]}) shmctl$IPC_INFO(0x0, 0x3, &(0x7f0000564000)=""/4096) r0 = dup(0xffffffffffffff9c) flistxattr(r0, &(0x7f0000e61000-0x1000)=""/4096, 0x1000) 2018/02/01 04:11:24 executing program 1: r0 = openat$autofs(0xffffffffffffff9c, &(0x7f0000bb8000)='/dev/autofs\x00', 0x9dce54c20b9ce183, 0x0) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$sock_inet_SIOCSIFDSTADDR(r0, 0x8918, &(0x7f0000001000-0x20)={@common='gretap0\x00', @ifru_addrs={0x2, 0x1, @broadcast=0xffffffff, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}}) openat$ion(0xffffffffffffff9c, &(0x7f0000801000-0x9)='/dev/ion\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000233000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = openat$cuse(0xffffffffffffff9c, &(0x7f0000acb000)='/dev/cuse\x00', 0x2080, 0x0) ioctl$TIOCGSID(0xffffffffffffff9c, 0x5429, &(0x7f0000973000)=0x0) ioctl$sock_FIOSETOWN(r3, 0x8901, &(0x7f00003bb000)=r4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) dup2(r1, r2) write$tun(0xffffffffffffffff, &(0x7f0000577000)=@pi={0x0, 0x0, @eth={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x0}, [], {@canfd={0xd, {{0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0, "feb442a1f43ead325d71fed774c8f6028c2a6b79a4e418aa3c5f391769659fef9f596cdade428c389e511eaad39d2ee4334dee9516a31d00510baaf06efc0980"}}}}}, 0x5a) r5 = dup2(r2, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004ee000-0x76)='\x00', 0x1, 0x0, 0x0}], &(0x7f000000b000-0x30)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)=""}) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f00005da000)={0x0, 0x0, &(0x7f00000d8000)=[], 0x48, 0x0, &(0x7f000044c000-0x83)="a410778b7a640ab0384c4ead541b6ee57c5645909ef688d8ac3e5ecfc7039f5f8ba53f127b7f01947cd3689eaf6c090277915bab2a0c450988cb85688e2bcc101a80664d3081fcc0"}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000c5a000)={0x0, 0x0, 0x0, 0x0}) mmap(&(0x7f0000000000/0x13000)=nil, 0x13000, 0x0, 0x32, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000a95000-0x30)={0x14, 0x0, &(0x7f0000b8f000)=[@increfs_done={0x40106308, r6, 0x1}], 0x0, 0x0, &(0x7f00002e4000-0x70)=""}) ioctl$BINDER_SET_MAX_THREADS(r2, 0x40046205, 0x8) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000436000-0x30)={0x20, 0x0, &(0x7f0000136000)=[@dead_binder_done={0x40086310, 0x3}, @increfs_done={0x40106308, r6, 0x0}], 0x0, 0x0, &(0x7f0000888000-0xb)=""}) [ 304.027310] binder: 15294:15298 ioctl 40046207 0 returned -16 [ 304.037335] binder_alloc: 15097: binder_alloc_buf, no vma [ 304.037359] binder: 15294:15298 transaction failed 29189/-3, size 40-8 line 2903 [ 304.048139] binder: 15294:15309 BC_INCREFS_DONE u0000000000000000 no match [ 304.070639] binder: BINDER_SET_CONTEXT_MGR already set [ 304.070649] binder: 15314:15317 ioctl 40046207 0 returned -16 [ 304.071643] binder_alloc: 15097: binder_alloc_buf, no vma 2018/02/01 04:11:24 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet_sctp(0x2, 0x1, 0x84) syz_open_dev$usbmon(&(0x7f0000e20000-0xd)='/dev/usbmon#\x00', 0x3ff, 0x0) sendto$inet(r0, &(0x7f0000022000-0x16)="01", 0x1, 0x0, &(0x7f0000031000-0x10)={0x2, 0xffffffffffffffff, @local={0xac, 0x14, 0xffffffffffffffff, 0xaa}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x10) shutdown(r0, 0x1) 2018/02/01 04:11:24 executing program 5: mmap(&(0x7f0000000000/0xffa000)=nil, 0xffa000, 0x3, 0x32, 0xffffffffffffffff, 0x0) unshare(0x8000400) pipe(&(0x7f0000ff9000-0x8)={0xffffffffffffffff, 0xffffffffffffffff}) mq_notify(r1, &(0x7f0000ffa000-0x60)={0x0, 0x0, 0x0, @tid=0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) mmap(&(0x7f0000ffa000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$TUNSETPERSIST(r0, 0x400454cb, &(0x7f0000ffa000)=0x4) mmap(&(0x7f0000ffa000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffa000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) accept4$llc(r1, &(0x7f0000ffb000-0x10)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={[0x0, 0x0, 0x0, 0x0], 0xffffffffffffffff, 0x0}, [0x0, 0x0]}, &(0x7f0000ffb000-0x4)=0x10, 0x800) [ 304.071666] binder: 15314:15317 transaction failed 29189/-3, size 40-8 line 2903 [ 304.082197] binder: 15314:15317 BC_INCREFS_DONE u0000000000000000 no match [ 304.082755] binder: 15314:15317 BC_DEAD_BINDER_DONE 0000000000000003 not found 2018/02/01 04:11:24 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f0000590000-0x8)='./file0\x00', 0x14) write$selinux_create(r0, &(0x7f000074c000)=@access={'system_u:object_r:dpkg_exec_t:s0', 0x20, '/usr/sbin/cups-browsed', 0x20, 0x32, 0x30, 0x0}, 0x3b) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f00007cf000)='/dev/cuse\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_STATUS(r1, 0xc05c5340, &(0x7f0000b85000)={0x6, 0x100, 0x2, {0x0, 0x0}, 0x0, 0x4, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000801000-0x9)='/dev/ion\x00', 0x0, 0x0) r3 = syz_open_dev$binder(&(0x7f0000233000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r4 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0) r5 = dup2(r3, r4) write$tun(0xffffffffffffffff, &(0x7f0000577000)=@pi={0x0, 0x0, @eth={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x0}, [], {@canfd={0xd, {{0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0, "feb442a1f43ead325d71fed774c8f6028c2a6b79a4e418aa3c5f391769659fef9f596cdade428c389e511eaad39d2ee4334dee9516a31d00510baaf06efc0980"}}}}}, 0x5a) r6 = dup2(r4, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004ee000-0x76)='\x00', 0x1, 0x0, 0x0}], &(0x7f000000b000-0x30)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)=""}) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f00005da000)={0x0, 0x0, &(0x7f00000d8000)=[], 0x48, 0x0, &(0x7f000044c000-0x83)="a410778b7a640ab0384c4ead541b6ee57c5645909ef688d8ac3e5ecfc7039f5f8ba53f127b7f01947cd3689eaf6c090277915bab2a0c450988cb85688e2bcc101a80664d3081fcc0"}) ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000c5a000)={0x0, 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000a95000-0x30)={0x14, 0x0, &(0x7f0000b8f000)=[@increfs_done={0x40106308, r7, 0x1}], 0x0, 0x0, &(0x7f00002e4000-0x70)=""}) getsockopt$inet6_dccp_buf(r5, 0x21, 0xcf, &(0x7f0000e10000-0xcc)=""/204, &(0x7f000037d000-0x4)=0xcc) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000436000-0x30)={0x20, 0x0, &(0x7f0000136000)=[@dead_binder_done={0x40086310, 0x3}, @increfs_done={0x40106308, r7, 0x0}], 0x0, 0x0, &(0x7f0000888000-0xb)=""}) close(r2) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000002000-0x38)={0x0, 0x0, &(0x7f0000003000)=[], 0x0, &(0x7f0000002000)=[{0x10, 0x10e, 0x0, ""}], 0x10, 0x0}, 0x0) 2018/02/01 04:11:24 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r0, &(0x7f0000022000-0x16)="01", 0x1, 0x0, &(0x7f0000031000-0x10)={0x2, 0xffffffffffffffff, @local={0xac, 0x14, 0xffffffffffffffff, 0xaa}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x10) shutdown(r0, 0x1) 2018/02/01 04:11:24 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) bind$unix(0xffffffffffffffff, &(0x7f000055b000)=@file={0x0, './file0\x00'}, 0xa) perf_event_open(&(0x7f000002f000-0x78)={0x0, 0x78, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0xd34, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000)=0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xffffffff, 0xffffffffffffffff, 0x0) mremap(&(0x7f00003fb000/0x400000)=nil, 0x400000, 0x400000, 0x3, &(0x7f0000bec000/0x400000)=nil) r0 = syz_open_dev$sndmidi(&(0x7f0000822000)='/dev/snd/midiC#D#\x00', 0x3, 0x82200) ioctl$KVM_SET_GUEST_DEBUG(r0, 0x4048ae9b, &(0x7f0000975000)={0x0, 0x0, [0x0, 0x1, 0xfffffffffffffbff, 0x1000, 0x0, 0x3f, 0xd8, 0x8]}) 2018/02/01 04:11:24 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dspn(&(0x7f00007b2000)='/dev/dsp#\x00', 0x6d999f5e, 0x100) ioctl$KDGETMODE(r0, 0x4b3b, &(0x7f0000b73000-0x8)=0x0) seccomp(0x1, 0x0, &(0x7f000089b000-0x10)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x407ffc0003}]}) shmctl$IPC_INFO(0x0, 0x3, &(0x7f0000564000)=""/4096) [ 304.082765] binder: 15314:15317 BC_INCREFS_DONE u0000000000000000 no match [ 304.085008] binder: BINDER_SET_CONTEXT_MGR already set [ 304.087390] binder: 15313:15315 ioctl 40046207 0 returned -16 [ 304.091367] binder_alloc: 15097: binder_alloc_buf, no vma 2018/02/01 04:11:24 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f0000590000-0x8)='./file0\x00', 0x14) write$selinux_create(r0, &(0x7f000074c000)=@access={'system_u:object_r:dpkg_exec_t:s0', 0x20, '/usr/sbin/cups-browsed', 0x20, 0x32, 0x30, 0x0}, 0x3b) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f00007cf000)='/dev/cuse\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_STATUS(r1, 0xc05c5340, &(0x7f0000b85000)={0x6, 0x100, 0x2, {0x0, 0x0}, 0x0, 0x4, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000801000-0x9)='/dev/ion\x00', 0x0, 0x0) r3 = syz_open_dev$binder(&(0x7f0000233000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r4 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0) r5 = dup2(r3, r4) write$tun(0xffffffffffffffff, &(0x7f0000577000)=@pi={0x0, 0x0, @eth={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x0}, [], {@canfd={0xd, {{0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0, "feb442a1f43ead325d71fed774c8f6028c2a6b79a4e418aa3c5f391769659fef9f596cdade428c389e511eaad39d2ee4334dee9516a31d00510baaf06efc0980"}}}}}, 0x5a) r6 = dup2(r4, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004ee000-0x76)='\x00', 0x1, 0x0, 0x0}], &(0x7f000000b000-0x30)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)=""}) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f00005da000)={0x0, 0x0, &(0x7f00000d8000)=[], 0x48, 0x0, &(0x7f000044c000-0x83)="a410778b7a640ab0384c4ead541b6ee57c5645909ef688d8ac3e5ecfc7039f5f8ba53f127b7f01947cd3689eaf6c090277915bab2a0c450988cb85688e2bcc101a80664d3081fcc0"}) ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000c5a000)={0x0, 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000a95000-0x30)={0x14, 0x0, &(0x7f0000b8f000)=[@increfs_done={0x40106308, r7, 0x1}], 0x0, 0x0, &(0x7f00002e4000-0x70)=""}) getsockopt$inet6_dccp_buf(r5, 0x21, 0xcf, &(0x7f0000e10000-0xcc)=""/204, &(0x7f000037d000-0x4)=0xcc) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000436000-0x30)={0x20, 0x0, &(0x7f0000136000)=[@dead_binder_done={0x40086310, 0x3}, @increfs_done={0x40106308, r7, 0x0}], 0x0, 0x0, &(0x7f0000888000-0xb)=""}) close(r2) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000002000-0x38)={0x0, 0x0, &(0x7f0000003000)=[], 0x0, &(0x7f0000002000)=[{0x10, 0x10e, 0x0, ""}], 0x10, 0x0}, 0x0) 2018/02/01 04:11:24 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f000048f000-0x12)='/dev/snd/midiC#D#\x00', 0x2df, 0x8000) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_INFO(r0, 0xc10c5541, &(0x7f000073f000)={0x401, 0x6, 0x9, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x7f, 0x4, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f000029d000)={r0, 0x28, &(0x7f0000b36000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16}}, 0x10) r1 = syz_open_dev$sndctrl(&(0x7f000068f000)='/dev/snd/controlC#\x00', 0x110000000000, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(r1, 0xc1105511, &(0x7f0000a5e000-0x10c)={{0xb, 0x0, 0x0, 0x0, "1b4d3cbde8f58d90018924940c3317f72fd20a070a115c4a1dbe9fd9421f2bde5ac7296e7e4d6ace88736a65", 0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, "e1d11b93206e214bb305376205292044a4eae3d1849ba4f663070b9af44b523aa0e85d3d904c0aada313c6228e9e94723904b3f9cc8ad27895951cf255a21d2c", &(0x7f0000a88000-0x2)='&\x00', 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], [0x0, 0x0, 0x0, 0x0], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) 2018/02/01 04:11:24 executing program 2: openat$ion(0xffffffffffffff9c, &(0x7f0000801000-0x9)='/dev/ion\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000233000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = dup2(r0, r1) write$tun(0xffffffffffffffff, &(0x7f0000577000)=@pi={0x0, 0x0, @eth={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x0}, [], {@canfd={0xd, {{0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0, "feb442a1f43ead325d71fed774c8f6028c2a6b79a4e418aa3c5f391769659fef9f596cdade428c389e511eaad39d2ee4334dee9516a31d00510baaf06efc0980"}}}}}, 0x5a) r3 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004ee000-0x76)='\x00', 0x1, 0x0, 0x0}], &(0x7f000000b000-0x30)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)=""}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00005da000)={0x0, 0x0, &(0x7f00000d8000)=[], 0x48, 0x0, &(0x7f000044c000-0x83)="a410778b7a640ab0384c4ead541b6ee57c5645909ef688d8ac3e5ecfc7039f5f8ba53f127b7f01947cd3689eaf6c090277915bab2a0c450988cb85688e2bcc101a80664d3081fcc0"}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000c5a000)={0x0, 0x0, 0x0, 0x0}) mmap(&(0x7f0000000000/0x13000)=nil, 0x13000, 0x0, 0x32, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000a95000-0x30)={0x14, 0x0, &(0x7f0000b8f000)=[@increfs_done={0x40106308, r4, 0x1}], 0x0, 0x0, &(0x7f00002e4000-0x70)=""}) getsockopt$inet_sctp_SCTP_PR_SUPPORTED(r2, 0x84, 0x71, &(0x7f000072b000)={0x0, 0x9}, &(0x7f00005b6000-0x4)=0x8) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r2, 0x84, 0x6f, &(0x7f0000c5a000-0x10)={r5, 0x58, &(0x7f0000f7a000)=[@in={0x2, 0x3, @multicast2=0xe0000002, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, @in={0x2, 0x2, @local={0xac, 0x14, 0x0, 0xaa}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, @in6={0xa, 0x0, 0x7, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x1}, 0x0}, @in6={0xa, 0x0, 0xffff, @local={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0xaa}, 0x2}]}, &(0x7f00004bf000-0x4)=0x10) [ 304.091392] binder: 15313:15315 transaction failed 29189/-3, size 40-8 line 2903 [ 304.105639] binder: BINDER_SET_CONTEXT_MGR already set [ 304.105648] binder: 15321:15324 ioctl 40046207 0 returned -16 [ 304.109582] binder: 15321:15324 BC_INCREFS_DONE u0000000000000000 no match [ 304.134814] binder_alloc: binder_alloc_mmap_handler: 15321 20000000-20002000 already mapped failed -16 [ 304.135921] binder: BINDER_SET_CONTEXT_MGR already set [ 304.135929] binder: 15327:15333 ioctl 40046207 0 returned -16 [ 304.136075] binder: BINDER_SET_CONTEXT_MGR already set [ 304.136083] binder: 15321:15324 ioctl 40046207 0 returned -16 [ 304.137496] binder_alloc: 15097: binder_alloc_buf, no vma [ 304.137518] binder: 15327:15333 transaction failed 29189/-3, size 40-8 line 2903 [ 304.139986] binder: BINDER_SET_CONTEXT_MGR already set [ 304.139994] binder: 15326:15332 ioctl 40046207 0 returned -16 [ 304.141834] binder_alloc: 15097: binder_alloc_buf, no vma [ 304.141858] binder: 15326:15332 transaction failed 29189/-3, size 40-8 line 2903 2018/02/01 04:11:24 executing program 0: mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$mixer(0xffffffffffffff9c, &(0x7f0000001000-0xb)='/dev/mixer\x00', 0x4201, 0x0) getsockopt$bt_BT_FLUSHABLE(r0, 0x112, 0x8, &(0x7f0000f29000-0x4)=0x5, &(0x7f00009b8000)=0x4) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r1 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSARP(r1, 0x8955, &(0x7f0000208000-0x44)={{0x2, 0xffffffffffffffff, @broadcast=0xffffffff, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, {0x0, @local={[0xaa, 0xaa, 0xaa, 0xaa], 0xffffffffffffffff, 0xaa}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x8, {0x2, 0xffffffffffffffff, @rand_addr=0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, @common="006f73000a0fff000008000065004080"}) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) setsockopt$bt_BT_POWER(r0, 0x112, 0x9, &(0x7f0000b66000-0x1)=0x8, 0x1) getsockname$packet(r0, &(0x7f0000ce3000-0x14)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @local={[0x0, 0x0, 0x0, 0x0], 0xffffffffffffffff, 0x0}, [0x0, 0x0]}, &(0x7f0000161000)=0x14) sendmsg$nl_xfrm(r2, &(0x7f0000a8d000)={&(0x7f0000e4e000)={0x10, 0x0, 0x0, 0x0}, 0xc, &(0x7f0000fcf000-0x10)={&(0x7f00005d5000)=@updsa={0x104, 0x1a, 0x1, 0xffffffffffffffff, 0xffffffffffffffff, {{@in6=@local={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0xffffffffffffffff, 0xaa}, @in=@dev={0xac, 0x14, 0xffffffffffffffff, 0x0}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0}, {@in=@broadcast=0xffffffff, 0xffffffffffffffff, 0x2b}, @in=@multicast2=0xe0000002, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, {0x0, 0x0, 0x0, 0x0}, {0x0, 0x0, 0x0}, 0xffffffffffffffff, 0xffffffffffffffff, 0xa, 0x2, 0x0, 0x0}, [@coaddr={0x14, 0xe, @in=@remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}}]}, 0x104}, 0x1, 0x0, 0x0, 0x0}, 0x0) setsockopt$bt_BT_SNDMTU(r0, 0x112, 0xc, &(0x7f0000137000)=0x8000, 0x2) 2018/02/01 04:11:24 executing program 1: openat$ion(0xffffffffffffff9c, &(0x7f0000801000-0x9)='/dev/ion\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000233000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) openat$selinux_member(0xffffffffffffff9c, &(0x7f00006b9000)='/selinux/member\x00', 0x2, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) openat$dir(0xffffffffffffff9c, &(0x7f0000e93000)='./file0\x00', 0x200000, 0x80) write$tun(0xffffffffffffffff, &(0x7f0000577000)=@pi={0x0, 0x0, @eth={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x0}, [], {@canfd={0xd, {{0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0, "feb442a1f43ead325d71fed774c8f6028c2a6b79a4e418aa3c5f391769659fef9f596cdade428c389e511eaad39d2ee4334dee9516a31d00510baaf06efc0980"}}}}}, 0x5a) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004ee000-0x76)='\x00', 0x1, 0x0, 0x0}], &(0x7f000000b000-0x30)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)=""}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00005da000)={0x0, 0x0, &(0x7f00000d8000)=[], 0x48, 0x0, &(0x7f000044c000-0x83)="a410778b7a640ab0384c4ead541b6ee57c5645909ef688d8ac3e5ecfc7039f5f8ba53f127b7f01947cd3689eaf6c090277915bab2a0c450988cb85688e2bcc101a80664d3081fcc0"}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000c5a000)={0x0, 0x0, 0x0, 0x0}) mmap(&(0x7f0000000000/0x13000)=nil, 0x13000, 0x0, 0x32, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000a95000-0x30)={0x14, 0x0, &(0x7f0000b8f000)=[@increfs_done={0x40106308, r3, 0x1}], 0x0, 0x0, &(0x7f00002e4000-0x70)=""}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000436000-0x30)={0x20, 0x0, &(0x7f0000136000)=[@dead_binder_done={0x40086310, 0x3}, @increfs_done={0x40106308, r3, 0x0}], 0x0, 0x0, &(0x7f0000888000-0xb)=""}) 2018/02/01 04:11:24 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) sendto$inet(0xffffffffffffffff, &(0x7f0000022000-0x16)="01", 0x1, 0x0, &(0x7f0000031000-0x10)={0x2, 0xffffffffffffffff, @local={0xac, 0x14, 0xffffffffffffffff, 0xaa}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x10) shutdown(0xffffffffffffffff, 0x1) 2018/02/01 04:11:24 executing program 3: mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000001000-0x10)='/dev/sequencer2\x00', 0x0, 0x0) ioctl$sock_inet6_tcp_SIOCINQ(r0, 0x541b, &(0x7f00004bd000)=0x0) r1 = socket$vsock_stream(0x28, 0x1, 0x0) setsockopt$SO_VM_SOCKETS_BUFFER_SIZE(r1, 0x28, 0x40000, &(0x7f0000000000)=0x0, 0x8) setsockopt$inet_mreq(r0, 0x0, 0x23, &(0x7f0000000000)={@remote={0xac, 0x14, 0x0, 0xbb}, @broadcast=0xffffffff}, 0x8) 2018/02/01 04:11:24 executing program 5: mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x5, 0x0) setsockopt(r0, 0x84, 0x72, &(0x7f000023e000-0x1)="", 0x0) r1 = openat$mixer(0xffffffffffffff9c, &(0x7f0000576000)='/dev/mixer\x00', 0x8083, 0x0) getsockopt$inet_sctp6_SCTP_MAXSEG(r0, 0x84, 0xd, &(0x7f0000000000)=@assoc_id=0x0, &(0x7f0000002000-0x4)=0x4) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r1, 0x84, 0x6, &(0x7f0000002000-0x8c)={r2, @in6={{0xa, 0x3, 0x0, @local={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0xffffffffffffffff, 0xaa}, 0x0}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}}, &(0x7f0000000000)=0x8c) ioctl$sock_inet_SIOCADDRT(r1, 0x890b, &(0x7f0000000000)={0x7, {0x2, 0x0, @empty=0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, {0x2, 0x0, @multicast2=0xe0000002, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, {0x2, 0x1, @empty=0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x80, 0x5, 0x6, 0x9, 0x100, &(0x7f0000001000)=@syzn={0x73, 0x79, 0x7a, 0x0, 0x0}, 0x200, 0x80000001, 0xffffffffffff4b50}) mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(r1, 0x8250aea6, &(0x7f0000003000-0xb4)=""/180) ioctl$GIO_UNISCRNMAP(r1, 0x4b69, &(0x7f0000000000)=""/213) 2018/02/01 04:11:24 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f0000590000-0x8)='./file0\x00', 0x14) write$selinux_create(r0, &(0x7f000074c000)=@access={'system_u:object_r:dpkg_exec_t:s0', 0x20, '/usr/sbin/cups-browsed', 0x20, 0x32, 0x30, 0x0}, 0x3b) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f00007cf000)='/dev/cuse\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_STATUS(r1, 0xc05c5340, &(0x7f0000b85000)={0x6, 0x100, 0x2, {0x0, 0x0}, 0x0, 0x4, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000801000-0x9)='/dev/ion\x00', 0x0, 0x0) r3 = syz_open_dev$binder(&(0x7f0000233000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r4 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0) r5 = dup2(r3, r4) write$tun(0xffffffffffffffff, &(0x7f0000577000)=@pi={0x0, 0x0, @eth={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x0}, [], {@canfd={0xd, {{0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0, "feb442a1f43ead325d71fed774c8f6028c2a6b79a4e418aa3c5f391769659fef9f596cdade428c389e511eaad39d2ee4334dee9516a31d00510baaf06efc0980"}}}}}, 0x5a) r6 = dup2(r4, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004ee000-0x76)='\x00', 0x1, 0x0, 0x0}], &(0x7f000000b000-0x30)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)=""}) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f00005da000)={0x0, 0x0, &(0x7f00000d8000)=[], 0x48, 0x0, &(0x7f000044c000-0x83)="a410778b7a640ab0384c4ead541b6ee57c5645909ef688d8ac3e5ecfc7039f5f8ba53f127b7f01947cd3689eaf6c090277915bab2a0c450988cb85688e2bcc101a80664d3081fcc0"}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000c5a000)={0x0, 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000a95000-0x30)={0x14, 0x0, &(0x7f0000b8f000)=[@increfs_done={0x40106308, r7, 0x1}], 0x0, 0x0, &(0x7f00002e4000-0x70)=""}) getsockopt$inet6_dccp_buf(r5, 0x21, 0xcf, &(0x7f0000e10000-0xcc)=""/204, &(0x7f000037d000-0x4)=0xcc) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000436000-0x30)={0x20, 0x0, &(0x7f0000136000)=[@dead_binder_done={0x40086310, 0x3}, @increfs_done={0x40106308, r7, 0x0}], 0x0, 0x0, &(0x7f0000888000-0xb)=""}) close(r2) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000002000-0x38)={0x0, 0x0, &(0x7f0000003000)=[], 0x0, &(0x7f0000002000)=[{0x10, 0x10e, 0x0, ""}], 0x10, 0x0}, 0x0) 2018/02/01 04:11:24 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = shmget(0x0, 0x3000, 0x4, &(0x7f0000e86000/0x3000)=nil) getxattr(&(0x7f000088f000)='./file0\x00', &(0x7f00001ab000-0x35)=@random={'system.', '*procwlan0selfvmnet0posix_acl_accessvboxnet1]\x00'}, &(0x7f0000980000-0x1000)=""/4096, 0x1000) r1 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000d68000-0x16)='/selinux/checkreqprot\x00', 0x2, 0x0) ioctl$TCGETS(r1, 0x5401, &(0x7f0000424000-0x24)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) shmctl$IPC_INFO(r0, 0x3, &(0x7f0000564000)=""/4096) 2018/02/01 04:11:24 executing program 2: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000801000-0x9)='/dev/ion\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000233000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_THREAD_EXIT(r1, 0x40046208, 0x0) r2 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) r3 = dup2(r1, r2) write$tun(0xffffffffffffffff, &(0x7f0000577000)=@pi={0x0, 0x0, @eth={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x0}, [], {@canfd={0xd, {{0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0, "feb442a1f43ead325d71fed774c8f6028c2a6b79a4e418aa3c5f391769659fef9f596cdade428c389e511eaad39d2ee4334dee9516a31d00510baaf06efc0980"}}}}}, 0x5a) r4 = dup2(r2, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004ee000-0x76)='\x00', 0x1, 0x0, 0x0}], &(0x7f000000b000-0x30)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)=""}) getsockopt$inet_IP_XFRM_POLICY(r3, 0x0, 0x11, &(0x7f0000ddb000)={{{@in=@multicast2=0x0, @in=@multicast1=0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, {0x0, 0x0, 0x0, 0x0}, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, {{@in6=@dev={0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0xffffffffffffffff, 0x0}, 0xffffffffffffffff, 0x0}, 0x0, @in6=@dev={0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0xffffffffffffffff, 0x0}, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, &(0x7f00007be000-0x4)=0xe8) r6 = ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82) ioctl$LOOP_CTL_REMOVE(r4, 0x4c81, r6) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f000000c000)={{{@in6=@mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x1}, @in=@local={0xac, 0x14, 0x0, 0xaa}, 0x3, 0x3, 0x2, 0x9, 0xa, 0x80, 0x20, 0xff, 0x0, r5}, {0x7fff, 0x0, 0x1f, 0x7, 0x9e9, 0x800, 0x1f, 0x5}, {0x2, 0x101, 0x9, 0x8}, 0x81, 0x5, 0x2, 0x1, 0x3, 0x3}, {{@in6=@local={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0xaa}, 0x3, 0x3f}, 0x0, @in=@multicast1=0xe0000001, 0x3, 0x7, 0x2, 0x5, 0x9, 0xfff, 0x1}}, 0xe8) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00005da000)={0x0, 0x0, &(0x7f00000d8000)=[], 0x48, 0x0, &(0x7f000044c000-0x83)="a410778b7a640ab0384c4ead541b6ee57c5645909ef688d8ac3e5ecfc7039f5f8ba53f127b7f01947cd3689eaf6c090277915bab2a0c450988cb85688e2bcc101a80664d3081fcc0"}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000c5a000)={0x0, 0x0, 0x0, 0x0}) mmap(&(0x7f0000000000/0x13000)=nil, 0x13000, 0x0, 0x32, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000a95000-0x30)={0x14, 0x0, &(0x7f0000b8f000)=[@increfs_done={0x40106308, r7, 0x1}], 0x0, 0x0, &(0x7f00002e4000-0x70)=""}) 2018/02/01 04:11:24 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) sendto$inet(0xffffffffffffffff, &(0x7f0000022000-0x16)="01", 0x1, 0x0, &(0x7f0000031000-0x10)={0x2, 0xffffffffffffffff, @local={0xac, 0x14, 0xffffffffffffffff, 0xaa}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x10) shutdown(0xffffffffffffffff, 0x1) [ 304.142997] binder: 15327:15333 BC_INCREFS_DONE u0000000000000000 no match [ 304.143094] binder: 15327:15333 BC_DEAD_BINDER_DONE 0000000000000003 not found 2018/02/01 04:11:24 executing program 5: mmap(&(0x7f0000000000/0x13000)=nil, 0x13000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000004000-0x38)={&(0x7f0000004000)=@nl=@proc={0x10, 0x0, 0xffffffffffffffff, 0x0}, 0xc, &(0x7f0000002000)=[{&(0x7f0000001000)="5500000018007fafb72d1cb2a4a280930206000000a843096c2623692500080003000149bd50ca8a9848a3c728f1c46b7b31afdc1338d54400009b84136ef75afb83de448daa7227c43ab8220000bf0cec6bab91d4", 0x55}], 0x1, &(0x7f0000004000)=[], 0x0, 0x0}, 0x0) sysfs$1(0x1, &(0x7f000000a000)='@+\x00') mmap(&(0x7f0000013000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000013000)='/dev/audio\x00', 0x459a40eff64bf431, 0x0) mmap(&(0x7f0000013000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$KVM_GET_LAPIC(r1, 0x8400ae8e, &(0x7f0000014000-0x400)={"18f6da74263a7be979fb3c9a83416601623767c339f71310e12ba43533d81b483da522c4102b8d0f4f6390053bc3a4971b18c4bffe2c645cfcfe688c3d01df6bc09118ca1619989f2373caa2a882af05ab14a41fc3c29ab5a6d9d8f23885c6b5c82454ea84c108b2087a910acb384d0c7910ca02b54683f0396b3674489cd599f81b9fc19a6b9fe27185acacb6fb2b661e42757f913233e90e8cdddf4b34a63b3ef8aec3d47e59fc6bca4de864d021fd353005d28f3a9e3305e1218af513e72c25c8bd656e3086bde841674966133cefda0e3f833f6dcabbc938e181f4b10a33eb9e607b74c534b9b9aed74842d3da1175200eebd55239504d80c7e1cd5cbb53c823a90fbf8a3b740ef1813bf13772142dbc08f1d1b3dee250efea72a7c1a7b03b69165396fb17ef8785e9595c5885b5f048651d89677922071ecf59e276ee51696fee40e0f589a507714fd4dc1ba80079bf1f0fce3e0a6012abe012cb3d6023fef5f62a3fedc67faab8f99fd0526984064b2ae4ecce9913ef801aebd5525e88a6988abf5429bcc70523b355c0af87905f8666b0b8efb0559f0e618af6e7ea34efa52be2d796c9c987bf09bf1df040a26671af40f08df111894fcc633d5cc5814315d180b7c73888b053d54dde1fc8e1085fda243971a476b819f60037b92ed7fc9d021164e332702dc760f05c2cbab6a0df980968899fb467b367ca8261f4aaa1f95d3a977e7edb1674fe4b3f3e81ce9b0ec8aab9694d95d3347d535e553b70990eb534bd92b6d8319cd59f6318984a0de577697cc89f493b20a98b5dfc37ae5e0790ef7b64c5492931a40581a72afb83840a63d7a14ab9a4f754323e7fbac0f6543446494a28835c4e466453323fc35b66b92f2252fea8aa4fed2d77eb9ba72929103a0f7adde976808555af7ae97aa16a5788ecb985b8c56eb0f057a01b482277507cca518ed3c869b1090ca6ed954893c4eea4714b6fa260b14144e4a608c7ba5c3402f83ffa8c1a59979b8b683f920e1887c63ab771f4e7c71de9b4b8c1fca8217590d85415fb65c5acfc621f4c1a721c944398cd40fd0aa6ab240267f8ae4fa36c88c1850b7eb49bcb9aa45f2adba6cbec7535b283bc37fef35e276ba696587437db3f2636d73b7ee3679b45157fd992f4a1884e7f11121dca516e4c83e96d60eb2eb18158f81268ec5e380eadcf6df36642b4b512c9f11272613cfbf21e2c94c9ee131659ab2533466ab094e77dfe4506fa282d787246c1ee26fbe37a2d71b94f2b3941852d94a94a85fca18bef8f4699a2899ce40746d968cc9dcb53ea8fab387d755e8d2914428d0cffa0940741871fbbd4b2a07fa97b7c476ccaec8b3ebe04db6bf0f5289bff8194ae68ac54f19e49029c0b2f7aa6062fe9f9140ed81ccd6db08201bd95a73c88cc714418476358d964402ef4235defbc94e6960e"}) mmap(&(0x7f0000013000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r2 = creat(&(0x7f000000f000)='./file0\x00', 0x10) mmap(&(0x7f0000014000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$EVIOCRMFF(r2, 0x40044581, &(0x7f0000014000)=0x7) ioctl$KDDELIO(r2, 0x4b35, 0x4) r3 = syz_open_dev$midi(&(0x7f0000014000-0xb)='/dev/midi#\x00', 0x80000000, 0x40080) mmap(&(0x7f0000013000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) write$selinux_validatetrans(r3, &(0x7f0000013000)={'system_u:object_r:pam_exec_t:s0', 0x20, 'system_u:object_r:hald_cache_t:s0', 0x20, 0x31, 0x37, 0x20, '/usr/lib/telepathy/mission-control-5\x00'}, 0x6a) 2018/02/01 04:11:24 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f0000590000-0x8)='./file0\x00', 0x14) write$selinux_create(r0, &(0x7f000074c000)=@access={'system_u:object_r:dpkg_exec_t:s0', 0x20, '/usr/sbin/cups-browsed', 0x20, 0x32, 0x30, 0x0}, 0x3b) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f00007cf000)='/dev/cuse\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_STATUS(r1, 0xc05c5340, &(0x7f0000b85000)={0x6, 0x100, 0x2, {0x0, 0x0}, 0x0, 0x4, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000801000-0x9)='/dev/ion\x00', 0x0, 0x0) r3 = syz_open_dev$binder(&(0x7f0000233000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r4 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0) r5 = dup2(r3, r4) write$tun(0xffffffffffffffff, &(0x7f0000577000)=@pi={0x0, 0x0, @eth={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x0}, [], {@canfd={0xd, {{0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0, "feb442a1f43ead325d71fed774c8f6028c2a6b79a4e418aa3c5f391769659fef9f596cdade428c389e511eaad39d2ee4334dee9516a31d00510baaf06efc0980"}}}}}, 0x5a) r6 = dup2(r4, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004ee000-0x76)='\x00', 0x1, 0x0, 0x0}], &(0x7f000000b000-0x30)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)=""}) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f00005da000)={0x0, 0x0, &(0x7f00000d8000)=[], 0x48, 0x0, &(0x7f000044c000-0x83)="a410778b7a640ab0384c4ead541b6ee57c5645909ef688d8ac3e5ecfc7039f5f8ba53f127b7f01947cd3689eaf6c090277915bab2a0c450988cb85688e2bcc101a80664d3081fcc0"}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000c5a000)={0x0, 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000a95000-0x30)={0x14, 0x0, &(0x7f0000b8f000)=[@increfs_done={0x40106308, r7, 0x1}], 0x0, 0x0, &(0x7f00002e4000-0x70)=""}) getsockopt$inet6_dccp_buf(r5, 0x21, 0xcf, &(0x7f0000e10000-0xcc)=""/204, &(0x7f000037d000-0x4)=0xcc) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000436000-0x30)={0x20, 0x0, &(0x7f0000136000)=[@dead_binder_done={0x40086310, 0x3}, @increfs_done={0x40106308, r7, 0x0}], 0x0, 0x0, &(0x7f0000888000-0xb)=""}) close(r2) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000002000-0x38)={0x0, 0x0, &(0x7f0000003000)=[], 0x0, &(0x7f0000002000)=[{0x10, 0x10e, 0x0, ""}], 0x10, 0x0}, 0x0) 2018/02/01 04:11:24 executing program 3: mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mq_open(&(0x7f0000000000)='\x00', 0x80, 0x1, &(0x7f0000001000-0x40)={0xfffffffffffffff7, 0x7, 0xe39, 0xff, 0x0, 0x2, 0xf2c, 0x7fffffff}) r0 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/checkreqprot\x00', 0x400, 0x0) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r0, 0x84, 0x8, &(0x7f0000000000)=0x0, &(0x7f0000000000)=0x4) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000001000)=[{&(0x7f0000000000)="d7f8e0081598b8b57426fcc84157918755ece36410816150bc3f4e43a1a11f4c73bcf42373d5e444fd7658439d7e27c2e852d502b2ad7f2a7500fb0a59063e59932ebedae648f49849b4f9c07c7b9d15579189837a9a8561a763646768f4c41d19ccd9cd19a90d7530d8a2a3ac89e634f69fb374d3e62f5155dfee30a71493c06b5eb35f71cc", 0x86}, {&(0x7f0000001000-0x15)="ddcfedc455a3e829f1c5ca193d085d2a786804e481", 0x15}, {&(0x7f0000001000)="", 0x0}, {&(0x7f0000002000-0x2d)="787140184977fe796837a00fd2ea094b02f08c4e45cae02c13367072dcfa392d86f84cb5026b6c7fe3d577b3ad", 0x2d}, {&(0x7f0000001000)="94a0fdd7e3b1149d51b8a3d28cd3f6ebdf9c2a2ecf661e", 0x17}, {&(0x7f0000001000-0xe5)="0009c56d7811f0c5301af820d1ba7e950dd31c23b645b1abc0257ea545c1ad782ea8e23423252ec7a2cfa2144b2aeb68778b82779a08e6979660f266433d13e0f518fe3374da0f53dd626144bb4b44ec02fcc32373ff2a49b97681fad2c94275484207ee3279f7fe6941b7029a102eebe89956d93df0dc7dea77ff724f5a452b9d5597153081849a609fc9e79df104c05a0f45f9143d57c56b16f86cd8de848ad541f47196d153df00d87d01b357ace693b5bfda4f2a624b283596be3abee71a3d6e19cb2140e93cae3dbadc0e0d2b32c178af9b17f22f780aa5616956d881f090cb5edda3", 0xe5}, {&(0x7f0000002000-0x5b)="4ae3785ea9d98b7e0b748ea7b31a382243f9e65163c20b987c0d166de52bd11de9d78cf7a2692bf4cf5605ca0ab23fcb4057e3995bd8f3d090793fef92e6a59217dc8c0abc2f26e04d980b76846f2093b7978cc5dd84d8e013367b", 0x5b}], 0x7, 0x0, 0x0, 0x20000080}, 0x44000) ioctl$KVM_DEASSIGN_PCI_DEVICE(r0, 0x4040ae72, &(0x7f0000001000-0x14)={0x2, 0x100000000, 0x4, 0x1, 0x9}) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) getsockopt$bt_rfcomm_RFCOMM_CONNINFO(r0, 0x12, 0x2, &(0x7f000058b000)=""/1, &(0x7f0000001000-0x4)=0x1) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$mice(&(0x7f0000a86000)='/dev/input/mice\x00', 0x0, 0x0) r2 = syz_open_dev$evdev(&(0x7f0000058000-0x12)='/dev/input/event#\x00', 0xafd, 0x8000040000001) write$selinux_load(r0, &(0x7f0000f33000)={0xf97cff8c, 0x8, 'SE Linux', "e648913e83d14d2378f4d1427b1ceecb14ee5c2c53aabd3a38b97b82cc2c5f70108db3506237af76d88873892559e6a5768d2c828fe0673c8eddd7117a6bd347e97d31d92abeef19260db0b1d8558d0d257f13be22600ff580f483f13c83da198a66e61c7a78b67c24b1f94643b411c8b6dec1efc857579ea8cea92465c6bb62a6d58a23ef8ea6501401a32ac4db813d42a1107eb4d025af1ccfda4cb058efca00a3e7f62cc054cb447612121d613f92e44900ab1e390ba8162a8e4900a34e83b9dfe76c842bea0ae88cb919ed0eb1473611dfdd42e6fd735689aae13be56d993647480fb6f7386a64e85055a87ec4158241"}, 0x102) ioctl$KDMKTONE(r1, 0x4b30, 0x10000) ioctl$sock_bt_hidp_HIDPCONNDEL(r1, 0x400448c9, &(0x7f00000f7000-0xc)={{0x1, 0x1ff, 0x800, 0x7f, 0x7fff, 0x3}, 0xfffffffffffffffb}) setsockopt$inet6_MCAST_JOIN_GROUP(r1, 0x29, 0x2a, &(0x7f0000196000)={0x8744, {{0xa, 0x2, 0x9, @local={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0xaa}, 0xff}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}}, 0x88) r3 = perf_event_open(&(0x7f000001d000)={0x2, 0x78, 0xe2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000dcc000-0x1)=0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) write$evdev(r2, &(0x7f000013e000)=[{{0x0, 0x0}, 0x0, 0x100000001, 0x0}, {{0x0, 0x0}, 0x0, 0x0, 0x0}], 0x30) accept4$packet(r0, &(0x7f0000b50000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={[0x0, 0x0, 0x0, 0x0], 0xffffffffffffffff, 0x0}, [0x0, 0x0]}, &(0x7f000007a000)=0x14, 0x800) socket$inet6_sctp(0xa, 0x1, 0x84) ioctl$sock_inet_tcp_SIOCINQ(r3, 0x541b, &(0x7f000028d000-0x4)=0x0) recvfrom$packet(r1, &(0x7f00005d8000)=""/4096, 0x1000, 0x2062, &(0x7f00007c3000)={0x11, 0xc, r4, 0x1, 0x1, 0x6, @dev={[0xaa, 0xaa, 0xaa, 0xaa], 0x0, 0xb}, [0x0, 0x0]}, 0x14) 2018/02/01 04:11:24 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) seccomp(0x1, 0x0, &(0x7f000089b000-0x10)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x407ffc0003}]}) shmctl$IPC_INFO(0x0, 0x3, &(0x7f0000564000)=""/4096) seccomp(0x1, 0x0, &(0x7f0000833000-0x10)={0x4, &(0x7f00006ff000)=[{0x4, 0xc0000000, 0x9, 0x7}, {0x64c05e6e, 0x4, 0x7, 0x0}, {0x1, 0x2, 0x3, 0x6}, {0x0, 0x6, 0x6, 0x0}]}) socketpair$inet6_tcp(0xa, 0x1, 0x0, &(0x7f0000d0f000-0x8)={0x0, 0x0}) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f00004d9000)={0x3, &(0x7f0000163000-0x18)=[{0x394, 0x1ff, 0x4df9af1a, 0x3}, {0x100000001, 0xd1, 0x6, 0x10001}, {0x2, 0x5, 0x7, 0x0}]}, 0x10) 2018/02/01 04:11:24 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) sendto$inet(0xffffffffffffffff, &(0x7f0000022000-0x16)="01", 0x1, 0x0, &(0x7f0000031000-0x10)={0x2, 0xffffffffffffffff, @local={0xac, 0x14, 0xffffffffffffffff, 0xaa}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x10) shutdown(0xffffffffffffffff, 0x1) 2018/02/01 04:11:24 executing program 1: openat$ion(0xffffffffffffff9c, &(0x7f0000801000-0x9)='/dev/ion\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000233000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) write$tun(0xffffffffffffffff, &(0x7f0000577000)=@pi={0x0, 0x0, @eth={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x0}, [], {@canfd={0xd, {{0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0, "feb442a1f43ead325d71fed774c8f6028c2a6b79a4e418aa3c5f391769659fef9f596cdade428c389e511eaad39d2ee4334dee9516a31d00510baaf06efc0980"}}}}}, 0x5a) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004ee000-0x76)='\x00', 0x1, 0x0, 0x0}], &(0x7f000000b000-0x30)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)=""}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00005da000)={0x0, 0x0, &(0x7f00000d8000)=[], 0x48, 0x0, &(0x7f000044c000-0x83)="a410778b7a640ab0384c4ead541b6ee57c5645909ef688d8ac3e5ecfc7039f5f8ba53f127b7f01947cd3689eaf6c090277915bab2a0c450988cb85688e2bcc101a80664d3081fcc0"}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000c5a000)={0x0, 0x0, 0x0, 0x0}) mmap(&(0x7f0000000000/0x13000)=nil, 0x13000, 0x0, 0x32, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000a95000-0x30)={0x14, 0x0, &(0x7f0000b8f000)=[@increfs_done={0x40106308, r2, 0x1}], 0x0, 0x0, &(0x7f00002e4000-0x70)=""}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000436000-0x30)={0x20, 0x0, &(0x7f0000136000)=[@dead_binder_done={0x40086310, 0x3}, @increfs_done={0x40106308, r2, 0x0}], 0x0, 0x0, &(0x7f0000888000-0xb)=""}) [ 304.143101] binder: 15327:15333 BC_INCREFS_DONE u0000000000000000 no match [ 304.156796] binder: 15321:15324 BC_INCREFS_DONE u0000000000000000 no match [ 304.274005] QAT: Invalid ioctl [ 304.283906] binder: BINDER_SET_CONTEXT_MGR already set 2018/02/01 04:11:24 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f0000590000-0x8)='./file0\x00', 0x14) write$selinux_create(r0, &(0x7f000074c000)=@access={'system_u:object_r:dpkg_exec_t:s0', 0x20, '/usr/sbin/cups-browsed', 0x20, 0x32, 0x30, 0x0}, 0x3b) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f00007cf000)='/dev/cuse\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_STATUS(r1, 0xc05c5340, &(0x7f0000b85000)={0x6, 0x100, 0x2, {0x0, 0x0}, 0x0, 0x4, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000801000-0x9)='/dev/ion\x00', 0x0, 0x0) r3 = syz_open_dev$binder(&(0x7f0000233000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r4 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0) r5 = dup2(r3, r4) write$tun(0xffffffffffffffff, &(0x7f0000577000)=@pi={0x0, 0x0, @eth={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x0}, [], {@canfd={0xd, {{0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0, "feb442a1f43ead325d71fed774c8f6028c2a6b79a4e418aa3c5f391769659fef9f596cdade428c389e511eaad39d2ee4334dee9516a31d00510baaf06efc0980"}}}}}, 0x5a) r6 = dup2(r4, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004ee000-0x76)='\x00', 0x1, 0x0, 0x0}], &(0x7f000000b000-0x30)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)=""}) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f00005da000)={0x0, 0x0, &(0x7f00000d8000)=[], 0x48, 0x0, &(0x7f000044c000-0x83)="a410778b7a640ab0384c4ead541b6ee57c5645909ef688d8ac3e5ecfc7039f5f8ba53f127b7f01947cd3689eaf6c090277915bab2a0c450988cb85688e2bcc101a80664d3081fcc0"}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000c5a000)={0x0, 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000a95000-0x30)={0x14, 0x0, &(0x7f0000b8f000)=[@increfs_done={0x40106308, r7, 0x1}], 0x0, 0x0, &(0x7f00002e4000-0x70)=""}) getsockopt$inet6_dccp_buf(r5, 0x21, 0xcf, &(0x7f0000e10000-0xcc)=""/204, &(0x7f000037d000-0x4)=0xcc) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000436000-0x30)={0x20, 0x0, &(0x7f0000136000)=[@dead_binder_done={0x40086310, 0x3}, @increfs_done={0x40106308, r7, 0x0}], 0x0, 0x0, &(0x7f0000888000-0xb)=""}) close(r2) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000002000-0x38)={0x0, 0x0, &(0x7f0000003000)=[], 0x0, &(0x7f0000002000)=[{0x10, 0x10e, 0x0, ""}], 0x10, 0x0}, 0x0) [ 304.283918] binder: 15343:15352 ioctl 40046207 0 returned -16 [ 304.285331] binder_alloc: 15097: binder_alloc_buf, no vma [ 304.285354] binder: 15343:15352 transaction failed 29189/-3, size 40-8 line 2903 [ 304.287730] binder: 15343:15352 BC_DEAD_BINDER_DONE 0000000000000003 not found [ 304.287741] binder: 15343:15352 BC_INCREFS_DONE u0000000000000000 no match [ 304.291082] binder: BINDER_SET_CONTEXT_MGR already set [ 304.291091] binder: 15346:15348 ioctl 40046207 0 returned -16 [ 304.291614] binder_alloc: 15097: binder_alloc_buf, no vma [ 304.291640] binder: 15346:15348 transaction failed 29189/-3, size 40-8 line 2903 [ 304.328385] QAT: Invalid ioctl [ 304.332804] binder: BINDER_SET_CONTEXT_MGR already set [ 304.332818] binder: 15343:15352 ioctl 40046207 0 returned -16 [ 304.334623] binder: BINDER_SET_CONTEXT_MGR already set [ 304.334637] binder: 15350:15359 ioctl 40046207 0 returned -16 [ 304.343530] binder_alloc: 15097: binder_alloc_buf, no vma [ 304.343558] binder: 15350:15359 transaction failed 29189/-3, size 40-8 line 2903 [ 304.345419] binder: BINDER_SET_CONTEXT_MGR already set [ 304.345429] binder: 15361:15363 ioctl 40046207 0 returned -16 [ 304.345786] binder_alloc: 15097: binder_alloc_buf, no vma [ 304.345808] binder: 15361:15363 transaction failed 29189/-3, size 40-8 line 2903 [ 304.349350] binder: 15350:15359 BC_INCREFS_DONE u0000000000000000 no match [ 304.355805] binder_alloc: 15097: binder_alloc_buf, no vma [ 304.355833] binder: 15343:15352 transaction failed 29189/-3, size 40-8 line 2903 [ 304.409248] binder: BINDER_SET_CONTEXT_MGR already set [ 304.409260] binder: 15350:15377 ioctl 40046207 0 returned -16 [ 304.415571] binder_alloc: 15097: binder_alloc_buf, no vma [ 304.415617] binder: 15350:15353 transaction failed 29189/-3, size 40-8 line 2903 [ 304.418905] binder: BINDER_SET_CONTEXT_MGR already set [ 304.418913] binder: 15373:15374 ioctl 40046207 0 returned -16 [ 304.419652] binder_alloc: 15097: binder_alloc_buf, no vma [ 304.419674] binder: 15373:15374 transaction failed 29189/-3, size 40-8 line 2903 [ 304.455685] binder: BINDER_SET_CONTEXT_MGR already set [ 304.455694] binder: 15375:15380 ioctl 40046207 0 returned -16 [ 304.468911] binder_alloc: 15097: binder_alloc_buf, no vma [ 304.468936] binder: 15375:15380 transaction failed 29189/-3, size 40-8 line 2903 [ 304.471091] binder: 15375:15380 BC_INCREFS_DONE u0000000000000000 no match [ 304.471173] binder: 15375:15380 BC_DEAD_BINDER_DONE 0000000000000003 not found [ 304.471181] binder: 15375:15380 BC_INCREFS_DONE u0000000000000000 no match [ 304.491591] binder: BINDER_SET_CONTEXT_MGR already set [ 304.491602] binder: 15375:15380 ioctl 40046207 0 returned -16 [ 304.501985] binder_alloc: 15097: binder_alloc_buf, no vma [ 304.502222] binder: 15375:15380 transaction failed 29189/-3, size 40-8 line 2903 [ 304.507532] binder: 15375:15388 BC_INCREFS_DONE u0000000000000000 no match [ 304.549101] binder: BINDER_SET_CONTEXT_MGR already set [ 304.549111] binder: 15396:15404 ioctl 40046207 0 returned -16 [ 304.556176] binder: 15396:15404 ioctl 80404521 200ec000 returned -22 [ 304.556355] binder_alloc: 15097: binder_alloc_buf, no vma [ 304.556376] binder: 15396:15404 transaction failed 29189/-3, size 40-8 line 2903 [ 304.560169] binder: BINDER_SET_CONTEXT_MGR already set [ 304.560178] binder: 15395:15401 ioctl 40046207 0 returned -16 [ 304.561911] binder: BINDER_SET_CONTEXT_MGR already set [ 304.561918] binder: 15398:15405 ioctl 40046207 0 returned -16 [ 304.561991] binder_alloc: 15097: binder_alloc_buf, no vma [ 304.562042] binder: 15395:15401 transaction failed 29189/-3, size 40-8 line 2903 [ 304.570178] binder_alloc: 15097: binder_alloc_buf, no vma [ 304.570202] binder: 15398:15405 transaction failed 29189/-3, size 40-8 line 2903 [ 304.571080] binder: 15396:15404 BC_INCREFS_DONE u0000000000000000 no match [ 304.576384] binder: 15398:15405 BC_INCREFS_DONE u0000000000000000 no match [ 304.576454] binder: 15398:15405 ioctl 40046205 8 returned -22 [ 304.576514] binder: 15398:15405 BC_DEAD_BINDER_DONE 0000000000000003 not found [ 304.576522] binder: 15398:15405 BC_INCREFS_DONE u0000000000000000 no match [ 304.611142] binder: BINDER_SET_CONTEXT_MGR already set [ 304.611154] binder: 15396:15404 ioctl 40046207 0 returned -16 [ 304.613243] binder: 15396:15411 ioctl 80404521 200ec000 returned -22 [ 304.615316] binder_alloc: 15097: binder_alloc_buf, no vma [ 304.615340] binder: 15396:15411 transaction failed 29189/-3, size 40-8 line 2903 [ 304.626926] binder: BINDER_SET_CONTEXT_MGR already set [ 304.626936] binder: 15417:15418 ioctl 40046207 0 returned -16 [ 304.627107] binder: 15396:15422 BC_INCREFS_DONE u0000000000000000 no match [ 304.628419] binder_alloc: 15097: binder_alloc_buf, no vma [ 304.628441] binder: 15417:15418 transaction failed 29189/-3, size 40-8 line 2903 [ 304.644124] binder: BINDER_SET_CONTEXT_MGR already set [ 304.644136] binder: 15398:15405 ioctl 40046207 0 returned -16 [ 304.647605] binder_alloc: 15097: binder_alloc_buf, no vma [ 304.647631] binder: 15398:15405 transaction failed 29189/-3, size 40-8 line 2903 [ 304.650829] binder: 15398:15412 ioctl 40046205 8 returned -22 [ 304.679300] binder: BINDER_SET_CONTEXT_MGR already set [ 304.679309] binder: 15427:15429 ioctl 40046207 0 returned -16 [ 304.679697] binder_alloc: 15097: binder_alloc_buf, no vma [ 304.679720] binder: 15427:15429 transaction failed 29189/-3, size 40-8 line 2903 [ 304.700155] binder: BINDER_SET_CONTEXT_MGR already set [ 304.700164] binder: 15431:15434 ioctl 40046207 0 returned -16 [ 304.701072] binder_alloc: 15097: binder_alloc_buf, no vma [ 304.701094] binder: 15431:15434 transaction failed 29189/-3, size 40-8 line 2903 [ 304.708973] binder: 15431:15434 BC_INCREFS_DONE u0000000000000000 no match [ 304.717567] binder: BINDER_SET_CONTEXT_MGR already set [ 304.717576] binder: 15431:15434 ioctl 40046207 0 returned -16 [ 304.718429] binder_alloc: 15097: binder_alloc_buf, no vma [ 304.718450] binder: 15431:15434 transaction failed 29189/-3, size 40-8 line 2903 [ 304.720233] binder: 15431:15434 BC_INCREFS_DONE u0000000000000000 no match [ 304.792235] binder: BINDER_SET_CONTEXT_MGR already set [ 304.792244] binder: 15439:15443 ioctl 40046207 0 returned -16 [ 304.793507] binder_alloc: 15097: binder_alloc_buf, no vma [ 304.793535] binder: 15439:15443 transaction failed 29189/-3, size 40-8 line 2903 [ 304.795680] binder: 15439:15443 BC_INCREFS_DONE u0000000000000000 no match [ 304.795993] binder: 15439:15443 BC_DEAD_BINDER_DONE 0000000000000003 not found [ 304.796006] binder: 15439:15443 BC_INCREFS_DONE u0000000000000000 no match [ 304.796486] sctp: [Deprecated]: syz-executor5 (pid 15446) Use of int in maxseg socket option. [ 304.796486] Use struct sctp_assoc_value instead [ 304.804405] binder: BINDER_SET_CONTEXT_MGR already set [ 304.804415] binder: 15445:15447 ioctl 40046207 0 returned -16 [ 304.806088] binder_alloc: 15097: binder_alloc_buf, no vma [ 304.806113] binder: 15445:15447 transaction failed 29189/-3, size 40-8 line 2903 [ 304.808305] binder: BINDER_SET_CONTEXT_MGR already set [ 304.808313] binder: 15449:15453 ioctl 40046207 0 returned -16 [ 304.809518] binder_alloc: 15097: binder_alloc_buf, no vma [ 304.809540] binder: 15449:15453 transaction failed 29189/-3, size 40-8 line 2903 [ 304.814160] binder: 15449:15453 ioctl 4c82 0 returned -22 [ 304.814221] binder: 15449:15453 ioctl 4c81 ffffffffffffffff returned -22 [ 304.816326] sctp: [Deprecated]: syz-executor5 (pid 15452) Use of int in maxseg socket option. [ 304.816326] Use struct sctp_assoc_value instead [ 304.817149] binder: 15449:15453 BC_INCREFS_DONE u0000000000000000 no match 2018/02/01 04:11:25 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000a8d000)={&(0x7f0000e4e000)={0x10, 0x0, 0x0, 0x0}, 0xc, &(0x7f0000fcf000-0x10)={&(0x7f00005d5000)=@updsa={0x104, 0x1a, 0x1, 0xffffffffffffffff, 0xffffffffffffffff, {{@in6=@local={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0xffffffffffffffff, 0xaa}, @in=@dev={0xac, 0x14, 0xffffffffffffffff, 0x0}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0}, {@in=@broadcast=0xffffffff, 0xffffffffffffffff, 0x2b}, @in=@multicast2=0xe0000002, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, {0x0, 0x0, 0x0, 0x0}, {0x0, 0x0, 0x0}, 0xffffffffffffffff, 0xffffffffffffffff, 0xa, 0x2, 0x0, 0x0}, [@coaddr={0x14, 0xe, @in=@remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}}]}, 0x104}, 0x1, 0x0, 0x0, 0x0}, 0x0) syz_open_dev$evdev(&(0x7f0000200000-0x12)='/dev/input/event#\x00', 0x8, 0x282000) 2018/02/01 04:11:25 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x803, 0x8010000200000087) fcntl$setflags(r0, 0x2, 0x1) r1 = syz_open_dev$dmmidi(&(0x7f0000c9e000)='/dev/dmmidi#\x00', 0x80000000, 0x111000) ioctl$KVM_KVMCLOCK_CTRL(r1, 0xaead) setsockopt$bt_BT_CHANNEL_POLICY(r1, 0x112, 0xa, &(0x7f0000feb000-0x4)=0x1, 0x4) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000ce6000)={r1, 0x50, &(0x7f0000895000-0x50)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16}}, 0x10) sendmsg(r0, &(0x7f0000b11000)={&(0x7f0000d34000-0x1c)=@in6={0xa, 0xffffffffffffffff, 0x0, @remote={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0xffffffffffffffff, 0xbb}, 0x0}, 0x1c, &(0x7f0000be7000)=[{&(0x7f0000e3e000-0x42)="a8ea62", 0x3}], 0x1, &(0x7f000034d000)=[], 0x0, 0x0}, 0x0) 2018/02/01 04:11:25 executing program 2: openat$ion(0xffffffffffffff9c, &(0x7f0000801000-0x9)='/dev/ion\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000233000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) syz_open_dev$sndctrl(&(0x7f000076b000-0xf)='/dev/snd/controlC#\x00', 0x800, 0x400000) dup2(r0, r1) write$tun(0xffffffffffffffff, &(0x7f0000577000)=@pi={0x0, 0x0, @eth={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x0}, [], {@canfd={0xd, {{0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0, "feb442a1f43ead325d71fed774c8f6028c2a6b79a4e418aa3c5f391769659fef9f596cdade428c389e511eaad39d2ee4334dee9516a31d00510baaf06efc0980"}}}}}, 0x5a) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004ee000-0x76)='\x00', 0x1, 0x0, 0x0}], &(0x7f000000b000-0x30)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)=""}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00005da000)={0x0, 0x0, &(0x7f00000d8000)=[], 0x48, 0x0, &(0x7f000044c000-0x83)="a410778b7a640ab0384c4ead541b6ee57c5645909ef688d8ac3e5ecfc7039f5f8ba53f127b7f01947cd3689eaf6c090277915bab2a0c450988cb85688e2bcc101a80664d3081fcc0"}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000c5a000)={0x0, 0x0, 0x0, 0x0}) mmap(&(0x7f0000000000/0x13000)=nil, 0x13000, 0x0, 0x32, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000a95000-0x30)={0x14, 0x0, &(0x7f0000b8f000)=[@increfs_done={0x40106308, r3, 0x1}], 0x0, 0x0, &(0x7f00002e4000-0x70)=""}) 2018/02/01 04:11:25 executing program 7: r0 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r0, &(0x7f0000022000-0x16)="01", 0x1, 0x0, &(0x7f0000031000-0x10)={0x2, 0xffffffffffffffff, @local={0xac, 0x14, 0xffffffffffffffff, 0xaa}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x10) shutdown(r0, 0x1) 2018/02/01 04:11:25 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f0000590000-0x8)='./file0\x00', 0x14) write$selinux_create(r0, &(0x7f000074c000)=@access={'system_u:object_r:dpkg_exec_t:s0', 0x20, '/usr/sbin/cups-browsed', 0x20, 0x32, 0x30, 0x0}, 0x3b) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f00007cf000)='/dev/cuse\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_STATUS(r1, 0xc05c5340, &(0x7f0000b85000)={0x6, 0x100, 0x2, {0x0, 0x0}, 0x0, 0x4, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000801000-0x9)='/dev/ion\x00', 0x0, 0x0) r3 = syz_open_dev$binder(&(0x7f0000233000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r4 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0) r5 = dup2(r3, r4) write$tun(0xffffffffffffffff, &(0x7f0000577000)=@pi={0x0, 0x0, @eth={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x0}, [], {@canfd={0xd, {{0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0, "feb442a1f43ead325d71fed774c8f6028c2a6b79a4e418aa3c5f391769659fef9f596cdade428c389e511eaad39d2ee4334dee9516a31d00510baaf06efc0980"}}}}}, 0x5a) r6 = dup2(r4, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004ee000-0x76)='\x00', 0x1, 0x0, 0x0}], &(0x7f000000b000-0x30)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)=""}) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f00005da000)={0x0, 0x0, &(0x7f00000d8000)=[], 0x48, 0x0, &(0x7f000044c000-0x83)="a410778b7a640ab0384c4ead541b6ee57c5645909ef688d8ac3e5ecfc7039f5f8ba53f127b7f01947cd3689eaf6c090277915bab2a0c450988cb85688e2bcc101a80664d3081fcc0"}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000c5a000)={0x0, 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000a95000-0x30)={0x0, 0x0, &(0x7f0000b8f000)=[], 0x0, 0x0, &(0x7f00002e4000-0x70)=""}) getsockopt$inet6_dccp_buf(r5, 0x21, 0xcf, &(0x7f0000e10000-0xcc)=""/204, &(0x7f000037d000-0x4)=0xcc) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000436000-0x30)={0x20, 0x0, &(0x7f0000136000)=[@dead_binder_done={0x40086310, 0x3}, @increfs_done={0x40106308, r7, 0x0}], 0x0, 0x0, &(0x7f0000888000-0xb)=""}) close(r2) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000002000-0x38)={0x0, 0x0, &(0x7f0000003000)=[], 0x0, &(0x7f0000002000)=[{0x10, 0x10e, 0x0, ""}], 0x10, 0x0}, 0x0) 2018/02/01 04:11:25 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) seccomp(0x1, 0x0, &(0x7f000089b000-0x10)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x407ffc0003}]}) shmctl$IPC_INFO(0x0, 0x3, &(0x7f0000564000)=""/4096) r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000642000-0xf)='/dev/sequencer\x00', 0x82000, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000d3c000-0x28)={@generic="fb69242f4d93774486f28573f7f37b62", 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000b48000-0x14)={@local={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0xaa}, r1}, 0x14) 2018/02/01 04:11:25 executing program 1: openat$ion(0xffffffffffffff9c, &(0x7f0000801000-0x9)='/dev/ion\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000233000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x8) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) write$tun(0xffffffffffffffff, &(0x7f0000577000)=@pi={0x0, 0x0, @eth={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x0}, [], {@canfd={0xd, {{0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0, "feb442a1f43ead325d71fed774c8f6028c2a6b79a4e418aa3c5f391769659fef9f596cdade428c389e511eaad39d2ee4334dee9516a31d00510baaf06efc0980"}}}}}, 0x5a) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004ee000-0x76)='\x00', 0x1, 0x0, 0x0}], &(0x7f000000b000-0x30)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)=""}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00005da000)={0x0, 0x0, &(0x7f00000d8000)=[], 0x48, 0x0, &(0x7f000044c000-0x83)="a410778b7a640ab0384c4ead541b6ee57c5645909ef688d8ac3e5ecfc7039f5f8ba53f127b7f01947cd3689eaf6c090277915bab2a0c450988cb85688e2bcc101a80664d3081fcc0"}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000c5a000)={0x0, 0x0, 0x0, 0x0}) mmap(&(0x7f0000000000/0x13000)=nil, 0x13000, 0x0, 0x32, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000a95000-0x30)={0x14, 0x0, &(0x7f0000b8f000)=[@increfs_done={0x40106308, r3, 0x1}], 0x0, 0x0, &(0x7f00002e4000-0x70)=""}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000436000-0x30)={0x20, 0x0, &(0x7f0000136000)=[@dead_binder_done={0x40086310, 0x3}, @increfs_done={0x40106308, r3, 0x0}], 0x0, 0x0, &(0x7f0000888000-0xb)=""}) 2018/02/01 04:11:25 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f00004da000)={0x0, 0x0, 0x0}, 0x4) r1 = socket$packet(0x11, 0x3, 0x300) r2 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000808000-0x4)={0x9, 0x0, 0x3000}, 0x4) setsockopt$packet_fanout(r2, 0x107, 0x12, &(0x7f000007b000-0x4)={0x0, 0x0, 0x0}, 0x4) r3 = getpid() ioctl$sock_FIOSETOWN(r1, 0x8901, &(0x7f0000cde000)=r3) 2018/02/01 04:11:25 executing program 7: r0 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r0, &(0x7f0000022000-0x16)="01", 0x1, 0x0, &(0x7f0000031000-0x10)={0x2, 0xffffffffffffffff, @local={0xac, 0x14, 0xffffffffffffffff, 0xaa}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x10) shutdown(r0, 0x1) [ 304.829497] binder: BINDER_SET_CONTEXT_MGR already set [ 304.829508] binder: 15439:15455 ioctl 40046207 0 returned -16 [ 304.834829] binder_alloc: 15097: binder_alloc_buf, no vma [ 304.834854] binder: 15439:15443 transaction failed 29189/-3, size 40-8 line 2903 [ 304.837138] binder: BINDER_SET_CONTEXT_MGR already set [ 304.837148] binder: 15449:15459 ioctl 40046207 0 returned -16 2018/02/01 04:11:25 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000cb4000-0x8)='./file0\x00', 0x0) r0 = open(&(0x7f0000625000)='./file0\x00', 0x0, 0x0) mkdirat(r0, &(0x7f0000644000-0x8)='./file0\x00', 0x0) r1 = open$dir(&(0x7f00004db000-0x8)='./file0\x00', 0x0, 0x0) r2 = openat(r1, &(0x7f000029f000-0x8)='./file0\x00', 0x0, 0x0) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000ceb000)={r0, 0x50, &(0x7f0000551000-0x50)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16}}, 0x10) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000978000-0x4)=r3, 0x4) setsockopt$inet_sctp_SCTP_ADD_STREAMS(r2, 0x84, 0x79, &(0x7f0000a57000-0x4)=0xfffffffffffff800, 0x4) ioctl$ASHMEM_GET_PIN_STATUS(r0, 0x7709, 0x0) mount(&(0x7f0000c95000)='./file0\x00', &(0x7f00000e4000)='./file0\x00', &(0x7f00009b9000)="0500de00667300", 0x1004, &(0x7f00006b8000)="") symlinkat(&(0x7f0000020000-0x9)='./file0/file0\x00', r2, &(0x7f0000020000-0x8)='./file0\x00') renameat(r2, &(0x7f000043c000)='./file0\x00', r2, &(0x7f00008c1000)='./file0/file0\x00') 2018/02/01 04:11:25 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f0000590000-0x8)='./file0\x00', 0x14) write$selinux_create(r0, &(0x7f000074c000)=@access={'system_u:object_r:dpkg_exec_t:s0', 0x20, '/usr/sbin/cups-browsed', 0x20, 0x32, 0x30, 0x0}, 0x3b) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f00007cf000)='/dev/cuse\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_STATUS(r1, 0xc05c5340, &(0x7f0000b85000)={0x6, 0x100, 0x2, {0x0, 0x0}, 0x0, 0x4, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000801000-0x9)='/dev/ion\x00', 0x0, 0x0) r3 = syz_open_dev$binder(&(0x7f0000233000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r4 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0) r5 = dup2(r3, r4) write$tun(0xffffffffffffffff, &(0x7f0000577000)=@pi={0x0, 0x0, @eth={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x0}, [], {@canfd={0xd, {{0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0, "feb442a1f43ead325d71fed774c8f6028c2a6b79a4e418aa3c5f391769659fef9f596cdade428c389e511eaad39d2ee4334dee9516a31d00510baaf06efc0980"}}}}}, 0x5a) r6 = dup2(r4, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004ee000-0x76)='\x00', 0x1, 0x0, 0x0}], &(0x7f000000b000-0x30)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)=""}) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f00005da000)={0x0, 0x0, &(0x7f00000d8000)=[], 0x48, 0x0, &(0x7f000044c000-0x83)="a410778b7a640ab0384c4ead541b6ee57c5645909ef688d8ac3e5ecfc7039f5f8ba53f127b7f01947cd3689eaf6c090277915bab2a0c450988cb85688e2bcc101a80664d3081fcc0"}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000c5a000)={0x0, 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000a95000-0x30)={0x0, 0x0, &(0x7f0000b8f000)=[], 0x0, 0x0, &(0x7f00002e4000-0x70)=""}) getsockopt$inet6_dccp_buf(r5, 0x21, 0xcf, &(0x7f0000e10000-0xcc)=""/204, &(0x7f000037d000-0x4)=0xcc) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000436000-0x30)={0x20, 0x0, &(0x7f0000136000)=[@dead_binder_done={0x40086310, 0x3}, @increfs_done={0x40106308, r7, 0x0}], 0x0, 0x0, &(0x7f0000888000-0xb)=""}) close(r2) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000002000-0x38)={0x0, 0x0, &(0x7f0000003000)=[], 0x0, &(0x7f0000002000)=[{0x10, 0x10e, 0x0, ""}], 0x10, 0x0}, 0x0) 2018/02/01 04:11:25 executing program 7: r0 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r0, &(0x7f0000022000-0x16)="01", 0x1, 0x0, &(0x7f0000031000-0x10)={0x2, 0xffffffffffffffff, @local={0xac, 0x14, 0xffffffffffffffff, 0xaa}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x10) shutdown(r0, 0x1) [ 304.847128] binder: 15439:15455 BC_DEAD_BINDER_DONE 0000000000000003 not found [ 304.847139] binder: 15439:15455 BC_INCREFS_DONE u0000000000000000 no match 2018/02/01 04:11:25 executing program 1: openat$ion(0xffffffffffffff9c, &(0x7f0000801000-0x9)='/dev/ion\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000233000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) write$tun(0xffffffffffffffff, &(0x7f0000577000)=@pi={0x0, 0x0, @eth={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x0}, [], {@canfd={0xd, {{0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0, "feb442a1f43ead325d71fed774c8f6028c2a6b79a4e418aa3c5f391769659fef9f596cdade428c389e511eaad39d2ee4334dee9516a31d00510baaf06efc0980"}}}}}, 0x5a) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x24, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004ee000-0x76)='\x00', 0x1, 0x0, 0x0}], &(0x7f000000b000-0x30)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)=""}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00005da000)={0x0, 0x0, &(0x7f00000d8000)=[], 0x48, 0x0, &(0x7f000044c000-0x83)="a410778b7a640ab0384c4ead541b6ee57c5645909ef688d8ac3e5ecfc7039f5f8ba53f127b7f01947cd3689eaf6c090277915bab2a0c450988cb85688e2bcc101a80664d3081fcc0"}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000c5a000)={0x0, 0x0, 0x0, 0x0}) mmap(&(0x7f0000000000/0x13000)=nil, 0x13000, 0x0, 0x32, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000a95000-0x30)={0x14, 0x0, &(0x7f0000b8f000)=[@increfs_done={0x40106308, r3, 0x1}], 0x0, 0x0, &(0x7f00002e4000-0x70)=""}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000436000-0x30)={0x20, 0x0, &(0x7f0000136000)=[@dead_binder_done={0x40086310, 0x3}, @increfs_done={0x40106308, r3, 0x0}], 0x0, 0x0, &(0x7f0000888000-0xb)=""}) 2018/02/01 04:11:25 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) seccomp(0x1, 0x0, &(0x7f000089b000-0x10)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x407ffc0003}]}) r0 = syz_open_dev$mouse(&(0x7f00007f1000)='/dev/input/mouse#\x00', 0x1000000000003, 0x3ffffffffffffff) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r0, 0x84, 0x6b, &(0x7f00002d1000)=[@in6={0xa, 0x1, 0x7fff, @local={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0xaa}, 0x6}, @in={0x2, 0x3, @multicast1=0xe0000001, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, @in6={0xa, 0x1, 0x0, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x1}, 0x100000000}], 0x48) shmctl$IPC_INFO(0x0, 0x3, &(0x7f0000564000)=""/4096) 2018/02/01 04:11:25 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x0, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r0, &(0x7f0000022000-0x16)="01", 0x1, 0x0, &(0x7f0000031000-0x10)={0x2, 0xffffffffffffffff, @local={0xac, 0x14, 0xffffffffffffffff, 0xaa}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x10) shutdown(r0, 0x1) 2018/02/01 04:11:25 executing program 2: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000801000-0x9)='/dev/ion\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000001000-0x2b)="2d6d696d655f747970652876626f786e6574316367726f757076626f786e65743070707030b17070703000", 0x1) ioctl$BINDER_SET_MAX_THREADS(r1, 0x40046205, 0x80000000) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000a43000-0xd)='/dev/binder#\x00', 0x0, 0x0) r3 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) dup2(r0, r3) write$tun(0xffffffffffffffff, &(0x7f0000577000)=@pi={0x0, 0x0, @eth={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x0}, [], {@canfd={0xd, {{0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0, "feb442a1f43ead325d71fed774c8f6028c2a6b79a4e418aa3c5f391769659fef9f596cdade428c389e511eaad39d2ee4334dee9516a31d00510baaf06efc0980"}}}}}, 0x5a) r4 = dup2(r3, r2) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x3, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004ee000-0x76)='\x00', 0x1, 0x0, 0x0}], &(0x7f000000b000-0x30)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)=""}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00005da000)={0x0, 0x0, &(0x7f00000d8000)=[], 0x48, 0x0, &(0x7f000044c000-0x83)="a410778b7a640ab0384c4ead541b6ee57c5645909ef688d8ac3e5ecfc7039f5f8ba53f127b7f01947cd3689eaf6c090277915bab2a0c450988cb85688e2bcc101a80664d3081fcc0"}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r3, 0xc018620b, &(0x7f0000c5a000)={0x0, 0x0, 0x0, 0x0}) mmap(&(0x7f0000000000/0x13000)=nil, 0x13000, 0x0, 0x32, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000a95000-0x30)={0x14, 0x0, &(0x7f0000b8f000)=[@increfs_done={0x40106308, r5, 0x1}], 0x0, 0x0, &(0x7f00002e4000-0x70)=""}) [ 304.852237] binder_alloc: 15097: binder_alloc_buf, no vma [ 304.852264] binder: 15449:15459 transaction failed 29189/-3, size 40-8 line 2903 [ 304.859159] binder: 15449:15459 ioctl 4c82 0 returned -22 [ 304.865153] binder: BINDER_SET_CONTEXT_MGR already set [ 304.865161] binder: 15464:15466 ioctl 40046207 0 returned -16 [ 304.866288] binder: 15449:15453 ioctl 4c81 ffffffffffffffff returned -22 2018/02/01 04:11:25 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000f3c000)='/dev/ptmx\x00', 0x400000, 0x0) ioctl$GIO_SCRNMAP(r0, 0x4b40, &(0x7f0000350000)=""/43) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000a8d000)={&(0x7f0000e4e000)={0x10, 0x0, 0x0, 0x0}, 0xc, &(0x7f0000fcf000-0x10)={&(0x7f00005d5000)=@updsa={0x104, 0x1a, 0x1, 0xffffffffffffffff, 0xffffffffffffffff, {{@in6=@local={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0xffffffffffffffff, 0xaa}, @in=@dev={0xac, 0x14, 0xffffffffffffffff, 0x0}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0}, {@in=@broadcast=0xffffffff, 0xffffffffffffffff, 0x2b}, @in=@multicast2=0xe0000002, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, {0x0, 0x0, 0x0, 0x0}, {0x0, 0x0, 0x0}, 0xffffffffffffffff, 0xffffffffffffffff, 0xa, 0x2, 0x0, 0x0}, [@coaddr={0x14, 0xe, @in=@remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}}]}, 0x104}, 0x1, 0x0, 0x0, 0x0}, 0x0) 2018/02/01 04:11:25 executing program 5: openat$ion(0xffffffffffffff9c, &(0x7f0000801000-0x9)='/dev/ion\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000233000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) syz_open_dev$sndctrl(&(0x7f000076b000-0xf)='/dev/snd/controlC#\x00', 0x800, 0x400000) dup2(r0, r1) write$tun(0xffffffffffffffff, &(0x7f0000577000)=@pi={0x0, 0x0, @eth={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x0}, [], {@canfd={0xd, {{0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0, "feb442a1f43ead325d71fed774c8f6028c2a6b79a4e418aa3c5f391769659fef9f596cdade428c389e511eaad39d2ee4334dee9516a31d00510baaf06efc0980"}}}}}, 0x5a) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004ee000-0x76)='\x00', 0x1, 0x0, 0x0}], &(0x7f000000b000-0x30)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)=""}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00005da000)={0x0, 0x0, &(0x7f00000d8000)=[], 0x48, 0x0, &(0x7f000044c000-0x83)="a410778b7a640ab0384c4ead541b6ee57c5645909ef688d8ac3e5ecfc7039f5f8ba53f127b7f01947cd3689eaf6c090277915bab2a0c450988cb85688e2bcc101a80664d3081fcc0"}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000c5a000)={0x0, 0x0, 0x0, 0x0}) mmap(&(0x7f0000000000/0x13000)=nil, 0x13000, 0x0, 0x32, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000a95000-0x30)={0x14, 0x0, &(0x7f0000b8f000)=[@increfs_done={0x40106308, r3, 0x1}], 0x0, 0x0, &(0x7f00002e4000-0x70)=""}) 2018/02/01 04:11:25 executing program 3: mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = mq_open(&(0x7f000008e000-0x2)='/\x00', 0x1, 0x50, &(0x7f0000001000-0x40)={0x786, 0xfffffffffffffffa, 0x6, 0xd, 0x0, 0xffff, 0x4, 0x7fff}) mmap(&(0x7f0000d61000/0x4000)=nil, 0x4000, 0x3, 0x32, r0, 0x0) openat$audio(0xffffffffffffff9c, &(0x7f0000001000-0xb)='/dev/audio\x00', 0x40000, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r1 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000bdc000)='/dev/sequencer\x00', 0x0, 0x0) perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0x0, 0xffffffffffffffff, 0x0) readv(r1, &(0x7f000090e000)=[{&(0x7f0000c89000)=""/179, 0xb3}], 0x0) 2018/02/01 04:11:25 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f0000590000-0x8)='./file0\x00', 0x14) write$selinux_create(r0, &(0x7f000074c000)=@access={'system_u:object_r:dpkg_exec_t:s0', 0x20, '/usr/sbin/cups-browsed', 0x20, 0x32, 0x30, 0x0}, 0x3b) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f00007cf000)='/dev/cuse\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_STATUS(r1, 0xc05c5340, &(0x7f0000b85000)={0x6, 0x100, 0x2, {0x0, 0x0}, 0x0, 0x4, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000801000-0x9)='/dev/ion\x00', 0x0, 0x0) r3 = syz_open_dev$binder(&(0x7f0000233000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r4 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0) r5 = dup2(r3, r4) write$tun(0xffffffffffffffff, &(0x7f0000577000)=@pi={0x0, 0x0, @eth={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x0}, [], {@canfd={0xd, {{0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0, "feb442a1f43ead325d71fed774c8f6028c2a6b79a4e418aa3c5f391769659fef9f596cdade428c389e511eaad39d2ee4334dee9516a31d00510baaf06efc0980"}}}}}, 0x5a) r6 = dup2(r4, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004ee000-0x76)='\x00', 0x1, 0x0, 0x0}], &(0x7f000000b000-0x30)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)=""}) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f00005da000)={0x0, 0x0, &(0x7f00000d8000)=[], 0x48, 0x0, &(0x7f000044c000-0x83)="a410778b7a640ab0384c4ead541b6ee57c5645909ef688d8ac3e5ecfc7039f5f8ba53f127b7f01947cd3689eaf6c090277915bab2a0c450988cb85688e2bcc101a80664d3081fcc0"}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000c5a000)={0x0, 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000a95000-0x30)={0x0, 0x0, &(0x7f0000b8f000)=[], 0x0, 0x0, &(0x7f00002e4000-0x70)=""}) getsockopt$inet6_dccp_buf(r5, 0x21, 0xcf, &(0x7f0000e10000-0xcc)=""/204, &(0x7f000037d000-0x4)=0xcc) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000436000-0x30)={0x20, 0x0, &(0x7f0000136000)=[@dead_binder_done={0x40086310, 0x3}, @increfs_done={0x40106308, r7, 0x0}], 0x0, 0x0, &(0x7f0000888000-0xb)=""}) close(r2) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000002000-0x38)={0x0, 0x0, &(0x7f0000003000)=[], 0x0, &(0x7f0000002000)=[{0x10, 0x10e, 0x0, ""}], 0x10, 0x0}, 0x0) 2018/02/01 04:11:25 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x0, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r0, &(0x7f0000022000-0x16)="01", 0x1, 0x0, &(0x7f0000031000-0x10)={0x2, 0xffffffffffffffff, @local={0xac, 0x14, 0xffffffffffffffff, 0xaa}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x10) shutdown(r0, 0x1) 2018/02/01 04:11:25 executing program 2: openat$ion(0xffffffffffffff9c, &(0x7f0000801000-0x9)='/dev/ion\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000233000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) write$tun(0xffffffffffffffff, &(0x7f0000577000)=@pi={0x0, 0x0, @eth={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x0}, [], {@canfd={0xd, {{0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0, "feb442a1f43ead325d71fed774c8f6028c2a6b79a4e418aa3c5f391769659fef9f596cdade428c389e511eaad39d2ee4334dee9516a31d00510baaf06efc0980"}}}}}, 0x5a) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004ee000-0x76)='\x00', 0x1, 0x0, 0x0}], &(0x7f000000b000-0x30)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)=""}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00005da000)={0x0, 0x0, &(0x7f00000d8000)=[], 0x48, 0x0, &(0x7f000044c000-0x83)="a410778b7a640ab0384c4ead541b6ee57c5645909ef688d8ac3e5ecfc7039f5f8ba53f127b7f01947cd3689eaf6c090277915bab2a0c450988cb85688e2bcc101a80664d3081fcc0"}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000c5a000)={0x0, 0x0, 0x0, 0x0}) mmap(&(0x7f0000000000/0xff0000)=nil, 0xff0000, 0x3, 0x32, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000733000)={0x5, 0x1, 0x5, 0xb, 0x0, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x1c) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000733000)={0x5, 0x1, 0x5, 0x200000000000009, 0x1, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x2c) r5 = bpf$MAP_CREATE(0x0, &(0x7f00004fa000-0x1c)={0xc, 0x4, 0x4, 0x100000001, 0x0, r4, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x1c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f00005f1000)={r5, &(0x7f0000eed000)="", &(0x7f0000b88000)="13", 0x0}, 0x20) mmap(&(0x7f0000000000/0x13000)=nil, 0x13000, 0x0, 0x32, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000a95000-0x30)={0x14, 0x0, &(0x7f0000b8f000)=[@increfs_done={0x40106308, r3, 0x1}], 0x0, 0x0, &(0x7f00002e4000-0x70)=""}) 2018/02/01 04:11:25 executing program 1: openat$ion(0xffffffffffffff9c, &(0x7f0000801000-0x9)='/dev/ion\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000233000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$packet(0x11, 0x3, 0x300, &(0x7f000096e000-0x8)={0x0, 0x0}) dup2(r0, r1) write$tun(0xffffffffffffffff, &(0x7f0000577000)=@pi={0x0, 0x0, @eth={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x0}, [], {@canfd={0xd, {{0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0, "feb442a1f43ead325d71fed774c8f6028c2a6b79a4e418aa3c5f391769659fef9f596cdade428c389e511eaad39d2ee4334dee9516a31d00510baaf06efc0980"}}}}}, 0x5a) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004ee000-0x76)='\x00', 0x1, 0x0, 0x0}], &(0x7f000000b000-0x30)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)=""}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00005da000)={0x0, 0x0, &(0x7f00000d8000)=[], 0x48, 0x0, &(0x7f000044c000-0x83)="a410778b7a640ab0384c4ead541b6ee57c5645909ef688d8ac3e5ecfc7039f5f8ba53f127b7f01947cd3689eaf6c090277915bab2a0c450988cb85688e2bcc101a80664d3081fcc0"}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000c5a000)={0x0, 0x0, 0x0, 0x0}) mmap(&(0x7f0000000000/0x13000)=nil, 0x13000, 0x0, 0x32, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000a95000-0x30)={0x14, 0x0, &(0x7f0000b8f000)=[@increfs_done={0x40106308, r3, 0x1}], 0x0, 0x0, &(0x7f00002e4000-0x70)=""}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000436000-0x30)={0x20, 0x0, &(0x7f0000136000)=[@dead_binder_done={0x40086310, 0x3}, @increfs_done={0x40106308, r3, 0x0}], 0x0, 0x0, &(0x7f0000888000-0xb)=""}) 2018/02/01 04:11:25 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) seccomp(0x1, 0x0, &(0x7f000089b000-0x10)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x407ffc0003}]}) shmget$private(0x0, 0x3000, 0x1010, &(0x7f0000811000/0x3000)=nil) shmget(0x1, 0x1000, 0xd0, &(0x7f0000903000/0x1000)=nil) r0 = shmget$private(0x0, 0x3000, 0x202, &(0x7f0000426000/0x3000)=nil) shmctl$IPC_INFO(r0, 0x3, &(0x7f00007c1000-0x1000)=""/4096) r1 = accept4(0xffffffffffffffff, &(0x7f0000c05000-0x10)=@can={0x0, 0x0, 0x0, 0x0}, &(0x7f0000c8a000)=0x10, 0x80800) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000c2e000)=@raw={'raw\x00', 0x9, 0x4, 0x3d0, 0x1e8, 0xffffffff, 0xffffffff, 0x1e8, 0xffffffff, 0x0, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x4, &(0x7f0000252000)=[{0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}], {{{[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0xa8, 0xd0, 0x0, {0x0, 0x0}}, {0x28, '\x00', 0x0, 0x2f8}}, [{{@ipv6={@empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, [0xffffffff, 0xffffffff, 0xffffff00, 0xffffff00], [0x0, 0xff000000, 0xff000000, 0x0], @common='syzkaller0\x00', @common='erspan0\x00', {0xff, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, {0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x3c, 0x100000000, 0x2, 0x2}, 0x0, 0xd0, 0x118, 0x0, {0x0, 0x0}, [@common=@hl={0x28, 'hl\x00', 0x0, {0x1, 0x5}}]}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x1, 0x0, 0xf143, 0xcd, '\x00', 0x6dd}}}, {{@ipv6={@ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], [0xff, 0xff], @loopback=0x7f000001}, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, [0xffffffff, 0x0, 0xff0000ff, 0x0], [0xffffff00, 0xffffff00, 0xff, 0x0], @generic="eefb60046856f5e0f4ac317333875232", @generic="b58e582cea391c5ac48ae1bfb3ff6420", {0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, {0xff, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x3a, 0x4, 0x1, 0x14}, 0x0, 0xa8, 0x110, 0x0, {0x0, 0x0}, []}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x2, 0x3, 0x8001, 0x7f, '\x00', 'syz0\x00', 0x1000}}}, {{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0xa8, 0xd8, 0x0, {0x0, 0x0}, [@unspec=@void=""]}, @common=@unspec=@CONNMARK={0x30, 'CONNMARK\x00', 0x1, {0xb2c, 0x9, 0x6, 0x1}}}]}}, 0x430) [ 304.877253] binder_alloc: 15097: binder_alloc_buf, no vma [ 304.877282] binder: 15464:15466 transaction failed 29189/-3, size 40-8 line 2903 [ 304.883195] binder: 15449:15467 BC_INCREFS_DONE u0000000000000000 no match [ 304.911542] binder: BINDER_SET_CONTEXT_MGR already set [ 304.911552] binder: 15472:15473 ioctl 40046207 0 returned -16 [ 304.912376] binder_alloc: 15097: binder_alloc_buf, no vma 2018/02/01 04:11:25 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x0, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r0, &(0x7f0000022000-0x16)="01", 0x1, 0x0, &(0x7f0000031000-0x10)={0x2, 0xffffffffffffffff, @local={0xac, 0x14, 0xffffffffffffffff, 0xaa}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x10) shutdown(r0, 0x1) 2018/02/01 04:11:25 executing program 5: openat$ion(0xffffffffffffff9c, &(0x7f0000801000-0x9)='/dev/ion\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000233000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) syz_open_dev$sndctrl(&(0x7f000076b000-0xf)='/dev/snd/controlC#\x00', 0x800, 0x400000) dup2(r0, r1) write$tun(0xffffffffffffffff, &(0x7f0000577000)=@pi={0x0, 0x0, @eth={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x0}, [], {@canfd={0xd, {{0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0, "feb442a1f43ead325d71fed774c8f6028c2a6b79a4e418aa3c5f391769659fef9f596cdade428c389e511eaad39d2ee4334dee9516a31d00510baaf06efc0980"}}}}}, 0x5a) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004ee000-0x76)='\x00', 0x1, 0x0, 0x0}], &(0x7f000000b000-0x30)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)=""}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00005da000)={0x0, 0x0, &(0x7f00000d8000)=[], 0x48, 0x0, &(0x7f000044c000-0x83)="a410778b7a640ab0384c4ead541b6ee57c5645909ef688d8ac3e5ecfc7039f5f8ba53f127b7f01947cd3689eaf6c090277915bab2a0c450988cb85688e2bcc101a80664d3081fcc0"}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000c5a000)={0x0, 0x0, 0x0, 0x0}) mmap(&(0x7f0000000000/0x13000)=nil, 0x13000, 0x0, 0x32, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000a95000-0x30)={0x14, 0x0, &(0x7f0000b8f000)=[@increfs_done={0x40106308, r3, 0x1}], 0x0, 0x0, &(0x7f00002e4000-0x70)=""}) [ 304.912400] binder: 15472:15473 transaction failed 29189/-3, size 40-8 line 2903 [ 304.930836] binder: BINDER_SET_CONTEXT_MGR already set [ 304.930846] binder: 15476:15477 ioctl 40046207 0 returned -16 2018/02/01 04:11:25 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$KVM_GET_REG_LIST(0xffffffffffffffff, 0xc008aeb0, &(0x7f0000a6b000-0x10)={0x1, [0x5]}) ioctl$EVIOCGPROP(0xffffffffffffffff, 0xc004743e, &(0x7f0000879000)=""/246) ioctl$EVIOCGREP(0xffffffffffffffff, 0x4004743c, &(0x7f0000d1e000-0xae)=""/174) write$eventfd(0xffffffffffffffff, &(0x7f000089c000)=0x0, 0x8) 2018/02/01 04:11:25 executing program 1: openat$ion(0xffffffffffffff9c, &(0x7f0000801000-0x9)='/dev/ion\x00', 0x0, 0x0) socket$netlink(0x10, 0x3, 0x8) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000233000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) write$tun(0xffffffffffffffff, &(0x7f0000577000)=@pi={0x0, 0x0, @eth={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x0}, [], {@canfd={0xd, {{0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0, "feb442a1f43ead325d71fed774c8f6028c2a6b79a4e418aa3c5f391769659fef9f596cdade428c389e511eaad39d2ee4334dee9516a31d00510baaf06efc0980"}}}}}, 0x5a) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004ee000-0x76)='\x00', 0x1, 0x0, 0x0}], &(0x7f000000b000-0x30)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)=""}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00005da000)={0x0, 0x0, &(0x7f00000d8000)=[], 0x48, 0x0, &(0x7f000044c000-0x83)="a410778b7a640ab0384c4ead541b6ee57c5645909ef688d8ac3e5ecfc7039f5f8ba53f127b7f01947cd3689eaf6c090277915bab2a0c450988cb85688e2bcc101a80664d3081fcc0"}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000c5a000)={0x0, 0x0, 0x0, 0x0}) mmap(&(0x7f0000000000/0x13000)=nil, 0x13000, 0x0, 0x32, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000a95000-0x30)={0x14, 0x0, &(0x7f0000b8f000)=[@increfs_done={0x40106308, r3, 0x1}], 0x0, 0x0, &(0x7f00002e4000-0x70)=""}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000436000-0x30)={0x20, 0x0, &(0x7f0000136000)=[@dead_binder_done={0x40086310, 0x3}, @increfs_done={0x40106308, r3, 0x0}], 0x0, 0x0, &(0x7f0000888000-0xb)=""}) 2018/02/01 04:11:25 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f0000590000-0x8)='./file0\x00', 0x14) write$selinux_create(r0, &(0x7f000074c000)=@access={'system_u:object_r:dpkg_exec_t:s0', 0x20, '/usr/sbin/cups-browsed', 0x20, 0x32, 0x30, 0x0}, 0x3b) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f00007cf000)='/dev/cuse\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_STATUS(r1, 0xc05c5340, &(0x7f0000b85000)={0x6, 0x100, 0x2, {0x0, 0x0}, 0x0, 0x4, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000801000-0x9)='/dev/ion\x00', 0x0, 0x0) r3 = syz_open_dev$binder(&(0x7f0000233000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r4 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0) r5 = dup2(r3, r4) write$tun(0xffffffffffffffff, &(0x7f0000577000)=@pi={0x0, 0x0, @eth={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x0}, [], {@canfd={0xd, {{0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0, "feb442a1f43ead325d71fed774c8f6028c2a6b79a4e418aa3c5f391769659fef9f596cdade428c389e511eaad39d2ee4334dee9516a31d00510baaf06efc0980"}}}}}, 0x5a) r6 = dup2(r4, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004ee000-0x76)='\x00', 0x1, 0x0, 0x0}], &(0x7f000000b000-0x30)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)=""}) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f00005da000)={0x0, 0x0, &(0x7f00000d8000)=[], 0x48, 0x0, &(0x7f000044c000-0x83)="a410778b7a640ab0384c4ead541b6ee57c5645909ef688d8ac3e5ecfc7039f5f8ba53f127b7f01947cd3689eaf6c090277915bab2a0c450988cb85688e2bcc101a80664d3081fcc0"}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000c5a000)={0x0, 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000a95000-0x30)={0x14, 0x0, &(0x7f0000b8f000)=[@increfs_done={0x40106308, 0x0, 0x1}], 0x0, 0x0, &(0x7f00002e4000-0x70)=""}) getsockopt$inet6_dccp_buf(r5, 0x21, 0xcf, &(0x7f0000e10000-0xcc)=""/204, &(0x7f000037d000-0x4)=0xcc) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000436000-0x30)={0x20, 0x0, &(0x7f0000136000)=[@dead_binder_done={0x40086310, 0x3}, @increfs_done={0x40106308, r7, 0x0}], 0x0, 0x0, &(0x7f0000888000-0xb)=""}) close(r2) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000002000-0x38)={0x0, 0x0, &(0x7f0000003000)=[], 0x0, &(0x7f0000002000)=[{0x10, 0x10e, 0x0, ""}], 0x10, 0x0}, 0x0) 2018/02/01 04:11:25 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r0, &(0x7f0000022000-0x16)="01", 0x1, 0x0, &(0x7f0000031000-0x10)={0x2, 0xffffffffffffffff, @local={0xac, 0x14, 0xffffffffffffffff, 0xaa}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x10) shutdown(r0, 0x1) [ 304.931330] binder_alloc: 15097: binder_alloc_buf, no vma [ 304.931356] binder: 15476:15477 transaction failed 29189/-3, size 40-8 line 2903 [ 304.940686] binder: BINDER_SET_CONTEXT_MGR already set 2018/02/01 04:11:25 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) seccomp(0x1, 0x0, &(0x7f000089b000-0x10)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x407ffc0003}]}) socketpair(0x4, 0x5, 0x4, &(0x7f0000d42000-0x8)={0x0, 0x0}) getsockopt$inet_sctp6_SCTP_RTOINFO(0xffffffffffffff9c, 0x84, 0x0, &(0x7f0000521000)={0x0, 0xb731, 0x80000000, 0x3}, &(0x7f0000304000)=0x10) setsockopt$inet_sctp_SCTP_DEFAULT_SNDINFO(r0, 0x84, 0x22, &(0x7f000036c000-0x10)={0xffffffff, 0x8000, 0x0, 0x100000000, r2}, 0x10) ioctl$TIOCGSID(0xffffffffffffff9c, 0x5429, &(0x7f0000c8f000)=0x0) ioctl$TIOCSCTTY(r0, 0x540e, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x40082406, &(0x7f0000de7000-0x1)='\x00') ioctl$sock_SIOCINQ(r1, 0x541b, &(0x7f0000a1f000)=0x0) ioctl$KVM_CREATE_DEVICE(0xffffffffffffff9c, 0xc00caee0, &(0x7f00008e3000-0xc)={0x0, 0xffffffffffffffff, 0x1}) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000764000-0x4)=0x2) getsockopt$inet_sctp_SCTP_GET_ASSOC_NUMBER(r4, 0x84, 0x1c, &(0x7f0000c21000)=0x0, &(0x7f0000e27000)=0x4) ioctl$VHOST_SET_VRING_BASE(r4, 0x4008af12, &(0x7f0000d59000-0x8)={0x3adbece1ab86ba9f, 0x10001}) sched_getscheduler(r3) shmctl$IPC_INFO(0x0, 0x3, &(0x7f0000564000)=""/4096) 2018/02/01 04:11:25 executing program 2: openat$ion(0xffffffffffffff9c, &(0x7f0000801000-0x9)='/dev/ion\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000233000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) fcntl$F_SET_FILE_RW_HINT(r0, 0x40e, &(0x7f0000967000)=0x5) dup2(r0, r1) write$tun(0xffffffffffffffff, &(0x7f0000577000)=@pi={0x0, 0x0, @eth={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x0}, [], {@canfd={0xd, {{0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0, "feb442a1f43ead325d71fed774c8f6028c2a6b79a4e418aa3c5f391769659fef9f596cdade428c389e511eaad39d2ee4334dee9516a31d00510baaf06efc0980"}}}}}, 0x5a) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004ee000-0x76)='\x00', 0x1, 0x0, 0x0}], &(0x7f000000b000-0x30)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)=""}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00005da000)={0x0, 0x0, &(0x7f00000d8000)=[], 0x48, 0x0, &(0x7f000044c000-0x83)="a410778b7a640ab0384c4ead541b6ee57c5645909ef688d8ac3e5ecfc7039f5f8ba53f127b7f01947cd3689eaf6c090277915bab2a0c450988cb85688e2bcc101a80664d3081fcc0"}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000c5a000)={0x0, 0x0, 0x0, 0x0}) mmap(&(0x7f0000000000/0x13000)=nil, 0x13000, 0x0, 0x32, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000a95000-0x30)={0x14, 0x0, &(0x7f0000b8f000)=[@increfs_done={0x40106308, r3, 0x1}], 0x0, 0x0, &(0x7f00002e4000-0x70)=""}) [ 304.940698] binder: 15472:15473 ioctl 40046207 0 returned -16 [ 304.945290] binder_alloc: 15097: binder_alloc_buf, no vma [ 304.945319] binder: 15472:15478 transaction failed 29189/-3, size 40-8 line 2903 [ 305.678763] binder: BINDER_SET_CONTEXT_MGR already set [ 305.678773] binder: 15492:15497 ioctl 40046207 0 returned -16 [ 305.680358] binder: BINDER_SET_CONTEXT_MGR already set [ 305.680366] binder: 15489:15493 ioctl 40046207 0 returned -16 [ 305.680507] binder_alloc: 15097: binder_alloc_buf, no vma [ 305.680531] binder: 15492:15497 transaction failed 29189/-3, size 40-8 line 2903 [ 305.684418] binder_alloc: 15097: binder_alloc_buf, no vma [ 305.684441] binder: 15489:15493 transaction failed 29189/-3, size 40-8 line 2903 [ 305.685852] binder: 15492:15497 BC_INCREFS_DONE u0000000000000000 no match [ 305.685917] binder: 15492:15497 BC_DEAD_BINDER_DONE 0000000000000003 not found 2018/02/01 04:11:26 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) fstat(r0, &(0x7f00000eb000-0x44)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$nl_xfrm(r0, &(0x7f0000a8d000)={&(0x7f0000e4e000)={0x10, 0x0, 0x0, 0x0}, 0xc, &(0x7f0000fcf000-0x10)={&(0x7f00005d5000)=@updsa={0x104, 0x1a, 0x1, 0xffffffffffffffff, 0xffffffffffffffff, {{@in6=@local={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0xffffffffffffffff, 0xaa}, @in=@dev={0xac, 0x14, 0xffffffffffffffff, 0x0}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, r1}, {@in=@broadcast=0xffffffff, 0xffffffffffffffff, 0x2b}, @in6=@empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, {0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, {0x0, 0x0, 0x0, 0x0}, {0x0, 0x0, 0x0}, 0xffffffffffffffff, 0xffffffffffffffff, 0xa, 0x2, 0x0, 0x0}, [@coaddr={0x14, 0xe, @in=@remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}}]}, 0x104}, 0x1, 0x0, 0x0, 0x0}, 0x0) 2018/02/01 04:11:26 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_buf(r0, 0x29, 0x39, &(0x7f0000eb3000)="ff02020100000000000000000000ea030a4e00000000d805", 0x18) getsockopt$inet6_opts(r0, 0x29, 0x39, &(0x7f0000e07000)=""/125, &(0x7f000019d000)=0x23b) syz_open_dev$audion(&(0x7f0000aee000-0xc)='/dev/audio#\x00', 0x4, 0x40) 2018/02/01 04:11:26 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f, 0x0, 0x0, 0x0, 0x7ac299c5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, @perf_bp={&(0x7f0000000000)=0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0x0, 0xffffffffffffffff, 0x0) setsockopt$netlink_NETLINK_LISTEN_ALL_NSID(0xffffffffffffffff, 0x10e, 0x8, &(0x7f0000fea000+0x815)=0x0, 0x4) r1 = epoll_create(0x143) r2 = socket$rds(0x15, 0x5, 0x0) r3 = epoll_create(0x100000001) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f000000e000)={0x1, 0x0}) epoll_ctl$EPOLL_CTL_ADD(r3, 0x1, r2, &(0x7f000000d000)={0x0, 0x0}) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, 0xffffffffffffffff, &(0x7f000000e000-0xc)={0x0, 0x0}) r4 = epoll_create(0x46c) r5 = epoll_create(0x800) epoll_ctl$EPOLL_CTL_ADD(r5, 0x1, r1, &(0x7f0000c7f000)={0x0, 0x0}) r6 = epoll_create(0xe0) epoll_ctl$EPOLL_CTL_ADD(r4, 0x1, r5, &(0x7f0000d5e000-0xc)={0x0, 0x0}) epoll_ctl$EPOLL_CTL_ADD(r6, 0x1, r4, &(0x7f000050b000-0xc)={0x0, 0x0}) 2018/02/01 04:11:26 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r0, &(0x7f0000022000-0x16)="01", 0x1, 0x0, &(0x7f0000031000-0x10)={0x2, 0xffffffffffffffff, @local={0xac, 0x14, 0xffffffffffffffff, 0xaa}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x10) shutdown(r0, 0x1) 2018/02/01 04:11:26 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f0000590000-0x8)='./file0\x00', 0x14) write$selinux_create(r0, &(0x7f000074c000)=@access={'system_u:object_r:dpkg_exec_t:s0', 0x20, '/usr/sbin/cups-browsed', 0x20, 0x32, 0x30, 0x0}, 0x3b) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f00007cf000)='/dev/cuse\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_STATUS(r1, 0xc05c5340, &(0x7f0000b85000)={0x6, 0x100, 0x2, {0x0, 0x0}, 0x0, 0x4, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000801000-0x9)='/dev/ion\x00', 0x0, 0x0) r3 = syz_open_dev$binder(&(0x7f0000233000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r4 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0) r5 = dup2(r3, r4) write$tun(0xffffffffffffffff, &(0x7f0000577000)=@pi={0x0, 0x0, @eth={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x0}, [], {@canfd={0xd, {{0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0, "feb442a1f43ead325d71fed774c8f6028c2a6b79a4e418aa3c5f391769659fef9f596cdade428c389e511eaad39d2ee4334dee9516a31d00510baaf06efc0980"}}}}}, 0x5a) r6 = dup2(r4, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004ee000-0x76)='\x00', 0x1, 0x0, 0x0}], &(0x7f000000b000-0x30)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)=""}) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f00005da000)={0x0, 0x0, &(0x7f00000d8000)=[], 0x48, 0x0, &(0x7f000044c000-0x83)="a410778b7a640ab0384c4ead541b6ee57c5645909ef688d8ac3e5ecfc7039f5f8ba53f127b7f01947cd3689eaf6c090277915bab2a0c450988cb85688e2bcc101a80664d3081fcc0"}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000c5a000)={0x0, 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000a95000-0x30)={0x14, 0x0, &(0x7f0000b8f000)=[@increfs_done={0x40106308, 0x0, 0x1}], 0x0, 0x0, &(0x7f00002e4000-0x70)=""}) getsockopt$inet6_dccp_buf(r5, 0x21, 0xcf, &(0x7f0000e10000-0xcc)=""/204, &(0x7f000037d000-0x4)=0xcc) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000436000-0x30)={0x20, 0x0, &(0x7f0000136000)=[@dead_binder_done={0x40086310, 0x3}, @increfs_done={0x40106308, r7, 0x0}], 0x0, 0x0, &(0x7f0000888000-0xb)=""}) close(r2) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000002000-0x38)={0x0, 0x0, &(0x7f0000003000)=[], 0x0, &(0x7f0000002000)=[{0x10, 0x10e, 0x0, ""}], 0x10, 0x0}, 0x0) 2018/02/01 04:11:26 executing program 2: mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) openat$ion(0xffffffffffffff9c, &(0x7f0000001000-0x9)='/dev/ion\x00', 0xffffffffffff7ffd, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000233000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = add_key(&(0x7f0000b66000-0xa)='id_legacy\x00', &(0x7f0000d60000-0x5)={0x73, 0x79, 0x7a, 0x1, 0x0}, &(0x7f0000b03000-0x60)="d88e6fcaa3380f08b5c1745ab1e8c736eefa35a366ee0766518f59ed4929166382c3d8df223287f89794ac9815a1d79cfce96d258255a790e86e31f1bd7e2d5f7e441379a210c2b7cd7cb89e96b17337b51812f821aa4baac14fa2bde8143934", 0x60, 0xffffffffffffffff) keyctl$setperm(0x5, r2, 0x8200000) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) write$tun(0xffffffffffffffff, &(0x7f0000577000)=@pi={0x0, 0x0, @eth={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x0}, [], {@canfd={0xd, {{0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0, "feb442a1f43ead325d71fed774c8f6028c2a6b79a4e418aa3c5f391769659fef9f596cdade428c389e511eaad39d2ee4334dee9516a31d00510baaf06efc0980"}}}}}, 0x5a) r3 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004ee000-0x76)='\x00', 0x1, 0x0, 0x0}], &(0x7f000000b000-0x30)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)=""}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00005da000)={0x0, 0x0, &(0x7f00000d8000)=[], 0x48, 0x0, &(0x7f000044c000-0x83)="a410778b7a640ab0384c4ead541b6ee57c5645909ef688d8ac3e5ecfc7039f5f8ba53f127b7f01947cd3689eaf6c090277915bab2a0c450988cb85688e2bcc101a80664d3081fcc0"}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000c5a000)={0x0, 0x0, 0x0, 0x0}) mmap(&(0x7f0000000000/0x13000)=nil, 0x13000, 0x0, 0x32, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000a95000-0x30)={0x14, 0x0, &(0x7f0000b8f000)=[@increfs_done={0x40106308, r4, 0x1}], 0x0, 0x0, &(0x7f00002e4000-0x70)=""}) 2018/02/01 04:11:26 executing program 1: openat$ion(0xffffffffffffff9c, &(0x7f0000801000-0x9)='/dev/ion\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000233000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) write$tun(0xffffffffffffffff, &(0x7f0000577000)=@pi={0x0, 0x0, @eth={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x0}, [], {@canfd={0xd, {{0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0, "feb442a1f43ead325d71fed774c8f6028c2a6b79a4e418aa3c5f391769659fef9f596cdade428c389e511eaad39d2ee4334dee9516a31d00510baaf06efc0980"}}}}}, 0x5a) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004ee000-0x76)='\x00', 0x1, 0x0, 0x0}], &(0x7f000000b000-0x30)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)=""}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00005da000)={0x0, 0x0, &(0x7f00000d8000)=[], 0x48, 0x0, &(0x7f000044c000-0x83)="a410778b7a640ab0384c4ead541b6ee57c5645909ef688d8ac3e5ecfc7039f5f8ba53f127b7f01947cd3689eaf6c090277915bab2a0c450988cb85688e2bcc101a80664d3081fcc0"}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000c5a000)={0x0, 0x0, 0x0, 0x0}) mmap(&(0x7f0000000000/0x13000)=nil, 0x13000, 0x0, 0x32, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000a95000-0x30)={0x14, 0x0, &(0x7f0000b8f000)=[@increfs_done={0x40106308, r3, 0x1}], 0x0, 0x0, &(0x7f00002e4000-0x70)=""}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000436000-0x30)={0x20, 0x0, &(0x7f0000136000)=[@dead_binder_done={0x40086310, 0x3}, @increfs_done={0x40106308, r3, 0x0}], 0x0, 0x0, &(0x7f0000888000-0xb)=""}) openat$vnet(0xffffffffffffff9c, &(0x7f00006d9000)='/dev/vhost-net\x00', 0x2, 0x0) 2018/02/01 04:11:26 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) seccomp(0x1, 0x0, &(0x7f000089b000-0x10)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x407ffc0003}]}) r0 = socket$bt_cmtp(0x1f, 0x3, 0x5) getsockopt$bt_BT_CHANNEL_POLICY(r0, 0x112, 0xa, &(0x7f00004f2000-0x4)=0x1, &(0x7f000037a000)=0x4) r1 = openat$pfkey(0xffffffffffffff9c, &(0x7f000095e000-0x15)='/proc/self/net/pfkey\x00', 0x8002, 0x0) setsockopt$bt_rfcomm_RFCOMM_LM(r1, 0x12, 0x3, &(0x7f0000575000)=0x30, 0x4) shmctl$IPC_INFO(0x0, 0x3, &(0x7f0000564000)=""/4096) r2 = openat$cuse(0xffffffffffffff9c, &(0x7f0000a34000-0xa)='/dev/cuse\x00', 0x80, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r2, 0xc0a85320, &(0x7f0000e69000)={{0x3, 0x1}, 'port0\x00', 0x10, 0x110064, 0x2, 0x3, 0x7, 0xfffffffffffffff9, 0x100000000, 0x0, 0x2, 0x83f4, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) [ 305.685925] binder: 15492:15497 BC_INCREFS_DONE u0000000000000000 no match [ 305.696596] binder: BINDER_SET_CONTEXT_MGR already set [ 305.696605] binder: 15486:15496 ioctl 40046207 0 returned -16 [ 305.696877] binder: 15489:15493 BC_INCREFS_DONE u0000000000000000 no match [ 305.696927] binder_alloc: 15097: binder_alloc_buf, no vma 2018/02/01 04:11:26 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r0, &(0x7f0000022000-0x16)="01", 0x1, 0x0, &(0x7f0000031000-0x10)={0x2, 0xffffffffffffffff, @local={0xac, 0x14, 0xffffffffffffffff, 0xaa}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x10) shutdown(r0, 0x1) 2018/02/01 04:11:26 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f0000590000-0x8)='./file0\x00', 0x14) write$selinux_create(r0, &(0x7f000074c000)=@access={'system_u:object_r:dpkg_exec_t:s0', 0x20, '/usr/sbin/cups-browsed', 0x20, 0x32, 0x30, 0x0}, 0x3b) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f00007cf000)='/dev/cuse\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_STATUS(r1, 0xc05c5340, &(0x7f0000b85000)={0x6, 0x100, 0x2, {0x0, 0x0}, 0x0, 0x4, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000801000-0x9)='/dev/ion\x00', 0x0, 0x0) r3 = syz_open_dev$binder(&(0x7f0000233000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r4 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0) r5 = dup2(r3, r4) write$tun(0xffffffffffffffff, &(0x7f0000577000)=@pi={0x0, 0x0, @eth={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x0}, [], {@canfd={0xd, {{0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0, "feb442a1f43ead325d71fed774c8f6028c2a6b79a4e418aa3c5f391769659fef9f596cdade428c389e511eaad39d2ee4334dee9516a31d00510baaf06efc0980"}}}}}, 0x5a) r6 = dup2(r4, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004ee000-0x76)='\x00', 0x1, 0x0, 0x0}], &(0x7f000000b000-0x30)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)=""}) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f00005da000)={0x0, 0x0, &(0x7f00000d8000)=[], 0x48, 0x0, &(0x7f000044c000-0x83)="a410778b7a640ab0384c4ead541b6ee57c5645909ef688d8ac3e5ecfc7039f5f8ba53f127b7f01947cd3689eaf6c090277915bab2a0c450988cb85688e2bcc101a80664d3081fcc0"}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000c5a000)={0x0, 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000a95000-0x30)={0x14, 0x0, &(0x7f0000b8f000)=[@increfs_done={0x40106308, 0x0, 0x1}], 0x0, 0x0, &(0x7f00002e4000-0x70)=""}) getsockopt$inet6_dccp_buf(r5, 0x21, 0xcf, &(0x7f0000e10000-0xcc)=""/204, &(0x7f000037d000-0x4)=0xcc) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000436000-0x30)={0x20, 0x0, &(0x7f0000136000)=[@dead_binder_done={0x40086310, 0x3}, @increfs_done={0x40106308, r7, 0x0}], 0x0, 0x0, &(0x7f0000888000-0xb)=""}) close(r2) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000002000-0x38)={0x0, 0x0, &(0x7f0000003000)=[], 0x0, &(0x7f0000002000)=[{0x10, 0x10e, 0x0, ""}], 0x10, 0x0}, 0x0) 2018/02/01 04:11:26 executing program 3: mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) socketpair$inet6_dccp(0xa, 0x6, 0x0, &(0x7f0000001000-0x8)={0x0, 0x0}) fcntl$getownex(r0, 0x10, &(0x7f0000339000-0x8)={0x0, 0x0}) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000)=0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000d3f000-0x9)='net/unix\x00') lseek(r1, 0x0, 0x1) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) seccomp(0x1, 0x0, &(0x7f0000056000-0x10)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x407ffc0003}]}) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f00008cf000-0x8)={0x0, 0x0}) [ 305.696948] binder: 15486:15496 transaction failed 29189/-3, size 40-8 line 2903 [ 305.718981] binder: BINDER_SET_CONTEXT_MGR already set [ 305.718990] binder: 15492:15497 ioctl 40046207 0 returned -16 [ 305.731548] binder_alloc: 15097: binder_alloc_buf, no vma 2018/02/01 04:11:26 executing program 1: openat$ion(0xffffffffffffff9c, &(0x7f0000801000-0x9)='/dev/ion\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000233000-0xd)='/dev/binder#\x00', 0x0, 0x2) r1 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) write$tun(0xffffffffffffffff, &(0x7f0000577000)=@pi={0x0, 0x0, @eth={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x0}, [], {@canfd={0xd, {{0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0, "feb442a1f43ead325d71fed774c8f6028c2a6b79a4e418aa3c5f391769659fef9f596cdade428c389e511eaad39d2ee4334dee9516a31d00510baaf06efc0980"}}}}}, 0x5a) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004ee000-0x76)='\x00', 0x1, 0x0, 0x0}], &(0x7f000000b000-0x30)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)=""}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00005da000)={0x0, 0x0, &(0x7f00000d8000)=[], 0x48, 0x0, &(0x7f000044c000-0x83)="a410778b7a640ab0384c4ead541b6ee57c5645909ef688d8ac3e5ecfc7039f5f8ba53f127b7f01947cd3689eaf6c090277915bab2a0c450988cb85688e2bcc101a80664d3081fcc0"}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000c5a000)={0x0, 0x0, 0x0, 0x0}) mmap(&(0x7f0000000000/0x13000)=nil, 0x13000, 0x0, 0x32, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000a95000-0x30)={0x14, 0x0, &(0x7f0000b8f000)=[@increfs_done={0x40106308, r3, 0x1}], 0x0, 0x0, &(0x7f00002e4000-0x70)=""}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000436000-0x30)={0x20, 0x0, &(0x7f0000136000)=[@dead_binder_done={0x40086310, 0x3}, @increfs_done={0x40106308, r3, 0x0}], 0x0, 0x0, &(0x7f0000888000-0xb)=""}) 2018/02/01 04:11:26 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f0000590000-0x8)='./file0\x00', 0x14) write$selinux_create(r0, &(0x7f000074c000)=@access={'system_u:object_r:dpkg_exec_t:s0', 0x20, '/usr/sbin/cups-browsed', 0x20, 0x32, 0x30, 0x0}, 0x3b) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f00007cf000)='/dev/cuse\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_STATUS(r1, 0xc05c5340, &(0x7f0000b85000)={0x6, 0x100, 0x2, {0x0, 0x0}, 0x0, 0x4, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000801000-0x9)='/dev/ion\x00', 0x0, 0x0) r3 = syz_open_dev$binder(&(0x7f0000233000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r4 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0) r5 = dup2(r3, r4) write$tun(0xffffffffffffffff, &(0x7f0000577000)=@pi={0x0, 0x0, @eth={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x0}, [], {@canfd={0xd, {{0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0, "feb442a1f43ead325d71fed774c8f6028c2a6b79a4e418aa3c5f391769659fef9f596cdade428c389e511eaad39d2ee4334dee9516a31d00510baaf06efc0980"}}}}}, 0x5a) r6 = dup2(r4, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004ee000-0x76)='\x00', 0x1, 0x0, 0x0}], &(0x7f000000b000-0x30)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)=""}) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f00005da000)={0x0, 0x0, &(0x7f00000d8000)=[], 0x48, 0x0, &(0x7f000044c000-0x83)="a410778b7a640ab0384c4ead541b6ee57c5645909ef688d8ac3e5ecfc7039f5f8ba53f127b7f01947cd3689eaf6c090277915bab2a0c450988cb85688e2bcc101a80664d3081fcc0"}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000c5a000)={0x0, 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000a95000-0x30)={0x14, 0x0, &(0x7f0000b8f000)=[@increfs_done={0x40106308, r7, 0x0}], 0x0, 0x0, &(0x7f00002e4000-0x70)=""}) getsockopt$inet6_dccp_buf(r5, 0x21, 0xcf, &(0x7f0000e10000-0xcc)=""/204, &(0x7f000037d000-0x4)=0xcc) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000436000-0x30)={0x20, 0x0, &(0x7f0000136000)=[@dead_binder_done={0x40086310, 0x3}, @increfs_done={0x40106308, r7, 0x0}], 0x0, 0x0, &(0x7f0000888000-0xb)=""}) close(r2) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000002000-0x38)={0x0, 0x0, &(0x7f0000003000)=[], 0x0, &(0x7f0000002000)=[{0x10, 0x10e, 0x0, ""}], 0x10, 0x0}, 0x0) 2018/02/01 04:11:26 executing program 2: openat$ion(0xffffffffffffff9c, &(0x7f0000801000-0x9)='/dev/ion\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000233000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) write$tun(0xffffffffffffffff, &(0x7f0000577000)=@pi={0x0, 0x0, @eth={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x0}, [], {@canfd={0xd, {{0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0, "feb442a1f43ead325d71fed774c8f6028c2a6b79a4e418aa3c5f391769659fef9f596cdade428c389e511eaad39d2ee4334dee9516a31d00510baaf06efc0980"}}}}}, 0x5a) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004ee000-0x76)='\x00', 0x1, 0x0, 0x0}], &(0x7f000000b000-0x30)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)=""}) ustat(0x4, &(0x7f0000f51000-0x20)={0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00005da000)={0x0, 0x0, &(0x7f00000d8000)=[], 0x48, 0x0, &(0x7f000044c000-0x83)="a410778b7a640ab0384c4ead541b6ee57c5645909ef688d8ac3e5ecfc7039f5f8ba53f127b7f01947cd3689eaf6c090277915bab2a0c450988cb85688e2bcc101a80664d3081fcc0"}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000c5a000)={0x0, 0x0, 0x0, 0x0}) mmap(&(0x7f0000000000/0x13000)=nil, 0x13000, 0x0, 0x32, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000a95000-0x30)={0x14, 0x0, &(0x7f0000b8f000)=[@increfs_done={0x40106308, r3, 0x1}], 0x0, 0x0, &(0x7f00002e4000-0x70)=""}) 2018/02/01 04:11:26 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet_sctp(0x2, 0x0, 0x84) sendto$inet(r0, &(0x7f0000022000-0x16)="01", 0x1, 0x0, &(0x7f0000031000-0x10)={0x2, 0xffffffffffffffff, @local={0xac, 0x14, 0xffffffffffffffff, 0xaa}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x10) shutdown(r0, 0x1) [ 305.731573] binder: 15492:15497 transaction failed 29189/-3, size 40-8 line 2903 [ 305.737772] binder: BINDER_SET_CONTEXT_MGR already set [ 305.737788] binder: 15489:15493 ioctl 40046207 0 returned -16 2018/02/01 04:11:26 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000ffe000-0x58)={0x26, 'hash\x00', 0x0, 0x0, 'sha512\x00'}, 0x58) r1 = syz_open_dev$usbmon(&(0x7f00002d8000-0xd)='/dev/usbmon#\x00', 0x0, 0x0) r2 = dup2(r1, r0) getsockopt$inet_sctp6_SCTP_ASSOCINFO(r1, 0x84, 0x1, &(0x7f00005a9000)={0x0, 0x7, 0xfffffffffffffbff, 0xcfa, 0x0, 0x8960}, &(0x7f00004d7000)=0x14) getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r2, 0x84, 0x1a, &(0x7f0000b46000-0xa3)={r3, 0x9b, "7a1c88a1ef751eb28d58727f250c0ce02de1bba1078728d48ce73012713212379353422f5ec18f09e799237b900dc37d3f556b7a6e86e5c075b4799cb7291ead970be9b87b6cbee196f021da28b8c4b131a0ad3e952e4283f9985cca54b0b434cb92025d970c94991a985f412fee604e740fba44211cfece385fc48dc98868c85375265f452467222f85c365db6dd4a494c97cc1a818b89bf7dc93"}, &(0x7f00007b6000)=0xa3) [ 305.746515] binder_alloc: 15097: binder_alloc_buf, no vma [ 305.746588] binder: 15489:15502 transaction failed 29189/-3, size 40-8 line 2903 [ 305.754621] binder: 15489:15512 BC_INCREFS_DONE u0000000000000000 no match [ 305.773768] binder: BINDER_SET_CONTEXT_MGR already set [ 305.773777] binder: 15510:15514 ioctl 40046207 0 returned -16 [ 305.774991] binder_alloc: 15097: binder_alloc_buf, no vma [ 305.775150] binder: 15510:15514 transaction failed 29189/-3, size 40-8 line 2903 2018/02/01 04:11:26 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_dev$mouse(&(0x7f0000377000)='/dev/input/mouse#\x00', 0x1, 0x0) syz_open_dev$adsp(&(0x7f0000acd000)='/dev/adsp#\x00', 0x20, 0x2000) signalfd(r0, &(0x7f0000d4c000-0x8)={0xffffffffffff8001}, 0x8) sendmsg$nl_xfrm(r0, &(0x7f0000a8d000)={&(0x7f0000e4e000)={0x10, 0x0, 0x0, 0x0}, 0xc, &(0x7f0000fcf000-0x10)={&(0x7f00005d5000)=@updsa={0x104, 0x1a, 0x1, 0xffffffffffffffff, 0xffffffffffffffff, {{@in6=@local={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0xffffffffffffffff, 0xaa}, @in=@dev={0xac, 0x14, 0xffffffffffffffff, 0x0}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0}, {@in=@broadcast=0xffffffff, 0xffffffffffffffff, 0x2b}, @in=@multicast2=0xe0000002, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, {0x0, 0x0, 0x0, 0x0}, {0x0, 0x0, 0x0}, 0xffffffffffffffff, 0xffffffffffffffff, 0xa, 0x2, 0x0, 0x0}, [@coaddr={0x14, 0xe, @in=@remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}}]}, 0x104}, 0x1, 0x0, 0x0, 0x0}, 0x0) 2018/02/01 04:11:26 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f0000590000-0x8)='./file0\x00', 0x14) write$selinux_create(r0, &(0x7f000074c000)=@access={'system_u:object_r:dpkg_exec_t:s0', 0x20, '/usr/sbin/cups-browsed', 0x20, 0x32, 0x30, 0x0}, 0x3b) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f00007cf000)='/dev/cuse\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_STATUS(r1, 0xc05c5340, &(0x7f0000b85000)={0x6, 0x100, 0x2, {0x0, 0x0}, 0x0, 0x4, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000801000-0x9)='/dev/ion\x00', 0x0, 0x0) r3 = syz_open_dev$binder(&(0x7f0000233000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r4 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0) r5 = dup2(r3, r4) write$tun(0xffffffffffffffff, &(0x7f0000577000)=@pi={0x0, 0x0, @eth={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x0}, [], {@canfd={0xd, {{0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0, "feb442a1f43ead325d71fed774c8f6028c2a6b79a4e418aa3c5f391769659fef9f596cdade428c389e511eaad39d2ee4334dee9516a31d00510baaf06efc0980"}}}}}, 0x5a) r6 = dup2(r4, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004ee000-0x76)='\x00', 0x1, 0x0, 0x0}], &(0x7f000000b000-0x30)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)=""}) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f00005da000)={0x0, 0x0, &(0x7f00000d8000)=[], 0x48, 0x0, &(0x7f000044c000-0x83)="a410778b7a640ab0384c4ead541b6ee57c5645909ef688d8ac3e5ecfc7039f5f8ba53f127b7f01947cd3689eaf6c090277915bab2a0c450988cb85688e2bcc101a80664d3081fcc0"}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000c5a000)={0x0, 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000a95000-0x30)={0x14, 0x0, &(0x7f0000b8f000)=[@increfs_done={0x40106308, r7, 0x0}], 0x0, 0x0, &(0x7f00002e4000-0x70)=""}) getsockopt$inet6_dccp_buf(r5, 0x21, 0xcf, &(0x7f0000e10000-0xcc)=""/204, &(0x7f000037d000-0x4)=0xcc) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000436000-0x30)={0x20, 0x0, &(0x7f0000136000)=[@dead_binder_done={0x40086310, 0x3}, @increfs_done={0x40106308, r7, 0x0}], 0x0, 0x0, &(0x7f0000888000-0xb)=""}) close(r2) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000002000-0x38)={0x0, 0x0, &(0x7f0000003000)=[], 0x0, &(0x7f0000002000)=[{0x10, 0x10e, 0x0, ""}], 0x10, 0x0}, 0x0) 2018/02/01 04:11:26 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) seccomp(0x1, 0x0, &(0x7f000089b000-0x10)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x407ffc0003}]}) shmctl$IPC_INFO(0x0, 0x3, &(0x7f0000564000)=""/4096) r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f00002a8000)='/dev/sequencer\x00', 0x484000, 0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000b2d000)={0xaa, 0x4, 0x0}) 2018/02/01 04:11:26 executing program 2: openat$ion(0xffffffffffffff9c, &(0x7f0000801000-0x9)='/dev/ion\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000233000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) dup2(r0, r1) write$tun(0xffffffffffffffff, &(0x7f0000577000)=@pi={0x0, 0x0, @eth={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x0}, [], {@canfd={0xd, {{0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0, "feb442a1f43ead325d71fed774c8f6028c2a6b79a4e418aa3c5f391769659fef9f596cdade428c389e511eaad39d2ee4334dee9516a31d00510baaf06efc0980"}}}}}, 0x5a) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004ee000-0x76)='\x00', 0x1, 0x0, 0x0}], &(0x7f000000b000-0x30)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)=""}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00005da000)={0x0, 0x0, &(0x7f00000d8000)=[], 0x48, 0x0, &(0x7f000044c000-0x83)="a410778b7a640ab0384c4ead541b6ee57c5645909ef688d8ac3e5ecfc7039f5f8ba53f127b7f01947cd3689eaf6c090277915bab2a0c450988cb85688e2bcc101a80664d3081fcc0"}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000c5a000)={0x0, 0x0, 0x0, 0x0}) mmap(&(0x7f0000000000/0x13000)=nil, 0x13000, 0x0, 0x32, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000a95000-0x30)={0x14, 0x0, &(0x7f0000b8f000)=[@increfs_done={0x40106308, r3, 0x1}], 0x0, 0x0, &(0x7f00002e4000-0x70)=""}) 2018/02/01 04:11:26 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet_sctp(0x2, 0x0, 0x84) sendto$inet(r0, &(0x7f0000022000-0x16)="01", 0x1, 0x0, &(0x7f0000031000-0x10)={0x2, 0xffffffffffffffff, @local={0xac, 0x14, 0xffffffffffffffff, 0xaa}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x10) shutdown(r0, 0x1) 2018/02/01 04:11:26 executing program 3: mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$mice(&(0x7f0000001000)='/dev/input/mice\x00', 0x0, 0x0) mmap(&(0x7f0000003000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) epoll_ctl$EPOLL_CTL_DEL(r0, 0x2, r0) mmap(&(0x7f0000003000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000003000)=@nat={'nat\x00', 0x1b, 0x4, 0x520, 0xd0, 0xd0, 0xffffffff, 0xd0, 0x2f8, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x4, &(0x7f0000003000)=[{0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}], {{{[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0xa8, 0xd0, 0x0, {0x0, 0x0}}, {0x28, '\x00', 0x0, 0xd0}}, [{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0x1e0, 0x228, 0x0, {0x0, 0x0}, [@common=@rt={0x138, 'rt\x00', 0x0, {0x8, 0x7, 0xfffffffffffffffc, 0x5, 0x30, 0x6, [@mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x1}, @loopback={0x0, 0x1}, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x1}, @remote={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0xbb}, @loopback={0x0, 0x1}, @loopback={0x0, 0x1}, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x1}, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x1}, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], [0xff, 0xff], @dev={0xac, 0x14, 0x0, 0x13}}, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], [0xff, 0xff], @dev={0xac, 0x14, 0x0, 0xc}}, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x1}, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x1}, @remote={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0xbb}, @remote={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0xbb}, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], [0xff, 0xff], @dev={0xac, 0x14, 0x0, 0xd}}], 0x3}}]}, @REDIRECT={0x48, 'REDIRECT\x00', 0x0, {0x6, @ipv4=@multicast1=0xe0000001, @ipv4=@empty=0x0, @port=0x3, @gre_key=0x6}}}, {{@ipv6={@loopback={0x0, 0x1}, @loopback={0x0, 0x1}, [0xffffffff, 0xffffffff, 0xff, 0xff000000], [0xffffffff, 0x0, 0xffffffff, 0xff], @common='rose0\x00', @syzn={0x73, 0x79, 0x7a, 0x0, 0x0}, {0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, {0xff, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x3b, 0x8, 0x4, 0x8}, 0x0, 0xa8, 0xf0, 0x0, {0x0, 0x0}, []}, @REDIRECT={0x48, 'REDIRECT\x00', 0x0, {0x4, @ipv4=@multicast2=0xe0000002, @ipv6=@empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, @icmp_id=0x3, @gre_key=0x8}}}, {{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0xf0, 0x138, 0x0, {0x0, 0x0}, [@common=@hbh={0x48, 'hbh\x00', 0x0, {0x0, 0x2, 0x1, [0xfffffffffffffff9, 0x4, 0x0, 0x10000, 0x2, 0x5, 0x8000, 0xffffffffffffffa1, 0x4, 0x8, 0x100000001, 0x6, 0x100000000, 0x800, 0x8, 0x9], 0x3}}]}, @NETMAP={0x48, 'NETMAP\x00', 0x0, {0x10, @ipv4=@local={0xac, 0x14, 0x0, 0xaa}, @ipv4=@multicast2=0xe0000002, @icmp_id=0x0, @port=0x3}}}]}}, 0x580) ioctl$int_in(r0, 0x5452, &(0x7f0000002000)=0xfffffffffffffffb) 2018/02/01 04:11:26 executing program 1: openat$ion(0xffffffffffffff9c, &(0x7f0000801000-0x9)='/dev/ion\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000233000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = dup2(r0, r1) write$tun(0xffffffffffffffff, &(0x7f0000577000)=@pi={0x0, 0x0, @eth={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x0}, [], {@canfd={0xd, {{0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0, "feb442a1f43ead325d71fed774c8f6028c2a6b79a4e418aa3c5f391769659fef9f596cdade428c389e511eaad39d2ee4334dee9516a31d00510baaf06efc0980"}}}}}, 0x5a) r3 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004ee000-0x76)='\x00', 0x1, 0x0, 0x0}], &(0x7f000000b000-0x30)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)=""}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00005da000)={0x0, 0x0, &(0x7f00000d8000)=[], 0x48, 0x0, &(0x7f000044c000-0x83)="a410778b7a640ab0384c4ead541b6ee57c5645909ef688d8ac3e5ecfc7039f5f8ba53f127b7f01947cd3689eaf6c090277915bab2a0c450988cb85688e2bcc101a80664d3081fcc0"}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000c5a000)={0x0, 0x0, 0x0, 0x0}) mmap(&(0x7f0000000000/0x13000)=nil, 0x13000, 0x0, 0x32, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000a95000-0x30)={0x14, 0x0, &(0x7f0000b8f000)=[@increfs_done={0x40106308, r4, 0x1}], 0x0, 0x0, &(0x7f00002e4000-0x70)=""}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000436000-0x30)={0x20, 0x0, &(0x7f0000136000)=[@dead_binder_done={0x40086310, 0x3}, @increfs_done={0x40106308, r4, 0x0}], 0x0, 0x0, &(0x7f0000888000-0xb)=""}) setsockopt$inet_MCAST_JOIN_GROUP(r2, 0x0, 0x2a, &(0x7f0000355000)={0x200, {{0x2, 0x3, @broadcast=0xffffffff, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}}, 0x90) 2018/02/01 04:11:26 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000742000)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4068aea3, &(0x7f0000af5000)={0x7b, 0x0, [0x0, 0x0, 0x0, 0x0], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) r3 = dup2(r2, r2) accept4$vsock_stream(r3, &(0x7f0000ae0000)={0x28, 0x0, 0x0, @host=0x2, 0x0}, 0x10, 0x800) ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000db3000-0x18)={0xc4, 0x0, [{0x40000082, 0x0, 0xfffffffffffffffe}]}) 2018/02/01 04:11:26 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f0000590000-0x8)='./file0\x00', 0x14) write$selinux_create(r0, &(0x7f000074c000)=@access={'system_u:object_r:dpkg_exec_t:s0', 0x20, '/usr/sbin/cups-browsed', 0x20, 0x32, 0x30, 0x0}, 0x3b) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f00007cf000)='/dev/cuse\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_STATUS(r1, 0xc05c5340, &(0x7f0000b85000)={0x6, 0x100, 0x2, {0x0, 0x0}, 0x0, 0x4, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000801000-0x9)='/dev/ion\x00', 0x0, 0x0) r3 = syz_open_dev$binder(&(0x7f0000233000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r4 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0) r5 = dup2(r3, r4) write$tun(0xffffffffffffffff, &(0x7f0000577000)=@pi={0x0, 0x0, @eth={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x0}, [], {@canfd={0xd, {{0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0, "feb442a1f43ead325d71fed774c8f6028c2a6b79a4e418aa3c5f391769659fef9f596cdade428c389e511eaad39d2ee4334dee9516a31d00510baaf06efc0980"}}}}}, 0x5a) r6 = dup2(r4, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004ee000-0x76)='\x00', 0x1, 0x0, 0x0}], &(0x7f000000b000-0x30)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)=""}) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f00005da000)={0x0, 0x0, &(0x7f00000d8000)=[], 0x48, 0x0, &(0x7f000044c000-0x83)="a410778b7a640ab0384c4ead541b6ee57c5645909ef688d8ac3e5ecfc7039f5f8ba53f127b7f01947cd3689eaf6c090277915bab2a0c450988cb85688e2bcc101a80664d3081fcc0"}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000c5a000)={0x0, 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000a95000-0x30)={0x14, 0x0, &(0x7f0000b8f000)=[@increfs_done={0x40106308, r7, 0x0}], 0x0, 0x0, &(0x7f00002e4000-0x70)=""}) getsockopt$inet6_dccp_buf(r5, 0x21, 0xcf, &(0x7f0000e10000-0xcc)=""/204, &(0x7f000037d000-0x4)=0xcc) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000436000-0x30)={0x20, 0x0, &(0x7f0000136000)=[@dead_binder_done={0x40086310, 0x3}, @increfs_done={0x40106308, r7, 0x0}], 0x0, 0x0, &(0x7f0000888000-0xb)=""}) close(r2) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000002000-0x38)={0x0, 0x0, &(0x7f0000003000)=[], 0x0, &(0x7f0000002000)=[{0x10, 0x10e, 0x0, ""}], 0x10, 0x0}, 0x0) [ 305.798524] binder: BINDER_SET_CONTEXT_MGR already set [ 305.798536] binder: 15515:15516 ioctl 40046207 0 returned -16 [ 305.799953] binder_alloc: 15097: binder_alloc_buf, no vma [ 305.799977] binder: 15515:15516 transaction failed 29189/-3, size 40-8 line 2903 2018/02/01 04:11:26 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) syz_open_dev$sndseq(&(0x7f0000994000)='/dev/snd/seq\x00', 0x0, 0x0) r0 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000226000)='/proc/self/net/pfkey\x00', 0x100, 0x0) ioctl$SIOCGIFHWADDR(r0, 0x8927, &(0x7f0000ba3000-0x50)={@generic=""/16, @ifru_ivalue=0x0}) [ 305.802620] binder: 15515:15516 BC_INCREFS_DONE u0000000000000000 no match [ 305.802801] binder: 15515:15516 BC_DEAD_BINDER_DONE 0000000000000003 not found 2018/02/01 04:11:26 executing program 1: openat$ion(0xffffffffffffff9c, &(0x7f0000801000-0x9)='/dev/ion\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000233000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) r2 = shmget$private(0x0, 0x1000, 0x44, &(0x7f0000e24000/0x1000)=nil) shmctl$IPC_INFO(r2, 0x3, &(0x7f0000c57000)=""/17) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r3 = dup2(r0, r1) write$tun(0xffffffffffffffff, &(0x7f0000577000)=@pi={0x0, 0x0, @eth={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x0}, [], {@canfd={0xd, {{0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0, "feb442a1f43ead325d71fed774c8f6028c2a6b79a4e418aa3c5f391769659fef9f596cdade428c389e511eaad39d2ee4334dee9516a31d00510baaf06efc0980"}}}}}, 0x5a) r4 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004ee000-0x76)='\x00', 0x1, 0x0, 0x0}], &(0x7f000000b000-0x30)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)=""}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00005da000)={0x0, 0x0, &(0x7f00000d8000)=[], 0x48, 0x0, &(0x7f000044c000-0x83)="a410778b7a640ab0384c4ead541b6ee57c5645909ef688d8ac3e5ecfc7039f5f8ba53f127b7f01947cd3689eaf6c090277915bab2a0c450988cb85688e2bcc101a80664d3081fcc0"}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000c5a000)={0x0, 0x0, 0x0, 0x0}) ioctl$DRM_IOCTL_VERSION(r3, 0xc0406400, &(0x7f00003cc000-0x40)={0x20, 0x96a5, 0x9, 0x29, &(0x7f0000ee0000-0x29)=""/41, 0xe1, &(0x7f0000770000-0xe1)=""/225, 0xa4, &(0x7f0000551000-0xa4)=""/164}) mmap(&(0x7f0000000000/0x13000)=nil, 0x13000, 0x0, 0x32, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000a95000-0x30)={0x14, 0x0, &(0x7f0000b8f000)=[@increfs_done={0x40106308, r5, 0x1}], 0x0, 0x0, &(0x7f00002e4000-0x70)=""}) ioctl$KDSKBMODE(r4, 0x4b45, &(0x7f0000042000)=0x9) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000436000-0x30)={0x20, 0x0, &(0x7f0000136000)=[@dead_binder_done={0x40086310, 0x3}, @increfs_done={0x40106308, r5, 0x0}], 0x0, 0x0, &(0x7f0000888000-0xb)=""}) 2018/02/01 04:11:26 executing program 2: openat$ion(0xffffffffffffff9c, &(0x7f0000801000-0x9)='/dev/ion\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000233000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) write$tun(0xffffffffffffffff, &(0x7f0000577000)=@pi={0x0, 0x0, @eth={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x0}, [], {@canfd={0xd, {{0x0, 0x0, 0x0, 0x6}, 0x2, 0x0, 0x0, 0x0, "feb442a1f43ead325d71fed774c8f6028c2a6b79a4e418aa3c5f391769659fef9f596cdade428c389e511eaad39d2ee4334dee9516a31d00510baaf06efc0980"}}}}}, 0x5a) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004ee000-0x76)='\x00', 0x1, 0x0, 0x0}], &(0x7f000000b000-0x30)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)=""}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00005da000)={0x0, 0x0, &(0x7f00000d8000)=[], 0x48, 0x0, &(0x7f000044c000-0x83)="a410778b7a640ab0384c4ead541b6ee57c5645909ef688d8ac3e5ecfc7039f5f8ba53f127b7f01947cd3689eaf6c090277915bab2a0c450988cb85688e2bcc101a80664d3081fcc0"}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000c5a000)={0x0, 0x0, 0x0, 0x0}) mmap(&(0x7f0000000000/0x13000)=nil, 0x13000, 0x0, 0x32, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000a95000-0x30)={0x14, 0x0, &(0x7f0000b8f000)=[@increfs_done={0x40106308, r3, 0x1}], 0x0, 0x0, &(0x7f00002e4000-0x70)=""}) 2018/02/01 04:11:26 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet_sctp(0x2, 0x0, 0x84) sendto$inet(r0, &(0x7f0000022000-0x16)="01", 0x1, 0x0, &(0x7f0000031000-0x10)={0x2, 0xffffffffffffffff, @local={0xac, 0x14, 0xffffffffffffffff, 0xaa}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x10) shutdown(r0, 0x1) 2018/02/01 04:11:26 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) seccomp(0x1, 0x0, &(0x7f000089b000-0x10)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x407ffc0003}]}) r0 = shmget$private(0x0, 0x4000, 0x10, &(0x7f00005b6000/0x4000)=nil) r1 = openat$dsp(0xffffffffffffff9c, &(0x7f00008cb000-0x9)='/dev/dsp\x00', 0x0, 0x0) getpeername$packet(r1, &(0x7f0000618000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @local={[0x0, 0x0, 0x0, 0x0], 0xffffffffffffffff, 0x0}, [0x0, 0x0]}, &(0x7f00009ee000-0x4)=0x14) shmctl$IPC_INFO(r0, 0x3, &(0x7f0000564000)=""/4096) 2018/02/01 04:11:26 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f0000590000-0x8)='./file0\x00', 0x14) write$selinux_create(r0, &(0x7f000074c000)=@access={'system_u:object_r:dpkg_exec_t:s0', 0x20, '/usr/sbin/cups-browsed', 0x20, 0x32, 0x30, 0x0}, 0x3b) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f00007cf000)='/dev/cuse\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_STATUS(r1, 0xc05c5340, &(0x7f0000b85000)={0x6, 0x100, 0x2, {0x0, 0x0}, 0x0, 0x4, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000801000-0x9)='/dev/ion\x00', 0x0, 0x0) r3 = syz_open_dev$binder(&(0x7f0000233000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r4 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0) r5 = dup2(r3, r4) write$tun(0xffffffffffffffff, &(0x7f0000577000)=@pi={0x0, 0x0, @eth={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x0}, [], {@canfd={0xd, {{0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0, "feb442a1f43ead325d71fed774c8f6028c2a6b79a4e418aa3c5f391769659fef9f596cdade428c389e511eaad39d2ee4334dee9516a31d00510baaf06efc0980"}}}}}, 0x5a) r6 = dup2(r4, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004ee000-0x76)='\x00', 0x1, 0x0, 0x0}], &(0x7f000000b000-0x30)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)=""}) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f00005da000)={0x0, 0x0, &(0x7f00000d8000)=[], 0x48, 0x0, &(0x7f000044c000-0x83)="a410778b7a640ab0384c4ead541b6ee57c5645909ef688d8ac3e5ecfc7039f5f8ba53f127b7f01947cd3689eaf6c090277915bab2a0c450988cb85688e2bcc101a80664d3081fcc0"}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000c5a000)={0x0, 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000a95000-0x30)={0x14, 0x0, &(0x7f0000b8f000)=[@increfs_done={0x40106308, r7, 0x1}], 0x0, 0x0, &(0x7f00002e4000-0x70)=""}) getsockopt$inet6_dccp_buf(0xffffffffffffffff, 0x21, 0xcf, &(0x7f0000e10000-0xcc)=""/204, &(0x7f000037d000-0x4)=0xcc) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000436000-0x30)={0x20, 0x0, &(0x7f0000136000)=[@dead_binder_done={0x40086310, 0x3}, @increfs_done={0x40106308, r7, 0x0}], 0x0, 0x0, &(0x7f0000888000-0xb)=""}) close(r2) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000002000-0x38)={0x0, 0x0, &(0x7f0000003000)=[], 0x0, &(0x7f0000002000)=[{0x10, 0x10e, 0x0, ""}], 0x10, 0x0}, 0x0) [ 305.802809] binder: 15515:15516 BC_INCREFS_DONE u0000000000000000 no match [ 305.814340] binder: BINDER_SET_CONTEXT_MGR already set 2018/02/01 04:11:26 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) sendmsg$unix(0xffffffffffffffff, &(0x7f0000833000)={&(0x7f0000564000)=@abs={0x0, 0x0, 0xffffffffffffffff}, 0x8, &(0x7f0000452000-0x10)=[{&(0x7f0000007000)="002a932f01000000cf960802e02348f800000000001c0003f2a576", 0x1b}], 0x1, &(0x7f00001fa000-0x20)=[], 0x0, 0x0}, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00004a2000-0x8)='./file0\x00', 0x22a840, 0x0) setsockopt$RDS_RECVERR(r0, 0x114, 0x5, &(0x7f0000719000)=0x0, 0x4) r1 = syz_open_dev$sg(&(0x7f00000c6000-0x9)='/dev/sg#\x00', 0x0, 0x0) ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, &(0x7f0000007000)={0x0, 0x0, 0x533, 0x30001, 0x0, 0x0}) ioctl$KVM_GET_REGS(r1, 0x8090ae81, &(0x7f00005cc000)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0x0}) ioctl(r1, 0x2285, &(0x7f0000007000)='S') [ 305.814348] binder: 15519:15521 ioctl 40046207 0 returned -16 [ 305.816720] binder_alloc: 15097: binder_alloc_buf, no vma [ 305.816744] binder: 15519:15521 transaction failed 29189/-3, size 40-3 line 2903 [ 305.820305] binder: 15519:15521 BC_INCREFS_DONE u0000000000000000 no match [ 305.827251] binder: BINDER_SET_CONTEXT_MGR already set [ 305.827260] binder: 15515:15516 ioctl 40046207 0 returned -16 [ 305.836164] binder_alloc: 15097: binder_alloc_buf, no vma [ 305.836189] binder: 15515:15516 transaction failed 29189/-3, size 40-8 line 2903 [ 305.836484] binder: BINDER_SET_CONTEXT_MGR already set [ 305.836497] binder: 15519:15524 ioctl 40046207 0 returned -16 [ 305.842508] binder: 15515:15523 BC_DEAD_BINDER_DONE 0000000000000003 not found [ 305.842519] binder: 15515:15523 BC_INCREFS_DONE u0000000000000000 no match [ 305.903370] binder: BINDER_SET_CONTEXT_MGR already set [ 305.903380] binder: 15535:15537 ioctl 40046207 0 returned -16 [ 305.904680] binder_alloc: 15097: binder_alloc_buf, no vma [ 305.904707] binder: 15535:15537 transaction failed 29189/-3, size 40-8 line 2903 [ 305.906863] binder: BINDER_SET_CONTEXT_MGR already set [ 305.906871] binder: 15536:15538 ioctl 40046207 0 returned -16 [ 305.909563] binder: BINDER_SET_CONTEXT_MGR already set [ 305.909572] binder: 15530:15531 ioctl 40046207 0 returned -16 [ 305.911693] binder_alloc: 15097: binder_alloc_buf, no vma [ 305.911718] binder: 15530:15531 transaction failed 29189/-3, size 40-8 line 2903 [ 305.917177] binder: 15530:15531 BC_INCREFS_DONE u0000000000000000 no match [ 305.920504] binder_alloc: 15097: binder_alloc_buf, no vma [ 305.920531] binder: 15536:15538 transaction failed 29189/-3, size 40-8 line 2903 [ 305.922817] binder: 15536:15538 BC_INCREFS_DONE u0000000000000000 no match [ 305.922959] binder: 15536:15538 BC_DEAD_BINDER_DONE 0000000000000003 not found [ 305.922969] binder: 15536:15538 BC_INCREFS_DONE u0000000000000000 no match [ 305.941337] binder: 15535:15537 BC_INCREFS_DONE u0000000000000000 no match [ 305.950721] binder: BINDER_SET_CONTEXT_MGR already set [ 305.950731] binder: 15545:15547 ioctl 40046207 0 returned -16 [ 305.951710] binder: BINDER_SET_CONTEXT_MGR already set [ 305.951718] binder: 15536:15544 ioctl 40046207 0 returned -16 [ 305.953744] binder_alloc: 15097: binder_alloc_buf, no vma [ 305.953770] binder: 15545:15547 transaction failed 29189/-3, size 40-8 line 2903 [ 305.964151] binder: BINDER_SET_CONTEXT_MGR already set [ 305.964185] binder: 15545:15547 BC_INCREFS_DONE u0000000000000000 no match [ 305.964200] binder: 15533:15541 ioctl 40046207 0 returned -16 [ 305.964423] binder_alloc: 15097: binder_alloc_buf, no vma [ 305.964447] binder: 15533:15541 transaction failed 29189/-3, size 40-8 line 2903 [ 305.965507] binder_alloc: 15097: binder_alloc_buf, no vma [ 305.965532] binder: 15536:15544 transaction failed 29189/-3, size 40-8 line 2903 [ 305.977348] binder: BINDER_SET_CONTEXT_MGR already set [ 305.977358] binder: 15535:15537 ioctl 40046207 0 returned -16 [ 305.994161] binder_alloc: 15097: binder_alloc_buf, no vma [ 305.994190] binder: 15535:15537 transaction failed 29189/-3, size 40-8 line 2903 [ 306.004634] kauditd_printk_skb: 388 callbacks suppressed [ 306.004643] audit: type=1326 audit(1517458285.935:5710): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 pid=15539 comm="syz-executor4" exe="/root/syz-executor4" sig=0 arch=c000003e syscall=31 compat=0 ip=0x453299 code=0x7ffc0000 [ 306.004664] audit: type=1326 audit(1517458285.936:5711): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 pid=15539 comm="syz-executor4" exe="/root/syz-executor4" sig=0 arch=c000003e syscall=202 compat=0 ip=0x453299 code=0x7ffc0000 [ 306.004681] audit: type=1326 audit(1517458285.936:5712): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 pid=15539 comm="syz-executor4" exe="/root/syz-executor4" sig=0 arch=c000003e syscall=202 compat=0 ip=0x453299 code=0x7ffc0000 [ 306.013221] binder: 15535:15552 BC_INCREFS_DONE u0000000000000000 no match [ 306.053153] binder: BINDER_SET_CONTEXT_MGR already set [ 306.053162] binder: 15560:15564 ioctl 40046207 0 returned -16 [ 306.053589] binder_alloc: 15097: binder_alloc_buf, no vma [ 306.053610] binder: 15560:15564 transaction failed 29189/-3, size 40-8 line 2903 [ 306.053758] binder: BINDER_SET_CONTEXT_MGR already set [ 306.053764] binder: 15556:15561 ioctl 40046207 0 returned -16 [ 306.054852] binder_alloc: 15097: binder_alloc_buf, no vma [ 306.054875] binder: 15556:15561 transaction failed 29189/-3, size 40-8 line 2903 [ 306.058590] binder: 15556:15561 BC_INCREFS_DONE u0000000000000000 no match [ 306.058649] binder: 15556:15561 BC_DEAD_BINDER_DONE 0000000000000003 not found [ 306.058657] binder: 15556:15561 BC_INCREFS_DONE u0000000000000000 no match [ 306.059967] audit: type=1326 audit(1517458285.991:5713): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 pid=15563 comm="syz-executor4" exe="/root/syz-executor4" sig=0 arch=c000003e syscall=202 compat=0 ip=0x453299 code=0x7ffc0000 [ 306.060373] audit: type=1326 audit(1517458285.992:5714): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 pid=15563 comm="syz-executor4" exe="/root/syz-executor4" sig=0 arch=c000003e syscall=202 compat=0 ip=0x453299 code=0x7ffc0000 [ 306.067443] binder: BINDER_SET_CONTEXT_MGR already set [ 306.067451] binder: 15556:15566 ioctl 40046207 0 returned -16 [ 306.070471] audit: type=1326 audit(1517458286.002:5715): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 pid=15563 comm="syz-executor4" exe="/root/syz-executor4" sig=0 arch=c000003e syscall=53 compat=0 ip=0x453299 code=0x7ffc0000 [ 306.077533] binder: BINDER_SET_CONTEXT_MGR already set [ 306.077542] binder: 15565:15568 ioctl 40046207 0 returned -16 [ 306.077639] binder_alloc: 15097: binder_alloc_buf, no vma [ 306.077664] binder: 15556:15570 transaction failed 29189/-3, size 40-8 line 2903 [ 306.079847] binder_alloc: 15097: binder_alloc_buf, no vma [ 306.079869] binder: 15565:15568 transaction failed 29189/-3, size 40-8 line 2903 [ 306.082124] binder: 15556:15566 BC_INCREFS_DONE u0000000000000000 no match [ 306.082166] binder: 15565:15568 BC_INCREFS_DONE u0000000000000000 no match [ 306.091710] audit: type=1326 audit(1517458286.022:5716): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 pid=15563 comm="syz-executor4" exe="/root/syz-executor4" sig=0 arch=c000003e syscall=202 compat=0 ip=0x453299 code=0x7ffc0000 [ 306.091730] audit: type=1326 audit(1517458286.022:5717): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 pid=15563 comm="syz-executor4" exe="/root/syz-executor4" sig=0 arch=c000003e syscall=202 compat=0 ip=0x453299 code=0x7ffc0000 [ 306.091746] audit: type=1326 audit(1517458286.022:5718): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 pid=15563 comm="syz-executor4" exe="/root/syz-executor4" sig=0 arch=c000003e syscall=55 compat=0 ip=0x453299 code=0x7ffc0000 [ 306.091763] audit: type=1326 audit(1517458286.023:5719): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 pid=15563 comm="syz-executor4" exe="/root/syz-executor4" sig=0 arch=c000003e syscall=202 compat=0 ip=0x453299 code=0x7ffc0000 [ 306.109816] binder: BINDER_SET_CONTEXT_MGR already set [ 306.109827] binder: 15565:15568 ioctl 40046207 0 returned -16 [ 306.124622] binder_alloc: 15097: binder_alloc_buf, no vma [ 306.124648] binder: 15565:15568 transaction failed 29189/-3, size 40-8 line 2903 [ 306.126371] binder: 15565:15572 BC_INCREFS_DONE u0000000000000000 no match [ 306.203344] binder: BINDER_SET_CONTEXT_MGR already set [ 306.203354] binder: 15584:15585 ioctl 40046207 0 returned -16 [ 306.206421] binder: BINDER_SET_CONTEXT_MGR already set [ 306.206430] binder: 15586:15589 ioctl 40046207 0 returned -16 [ 306.209462] binder_alloc: 15097: binder_alloc_buf, no vma [ 306.209493] binder: 15586:15589 transaction failed 29189/-3, size 40-8 line 2903 [ 306.213740] binder: 15586:15589 BC_INCREFS_DONE u0000000000000000 no match [ 306.213981] binder: 15586:15589 BC_DEAD_BINDER_DONE 0000000000000003 not found [ 306.213991] binder: 15586:15589 BC_INCREFS_DONE u0000000000000000 no match [ 306.215569] binder_alloc: 15097: binder_alloc_buf, no vma [ 306.215595] binder: 15584:15585 transaction failed 29189/-3, size 40-8 line 2903 [ 306.216053] binder: 15584:15585 BC_INCREFS_DONE u0000000000000000 no match [ 306.231220] binder: BINDER_SET_CONTEXT_MGR already set [ 306.231230] binder: 15580:15591 ioctl 40046207 0 returned -16 [ 306.231527] binder_alloc: 15097: binder_alloc_buf, no vma [ 306.231552] binder: 15580:15591 transaction failed 29189/-3, size 40-8 line 2903 [ 306.263539] binder: BINDER_SET_CONTEXT_MGR already set [ 306.263552] binder: 15586:15589 ioctl 40046207 0 returned -16 [ 306.269701] binder_alloc: 15097: binder_alloc_buf, no vma [ 306.269731] binder: 15586:15589 transaction failed 29189/-3, size 40-8 line 2903 [ 306.272262] binder: BINDER_SET_CONTEXT_MGR already set [ 306.272272] binder: 15584:15596 ioctl 40046207 0 returned -16 [ 306.273708] binder: 15586:15598 BC_DEAD_BINDER_DONE 0000000000000003 not found [ 306.273721] binder: 15586:15598 BC_INCREFS_DONE u0000000000000000 no match [ 306.275952] binder_alloc: 15097: binder_alloc_buf, no vma [ 306.275978] binder: 15584:15585 transaction failed 29189/-3, size 40-8 line 2903 [ 306.276542] binder: 15584:15585 BC_INCREFS_DONE u0000000000000000 no match [ 306.279928] binder: BINDER_SET_CONTEXT_MGR already set [ 306.279938] binder: 15600:15602 ioctl 40046207 0 returned -16 [ 306.282744] binder_alloc: 15097: binder_alloc_buf, no vma [ 306.282771] binder: 15600:15602 transaction failed 29189/-3, size 40-8 line 2903 [ 306.321148] binder: BINDER_SET_CONTEXT_MGR already set [ 306.321157] binder: 15606:15607 ioctl 40046207 0 returned -16 [ 306.321489] binder_alloc: 15097: binder_alloc_buf, no vma [ 306.321512] binder: 15606:15607 transaction failed 29189/-3, size 40-8 line 2903 [ 306.333267] binder: BINDER_SET_CONTEXT_MGR already set [ 306.333275] binder: 15608:15612 ioctl 40046207 0 returned -16 [ 306.334319] binder: 15608:15612 transaction failed 29189/-22, size 40-8 line 2788 [ 306.344388] binder: 15608:15612 BC_INCREFS_DONE u0000000000000000 no match [ 306.345352] binder: 15608:15612 BC_DEAD_BINDER_DONE 0000000000000003 not found [ 306.345362] binder: 15608:15612 BC_INCREFS_DONE u0000000000000000 no match [ 306.363259] binder: BINDER_SET_CONTEXT_MGR already set [ 306.363269] binder: 15611:15617 ioctl 40046207 0 returned -16 [ 306.365358] binder_alloc: 15097: binder_alloc_buf, no vma [ 306.365412] binder: 15611:15617 transaction failed 29189/-3, size 40-8 line 2903 [ 306.367599] binder: 15611:15617 BC_INCREFS_DONE u0000000000000000 no match [ 306.383757] binder: BINDER_SET_CONTEXT_MGR already set [ 306.383768] binder: 15611:15617 ioctl 40046207 0 returned -16 [ 306.387803] binder_alloc: 15097: binder_alloc_buf, no vma [ 306.387828] binder: 15611:15617 transaction failed 29189/-3, size 40-8 line 2903 [ 306.391428] binder: 15611:15617 BC_INCREFS_DONE u0000000000000000 no match [ 306.407339] binder: 15608:15618 BC_DEAD_BINDER_DONE 0000000000000003 not found [ 306.407359] binder: 15608:15618 BC_INCREFS_DONE u00000000204edf8a node 1520 cookie mismatch 0000000000000000 != 0000000000000001 [ 306.407495] binder: 15608:15612 BC_INCREFS_DONE node 1520 has no pending increfs request [ 306.464460] binder: BINDER_SET_CONTEXT_MGR already set [ 306.464476] binder: 15631:15634 ioctl 40046207 0 returned -16 [ 306.465605] binder_alloc: 15097: binder_alloc_buf, no vma [ 306.465628] binder: 15631:15634 transaction failed 29189/-3, size 40-8 line 2903 [ 306.468642] binder: 15631:15634 BC_INCREFS_DONE u0000000000000000 no match [ 306.468992] binder: BINDER_SET_CONTEXT_MGR already set [ 306.469004] binder: 15629:15632 ioctl 40046207 0 returned -16 [ 306.469802] binder_alloc: 15097: binder_alloc_buf, no vma [ 306.469823] binder: 15629:15632 transaction failed 29189/-3, size 40-8 line 2903 [ 306.484090] binder: BINDER_SET_CONTEXT_MGR already set [ 306.484100] binder: 15636:15641 ioctl 40046207 0 returned -16 [ 306.484977] binder_alloc: 15097: binder_alloc_buf, no vma [ 306.485000] binder: 15636:15641 transaction failed 29189/-3, size 40-8 line 2903 [ 306.487248] binder: 15636:15641 BC_INCREFS_DONE u0000000000000000 no match [ 306.487373] binder: 15636:15641 BC_DEAD_BINDER_DONE 0000000000000003 not found [ 306.487382] binder: 15636:15641 BC_INCREFS_DONE u0000000000000000 no match [ 306.493871] binder: BINDER_SET_CONTEXT_MGR already set [ 306.493880] binder: 15631:15634 ioctl 40046207 0 returned -16 [ 306.511385] binder: BINDER_SET_CONTEXT_MGR already set [ 306.511395] binder: 15636:15641 ioctl 40046207 0 returned -16 [ 306.512563] binder_alloc: 15097: binder_alloc_buf, no vma [ 306.512592] binder: 15631:15634 transaction failed 29189/-3, size 40-8 line 2903 [ 306.515345] binder_alloc: 15097: binder_alloc_buf, no vma [ 306.515369] binder: 15636:15641 transaction failed 29189/-3, size 40-8 line 2903 [ 306.519512] binder: BINDER_SET_CONTEXT_MGR already set [ 306.519521] binder: 15646:15648 ioctl 40046207 0 returned -16 [ 306.519819] binder_alloc: 15097: binder_alloc_buf, no vma [ 306.519864] binder: 15646:15648 transaction failed 29189/-3, size 40-8 line 2903 [ 306.571415] binder: BINDER_SET_CONTEXT_MGR already set [ 306.571425] binder: 15654:15661 ioctl 40046207 0 returned -16 [ 306.572622] binder_alloc: 15097: binder_alloc_buf, no vma [ 306.572646] binder: 15654:15661 transaction failed 29189/-3, size 40-8 line 2903 [ 306.572761] binder: BINDER_SET_CONTEXT_MGR already set [ 306.572768] binder: 15653:15657 ioctl 40046207 0 returned -16 [ 306.575571] binder_alloc: 15097: binder_alloc_buf, no vma [ 306.575596] binder: 15653:15657 transaction failed 29189/-3, size 40-8 line 2903 [ 306.575694] binder: 15654:15661 BC_INCREFS_DONE u0000000000000000 no match [ 306.575854] binder: 15653:15657 ioctl c0406400 203cbfc0 returned -22 [ 306.577908] binder: 15653:15657 BC_INCREFS_DONE u0000000000000000 no match [ 306.577986] binder: 15653:15657 ioctl 4b45 20042000 returned -22 [ 306.578090] binder: 15653:15657 BC_DEAD_BINDER_DONE 0000000000000003 not found [ 306.578099] binder: 15653:15657 BC_INCREFS_DONE u0000000000000000 no match [ 306.599612] binder: BINDER_SET_CONTEXT_MGR already set [ 306.599623] binder: 15654:15661 ioctl 40046207 0 returned -16 [ 306.605443] binder_alloc: 15097: binder_alloc_buf, no vma [ 306.605476] binder: 15654:15661 transaction failed 29189/-3, size 40-8 line 2903 [ 306.605905] binder: BINDER_SET_CONTEXT_MGR already set [ 306.605914] binder: 15653:15657 ioctl 40046207 0 returned -16 [ 306.611124] binder_alloc: 15097: binder_alloc_buf, no vma [ 306.611145] binder: 15653:15657 transaction failed 29189/-3, size 40-8 line 2903 [ 306.617262] binder: BINDER_SET_CONTEXT_MGR already set [ 306.617271] binder: 15663:15667 ioctl 40046207 0 returned -16 [ 306.618823] binder_alloc: 15097: binder_alloc_buf, no vma [ 306.618845] binder: 15663:15667 transaction failed 29189/-3, size 40-8 line 2903 [ 306.626586] binder: 15653:15670 ioctl c0406400 203cbfc0 returned -22 [ 306.628648] binder: 15653:15670 BC_INCREFS_DONE u0000000000000000 no match [ 306.629845] binder: 15653:15657 ioctl 4b45 20042000 returned -22 [ 306.629874] binder: 15653:15670 BC_DEAD_BINDER_DONE 0000000000000003 not found [ 306.629883] binder: 15653:15670 BC_INCREFS_DONE u0000000000000000 no match [ 308.054519] binder: undelivered TRANSACTION_ERROR: 29189 [ 308.054768] binder: undelivered TRANSACTION_ERROR: 29189 [ 308.054916] binder: undelivered TRANSACTION_ERROR: 29189 [ 308.055180] binder: undelivered TRANSACTION_ERROR: 29189 [ 308.055296] binder: undelivered TRANSACTION_ERROR: 29189 [ 308.055400] binder: undelivered TRANSACTION_ERROR: 29189 [ 308.055665] binder: undelivered TRANSACTION_ERROR: 29189 [ 308.055818] binder: undelivered TRANSACTION_ERROR: 29189 [ 308.056302] binder: undelivered TRANSACTION_ERROR: 29189 [ 308.056434] binder: undelivered TRANSACTION_ERROR: 29189 [ 308.056640] binder: undelivered TRANSACTION_ERROR: 29189 [ 308.056753] binder: undelivered TRANSACTION_ERROR: 29189 [ 308.056842] binder: undelivered TRANSACTION_ERROR: 29189 [ 308.057169] binder: undelivered TRANSACTION_ERROR: 29189 2018/02/01 04:11:28 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$mice(&(0x7f0000a94000)='/dev/input/mice\x00', 0x0, 0x440) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f0000609000-0x4c8)={{0x8, 0x5, 0x8, 0x81, "e9e180f418c84ab4e808455094b49cc73b1a7f0fc1a000dd3b2dc6f43e7290ab765c4d64e2f0795e1a912582", 0x80}, 0xd01, [0x100000000, 0x3, 0x1, 0x7, 0x3b, 0x9, 0xe67, 0xb41, 0xd0, 0x7, 0xfffffffffffffffe, 0x58e8, 0x8, 0x6, 0x7ff, 0x0, 0x5, 0xd7, 0x8, 0x0, 0x3, 0x34, 0x1, 0x8, 0x44608f87, 0x80000000, 0x2, 0x2f, 0x7fffffff, 0x9, 0x3, 0x6, 0x5, 0x4, 0x3, 0x0, 0x26f1, 0x0, 0x81, 0x7, 0x8000000000000000, 0x1000, 0x8, 0x7fffffff, 0x80000000, 0x9, 0x9, 0x80000000, 0x84, 0x9, 0x4, 0x200, 0x80000000, 0x5, 0x0, 0x4c6b, 0x8, 0x61ef, 0x6, 0xfff, 0xa7, 0x1, 0x1, 0x101, 0x7, 0x7fffffff, 0x4, 0x7d3, 0x7, 0x4, 0x3, 0x8, 0xc92, 0x800, 0x40b, 0xffffffffffff8000, 0x200, 0xfffffffffffffffb, 0x80000000, 0x7, 0x6, 0x0, 0x80, 0xffff, 0x56a, 0x3, 0xfffffffffffffffb, 0x4, 0x1a7d, 0x40, 0x800, 0x3, 0x80000000, 0x2, 0xfffffffffffffffa, 0x10000, 0x400, 0x694, 0x7f, 0xa3, 0xfffffffffffffc00, 0x0, 0x9, 0x4, 0x3f, 0x6, 0x5, 0xa43c, 0x1, 0x8001, 0x98, 0x3, 0x3, 0x1, 0x1, 0x200, 0x10ac, 0x100, 0x3, 0x1, 0x21662b27, 0x99, 0x7e1cf065, 0x3, 0x9, 0x400, 0x5, 0x8], {0x0, 0x0}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000a8d000)={&(0x7f0000e4e000)={0x10, 0x0, 0x0, 0x0}, 0xc, &(0x7f0000fcf000-0x10)={&(0x7f00005d5000)=@updsa={0x104, 0x1a, 0x1, 0xffffffffffffffff, 0xffffffffffffffff, {{@in6=@mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x1}, @in=@dev={0xac, 0x14, 0xffffffffffffffff, 0x0}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0}, {@in=@broadcast=0xffffffff, 0xffffffffffffffff, 0x2b}, @in=@multicast2=0xe0000002, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, {0x0, 0x0, 0x0, 0x0}, {0x0, 0x0, 0x0}, 0xffffffffffffffff, 0xffffffffffffffff, 0xa, 0x2, 0x0, 0x0}, [@coaddr={0x14, 0xe, @in=@remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}}]}, 0x104}, 0x1, 0x0, 0x0, 0x0}, 0x0) syz_open_dev$vcsa(&(0x7f0000bad000-0xb)='/dev/vcsa#\x00', 0x8000, 0x4000) 2018/02/01 04:11:28 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(0xffffffffffffffff, &(0x7f0000022000-0x16)="01", 0x1, 0x0, &(0x7f0000031000-0x10)={0x2, 0xffffffffffffffff, @local={0xac, 0x14, 0xffffffffffffffff, 0xaa}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x10) shutdown(r0, 0x1) 2018/02/01 04:11:28 executing program 1: openat$ion(0xffffffffffffff9c, &(0x7f0000801000-0x9)='/dev/ion\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000233000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) write$tun(0xffffffffffffffff, &(0x7f0000577000)=@pi={0x0, 0x0, @eth={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x0}, [], {@canfd={0xd, {{0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0, "feb442a1f43ead325d71fed774c8f6028c2a6b79a4e418aa3c5f391769659fef9f596cdade428c389e511eaad39d2ee4334dee9516a31d00510baaf06efc0980"}}}}}, 0x5a) syz_open_dev$adsp(&(0x7f0000061000-0xb)='/dev/adsp#\x00', 0x86, 0x0) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004ee000-0x76)='\x00', 0x1, 0x0, 0x0}], &(0x7f000000b000-0x30)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)=""}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00005da000)={0x0, 0x0, &(0x7f00000d8000)=[], 0x48, 0x0, &(0x7f000044c000-0x83)="a410778b7a640ab0384c4ead541b6ee57c5645909ef688d8ac3e5ecfc7039f5f8ba53f127b7f01947cd3689eaf6c090277915bab2a0c450988cb85688e2bcc101a80664d3081fcc0"}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000c5a000)={0x0, 0x0, 0x0, 0x0}) mmap(&(0x7f0000000000/0x13000)=nil, 0x13000, 0x0, 0x32, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000a95000-0x30)={0x14, 0x0, &(0x7f0000b8f000)=[@increfs_done={0x40106308, r3, 0x1}], 0x0, 0x0, &(0x7f00002e4000-0x70)=""}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000436000-0x30)={0x20, 0x0, &(0x7f0000136000)=[@dead_binder_done={0x40086310, 0x3}, @increfs_done={0x40106308, r3, 0x0}], 0x0, 0x0, &(0x7f0000888000-0xb)=""}) 2018/02/01 04:11:28 executing program 2: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000801000-0x9)='/dev/ion\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000233000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = dup3(r1, r0, 0x80000) r4 = openat(r3, &(0x7f0000182000-0x8)='./file0\x00', 0x4000, 0x14) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) dup2(r2, r2) r5 = dup2(r2, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004ee000-0x76)='\x00', 0x1, 0x0, 0x0}], &(0x7f000000b000-0x30)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)=""}) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f00005da000)={0x0, 0x0, &(0x7f00000d8000)=[], 0x48, 0x0, &(0x7f000044c000-0x83)="a410778b7a640ab0384c4ead541b6ee57c5645909ef688d8ac3e5ecfc7039f5f8ba53f127b7f01947cd3689eaf6c090277915bab2a0c450988cb85688e2bcc101a80664d3081fcc0"}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000c5a000)={0x0, 0x0, 0x0, 0x0}) r7 = getpgrp(0xffffffffffffffff) fcntl$setownex(r4, 0xf, &(0x7f0000c3c000)={0x0, r7}) mmap(&(0x7f0000000000/0x13000)=nil, 0x13000, 0x0, 0x32, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000a95000-0x30)={0x14, 0x0, &(0x7f0000b8f000)=[@increfs_done={0x40106308, r6, 0x1}], 0x0, 0x0, &(0x7f00002e4000-0x70)=""}) socketpair$inet_sctp(0x2, 0x0, 0x84, &(0x7f0000559000-0x8)={0x0, 0x0}) 2018/02/01 04:11:28 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) seccomp(0x100000000000001, 0x0, &(0x7f0000644000)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0xfffffdffffffffff, 0x407ffc0003}]}) r0 = openat$rtc(0xffffffffffffff9c, &(0x7f000016a000-0x9)='/dev/rtc\x00', 0x4000, 0x0) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000d67000-0x4)='tls\x00', 0x4) shmctl$IPC_INFO(0x0, 0x3, &(0x7f0000564000)=""/4096) 2018/02/01 04:11:28 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000ddd000)='/dev/cuse\x00', 0x2000000000001, 0x0) write$fuse(r0, &(0x7f000000b000-0x21)={0x28, 0x2, 0x0, @fuse_notify_inval_inode_out={0x0, 0x0, 0x0}}, 0x28) 2018/02/01 04:11:28 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f0000590000-0x8)='./file0\x00', 0x14) write$selinux_create(r0, &(0x7f000074c000)=@access={'system_u:object_r:dpkg_exec_t:s0', 0x20, '/usr/sbin/cups-browsed', 0x20, 0x32, 0x30, 0x0}, 0x3b) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f00007cf000)='/dev/cuse\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_STATUS(r1, 0xc05c5340, &(0x7f0000b85000)={0x6, 0x100, 0x2, {0x0, 0x0}, 0x0, 0x4, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000801000-0x9)='/dev/ion\x00', 0x0, 0x0) r3 = syz_open_dev$binder(&(0x7f0000233000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r4 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0) r5 = dup2(r3, r4) write$tun(0xffffffffffffffff, &(0x7f0000577000)=@pi={0x0, 0x0, @eth={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x0}, [], {@canfd={0xd, {{0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0, "feb442a1f43ead325d71fed774c8f6028c2a6b79a4e418aa3c5f391769659fef9f596cdade428c389e511eaad39d2ee4334dee9516a31d00510baaf06efc0980"}}}}}, 0x5a) r6 = dup2(r4, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004ee000-0x76)='\x00', 0x1, 0x0, 0x0}], &(0x7f000000b000-0x30)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)=""}) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f00005da000)={0x0, 0x0, &(0x7f00000d8000)=[], 0x48, 0x0, &(0x7f000044c000-0x83)="a410778b7a640ab0384c4ead541b6ee57c5645909ef688d8ac3e5ecfc7039f5f8ba53f127b7f01947cd3689eaf6c090277915bab2a0c450988cb85688e2bcc101a80664d3081fcc0"}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000c5a000)={0x0, 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000a95000-0x30)={0x14, 0x0, &(0x7f0000b8f000)=[@increfs_done={0x40106308, r7, 0x1}], 0x0, 0x0, &(0x7f00002e4000-0x70)=""}) getsockopt$inet6_dccp_buf(0xffffffffffffffff, 0x21, 0xcf, &(0x7f0000e10000-0xcc)=""/204, &(0x7f000037d000-0x4)=0xcc) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000436000-0x30)={0x20, 0x0, &(0x7f0000136000)=[@dead_binder_done={0x40086310, 0x3}, @increfs_done={0x40106308, r7, 0x0}], 0x0, 0x0, &(0x7f0000888000-0xb)=""}) close(r2) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000002000-0x38)={0x0, 0x0, &(0x7f0000003000)=[], 0x0, &(0x7f0000002000)=[{0x10, 0x10e, 0x0, ""}], 0x10, 0x0}, 0x0) 2018/02/01 04:11:28 executing program 5: mmap(&(0x7f0000000000/0xfc8000)=nil, 0xfc8000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket(0x2, 0x5, 0x0) setsockopt$sock_timeval(r0, 0x1, 0x14, &(0x7f0000fc8000-0x10)={0x0, 0x2710}, 0x10) recvmmsg(r0, &(0x7f0000fc6000-0x39)=[{{0x0, 0x0, &(0x7f000062d000-0x20)=[], 0x0, &(0x7f0000fc2000-0x92)=""/146, 0x92, 0x0}, 0x0}], 0x1, 0x0, 0x0) mmap(&(0x7f0000fc8000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) getsockopt$inet_sctp_SCTP_DEFAULT_PRINFO(r0, 0x84, 0x72, &(0x7f0000fc9000-0xc)={0x0, 0x100000001, 0x10}, &(0x7f0000ed6000-0x4)=0xc) mmap(&(0x7f0000fc8000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) getsockopt$inet_sctp_SCTP_CONTEXT(r0, 0x84, 0x11, &(0x7f000035d000-0x8)={r1, 0x9}, &(0x7f0000fc8000)=0x8) [ 308.057256] binder: undelivered TRANSACTION_ERROR: 29189 [ 308.057328] binder: undelivered TRANSACTION_ERROR: 29189 [ 308.057584] binder: undelivered TRANSACTION_ERROR: 29189 [ 308.057671] binder: undelivered TRANSACTION_ERROR: 29189 2018/02/01 04:11:28 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(0xffffffffffffffff, &(0x7f0000022000-0x16)="01", 0x1, 0x0, &(0x7f0000031000-0x10)={0x2, 0xffffffffffffffff, @local={0xac, 0x14, 0xffffffffffffffff, 0xaa}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x10) shutdown(r0, 0x1) 2018/02/01 04:11:28 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) r1 = creat(&(0x7f00005c2000)='./file0\x00', 0xa) socketpair$inet6_udp(0xa, 0x2, 0x0, &(0x7f0000e24000)={0x0, 0x0}) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000597000)={0x0, r1, 0x4, 0x1, 0x0}, 0x14) ioctl$sock_inet_SIOCDELRT(r1, 0x890c, &(0x7f0000d20000)={0x1, {0x2, 0x0, @multicast1=0xe0000001, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, {0x2, 0x3, @dev={0xac, 0x14, 0x0, 0xd}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, {0x2, 0x2, @rand_addr=0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x40, 0x0, 0x7, 0x7, 0x6, &(0x7f0000fd9000-0x10)=@common='gre0\x00', 0x3, 0x1, 0xd8f9}) sendmsg(r0, &(0x7f0000112000-0x38)={&(0x7f00007cc000)=@nfc={0x27, 0x0, 0x0, 0x0}, 0x10, &(0x7f0000419000)=[], 0x0, &(0x7f0000243000-0x270)=[{0x10, 0x84, 0x101, ""}], 0x10, 0x0}, 0x0) 2018/02/01 04:11:28 executing program 3: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000001000-0xa)='/dev/ptmx\x00', 0x0, 0x0) ioctl$KDSKBMETA(r1, 0x4b63, &(0x7f000093b000)=0x3) sendmsg$nl_xfrm(r0, &(0x7f000000b000)={&(0x7f000000f000)={0x10, 0x0, 0x0, 0x0}, 0xc, &(0x7f00005a7000-0x10)={&(0x7f0000ee9000-0x10)=@newsa={0x138, 0x10, 0x713, 0xffffffffffffffff, 0xffffffffffffffff, {{@in6=@mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x1}, @in6=@dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0xffffffffffffffff, 0x0}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, {@in=@empty=0x0, 0xffffffffffffffff, 0x6c}, @in6=@loopback={0x0, 0x1}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, {0x0, 0x0, 0x0, 0x0}, {0x0, 0x0, 0x0}, 0xffffffffffffffff, 0xffffffffffffffff, 0x2, 0x0, 0x0, 0x0}, [@algo_comp={0x48, 0x3, {{'deflate\x00'}, 0x0, ""}}]}, 0x138}, 0x1, 0x0, 0x0, 0x0}, 0x0) [ 308.057803] binder: undelivered TRANSACTION_ERROR: 29189 [ 308.057920] binder: undelivered TRANSACTION_ERROR: 29189 [ 308.058095] binder: undelivered TRANSACTION_ERROR: 29189 2018/02/01 04:11:28 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f0000590000-0x8)='./file0\x00', 0x14) write$selinux_create(r0, &(0x7f000074c000)=@access={'system_u:object_r:dpkg_exec_t:s0', 0x20, '/usr/sbin/cups-browsed', 0x20, 0x32, 0x30, 0x0}, 0x3b) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f00007cf000)='/dev/cuse\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_STATUS(r1, 0xc05c5340, &(0x7f0000b85000)={0x6, 0x100, 0x2, {0x0, 0x0}, 0x0, 0x4, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000801000-0x9)='/dev/ion\x00', 0x0, 0x0) r3 = syz_open_dev$binder(&(0x7f0000233000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r4 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0) r5 = dup2(r3, r4) write$tun(0xffffffffffffffff, &(0x7f0000577000)=@pi={0x0, 0x0, @eth={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x0}, [], {@canfd={0xd, {{0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0, "feb442a1f43ead325d71fed774c8f6028c2a6b79a4e418aa3c5f391769659fef9f596cdade428c389e511eaad39d2ee4334dee9516a31d00510baaf06efc0980"}}}}}, 0x5a) r6 = dup2(r4, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004ee000-0x76)='\x00', 0x1, 0x0, 0x0}], &(0x7f000000b000-0x30)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)=""}) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f00005da000)={0x0, 0x0, &(0x7f00000d8000)=[], 0x48, 0x0, &(0x7f000044c000-0x83)="a410778b7a640ab0384c4ead541b6ee57c5645909ef688d8ac3e5ecfc7039f5f8ba53f127b7f01947cd3689eaf6c090277915bab2a0c450988cb85688e2bcc101a80664d3081fcc0"}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000c5a000)={0x0, 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000a95000-0x30)={0x14, 0x0, &(0x7f0000b8f000)=[@increfs_done={0x40106308, r7, 0x1}], 0x0, 0x0, &(0x7f00002e4000-0x70)=""}) getsockopt$inet6_dccp_buf(0xffffffffffffffff, 0x21, 0xcf, &(0x7f0000e10000-0xcc)=""/204, &(0x7f000037d000-0x4)=0xcc) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000436000-0x30)={0x20, 0x0, &(0x7f0000136000)=[@dead_binder_done={0x40086310, 0x3}, @increfs_done={0x40106308, r7, 0x0}], 0x0, 0x0, &(0x7f0000888000-0xb)=""}) close(r2) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000002000-0x38)={0x0, 0x0, &(0x7f0000003000)=[], 0x0, &(0x7f0000002000)=[{0x10, 0x10e, 0x0, ""}], 0x10, 0x0}, 0x0) 2018/02/01 04:11:28 executing program 1: r0 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000af5000)='/selinux/avc/hash_stats\x00', 0x0, 0x0) openat$ion(0xffffffffffffff9c, &(0x7f0000801000-0x9)='/dev/ion\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000233000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) r3 = dup2(r1, r2) write$tun(0xffffffffffffffff, &(0x7f0000577000)=@pi={0x0, 0x0, @eth={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x0}, [], {@canfd={0xd, {{0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0, "feb442a1f43ead325d71fed774c8f6028c2a6b79a4e418aa3c5f391769659fef9f596cdade428c389e511eaad39d2ee4334dee9516a31d00510baaf06efc0980"}}}}}, 0x5a) r4 = dup2(r2, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004ee000-0x76)='\x00', 0x1, 0x0, 0x0}], &(0x7f000000b000-0x30)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)=""}) getsockopt$inet_sctp_SCTP_PR_SUPPORTED(r3, 0x84, 0x71, &(0x7f0000fd7000-0x8)={0x0, 0x7ff}, &(0x7f0000686000-0x4)=0x8) getsockopt$inet_sctp_SCTP_DEFAULT_PRINFO(r0, 0x84, 0x72, &(0x7f00001da000)={r5, 0x3f, 0x10}, &(0x7f0000bd9000-0x4)=0xc) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00005da000)={0x0, 0x0, &(0x7f00000d8000)=[], 0x48, 0x0, &(0x7f000044c000-0x83)="a410778b7a640ab0384c4ead541b6ee57c5645909ef688d8ac3e5ecfc7039f5f8ba53f127b7f01947cd3689eaf6c090277915bab2a0c450988cb85688e2bcc101a80664d3081fcc0"}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000c5a000)={0x0, 0x0, 0x0, 0x0}) mmap(&(0x7f0000000000/0x13000)=nil, 0x13000, 0x0, 0x32, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000a95000-0x30)={0x14, 0x0, &(0x7f0000b8f000)=[@increfs_done={0x40106308, r6, 0x1}], 0x0, 0x0, &(0x7f00002e4000-0x70)=""}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000436000-0x30)={0x20, 0x0, &(0x7f0000136000)=[@dead_binder_done={0x40086310, 0x3}, @increfs_done={0x40106308, r6, 0x0}], 0x0, 0x0, &(0x7f0000888000-0xb)=""}) 2018/02/01 04:11:28 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(0xffffffffffffffff, &(0x7f0000022000-0x16)="01", 0x1, 0x0, &(0x7f0000031000-0x10)={0x2, 0xffffffffffffffff, @local={0xac, 0x14, 0xffffffffffffffff, 0xaa}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x10) shutdown(r0, 0x1) 2018/02/01 04:11:28 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) seccomp(0x1, 0x0, &(0x7f000089b000-0x10)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x407ffc0003}]}) r0 = shmget(0x1, 0x1000, 0x0, &(0x7f0000dc0000/0x1000)=nil) shmat(r0, &(0x7f00008e1000/0x2000)=nil, 0x6000) execve(&(0x7f00009dc000)='./file0\x00', &(0x7f00004ff000-0x28)=[&(0x7f0000f72000-0x6)='nodev\x00', &(0x7f0000a9e000)='+\\\x00', &(0x7f0000e5c000)='\x00', &(0x7f0000695000-0x4)='lo!\x00', &(0x7f0000125000-0x7)='cgroup\x00'], &(0x7f00002ad000-0x28)=[&(0x7f0000f5e000)='{\x00', &(0x7f00002aa000)='mime_type%\x00', &(0x7f000000b000)='lo\x00', &(0x7f0000c54000-0x1)='\x00', &(0x7f00006c9000-0x1)='\x00']) shmctl$IPC_INFO(0x0, 0x3, &(0x7f0000564000)=""/4096) [ 308.058215] binder: undelivered TRANSACTION_ERROR: 29189 2018/02/01 04:11:28 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = memfd_create(&(0x7f0000f67000)='&+wlan1keyringvboxnet1[cpusetwlan0GPL%cgroup\x00', 0x2) syz_emit_ethernet(0x32, &(0x7f0000008000-0x8e)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @empty=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x24, 0xffffffffffffffff, 0x2000, 0x0, 0x0, 0x0, @local={0xac, 0x14, 0xffffffffffffffff, 0xaa}, @multicast1=0xe0000001, {[]}}, @dccp={{0xffffffffffffffff, 0xffffffffffffffff, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, "11ad5b", 0x0, "5fc07d"}, ""}}}}}, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(r0, 0xc0505350, &(0x7f0000001000-0x50)={{0x8e, 0x5}, {0x65fcf7f1, 0x3}, 0x101, 0x5, 0xb5, [0x0, 0x0, 0x0], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) clone(0x0, &(0x7f0000002000-0xc9)="", &(0x7f0000002000-0x4)=0x0, &(0x7f0000001000)=0x0, &(0x7f0000007000)="") r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f0000c9c000)={0xa, 0x1, 0xfffffffffffffffd, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x1}, 0x2}, 0x1c) ioctl$DRM_IOCTL_FREE_BUFS(r0, 0x4010641a, &(0x7f0000972000)={0x6, &(0x7f0000ccb000-0x18)=[0x4, 0x4, 0x6, 0x0, 0x2, 0x6]}) listen(r2, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_INFO(r0, 0xc08c5334, &(0x7f0000f87000-0x8c)={0x4, 0x0, 0x5, 'queue1\x00', 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) setsockopt$inet_tcp_int(r0, 0x6, 0x953610c9e6c6cd75, &(0x7f0000a9d000-0x4)=0xac6, 0x4) sendfile(r2, r2, &(0x7f0000a58000-0x8)=0x0, 0x9) fcntl$setstatus(r1, 0x4, 0x2000) accept$ipx(r2, &(0x7f000061e000)={0x0, 0x0, 0x0, ""/6, 0x0, 0x0}, &(0x7f0000ba5000)=0x258) mmap$binder(&(0x7f0000789000/0x2000)=nil, 0x2000, 0x300000e, 0x1010, r0, 0x0) sendto$inet(r1, &(0x7f0000389000-0x1)="b6", 0x1, 0x20008045, &(0x7f00000b0000)={0x2, 0x2, @empty=0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x10) setsockopt$sock_linger(r1, 0x1, 0xd, &(0x7f0000288000-0x8)={0x3000001, 0xffffffffffffffff}, 0x8) setsockopt$inet_tcp_int(r1, 0x6, 0x8, &(0x7f00006c2000-0x4)=0x4, 0x4) ioctl$RNDCLEARPOOL(r0, 0x5206, &(0x7f000023b000)=0x2) [ 308.058474] binder: undelivered TRANSACTION_ERROR: 29189 [ 308.058529] binder: undelivered TRANSACTION_ERROR: 29189 [ 308.058666] binder: undelivered TRANSACTION_ERROR: 29189 [ 308.058852] binder: undelivered TRANSACTION_ERROR: 29189 [ 308.059090] binder: undelivered TRANSACTION_ERROR: 29189 [ 308.059224] binder: undelivered TRANSACTION_ERROR: 29189 [ 308.059342] binder: undelivered TRANSACTION_ERROR: 29189 [ 308.059515] binder: undelivered TRANSACTION_ERROR: 29189 [ 308.059634] binder: undelivered TRANSACTION_ERROR: 29189 [ 308.059703] binder: undelivered TRANSACTION_ERROR: 29189 [ 308.059879] binder: undelivered TRANSACTION_ERROR: 29189 [ 308.059951] binder: undelivered TRANSACTION_ERROR: 29189 [ 308.060191] binder: send failed reply for transaction 1416 to 15097:15102 [ 308.077866] binder: undelivered TRANSACTION_ERROR: 29189 [ 308.078007] binder: undelivered TRANSACTION_ERROR: 29189 [ 308.078186] binder: undelivered TRANSACTION_ERROR: 29189 [ 308.078300] binder: undelivered TRANSACTION_ERROR: 29189 [ 308.078401] binder: undelivered TRANSACTION_ERROR: 29189 [ 308.078473] binder: undelivered TRANSACTION_ERROR: 29189 [ 308.078576] binder: undelivered TRANSACTION_ERROR: 29189 [ 308.078622] binder: undelivered TRANSACTION_ERROR: 29189 [ 308.078632] binder: undelivered TRANSACTION_ERROR: 29189 [ 308.078733] binder: undelivered TRANSACTION_ERROR: 29189 [ 308.078778] binder: undelivered TRANSACTION_ERROR: 29189 [ 308.078919] binder: undelivered TRANSACTION_ERROR: 29189 [ 308.078972] binder: undelivered TRANSACTION_ERROR: 29189 [ 308.079154] binder: undelivered TRANSACTION_ERROR: 29189 [ 308.079201] binder: undelivered TRANSACTION_ERROR: 29189 [ 308.079491] binder: undelivered TRANSACTION_ERROR: 29189 [ 308.079761] binder: undelivered TRANSACTION_ERROR: 29189 [ 308.079886] binder: undelivered TRANSACTION_ERROR: 29189 [ 308.080078] binder: undelivered TRANSACTION_ERROR: 29189 [ 308.080219] binder: undelivered TRANSACTION_ERROR: 29189 [ 308.080294] binder: undelivered TRANSACTION_COMPLETE [ 308.080302] binder: undelivered TRANSACTION_ERROR: 29189 [ 308.094453] binder: undelivered TRANSACTION_ERROR: 29189 [ 308.094530] binder: undelivered TRANSACTION_ERROR: 29189 [ 308.094590] binder: undelivered TRANSACTION_ERROR: 29189 [ 308.094651] binder: undelivered TRANSACTION_ERROR: 29189 [ 308.094768] binder: release 15608:15612 transaction 1519 out, still active [ 308.094773] binder: unexpected work type, 4, not freed [ 308.094776] binder: undelivered TRANSACTION_COMPLETE [ 308.094816] binder: send failed reply for transaction 1519, target dead [ 308.203428] binder: 15687:15691 BC_DEAD_BINDER_DONE 0000000000000003 not found [ 308.203439] binder: 15687:15691 BC_INCREFS_DONE u00000000204edf8a node 1535 cookie mismatch 0000000000000000 != 0000000000000001 [ 308.215265] binder: send failed reply for transaction 1534 to 15687:15691 [ 308.232901] binder: BINDER_SET_CONTEXT_MGR already set [ 308.232916] binder: 15694:15699 ioctl 40046207 0 returned -16 [ 308.236193] binder_alloc: 15688: binder_alloc_buf, no vma [ 308.236217] binder: 15694:15699 transaction failed 29189/-3, size 40-8 line 2903 [ 308.250174] binder: BINDER_SET_CONTEXT_MGR already set [ 308.250184] binder: 15687:15691 ioctl 40046207 0 returned -16 [ 308.254698] binder: undelivered TRANSACTION_ERROR: 29189 [ 308.263368] binder_alloc: 15688: binder_alloc_buf, no vma [ 308.263393] binder: 15687:15700 transaction failed 29189/-3, size 40-8 line 2903 [ 308.272498] binder: 15687:15691 BC_DEAD_BINDER_DONE 0000000000000003 not found [ 308.272514] binder: 15687:15691 BC_INCREFS_DONE u00000000204edf8a node 1535 cookie mismatch 0000000000000000 != 0000000000000001 [ 308.283744] binder: undelivered TRANSACTION_ERROR: 29189 [ 308.283756] binder: undelivered TRANSACTION_ERROR: 29189 [ 308.307275] binder: BINDER_SET_CONTEXT_MGR already set [ 308.307286] binder: 15688:15697 ioctl 40046207 0 returned -16 [ 308.307631] binder: BINDER_SET_CONTEXT_MGR already set [ 308.307638] binder: 15715:15717 ioctl 40046207 0 returned -16 [ 308.307967] binder_alloc: 15688: binder_alloc_buf, no vma [ 308.307989] binder: 15715:15717 transaction failed 29189/-3, size 40-8 line 2903 [ 308.313354] binder_alloc: 15688: binder_alloc_buf, no vma [ 308.313380] binder: 15688:15713 transaction failed 29189/-3, size 40-8 line 2903 [ 308.319684] binder: 15688:15719 BC_INCREFS_DONE u0000000000000000 no match [ 308.328133] binder: BINDER_SET_CONTEXT_MGR already set [ 308.328141] binder: 15722:15725 ioctl 40046207 0 returned -16 [ 308.330250] binder_alloc: 15688: binder_alloc_buf, no vma [ 308.330274] binder: 15722:15725 transaction failed 29189/-3, size 40-8 line 2903 [ 308.340124] binder: undelivered TRANSACTION_ERROR: 29189 [ 308.340175] binder: release 15688:15697 transaction 1538 out, still active [ 308.340179] binder: undelivered TRANSACTION_COMPLETE [ 308.340217] binder: send failed reply for transaction 1538, target dead [ 308.340281] binder: undelivered TRANSACTION_ERROR: 29189 [ 308.353525] binder: 15722:15725 BC_INCREFS_DONE u0000000000000000 no match [ 308.353591] binder: 15722:15725 BC_DEAD_BINDER_DONE 0000000000000003 not found [ 308.353601] binder: 15722:15725 BC_INCREFS_DONE u0000000000000000 no match [ 308.390494] binder: 15722:15725 BC_INCREFS_DONE node 1548 has no pending increfs request [ 308.390541] binder: 15722:15725 BC_DEAD_BINDER_DONE 0000000000000003 not found [ 308.390553] binder: 15722:15725 BC_INCREFS_DONE u00000000204edf8a node 1548 cookie mismatch 0000000000000000 != 0000000000000001 [ 308.394676] binder: send failed reply for transaction 1547 to 15722:15731 [ 308.400253] binder: undelivered TRANSACTION_COMPLETE 2018/02/01 04:11:28 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = socket$inet_sctp(0x2, 0x5, 0x84) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffff9c, 0x84, 0x13, &(0x7f0000f07000)={0x0, 0x8}, &(0x7f000034b000-0x4)=0x8) getsockopt$inet_sctp_SCTP_RESET_STREAMS(r1, 0x84, 0x77, &(0x7f00002a4000-0x1a)={r2, 0x96ba, 0x9, [0x20, 0x50000, 0x1, 0x5, 0x10000, 0x0, 0x4, 0x100000000, 0x10000]}, &(0x7f0000898000-0x4)=0x1a) sendmsg$nl_xfrm(r0, &(0x7f0000a8d000)={&(0x7f0000e4e000)={0x10, 0x0, 0x0, 0x0}, 0xc, &(0x7f0000fcf000-0x10)={&(0x7f00005d5000)=@updsa={0x104, 0x1a, 0x1, 0xffffffffffffffff, 0xffffffffffffffff, {{@in6=@local={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0xffffffffffffffff, 0xaa}, @in=@dev={0xac, 0x14, 0xffffffffffffffff, 0x0}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0}, {@in=@broadcast=0xffffffff, 0xffffffffffffffff, 0x2b}, @in=@multicast2=0xe0000002, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, {0x0, 0x0, 0x0, 0x0}, {0x0, 0x0, 0x0}, 0xffffffffffffffff, 0xffffffffffffffff, 0xa, 0x2, 0x0, 0x0}, [@coaddr={0x14, 0xe, @in=@remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}}]}, 0x104}, 0x1, 0x0, 0x0, 0x0}, 0x0) 2018/02/01 04:11:28 executing program 3: mmap(&(0x7f0000000000/0x6000)=nil, 0x6000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000004000-0x28)={@syzn={0x73, 0x79, 0x7a, 0x0, 0x0}, &(0x7f0000002000)=@ethtool_rxfh={0x46, 0x1000000000000000, 0x7ff, 0x0, 0x0, "e22e5b", 0x100000000, []}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) mmap(&(0x7f0000006000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000006000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r1 = accept4$ipx(0xffffffffffffffff, &(0x7f0000006000)={0x0, 0x0, 0x0, ""/6, 0x0, 0x0}, &(0x7f0000007000-0x4)=0x10, 0x800) mmap(&(0x7f0000006000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000006000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) getsockopt$ipx_IPX_TYPE(r1, 0x100, 0x1, &(0x7f0000006000)=0x0, &(0x7f0000006000)=0x4) 2018/02/01 04:11:28 executing program 2: openat$ion(0xffffffffffffff9c, &(0x7f0000801000-0x9)='/dev/ion\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000233000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = dup2(r0, r1) write$tun(0xffffffffffffffff, &(0x7f0000577000)=@pi={0x0, 0x0, @eth={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x0}, [], {@canfd={0xd, {{0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0, "feb442a1f43ead325d71fed774c8f6028c2a6b79a4e418aa3c5f391769659fef9f596cdade428c389e511eaad39d2ee4334dee9516a31d00510baaf06efc0980"}}}}}, 0x5a) r3 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004ee000-0x76)='\x00', 0x1, 0x0, 0x0}], &(0x7f000000b000-0x30)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)=""}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00005da000)={0x0, 0x0, &(0x7f00000d8000)=[], 0x48, 0x0, &(0x7f000044c000-0x83)="a410778b7a640ab0384c4ead541b6ee57c5645909ef688d8ac3e5ecfc7039f5f8ba53f127b7f01947cd3689eaf6c090277915bab2a0c450988cb85688e2bcc101a80664d3081fcc0"}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000c5a000)={0x0, 0x0, 0x0, 0x0}) mmap(&(0x7f0000000000/0x13000)=nil, 0x13000, 0x0, 0x32, 0xffffffffffffffff, 0x0) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r2, 0x84, 0x18, &(0x7f0000ecb000)={0x0, 0x3}, &(0x7f000005d000-0x4)=0x6) getsockopt$inet_sctp_SCTP_ENABLE_STREAM_RESET(r3, 0x84, 0x76, &(0x7f0000db5000-0x8)={r5, 0x4}, &(0x7f00005e1000-0x4)=0x8) getsockopt$inet_IP_IPSEC_POLICY(r3, 0x0, 0x10, &(0x7f0000733000)={{{@in6=@mcast2={0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0}, @in6=@ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], [0x0, 0x0], @broadcast=0x0}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, {0x0, 0x0, 0x0, 0x0}, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, {{@in=@broadcast=0x0, 0xffffffffffffffff, 0x0}, 0x0, @in=@local={0x0, 0x0, 0xffffffffffffffff, 0x0}, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, &(0x7f000008e000)=0xe8) r7 = getegid() fchownat(r2, &(0x7f00004c3000-0x8)='./file0\x00', r6, r7, 0x1800) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000a95000-0x30)={0x14, 0x0, &(0x7f0000b8f000)=[@increfs_done={0x40106308, r4, 0x1}], 0x0, 0x0, &(0x7f00002e4000-0x70)=""}) 2018/02/01 04:11:28 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f0000590000-0x8)='./file0\x00', 0x14) write$selinux_create(r0, &(0x7f000074c000)=@access={'system_u:object_r:dpkg_exec_t:s0', 0x20, '/usr/sbin/cups-browsed', 0x20, 0x32, 0x30, 0x0}, 0x3b) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f00007cf000)='/dev/cuse\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_STATUS(r1, 0xc05c5340, &(0x7f0000b85000)={0x6, 0x100, 0x2, {0x0, 0x0}, 0x0, 0x4, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000801000-0x9)='/dev/ion\x00', 0x0, 0x0) r3 = syz_open_dev$binder(&(0x7f0000233000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r4 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0) r5 = dup2(r3, r4) write$tun(0xffffffffffffffff, &(0x7f0000577000)=@pi={0x0, 0x0, @eth={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x0}, [], {@canfd={0xd, {{0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0, "feb442a1f43ead325d71fed774c8f6028c2a6b79a4e418aa3c5f391769659fef9f596cdade428c389e511eaad39d2ee4334dee9516a31d00510baaf06efc0980"}}}}}, 0x5a) r6 = dup2(r4, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004ee000-0x76)='\x00', 0x1, 0x0, 0x0}], &(0x7f000000b000-0x30)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)=""}) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f00005da000)={0x0, 0x0, &(0x7f00000d8000)=[], 0x48, 0x0, &(0x7f000044c000-0x83)="a410778b7a640ab0384c4ead541b6ee57c5645909ef688d8ac3e5ecfc7039f5f8ba53f127b7f01947cd3689eaf6c090277915bab2a0c450988cb85688e2bcc101a80664d3081fcc0"}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000c5a000)={0x0, 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000a95000-0x30)={0x14, 0x0, &(0x7f0000b8f000)=[@increfs_done={0x40106308, r7, 0x1}], 0x0, 0x0, &(0x7f00002e4000-0x70)=""}) getsockopt$inet6_dccp_buf(r5, 0x21, 0x0, &(0x7f0000e10000-0xcc)=""/204, &(0x7f000037d000-0x4)=0xcc) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000436000-0x30)={0x20, 0x0, &(0x7f0000136000)=[@dead_binder_done={0x40086310, 0x3}, @increfs_done={0x40106308, r7, 0x0}], 0x0, 0x0, &(0x7f0000888000-0xb)=""}) close(r2) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000002000-0x38)={0x0, 0x0, &(0x7f0000003000)=[], 0x0, &(0x7f0000002000)=[{0x10, 0x10e, 0x0, ""}], 0x10, 0x0}, 0x0) 2018/02/01 04:11:28 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r0, &(0x7f0000022000-0x16)="", 0x0, 0x0, &(0x7f0000031000-0x10)={0x2, 0xffffffffffffffff, @local={0xac, 0x14, 0xffffffffffffffff, 0xaa}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x10) shutdown(r0, 0x1) 2018/02/01 04:11:28 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) seccomp(0x1, 0x0, &(0x7f000089b000-0x10)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x407ffc0003}]}) shmget$private(0x0, 0x3000, 0x54000500, &(0x7f000039a000/0x3000)=nil) shmget(0x0, 0x3000, 0x4, &(0x7f0000dd1000/0x3000)=nil) r0 = shmget(0x1, 0x4000, 0x2, &(0x7f0000a68000/0x4000)=nil) shmctl$IPC_INFO(r0, 0x3, &(0x7f0000068000-0x1000)=""/4096) 2018/02/01 04:11:28 executing program 1: openat$ion(0xffffffffffffff9c, &(0x7f0000801000-0x9)='/dev/ion\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000233000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) write$tun(0xffffffffffffffff, &(0x7f0000577000)=@pi={0x0, 0x0, @eth={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x0}, [], {@canfd={0xd, {{0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0, "feb442a1f43ead325d71fed774c8f6028c2a6b79a4e418aa3c5f391769659fef9f596cdade428c389e511eaad39d2ee4334dee9516a31d00510baaf06efc0980"}}}}}, 0x5a) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004ee000-0x76)='\x00', 0x1, 0x0, 0x0}], &(0x7f000000b000-0x30)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)=""}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00005da000)={0x0, 0x0, &(0x7f00000d8000)=[], 0x48, 0x0, &(0x7f000044c000-0x83)="a410778b7a640ab0384c4ead541b6ee57c5645909ef688d8ac3e5ecfc7039f5f8ba53f127b7f01947cd3689eaf6c090277915bab2a0c450988cb85688e2bcc101a80664d3081fcc0"}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000c5a000)={0x0, 0x0, 0x0, 0x0}) mmap(&(0x7f0000000000/0x13000)=nil, 0x13000, 0x0, 0x32, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000a95000-0x30)={0x14, 0x0, &(0x7f0000b8f000)=[@increfs_done={0x40106308, r3, 0x1}], 0x0, 0x0, &(0x7f00002e4000-0x70)=""}) ioctl$TCFLSH(r2, 0x540b, 0x1) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000436000-0x30)={0x20, 0x0, &(0x7f0000136000)=[@dead_binder_done={0x40086310, 0x3}, @increfs_done={0x40106308, r3, 0x0}], 0x0, 0x0, &(0x7f0000888000-0xb)=""}) 2018/02/01 04:11:28 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet_sctp(0x2, 0x1, 0x84) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @rand_addr=0x7fffffff, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x10) listen(r0, 0x100401000003) r1 = accept$inet(r0, &(0x7f0000da9000-0x10)={0x0, 0xffffffffffffffff, @multicast2=0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, &(0x7f00002d3000)=0x10) write(r1, &(0x7f0000a96000-0xb6)="1f", 0x1) setsockopt(r1, 0x84, 0x7b, &(0x7f0000e0e000-0x8)="8022e2ed01000000", 0x8) setsockopt$inet_sctp_SCTP_DEFAULT_SNDINFO(r1, 0x84, 0x22, &(0x7f0000373000)={0x7, 0x0, 0x0, 0x0, 0x0}, 0x10) ioctl$fiemap(r1, 0xc020660b, &(0x7f0000ef4000)={0xffffffffffffffc0, 0x4, 0x2, 0x4, 0x1, [{0x8, 0x9, 0x20, 0x0, 0x0, 0x804, 0x0, 0x0, 0x0}]}) write(r1, &(0x7f00007b0000)="01", 0x1) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r1, 0x84, 0x7b, &(0x7f00002c2000)={0x0, 0x0}, 0x8) [ 308.400262] binder: undelivered TRANSACTION_ERROR: 29189 2018/02/01 04:11:28 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r0, &(0x7f0000022000-0x16)="", 0x0, 0x0, &(0x7f0000031000-0x10)={0x2, 0xffffffffffffffff, @local={0xac, 0x14, 0xffffffffffffffff, 0xaa}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x10) shutdown(r0, 0x1) 2018/02/01 04:11:28 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r0, &(0x7f0000022000-0x16)="", 0x0, 0x0, &(0x7f0000031000-0x10)={0x2, 0xffffffffffffffff, @local={0xac, 0x14, 0xffffffffffffffff, 0xaa}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x10) shutdown(r0, 0x1) 2018/02/01 04:11:28 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = semget(0x1, 0x7, 0x8) semctl$IPC_RMID(r0, 0x0, 0x0) socket$nl_crypto(0x10, 0x3, 0x15) clone(0x200, &(0x7f000099f000)="", &(0x7f0000ad9000-0x4)=0x0, &(0x7f0000676000)=0x0, &(0x7f00005f2000-0x1)="") mknod(&(0x7f0000433000)='./file0\x00', 0x1001, 0x0) r1 = getpgrp(0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000000)=0x9) r2 = syz_open_dev$vcsn(&(0x7f0000763000-0xa)='/dev/vcs#\x00', 0x3, 0x48000) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffff9c, 0x29, 0x22, &(0x7f0000f0a000)={{{@in=@local={0x0, 0x0, 0xffffffffffffffff, 0x0}, @in6=@dev={0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0xffffffffffffffff, 0x0}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, {0x0, 0x0, 0x0, 0x0}, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, {{@in6=@ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], [0x0, 0x0], @broadcast=0x0}, 0xffffffffffffffff, 0x0}, 0x0, @in=@dev={0x0, 0x0, 0xffffffffffffffff, 0x0}, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, &(0x7f0000833000-0x4)=0xe8) getresgid(&(0x7f000041b000-0x4)=0x0, &(0x7f0000345000-0x4)=0x0, &(0x7f000005e000-0x4)=0x0) setsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000dec000)={r1, r3, r4}, 0xc) process_vm_writev(r1, &(0x7f0000fb9000)=[{&(0x7f0000510000-0x1000)=""/4096, 0x1000}], 0x1, &(0x7f000076e000)=[{&(0x7f0000f79000)=""/119, 0x77}], 0x1, 0x0) execveat(0xffffffffffffffff, &(0x7f000023e000)='./file0\x00', &(0x7f0000bfb000)=[], &(0x7f0000a14000)=[], 0x0) creat(&(0x7f000074f000-0x8)='./file0\x00', 0x0) 2018/02/01 04:11:28 executing program 2: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000801000-0x9)='/dev/ion\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000233000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) dup2(r1, r2) write$tun(0xffffffffffffffff, &(0x7f0000577000)=@pi={0x0, 0x0, @eth={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x0}, [], {@canfd={0xd, {{0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0, "feb442a1f43ead325d71fed774c8f6028c2a6b79a4e418aa3c5f391769659fef9f596cdade428c389e511eaad39d2ee4334dee9516a31d00510baaf06efc0980"}}}}}, 0x5a) r3 = dup2(r0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004ee000-0x76)='\x00', 0x1, 0x0, 0x0}], &(0x7f000000b000-0x30)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)=""}) r4 = semget$private(0x0, 0x3, 0x80) semctl$GETZCNT(r4, 0x2, 0xf, &(0x7f000067a000-0x74)=""/116) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00005da000)={0x0, 0x0, &(0x7f00000d8000)=[], 0x48, 0x0, &(0x7f000044c000-0x83)="a410778b7a640ab0384c4ead541b6ee57c5645909ef688d8ac3e5ecfc7039f5f8ba53f127b7f01947cd3689eaf6c090277915bab2a0c450988cb85688e2bcc101a80664d3081fcc0"}) openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000095000)='/selinux/enforce\x00', 0x204040, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000c5a000)={0x0, 0x0, 0x0, 0x0}) mmap(&(0x7f0000000000/0x13000)=nil, 0x13000, 0x0, 0x32, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000a95000-0x30)={0x14, 0x0, &(0x7f0000b8f000)=[@increfs_done={0x40106308, r5, 0x1}], 0x0, 0x0, &(0x7f00002e4000-0x70)=""}) [ 308.965445] binder: send failed reply for transaction 1551 to 15743:15749 [ 308.993403] binder: 15747:15754 ioctl 540b 1 returned -22 [ 308.999248] binder: BINDER_SET_CONTEXT_MGR already set 2018/02/01 04:11:28 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) seccomp(0x1, 0x0, &(0x7f000089b000-0x10)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x407ffc0003}]}) shmctl$IPC_INFO(0x0, 0x3, &(0x7f0000564000)=""/4096) r0 = syz_open_dev$loop(&(0x7f0000a8a000)='/dev/loop#\x00', 0x5, 0x100) syz_open_dev$sndmidi(&(0x7f0000afb000-0x12)='/dev/snd/midiC#D#\x00', 0x869, 0x200) setns(r0, 0x40000000) r1 = syz_open_dev$dmmidi(&(0x7f00003f8000)='/dev/dmmidi#\x00', 0x100000001, 0x0) getsockopt$inet_sctp_SCTP_DEFAULT_PRINFO(0xffffffffffffffff, 0x84, 0x72, &(0x7f000060c000)={0x0, 0x7, 0x10}, &(0x7f0000699000)=0xc) setsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r1, 0x84, 0x6, &(0x7f0000652000)={r2, @in={{0x2, 0x3, @multicast1=0xe0000001, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}}, 0x8c) 2018/02/01 04:11:28 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f0000590000-0x8)='./file0\x00', 0x14) write$selinux_create(r0, &(0x7f000074c000)=@access={'system_u:object_r:dpkg_exec_t:s0', 0x20, '/usr/sbin/cups-browsed', 0x20, 0x32, 0x30, 0x0}, 0x3b) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f00007cf000)='/dev/cuse\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_STATUS(r1, 0xc05c5340, &(0x7f0000b85000)={0x6, 0x100, 0x2, {0x0, 0x0}, 0x0, 0x4, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000801000-0x9)='/dev/ion\x00', 0x0, 0x0) r3 = syz_open_dev$binder(&(0x7f0000233000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r4 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0) r5 = dup2(r3, r4) write$tun(0xffffffffffffffff, &(0x7f0000577000)=@pi={0x0, 0x0, @eth={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x0}, [], {@canfd={0xd, {{0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0, "feb442a1f43ead325d71fed774c8f6028c2a6b79a4e418aa3c5f391769659fef9f596cdade428c389e511eaad39d2ee4334dee9516a31d00510baaf06efc0980"}}}}}, 0x5a) r6 = dup2(r4, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004ee000-0x76)='\x00', 0x1, 0x0, 0x0}], &(0x7f000000b000-0x30)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)=""}) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f00005da000)={0x0, 0x0, &(0x7f00000d8000)=[], 0x48, 0x0, &(0x7f000044c000-0x83)="a410778b7a640ab0384c4ead541b6ee57c5645909ef688d8ac3e5ecfc7039f5f8ba53f127b7f01947cd3689eaf6c090277915bab2a0c450988cb85688e2bcc101a80664d3081fcc0"}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000c5a000)={0x0, 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000a95000-0x30)={0x14, 0x0, &(0x7f0000b8f000)=[@increfs_done={0x40106308, r7, 0x1}], 0x0, 0x0, &(0x7f00002e4000-0x70)=""}) getsockopt$inet6_dccp_buf(r5, 0x21, 0x0, &(0x7f0000e10000-0xcc)=""/204, &(0x7f000037d000-0x4)=0xcc) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000436000-0x30)={0x20, 0x0, &(0x7f0000136000)=[@dead_binder_done={0x40086310, 0x3}, @increfs_done={0x40106308, r7, 0x0}], 0x0, 0x0, &(0x7f0000888000-0xb)=""}) close(r2) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000002000-0x38)={0x0, 0x0, &(0x7f0000003000)=[], 0x0, &(0x7f0000002000)=[{0x10, 0x10e, 0x0, ""}], 0x10, 0x0}, 0x0) 2018/02/01 04:11:29 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r0, &(0x7f0000022000-0x16)="01", 0x1, 0x0, &(0x7f0000031000-0x10)={0x2, 0xffffffffffffffff, @local={0xac, 0x14, 0xffffffffffffffff, 0xaa}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x10) shutdown(0xffffffffffffffff, 0x1) 2018/02/01 04:11:29 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00001f1000-0x8)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f00000bc000)=@abs={0x0, 0x0, 0xffffffffffffffff}, 0x8) setsockopt$sock_linger(r0, 0x1, 0xd, &(0x7f00006ef000)={0x4, 0x3}, 0x8) sendmmsg$unix(r1, &(0x7f00000bd000)=[], 0x80, 0xc0) setsockopt$sock_int(r1, 0x1, 0x7, &(0x7f00005ff000-0x4)=0x0, 0x4) openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000a08000)='/selinux/avc/cache_stats\x00', 0x0, 0x0) sendto$unix(r1, &(0x7f00004b9000)="", 0x0, 0x0, 0x0, 0x0) close(r0) r2 = gettid() fcntl$setown(r1, 0x8, r2) [ 308.999259] binder: 15743:15749 ioctl 40046207 0 returned -16 [ 309.006422] binder_alloc: 15747: binder_alloc_buf, no vma [ 309.006444] binder: 15743:15749 transaction failed 29189/-3, size 40-8 line 2903 [ 309.015524] binder: 15743:15759 BC_INCREFS_DONE node 1552 has no pending increfs request [ 309.017323] binder: send failed reply for transaction 1555 to 15747:15754 [ 309.019219] binder: 15744:15755 transaction failed 29189/-22, size 40-8 line 2788 [ 309.031938] binder: 15747:15768 BC_DEAD_BINDER_DONE 0000000000000003 not found [ 309.031954] binder: 15747:15768 BC_INCREFS_DONE u00000000204edf8a node 1556 cookie mismatch 0000000000000000 != 0000000000000001 [ 309.032648] binder: undelivered TRANSACTION_COMPLETE [ 309.032656] binder: undelivered TRANSACTION_ERROR: 29189 [ 309.032660] binder: undelivered TRANSACTION_ERROR: 29189 [ 309.051454] binder: undelivered TRANSACTION_ERROR: 29189 [ 309.072168] binder: 15747:15768 transaction failed 29189/-22, size 40-8 line 2788 [ 309.077859] binder: 15747:15768 BC_INCREFS_DONE node 1556 has no pending increfs request [ 309.077912] binder: 15747:15768 ioctl 540b 1 returned -22 [ 309.080086] binder: 15747:15768 BC_DEAD_BINDER_DONE 0000000000000003 not found [ 309.080102] binder: 15747:15768 BC_INCREFS_DONE u00000000204edf8a node 1556 cookie mismatch 0000000000000000 != 0000000000000001 [ 309.095576] binder: send failed reply for transaction 1564 to 15769:15772 [ 309.096718] binder: 15769:15772 BC_INCREFS_DONE u00000000204edf8a no match [ 309.105431] binder_alloc: 15775: binder_alloc_buf, no vma [ 309.105453] binder: 15775:15779 transaction failed 29189/-3, size 40-8 line 2903 [ 309.118620] binder: 15769:15772 BC_INCREFS_DONE u0000000000000000 no match [ 309.127345] binder: undelivered TRANSACTION_ERROR: 29189 [ 309.148158] binder: undelivered TRANSACTION_COMPLETE [ 309.148169] binder: undelivered TRANSACTION_ERROR: 29189 [ 309.344820] binder: undelivered TRANSACTION_COMPLETE [ 309.350130] binder: undelivered TRANSACTION_ERROR: 29189 2018/02/01 04:11:29 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000a8d000)={&(0x7f0000e4e000)={0x10, 0x0, 0x0, 0x0}, 0xc, &(0x7f0000fcf000-0x10)={&(0x7f00005d5000)=@updsa={0x104, 0x1a, 0x1, 0xffffffffffffffff, 0xffffffffffffffff, {{@in6=@local={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0xffffffffffffffff, 0xaa}, @in=@dev={0xac, 0x14, 0xffffffffffffffff, 0x0}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x2, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, {@in=@broadcast=0xffffffff, 0xffffffffffffffff, 0x2b}, @in=@multicast2=0xe0000002, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, {0x400, 0x0, 0x0, 0x0}, {0x0, 0x0, 0x0}, 0xffffffffffffffff, 0xffffffffffffffff, 0xa, 0x2, 0x0, 0x0}, [@coaddr={0x14, 0xe, @in=@remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}}]}, 0x104}, 0x1, 0x0, 0x0, 0x0}, 0x0) 2018/02/01 04:11:29 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f0000590000-0x8)='./file0\x00', 0x14) write$selinux_create(r0, &(0x7f000074c000)=@access={'system_u:object_r:dpkg_exec_t:s0', 0x20, '/usr/sbin/cups-browsed', 0x20, 0x32, 0x30, 0x0}, 0x3b) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f00007cf000)='/dev/cuse\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_STATUS(r1, 0xc05c5340, &(0x7f0000b85000)={0x6, 0x100, 0x2, {0x0, 0x0}, 0x0, 0x4, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000801000-0x9)='/dev/ion\x00', 0x0, 0x0) r3 = syz_open_dev$binder(&(0x7f0000233000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r4 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0) r5 = dup2(r3, r4) write$tun(0xffffffffffffffff, &(0x7f0000577000)=@pi={0x0, 0x0, @eth={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x0}, [], {@canfd={0xd, {{0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0, "feb442a1f43ead325d71fed774c8f6028c2a6b79a4e418aa3c5f391769659fef9f596cdade428c389e511eaad39d2ee4334dee9516a31d00510baaf06efc0980"}}}}}, 0x5a) r6 = dup2(r4, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004ee000-0x76)='\x00', 0x1, 0x0, 0x0}], &(0x7f000000b000-0x30)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)=""}) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f00005da000)={0x0, 0x0, &(0x7f00000d8000)=[], 0x48, 0x0, &(0x7f000044c000-0x83)="a410778b7a640ab0384c4ead541b6ee57c5645909ef688d8ac3e5ecfc7039f5f8ba53f127b7f01947cd3689eaf6c090277915bab2a0c450988cb85688e2bcc101a80664d3081fcc0"}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000c5a000)={0x0, 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000a95000-0x30)={0x14, 0x0, &(0x7f0000b8f000)=[@increfs_done={0x40106308, r7, 0x1}], 0x0, 0x0, &(0x7f00002e4000-0x70)=""}) getsockopt$inet6_dccp_buf(r5, 0x21, 0x0, &(0x7f0000e10000-0xcc)=""/204, &(0x7f000037d000-0x4)=0xcc) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000436000-0x30)={0x20, 0x0, &(0x7f0000136000)=[@dead_binder_done={0x40086310, 0x3}, @increfs_done={0x40106308, r7, 0x0}], 0x0, 0x0, &(0x7f0000888000-0xb)=""}) close(r2) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000002000-0x38)={0x0, 0x0, &(0x7f0000003000)=[], 0x0, &(0x7f0000002000)=[{0x10, 0x10e, 0x0, ""}], 0x10, 0x0}, 0x0) 2018/02/01 04:11:29 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) seccomp(0x1, 0x0, &(0x7f000089b000-0x10)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x407ffc0003}]}) r0 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000e3f000)='/dev/rfkill\x00', 0x0, 0x0) ioctl$KVM_XEN_HVM_CONFIG(r0, 0x4038ae7a, &(0x7f0000fcf000-0x38)={0x800, 0x85e, &(0x7f0000c52000-0x1000)="25d4f66e74208a9151fe198f87cfc81c7bced0a69844bc1dd8b0b20ab2c333405d219a0b160afa268167fdb29750251a589866d55ff92e9d45fe8f38301cb2725a8741472e66bc54ff6fbaefcb310ceb5686ff04acf38cbcc5ca3a8f30530789d111089b09ed2d6eaf227a3d1dbcb25243379e11c9dd7baad4d7f8cd7fa5cb0d4465f1e09a0ab17492a3693a1823abeb8323a7c403d1f3537375a478e9dccbe8176567130fb60df19f7f391e215ecf0a9c9ff5dd883bc5cee1b64a08274861aa691154bf00fbc1c29a13e1f37e715310604d533191c3a3c0959dc415b8fc243dc92aa26a671901044a7c982ac894d71157b1bcdddbe5572612ed5ea02e61dc0124899117698d18f254daafe1ccac561dc641a7de1e2bfd0cd999973e019733bb8f606b7f4eba648760959119e79c6730ce32fbc5ea11c3b9309434af781dea27c9a725348090915b5db33c68fe9d58132e54125e2c90f27d5faddd9511c80a370f6c5fe1e88665185120684ac2c4d59fdaaf71def07cc8e7547bc30e16fcc5d53bcb6b240c6a9fb46f8c5270db95a2e0b1b3416ea524671d85eaf017d549b571987079d85f538e3662eff50e571c3cb1702d76e4530ddd1da6559839bbb0701ca23b9121b3b085a6ce7e10317ba19c101c44cf4a4385edd64eab50162aec4ce6ad2e97c42bc2e71ec1629ef49748ebcd0e77373db567907cae6a499234fd76a8b8854760a090953cb7f2bf413412012ccd7282553da0c1704c8adc15d5e5cfeb91366de34bc4a8e2d70a428094e2a1e19dbd63a7f30e9982aaea7d6a8bf8c7f57feefa8f3c5b0728ae1bf360584f015138a5a54b32295cef0a54e1133f15b77de824c3867eb622447b783c6465d9e48606df13f826a4a43ec8042b1a0ef60532c075ba87e8eba2494f522e5a5e3b161d6ea1a1cb1e3b07e4b2ffc4828d8d08fc67f2fb6fd46278668d40dabb48e1340cf7987526cbec1054009c7f25615ea50ec378c97fd2817c8c3f2192b5f66e02b353404d5aff2f5b5a7ec64b90d747afe0750d256a54f4fa8079b8e56839d5d8d00955f29b961e155a9465da88d162300333768b47f4c25830fce7886af103071347ae63cf9c655f76f302fbe78a95bc6a3e22328251fe625c832e7d5b8729f53039e567fea6ee843d809c20fa7cb91f6b0c4027cac1f413e3fe431545ff620a1fa73bccd57493821a150dbb22c2355026dac9bd0fd84b1cb0c9ba35adc095327ebe8f03e1b27cc3fbdd12b63efc989574e6715f62b28a2c04d3591d13b67526d465bc3aa499aca4d2de8302a6784963dfc593d6215bb0976597ef68c31fe5a1365179512700c7dfd8136ad5eb835319447957795ead3104617568e741ea37fd80bd3457b9fc9a69d107032fa9b1bb443d7fbf6559c59ee3cae6d137262679276094b67bca8ebc117f6a6ad0bab2ef467041832d52ee2555784a8a7431a40d14a130a95ade55d1e0ff859521441a6120aa4ed9d01680220c2df40333768826a5d8af0d6c75083ed5b107d345a848d40fa35fd0aa93c18d0d459f1f91b84268862ee2437ddd315171c24e48d54a42760ac2a4ef9c6c6609d03a0cd54ef034c4621e995d1efaaf99bb693ba6cf0b939081c4b42c724ea55a5f9a061f934a209e7a3231491852714c0dd7ef50c4a90b7e6ba6c35f4b7700a0d452eed2e35bf57a9a9b846bde084bb79fa1ba7902a7d8d6638a5b1400d0de220b5b5050cf3ac568d91f248c4fa003516fcd66a083f537ef6abdf578bc3fa49ee4b823365e8ee4c7d9b2df208a8395cd8295caab53c4b42e768f539026502c07229fbf4525189ce7fb3e09b7a9f83eff795515c9afd58f4a1cd719f9292c60d15d2020184a17b31d1574eb9b33cf45dc7c8af340940abd38071be6d477c16902bf4f6aec3c7e7d20a418f8526b40b2d7e8a1ab7aa7621a736bbaa46d8a71a08a816ea9d6b2c74d4a89527107be38d2c580c33c07bcd986f12fa040cce070f811f53f97b902563489c0bbaa1c2b193d2a97e03726191003400986735914d947852f0c1a0596c30b159d12e18f35c00a83bbea60aaf4a69046a17465417ab7536868695bf027c33c0a55221a5ef6b24da11ee86d078ecbd35bdcbf9183ee022a2f56432784b4396b5ec4cf79301d55eb4971c33c26dcd7d748a79f46b542e5332d331a85326f73aa5564c709a5b726170bdf36099530a96bb62c74958315562a4360efbefc0b990d8ccada0b71b325c7caa2652450c1fcd3f75a953350f5f96e29a7635b2a66ba84e5999cd1629e067d7b812ab93aa7ef6dc491e59b25a45a650750332b1fab4b702e149c63ff4cdf42818a0603cb1bcd296df5d82b411e3f5adef275c6707e45ff2ccadeaeac41e8afcec3fd13dc614a2b432c1f8b54b0eca74a6f37ffc8de5c788a6feccaf136452ab8477d54f04fd83916d842027efb9bcadbbdc7bfae9a296af3643bd2843c29500fd1a30f2bfbba53becf094e8dad9b0dac3b24080152af694e8d0d08a9d5604e38064694eb2dc0b8d604872fc5a71ef6c09c5f962081d25271e42c0a25be8e9dd3cfed9388da474a0ee0bfdc0975954922663086d9d0f61144d55001e52318a89910c69041f24289774abf52c8b058c4ab82c69b83dea6c4adaa39b5bdd48bc6f0bf710fafef1be9fa74ec2cf8b2ca0ea01a416fdf5243d769029a9d451ee359df5c65fcdbf53b958c062e968d2cadb1a0a1ab1f4ee3ceea3ee2e0745f11641bd769e6b55b7b3c7d0747b0b2266eabea6e1d2de9505bde6bcf5c2571f79562c48fec1bb1a62af9cfe444145a5563d6d0ac27f15407b79d23c3684a49c1b6ce614a9efacf7c87211b9993a407b2f4343b464f685c118230431479792679a6eac6a58d724b211156ef73d501671c831ce57e44214b2aaf38d555e9e6166485b2a1b1aafc098ac61218f3e6496e84dc11f6053c2bddba4b17529f30fa1ed2bcc236680bd43814a5a451ee0466d4f0e74d48ffdd374a447b5da04e46c3ef701e9ca1366fbfec785ab6ee6b4cf0eff8a308b8f90b44a47e229a704dc27d91e31fcad6eed724d6a088bef903de971db29c4826bacf1b62077502c76067129f49b3f3775305c6fbe04ab6c545d4153169587f8dc23ac5111c15ff2117a31912502cec276c99d7679140c9a2fdb5f84b1652fa6914c2183b5df29b28e480a813a735a5575bb32abc6fd4e00b199c938b680011ad54c0656a4dc1874de5774151499aa303fe446345bd5cad736f3405cdd6664d3536dc8c3b2a7e89e15f5f9ff29d62aed52cfc98119b03e94eae97eb6412004f8d5e7969aaa4b430057d2eb8ceaaae2d21c8a94c56d9749ed521a97f87cc6ec96f728c13d58ac40ff2dffb0c10a95036854f45712378043334a5d57588978e145c3d9605df6e4aac27d3975615ad8740db88e79ecc7ec56da8510d9f86077968ed3d1e5dfea7969a03cf54e07d41cb45e237815f5c554aff7a121fbada4fa1779ffa1aa14ada870e636f7f8ad305f51f704c3449750037fef99503d011c51b3a8d42ad08b6bad41732a597523d69f9acdac67abff3309888282f1216354054e646f906d2799f3dbf1fedf910f29ccc1ce8173a75c0e5893f8f95952967c0f58512212c2eb3a09cc77cd095a5fd63382add21518e3266244e6e2573baf55574335afc1d519fc93826adb7f8e1ac1be0619a2b5848e532c5cfca9922366ac3dfe9747131055dd909b8b34e9bcff92db7346efce5d835e6e1b482c7e0632994c635b5ca70909bd3b0da881e8bebda0e492fc60639a090a58063a00e1d06dbf2bf7d4618b3c5591795180cd84b2c7143c9afd0f8125772a34be888073628d0648f1444bf6ecca4d7b3eb4dc0d60f2af8ec43ae0fb90619a490767ab0606e82770eae187b90d8c8989aa84cbc1395b3308ff229646684a93f79ce1b113cb505dab22066a9e1ddc7693360e88f41b160e833cb3a4cc002b3c3560304f3032a7a4a1b59de22dc4c92d5e4ab5633aea87a94ad1cf1abf894bff3693fc432c8e0bc4f5ea23f9f398ceb25014c32efce87612afbcc8e0d27dac074aa433f494a8449ad2c8db55a90c396a7ba13b441da747f0567e2e8b8d476c3b9867d28e75369a65f7bec6a4b882003b470c213e267d2008c439c62b162822b9ebcff89200af0feda5dd78e4070e44444d686e0cfc6ebb08a1fe146ef650a9eceb66a3ab558d2f9e00c39225d0ce7e136b33dc7841447d2219b146389319244a90ae79022365ea7b80d4880441498756351b8491207761b09b7ea36ff195c568e0543f95a5b9a9c2d997c2f48c1642b3fda7d9d70f1baf6d01f9558e8093d321168ad7208491c010260d3c554ed0add3ad2ba73837dd7306f698ca6136c524dc9d4de405a03c06d96cf3a5e9eb4ae4f930b9ce45c840649b6fc3868b95f2dbd84ad297b450604c7b51141c695e0a07afe33c93039593c2016c914a4f0d050a820e649a84a6b4234748a790314e688166081034dbd8d50ccde8a580ebcdabb862702dfe7869c5c2875c09d988002024b64c56ab68101b60bde3bf702e78955170a14a01f030531af8f73945277f5c2e3a88669b9d5855100b0157b36073641cec3ea3604a8e73edb995750dfd41acc65f58393051c0e106df0e8d44ebae4a53ef6c6f2c66618e368da87fe02eac57274eca6121b4487cddd66dc6a75419f340876286385d399c21e85e56354c7b4ad15e5fcb56e48187315ee450ee27f5b07af6eb04d6ad3f2004e3e1d820736eb34eae771209b54f0b7f1fc88f89ec5225deec86227ad21128ae1fcd663e249962696f0e496b8bdf766edfb804c8e87989364d00138bd3364d3873c70a837813c62268dcb3d7d56f2e6d6e1907c25fba8a57c80a04535169d49a02a80c9f84848c6e1877435ceb50efd8623414eabc05ac376f5a705b301054b64386cf15193aa1ffdd21dc9e2fa77843716725c4c26edb97c6926ae510c3e2bb07c9c80c7bf2839f63f85fe186b7ae8ca1e35b9024156466b22f50db30f0c0cebcac77615be9f29e9157ca7c18d52c86d88bbcded67f463402a56e0c8731780adeaa0ffc88229816bbcb3efe7991b6be3ba9a48ed8659f95720cc8cd8a5a7bf2c2236c553f718d06a0126f95f72490e0a06285482219342c3f02a6b7bf6ee8ce48a79b840602a4e9cc845ff989fdb095b00912f4bec87c837ff9e569e01d9f9684dce46a07c9175cd378b74bc3b0b9443f1c816bba4d48a2bfb6b0c978016607ca51cef1ad9aaf739871c84a2ba1de7ff9c63e9825875064a8eb1f07bd5b9d5b3986508e48c61d4c1aabfd73f0c3d26622e4d11e221e45340e41cc5134d3cacf9c28f757033af0419fe6d736cde5d0b0a3ad5ab3ca17aaf61f91e6d84b5c7a35d8abcce390544a1aa308cab8eb5c617eb26c1ca5e9e14b733feb69cabc6be0158e11c0e45e22ad80cc79410b64dc51830c366d606fec4f84456f2b897cfd8f6053a0b791c0752beeedab4d2a8e7b614af14f78480379c56c631f3ed607755b2e892042b3e4793082e690246b002c4cbf3c1f5effadf9532c4c52bcad33161fa8f4064e6f600999dad34b40c9fb675eee7ad5cb0c6fc8341e47e84f547ae3c59d26074d04da7d9be729d1c06608737075d059ebab43d3698c09bafcaa6b444fee4d6ff4533187e0cf62e2469ad723ca7d034e4f48f7d1fc5a5c2e27d0ba3e0c563d2d784931f830be00b21991c0634128e893eb47119d92b84ba44a28a0928fe358b04cdf385685b37d52eed2392b34ec69fd9688e94c9ba9751363fac94012b", &(0x7f0000832000)="be118950c7989622", 0x1000, 0x8, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) connect$pppoe(r0, &(0x7f0000cd6000-0x1e)={0x18, 0x0, {0x3, @remote={[0xaa, 0xaa, 0xaa, 0xaa], 0x0, 0xbb}, @syzn={0x73, 0x79, 0x7a, 0x0, 0x0}}}, 0x1e) r1 = openat$mixer(0xffffffffffffff9c, &(0x7f0000241000)='/dev/mixer\x00', 0x40040, 0x0) setsockopt$inet_sctp6_SCTP_NODELAY(r1, 0x84, 0x3, &(0x7f0000b67000)=0x6, 0xae65ca127d177800) shmctl$IPC_INFO(0x0, 0x3, &(0x7f0000564000)=""/4096) 2018/02/01 04:11:29 executing program 2: openat$ion(0xffffffffffffff9c, &(0x7f0000801000-0x9)='/dev/ion\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000927000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) write$tun(0xffffffffffffffff, &(0x7f0000577000)=@pi={0x0, 0x0, @eth={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x0}, [], {@canfd={0xd, {{0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0, "feb442a1f43ead325d71fed774c8f6028c2a6b79a4e418aa3c5f391769659fef9f596cdade428c389e511eaad39d2ee4334dee9516a31d00510baaf06efc0980"}}}}}, 0x5a) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004ee000-0x76)='\x00', 0x1, 0x0, 0x0}], &(0x7f000000b000-0x30)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)=""}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00005da000)={0x0, 0x0, &(0x7f00000d8000)=[], 0x48, 0x0, &(0x7f000044c000-0x83)="a410778b7a640ab0384c4ead541b6ee57c5645909ef688d8ac3e5ecfc7039f5f8ba53f127b7f01947cd3689eaf6c090277915bab2a0c450988cb85688e2bcc101a80664d3081fcc0"}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000c5a000)={0x0, 0x0, 0x0, 0x0}) mmap(&(0x7f0000000000/0x13000)=nil, 0x13000, 0x0, 0x32, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000a95000-0x30)={0x14, 0x0, &(0x7f0000b8f000)=[@increfs_done={0x40106308, r3, 0x1}], 0x0, 0x0, &(0x7f00002e4000-0x70)=""}) 2018/02/01 04:11:29 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r0, &(0x7f0000022000-0x16)="01", 0x1, 0x0, &(0x7f0000031000-0x10)={0x2, 0xffffffffffffffff, @local={0xac, 0x14, 0xffffffffffffffff, 0xaa}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x10) shutdown(0xffffffffffffffff, 0x1) 2018/02/01 04:11:29 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x2, 0x78, 0xe2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000)=0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r0, &(0x7f0000349000-0x2e)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0xffffffffffffffff, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x2, 0x0, 0x0, 0x0}}, 0x2e) clock_gettime(0x0, &(0x7f00005fa000)={0x0, 0x0}) utimes(&(0x7f000042e000)='./file0\x00', &(0x7f0000ffa000-0x20)={{0x0, 0x0}, {r1, r2/1000+30000}}) r3 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r3, &(0x7f00005fb000-0x2e)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0xffffffffffffffff, @multicast2=0xe0000002, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x4, 0x0, 0x0, 0x0}}, 0x2e) 2018/02/01 04:11:29 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) seccomp(0x1, 0x0, &(0x7f000034c000-0x10)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x407ffc0003}]}) r0 = syz_open_dev$midi(&(0x7f000046f000)='/dev/midi#\x00', 0x1f, 0x8040) ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffffff, 0xc0206434, &(0x7f0000d16000)={0x9, 0x0, 0x1, 0x3}) ioctl$DRM_IOCTL_AGP_UNBIND(r0, 0x40106437, &(0x7f00003d3000)={r1, 0x39d}) setresgid(0x0, 0x0, 0x0) 2018/02/01 04:11:29 executing program 1: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000801000-0x9)='/dev/ion\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000233000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) r3 = dup2(r1, r2) write$tun(0xffffffffffffffff, &(0x7f0000577000)=@pi={0x0, 0x0, @eth={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x0}, [], {@canfd={0xd, {{0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0, "feb442a1f43ead325d71fed774c8f6028c2a6b79a4e418aa3c5f391769659fef9f596cdade428c389e511eaad39d2ee4334dee9516a31d00510baaf06efc0980"}}}}}, 0x5a) r4 = dup2(r2, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004ee000-0x76)='\x00', 0x1, 0x0, 0x0}], &(0x7f000000b000-0x30)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)=""}) mmap$binder(&(0x7f0000d74000/0x4000)=nil, 0x4000, 0x1000000, 0x40010, r1, 0x0) sendmsg$netlink(r4, &(0x7f0000bbf000-0x38)={&(0x7f0000893000)=@proc={0x10, 0x0, 0x3, 0x80000000}, 0xc, &(0x7f0000f21000)=[{&(0x7f0000929000-0x1244)={0x1244, 0x2d, 0x100, 0x4, 0x3, "", [@typed={0x8, 0x7b, @void=""}, @generic="3fd533b42a3e604738b1385759e8b2cda96f37a37d60ceb8ed02e1a1f64989d87c39fb4e8d595f63934d5c4eb40fbe71544cd3e04c2544387a0b1a620a4410e6ebcf81fb390d887fbe56440d347628c446f87863fa7ac90512ad27475d87f342f0c1a2", @typed={0x10, 0x6, @u64=0x2}, @nested={0x1154, 0x4f, [@typed={0xc, 0x18, @ipv4=@empty=0x0}, @generic="be6abcea4acdd279a9e5a50fa791d16bbe97fcaa5c8ffb6e97574b8ee4d725f190892d7bde80b640b87f013fa11f867072802bf02d5db93269ab5ea53193cdea93cbc78472b2b9ac17ad8ba563745de9b20219c805c94be8199fd0d7367fa2b013b25a0b692a74545514f5ca492fbac6d258f0d6645f7f660068eba5c3ed00442f1cc7213d1106b0033837e9efae219f14e828aa876c39e9ae94a453067ae92e86ae7118d169327ec6daa7ab87bd849f3e020b", @generic="7d0161cc6777e9d14bd901151a3c66d0fe3667601f6810ada42e4fa5591814d0001202bfc96a4f0f3b0df1587136c00c8f077a9987d60bc3588a44599bf03c366d76e756f67cf549df84d16e3549860d4c4513ace4fb0aacebe6e796bfd8ae0fcaabdee332b5c3236d35a561348b42c9c5a3e337945a6579658e2f503c12eec2fd20b747aaa38ae67dff3e22271694aa2932d744122fce9e7bd626b6bc79bd37ff5f32adc6654e5e2ad5ffaa707834a8d163fc005a10c1e8e0933a3c9962b5f50190eb732bc42f43a248f354ce2bd9a97ccb17578852f123e16bd9afed4be74c629b29884c7fe4d0a783f47895b4599ae44ce94eda998a8d4fb14f029dbb3daae3ffe3eb0b0f14a8c49a1b17fe02ea72440e02f5f822557ffcc9d0d3691267c90fd4691b8b5ec957e55567a6fe42cae2797049a53c2a3908fc3def934fbac09988c802c927e1356f56a5e7920eabafae8ab94ac7a21cc02dc4eb9e34787a5a6cf81cc70ee5f2838a6a412bf4ca35017356c32442dead7ec9361a5dedbebc7e85ba8745a6a750acf326aa2808b276cf978b7e3e1840c7c39b571fa8a5147e297aac3d0c46cb68f727513a41e3a006468fb0a944d7bc6df71fcae96cfb54cc082f1668ba488f3ee7e7d9711c68b878e26b36ba10ecb2cde3b5b314c81f44fb8893dbe57775fcb9e6bf0e7536a1345ffea0f87948b42eb0f342b95a860d409b7da582fdecba2510192d3e6363aa0d06e5b1ff3913d9b6543fce6e97f20ced636169d94477ed9abb0f56c32be698f4a6236d7a130ca0057b0ceaf7fa3e8f5186ae04cc2805edf843a4233683ec60ab2024f3174fa3aa74ae9eba0f95a7f253da3f2cafec86b23f8bee0c07c600b970df4a59a2607de677f69f27b8b9e7840cde0501855882edad2ebdbad72773ce247fc90d8c3520cd7cb314047e6a04c4f8efac3c0e72d434943611a21f288ddeef9a8c76c0c0e9f141d615e30e38d000bc4f16113b8f8c778c80916455704aa1879696cdd2faa04fa3f5b84d7608c1597ba63ae08cee01ba903db361b5f237f036d9a5b2c5b32a8aa5cb576295352bf31af196fdff2a270f1a7c0e1d17b904f68574434e087ffd46cbe7f9fac078a0fd0cc2fce641eaac3f9de597e11762ecc138c70ddd34f09bff408cdff1c19ddbd3e4dbf28609a39c591fe94bb46eeb73d344aa219350b676df8783d0f3d48585891ce9ca08f2fb3baeb9895763542bada6f43d4c843bb2e17ed5950bead5d89969cbd8a95a2d0b7c0845414d857d1f60e6c7d7c07e72cefebf17e736baf7c6bac288e41852d68efe48aeb2226baa65fd126fa89d37f6593a76515563d58ebe5c06584907859287cfcfe3c5607f24392d9a35bdc26cd460d16b250b49c77fb25d095e051c515418a047a04fe9def79f1174cf4a3ec55eca06418253d80b805d984b6f5f5352efd1faf6f29df3a99cd619cbf9608147a64402e47d119cd90784b558c38da45ab7c3c78d85b3cfd26cdde15875ee2d32a151d75f0c819a4bf6e08131bcc05ae9c3ab6698b8274bed66f83f1033e27ceb005257ca09132c050ff5f8b36fc150a3903d709cf0a1b00e57382f9290019aca4105d4f103f957c6fb47379a0a56a625c8b2a07c3ae5ebcf16bc708d10ef46236d39ac8183522b4580bbafb16d76db8da777bcf702bc0a6c3de32766e3add72fa1793873f64d6c3100525750edafd44d247c0b7a023f616a9b8e78cde6a2a2aae50f6e47c583ed19390cbd39793abf48c5564e7f99e3c521eff38082882713a88675e51cfbb4536749fb640a637c864c3732ff9b7793f6f8330e3c87e6fbd51313d9c33bcc088001e26cd7d51a1071bdd733bc8f640f76f14951263cef5a5a765457136a823d0045da2d375cfeb0cfb920a20c679dbfe24f3e2dd1b70a6273209dee350c641089e12391eb5901cae07b1627617246183144be13ec7e27b21059238e833c83e99c7187f7363c548ce8dcb4ed4472d69adb6f28e8086f611834db1664b1e0081ad6ac6df190556803754fc60993cc6bcf069a30f38ff35c8e092c431d57447ad2b0def2c26d434faeb5c92bdc28f2fc4eb1c05dadf94c8e39330fff05fbe00f0e2a374234f844a58ffcd0b66118b38813086a3899f384103ab93117c3156566d09dbde7aab60966a07ae93685bd94cf1d1ffecd460ed3b201b47da672a950f0db6984b7901594d1ee80679ae2a8a6012d87a53a0f070c92dd7c461da99fe29baed7f5a4a75b84410bacaf8ff59fb3ba6b1cf7e5eba107a73d752e8426e48ebb76ca63add67940165db563f297e428a957b925b73c5de5ba831186c0190bdf83e3f138c8736caf0ccc0dc71dea1b08ef53bb084f684fac2a82bf892e8b4d50f371e6d14fa919c530bc01f8877cfd6a0753083da4ac01c337e5ee76a11ed39ce097d5158f29a6feb5ad319969b4ba47e52be107172255fe44ea78f6cf00ce2beb5414ad07944803a2355ffcc29f8236c6fade40f4b3c20833ebb36a0a63e39c05b4588926e74b60faecc760a9d3ba1822703cdaa10e1199b63ed01c636ff8b4e23b4f20502497fb83864ed8f9b1ecac90524604132f5efb377398667709296e29ef47c1b2f84981475225419d6b2839c561cfc6e82429e3ac55b4332474129a670ed366f349f605842e8aad6183c25c21b16efe72ea5e603ceb71c83cb5d3b1302a589b928e1278f52c40e8ba7da870eef9d43b8aefb05c0a6742621e30559d46ef98963586c54e5cfa3cdf2b3af2ea10d5c124ff21612327a3dd9ee6bc88617b91342bce9006038e1860059d03901ab411db93297ba8ceb1c5065527ecf03d30819c68fe4d5eaa8b2cc72ce41372a4c6c6c33c951003aa1cd711756174808a509ca74b3284092b0ba93b79739d304e6c0c4e887cb5dba8ee04180a7e001835ead24f2f9d0e5161476c08fcf98b61f40294fcaccd49712635b6964edef592fcbbba8a89390b73048a33444fc88fbcb18132597f5ba57d59bc01843c05b3d18e09621eb7719e2e9084263feab8e109e1b8870ca0ac011da80638ab301f0bd4b3388a36258f877e2f4ebd530cabe55cd4dfb8d092ab9a9ba55571725e91595f441ec5ef78e2e573f267b616d157bee4100963e67e82d78e6c8bd228c00610c9ae60db396efb79617881dd07cf35cae532b835b7ec672c75c1879f9f211ea8e214fda54aa407952bb49abe8c233f43f5df91ec89ecd04dfa892d4ab6f5b832646516ac9813e6aed534671dcf98f15edf88de58d94cf833484110fa1fdd98473910e64122deb223b39055209d81be3847fd60cbd96651f20d964bc062d7fcc7b74d4816410441164d145b94b359ed602b58f699fb7e3dfb14a7f03d9d4eb2ab2cc265d9bb8067a605784683622d10c0cbf3ff453dc0c58237e4cf5543a25ab096eb1d08a75cc544fca02f5511a5e20cb764057f8f4a55ed82b5a3e724cb15d45385c32679828af41ce2f77bb30fc9ba9224a5ee8cd79d0cc920471cea3b4669584b1edcc9dac778dc129a157f8944c86ceb60cfd9ab5959d99e64f3a64385087c165d11d1497b7aa46aedc788599ec718d10ed2e1d493b7f2361cdd20ab5495e03bce2982bf73969b56836929e230ab1c743bd7d1973447d2fdd844bcb5557ac05a191383a8dcfe37d65971ffbce02862ee22c2d54b5a5af264555c75c56eaf76787ffd33d8b4b09d98c313ec47eb6f6c7d130c53d71445c069eb6c0914cd6eea7cf59ee42d0246271f512bb711ebe2fa98ceb4623735424ff37c5e8ee12e29f5b5c64e74dacf17e37f51d7513c2ebba5987f19b575a5366a3257c5a3ef9a7408731e8f08c956c9f10de9e736ec5bd186d4b81da6d428074ed8e47bb8b8c39b489b87c4a5fd76cb9c4e478606a21d4f4b11d22a7c76dbe420e34b45459f94187ba57696f56832d789285bb7ff5129e1dd5bce2da37ce4161ffadc60261ab3fe0b3797fd4bc3b907aa5aed33af786a38a5ea9eb5a7059601022728ac2a2ff2f9597c507546cd1196c054dadf13f2803aac7990d000ebd451c0be76f8921e65c33d60936c67dde1850f8d23e280b408648e076409e90425ae39cae27908a5794fd5822aac1f3986e9792787ba05fa73acf6c9d4ceeadd604a87371a70084f5925f2e1d9f092145be9d2a51319e04d19762756819fb5c6cddcae2f40b3af4d04e508eeafc11df68bf24ac6c60a1e914fc6cdff0c190e46c56a70e14b8735e8988794ecae739d0d7b2d7f945c46a9c9788e8f48e1c4846b80aeb06ba38a296053b33a68197a8642bad88550395ceb27ac4c7c812405e14a56b58d2c107f8314267c66a18248b02e7100f916758f70f0d44522b12623d5e8cf8327f176d76ef6e2c384c3c7688f6f7d73149d3ca8366ef75fe4b94c2a209f26ea342447802398fbfc51098b611a7b6579bbad86fe5131e67e944b327540fa95d3bb2b6a448ed54ae8a05d31e7c95c9ac105bd330c5b395096c41059fb43548158e7516c43705a7534070fdc5777c6dc9721e1a81a2de978bb1314a3ae3cec6f4d4e280188de4ffc90eea653b5776a766a7571422cfb9abc70631cfa0298313b4c5c3633cf1fecff3a42c39df146108dec8ac10d039921cb931f63a010abd34fcb21fbf3ea27d7f26e445597569f5382632d0143f4c6571cf84cba81ceef2c78250adc15dc4c859cb4bf9b112ccf381347c37713476cdee6ac501ebe281dd835bfd8de912e48338b1de1aa75cc214bb46cd16e787c798b452dd457ee44de6b549e565fe38247ca8673045a5041935376b01390dc46d24c7ad85820372edeff928473980eac18052ff2b62c497e38fa023f2da85e1abcf80df0d33f12d9ec5f5e9de82e695d3b4e33a91215869fc955ea41adc1307f36f09521ad97e0dc434c179c5697d93b3893adb61ca7800b8c1d727eda710a823de6b38b9853b03dba9d19b03458eb4bd274ea91f28ec81a3c1e1bb574e3f138ca9298f504169288cea75b1424a5321653f247bd74f953322506bc22703515d338414d19c4c5f54c1d6c3031936db5f242ca3d24e7fb7b9fc47a1fc3ecd0e7346e9c4c6ab4cbb41f7394a284290efe492f04657a98ff925c359906b55435253bf7c0c11a65c36efa37a1f964d774f9a1ddcd3e8095edd175869943d9ee8fbcceaaf31702f42860318be90804dc24105f5bf8c8e079db68e75d4f008c9be9277e9cec4b52a3dc4f1e67087d2930a380cc109ebb92b49aa7a2496ad3723a25d69fcb33ad18635f3fa63ef03f1e66f442531831ede62b38f9fb58a9c5d349dc952b6d1f1242024f1cc10621f02ea945b5985788cf53e8c93b799a545f1e6d68644784220bafa24c8a0c6ebe770206e02661923fc6a005e06e094eaa3f7cf6ccbf60ffccae5ad218a88f1f94540a4a72bdf32235d23cc0187b6db793d7a5a2d59ab08cff3ba041e1fe14d000c77bf91fa006216dd78e2d52bdfb2f00812d463612986bfb9885dd390f3d2f856427b1471f4d12e92f0670fc1a0d4eba0527651b69bff8fac68a3b17bcc0a2febf4eb5046c085346a8d79d055530699f31cb7bef6b7c3d41a519ff380386c0930fd96a2d176fb128092cfd19a971691b744e98a820f95856cc8fe9a2de850d9d082ad21ea71e6a52a6b273b3a0d2fab5a053af423b15a0920946066367d7fbeb2d396b5788ae309c11c86e4bcd55bb08601ed7086072916578a392faa327d9f9f2474cd7c6a095b7cb1dc429eb536159ff24c437605c5228617437e6bdb25566469514cf08f8f3ad82ca02532434ad92132f7b55f4fbdad6", @generic="7056350ad0440cfd8e216c2577912e2e09fc3a32ecb53c5eea576a99ba63dba5bfda8ba38b15a5d3794c658ab2b90d7e316c3544eba8d45cc61a588e5f03f3cb6549377a7eeb99941a0dab8a351fad86b6b6803bc1c1ab1e9d39dba49fb15da25224c8c40c245ada7a399b81a3bc3e189294391fc648630e90680e3073436ef06b14e013627f4cc29149fec796d7617d"]}, @generic="1f5076f7b98eec511282549bdad3e52bbb02b97c77bfa1960d687383216f4ac427fb77c92293d6259a7befb5a5be6a345d383291c157d570114df82c3d3a9dec91ac6b2c6c237792d443cf2e7c03cf2a43a1786618068b798e400e8dad30e2165b1b3a90"]}, 0x1244}, {&(0x7f0000915000-0x124)={0x124, 0x28, 0x8, 0x1, 0x2, "", [@typed={0x18, 0x8e, @ipv6=@local={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0xaa}}, @nested={0xfc, 0x61, [@generic="a9eebc1c854ceaa9605a69bb13c92935e3080b7292d94c31390d8b2627c18bca98f5f3461aba3d8d609cc30c47d200cb51248e6f2fcb9aabc6d6608f84ca8781033dbbcabfa35a497b2edeaf604e54c8463a6b91ec12a49619289a7728cfc3bf84eef9aa2edd7af86079b36b0a79629a1989e5672b5142f88d211279397cba63de9e2cfb26974098bb59f2a02f034fcbecce356be33bded8b38173bb25f60a5736d4e2f63903884da4a8eccf4e2fd34fd286ca3ae1512dc7dddde2cf1cc0aa899ad63e4a1441e2e47bf542e21dd5cadfe3f527a8531b2b0c988615f01508de018854a5e8fa582b1229cf5dd0e673cf32b5bc97c5d5a47fb2"]}]}, 0x124}, {&(0x7f000068e000)={0x314, 0x40, 0x820, 0x2, 0x1, "", [@typed={0x8, 0x8, @void=""}, @generic="7c781dda7a8acdf9b4030fdf4a5b6e1dddc771483b1594134dcb2c34637cddd00f5e221c909cf1113cf4056a8bbefd73363f9ca622293c14ac56d39e8aebf1e0deeb0de4dd529d564f26a7cce35d14ae67584ac0c5866cdafc544518b441f4e186b21eff75d7dc78173aa8c82fbab87b2589bdc935013be04918fc44c5f8c85cf047a9afa57ebd8295f19a054f5e16", @nested={0x10, 0x5, [@typed={0xc, 0x74, @fd=r3}]}, @typed={0xc, 0x4, @ipv4=@local={0xac, 0x14, 0x0, 0xaa}}, @nested={0x1b4, 0x3a, [@generic="4991cc995f6de649ea2994801ba8853ada2fd978517638be1ff3a602de751b3a1bd10865477def9a46b5cdab298af640c4847056a91e5e00cdd7af2d8acbee2d904f183c5ee6ba7ff770de209882c3328f203ac90ceac7d5f0a2d3e8391d2ef374b00cde9b3ca33688993e3cf6fff71e540747bfc1d384f2362b2137706ebe80f6b7a762f25c21f20cd39d6f1612e768b321d4e8e95ea0bd2a84d663da4cce8d6f28ada45a9f657a0214cd77bf608deab50d460614224ecb0f82a24f78c92c93b73bbbb8e1547c", @typed={0x10, 0x35, @u64=0x5}, @generic="96c14914d6aa3069c2d5131d9abf9a44114fd9419476437ea3d246ca5cc0b48675aec6d8a6e5b0b8941aa1e4bd992c8cb76377fe0fbd2bb7ff1a16147e9bcecb502228c3dc15f3d7cd7b453266ae5b48b03b476d974feeaec34a0e6ba38f30815f40c80d93aa8df8a7b6eb4d1f4794f4339fe2b252a4706ce8c4f770320d63063ad6ab030965368897cb1091a98e6ff5e51f0102cba2460a04a2c3a766c876601148b63b958bf99ad6ebe23e84f8fa4b0e875d94867021ced5cbf7baaf7515e6d904911fde7101668cac87439d4d05c4d82a8b2339d972ba"]}, @nested={0x9c, 0x4c, [@generic="98a3f3c30ac8861ca42831b2ebbc20bf9754e255eb912b72fa548776a6aaa4f70ee2c7524784fa9ffba43fb6e85f9f63fd51fc4d20e9c185f30a5a0998bbb33de8bb5c33e5c728500edeb4fb4d8a3ef0e18d79e84ed21d0a4757f5c1b99f574727", @typed={0x10, 0x51, @u64=0x877a}, @generic="2c9116d20091cda6f96f43feaae84791f38d443ac2d88c053f598cabd2042be02896e64db0d860"]}]}, 0x314}], 0x3, &(0x7f0000396000-0x30)=[@rights={0x18, 0x1, 0x1, [r0, r1]}, @rights={0x18, 0x1, 0x1, [r4, r3]}], 0x30, 0x5}, 0xc800) ioctl$sock_netrom_TIOCINQ(r4, 0x541b, &(0x7f0000e6b000)=0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000c5a000)={0x0, 0x0, 0x0, 0x0}) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r6 = syz_open_dev$sndseq(&(0x7f0000ff1000-0xd)='/dev/snd/seq\x00', 0x0, 0x0) read(r6, &(0x7f0000fb6000)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r6, 0xc0a85320, &(0x7f0000419000-0xb0)={{0x80, 0x0}, "0a4ceaa05d9a00000000000000039b3fd4cec307e8ef3d13eb790ec9c65abaf90d229db692542e5b78f8b29e0a27800f0000000000000009fb42f376589701a4", 0xa9824f69d1376637, 0x10800a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r6, 0x4040534e, &(0x7f00001a0000-0x17)={0xc1, @tick=0x0, 0x0, {0x0, 0x0}, 0x0, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) ioctl$SNDRV_SEQ_IOCTL_QUERY_NEXT_PORT(r6, 0xc0a85352, &(0x7f0000270000-0xb0)={{0x0, 0x0}, 'port0\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r6, 0xc058534f, &(0x7f0000945000-0x58)={{0x0, 0x0}, 0x0, 0x0, 0x0, {0x0, 0x0}, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000fdc000-0x10)='/dev/sequencer2\x00', 0x0, 0x0) ioctl$DRM_IOCTL_GET_CAP(r3, 0xc010640c, &(0x7f0000a55000)={0x3, 0x7}) mmap(&(0x7f0000000000/0x13000)=nil, 0x13000, 0x0, 0x32, 0xffffffffffffffff, 0x0) setsockopt$packet_fanout(r3, 0x107, 0x12, &(0x7f0000123000-0x4)={0x3, 0x7, 0x8000}, 0x4) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000a95000-0x30)={0x14, 0x0, &(0x7f0000b8f000)=[@increfs_done={0x40106308, r5, 0x3}], 0x68, 0x0, &(0x7f00004f3000)="9edb3fb9e2b555883772ce3a492bd66c45a3000000000000000519d8bd0004ee494e3acc18e9725c8b9945814d5480793d8fc4a3970304172074a14b46d45fd75dca6c79e8dc9a77fcdb3609a361996443b6e4fb72a9f7f358dbac538a175b3c2fa5a6c465902d4a"}) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_INFO(r3, 0xc10c5541, &(0x7f0000012000)={0x1, 0x2, 0xf21, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x9, 0x6, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000436000-0x30)={0x20, 0x0, &(0x7f0000136000)=[@dead_binder_done={0x40086310, 0x3}, @increfs_done={0x40106308, r5, 0x0}], 0x0, 0x0, &(0x7f0000888000-0xb)=""}) getsockopt$inet_sctp_SCTP_HMAC_IDENT(r3, 0x84, 0x16, &(0x7f0000721000-0x8)={0x2, [0x4, 0x25]}, &(0x7f00004bc000)=0x8) ioctl$KVM_GET_SREGS(r3, 0x8138ae83, &(0x7f0000cd2000-0x138)={{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, {0x0, 0x0, [0x0, 0x0, 0x0]}, {0x0, 0x0, [0x0, 0x0, 0x0]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0]}) [ 309.422113] binder: BINDER_SET_CONTEXT_MGR already set 2018/02/01 04:11:29 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r0, &(0x7f0000022000-0x16)="01", 0x1, 0x0, &(0x7f0000031000-0x10)={0x2, 0xffffffffffffffff, @local={0xac, 0x14, 0xffffffffffffffff, 0xaa}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x10) shutdown(0xffffffffffffffff, 0x1) 2018/02/01 04:11:29 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000)=0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000001000-0x11)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet_sctp_SCTP_FRAGMENT_INTERLEAVE(r0, 0x84, 0x12, &(0x7f00004bf000)=0xfffffffffffffffb, 0x4) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x0, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) readv(r0, &(0x7f0000001000)=[{&(0x7f0000001000-0x10)=""/16, 0x10}], 0x1) 2018/02/01 04:11:29 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x3, 0x7) perf_event_open(&(0x7f000001d000)={0x2, 0x78, 0xe2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x688b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000)=0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000010000-0x400)=@filter={'filter\x00', 0xa, 0x4, 0x3a0, 0xffffffff, 0x0, 0x0, 0x0, 0xffffffff, 0xffffffff, 0x0, 0x0, 0x0, 0xffffffff, 0x4, &(0x7f0000012000)=[{0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}], {{{[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0xa8, 0xd0, 0x0, {0x0, 0x0}}, {0x28, '\x00', 0x0, 0xfffffffffffffffe}}, [{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0xa8, 0xf0, 0x0, {0x0, 0x0}, []}, @common=@unspec=@IDLETIMER={0x48, 'IDLETIMER\x00', 0x0, {0x80000001, "737953fc00008000000000000000ffffff008000d200", 0x0}}}, {{@ipv6={@remote={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0xffffffffffffffff, 0xbb}, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, [0x0, 0x0, 0x0, 0x0], [0x0, 0x0, 0x0, 0x0], @generic="28446331605bfefb40ec55d89ccefcf6", @generic="21bcf35d5f3f02f397f4125277faaf31", {0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, {0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xa8, 0xf0, 0x0, {0x0, 0x0}, []}, @common=@unspec=@LED={0x48, 'LED\x00', 0x0, {'syz1\x00', 0x0, 0x0, 0x0}}}, {{@ipv6={@remote={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0xffffffffffffffff, 0xbb}, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x1}, [0x0, 0x0, 0x0, 0x0], [0x0, 0x0, 0x0, 0x0], @generic="83bd199c30f12b359fd940b92130f3df", @syzn={0x73, 0x79, 0x7a, 0xffffffffffffffff, 0x0}, {0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, {0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xa8, 0xf0, 0x0, {0x0, 0x0}, []}, @common=@unspec=@LED={0x48, 'LED\x00', 0x0, {"73797a300000000000000000000000000900000100", 0x0, 0x0, 0x0}}}]}}, 0x400) getsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r0, 0x84, 0x75, &(0x7f00005b7000)={0x0, 0x2}, &(0x7f0000425000-0x4)=0x8) getsockopt$inet_sctp6_SCTP_MAXSEG(r0, 0x84, 0xd, &(0x7f000037d000)=@assoc_value={r1, 0x5}, &(0x7f0000b45000)=0x8) 2018/02/01 04:11:29 executing program 2: openat$ion(0xffffffffffffff9c, &(0x7f0000801000-0x9)='/dev/ion\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000233000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$sndpcmp(&(0x7f0000382000-0x12)='/dev/snd/pcmC#D#p\x00', 0xff, 0x80) setsockopt$inet6_tcp_TCP_ULP(r2, 0x6, 0x1f, &(0x7f00003e7000-0x4)='tls\x00', 0x4) dup2(r0, r1) write$tun(0xffffffffffffffff, &(0x7f0000577000)=@pi={0x0, 0x0, @eth={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x0}, [], {@canfd={0xd, {{0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0, "feb442a1f43ead325d71fed774c8f6028c2a6b79a4e418aa3c5f391769659fef9f596cdade428c389e511eaad39d2ee4334dee9516a31d00510baaf06efc0980"}}}}}, 0x5a) r3 = dup2(r1, r0) ioctl$TTUNGETFILTER(r3, 0x801054db, &(0x7f0000d5d000-0x12)=""/18) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004ee000-0x76)='\x00', 0x1, 0x0, 0x0}], &(0x7f000000b000-0x30)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)=""}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00005da000)={0x0, 0x0, &(0x7f00000d8000)=[], 0x48, 0x0, &(0x7f000044c000-0x83)="a410778b7a640ab0384c4ead541b6ee57c5645909ef688d8ac3e5ecfc7039f5f8ba53f127b7f01947cd3689eaf6c090277915bab2a0c450988cb85688e2bcc101a80664d3081fcc0"}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000c5a000)={0x0, 0x0, 0x0, 0x0}) mmap(&(0x7f0000000000/0x13000)=nil, 0x13000, 0x0, 0x32, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000a95000-0x30)={0x14, 0x0, &(0x7f0000b8f000)=[@increfs_done={0x40106308, r4, 0x1}], 0x0, 0x0, &(0x7f00002e4000-0x70)=""}) [ 309.463112] binder: 15795:15798 ioctl 40046207 0 returned -16 [ 309.463933] binder: BINDER_SET_CONTEXT_MGR already set 2018/02/01 04:11:29 executing program 4: r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000d43000-0x10)='/dev/sequencer2\x00', 0x88080, 0x0) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$TIOCMBIC(r0, 0x5417, &(0x7f0000000000)=0x1) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) seccomp(0x1, 0x0, &(0x7f000089b000-0x10)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x407ffc0003}]}) shmctl$IPC_INFO(0x0, 0x3, &(0x7f0000564000)=""/4096) bind$pptp(r0, &(0x7f0000139000-0x20)={0x18, 0x2, {0x2, @rand_addr=0x1}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x20) ioctl$sock_bt_bnep_BNEPGETCONNINFO(r0, 0x800442d3, &(0x7f0000ad2000)={0x4c3, 0xfffffffffffffffb, 0x4, "4676a1111d73", "cdee420a78e46891bc4660fbb5f7f1e1"}) 2018/02/01 04:11:29 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r0, &(0x7f0000022000-0x16)="01", 0x1, 0x0, &(0x7f0000031000-0x10)={0x2, 0xffffffffffffffff, @local={0xac, 0x14, 0xffffffffffffffff, 0xaa}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x10) shutdown(r0, 0x0) [ 309.463952] binder: 15802:15806 ioctl 40046207 0 returned -16 [ 309.464055] binder: send failed reply for transaction 1571 to 15797:15800 2018/02/01 04:11:29 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) pipe2(&(0x7f0000ad0000-0x8)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) shmget(0x2, 0x1000, 0x420, &(0x7f0000d2e000/0x1000)=nil) poll(&(0x7f0000f1f000)=[{r1, 0x40, 0x0}, {r1, 0x8555, 0x0}, {r0, 0x0, 0x0}, {r1, 0x80, 0x0}, {r0, 0x2000, 0x0}, {r1, 0x110, 0x0}, {r0, 0x0, 0x0}], 0x7, 0x7ff) vmsplice(r1, &(0x7f00007f1000-0x10)=[{&(0x7f000000b000)='\a', 0x1}], 0x1, 0x0) bind$bt_sco(r0, &(0x7f000056d000-0x8)={0x1f, {0xc8c0, 0x2, 0x8000, 0x3, 0x10f, 0x7ff}}, 0x8) mbind(&(0x7f000000a000/0x3000)=nil, 0x3000, 0x0, &(0x7f0000002000-0x8)=0x0, 0x1, 0x2) openat$autofs(0xffffffffffffff9c, &(0x7f000095d000-0xc)='/dev/autofs\x00', 0x0, 0x0) statx(r0, &(0x7f0000722000-0x8)='./file0\x00', 0x2000, 0x100, &(0x7f000022d000-0x100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0}, {0x0, 0x0, 0x0}, {0x0, 0x0, 0x0}, {0x0, 0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) 2018/02/01 04:11:29 executing program 2: openat$ion(0xffffffffffffff9c, &(0x7f0000801000-0x9)='/dev/ion\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000233000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) write$tun(0xffffffffffffffff, &(0x7f0000577000)=@pi={0x0, 0x0, @eth={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x0}, [], {@canfd={0xd, {{0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0, "feb442a1f43ead325d71fed774c8f6028c2a6b79a4e418aa3c5f391769659fef9f596cdade428c389e511eaad39d2ee4334dee9516a31d00510baaf06efc0980"}}}}}, 0x5a) fstatfs(r1, &(0x7f000075d000)=""/200) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004ee000-0x76)='\x00', 0x1, 0x0, 0x0}], &(0x7f000000b000-0x30)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)=""}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00005da000)={0x0, 0x0, &(0x7f00000d8000)=[], 0x48, 0x0, &(0x7f000044c000-0x83)="a410778b7a640ab0384c4ead541b6ee57c5645909ef688d8ac3e5ecfc7039f5f8ba53f127b7f01947cd3689eaf6c090277915bab2a0c450988cb85688e2bcc101a80664d3081fcc0"}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000c5a000)={0x0, 0x0, 0x0, 0x0}) mmap(&(0x7f0000000000/0x13000)=nil, 0x13000, 0x0, 0x32, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000a95000-0x30)={0x14, 0x0, &(0x7f0000b8f000)=[@increfs_done={0x40106308, r3, 0x1}], 0x0, 0x0, &(0x7f00002e4000-0x70)=""}) [ 309.469177] binder_alloc: 15797: binder_alloc_buf, no vma [ 309.469202] binder: 15797:15809 transaction failed 29189/-3, size 40-8 line 2903 [ 309.469227] binder: 15797:15809 ioctl c0306201 20008000 returned -14 [ 309.469282] binder_alloc: 15797: binder_alloc_buf, no vma [ 309.469305] binder: 15795:15812 transaction failed 29189/-3, size 40-8 line 2903 [ 309.470823] binder_alloc: 15797: binder_alloc_buf, no vma [ 309.470850] binder: 15802:15813 transaction failed 29189/-3, size 40-8 line 2903 [ 309.474969] binder: 15802:15806 ioctl 541b 20e6b000 returned -22 [ 309.506777] binder: undelivered TRANSACTION_COMPLETE [ 309.506786] binder: undelivered TRANSACTION_ERROR: 29189 [ 309.506797] binder: undelivered TRANSACTION_ERROR: 29189 [ 309.543070] binder: 15822:15826 ioctl 801054db 20d5cfee returned -22 [ 309.545174] binder: send failed reply for transaction 1579 to 15822:15826 [ 309.575770] binder: 15822:15826 ioctl 801054db 20d5cfee returned -22 [ 309.575821] binder: 15822:15831 transaction failed 29189/-22, size 40-8 line 2788 [ 309.597347] binder: undelivered TRANSACTION_ERROR: 29189 [ 309.597359] binder: undelivered TRANSACTION_ERROR: 29189 [ 309.603888] binder: 15802:15806 ioctl c010640c 20a55000 returned -22 [ 309.604352] binder: 15802:15806 BC_INCREFS_DONE u0000000000000000 no match [ 309.638724] binder: 15802:15813 ioctl c10c5541 20012000 returned -22 [ 309.643394] binder: 15802:15813 ioctl 8138ae83 20cd1ec8 returned -22 [ 309.662432] binder: BINDER_SET_CONTEXT_MGR already set [ 309.662442] binder: 15802:15813 ioctl 40046207 0 returned -16 [ 309.665786] binder: send failed reply for transaction 1585 to 15841:15844 [ 309.666779] binder: 15802:15806 transaction failed 29189/-22, size 40-8 line 2788 [ 309.669519] binder: 15802:15813 ioctl 541b 20e6b000 returned -22 [ 309.684630] binder: 15841:15845 transaction failed 29189/-22, size 40-8 line 2788 [ 309.705640] binder: undelivered TRANSACTION_ERROR: 29189 [ 309.705653] binder: undelivered TRANSACTION_ERROR: 29189 [ 309.708540] binder: 15802:15806 ioctl c010640c 20a55000 returned -22 [ 309.722571] binder: 15802:15806 ioctl c10c5541 20012000 returned -22 2018/02/01 04:11:29 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000a8d000)={&(0x7f0000e4e000)={0x10, 0x0, 0x0, 0x0}, 0xc, &(0x7f0000fcf000-0x10)={&(0x7f00005d5000)=@updsa={0x104, 0x1a, 0x1, 0xffffffffffffffff, 0xffffffffffffffff, {{@in6=@local={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0xaa}, @in=@dev={0xac, 0x14, 0xffffffffffffffff, 0x0}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0}, {@in=@broadcast=0xffffffff, 0xffffffffffffffff, 0x2b}, @in=@multicast2=0xe0000002, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, {0x0, 0x0, 0x0, 0x0}, {0x0, 0x0, 0x0}, 0xffffffffffffffff, 0xffffffffffffffff, 0xa, 0x2, 0x0, 0x0}, [@coaddr={0x14, 0xe, @in=@remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}}]}, 0x104}, 0x1, 0x0, 0x0, 0x0}, 0x0) 2018/02/01 04:11:29 executing program 2: openat$ion(0xffffffffffffff9c, &(0x7f0000801000-0x9)='/dev/ion\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000233000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = dup2(r0, r1) ioctl$KVM_S390_INTERRUPT_CPU(r2, 0x4010ae94, &(0x7f0000d2c000-0x10)={0x5, 0x5, 0x2}) write$tun(0xffffffffffffffff, &(0x7f0000577000)=@pi={0x0, 0x0, @eth={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x0}, [], {@canfd={0xd, {{0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0, "feb442a1f43ead325d71fed774c8f6028c2a6b79a4e418aa3c5f391769659fef9f596cdade428c389e511eaad39d2ee4334dee9516a31d00510baaf06efc0980"}}}}}, 0x5a) r3 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004ee000-0x76)='\x00', 0x1, 0x0, 0x0}], &(0x7f000000b000-0x30)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)=""}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00005da000)={0x0, 0x0, &(0x7f00000d8000)=[], 0x48, 0x0, &(0x7f000044c000-0x83)="a410778b7a640ab0384c4ead541b6ee57c5645909ef688d8ac3e5ecfc7039f5f8ba53f127b7f01947cd3689eaf6c090277915bab2a0c450988cb85688e2bcc101a80664d3081fcc0"}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000c5a000)={0x0, 0x0, 0x0, 0x0}) mmap(&(0x7f0000000000/0x13000)=nil, 0x13000, 0x0, 0x32, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000a95000-0x30)={0x14, 0x0, &(0x7f0000b8f000)=[@increfs_done={0x40106308, r4, 0x1}], 0x0, 0x0, &(0x7f00002e4000-0x70)=""}) 2018/02/01 04:11:29 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = getpgid(0x0) sched_setaffinity(r0, 0x8, &(0x7f00009ad000)=0x5) pipe2(&(0x7f0000f61000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r3 = userfaultfd(0x800) ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f0000bc8000)={0xaa, 0x0, 0x0}) ioctl$UFFDIO_REGISTER(r3, 0xc020aa00, &(0x7f0000838000-0x20)={{&(0x7f0000faa000/0x2000)=nil, 0x2000}, 0x6, 0x0}) write$sndseq(r2, &(0x7f0000012000-0x2e)=[{0x0, 0x0, 0x0, 0x0, @time={0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, @time=@time={0x77359400, 0x0}}], 0x1c) fcntl$setpipe(r1, 0x407, 0x0) socket$bt_hidp(0x1f, 0x3, 0x6) getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(r1, 0x84, 0x6c, &(0x7f000080c000-0xa9)={0x0, 0xa1, "cd47cfb546f6b067902033257e24a913dacc1bbf8312d31cc7fbf8ae77082855b12c13d702e7a3e7d7125e01948b3a1b99ffe1d3efb55aef7852e6c3a501d76127bceabfa724f23bf83485d0826112809fd4dc027055c66ddad3ffeb660fb68671dcc4d23fdeb530e9d6489ba06d59b6737a4f733e34964b349ca46b16402239a6363c8fce2760dde7c931e9b3a8bded6602c704c1d17b0db35c7f46ad9d643985"}, &(0x7f000091d000)=0xa9) setsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r1, 0x84, 0x76, &(0x7f0000dd4000)={r4, 0x800}, 0x8) ioctl$int_in(r2, 0x5452, &(0x7f0000b00000-0x8)=0x7) dup2(r1, r3) 2018/02/01 04:11:29 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f0000590000-0x8)='./file0\x00', 0x14) write$selinux_create(r0, &(0x7f000074c000)=@access={'system_u:object_r:dpkg_exec_t:s0', 0x20, '/usr/sbin/cups-browsed', 0x20, 0x32, 0x30, 0x0}, 0x3b) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f00007cf000)='/dev/cuse\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_STATUS(r1, 0xc05c5340, &(0x7f0000b85000)={0x6, 0x100, 0x2, {0x0, 0x0}, 0x0, 0x4, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000801000-0x9)='/dev/ion\x00', 0x0, 0x0) r3 = syz_open_dev$binder(&(0x7f0000233000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r4 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0) r5 = dup2(r3, r4) write$tun(0xffffffffffffffff, &(0x7f0000577000)=@pi={0x0, 0x0, @eth={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x0}, [], {@canfd={0xd, {{0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0, "feb442a1f43ead325d71fed774c8f6028c2a6b79a4e418aa3c5f391769659fef9f596cdade428c389e511eaad39d2ee4334dee9516a31d00510baaf06efc0980"}}}}}, 0x5a) r6 = dup2(r4, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004ee000-0x76)='\x00', 0x1, 0x0, 0x0}], &(0x7f000000b000-0x30)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)=""}) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f00005da000)={0x0, 0x0, &(0x7f00000d8000)=[], 0x48, 0x0, &(0x7f000044c000-0x83)="a410778b7a640ab0384c4ead541b6ee57c5645909ef688d8ac3e5ecfc7039f5f8ba53f127b7f01947cd3689eaf6c090277915bab2a0c450988cb85688e2bcc101a80664d3081fcc0"}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000c5a000)={0x0, 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000a95000-0x30)={0x14, 0x0, &(0x7f0000b8f000)=[@increfs_done={0x40106308, r7, 0x1}], 0x0, 0x0, &(0x7f00002e4000-0x70)=""}) getsockopt$inet6_dccp_buf(r5, 0x21, 0xcf, &(0x7f0000e10000-0xcc)=""/204, &(0x7f000037d000-0x4)=0xcc) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000436000-0x30)={0x20, 0x0, &(0x7f0000136000)=[@dead_binder_done={0x40086310, 0x3}, @increfs_done={0x40106308, r7, 0x0}], 0x0, 0x0, &(0x7f0000888000-0xb)=""}) close(r2) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000002000-0x38)={0x0, 0x0, &(0x7f0000003000)=[], 0x0, &(0x7f0000002000)=[{0x10, 0x10e, 0x0, ""}], 0x10, 0x0}, 0x0) 2018/02/01 04:11:29 executing program 1: openat$ion(0xffffffffffffff9c, &(0x7f0000801000-0x9)='/dev/ion\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000233000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) rt_sigtimedwait(&(0x7f0000438000)={0x0}, &(0x7f0000914000)={0x0, 0x0, 0x0, 0x0}, &(0x7f000015f000)={0x0, 0x0}, 0x20438008) r1 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) write$tun(0xffffffffffffffff, &(0x7f0000577000)=@pi={0x0, 0x0, @eth={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x0}, [], {@canfd={0xd, {{0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0, "feb442a1f43ead325d71fed774c8f6028c2a6b79a4e418aa3c5f391769659fef9f596cdade428c389e511eaad39d2ee4334dee9516a31d00510baaf06efc0980"}}}}}, 0x5a) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004ee000-0x76)='\x00', 0x1, 0x0, 0x0}], &(0x7f000000b000-0x30)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)=""}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00005da000)={0x0, 0x0, &(0x7f00000d8000)=[], 0x48, 0x0, &(0x7f000044c000-0x83)="a410778b7a640ab0384c4ead541b6ee57c5645909ef688d8ac3e5ecfc7039f5f8ba53f127b7f01947cd3689eaf6c090277915bab2a0c450988cb85688e2bcc101a80664d3081fcc0"}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000c5a000)={0x0, 0x0, 0x0, 0x0}) mmap(&(0x7f0000000000/0x13000)=nil, 0x13000, 0x0, 0x32, 0xffffffffffffffff, 0x0) r4 = add_key(&(0x7f00008e6000-0x6)='.dead\x00', &(0x7f0000ecf000)={0x73, 0x79, 0x7a, 0x2, 0x0}, &(0x7f00004d5000)="8635807d9d4e79fddade5a0552ada34c307b0ca258b81574ad75b64807a5e84d326f8803a60f75f8e0", 0x29, 0xfffffffffffffff9) keyctl$setperm(0x5, r4, 0x5000010) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000a95000-0x30)={0x14, 0x0, &(0x7f0000b8f000)=[@increfs_done={0x40106308, r3, 0x1}], 0x0, 0x0, &(0x7f00002e4000-0x70)=""}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000436000-0x30)={0x20, 0x0, &(0x7f0000136000)=[@dead_binder_done={0x40086310, 0x3}, @increfs_done={0x40106308, r3, 0x0}], 0x0, 0x0, &(0x7f0000888000-0xb)=""}) 2018/02/01 04:11:29 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) seccomp(0x1, 0x0, &(0x7f000089b000-0x10)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x407ffc0003}]}) shmctl$IPC_INFO(0x0, 0x3, &(0x7f0000564000)=""/4096) socketpair$inet6_icmp_raw(0xa, 0x3, 0x3a, &(0x7f0000d66000-0x8)={0x0, 0x0}) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f0000f2f000)={{{@in=@empty=0x0, @in=@dev={0x0, 0x0, 0xffffffffffffffff, 0x0}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, {0x0, 0x0, 0x0, 0x0}, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, {{@in6=@loopback={0x0, 0x0}, 0xffffffffffffffff, 0x0}, 0x0, @in=@remote={0x0, 0x0, 0xffffffffffffffff, 0x0}, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, &(0x7f00000c1000)=0xe8) r2 = syz_open_dev$usbmon(&(0x7f00009d4000-0xd)='/dev/usbmon#\x00', 0xa365, 0x101000) ioctl$DRM_IOCTL_CONTROL(r2, 0x40086414, &(0x7f0000c3c000-0x8)={0x2, 0x4}) r3 = getuid() setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000182000)={{{@in=@empty=0x0, @in=@local={0xac, 0x14, 0x0, 0xaa}, 0x3, 0x1ff, 0x0, 0x8, 0xa, 0xa0, 0x80, 0x6, r1, r3}, {0x2248, 0x1, 0x8, 0x7, 0x8, 0x0, 0x5, 0x2}, {0x0, 0x1, 0x100, 0x3}, 0xe3, 0x8, 0x1, 0x0, 0x1, 0x0}, {{@in=@remote={0xac, 0x14, 0x0, 0xbb}, 0x0, 0x3c}, 0x2, @in=@multicast2=0xe0000002, 0x4, 0x0, 0x1, 0xff, 0x0, 0x5, 0x2}}, 0xe8) r4 = syz_open_dev$sndpcmp(&(0x7f00001c7000-0x12)='/dev/snd/pcmC#D#p\x00', 0x2608, 0x0) setsockopt$inet_sctp_SCTP_RECVRCVINFO(r4, 0x84, 0x20, &(0x7f00002c2000)=0xbe, 0x4) 2018/02/01 04:11:29 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r0, &(0x7f0000022000-0x16)="01", 0x1, 0x0, &(0x7f0000031000-0x10)={0x2, 0xffffffffffffffff, @local={0xac, 0x14, 0xffffffffffffffff, 0xaa}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x10) shutdown(r0, 0x0) 2018/02/01 04:11:29 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x3, 0x7) perf_event_open(&(0x7f000001d000)={0x2, 0x78, 0xe2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x688b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000)=0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000010000-0x400)=@filter={'filter\x00', 0xa, 0x4, 0x3a0, 0xffffffff, 0x0, 0x0, 0x0, 0xffffffff, 0xffffffff, 0x0, 0x0, 0x0, 0xffffffff, 0x4, &(0x7f0000012000)=[{0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}], {{{[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0xa8, 0xd0, 0x0, {0x0, 0x0}}, {0x28, '\x00', 0x0, 0xfffffffffffffffe}}, [{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0xa8, 0xf0, 0x0, {0x0, 0x0}, []}, @common=@unspec=@IDLETIMER={0x48, 'IDLETIMER\x00', 0x0, {0x80000001, "737953fc00008000000000000000ffffff008000d200", 0x0}}}, {{@ipv6={@remote={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0xffffffffffffffff, 0xbb}, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, [0x0, 0x0, 0x0, 0x0], [0x0, 0x0, 0x0, 0x0], @generic="28446331605bfefb40ec55d89ccefcf6", @generic="21bcf35d5f3f02f397f4125277faaf31", {0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, {0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xa8, 0xf0, 0x0, {0x0, 0x0}, []}, @common=@unspec=@LED={0x48, 'LED\x00', 0x0, {'syz1\x00', 0x0, 0x0, 0x0}}}, {{@ipv6={@remote={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0xffffffffffffffff, 0xbb}, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x1}, [0x0, 0x0, 0x0, 0x0], [0x0, 0x0, 0x0, 0x0], @generic="83bd199c30f12b359fd940b92130f3df", @syzn={0x73, 0x79, 0x7a, 0xffffffffffffffff, 0x0}, {0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, {0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xa8, 0xf0, 0x0, {0x0, 0x0}, []}, @common=@unspec=@LED={0x48, 'LED\x00', 0x0, {"73797a300000000000000000000000000900000100", 0x0, 0x0, 0x0}}}]}}, 0x400) getsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r0, 0x84, 0x75, &(0x7f00005b7000)={0x0, 0x2}, &(0x7f0000425000-0x4)=0x8) getsockopt$inet_sctp6_SCTP_MAXSEG(r0, 0x84, 0xd, &(0x7f000037d000)=@assoc_value={r1, 0x5}, &(0x7f0000b45000)=0x8) [ 309.723717] binder: 15802:15806 BC_DEAD_BINDER_DONE 0000000000000003 not found [ 309.723728] binder: 15802:15806 BC_INCREFS_DONE u0000000000000000 no match [ 309.725573] binder: 15802:15806 ioctl 8138ae83 20cd1ec8 returned -22 [ 309.732658] binder: undelivered TRANSACTION_ERROR: 29189 [ 309.906931] binder: undelivered TRANSACTION_ERROR: 29189 2018/02/01 04:11:29 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r0, &(0x7f0000022000-0x16)="01", 0x1, 0x0, &(0x7f0000031000-0x10)={0x2, 0xffffffffffffffff, @local={0xac, 0x14, 0xffffffffffffffff, 0xaa}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x10) shutdown(r0, 0x0) 2018/02/01 04:11:29 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f0000590000-0x8)='./file0\x00', 0x14) write$selinux_create(r0, &(0x7f000074c000)=@access={'system_u:object_r:dpkg_exec_t:s0', 0x20, '/usr/sbin/cups-browsed', 0x20, 0x32, 0x30, 0x0}, 0x3b) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f00007cf000)='/dev/cuse\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_STATUS(r1, 0xc05c5340, &(0x7f0000b85000)={0x6, 0x100, 0x2, {0x0, 0x0}, 0x0, 0x4, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000801000-0x9)='/dev/ion\x00', 0x0, 0x0) r3 = syz_open_dev$binder(&(0x7f0000233000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r4 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0) r5 = dup2(r3, r4) write$tun(0xffffffffffffffff, &(0x7f0000577000)=@pi={0x0, 0x0, @eth={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x0}, [], {@canfd={0xd, {{0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0, "feb442a1f43ead325d71fed774c8f6028c2a6b79a4e418aa3c5f391769659fef9f596cdade428c389e511eaad39d2ee4334dee9516a31d00510baaf06efc0980"}}}}}, 0x5a) r6 = dup2(r4, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004ee000-0x76)='\x00', 0x1, 0x0, 0x0}], &(0x7f000000b000-0x30)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)=""}) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f00005da000)={0x0, 0x0, &(0x7f00000d8000)=[], 0x48, 0x0, &(0x7f000044c000-0x83)="a410778b7a640ab0384c4ead541b6ee57c5645909ef688d8ac3e5ecfc7039f5f8ba53f127b7f01947cd3689eaf6c090277915bab2a0c450988cb85688e2bcc101a80664d3081fcc0"}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000c5a000)={0x0, 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000a95000-0x30)={0x14, 0x0, &(0x7f0000b8f000)=[@increfs_done={0x40106308, r7, 0x1}], 0x0, 0x0, &(0x7f00002e4000-0x70)=""}) getsockopt$inet6_dccp_buf(r5, 0x21, 0xcf, &(0x7f0000e10000-0xcc)=""/204, &(0x7f000037d000-0x4)=0xcc) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000436000-0x30)={0x14, 0x0, &(0x7f0000136000)=[@increfs_done={0x40106308, r7, 0x0}], 0x0, 0x0, &(0x7f0000888000-0xb)=""}) close(r2) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000002000-0x38)={0x0, 0x0, &(0x7f0000003000)=[], 0x0, &(0x7f0000002000)=[{0x10, 0x10e, 0x0, ""}], 0x10, 0x0}, 0x0) 2018/02/01 04:11:29 executing program 5: mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$mouse(&(0x7f0000001000-0x12)='/dev/input/mouse#\x00', 0x3, 0x101100) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(0xffffffffffffffff, 0xc00c642d, &(0x7f00002d4000-0xc)={0x0, 0x0, 0xffffffffffffffff}) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$EVIOCGBITSW(r0, 0x80404525, &(0x7f0000001000)=""/0) ioctl$DRM_IOCTL_GEM_OPEN(0xffffffffffffff9c, 0xc010640b, &(0x7f0000989000)={0x0, 0x0, 0x2}) ioctl$DRM_IOCTL_GEM_FLINK(r0, 0xc008640a, &(0x7f0000d86000-0x8)={r1, r2}) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r3 = socket$key(0xf, 0x3, 0x2) perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000)=0x0, 0x4}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$key(r3, &(0x7f0000006000-0x38)={0x0, 0x0, &(0x7f0000015000)={&(0x7f0000017000-0xd0)={0x2, 0x12, 0x0, 0x0, 0x2, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, []}, 0x10}, 0x1, 0x0, 0x0, 0x0}, 0x0) 2018/02/01 04:11:29 executing program 3: mmap(&(0x7f0000000000/0xd25000)=nil, 0xd25000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) mmap(&(0x7f0000d25000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000d26000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r1 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000d26000+0x6c4)='/selinux/policy\x00', 0x0, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r1, 0x4008af60, &(0x7f0000a9b000)={@my=0x1, 0x0}) mmap(&(0x7f0000d26000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) connect$l2tp(r0, &(0x7f0000d26000)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x1, @dev={0xac, 0x14, 0x0, 0x12}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x0, 0x2, 0x2, 0x1}}, 0x2e) mmap(&(0x7f0000d26000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) getsockopt$inet_int(r0, 0x0, 0x37, &(0x7f0000d27000-0x4)=0x0, &(0x7f0000297000-0x4)=0x4) getpeername(r0, &(0x7f0000d25000)=@ethernet={0x0, @link_local={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, &(0x7f0000743000-0x4)=0x10) getsockopt$inet_tcp_int(r0, 0x6, 0x13, &(0x7f0000ae0000-0x4)=0x0, &(0x7f0000d1e000-0x4)=0x4) mmap(&(0x7f0000d27000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r2 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000d27000)='/selinux/mls\x00', 0x0, 0x0) mmap(&(0x7f0000d27000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) setsockopt$inet_udp_int(r2, 0x11, 0x67, &(0x7f0000d28000-0x4)=0x2, 0x4) [ 309.949969] binder: BINDER_SET_CONTEXT_MGR already set [ 309.970107] binder: 15850:15861 ioctl 40046207 0 returned -16 2018/02/01 04:11:29 executing program 1: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000801000-0x9)='/dev/ion\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000233000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000b57000-0x4)=0x400) r3 = socket$rds(0x15, 0x5, 0x0) ioctl$sock_SIOCOUTQ(r3, 0x5411, &(0x7f00000c1000-0x4)=0x0) r4 = syz_open_dev$dspn(&(0x7f0000f08000)='/dev/dsp#\x00', 0x7, 0x10000) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f00001cd000)={0x0, 0x3, 0x10, 0xfffffffffffffff8, 0x3ff}, &(0x7f0000a61000-0x4)=0x18) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r4, 0x84, 0x18, &(0x7f000012c000-0x6)={r5, 0x7ff}, &(0x7f0000334000)=0x6) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) r6 = dup2(r1, r2) write$tun(0xffffffffffffffff, &(0x7f0000577000)=@pi={0x0, 0x0, @eth={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x0}, [], {@canfd={0xd, {{0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0, "feb442a1f43ead325d71fed774c8f6028c2a6b79a4e418aa3c5f391769659fef9f596cdade428c389e511eaad39d2ee4334dee9516a31d00510baaf06efc0980"}}}}}, 0x5a) ioctl$TUNGETFEATURES(r6, 0x800454cf, &(0x7f00002e9000-0x4)=0x0) r7 = dup2(r2, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004ee000-0x76)='\x00', 0x1, 0x0, 0x0}], &(0x7f000000b000-0x30)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)=""}) ioctl$BINDER_WRITE_READ(r7, 0xc0306201, &(0x7f00005da000)={0x0, 0x0, &(0x7f00000d8000)=[], 0x48, 0x0, &(0x7f000044c000-0x83)="a410778b7a640ab0384c4ead541b6ee57c5645909ef688d8ac3e5ecfc7039f5f8ba53f127b7f01947cd3689eaf6c090277915bab2a0c450988cb85688e2bcc101a80664d3081fcc0"}) ioctl$KVM_GET_VCPU_MMAP_SIZE(r7, 0xae04) ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000c5a000)={0x0, 0x0, 0x0, 0x0}) mmap(&(0x7f0000000000/0x13000)=nil, 0x13000, 0x0, 0x32, 0xffffffffffffffff, 0x0) setsockopt$bt_hci_HCI_FILTER(r6, 0x0, 0x2, &(0x7f00007a2000)={0x8, 0x793f, 0x7, 0x200}, 0x10) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000a95000-0x30)={0x14, 0x0, &(0x7f0000b8f000)=[@increfs_done={0x40106308, r8, 0x1}], 0x0, 0x0, &(0x7f00002e4000-0x70)=""}) ioctl$DRM_IOCTL_RES_CTX(r6, 0xc0106426, &(0x7f00001d4000)={0x3, &(0x7f000093b000)=[{0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}]}) ioctl$DRM_IOCTL_GET_CTX(r6, 0xc0086423, &(0x7f000064e000-0x8)={r9, 0x1}) ioctl$BINDER_WRITE_READ(r7, 0xc0306201, &(0x7f0000436000-0x30)={0x60, 0x0, &(0x7f00003c4000-0x60)=[@reply_sg={0x40486312, {{0x3, 0x0, 0x1, 0x0, 0x11, 0x0, 0x0, 0x0, 0x20, &(0x7f000093e000)=[], &(0x7f000026f000-0x20)=[0x30, 0x58, 0x48, 0x40]}, 0x7}}, @increfs_done={0x40106308, r8, 0x0}], 0x0, 0x0, &(0x7f0000888000-0xb)=""}) [ 309.970185] binder: BINDER_SET_CONTEXT_MGR already set 2018/02/01 04:11:29 executing program 4: r0 = dup2(0xffffffffffffffff, 0xffffffffffffffff) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) sendmsg$netrom(r0, &(0x7f0000001000-0x38)={&(0x7f0000001000-0x48)=@full={{0x3, {'L"Sx@Q:'}, 0x10001}, [{"626be59aa1a6d5"}, {"a89fa47582e10f"}, {"ff84399aca2037"}, {"0e4d47d434182d"}, {"3021fd19b94d3c"}, {"32e21ae55dcef6"}, {"760fbb70e95130"}, {"360fb5386c0537"}]}, 0x48, &(0x7f00004e5000)=[{&(0x7f0000867000-0x59)="6c733a7cb6073997c2dcbaac4924ad3c0b1fd41d37e0b4a0f2696960e54bbb76a7c72fca63e1c0e8d771654dea12aeb1f692f575807849fef6f5f0546eabec545e9bdffadd73ce5f18a67defccb3da2f1e68093a9d4116e514", 0x59}, {&(0x7f00005ba000)="728b9c807e4a3857b927ea591c9c507b9e801c33d09b9d4639dc1fb000c84c9f355e1610317768b5c94b45bc1609aa4d536bf0828771c601f71f4fe1a5e1e4658e11093cd1053a23ed18229fd4b854b950c7546dcd9b7336800c229716d84aaad5675841a54b05e51063805a801766d2bdfb89a478d8154f90592e01b23e84e68d4b4f50674b1fc34b64c268548822d0586549cb9e07474feaced989c35caed0aed8dd1513cf843b5dd590ea56fe368c0736d4da21a95ec62e862b671f037299fa27c6822dbaa1dae9e24e675f05fc27a249760ce772a4905ccc0e260bfc90f4732cf616a6dff9f8190ed58f", 0xec}, {&(0x7f0000ba2000-0xac)="4014b10ecce6a1e25f2d9e6b5d5b2af8d8ec48d0dbdf2bc13cebdd4ec4b87d68ab3e3524d5fddd2c7733a3f6e43151941e60d069ec0564026ff8c407e1f898827244b98ff21b0d0e88592d88885614c2bbc616389013bbe83c54e401dcd9bdc14c55af15362c2e6272023aa5859c0d5412e25d4a56622bf4301e722fa3a9ba23a0e3a62109a70130dbbb0f4440b98b4d9d71ddf7ca2756d184bb056d3364043383bc5ad5934856fd4d8adeb4", 0xac}, {&(0x7f000066e000-0xa0)="0d81f56c75e6ae84ab3726c8946b507fb214adad2ddb024a12cb6550aaa907ba0d75ebc99601423b39b466d8a7b227d7e5b95edc9ff4a2308b7176442e09bd2fd3dadece5658d2dcc997f54dc1e160a52d265c1765fe507aebff86effef0207a906715067d63bf1ad9e7900a983517ad097fb18f801d2ba54cc29a802e2430db09990695e5b59ddc808d0893e3482614d651e135045bf8604c32b2cd4cf71d52", 0xa0}, {&(0x7f0000838000)="b40649fa3c6286332bc400b379a6f8cf3106f5bcfac94b485eccd3f94d8ee5564dcc1ed6f601", 0x26}], 0x5, &(0x7f0000516000)=[{0xf0, 0x0, 0x8, "183ab0151d89be714c7698d118ef8e0cf63d20f94ebecb1f76216561e75299f3153dbf8d5f0fb6356e20ed5f9609302d6265176ea9f42cec8208459a8482d09efbc39124fd1993bd905b5cca2a32380da633ab33e58b3b5aef3044ed78394c65f202783f31d8222704b70b841493479c945289cddb222db925325b9f2645c5fc9abe75b8fcaa97753b8e3bd0e93513f634c5fa9b3ac5dc34048f2739dd592905bffc9adbc3218c79636c920451bec122789a3cc37c3d96f2b2c3c4e77c1efd060f3e3cbbb64ada4e13308704f7d6367a8c0bcf600a7da4a3db535371a65667"}, {0x88, 0x10f, 0x4, "7831f78793f1a8f62bbb5c89f0c30307479659ee41af9efe4c9f0b00d8e8013315c5525cf340073997ccfaa6a3215a6f0451c8bd53588a6279b45bca05673ec00f5a3f6aecd5c48c3d18a8705a92e53217843f45c261c40c20211da07b753d2d3cf43fde6ab22da51ac4994c6aa00be3be85ab18"}], 0x178, 0x20004001}, 0xc000) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) setsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX(r0, 0x84, 0x6e, &(0x7f000074d000)=[@in={0x2, 0x2, @empty=0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, @in6={0xa, 0x0, 0x20, @local={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0xaa}, 0x8}, @in={0x2, 0x1, @multicast2=0xe0000002, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, @in={0x2, 0x1, @multicast2=0xe0000002, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}], 0x4c) seccomp(0x1, 0x0, &(0x7f000089b000-0x10)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x407ffc0003}]}) shmctl$IPC_INFO(0x0, 0x3, &(0x7f0000564000)=""/4096) 2018/02/01 04:11:30 executing program 7 (fault-call:3 fault-nth:0): mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r0, &(0x7f0000022000-0x16)="01", 0x1, 0x0, &(0x7f0000031000-0x10)={0x2, 0xffffffffffffffff, @local={0xac, 0x14, 0xffffffffffffffff, 0xaa}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x10) shutdown(r0, 0x1) [ 309.970200] binder: 15860:15863 ioctl 40046207 0 returned -16 2018/02/01 04:11:30 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000223000)={0x2, 0x78, 0xe3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000)=0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$rtc(0xffffffffffffff9c, &(0x7f000031a000-0x9)='/dev/rtc\x00', 0x98880, 0x0) setsockopt$inet_sctp_SCTP_ADD_STREAMS(r0, 0x84, 0x79, &(0x7f0000fac000)=0x7, 0x4) ioctl$VHOST_SET_VRING_ERR(r0, 0x4008af22, &(0x7f0000596000)={0x3, r0}) r1 = syz_open_dev$tun(&(0x7f0000125000-0xd)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETQUEUE(r1, 0x400454d9, &(0x7f0000543000-0x28)={@syzn={0x73, 0x79, 0x7a, 0x0, 0x0}, @ifru_settings={0x265, 0x0, @cisco=&(0x7f0000542000)={0x0, 0x0}}}) [ 309.974217] binder: 15857:15862 BC_DEAD_BINDER_DONE 0000000000000003 not found [ 309.974229] binder: 15857:15862 BC_INCREFS_DONE u00000000204edf8a node 1593 cookie mismatch 0000000000000000 != 0000000000000001 [ 309.978349] binder: 15860:15863 BC_INCREFS_DONE node 1596 has no pending increfs request [ 309.982421] binder: send failed reply for transaction 1592 to 15857:15862 [ 309.982437] binder: send failed reply for transaction 1595 to 15860:15863 [ 309.988296] binder: 15850:15867 ioctl 4010ae94 20d2bff0 returned -22 [ 309.991678] binder: undelivered TRANSACTION_COMPLETE [ 309.991687] binder: undelivered TRANSACTION_ERROR: 29189 [ 309.992442] binder: 15850:15867 transaction failed 29189/-22, size 40-8 line 2788 [ 309.999938] binder: 15850:15867 BC_INCREFS_DONE u0000000000000000 no match [ 310.020277] binder: send failed reply for transaction 1600 to 15857:15869 [ 310.025647] binder: 15857:15866 BC_INCREFS_DONE node 1593 has no pending increfs request [ 310.030252] binder: 15850:15867 ioctl 4010ae94 20d2bff0 returned -22 [ 310.030654] binder: 15850:15867 transaction failed 29189/-22, size 40-8 line 2788 [ 310.032922] binder: undelivered TRANSACTION_ERROR: 29189 [ 310.032941] binder: undelivered TRANSACTION_COMPLETE [ 310.032949] binder: undelivered TRANSACTION_ERROR: 29189 [ 310.041010] binder: 15850:15873 BC_INCREFS_DONE u0000000000000000 no match [ 310.073631] binder: 15880:15883 ioctl 800454cf 202e8ffc returned -22 [ 310.074481] binder: 15880:15883 ioctl ae04 0 returned -22 [ 310.076138] binder: send failed reply for transaction 1605 to 15880:15883 [ 310.078181] binder: 15880:15883 ioctl c0106426 201d4000 returned -22 [ 310.078239] binder: 15880:15883 ioctl c0086423 2064dff8 returned -22 [ 310.078298] binder: 15880:15883 got reply transaction with no transaction stack [ 310.078307] binder: 15880:15883 transaction failed 29201/-71, size 0-32 line 2703 [ 310.078440] binder_alloc: 15875: binder_alloc_buf, no vma [ 310.078465] binder: 15875:15879 transaction failed 29189/-3, size 40-8 line 2903 [ 310.113275] binder: 15880:15889 ioctl 800454cf 202e8ffc returned -22 [ 310.114721] binder: 15880:15889 transaction failed 29189/-22, size 40-8 line 2788 [ 310.115929] binder: 15880:15889 ioctl ae04 0 returned -22 [ 310.116718] binder: undelivered TRANSACTION_ERROR: 29189 [ 310.127644] binder: 15880:15883 BC_INCREFS_DONE u0000000000000000 no match [ 310.127694] binder: 15880:15883 ioctl c0106426 201d4000 returned -22 2018/02/01 04:11:30 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000a8d000)={&(0x7f0000e4e000)={0x10, 0x0, 0x0, 0x0}, 0xc, &(0x7f0000fcf000-0x10)={&(0x7f00005d5000)=@updsa={0x104, 0x1a, 0x1, 0xffffffffffffffff, 0xffffffffffffffff, {{@in6=@local={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0xffffffffffffffff, 0xaa}, @in=@dev={0xac, 0x14, 0xffffffffffffffff, 0x0}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0}, {@in=@broadcast=0xffffffff, 0xffffffffffffffff, 0x2b}, @in=@multicast2=0xe0000002, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, {0x0, 0x0, 0x0, 0x0}, {0x2, 0x0, 0x0}, 0xffffffffffffffff, 0xffffffffffffffff, 0xa, 0x2, 0x0, 0x0}, [@coaddr={0x14, 0xe, @in=@remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}}]}, 0x104}, 0x1, 0x0, 0x0, 0x0}, 0x0) r0 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000ffe000)='/selinux/mls\x00', 0x0, 0x0) ioctl$sock_SIOCGIFCONF(r0, 0x8910, &(0x7f0000f82000-0x10)=@req={0x50, &(0x7f0000d15000)={@common='gre0\x00', @ifru_names=@syzn={0x73, 0x79, 0x7a, 0x0, 0x0}}}) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000ee6000)='yeah\x00', 0x5) setsockopt$l2tp_PPPOL2TP_SO_RECVSEQ(r0, 0x111, 0x2, 0x1, 0x4) 2018/02/01 04:11:30 executing program 2: openat$ion(0xffffffffffffff9c, &(0x7f0000801000-0x9)='/dev/ion\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000233000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = dup2(r0, r1) write$tun(0xffffffffffffffff, &(0x7f0000577000)=@pi={0x0, 0x0, @eth={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x0}, [], {@canfd={0xd, {{0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0, "feb442a1f43ead325d71fed774c8f6028c2a6b79a4e418aa3c5f391769659fef9f596cdade428c389e511eaad39d2ee4334dee9516a31d00510baaf06efc0980"}}}}}, 0x5a) ioctl$KVM_CREATE_PIT2(r2, 0x4040ae77, &(0x7f0000ea0000)={0x80000001, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) r3 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004ee000-0x76)='\x00', 0x1, 0x0, 0x0}], &(0x7f000000b000-0x30)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)=""}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00005da000)={0x0, 0x0, &(0x7f00000d8000)=[], 0x48, 0x0, &(0x7f000044c000-0x83)="a410778b7a640ab0384c4ead541b6ee57c5645909ef688d8ac3e5ecfc7039f5f8ba53f127b7f01947cd3689eaf6c090277915bab2a0c450988cb85688e2bcc101a80664d3081fcc0"}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000c5a000)={0x0, 0x0, 0x0, 0x0}) mmap(&(0x7f0000000000/0x13000)=nil, 0x13000, 0x0, 0x32, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000a95000-0x30)={0x14, 0x0, &(0x7f0000b8f000)=[@increfs_done={0x40106308, r4, 0x1}], 0x0, 0x0, &(0x7f00002e4000-0x70)=""}) getsockopt$inet_sctp6_SCTP_MAXSEG(r3, 0x84, 0xd, &(0x7f0000103000-0x4)=@assoc_id=0x0, &(0x7f0000461000-0x4)=0x4) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER_VALUE(r2, 0x84, 0x7c, &(0x7f0000ad2000-0x8)={r5, 0x7, 0xa5}, 0x8) 2018/02/01 04:11:30 executing program 5: r0 = socket$inet6(0xa, 0x5, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x100000d, 0x32, 0xffffffffffffffff, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f0000002000-0x51)="54f914a0d2c0692f424ebda9d0d59e51d8cfebca9650098bd2998b536de5ae4385432d1895ebc413d9889751d60264d2901cb0d1569dfac9249b61cd52e5f12a1c928c4bb573d18be7f79dfbfdff18b401", 0x51, 0x0, &(0x7f0000000000)={0xa, 0xffffffffffffffff, 0x0, @loopback={0x0, 0x1}, 0x0}, 0x1c) bind$inet6(r0, &(0x7f0000002000-0x3)={0xa, 0xffffffffffffffff, 0x0, @loopback={0x0, 0x1}, 0x0}, 0x20) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) capset(&(0x7f00001e5000-0x8)={0x20020071026, 0x0}, &(0x7f0000002000-0x18)={0x0, 0x0, 0x0, 0xffffffffffffffff, 0x5, 0x0}) sendto$inet6(r0, &(0x7f00001ff000-0x96)='d', 0x1, 0x0, &(0x7f0000f31000)={0xa, 0xffffffffffffffff, 0x0, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], [0xff, 0xff], @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}}, 0x0}, 0x1c) 2018/02/01 04:11:30 executing program 1: openat$ion(0xffffffffffffff9c, &(0x7f0000801000-0x9)='/dev/ion\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000233000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = dup2(r0, r1) write$tun(0xffffffffffffffff, &(0x7f0000577000)=@pi={0x0, 0x0, @eth={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x0}, [], {@canfd={0xd, {{0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0, "feb442a1f43ead325d71fed774c8f6028c2a6b79a4e418aa3c5f391769659fef9f596cdade428c389e511eaad39d2ee4334dee9516a31d00510baaf06efc0980"}}}}}, 0x5a) r3 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004ee000-0x76)='\x00', 0x1, 0x0, 0x0}], &(0x7f000000b000-0x30)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)=""}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00005da000)={0x0, 0x0, &(0x7f00000d8000)=[], 0x48, 0x0, &(0x7f000044c000-0x83)="a410778b7a640ab0384c4ead541b6ee57c5645909ef688d8ac3e5ecfc7039f5f8ba53f127b7f01947cd3689eaf6c090277915bab2a0c450988cb85688e2bcc101a80664d3081fcc0"}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000c5a000)={0x0, 0x0, 0x0, 0x0}) ioctl$SIOCGIFMTU(r2, 0x8921, &(0x7f0000d86000)={@common=""/16, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) mmap(&(0x7f0000000000/0x13000)=nil, 0x13000, 0x0, 0x32, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000a95000-0x30)={0x14, 0x0, &(0x7f0000b8f000)=[@increfs_done={0x40106308, r4, 0x1}], 0x0, 0x0, &(0x7f00002e4000-0x70)=""}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000436000-0x30)={0x20, 0x0, &(0x7f0000136000)=[@dead_binder_done={0x40086310, 0x3}, @increfs_done={0x40106308, r4, 0x0}], 0x0, 0x0, &(0x7f0000888000-0xb)=""}) 2018/02/01 04:11:30 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f0000590000-0x8)='./file0\x00', 0x14) write$selinux_create(r0, &(0x7f000074c000)=@access={'system_u:object_r:dpkg_exec_t:s0', 0x20, '/usr/sbin/cups-browsed', 0x20, 0x32, 0x30, 0x0}, 0x3b) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f00007cf000)='/dev/cuse\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_STATUS(r1, 0xc05c5340, &(0x7f0000b85000)={0x6, 0x100, 0x2, {0x0, 0x0}, 0x0, 0x4, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000801000-0x9)='/dev/ion\x00', 0x0, 0x0) r3 = syz_open_dev$binder(&(0x7f0000233000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r4 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0) r5 = dup2(r3, r4) write$tun(0xffffffffffffffff, &(0x7f0000577000)=@pi={0x0, 0x0, @eth={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x0}, [], {@canfd={0xd, {{0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0, "feb442a1f43ead325d71fed774c8f6028c2a6b79a4e418aa3c5f391769659fef9f596cdade428c389e511eaad39d2ee4334dee9516a31d00510baaf06efc0980"}}}}}, 0x5a) r6 = dup2(r4, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004ee000-0x76)='\x00', 0x1, 0x0, 0x0}], &(0x7f000000b000-0x30)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)=""}) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f00005da000)={0x0, 0x0, &(0x7f00000d8000)=[], 0x48, 0x0, &(0x7f000044c000-0x83)="a410778b7a640ab0384c4ead541b6ee57c5645909ef688d8ac3e5ecfc7039f5f8ba53f127b7f01947cd3689eaf6c090277915bab2a0c450988cb85688e2bcc101a80664d3081fcc0"}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000c5a000)={0x0, 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000a95000-0x30)={0x14, 0x0, &(0x7f0000b8f000)=[@increfs_done={0x40106308, r7, 0x1}], 0x0, 0x0, &(0x7f00002e4000-0x70)=""}) getsockopt$inet6_dccp_buf(r5, 0x21, 0xcf, &(0x7f0000e10000-0xcc)=""/204, &(0x7f000037d000-0x4)=0xcc) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000436000-0x30)={0x14, 0x0, &(0x7f0000136000)=[@increfs_done={0x40106308, r7, 0x0}], 0x0, 0x0, &(0x7f0000888000-0xb)=""}) close(r2) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000002000-0x38)={0x0, 0x0, &(0x7f0000003000)=[], 0x0, &(0x7f0000002000)=[{0x10, 0x10e, 0x0, ""}], 0x10, 0x0}, 0x0) 2018/02/01 04:11:30 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) connect$inet(0xffffffffffffffff, &(0x7f0000217000-0x10)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x10) listen(0xffffffffffffffff, 0xff) r0 = accept(0xffffffffffffffff, &(0x7f0000f06000)=@rc={0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0}, &(0x7f00008f4000)=0xa) r1 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000c6b000)='/selinux/avc/hash_stats\x00', 0x0, 0x0) r2 = ioctl$LOOP_CTL_GET_FREE(0xffffffffffffff9c, 0x4c82) r3 = fcntl$getown(r0, 0x9) getpgid(r3) ioctl$LOOP_CTL_REMOVE(r1, 0x4c81, r2) setsockopt$sock_int(r0, 0x1, 0x1d, &(0x7f00008dc000)=0x100000001, 0x4) socketpair$inet_icmp(0x2, 0x2, 0x1, &(0x7f00008f1000-0x8)={0x0, 0x0}) ioctl$TIOCSCTTY(r1, 0x540e, 0x3fb) ioctl$TIOCLINUX6(r1, 0x541c, &(0x7f0000c15000-0x2)={0x6, 0x1f}) ioctl$sock_netrom_SIOCGSTAMP(r0, 0x8906, &(0x7f0000ff2000-0x4)=0x0) ioctl$PPPIOCGL2TPSTATS(r4, 0x80487436, &(0x7f000025b000)="d7ae05b21ee1fe150f1b8a446da64b507de257c57b3fc36cc353691baa6850d78fedfcdf0e13f6da4aba5cda087fe12be522db66a002d81e46eeb257ca6d7a0ef12fe8a69374d429113d117d12354cf404f5c7") 2018/02/01 04:11:30 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) openat$selinux_access(0xffffffffffffff9c, &(0x7f00008eb000-0x10)='/selinux/access\x00', 0x2, 0x0) seccomp(0x1, 0x0, &(0x7f000089b000-0x10)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x407ffc0003}]}) shmctl$IPC_INFO(0x0, 0x3, &(0x7f0000564000)=""/4096) r0 = dup(0xffffffffffffff9c) ioctl$KVM_TPR_ACCESS_REPORTING(r0, 0xc028ae92, &(0x7f000028e000)={0xffffffffffffff9a, 0x13, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) ioctl$PPPOEIOCSFWD(r0, 0x4008b100, &(0x7f00007d6000-0x1e)={0x18, 0x0, {0x1, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}, @generic="a0c0801c93f7047b96edcae0a76e17a1"}}) 2018/02/01 04:11:30 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r0, &(0x7f0000022000-0x16)="01", 0x1, 0x0, &(0x7f0000031000-0x10)={0x2, 0xffffffffffffffff, @local={0xac, 0x14, 0xffffffffffffffff, 0xaa}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x10) shutdown(r0, 0x1) [ 310.127730] binder: 15880:15883 ioctl c0086423 2064dff8 returned -22 [ 310.127778] binder: 15880:15883 got reply transaction with no transaction stack [ 310.127788] binder: 15880:15883 transaction failed 29201/-71, size 0-32 line 2703 [ 310.144986] binder: undelivered TRANSACTION_ERROR: 29201 [ 310.145005] binder: undelivered TRANSACTION_ERROR: 29189 [ 310.145211] binder: undelivered TRANSACTION_COMPLETE [ 310.145219] binder: undelivered TRANSACTION_ERROR: 29189 [ 310.145223] binder: undelivered TRANSACTION_ERROR: 29201 2018/02/01 04:11:30 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f0000590000-0x8)='./file0\x00', 0x14) write$selinux_create(r0, &(0x7f000074c000)=@access={'system_u:object_r:dpkg_exec_t:s0', 0x20, '/usr/sbin/cups-browsed', 0x20, 0x32, 0x30, 0x0}, 0x3b) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f00007cf000)='/dev/cuse\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_STATUS(r1, 0xc05c5340, &(0x7f0000b85000)={0x6, 0x100, 0x2, {0x0, 0x0}, 0x0, 0x4, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000801000-0x9)='/dev/ion\x00', 0x0, 0x0) r3 = syz_open_dev$binder(&(0x7f0000233000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r4 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0) r5 = dup2(r3, r4) write$tun(0xffffffffffffffff, &(0x7f0000577000)=@pi={0x0, 0x0, @eth={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x0}, [], {@canfd={0xd, {{0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0, "feb442a1f43ead325d71fed774c8f6028c2a6b79a4e418aa3c5f391769659fef9f596cdade428c389e511eaad39d2ee4334dee9516a31d00510baaf06efc0980"}}}}}, 0x5a) r6 = dup2(r4, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004ee000-0x76)='\x00', 0x1, 0x0, 0x0}], &(0x7f000000b000-0x30)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)=""}) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f00005da000)={0x0, 0x0, &(0x7f00000d8000)=[], 0x48, 0x0, &(0x7f000044c000-0x83)="a410778b7a640ab0384c4ead541b6ee57c5645909ef688d8ac3e5ecfc7039f5f8ba53f127b7f01947cd3689eaf6c090277915bab2a0c450988cb85688e2bcc101a80664d3081fcc0"}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000c5a000)={0x0, 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000a95000-0x30)={0x14, 0x0, &(0x7f0000b8f000)=[@increfs_done={0x40106308, r7, 0x1}], 0x0, 0x0, &(0x7f00002e4000-0x70)=""}) getsockopt$inet6_dccp_buf(r5, 0x21, 0xcf, &(0x7f0000e10000-0xcc)=""/204, &(0x7f000037d000-0x4)=0xcc) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000436000-0x30)={0x0, 0x0, &(0x7f0000136000)=[], 0x0, 0x0, &(0x7f0000888000-0xb)=""}) close(r2) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000002000-0x38)={0x0, 0x0, &(0x7f0000003000)=[], 0x0, &(0x7f0000002000)=[{0x10, 0x10e, 0x0, ""}], 0x10, 0x0}, 0x0) [ 310.475613] binder: 15901:15904 ioctl 8921 20d86000 returned -22 [ 310.483687] binder: BINDER_SET_CONTEXT_MGR already set 2018/02/01 04:11:30 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r0, &(0x7f0000022000-0x16)="01", 0x1, 0x0, &(0x7f0000031000-0x10)={0x2, 0xffffffffffffffff, @local={0xac, 0x14, 0xffffffffffffffff, 0xaa}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x10) r1 = syz_open_dev$adsp(&(0x7f0000753000-0xb)='/dev/adsp#\x00', 0xffffffff, 0x10000) setsockopt$netlink_NETLINK_RX_RING(r1, 0x10e, 0x6, &(0x7f000070e000-0x10)={0x9, 0x2, 0x1, 0x3}, 0x10) shutdown(r0, 0x1) 2018/02/01 04:11:30 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$amidi(&(0x7f00005a3000+0x2c3)='/dev/amidi#\x00', 0xff, 0x40) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(r0, 0x84, 0xf, &(0x7f00001e2000)={0x0, @in6={{0xa, 0x1, 0x4, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x1}, 0xe69}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x1, 0x1000, 0x81, 0x8, 0x4}, &(0x7f0000488000)=0xa0) getsockopt$inet_sctp_SCTP_DEFAULT_SNDINFO(0xffffffffffffffff, 0x84, 0x22, &(0x7f000043b000-0x10)={0x0, 0x4, 0x200000007fff, 0x5, r1}, &(0x7f0000566000-0x4)=0xfffffeff) getsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f00000e9000)={r2, @in6={{0xa, 0x0, 0x2184, @loopback={0x0, 0x1}, 0x7}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x9, 0x6, 0x5, 0xffff, 0x40}, &(0x7f00009ec000-0x4)=0xa0) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f000067c000-0x28)={@syzn={0x73, 0x79, 0x7a, 0x0, 0x0}, &(0x7f0000a8f000-0xd)=@ethtool_gstrings={0x1b, 0x7, 0x1, 'a'}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) r3 = syz_open_dev$adsp(&(0x7f0000001000-0xb)='/dev/adsp#\x00', 0x3, 0x101802) ioctl$TUNSETVNETHDRSZ(r3, 0x400454d8, &(0x7f0000000000)=0x7) perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000)=0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) msync(&(0x7f0000952000/0x2000)=nil, 0x87abbe8d1cc6ad9, 0x4) 2018/02/01 04:11:30 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000566000)='/dev/vga_arbiter\x00', 0x101000, 0x0) r1 = fcntl$getown(r0, 0x9) ioctl$SNDRV_CTL_IOCTL_ELEM_REPLACE(r0, 0xc1105518, &(0x7f0000756000)={{0x4, 0x0, 0x100000001, 0x7, "49e562c0c161070c58b90c3de52352719465758f3088e76da4f585f7bb4861a72835fdc0b6f1800c552ff0f3", 0xffffffffffffff01}, 0x0, 0x0, 0xfffffffffffffffe, r1, 0x3, 0x4df5, "89af9d3f62ee2cc92b1d91be5da30afeef341a1cad446215968ed5f4de3e6ea4f96768ced44fcc396f4787efa922b8fac35e4a0ebb2d4115ec1bf3dea5d5142c", &(0x7f0000abc000)='\x00', 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], [0x9d, 0x0, 0x4, 0x3ff], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) getsockopt(r0, 0x80, 0x7, &(0x7f0000faa000)=""/138, &(0x7f0000f92000)=0x8a) connect$pptp(r0, &(0x7f0000160000)={0x18, 0x2, {0x2, @multicast1=0xe0000001}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x20) seccomp(0x1, 0x0, &(0x7f000089b000-0x10)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x407ffc0003}]}) shmctl$IPC_INFO(0x0, 0x3, &(0x7f000079d000-0x6da)=""/4096) 2018/02/01 04:11:30 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000216000)='/dev/hwrng\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x5, 0x0) setsockopt$inet_int(r1, 0x0, 0xf, &(0x7f0000d11000-0x4)=0xfffffffffffffff9, 0x4) getsockopt$bt_BT_VOICE(r0, 0x112, 0xb, &(0x7f000093d000+0x780)=0x3, &(0x7f000069e000-0x8)=0x2) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r1, 0x84, 0x64, &(0x7f0000d24000)=[@in6={0xa, 0x3, 0x0, @loopback={0x0, 0x1}, 0x0}, @in={0x2, 0x3, @rand_addr=0xd5, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, @in={0x2, 0x3, @multicast1=0xe0000001, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}], 0x3c) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000e64000-0x8)={0x0, 0x0}) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_REM(r1, 0x84, 0x65, &(0x7f0000f08000)=[@in6={0xa, 0x3, 0x0, @loopback={0x0, 0x1}, 0x0}, @in6={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x0}], 0x38) 2018/02/01 04:11:30 executing program 2: openat$ion(0xffffffffffffff9c, &(0x7f0000801000-0x9)='/dev/ion\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000233000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) write$tun(0xffffffffffffffff, &(0x7f0000577000)=@pi={0x0, 0x0, @eth={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x0}, [], {@canfd={0xd, {{0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0, "feb442a1f43ead325d71fed774c8f6028c2a6b79a4e418aa3c5f391769659fef9f596cdade428c389e511eaad39d2ee4334dee9516a31d00510baaf06efc0980"}}}}}, 0x5a) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004ee000-0x76)='\x00', 0x1, 0x0, 0x0}], &(0x7f000000b000-0x30)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)=""}) openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000a7f000-0x16)='/selinux/checkreqprot\x00', 0x800, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00005da000)={0x0, 0x0, &(0x7f00000d8000)=[], 0x48, 0x0, &(0x7f000044c000-0x83)="a410778b7a640ab0384c4ead541b6ee57c5645909ef688d8ac3e5ecfc7039f5f8ba53f127b7f01947cd3689eaf6c090277915bab2a0c450988cb85688e2bcc101a80664d3081fcc0"}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000c5a000)={0x0, 0x0, 0x0, 0x0}) mmap(&(0x7f0000000000/0x13000)=nil, 0x13000, 0x0, 0x32, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000a95000-0x30)={0x14, 0x0, &(0x7f0000b8f000)=[@increfs_done={0x40106308, r3, 0x1}], 0x0, 0x0, &(0x7f00002e4000-0x70)=""}) fcntl$addseals(r1, 0x409, 0x5) [ 310.483699] binder: 15902:15907 ioctl 40046207 0 returned -16 [ 310.488727] binder: 15902:15907 BC_INCREFS_DONE node 1619 has no pending increfs request 2018/02/01 04:11:30 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f0000590000-0x8)='./file0\x00', 0x14) write$selinux_create(r0, &(0x7f000074c000)=@access={'system_u:object_r:dpkg_exec_t:s0', 0x20, '/usr/sbin/cups-browsed', 0x20, 0x32, 0x30, 0x0}, 0x3b) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f00007cf000)='/dev/cuse\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_STATUS(r1, 0xc05c5340, &(0x7f0000b85000)={0x6, 0x100, 0x2, {0x0, 0x0}, 0x0, 0x4, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000801000-0x9)='/dev/ion\x00', 0x0, 0x0) r3 = syz_open_dev$binder(&(0x7f0000233000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r4 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0) r5 = dup2(r3, r4) write$tun(0xffffffffffffffff, &(0x7f0000577000)=@pi={0x0, 0x0, @eth={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x0}, [], {@canfd={0xd, {{0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0, "feb442a1f43ead325d71fed774c8f6028c2a6b79a4e418aa3c5f391769659fef9f596cdade428c389e511eaad39d2ee4334dee9516a31d00510baaf06efc0980"}}}}}, 0x5a) r6 = dup2(r4, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004ee000-0x76)='\x00', 0x1, 0x0, 0x0}], &(0x7f000000b000-0x30)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)=""}) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f00005da000)={0x0, 0x0, &(0x7f00000d8000)=[], 0x48, 0x0, &(0x7f000044c000-0x83)="a410778b7a640ab0384c4ead541b6ee57c5645909ef688d8ac3e5ecfc7039f5f8ba53f127b7f01947cd3689eaf6c090277915bab2a0c450988cb85688e2bcc101a80664d3081fcc0"}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000c5a000)={0x0, 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000a95000-0x30)={0x14, 0x0, &(0x7f0000b8f000)=[@increfs_done={0x40106308, r7, 0x1}], 0x0, 0x0, &(0x7f00002e4000-0x70)=""}) getsockopt$inet6_dccp_buf(r5, 0x21, 0xcf, &(0x7f0000e10000-0xcc)=""/204, &(0x7f000037d000-0x4)=0xcc) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000436000-0x30)={0x0, 0x0, &(0x7f0000136000)=[], 0x0, 0x0, &(0x7f0000888000-0xb)=""}) close(r2) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000002000-0x38)={0x0, 0x0, &(0x7f0000003000)=[], 0x0, &(0x7f0000002000)=[{0x10, 0x10e, 0x0, ""}], 0x10, 0x0}, 0x0) 2018/02/01 04:11:30 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) seccomp(0x1, 0x0, &(0x7f00008dd000-0xd)={0x0, &(0x7f0000000000)=[]}) shmctl$IPC_INFO(0x0, 0x3, &(0x7f0000564000)=""/4096) [ 310.499333] binder: BINDER_SET_CONTEXT_MGR already set [ 310.499343] binder: 15910:15913 ioctl 40046207 0 returned -16 [ 310.500502] binder: 15910:15913 ioctl 4040ae77 20ea0000 returned -22 [ 310.511328] binder: send failed reply for transaction 1615 to 15901:15904 [ 310.511344] binder: send failed reply for transaction 1618 to 15902:15907 [ 310.511356] binder: send failed reply for transaction 1621 to 15910:15913 [ 310.511905] binder: undelivered TRANSACTION_COMPLETE [ 310.511913] binder: undelivered TRANSACTION_ERROR: 29189 [ 310.520205] binder: 15901:15915 BC_DEAD_BINDER_DONE 0000000000000003 not found [ 310.520221] binder: 15901:15915 BC_INCREFS_DONE u00000000204edf8a node 1616 cookie mismatch 0000000000000000 != 0000000000000001 [ 310.522762] binder: 15910:15916 ioctl 4040ae77 20ea0000 returned -22 [ 310.524995] binder: 15910:15916 transaction failed 29189/-22, size 40-8 line 2788 [ 310.569302] binder: 15901:15915 transaction failed 29189/-22, size 40-8 line 2788 [ 310.571215] binder: 15901:15927 ioctl 8921 20d86000 returned -22 [ 310.571271] binder: undelivered TRANSACTION_ERROR: 29189 [ 310.571281] binder: undelivered TRANSACTION_ERROR: 29189 [ 310.573348] binder: 15901:15927 BC_INCREFS_DONE node 1616 has no pending increfs request [ 310.578988] binder: 15920:15922 transaction failed 29189/-22, size 40-8 line 2788 [ 310.597248] binder: undelivered TRANSACTION_ERROR: 29189 [ 310.610386] binder: send failed reply for transaction 1631 to 15930:15934 [ 310.645110] binder: 15930:15934 transaction failed 29189/-22, size 40-8 line 2788 [ 310.649110] binder: 15930:15934 BC_INCREFS_DONE u0000000000000000 no match [ 310.654596] binder_alloc: 15938: binder_alloc_buf, no vma [ 310.654622] binder: 15938:15940 transaction failed 29189/-3, size 40-8 line 2903 [ 310.669163] binder: undelivered TRANSACTION_COMPLETE [ 310.669173] binder: undelivered TRANSACTION_ERROR: 29189 [ 310.681544] binder: undelivered TRANSACTION_ERROR: 29189 2018/02/01 04:11:30 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f00005b3000)='/dev/sequencer\x00', 0x40200, 0x0) ioctl$TCGETA(r0, 0x5405, &(0x7f0000679000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000a8d000)={&(0x7f0000e4e000)={0x10, 0x0, 0x0, 0x0}, 0xc, &(0x7f0000fcf000-0x10)={&(0x7f00005d5000)=@updsa={0x104, 0x1a, 0x1, 0xffffffffffffffff, 0xffffffffffffffff, {{@in6=@local={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0xffffffffffffffff, 0xaa}, @in=@dev={0xac, 0x14, 0xffffffffffffffff, 0x0}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0}, {@in=@broadcast=0xffffffff, 0xffffffffffffffff, 0x2b}, @in=@multicast2=0xe0000002, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, {0x0, 0x0, 0x0, 0x0}, {0x0, 0x0, 0x0}, 0xffffffffffffffff, 0xffffffffffffffff, 0xa, 0x2, 0x0, 0x0}, [@coaddr={0x14, 0xe, @in=@remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}}]}, 0x104}, 0x1, 0x0, 0x0, 0x0}, 0x0) 2018/02/01 04:11:30 executing program 5: prctl$intptr(0x27, 0x2) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = accept(0xffffffffffffffff, &(0x7f0000000000)=@in={0x0, 0xffffffffffffffff, @multicast2=0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, &(0x7f0000000000)=0x10) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$sock_netrom_TIOCOUTQ(r0, 0x5411, &(0x7f0000000000)=0x0) 2018/02/01 04:11:30 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000233000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000929000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) write$tun(0xffffffffffffffff, &(0x7f0000577000)=@pi={0x0, 0x0, @eth={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x0}, [], {@canfd={0xd, {{0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0, "feb442a1f43ead325d71fed774c8f6028c2a6b79a4e418aa3c5f391769659fef9f596cdade428c389e511eaad39d2ee4334dee9516a31d00510baaf06efc0980"}}}}}, 0x5a) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004ee000-0x76)='\x00', 0x1, 0x0, 0x0}], &(0x7f000000b000-0x30)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)=""}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00005da000)={0x0, 0x0, &(0x7f00000d8000)=[], 0x48, 0x0, &(0x7f000044c000-0x83)="a410778b7a640ab0384c4ead541b6ee57c5645909ef688d8ac3e5ecfc7039f5f8ba53f127b7f01947cd3689eaf6c090277915bab2a0c450988cb85688e2bcc101a80664d3081fcc0"}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000c5a000)={0x0, 0x0, 0x0, 0x0}) mmap(&(0x7f0000000000/0x13000)=nil, 0x13000, 0x0, 0x32, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000a95000-0x30)={0x14, 0x0, &(0x7f0000b8f000)=[@increfs_done={0x40106308, r3, 0x1}], 0x0, 0x0, &(0x7f00002e4000-0x70)=""}) setsockopt$inet_sctp_SCTP_RECVRCVINFO(r2, 0x84, 0x20, &(0x7f00000f7000)=0x8, 0x4) 2018/02/01 04:11:30 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f0000590000-0x8)='./file0\x00', 0x14) write$selinux_create(r0, &(0x7f000074c000)=@access={'system_u:object_r:dpkg_exec_t:s0', 0x20, '/usr/sbin/cups-browsed', 0x20, 0x32, 0x30, 0x0}, 0x3b) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f00007cf000)='/dev/cuse\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_STATUS(r1, 0xc05c5340, &(0x7f0000b85000)={0x6, 0x100, 0x2, {0x0, 0x0}, 0x0, 0x4, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000801000-0x9)='/dev/ion\x00', 0x0, 0x0) r3 = syz_open_dev$binder(&(0x7f0000233000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r4 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0) r5 = dup2(r3, r4) write$tun(0xffffffffffffffff, &(0x7f0000577000)=@pi={0x0, 0x0, @eth={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x0}, [], {@canfd={0xd, {{0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0, "feb442a1f43ead325d71fed774c8f6028c2a6b79a4e418aa3c5f391769659fef9f596cdade428c389e511eaad39d2ee4334dee9516a31d00510baaf06efc0980"}}}}}, 0x5a) r6 = dup2(r4, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004ee000-0x76)='\x00', 0x1, 0x0, 0x0}], &(0x7f000000b000-0x30)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)=""}) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f00005da000)={0x0, 0x0, &(0x7f00000d8000)=[], 0x48, 0x0, &(0x7f000044c000-0x83)="a410778b7a640ab0384c4ead541b6ee57c5645909ef688d8ac3e5ecfc7039f5f8ba53f127b7f01947cd3689eaf6c090277915bab2a0c450988cb85688e2bcc101a80664d3081fcc0"}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000c5a000)={0x0, 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000a95000-0x30)={0x14, 0x0, &(0x7f0000b8f000)=[@increfs_done={0x40106308, r7, 0x1}], 0x0, 0x0, &(0x7f00002e4000-0x70)=""}) getsockopt$inet6_dccp_buf(r5, 0x21, 0xcf, &(0x7f0000e10000-0xcc)=""/204, &(0x7f000037d000-0x4)=0xcc) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000436000-0x30)={0x0, 0x0, &(0x7f0000136000)=[], 0x0, 0x0, &(0x7f0000888000-0xb)=""}) close(r2) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000002000-0x38)={0x0, 0x0, &(0x7f0000003000)=[], 0x0, &(0x7f0000002000)=[{0x10, 0x10e, 0x0, ""}], 0x10, 0x0}, 0x0) 2018/02/01 04:11:30 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r0, &(0x7f0000022000-0x16)="01", 0x1, 0x0, &(0x7f0000031000-0x10)={0x2, 0xffffffffffffffff, @local={0xac, 0x14, 0xffffffffffffffff, 0xaa}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x10) r1 = syz_open_dev$evdev(&(0x7f0000137000-0x12)='/dev/input/event#\x00', 0x7ff, 0x400) ioctl$EVIOCGNAME(r1, 0x80404506, &(0x7f000093b000-0xfa)=""/250) shutdown(r0, 0x1) 2018/02/01 04:11:30 executing program 4: mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000001000-0xb)='/dev/hwrng\x00', 0x101800, 0x0) ioctl$KVM_ASSIGN_PCI_DEVICE(r0, 0x8040ae69, &(0x7f0000128000)={0x2, 0x6, 0x8, 0x4, 0x4}) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) seccomp(0x1, 0x0, &(0x7f000089b000-0x10)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x407ffc0003}]}) shmctl$IPC_INFO(0x0, 0x3, &(0x7f0000564000)=""/4096) 2018/02/01 04:11:30 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$amidi(&(0x7f00005a3000+0x2c3)='/dev/amidi#\x00', 0xff, 0x40) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(r0, 0x84, 0xf, &(0x7f00001e2000)={0x0, @in6={{0xa, 0x1, 0x4, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x1}, 0xe69}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x1, 0x1000, 0x81, 0x8, 0x4}, &(0x7f0000488000)=0xa0) getsockopt$inet_sctp_SCTP_DEFAULT_SNDINFO(0xffffffffffffffff, 0x84, 0x22, &(0x7f000043b000-0x10)={0x0, 0x4, 0x200000007fff, 0x5, r1}, &(0x7f0000566000-0x4)=0xfffffeff) getsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f00000e9000)={r2, @in6={{0xa, 0x0, 0x2184, @loopback={0x0, 0x1}, 0x7}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x9, 0x6, 0x5, 0xffff, 0x40}, &(0x7f00009ec000-0x4)=0xa0) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f000067c000-0x28)={@syzn={0x73, 0x79, 0x7a, 0x0, 0x0}, &(0x7f0000a8f000-0xd)=@ethtool_gstrings={0x1b, 0x7, 0x1, 'a'}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) r3 = syz_open_dev$adsp(&(0x7f0000001000-0xb)='/dev/adsp#\x00', 0x3, 0x101802) ioctl$TUNSETVNETHDRSZ(r3, 0x400454d8, &(0x7f0000000000)=0x7) perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000)=0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) msync(&(0x7f0000952000/0x2000)=nil, 0x87abbe8d1cc6ad9, 0x4) 2018/02/01 04:11:30 executing program 1: openat$ion(0xffffffffffffff9c, &(0x7f0000801000-0x9)='/dev/ion\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00008be000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x2000000000) r1 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = dup2(r0, r1) write$tun(0xffffffffffffffff, &(0x7f0000577000)=@pi={0x0, 0x0, @eth={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x0}, [], {@canfd={0xd, {{0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0, "feb442a1f43ead325d71fed774c8f6028c2a6b79a4e418aa3c5f391769659fef9f596cdade428c389e511eaad39d2ee4334dee9516a31d00510baaf06efc0980"}}}}}, 0x5a) r3 = dup2(r0, r2) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004ee000-0x76)='\x00', 0x1, 0x0, 0x0}], &(0x7f000000b000-0x30)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)=""}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00005da000)={0x0, 0x0, &(0x7f00000d8000)=[], 0x48, 0x0, &(0x7f000044c000-0x83)="a410778b7a640ab0384c4ead541b6ee57c5645909ef688d8ac3e5ecfc7039f5f8ba53f127b7f01947cd3689eaf6c090277915bab2a0c450988cb85688e2bcc101a80664d3081fcc0"}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000c5a000)={0x0, 0x0, 0x0, 0x0}) mmap(&(0x7f0000000000/0x13000)=nil, 0x13000, 0x0, 0x32, 0xffffffffffffffff, 0x0) bind$netrom(r2, &(0x7f0000b4c000)=@ax25={0x3, {"c9e378405d51f3"}, 0x1}, 0x10) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000a95000-0x30)={0x14, 0x0, &(0x7f0000b8f000)=[@increfs_done={0x40106308, r4, 0x1}], 0x0, 0x0, &(0x7f00002e4000-0x70)=""}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000436000-0x30)={0x20, 0x0, &(0x7f0000136000)=[@dead_binder_done={0x40086310, 0x3}, @increfs_done={0x40106308, r4, 0x0}], 0x0, 0x0, &(0x7f0000888000-0xb)=""}) [ 310.865416] binder: undelivered TRANSACTION_COMPLETE [ 310.870679] binder: undelivered TRANSACTION_ERROR: 29189 [ 310.876852] binder: undelivered TRANSACTION_ERROR: 29189 2018/02/01 04:11:30 executing program 5: mmap(&(0x7f0000000000/0xeed000)=nil, 0xeed000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6_sctp(0xa, 0x1, 0x84) mmap(&(0x7f0000eed000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) getsockopt$inet_sctp_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f0000665000-0x8)={0x0, 0x0, 0x7}, &(0x7f0000eed000)=0x8) mmap(&(0x7f0000eed000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r0, 0x84, 0x7c, &(0x7f0000eed000)={r1, 0x0, 0x4c0a}, 0x8) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(r0, 0x84, 0x1a, &(0x7f0000ee7000)={0x0, 0x0, ""}, &(0x7f0000ee8000-0x4)=0x8) 2018/02/01 04:11:30 executing program 4: mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) syz_open_dev$midi(&(0x7f0000001000-0xb)='/dev/midi#\x00', 0x7fffffff, 0x200) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) openat$ashmem(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ashmem\x00', 0x20002, 0x0) ioctl$KVM_CREATE_DEVICE(0xffffffffffffffff, 0xc00caee0, &(0x7f000064e000)={0x3, 0xffffffffffffff9c, 0x1}) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$adsp(&(0x7f0000000000)='/dev/adsp#\x00', 0x5, 0x4400) r1 = dup(r0) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$DRM_IOCTL_MODESET_CTL(r1, 0x40086408, &(0x7f0000001000-0x8)={0x6, 0xb072}) socket$nl_generic(0x10, 0x3, 0x10) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) seccomp(0x0, 0xfffffffffffffffc, &(0x7f0000853000-0x10)={0x2000000000000280, &(0x7f00009de000)=[]}) r2 = semget$private(0x0, 0x3, 0x40) semctl$IPC_STAT(r2, 0x0, 0x2, &(0x7f00006b2000-0x6b)=""/107) shmctl$IPC_INFO(0x0, 0x3, &(0x7f0000611000-0x1000)=""/4096) 2018/02/01 04:11:30 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r0, &(0x7f0000022000-0x16)="01", 0x1, 0x0, &(0x7f0000031000-0x10)={0x2, 0xffffffffffffffff, @local={0xac, 0x14, 0xffffffffffffffff, 0xaa}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x10) r1 = syz_open_dev$dmmidi(&(0x7f0000451000)='/dev/dmmidi#\x00', 0x1ff, 0x2000) setsockopt$l2tp_PPPOL2TP_SO_LNSMODE(r1, 0x111, 0x4, 0x0, 0x4) shutdown(r0, 0x1) setsockopt$inet6_MCAST_LEAVE_GROUP(r1, 0x29, 0x2d, &(0x7f0000b10000-0x88)={0x1, {{0xa, 0x1, 0x3f, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x3}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}}, 0x88) setsockopt$l2tp_PPPOL2TP_SO_SENDSEQ(r1, 0x111, 0x3, 0x1, 0x4) [ 310.925237] binder: BINDER_SET_CONTEXT_MGR already set [ 310.936215] binder: 15947:15950 ioctl 40046207 0 returned -16 [ 310.946339] binder: BINDER_SET_CONTEXT_MGR already set 2018/02/01 04:11:30 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x800000000003, 0x0, &(0x7f00000f3000)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$sock_int(r1, 0x1, 0x7, &(0x7f0000387000)=0x0, 0x4) sendmmsg$unix(r1, &(0x7f00000bd000)=[], 0x80, 0x0) recvfrom$unix(r1, &(0x7f0000063000)=""/7, 0x7, 0x0, &(0x7f0000a59000-0x8)=@abs={0x0, 0x0, 0xffffffffffffffff}, 0x8) close(r0) 2018/02/01 04:11:30 executing program 2: openat$ion(0xffffffffffffff9c, &(0x7f0000801000-0x9)='/dev/ion\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000233000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = dup2(r0, r1) write$tun(0xffffffffffffffff, &(0x7f0000577000)=@pi={0x0, 0x0, @eth={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x0}, [], {@canfd={0xd, {{0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0, "feb442a1f43ead325d71fed774c8f6028c2a6b79a4e418aa3c5f391769659fef9f596cdade428c389e511eaad39d2ee4334dee9516a31d00510baaf06efc0980"}}}}}, 0x5a) r3 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004ee000-0x76)='\x00', 0x1, 0x0, 0x0}], &(0x7f000000b000-0x30)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)=""}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00005da000)={0x0, 0x0, &(0x7f00000d8000)=[], 0x48, 0x0, &(0x7f000044c000-0x83)="a410778b7a640ab0384c4ead541b6ee57c5645909ef688d8ac3e5ecfc7039f5f8ba53f127b7f01947cd3689eaf6c090277915bab2a0c450988cb85688e2bcc101a80664d3081fcc0"}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000c5a000)={0x0, 0x0, 0x0, 0x0}) getsockopt$inet_sctp_SCTP_INITMSG(r2, 0x84, 0x2, &(0x7f0000cc5000)={0x0, 0x0, 0x0, 0x0}, &(0x7f0000794000-0x4)=0x8) mmap(&(0x7f0000000000/0x13000)=nil, 0x13000, 0x0, 0x32, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000a95000-0x30)={0x14, 0x0, &(0x7f0000b8f000)=[@increfs_done={0x40106308, r4, 0x1}], 0x0, 0x0, &(0x7f00002e4000-0x70)=""}) 2018/02/01 04:11:30 executing program 1: openat$ion(0xffffffffffffff9c, &(0x7f0000801000-0x9)='/dev/ion\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000233000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) write$tun(0xffffffffffffffff, &(0x7f0000577000)=@pi={0x0, 0x0, @eth={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x0}, [], {@canfd={0xd, {{0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0, "feb442a1f43ead325d71fed774c8f6028c2a6b79a4e418aa3c5f391769659fef9f596cdade428c389e511eaad39d2ee4334dee9516a31d00510baaf06efc0980"}}}}}, 0x5a) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004ee000-0x76)='\x00', 0x1, 0x0, 0x0}], &(0x7f000000b000-0x30)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)=""}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00005da000)={0x0, 0x0, &(0x7f00000d8000)=[], 0x48, 0x0, &(0x7f000044c000-0x83)="a410778b7a640ab0384c4ead541b6ee57c5645909ef688d8ac3e5ecfc7039f5f8ba53f127b7f01947cd3689eaf6c090277915bab2a0c450988cb85688e2bcc101a80664d3081fcc0"}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000c5a000)={0x0, 0x0, 0x0, 0x0}) mmap(&(0x7f0000000000/0x13000)=nil, 0x13000, 0x0, 0x32, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000a95000-0x30)={0x14, 0x0, &(0x7f0000b8f000)=[@increfs_done={0x40106308, r3, 0x1}], 0x0, 0x0, &(0x7f00002e4000-0x70)=""}) connect$bt_l2cap(r2, &(0x7f00008d7000)={0x1f, 0x3, {0xa6, 0x40, 0x76, 0x200, 0x7, 0xfc}, 0x3, 0x101}, 0xe) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000436000-0x30)={0x20, 0x0, &(0x7f0000136000)=[@dead_binder_done={0x40086310, 0x3}, @increfs_done={0x40106308, r3, 0x0}], 0x0, 0x0, &(0x7f0000888000-0xb)=""}) 2018/02/01 04:11:30 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = accept$llc(0xffffffffffffffff, &(0x7f0000d72000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @local={[0x0, 0x0, 0x0, 0x0], 0xffffffffffffffff, 0x0}, [0x0, 0x0]}, &(0x7f000027f000+0x936)=0x10) r1 = fcntl$dupfd(r0, 0x0, r0) setsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX_OLD(r1, 0x84, 0x6b, &(0x7f0000a77000)=[@in={0x2, 0x2, @dev={0xac, 0x14, 0x0, 0x17}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, @in6={0xa, 0x1, 0x1, @loopback={0x0, 0x1}, 0x295776f4}, @in={0x2, 0x3, @broadcast=0xffffffff, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}], 0x3c) bind$llc(r0, &(0x7f0000f0f000)={0x1a, 0xff, 0x5, 0xffffffffffff7fff, 0x6, 0x5, @empty=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0], [0x0, 0x0]}, 0x10) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00003fe000+0xdcf)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f00000bc000)=@abs={0x0, 0x0, 0xffffffffffffffff}, 0x5) socketpair(0xa, 0x6, 0x10, &(0x7f0000adb000-0x8)={0x0, 0x0}) getsockopt$inet6_int(r4, 0x29, 0x3, &(0x7f0000c96000)=0x0, &(0x7f0000aa6000)=0x4) sendmmsg$unix(r3, &(0x7f000016e000-0xa8)=[{&(0x7f00003e7000)=@file={0x0, './file0\x00'}, 0x0, &(0x7f0000bf0000)=[{&(0x7f0000a5d000)="7ab217cb43d9a2cac5485b7b388c9c9ab9b7c6a188f6b89d80e5316a740af5a63cbbe082290a060d79dede685116a0b909e42b3211f35093be9a735923da4be97ea86fa93c3239d1703e3d3d37a90f22ea422dc5ea839e9db907e188fe032a5d4f762b4afe80fe27d3fa572253463fbe52e6b741ffc01141327a7996fbaccb8a908cc39406a8e78efaf994acec355a0d02c9b6d6a8a9b7382a5f77146d60b8f102986c4dc53b0c774ed7c24c3c6625e8a05c85df4bea1bef51ed72d90ec6f6bd88d93cd112156662ae3bc7bf3a5e3ee7c5c314d240bf3318d5bcfe5332cb082de7", 0x0}, {&(0x7f0000909000)="a9289d58d0331d9770d99bca5b603ff7338661de49729225a38fcc5d6f004d9b927231b73547f283cf9706d4c0490486bd432190815f40b9ffdaa9551f36809a577c6d18944b49d1f08328214be853205630ed9d764268f2c270fe224cab556d8ab68be0b6de47dfc9282ed6372e3418f69b9e4c559cc02aea8efc701f9e288b10697fc0e1ad08dbf64d13943d89017e83aecfaab1e054814720c1ce41b5e1ce394d5a8ea4c52bb06714d217db379bee08bce754b7d1bbf98032878fc807308bd7c62318b2f29115b7b67388cff7cf16476df40ad1dab3bc7ded923ba0c906277bfa407fa29328ebb7ad6b1e2eb498ca097a6e9bd91cbfc3a0d3cc39a56c05f1ca0499fd101b7ac4109b52ebfba08e4d3cfd73a6834283da9d2fa0b7b239138b23af902db6cf872c1c00a158e86bc19c6e0205f47af807069e32572764d9a01803b6c6f01aa727038eaabffadbe52fa88fdc2d1f1c99c48f2b07fbcc8529dca7735104ccf7a6db2adffa8355262e1d2984894a220de3ebfbc143db45a27b08d6e2bce3fac78e285cc4a446c211a895e028904eb12a56b8fe813309f3166794088bfd8cae1302f7f53a5105ec0153a93261f8e7cde8c79f769ae6bc41c11869d4bf78fb2491ef7bcb1b6b75b554b38acf2891ce04a1b1f6bb72062d9fd3cd77cd3d1a674b2c2520f27bd0d44a7ca08a1868ae74b9169e40f475473a2eb2355d7f5904740247c6521ad1a29c830f4e16bc29f56310127d7c32b61233be38c1dc9bc48ad435f3c0a9a9c33d8b2597fe232f7b749c0207c4957deaa5dade2afa8027ff1c3eccb3b55645ed63f56bf9a598d430d973c5444c723030766fe37c6de3d8d12c34fe5339303568c6d2572dc4210f2ed5304d3e8acb9dbaac58f35674cab09bb640806aff67bb92c7189b8ea601c619034c645a074827366df966f99242ec5d96a9e3fc7427a882a95454dc6a88ea38789b03f17cf4ba663974529856c033e8ecd89dac2fa7699fc8bdf46ff530606f5ec451c1511a665a18db94537d3f9b38a852b0b1aa8cec09859a6b29d54bfb7b0dc5182c80a668123c9e15ff5d6ec465c33d197e424fa809475f16664d23663c40582cd403bfd24d5931658a40d9ed834c0e1602a39233e9299b03b507d72308b994a50fa67d279755782cef9e259f29bbf43f9630af4d2b55c30893c2c58aa26db717e97379f718b99d9bd8fe9663d8c9d783e1be1182cc82616b840bbb1fd644d3b841d714ce64087e8590404f45bebe02e61cc5b7e89e5b04405e171138b2a0aabb78710605edeaee7c742fbf057ce0f4670c820ad6d2f668d54b283bd1c88bb6c67cc10353b07d76d97eb811fb3b3d4593a9eca6d4b4e98f9b80b68044bd320fe581972b68ac7a0d5f6f78cc121c52598cdfe9aede0aa0dbed3ce85e672c87597d076aa80e201279b1d3bdddd7f808bcd91b2375e1b918299f68a98fd0bc4d9125e01eb9ea8ec688202ed021e3de3865ea1c50cedb3ec20e86181510027f5150afc7f85f053a17c96fd02cd5153e7005c0ca3098f8f76ba0f5cd79b68e4e9e750bddd62425946584753ef0421e8e1670ffdd3b8e4a9ab43cade9eebbbf583cdae9005ef1c795ff41992c60a680aaaa79c678ea80d70bf02e1583b46fcbba5bc109abb243a18d79392e3ade3f1055f06d5e71cfb6f369e356e8220d03efdef0a639b47fb23b4d41dae4432f010cfdfd890900adf66c1982d5a39da0c840d06b8b841d748a61800cdde60f4b671bfafeb279e5e852bd2fc4169c06713ee61668b7b3942711e54c0407d5807fd5bbfed56a56f22f122ab77566561b5ba71650930bad5510dedb1a2e6ac2f629dd78bc95eb3d54888758b24cbaf8165e309141a389263c36b628f41957610457b048aad102025953e5688bd582f2441c275122038931417198ab3595819f523b3e1c518bb7f34d2d7e2d6cf47beac361567f5ee74244029d0edba3cc1ac7eec2dc3e0b6652dd8c9391dbf13103f6a10484ae393f4f896cf511182d841d1db3a8539886af9a57395aff6ef75182ccf1ff69e27d0c0856d1eac6cead067e2ee7b870dcb9b67387f7c5017fbeaeac5ff0fe4fd750d0b5cbe0147b5b74980765e4ede586ffd352a84ad45d28bc854c3bfe208419bca5b92bebebee40a81e418bcbc576bbc70bd0c3369ffee3dbb4da52febb509e46b49be717f582c2a82e4ee50e2d57e3549526b499fce492c5aac9ea79766e9aabcc7a6cd47ff034d2c0ab2970e3704ce49a2f6810ea14c1c9d007944a62bfddd0034e096c0261067a058755af21f32059dedca455b65252c35f34e949e20bfb6ae2b0981206170df3f515a9bae54535b7c4d25e94d1794c9eb25333ddfec55b905b1619d6ec98ccf2baa0d322771ac21f3e001ab905ee0983cd79ea976a36a136fcba782d5e8094d47bc6c0bd341ef7f8ed0ce6925f346183e9b4671ca377c918939f73e6e98d977fff48d9c0967ef982ca972eb661eb874ba3ad8a1953b8a0e2c0dcfd5a8d75eba2f6b3871a3d31d90a29032afaa1de5823fe076398cfb555ab6d448442e9da4b25b6991d8100c74d9bd0be9c950d629c457dd2ec85d66e284fdf1a4429235d649fa290d936e09169985d455f55273d20f9e85cb29aaec987b59b4ec49022d060c6d0a587131f1ebeb23b5940387e2c197be15ba3b1573844b4658c32b533926d812d222a13265bc890552005209a5eca59adee2b08ea7686d840ea0e954bfa6e66f513578b8e476f2c925d706dbc5424a274ade4ef4ac83cc6a870418b52b0249e046dcc26d587882dedef07a5ac8bed884f658a2214b37ddf3b320f84a03bd82d9eb1a22af8e283306b702b0678c47fc982f5e9de4445b739d1530323c879190c69c061336dec3f4f7c1716585afc6c3c24c3a587831faee51380d515c1708c5fa22cee1c09ab6e0b1ef53c49446899fad215891bd0d8171e519c9fb01068d6344de2b6da6b5d6dfba1876418874c1ae9ecde8ef9baf94e0e5289314b4367e53f3a73277711699192855e84638f06ab15a023a44363be64734e227136bb41d447cac66ad0083a8cd9db19262e99c658174a189ba181c106940ac1f58410cf318a05d65f0e78375a2108a9fbf9a90cc33f6d8a5eb94a6b17737b9cc972cfc2cf2929ca5c06e36b211ba34dc5f8dda47483d3eeb6af31d1f16bdd85020dbdb97fe39df9206f67496a41b19ac7e0feecd98a80d18ea1ef5472df468547189f44b73969551861f80664f639ec0d0912d1fde6865358cb6a0f223b09f54575d8eed0e803e580d9a57b189cf2f912354923f4751309499294d3c401aa91dc26d6dce79842abd5209aca5ae1b57f52009c98b479e1d8fc09930b402dd89ee1f18e72ee109d73f8cb2b930477127d84d22a9b8be4469e0cf72c6615ffd709a16d3edb2b62afbda5a40ab15a3431eab77f985787521ab64b413f30896bf41f434a8cfe65faa7244e7b33eb5964da6a161cc231c819e6b7710ed800ecf56fcc3a1dc90ad294e4f59d7ed7091e52cdbcd4489ee83db085cc7bb33e271f87a8d5cef98b4b25a2a5fe01dc0afa61468be2a59d6c87122dd1c9010be6ee22ab2bbf2f12da6c52cf9ed75c1ce85f81053cb7f2036cc4e62ce74e45632935cc0d667b775fba3670015452792e52f23c102b119bf100c5771f4e8d07958d235a54cf017eb27022509227b634417417033072d69854eb55a5698e2c8a196552032b35b9a31b7ab5a41d3a430b69f6d25abd44eff63cedfaae13d342fb7cebd97918f8e7924643b6fa2d1035ba16a29b7233f41452e6d5d7d5fd7739d9757c22d0abd1d09bc8e86f8bd435d091b69eac2c2af25837ca96a6e851d8351d097581f9aced0bb65a84a870038d0e2f827869937154f430c923752072b88939013c3c7c6d753ef38f8a73300877ef9d84eeca01fba0ce049cbfe36270bb409f839d108e6c088067b66c9d11180430d87a42400f2a5427b9d91e9eabc059fc91a78800d2fca10629c1c53cee0ff6435428024b51705a2c7355042eb943ef0a02abff435e1a962e1f58aa80a815196efd6edff7640cef96e17c9f4aacd163b5572496e6f64ab5b9ee3898a28f0fbfa78d8220ca483d1742c2b5ed779c2b71920e7578190e64b28964cf2bbee3b1f8541ca0f704766b120a1ddc69372c0e3759c74ee9679c1dc5d03a29c2bd7017a94d597340d604862b23d137609ce96dac31da24c2dfd904c9d44ac63c85b785c5d101489d7af90c2972dee0f5108cb7a29a055ce88d686a7af6626fa54ed7cf305d2d43b39671ad572cbd8be712c54abfc330dcb57736f51ae418909a25dd099409bcd26ff77469d71e9d2ae834b7f8d0753fb07a2f367ff78f4482e3f13390b6f77a69b0a6529fb9764fc8aa03ed73dc72f79250eed2f9455d26fea02ad05f42f1e70ca5608ae9fd3ccb8be0bdad7adf1a7ae35d01a390cb1ea8bce9f1194ba9c0d23f8317ec3301a8bc5bfc7fce765d040ab6b7edd7afb88fa27deb5d79f07debc16168b42939754d7a6595a2dd313fffeaa9c35259456d90bd8efebac953c46b9b3c66ed980ff45e24257f6826ff443367bfc544023940cf3f4bed05ba24b1b89ad0f61d9c1ef3c01137c1eb998bc8c04ded221692f1f4bbb82196f03d9ded5db0a8f75bc05d7ecddc37477a4c4f0809d3a9668342427ef3f5a5fb73e6fa1a507acf88e1a2294d52afaf378277b63fb213315469a362748d7822d359374406fff7b71a0da08b73285867f70463eb19eff9b7a62c13c7deac06da3cdb0b646379f6e65d51e973c74af9e6e1029a8ba0e275851c34cd926a64f33728f1d5b1abb794bd246c2cf8b784f8c75b95b273473a675a3f56138d392b6a8297ea8fc4bab12dd901095d32dc2ce4a7aba5a169fb8096c0a4c6cec06794a625e53db8f69f3c6ec9a1285e48db4e0d5cd8aa8b2d091b9031225c374dc8e296bdc70f77e5a6d1b588890e821a7c03842cc38a302cb6bf2d13e904814ea758903cf5a49d91dfe56145f29982a4fc11972159c2fe75f7b4ac9a109478852eb9f79ef5b892f59d617d13806a0a6d664f2b5542e5e1932cf5743cae61e56cfe9718eb35ee073c8740fbb0ab4d75cdd4536d6e325f11dadf0c5ce04482781b82d597fdb6cfd394494733ac4d17da6bf49c38edec0125ca279355ab5e93470357e0db930bbf0c2f955db4e47d919da4b0088fdb6ce0e9a526ea680fec5bec2487fb07dbb88e25686ac2a4180192f6cd0489f41585845e6b37b2447ec7d402a38f022a84d17c05e35ae28c3c212fb0cbfc322086e293b897111a20ccca44b82a67840bf64ef2f634eddc5b13480f8f39f6853e933d9586d4eab0876d7561be3aa91f80708a3c7bae17782096c7133ef79c22bd25ded3d5dc91ca8e25984bdeef35ba9f95dc2316c3e192f11287a8a36ce353de76061bb7d6280420435882a44a3da59b195bfd09924bc6c56b594a7fd92d0fcfd9d7ce79d0fcd52d1ec63d3f69888c75045f70fcfe378fb4533b05e0f7e85e0ddf78031edb9d1cf099308f59585ee9423461d2fc401aa163dd8d00bd9456068f121582754be2a98e094d21f31231292a6235a425f0a51ea1821d8ce65f4ce063ffe01b7a3f58637a4a44145ad47a0a6330f091e9c1e42e98a2cfb147c9ee89e80c876c08a6c5d068a970eec11b30ef6a4978b844634fa6d74438f63c6faf5f4b668b00663e6f55379b695c9dc9656007d67dcc5a418618898976d3949a668ec62b162ba6762ead38c55c96d3a58c4248a26297ca75190093304df794b3", 0x0}, {&(0x7f00007cb000)="40675020de71c4136fbff66c4f7a11a5867e015da7de8caa52da9d214dc1d25fa38c29c05178d9af70db992731bd4bc57d745f59b55d1b20b749e23b7b20aecfc75ee6f3b3e329c5e7b48a0eb0e0fd02970af8bb3d1b3071043afdc0a7893f8419426628358fde123f726dbb2c6ef2c4011dbffd8bdd5939", 0x0}, {&(0x7f000051c000-0x9f)="985dc2467e04fd01ffe60596a76835e4de1aceb3afc3868b10c7621f7f4e71b2f84f32155c115539daf73616b59eaac91cf4cc939b9e037ab4e53a0e927223c0cbd629625e6b4eb7b5c39f241bc46bb63b03f5b169d001146d382d5f29a15359758d5bdb3791f3ca96515d7977239d911397a81c0f0059bbea59f40d62cfd8adc92b351b2fdb8f39cc5d740521fb3e4938656b379c3efc3a850d23fef9ecf1", 0x0}, {&(0x7f00006b7000)="ec0e2f4c020b10144741ce325c9b1f3a4038720fa1c2aed2354aefe22a995351f1234483b36b963818f51bb68af2de21c786a4f5b16d8b206e618f57041e4ee121c05e5e88f3a9853a6543a39b8222d4b1ef", 0x0}, {&(0x7f0000148000-0xbf)="4c9acafc48ca937beebcd2b9fc2077962c7754dba4f8cebe44b594b2553bebe58d90c743c4561ded8f4de077254057bc77de38b3e759222e5677b3b91667f7f3ab0ba53adc327742de7d47918402062e21c49b4d22007a4e52038aef3ad350868467a4cfb51b1f6ff0c2347b5fb14c8834a4acb689661f449d1cbf8c6c6602a54365ad869e9a04b0c2d5d1c1645b48b62893bf42f641e37a7e7e81667e0554b175d15b8ab0c466d1750b9333d5ef6ac0c85e4df9638b1a954dd80598b9c3d6", 0x0}, {&(0x7f00002b7000)="", 0x0}, {&(0x7f0000a00000-0xee)="70386b3896545f78929145c163c86bf2b774d0aaff51765a0c93f7f243fe00394bb8647063f770e97234dd8220ab89004d09b06291cbd2fc38a24727abe2262ac9ab6a12f6e67e5715c2c63ef3d5a31aeed9b3695ad1a89803aa6b56b4b2f798bd773def76f43e71c4465b6116a8cd6910e82a7b557c1f687737009c88578c0691cb56da65aed87a98fede503640695ba0cbdac5f5f6876334abe446f853500589d53f69f7efba4c82e984cfcf33774e4542c1d1cbd6a556a506bb7b7b56f2559a83a27db744ed2fc97b6b2d9f4ec65085a79e69da284b538b1920a342e5cc36372a1e296f76e187968da575d0a2", 0x0}], 0x0, 0x0, 0x0, 0x91}, {&(0x7f000093c000)=@abs={0x1, 0x0, 0x3}, 0x0, &(0x7f0000beb000)=[{&(0x7f0000dba000-0x24)="d8ca2c789a662c0c42bdc760f13f57a5be15e9d6ccfb90c09372ff2e8e81fa3bbe59db63", 0x0}, {&(0x7f0000c5e000-0xc1)="70e9d40cbab84d5015c177d80ca02f943e6662ec1a99396b6d19e52c316d393f5b1990e4f9e89da1454aa272c7c34e8e9c49787c399b8e6fe4c810e556cdc8c864a94338692cc799dcd30090e2620b12b922713a478701c9281526ff78d5c36292593ef2122357c14370f16c4b62072c79a38bade7025ac4c025f788b6fd10d907715e1c14ef73859a7d48a90f583dff29ead2f20aab6c017b9629c2e9270bfcf2ad0b1d9558d488aecd8a9ec499768b936ff6456fbc700a7aa4aed71ab03db2ac", 0x0}, {&(0x7f000094a000-0x7f)="b2b78b83380ed24129a604046ee7ce0f02ebbc7fb371cfac82a352286d14b1893413e2a02d256f0283a142de70c1be23c3699b4c9d561a7057d8d0a39a152d10adc39b2bc89de26281db0637ad1152721026b46cf3ae149a781c80fbcbdb8bd1a4a3046d45a4c4ff7e01bfe1fbd6b05c6d4c459b19cdd4574680e04779b585", 0x0}, {&(0x7f00006bc000)="cec902a54a8555cc38b63578fb6e9ed28c1a04523a6505976410326cdc1efca5578e9789a1852fe20c00fd0b2b9e4299054e0d73832e568246a57997b4361a35f97a446c3b1d1a2b8524d89e00f0f9671187903e9bb2425ef99b77c2dbe144013d8226e94d28ed75793624af4da4c31202f8445bd28cc2464bf992b074729368", 0x0}], 0x0, &(0x7f0000392000+0x3fd)=[@rights={0x0, 0x1, 0x1, [r2, r3]}], 0x0, 0x4000000}, {&(0x7f0000957000-0x8)=@abs={0x0, 0x0, 0x2}, 0x0, &(0x7f0000835000-0x30)=[{&(0x7f00007ea000)="17b043a1eebe9a59289ded0bec81b1882327e328aba6f9e841edd9112d25eda715cda9721aba159914fc58fd4780606a21e82e2d7850ad3b894c7478b50196b33dddb4c3ebf0b456fe1d3d6a9a51e782c7dff2fe39a095c5454418402bda614656740f6242b473df2f564998a87fc58a728f1f910f8585074a397346ab73bcae43b89c5120319d7ba085c14b2d1290cdf2a3316928caa9a24256cd110a5c53ddaabdfbaa901ed4145e5fc51b7002c243a9157e5583574dbdb5710080dbca1c9a4a610cec89e5fa659fd702e0bdd700e4b8438c1b0099d0f868203e110e750a25beff5e3aa949a5be52d66bfa49663577a033df985dcd54a1cfbecb2d7182cdb202e7771564a33182ce49a866ea94ee373dc5bb603746922207f5288ccf85f73d1c921e299868170362e59cb12cdd639f542b333b490b3ac750a080900b19c18a1125ed9d154660af2746cc27ea85ad19578f0622d79c79e869e1be6b9009546a2309be62c0f7c3592fe190b697464ab91f2618aa776fc421a2ca8211368be1466678c6cda362f7962effa667f4bf0e34cbc3b4682dac02421ea4f207eff2110fcfb2852c40d92717ee88f1e7dedeb4995d8a05745f1672c7f4a61f46ea3904678e2e6b4a8e3a8dc6b92310d30df5cf6fd4b066a45199186641bed4a8384b6e89853d736f280196dc230662d8165d827da8ec55e1804ec23d7289f0a0f4c4aaa1b2be4d0b1e82a6f2a2bfb7333ef9120b4eb42ad50f001af35eaf8daaa36cbad88566b331d96d6b426fabb93b8fc7ca520fa954657491fac878d47904d5c9772520d074121c653f7a4bd402a91fbff2bf2f337fe4619698122eca47390a25d0c5ca9b31f4e071f5a28557ecabec4192779206316909b9e0054709f2bedb84ed6086c89932648c09d91efbc8c99196f5022f94a63f1d519d81e3a2785c688b734b1280869f58e10200605c0f8c58d674d9eec1b0becdd69f6d5c07c91dc13f250a0e6dec4728d3f5a11e3d3fc8c5afc476f6aec07bcf1441d7ff2d6abb47c9a41227700287d5ee15b9ec030901bac819612db6a79c39d2a4d932f1186d35693a2c3aa397e6ff5563219d37a560a2b60753b73013d1636c3f5b63a34093fe5b935d6c5aa1b3bb0966b9cb61904b81a451721c1181b4caaa65d362aebcc7b099ec89526ee3fdae1a4f4d9ee3cfc36b0a4118580068d1df70070e381701742cec71f4a7a649e4879219665bd73131cdf85c0d8a86fb683b7394fd97aee4bb30e47eaf09b030c9d120bd42ebe3ba1e9c3e24428bba04e23d9f5459799e8bd4e3532006271d32bc857d00c5c7afca62e115a5cadb18a25e3cd2c96ce21fc89f96ad4197e2ac2471b69130ce4eecbd60630cf84530261763b7edf5986ca04f7553a6f62aefbd7b63ddc7aa70d6a6945f7a56fd70d6dcd82f33d831345ede0af9f3ccd8e913b2e3e87561ea936124d8f64ce90398b73f18f7fc721d57c7bc7d8f9aa71e9581237ba20bf132f97f74764d89cecb670dd3fff24dd470a7789f09c897f02ed6b08f80aab5618689d9c586d22532169476a84f644c7057c2d78f84c48715acf3d6a50c87538562a9cef04b406d3ff8bfa9d17b58e5a1867816e981d49e87d1e2733db7d5d6a6b503a950e97383fb378e585d15a45bcce9351764e890e813634412ffcc20477d1aa02d7c48ab93d512503aa70193531e902f900ee8d487b2da6f650c0c82d032754fc3cecab4e02824d49e14162d2a979677d740aa99e5516c7f0ec9597cf0c0c713933469e10c48a826bf96fc98b47b488d124e02fcebeea210f05d7c311036d991906d6b63d068a5c7abc471b0be15ce469a2b429a3672f41205a48741caf2143b940784433f5f1e1443429e4ab64dc83227e930be172ee0f2d80f5ad5e1628e5dab82a1c491b1515b8d572bba7c5a3ab97af132bc3c5f5f51380d8e4eb9af91f5f97cf0267a8f696324ea7670f393e1c64c0e84499b019c641a4a8437624b5b52daa6350379effaedf3f5f282803b7917b265189a0c6f8489fc3b5bc3bfaa198819e627549a292cbc457ad1ac914f8c52b72ff1759805cab9f6838c89266d85ec06c140b6cde4c065f6617448f5642f0cfda789fa995fd82e85cedee84ee7da825b925f46d80993f83913ac971b451a40b21e084d342d4fd043f2538116b540103dddb0e41290b97d2892bbb804d9a2bbb0580d011012ff8774cf352841efe31c32588ca5a62fb725391c083e2fbf8a80dbe47cd8e935890dd1bfa57c1260bd9ed8bb49ab14159eb6cfb03f8dad1297ec3bb67b9590699a650d713fa11b67ed9cdd53e87ea540f8169151048bc1d70759b1770c8bcd9824eb869f8c8261258d603bc35c0d176768aa37193dd20bd3f3d4f2e36eccf3a7c6ab7c74a0a7e307c553dc38383dcc2304fb314ba0a834176df0179daaaf6a461d036151022532f3f85a43026f5fb490c5738b72db712bade59bd68896de3e9ec634a3ad374beeaa68d85de71b0cf6d0ed308c9b7339b4371df1e64422485a3c4ea5f80633f41435e548bcfaca9c22477d89774586a6a0a6e4d01f25b23797ed001f8a34158cea792866897a0ded2a35e69e9c8bfd60bfd867bb5dddf171f713afc6ef9299f8fff6d31db545c58921915b49a4cd575af85beed0eddab83499b6258e134be24fc486a3275aa6194bfd3631462a7f21feb6eaad87c71fee1ff09952fdba1893cf7dd5129b6136bb4beaebad682d25ea42d02957b44a6b81733bf85a40ba92ee1e3599309e5693a8ff7e45025402a82f1c021ec03f450ef5759d2b753d08c09a5958c60c676d07c3253ed3aa42eed8c2f5b813ba4569c74c0b6050f4dfbe10aa3dbc8700c0410b8b0fce398cb9299530b88668c21a3e7581277c7b5aea6ce85f33e4cec036d70e98bd7287f89320c9b2c443a1889c77ad6f62a1ec01730c03ceac132593eb925fdc7f1b5752f681ff7d0bf01986260e1375a74d02646c6d7a734c48995ac24dbc24c97b8a0be9d99b29b43e1937853cbe92fab670629e3bf74f6e10386b2bad9dbfcac552344d21cf03e6296741548067a72a5efdbda51660a763ee9a06e0e053c5944fa8bf8b1ac257c28f0856ee7fde0fa48173f97f28d3a1fda38ec82f7094169688daaf29f1f91f9c30cc866b55d129386819ab10c542494b83efba9e932e8d9ab59642068f0d4c5b315f20bedf799291be63bf30e17a5b231b4674f508c5d56372c9fb2cf9fbe2b510b05bf2a3b0d87fb694e4082eca3d13bf4cbc9e5376b34e4b81768c360c90934a51bed7d382bd03048f8a5ae522eee5b83cfccb9fe60c24f366608de6e875fa5af9c16973283e1a1ee18bf6a4b84a6bb659f2e30e291f6c783b33f007e1b32884658b410770057f05c93003ef0d8f3ee92361f480065ab54233f9d9e4c19ef014f4098a515fd556b8c671bf82375bee5f51cdcbcf8e55d160449b5a3013c0673b555564bdd2c5bca7ff6fae1eb3bb56b962250b3445673036dcbd9e4d7f2e9958915eb50a28c8af4dae68c374d349e423d4f3e0126e1d266e995fd58fe641ff35317781bd814e7e340893fd1f22ddca3143fb81f59ac57d7d6ccced55ccbd2c4d72fabf608938115ccc09b5bee81a174f404eb2864caf56c4b8e9e6b05de73f31808c01ad48ec517ac0be7f4cd166e95a56b82bdf97a8fbd6aed27832a718a7f872816593ebf16d74e8461f9d902632815ab90374ff370c53aa9bb58bd471d1d4787330598f519ce7d2259fd8661498f6449b634fa02d7706fe5d50cda2d2d3e071c0d9a1f069fca243a706ddb26eb116a7df9be92ddff1ad0abdf2beff434c07e578dcde4435a2d4c4b008d4a46008009617a321e29b4047b3e849494868f970f1e862cac63f1da0987bf9969ded3ed2c3bc0c53c9f38e0281fb8a9278ba724b64297448ba997b232c3f7536364a2f993c1157d582169d27f394aec076e56dd287327b5f043e46f077ebf4c0f7c960ba15a26a537620c1eb0bf5fbafde844be3d6aca384af84186f70c8ae29faa86a2fec1e1f2f3ae3a2e7bcc64e8d982d97487a1497a57228665f96dfb4f38ecb33ee6d67892b694f643670143f1a7f4636e2dd4c5cb34c7eeea137b3c97fc9e8301d9017c7a70cdd9c1d5d5e5bac69fa5ee9b41b6ee50da3310790584373bc878b0fdc3d5fbfae145d6202d08dee53adc9aad71053c42747fed3380062ab096bfaa5fac98606feb1addd07b4b8e988cce46e8bd71f132661a10a77b6d857d987511dd1e56869257c81509a7260ba348d0233dc4d0d6c2920ab5473417dc2ee661ac41930f8029d8cf9c0bf866f89f79e8584efa0cf299b3fbe9c97a2b3627bcd9fd0f89266c0c6347523ae153974ef9121f219cbad931b266d6f54cf6acff8c2a81fd7b6bf12a2d6f3b2cf4657946bf9dd9ca66edba17db918aa7bb9e6706b625edb44fb09316aefa6d22b833480b1ba18a6e82cc813647aab304025d32835969677308fd2a962a343a68a1e642766081ab0a991c40f935e585cdcddab2d125354b4a2e0fb058d097adfd9098beb8b6480fd9042d14ab11b8945a9226d1e14852e2363da8552fb349aa96fee8c371cda3f72192a2216579a988003a78d1ffd20c22809ef27bf419d679f68c8837b29ad67c3ddab8658d3211ec5f8a0501229e5a3aa1378373a4c1acdb61266ff7d053a6eff3cf50e3d383f60bd71c85b13e9ff9e1c9c93c1b2c5db867185e0ebfbca753d90b85a5d2dffe3d50e9fa7acd6622d64e5af261f7786aa28ef6bdf62e3896b0e0c494bfe79ac1ef920f1457c8edf9a9319adfe435eb71be00c3f297a5c56d834e50ebf5a0e70b1e01dbe1f442c4a12752e48537f3e332566b7263bd5b2ad80796c24d414822d7a13b36f38475ecfd13706cfc9c1fff2364514232a6a435aaa9ccfc839856d2ef46810be8dfd19b7be52ee651a6d3a9a1652f95ae83ded644b670c70c08dd2d1ead5d25c396d551f4df8cf8ae0d12ff3f4b8f6de5f53f7195c09774378d4346272a4f8f8ac3c3f02b5bc44003d6b356c30842196868fa3bff28f7bbb663c5f824aee06b6741108e8ffdf68c9c3fb0deee51d687129b1e3e0cd6e2af3bba7e71367e6fe275d37c5831b930f7521c482a981347080ff62e06464604133bc92489731ff9b30e9a15049a330273d424e9c06a5deb9a661ce732c651f82ba7d27de9e75b878aef28cf52af5a82d78747f2142e6d58e33f89333be6c048efaf6e69b64a195bb87910ace7455a05122e4e7b658212de2f9c7cdb257ac6dde74ab6a3fb90be1c0ce099bd5a6b886e0cad26bf05dd5c69393f30eaed4cf643a1a2d2dd1b54647921e2d117283fac3989c4369f075159060f0c160d35e39fea2614fef658d4c5194d3898c664a6e10ab573f7e623ddd517d028397c7a383b34d87d2881c51f5752d4304a4a428ee16f35541b938931df35df443ab2ee32772f993ebd953a78765200fff48af03a3f5771a1a7be8857b074fc7abd86172ebdf70bbfc7997a4c8462d11d0128cc6080f73b96af7de6365e711013066a78ab8a36c1c4c7f86dc666250810275b873cb81bb157c2fedba24e73d5899ee566b68866188d5a27f0418f47536dfcff5612251b3b4196d6d458c90009ae97494398262e99c215d93d452411f287656ac4debc61bdcb809225a9a1720ea4866f2aedb9e949f25e0dca13df385b2d82058c049fead8e9a6c61f71cfd6ecef4dfbef2fd67e86db0c5976b88c90098381f2fa59640cd6b234fe29bd26074be3dcde611e63dd9e5ddacad56a6ed100bff9c", 0x0}, {&(0x7f0000050000-0x18)="68f50d2233a3efd01680f109f090fa87b3e3138b2269ef50", 0x0}, {&(0x7f0000500000-0x23)="f7fcd9641acd485f7d447f62f6620b0d1a39f0ee4edd5a2974fffb03ebdb162f2fdfae2632e6c728e9ddb3a074d27f5683cbdaf6ca7a29516b9e8613394ea66a216c3018596e6bf9cfd47a33e55585e1f67477bd644355a1230e9a905e7172fe78fb824c584b003988747599c0335ac16384704761059e4528c1e93c39be3769aa9f2bebbe6438b30be880f6e982116d6d81980497a7981212c513773e90e7570816091e4623c277cc277d460bdec5c4d7f8a47535d1028cd784ffd9c25413924e8acc54671db8986bc3c766ea77dc1275b478d66208ed7c932f7d", 0x0}], 0x0, 0x0, 0x0, 0x44810}], 0x382, 0xc0) setsockopt$sock_int(r3, 0x1, 0x7, &(0x7f00005ff000-0x4)=0x0, 0x4) sendto$unix(r3, &(0x7f00004b9000)="", 0x0, 0x0, 0x0, 0x0) close(r2) 2018/02/01 04:11:30 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) seccomp(0x1, 0x0, &(0x7f000089b000-0x10)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x407ffc0003}]}) r0 = accept4(0xffffffffffffffff, &(0x7f00007d7000)=@un=@file={0x0, ""/4096}, &(0x7f0000f7f000-0x4)=0x1002, 0x80800) getsockopt$sock_int(r0, 0x1, 0x2f, &(0x7f0000fd6000-0x4)=0x0, &(0x7f0000e08000-0x4)=0x4) shmctl$IPC_INFO(0x0, 0x3, &(0x7f0000564000)=""/4096) socketpair$ipx(0x4, 0x2, 0x0, &(0x7f0000a9e000-0x8)={0x0, 0x0}) [ 310.946349] binder: 15955:15959 ioctl 40046207 0 returned -16 [ 310.946687] binder: send failed reply for transaction 1639 to 15951:15954 [ 310.949674] binder: 15955:15959 transaction failed 29189/-22, size 40-8 line 2788 [ 310.949765] binder: 15951:15954 BC_DEAD_BINDER_DONE 0000000000000003 not found [ 310.949778] binder: 15951:15954 BC_INCREFS_DONE u00000000204edf8a node 1640 cookie mismatch 0000000000000000 != 0000000000000001 [ 310.952399] binder: 15955:15959 BC_INCREFS_DONE u0000000000000000 no match [ 310.970785] binder: 15947:15963 transaction failed 29189/-22, size 40-8 line 2788 [ 310.977161] binder: 15955:15965 transaction failed 29189/-22, size 40-8 line 2788 [ 311.000985] binder: 15951:15954 transaction failed 29189/-22, size 40-8 line 2788 [ 311.004169] binder: undelivered TRANSACTION_ERROR: 29189 [ 311.014528] binder: 15951:15964 BC_INCREFS_DONE node 1640 has no pending increfs request [ 311.032917] binder: undelivered TRANSACTION_COMPLETE [ 311.032928] binder: undelivered TRANSACTION_ERROR: 29189 [ 311.032932] binder: undelivered TRANSACTION_ERROR: 29189 [ 311.136413] kauditd_printk_skb: 366 callbacks suppressed [ 311.136421] audit: type=1326 audit(1517458291.067:6086): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 pid=15980 comm="syz-executor4" exe="/root/syz-executor4" sig=0 arch=c000003e syscall=202 compat=0 ip=0x453299 code=0x7ffc0000 [ 311.136842] audit: type=1326 audit(1517458291.068:6087): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 pid=15980 comm="syz-executor4" exe="/root/syz-executor4" sig=0 arch=c000003e syscall=288 compat=0 ip=0x453299 code=0x7ffc0000 [ 311.137413] audit: type=1326 audit(1517458291.068:6088): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 pid=15980 comm="syz-executor4" exe="/root/syz-executor4" sig=0 arch=c000003e syscall=202 compat=0 ip=0x453299 code=0x7ffc0000 [ 311.138687] audit: type=1326 audit(1517458291.069:6089): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 pid=15980 comm="syz-executor4" exe="/root/syz-executor4" sig=0 arch=c000003e syscall=55 compat=0 ip=0x453299 code=0x7ffc0000 [ 311.140114] binder: 15977:15985 BC_DEAD_BINDER_DONE 0000000000000003 not found [ 311.140127] binder: 15977:15985 BC_INCREFS_DONE u00000000204edf8a node 1650 cookie mismatch 0000000000000000 != 0000000000000001 [ 311.140437] audit: type=1326 audit(1517458291.071:6090): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 pid=15980 comm="syz-executor4" exe="/root/syz-executor4" sig=0 arch=c000003e syscall=202 compat=0 ip=0x453299 code=0x7ffc0000 [ 311.141322] audit: type=1326 audit(1517458291.073:6091): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 pid=15980 comm="syz-executor4" exe="/root/syz-executor4" sig=0 arch=c000003e syscall=31 compat=0 ip=0x453299 code=0x7ffc0000 [ 311.141358] binder: BINDER_SET_CONTEXT_MGR already set [ 311.141366] binder: 15978:15983 ioctl 40046207 0 returned -16 [ 311.143086] audit: type=1326 audit(1517458291.074:6092): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 pid=15980 comm="syz-executor4" exe="/root/syz-executor4" sig=0 arch=c000003e syscall=202 compat=0 ip=0x453299 code=0x7ffc0000 [ 311.144858] audit: type=1326 audit(1517458291.076:6093): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 pid=15980 comm="syz-executor4" exe="/root/syz-executor4" sig=0 arch=c000003e syscall=53 compat=0 ip=0x453299 code=0x7ffc0000 [ 311.144911] binder: send failed reply for transaction 1649 to 15977:15985 [ 311.144984] binder: 15978:15983 transaction failed 29189/-22, size 40-8 line 2788 [ 311.155185] binder: 15978:15983 BC_INCREFS_DONE u0000000000000000 no match [ 311.158791] binder: 15977:15985 transaction failed 29189/-22, size 40-8 line 2788 [ 311.174060] audit: type=1326 audit(1517458291.105:6094): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 pid=15980 comm="syz-executor4" exe="/root/syz-executor4" sig=0 arch=c000003e syscall=202 compat=0 ip=0x453299 code=0x7ffc0000 [ 311.174077] audit: type=1326 audit(1517458291.105:6095): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 pid=15980 comm="syz-executor4" exe="/root/syz-executor4" sig=0 arch=c000003e syscall=202 compat=0 ip=0x453299 code=0x7ffc0000 [ 311.177043] binder: undelivered TRANSACTION_COMPLETE [ 311.177053] binder: undelivered TRANSACTION_ERROR: 29189 [ 311.177056] binder: undelivered TRANSACTION_ERROR: 29189 [ 311.197448] binder: 15978:15983 transaction failed 29189/-22, size 40-8 line 2788 [ 311.211254] binder: undelivered TRANSACTION_ERROR: 29189 2018/02/01 04:11:31 executing program 0: mmap(&(0x7f0000000000/0x9d7000)=nil, 0x9d7000, 0x0, 0x4d072, 0xffffffffffffffff, 0x0) mincore(&(0x7f0000357000/0x400000)=nil, 0x400000, &(0x7f00009d7000)=""/160) mprotect(&(0x7f0000540000/0x2000)=nil, 0x2000, 0x3000002) mmap(&(0x7f00009d7000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00009d7000)='cpuset\x00') mmap(&(0x7f00009d7000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f00009d7000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f00009d7000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f00009d7000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) sendmsg(r0, &(0x7f00005d8000)={&(0x7f000006a000)=@ipx={0x4, 0x0, 0x9, "5eb9f0aace8a", 0x1, 0x0}, 0x10, &(0x7f0000837000-0x70)=[{&(0x7f00009d8000-0xaa)="7df503bf5db0a1b0f43ec0bdd01ab788c9bec2a4c28bc4e02844c2ef9692f68f929a20f55c35c0b1570cf26a99340db415fc382ff1c2fb4f7d45cd35f68abd489c71dbddc2e81aaadee2057b279d826a89537e2fd1277309b6c11a9c77b63727f633f2f917396d5d6c0ab64c104b4c4275b79ef1cb66199870a7f7e2446ec093f1ae997a37a355e8bf69d6e7e8c76111ab1dc1c0f71b2a35572ca5d4006c7bdb889ee96dbe4a9bfd2a23", 0xaa}, {&(0x7f000093e000)="12b061a3ec5d0e7fbbc4e8b9db1307627bc08a308c5a781b94d397e0438ebefcf678c71704d3381d63abfc4d607e1bae313fb8426d5188a2bf4c2f312dc5d7f5c4121ae112dd0931ef089cded46e112ab2be8ff28225d7e664c397a8ca23d985809f1e2ec2bfb2ca9edaf41b02374058f6deb1aee01787dcf18051f6ca22", 0x7e}, {&(0x7f00009d8000-0x51)="c5d3ec560fead58c900d77cd96dd57dd53f05397ef2c7d525b5e1ca7bdaed4bbf8e1cbfd3295b02f866da7aa826453bde45902b25691ce29a729b17d984ef97add3368339c5c99774199bcc15795da37aa", 0x51}, {&(0x7f00002d0000-0x33)="ae62ab419956cbdb049e48f09b4ee72e05b51d6ace4f9f86c35fa460401baa21b95b4925385b49e1b19f9c57fe01d52f8580d0", 0x33}, {&(0x7f00009d7000)="4e142871a399596c8e601c28743078dbb2a58c6786a960af5d6f1b0dfa4ef4bf2b8ab53ad1709db7ac1e5f8d04a92e5c783e214cf5764198a0a49850ef914765c0206796b6be53c0e7fef7191a68291911ddaf73498b4b60a28e24ce634d9865ff7acb9e184051f74e8dcc2c88eeff3232732a566a5f6a7078904e230b3d1d6d0a335ecffe91124f70f1cd8ccd", 0x8d}, {&(0x7f0000106000)="87227b3fc22ba34e6ee0402b513aa4d87b56926cae27d470ed56875e324b231662a6e5c6937ed690183dbca80d2be91a6f3a6929e4f3698ce2dacec9766d9113669cc01e4fa378", 0x47}, {&(0x7f00009d8000-0x1000)="9e674ce07c0bd8b5f9c6110a30450850ba28d9428f7587b42461e2d3f8c0dc6f824014a498b4916b5f423a3ccde1f52d3041042c40df8f8a3b09016371a58ae8072127742cdd2fbd6e69c9854457e36e0cf91181eb81d16407c8c95c811fcb09e032cd45e6fc6be8f2a0649e7bfa30ce0242a808ac7e751671833b7ac311ff7c9528b4499d38288fde5ee340e61ce3cb59c65f7d044e04bc7bec4e44af0ce7dab92eb774a0c5b2f829ab9aa2a5552518cf4f374f1d106701ed99af2e4460deb680a88488caadf961a385c24b1891bac5abf159d29a3a085c0a881cef732497e05511fdd1f6792ec1b814cfcd5b3b2a4a6c8c7caeed5c907913ba80f9995aa865a6ce4ae404ba34af4bcdf6d4dab44a8905722345c147090b4ba9f59777d7ef8ab50de6bd9c9128dd46f38a89fda93e75be7cbbf2d701e72dc8f8ba7bd589a34dc30b78af2963dfb5beea6cada40afb56c40cbf7065c82c16eb731fe6f013a782f4cf59b5e12c9d7b85c1231282b97a15ea91d1699de4fd4117772035485ce7fc1c9091bd311e210f6fdd119c96eb862ff571db59d605bed2ef8dbb535cf41731bf19f1ea323e20755932996ca43d10910915a7f595ecba283ac24c3f3af645b760350f57b6b3c62554ae80ad265e7a47e099b962383ef684ac03285070e7f4085d11f1d49e395348ae01d6a9bca0ad85df874371fb4ce48e2c298c5f1b7e466767d996af0dbd5a218c632a71c72628925a3d15d1077ff9f6dbef1b64b41adf9cc4a94a9e9b54b3b7331f1ae2edff3622d6d82448648158bc5c1d84a3c6b9524ba0a7962a2c412acb2031849c56a45319ba541fdf4bea822e593766045070619abd11ec3c7c3d7d25ddfc7e4f2bf86361aace11e92a69e1c2dc67941cd35f29fd56ff35691e2e4f5c8351b3ed163e8a183d21bcd19cc0a95d197041834221d48d511ce6073605c22c3cb91200aa3f63232bd09bdc6b03a3273d238f1a8b6f46f1c4d75b8df200d5acc99f60c7396bc548fa083ebcd62cc938a8902843bf25da106f94e2579a61ced4e38f440e6d53b24ecebd8ff522a2f5ce35fc4686b5a47a66b497fbe336ad450e3ac7cb32b5419716b79f29b4c074be48bb3b926ed1a6dca83adec6e07e01e19c7b9d3a33f56ee08b8d1e7ce5d9a4b0be3f4f0f8e0785e08b33d4a91ac2924211d02beadfdef104bed71d568486bdba3e86a12a1ef7fe09fae70439239a7f9acefb4f0b40b89af9670de157ae838549c9cfd294f5271b83196f918bad7b534727b567f092c611d4e77911f20d6b055b18553ecd8977b98c4e23b6d0e6357c766747851de58d3d779899118d4bcf621caea05ba0031352c158f285867c09087f29e8613612d4068431829541f871ef42ec24ead4a9242167e1d88bc570daf83c3915ba2dbf2f4555cf814aeeb95d5833be619fe2a10284857268bfa7c23442174f01ce68eac3c635847c5b8d91d0f1d680d086060628fbf9f74bc7f7e067869a13f63ce9b8cc4cedbd41f441fe1f75858da0a3eeab1aea763e9d7ff21b1e2ced5ec016f9cb2eb40bc0137745a567a6216f3a5c8b065d25596b986ecd6341e1df46a1b012f2441f916437fdd641a3937575bd16b4bf5b9836be105880f302373c7de8e9b581f55d3d5af194daf02ed40fa344390ab74c185d758e103b1e4f95d17c49d9db232dcbd347a242961cd0b7aad09ead896d56efd835aa864d0a894d88f9ab1eaaccfc77b46c26046eb1e6eacb5b917d7d0971fe03db31b8ff5f26c14cc63ed7d8eae8af39a503945d6230835655a9563d6fe003d3a6ec685225be1f856f77749f8de166a8b142039c13c5d86a557290e9f4590ab7fa5bd7e97f92a59da01f314d4071ed44f3008a84cd0c31be43a41e80a9dda65d5d52244bdb5fed49691de5b25cffcd3845fb2c7515be14fb225b069daf6fa81bbf570f5b7b52adb45b36058e4147f53b100ac1228dd800299a82331ee49821c8cb43fdde54428430f113f84aa92e3b24c4dc8d3d5997b3f57cccf777bd07d6e9712e9bae9c8371e5dfcf2f18e8a850d63492e594c2db09d3571d74f8d22237c6bb4cdc66309b6b85a620a9ee42084f56e5170134d08fd21757cc3f14d2e77f9024feb2b2ea042e1280c38210431b46e57cec23c66b6481d9a1040b604fa475fd5d5cd37a92dea7eb9ddac73ccbad589b6db779b32288dace25cb1777b3e0a3be9a36c880a61c450152b6a8a3befade3b3a909cd05a6fd492c28af3db7262d9cf1c7fc5fa5fc6496ad4fdd1ddafef3276dfa840dda83493abab080086b4e1843fa104a3efaa57d563fcf0c4f06076a52d981be5a02b6c292d85e13d0cb73d41ec87d802a18a1372131fd76beceb3086de09c084fcfdc9c812d19402a36593a579c144cfa85c868412b593c6c3a6711296fce873401643a4e11f3c5b35760d01bc6fa35f48d5a3bb5075082f663cf2b39bfeb8221d0ac411e042bcd46949da3e0e673d97f43608cc50ff4082c1092f25d982b8d8a2e1be13d156bacd395c5b79bc748d2841160036fe227bdf2f8e1b78bca09ff3f04b4a8978894b643592ba858e45f304833c7010d47a4375e3732b940fe49fa5796691e7a192d033b215bcfdb96cf390fbf61cbb9ad09962dec4219b7fd2b0dd282be21c9e142b3b40beb2c2d96247fa669bc8b903231fa88e681a893582a5a1b7b582c12bd68ddab84a6b2e9f8870046432d10ac94cb72f7e7ea48134ec115dcfaebcd2b5b83e5714c9928ee3302e0b5f5cea133130b6465ea232ccea75eeb9e4667081a66dbc3075324f8dd1ee0b43ef93c4f8ff1724cb9c7d6b4912c631c5ec21d5cd55d2a92614ff5dba7fdefc96775f8ef402f43a077d9884fe03eaf47bf18ceafe491cf7b83fc8e01997071d67752552a3f3a185d3b6e2ac32ad4e5922eb1d20d48e1b9773b252c5e233087c06248bb6cf2f983339a63de2106aa54727d5130f8767a0ba5747cbf3bbb90e96518f7e94a3676415e076ce5ca17aa68fbafb6078f55c9fdcfab283391ff9dca52b7007d2cdb979dc6706ed174e2f90dcfa1dee7697dfce3a965b6f0bd9246c4b2547d3fa8414e17e3098b229a6692f25405fd40764cc544092a1e058739db4b20bbc95f726a6b3891c0603fc086d8b710bb494f096be3a313dfb3f27716eee19dd633c3cd37e9731ad91ecd87c25ecd3ac6f5cbcf17ee0553182d9be58d0ebc9d3500093e9ed2c3e951245863cc43f63f8934128a1c597f6de6c113dfec047ba9dd77710fcb4dce3ba5eb0da76157f7b5d7eb8c934c230fcbb49c4e368a151aea2f78fd87049964bfdafa40661e0eb2a9a10e89d9712ec6c9c83817cf178a83d3c5edee06086a8227c6177f1cc3e71e639334d9166fa21314e3cd147181507ced1d0fb977618d87e0b88cefbf5bf99d09577ba904a5705dd12fac173a59422955f378dfe4a1223441e0a86041bbec311c48cd8ba9b17e414314554b0e3135cbf20377b8fa13466b61f57c37cd7454e92db369fb1963bd1eecadbb8c6d66bb486d7a77d4ef3b9dee2c0a516c95df31390d092e6fe67aa0b72eaf8fc1a770495f137de4167863e3510d3af275af345e14898810cd249a22b84535fa4d3696df24bc2557e5459d17cde54819ede2773ae019f0447f9b769700d59edad3dac6421c36af142b1c84be7fb9838b50df62fd2179ac3cd5c2e43f3bd5ffd0d5f8540dd82a2fa9fdc9f8b4df3ea34087f80dc6c232ec848dc297c7e606145429088d45bd95b5e86f1850780f4e731e903f5666f29baeff0cf2592af4b305e4eb02efe3c9ff4212d89c0e38a3f8450ddd2dd4bdb4a6b73471465ebcc7b8ceafd42bd295515a143207b22ff2cc58a00a1f62a8aa317ba81af70ec41116069a290e275b4eb7a02e2096d6b0f1839f4b8f206f66647afa3c61e152dc2f4753e2fb0f0edc93e38d7a38d6a1249293c0a9d21a383a72ad5500ce5a533db7fc8b1b3079bf8a8f8ed042e793379fc2b488a565bad40f5dffe00574514139403bada94a8104c168d8c64db411b774e9b1d9e45c62a639937ce33c6ae342fa9a1187e72f70edee1f8a5679b56b7495b8188cfa4834a24c5a3d616e32240a237812b60fc72063fc8960afba6d84490066039bf1220b8a60850b9571428bab3b5033b3eab1451a54614112149c86119bbddadfbd564b0911a28d6b0dcbfc59cac4f27c205ccce4a868917a84953a79b0e0d49dc04dbca802f108e48eed5877544317b015c47b90c325875e7b6182688c4bf1de9379e86a20e8481f1bc7354c471ed2a34b52b989a19fca7e730c469275007127fc533ccaeb1db03c4af5e2881f75d5a815f4d05b6e0674b0dcc9b87da9a919e1f7530dfe1463ad324a3e00f6f4aeaf623431d3218f47cb7a67da539cef276c360f15d05045fa65d1f4ad9a9c583c186169a5f3d2ff88a6fac752d347265b975c7a5cdeb53c02a9127736e9f5975dfd4e87477edb81611662b94387c121e16d6acfeda997aeec9350e429f8fae0013b9276d50cc1dc8cbbbaa99c5f1059bb19c74f4b90b81775dafd5efa6f6a40d783daa0934eaf06e9ccad14fb85f50e9a03a5cca854daab6aab7dff1257c24196e6f8e1f95639fdc086bedcedf5a8ff53919aceb5f3d207c5c1364d8863eb93710f07b37e7cc84dead78a31f4633374fb0717b118809e47663671a2e442a54f3cb93fd7c07f1f503c77c46e52b8028adbce85a2356778f59f721ccbd3c88c8ecfbfb41b057a593ccc03cb62d104b1f8784dfaf164a14995fa31f7dc592d2fbc267b5f311e14bce43977d01acb5ecf2eebfcb23383de3e559cedb7b921b610ff22d6b28cf40c5934cad2ebfa1a7e79c85be6a2b4422b8e3971511bd70a94c1016d9f06b540f26b0077a2e114f5e17de4a1eb1feed97b3655496ff8158cef59ba7b32f0f6c0397ed791dc54a2ba7ef52269548e22e5358af9344b2aef3905b96d1150036ced0c51541c0a55db836b58284522e81aed73b6cef95608016889310933177c5c13c0484348d7e5c2c39a0f997e40bc5dfe779e6adb55d5562e4e2e08676727748e0d2906d8d0cb06dd6df38623ca897d847882105920f6b1c6da1c45928be44a2dd62aae8cfdfd8e5e3c54c8809e432df37f9b3184eb2f82981d5bd0cb2b895dbaee52d95068a50422eba2302d5e67a27dd8ffcaa475c2d5fd536e34f49412b703df4c34ca4dba7171af5fca1904de159ae220ccd1fd1d2a0b11631867ce1ae49763aac5f4ebc8e63aa773e87d939e1c95a148556659a78eaf8239b9fd0354c5e2ac6acf0c44374af8d415a551c7bd5dc575657170b4538b9cb016532fb7ebc5a1c0b6fc0fa6f47e66fa37aaca8c1ff10684bb3df76cfe7fd48e5b6963e7a9bd27bf40438aa40fa46078e2ec12fa66c7eccbe7ce2e4626d0223dead72d48f14fac9d8e7837886ad0ec134cc80c0d23dfc958a893a256dfdd6eafbf9a7d2cbc72c3ce6642a717fde4b76fc97fd73d5a9a3e0fddf06fb33b85f239dfd5d78841c1aacbbd86191f1d13f5db8246d7e2dca1de4935c90fd21b9946c83adef96d2638118d292c3278e4259dffde4a038a46581e8cc4ebb6e7198e49fe3e2f79cd2fe38fe42eecd0ad5fee3ecd09eb6652bf8f95d0f9a507ecc812135a53aa53ccc4ac21429571dd466462dd6ea125b6bf46d8a4110207acc40d68f119d3387c0454b16a2eaa30546cbe7e0a06786239d27c2de12ffa385d1b7e0f03280b9539d13160e3618522e0d871e4515272fd5473d673285e1499b372c99c83ba236e2f03e126f16b9379aa7", 0x1000}], 0x7, &(0x7f0000729000)=[{0x1010, 0x18c, 0x0, "5806e180f7a10ec2abcb4adf8225348c6d804cd554799f68a9d6fa8af29567df868fc9753896e6a864326c855860f2ff1d34e2683e63049393688dbfe754b5223d3f9ae0f575aaef7400e99dae8f9074a5e5ea972eabaa0939d825d392aaaffba4570d5f7c4742e493b51d9a46567ca9ec6bebdccfb23532b25b3d7f02ff80b8a9dc506efa06a6df8aa4a1dbcf0eafdb59a80f8cb6f3275211d39f7a02c61b64ba3a5b9c9764aa7f055cc4567358f0850e3fc4d5a19ef938aeb8c2d6186b98f6d2ee03054b703819bf5ff241601a8a687007938c7edc7123bc6fb8c886721769b1c7000a949b92f931d10edeabdc260996f7525ec51b69c66ed143e0e0e85a1658a900c17711da74c339669b7c0de9e1e305aea37f070959758a4219c7806d194303bec67026f4946de1803a85389df60e47bf6fe1b762a4244617cff25a84d0ad8f09727d392ddc7b16e1136cf516eaeebd006d1df20b3578ae25579b84798b6e4cb7b55f5be8916e6449a4b2de20ab92a1cae209202740c399b05152a57a1aa749e46ff8e95ef00a13ec2f51425c38dc165a7e3817eb3a3b1ba1c395647b3389483ee2ef380cfae5d5fa2dbc5ca519485b720002194d77cdc0ca35ef57f7d46705db96d3da9c3b267cc298d5fb57689488532efd45cd47b410debec3825030a2164360d641f19a7ada441e0fb448017c0c32f4781fdda219ac9e4fb53beec43d1db897a9dbbd546973170ec7c088c29c7b4627835524da17490b1d7c6d3f6a9a37a2c2ba8e3e22aca497ca370d969448184bfb2da3abd6dd0818add44d743f2cf038fe8151cd1cdcbfed465e084dfbd6f04ac030e58ca648a64c078daa5f6ef0d03ef70e2bb4b601c28ea87ccf10e60bba220b2ffec3916768ee3b3a19bda73b5b170378f0c88c73301e09b145a5974e89b223d3fc7df25997d3d38307649a7877f74ff4e207603a25b84f5225d8201874e06c8d9a4246d20aa98dd76c574a7056baef4745fee02cea5b108c6c01e43f52e1ab48080d4e9664fcc59756b40044e5f64e35a42458ec56ebadcd725eaad8b2a2fa54fe93036e1a5446e52a18033cd8a9ca59229ee2fede0211a7a5c0fc0301f35a36a3136c0c2c4a30795fb65ab09f819298bb6fe339098a6b3806d5b0712dc3209f2bb1fa92646d1e3c4e76485c4923df97c09ddda8ece7c489fa570a377f4ffd19eb173ced1f9fce2eb81ea5a4d6b2c1d20a5950dfae42c815778b42739f74bdff18852a4043dc5529eae853eaca81923224923172e8a37474d710cbeffacbf8bada94edd28a0011643615532757fb2f5c00d8f8083aab40c999f1535778e41442ff177f0e607c53d4cbb1476dd02a3fc7762cb0aa1cae5b6bf817eaeb3b38c40f6e86c27add3baeb60686a82e24c2da94a7f9186283934d07f48f91179f632e6521de5f738d19811148a5e7f21794913260f878d8694711a28a44615eafd8ace3a69a6ca3c814f2699e792802de98c735d2df3ae8cec4202cd0c84be204ce7fd7650324f317c84dee893777c6b58d9a6191c62cd4d6837cd28550f3548e3d9cff7462b78a463b9cff77be9528f016f9d9d73f80af042e668eb67abb21eafe3617f6e57199eaccbe3554e1267a15612e4b3d3b31ced80e1362c07f306c35c6af36ddfa703a8b9577c2e8173cbc27f94c4988f771acc0d15e19b131eb4472182c15e9a6219f544238ea2808e1239670f340f7b619429d09f923e5b2bd028fdc593e8b0793199958e87529a05345023eb0b4d7faf9f299e6edf35c9ed532e04795d6129952b0355716546b8e07080eef58116d8119852cdd6ba7ea69be5cd284222c75a7ca8282f61f7dfad4b4b7199e1ff1e186c656fed9a05e6b83b97ae48ae0cf4221769ee5935b76e0d00d30d8520424fcbeef7adfc496c04c33102a68afe298f4943446291d68a7eb898dcbfe5896be9d5761958d58e342c074c2961b4b4d9ded434bacfa34a7c644112b5ba27c96f287da1e7b245604c50b0552543e36015afd37ce963cf74a62d908db7990145d6fd3bba35d214f1f7219f34ebb0c25133761c4e4914b8eff163857d5c2f633ea376e3a86cfe11d57af766a7b8197536f0cc621f75c1ef233e40b389c8883220e7ed0bd7a7cbc0dccbf85f48f4d10fbf88b49c4cd84f2aa4a2309afc62d2e10a496af0aa28d5b7520b046bfe680ed22315729ed907a0180b1375831d78f86124c98582552e630dd621895e4c0eff0ddae8e77a301a492ac90a7e514b1de3dbe1e88c95b84fa32339b500571e7ac9407b825025c317d9460d5de66342527befae242916d6d9d8e3ac0f3eb4de73ca3aa3c3d5909fa29a97fc182bce876a02ee281207c272c1a711a60788e90f32f292254fcf5abce354372458efc83cc08e2d8979220290ca51ab8cad0b3cc5d6ab72c14d2d28a45e999be4f9731ae1b3fd205feea77e273e9bfb21db691f378bfc12c4be11ce0d3719c9f53ac909de591e2c69fac48f8f0d06b3255f3643ca5d14e3359ec7941f7051134cfb5d6c1b1b7475d458083ba708e5551c4fb55f5f338455b258e3dd1aaf7d0936048b827e27cf0e163280e422f2d83fba397ea1633666ce050d89fec3eeb3e19528bb9e829c32ea191858971969a8a809fec46ba469226d29531211c0bb951488807de0d79f69bec1925a61ce15e5aff08bf482590f8ace02757ea5befef94adb7bac8a00501dbc39b1dc41f60f8034ade2c0576635a2b0fb2c341f3c612aecd9141489bc0cc812e4651bae425adfada3392c10cad35b8c4718c27556f35c28360b55941985bc34eebb2293320d2417c000f0bf345378b1fa2eb2ec38f6e1e677862c7bc4e1b3c571ed2bc3a5bf7c8a1645eb2e3f123c7e4209ce4168f2cc7b5952ffb3fb536e6aca22ca81c9e185431a6e9a8257dbddc5a95a644674bbc1d5567fc522ab7ea6c309294c8c3a18b142843d7b334a97ad05fed294a059f4e20b7dfafcf879eb7897a5e21951968fbf90bd9d78048363abf262cda4a57f58945d4a3a99c0ce875a2ca68443cc4a9662f71f9cec6c58d6719cd4443123696e2df0c3761f11fb5170af8787f7d3c4220cdf6c64c9e8990f5de895213c1c5c3f3a593f1c441b654a0194a987b1ec6edf845491d97b2304755d43a5349adec61b90ed0b899c6e6346b309a0702f994f2fe6f83774c03417e3b05ff8b45bb245dca5203febcf88294741a0c3f1f135bde00897fdf06f2bbec783d9153147e8a709f690d2f61e17eebd3fc5f7641c6f0bca9e5918649fb58aa6d63fb7e75b7ed0537d7a3c8d798c4654fc3db440d89b8510b6e3a0bf9f0cbea7817b812af749b353d2a67d5d37498c58b406f0c36223ad50a8175aa43eb7559edeae267d7628c1e7a2fc9c0b09931007d9804a7af95bbe54bda0ad0f99e90452ed0c758a615e6bb7afa8fbab1f6a8417d487cf6528642641add83a32277258521f75bd0186cbc2881391f817f34c84dbe96700fdc84575f4e734580377e88487b73ae7bb997297f3f41cd51fba42c26e341ee5ffa658e4bbcb9169000bf57dfe14b57f2f15ee98486ab263e40ec084259ffa11d4f641c1c6014303003335bddbf84ccd08112d96d8ccd1ac028a2b2886ea684e20ef8a4386b799d9ff06e8eb4a3976dec9e9635257f2d4647df8a93b46ebb4fada7a8d8c047b3d7b3d4cadefbf06f66c773d018266f72e69cd3b63ee627d0358bceead093fdde8fc687b766bb8d70610cf04db1669cc017a4a683a0ac40998d0f0ff301a573abd6b369d616efddd72eabeb17e17702a042062323557ab25e635c2169b771cfa23d676de69f2311dd35a64058259084d1bd3273aa16dc0f9c557c6631d4b8228c13f601c86a030ce4c34a5a337ae1a52217ee1d4467fdeb45dcf2b77d4190aeb13a9c17c031933fb186317131fc712ac9f177811f746eead9c4d7702da009517c7273dcc97dfe20e352b4df152810c2f405f471ba87fcf6091c48ef4700d2b2d6eab17358ea075da8facd8ffa5a5e473b323766d7a3f9e43e9f70e63388349402a4924a2108cfba6e469469cb05a2124ab194ab565e5215fdaf85dbceae19afef51ed8e8fa2b624b8244a09595a6ffd0b0df0a706a239b8ece7a2d2e0095a4c2e4760a0ff2e0e0f3b1702c7fdf9387c1774ad4b2d3b65b2b91c3b35a468ece63cab3cf6ee0dce916a7112d0bc9ef49c377711db06ab2b6381ea6cc87a2d3012f97c001de90303c7f2032ddef2504ee7eb4dc39033c8e89c118b73df1518c5bbaff3108cad8995ceb29e82089e39bc8a3e6bec92c002afdcbca7d9b7b395174fad6c14efa7a5966545aadc432c56224371fef1a8a5163b9590f32e393674778308743d73f902036fa484d6e019c73f138027e6569f7fcd494b08f5331e4516185ecb32f6bdb684453c3090cecfb70fe0bb40e47f536362cf5b8c96f985e866b6437ab5c707341dd6e1cd3198b53b3be6caaf79904118115da89b3242ad91c6e99aabfe5f36ba46d125d9853808068887927527ea34b39cc95fe8bfaa9fbe40ec54cb48772a282cd518808f0c4dcad85fcdd87ff235d5349fc7f640fca0509cd32cfeffc841c2389bc48edab97ae1caf1299e2284bd95449c54011321df98c4fabd9fb799a622a6bfcabd778ac08d1b65feb51633e2273cf4310fc0ecbf0f085ec7a5d9d232e3148d1263e731dd4419e90cdfe0be0583b532bbc1100e17e478af5668ffba13a9232058db4e61b31819999af69281daf7ed494c973c5321a976f04e1d3fa78833bf7ed07d7926308f70df09d64d526b2ca05e0a13a1be6fd8098c522f1daefc51844522106bab2295ab5abc37eb6f4f042a26f22abc799987ee12d17c22d27a4875b957762b2d9d0cd8011bd111d502309f857096bfb8c03c9b8a2c24c048f2046d0a0ff3528bb041d18a9de9769fd67c3e2a859e5b5dbb667ac7b0bb670e95ebfaedc311ff9957104da8e11da6056b7b7a25826660bbc2d42df938893f22b2cba57fb457c8111b1815dc6e6bebe4d50cd45fdb06f21cf3ad7458113aac0541b1b9a76544df7c8bb4ac40d6d981df7e5d4796777e2c625f0e5713660dfcc9c1094ba735e9a0035f66cc64fc1af83282fb4535accbbb637a79d3c88dab833f0a6fc5a0e7cea0da8dde34b55c3aafffaa370f7c26a9352dbb47df1d4c1ec5f4f80192e609e756cd14921c7a8a44d7c3c538e615395049a2209919b3cff9abe4725274cfabc90ad640d89b6f3ab8d2c2524792c1c14ca94973b42436cd4ec8cf8c8676dbb601658e6fd01c56cb10a413ac54d4c996a6ecd87416f8140452b07ed3f35320f7b6371099f74d45772a4ba826a648a388f654ad2b1df9e853df7cdcc0b24da0fe079e69c14a5cbf6f607374d54f950468730167d05b0469a7b7e3150d02e1eddf6a1240e7cc0c4130912de1db7651809da54080cd2787d93fd5a2c3a1b7f90b245137a6442a0080b28991ba5f05a6a0a8490a809b23618a03b4b49e5528ba10f323567bf196dfd27ea3df66674764f7afa8ba60ea953cfb5b350de2e2bec421df0edb1272d531ebfd2cdccb78ad334da819f56eb28c4172e28afeea6ce8583ff087b2fdba3a33b4aa617a86db5f9bc067e71c2c7fb7c9e98c79605af611c6623e3b72dad9e3932e0c1aa033fc2de580ee57bfd567795c6e86e9bea165309af6d902510e6e1f70b44cf0c20082fe1a464ab42fd19887091fc29afcc5f19c60a019b423f1b9031e14ba65b57f0c6037be36bec05fa55cd589e42fa866784259a4f7baffb2a9a1e6a2521e56b9914b2c"}], 0x1010, 0x8004}, 0x4000) mmap(&(0x7f00009d8000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$DRM_IOCTL_ADD_BUFS(r0, 0xc0206416, &(0x7f00009d8000)={0x9, 0xffffffff00000001, 0x80000002, 0xac, 0xf, 0xc00}) mmap(&(0x7f00009d9000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f00009da000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) openat$selinux_status(0xffffffffffffff9c, &(0x7f00009da000)='/selinux/status\x00', 0x0, 0x0) mmap(&(0x7f00009d9000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f00009d9000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f00009da000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f00009da000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) getsockname$unix(r0, &(0x7f00009db000-0x6e)=@file={0x0, ""/108}, &(0x7f00009db000-0x3)=0x6e) mmap(&(0x7f00009d9000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(r0, 0x29, 0x22, &(0x7f00009d9000)={{{@in=@dev={0x0, 0x0, 0xffffffffffffffff, 0x0}, @in=@loopback=0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, {0x0, 0x0, 0x0, 0x0}, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, {{@in=@rand_addr=0x0, 0xffffffffffffffff, 0x0}, 0x0, @in=@multicast2=0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, &(0x7f00009d9000)=0xe8) mmap(&(0x7f00009d9000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) getgroups(0x1, &(0x7f00009d9000)=[0xffffffffffffffff]) syz_fuseblk_mount(&(0x7f00009d9000)='./file0\x00', &(0x7f00009d9000)='./file0\x00', 0xe000, r1, r2, 0x10001, 0xfffffffffffffffe, 0x200040) open$dir(&(0x7f00008f2000)='./file0\x00', 0x200100, 0x1d9) 2018/02/01 04:11:31 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$inet_msfilter(r0, 0x0, 0x29, &(0x7f0000aad000)={@dev={0xac, 0x14, 0x0, 0x16}, @dev={0xac, 0x14, 0x0, 0x15}, 0x1, 0x1, [@loopback=0x7f000001]}, 0x14) sendto$inet(r0, &(0x7f0000022000-0x16)="01", 0x1, 0x0, &(0x7f0000031000-0x10)={0x2, 0xffffffffffffffff, @local={0xac, 0x14, 0xffffffffffffffff, 0xaa}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x10) shutdown(r0, 0x1) 2018/02/01 04:11:31 executing program 1: openat$ion(0xffffffffffffff9c, &(0x7f0000115000-0x9)='/dev/ion\x00', 0x2, 0x0) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) syz_open_dev$sndmidi(&(0x7f0000000000)='/dev/snd/midiC#D#\x00', 0x1, 0x80) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f000015c000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0x0, 0x1) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) write$tun(0xffffffffffffffff, &(0x7f0000577000)=@pi={0x0, 0x0, @eth={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x0}, [], {@canfd={0xd, {{0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0, "feb442a1f43ead325d71fed774c8f6028c2a6b79a4e418aa3c5f391769659fef9f596cdade428c389e511eaad39d2ee4334dee9516a31d00510baaf06efc0980"}}}}}, 0x5a) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004ee000-0x76)='\x00', 0x1, 0x0, 0x0}], &(0x7f000000b000-0x30)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)=""}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00005da000)={0x0, 0x0, &(0x7f00000d8000)=[], 0x48, 0x0, &(0x7f000044c000-0x83)="a410778b7a640ab0384c4ead541b6ee57c5645909ef688d8ac3e5ecfc7039f5f8ba53f127b7f01947cd3689eaf6c090277915bab2a0c450988cb85688e2bcc101a80664d3081fcc0"}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000c5a000)={0x0, 0x0, 0x0, 0x0}) mmap(&(0x7f0000000000/0x13000)=nil, 0x13000, 0x0, 0x32, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000a95000-0x30)={0x14, 0x0, &(0x7f0000b8f000)=[@increfs_done={0x40106308, r3, 0x1}], 0x0, 0x0, &(0x7f00002e4000-0x70)=""}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000436000-0x30)={0x20, 0x0, &(0x7f0000136000)=[@dead_binder_done={0x40086310, 0x3}, @increfs_done={0x40106308, r3, 0x0}], 0x0, 0x0, &(0x7f0000888000-0xb)=""}) 2018/02/01 04:11:31 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00001ea000)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r0, &(0x7f00000a4000-0x1010)={0xf97cff8c, 0x8, 'SE Linux', ""}, 0x10) perf_event_open(&(0x7f000001d000)={0x2, 0x78, 0xe2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000)=0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x2d, &(0x7f0000ae4000-0xc1)={@local={[0xaa, 0xaa, 0xaa, 0xaa], 0x0, 0xaa}, @dev={[0xaa, 0xaa, 0xaa, 0xaa], 0xffffffffffffffff, 0x0}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1f, 0xffffffffffffffff, 0x0, 0x0, 0x2f, 0x0, @rand_addr=0x0, @multicast1=0xe0000001, {[]}}, @igmp={0x0, 0x0, 0x0, @multicast1=0xe0000001, "00c0cf"}}}}}, &(0x7f0000adb000-0xc)={0x0, 0x1, [0x0]}) write(r0, &(0x7f00000f9000-0x2f)="", 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x40049409, 0xffffffffffffffff) r1 = open(&(0x7f0000f9b000-0x8)='./file0\x00', 0x8000000000141046, 0x0) mount(&(0x7f0000ae2000+0xd7d)='./file0/file0\x00', &(0x7f0000c1c000-0x8)='./file0\x00', &(0x7f0000a6f000)='nfs4\x00', 0x0, &(0x7f0000dee000-0xd1)='vs') ioctl$PPPIOCGCHAN(r1, 0x80047437, &(0x7f0000b18000-0x4)=0x0) getsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000977000)={0x0, 0x9, 0x0, 0x0}, &(0x7f0000eed000)=0x10) setsockopt$packet_buf(r1, 0x107, 0x0, &(0x7f0000c4c000)="e9e6f19eaf4a3bd110afebcb5b2ab609a0527a0b3374551c", 0x18) fcntl$getflags(r1, 0x0) getsockopt$inet_sctp6_SCTP_ADAPTATION_LAYER(r1, 0x84, 0x7, &(0x7f0000d05000-0x4)={0x0}, &(0x7f00007cb000)=0x4) 2018/02/01 04:11:31 executing program 2: openat$ion(0xffffffffffffff9c, &(0x7f0000801000-0x9)='/dev/ion\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000233000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = dup2(r0, r1) write$tun(0xffffffffffffffff, &(0x7f0000577000)=@pi={0x0, 0x0, @eth={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x0}, [], {@canfd={0xd, {{0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0, "feb442a1f43ead325d71fed774c8f6028c2a6b79a4e418aa3c5f391769659fef9f596cdade428c389e511eaad39d2ee4334dee9516a31d00510baaf06efc0980"}}}}}, 0x5a) r3 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004ee000-0x76)='\x00', 0x1, 0x0, 0x0}], &(0x7f000000b000-0x30)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)=""}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00005da000)={0x0, 0x0, &(0x7f00000d8000)=[], 0x48, 0x0, &(0x7f000044c000-0x83)="a410778b7a640ab0384c4ead541b6ee57c5645909ef688d8ac3e5ecfc7039f5f8ba53f127b7f01947cd3689eaf6c090277915bab2a0c450988cb85688e2bcc101a80664d3081fcc0"}) getsockopt$bt_BT_POWER(r3, 0x112, 0x9, &(0x7f0000e78000-0x1)=0x6, &(0x7f0000e1e000-0x8)=0x1) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000c5a000)={0x0, 0x0, 0x0, 0x0}) writev(r1, &(0x7f00006b7000-0x40)=[{&(0x7f0000a8c000-0xb2)="89383ebf40cc6806c622f3d9313018bcc7c7b9e54927d0f92299d6d4ab957995c6f5a0b7d3a47f5b4b4aa3b34906f4828c458ea359d1f38712814f3da653837c5812eab6ac190606efc17de729e5ec2b7be9e4384086a13efea42ee53cb9558efe2f8fa763f927115d0e5e72adb3062c601b4d2d85fb655a077395eccc0a8215040d6ceda446c211c23b316d638e85336f00ae4a7063bc9ad2661ffc4fc6c88cfb2cd6c26820ba3f488918e87141184a7373", 0xb2}, {&(0x7f000051f000-0x67)="994476c2466a915cd10756a62f77fcd2f95df792d24f658de545f205c1654d346156fca3a7a20d5f8d02b052d44aea94c16a07bced85caced5c7cb87d2b1190225337b416dfb23a0219eff11d37e905697197913d15413b8202bd8d6ba9895885a3e10cdf59e76", 0x67}, {&(0x7f0000de7000)="e5d395fdb04edc26f670c2100c2da426c16f0c94fd7518a49f75fb6e80958701b036fb492473ca4bee2abe0e583413c5bf3fc98e78289feaff0b93510048480b6d078044236bd61dbd8ca283355e92afe8150a19ff2429e73be48f6f3e345cf0e8f9dd9c5a5368dd464be2089e65de5f812a607f2031017420528c6b75ab6580e0f2b1327943b050925017ba59f2c941a7503a58fbc69327c093671e3df220", 0x9f}, {&(0x7f0000a5c000-0x6a)="d9e865e84d193dbcb7532e9d98dc65cf66dad4543a090a2460911c30556ff5269a6ef4a25554f5da1ee9dc0f715e65a7a377264464e383e5184ee70acfecbe4a5e8fe6fec3fa7289b9b9c661ef0355eaf3e3328896dfcbc88c95cf966eee45c0c1165c794b2bd6e6eb37", 0x6a}], 0x4) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(r2, 0x84, 0xf, &(0x7f0000310000)={0x0, @in={{0x2, 0x1, @remote={0xac, 0x14, 0x0, 0xbb}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x4, 0x6, 0x80, 0x100000001, 0x8000000000000}, &(0x7f000091d000-0x4)=0xa0) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r3, 0x84, 0x9, &(0x7f00007de000-0xa0)={r5, @in6={{0xa, 0x2, 0xfff, @local={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0xaa}, 0x0}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x6, 0x1, 0x4, 0x401, 0x80}, 0xa0) mmap(&(0x7f0000000000/0x13000)=nil, 0x13000, 0x0, 0x32, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000a95000-0x30)={0x14, 0x0, &(0x7f0000b8f000)=[@increfs_done={0x40106308, r4, 0x1}], 0x0, 0x0, &(0x7f00002e4000-0x70)=""}) getsockopt$inet_sctp6_SCTP_STATUS(r3, 0x84, 0xe, &(0x7f00005e9000)={r5, 0xd2d3, 0x1ff, 0x5, 0x1, 0x0, 0x4, 0x100, {r5, @in6={{0xa, 0x2, 0x6f2, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x1}, 0x7fffffff}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x7, 0xffffffffffff8000, 0x6, 0x2, 0x80000000}}, &(0x7f00001c5000-0x4)=0xb8) 2018/02/01 04:11:31 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000303000)='/dev/sequencer2\x00', 0x460000, 0x0) ioctl$PPPOEIOCSFWD(r0, 0x4008b100, &(0x7f0000591000-0x1e)={0x18, 0x0, {0x0, @random="57c8c669bc3c", @generic="809069132a044dad73c376903a10fe7b"}}) socketpair$inet6_tcp(0xa, 0x1, 0x0, &(0x7f0000242000)={0x0, 0x0}) ioctl$SNDRV_CTL_IOCTL_TLV_COMMAND(r0, 0xc008551c, &(0x7f0000e51000-0x14)={0x1, 0xc, [0x111, 0x80, 0x4]}) seccomp(0x1, 0x0, &(0x7f000089b000-0x10)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x407ffc0003}]}) shmctl$IPC_INFO(0x0, 0x3, &(0x7f0000564000)=""/4096) 2018/02/01 04:11:31 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$rtc(0xffffffffffffff9c, &(0x7f00001c8000-0x9)='/dev/rtc\x00', 0x10000, 0x0) getsockopt$netrom_NETROM_T2(r0, 0x103, 0x2, &(0x7f0000905000-0x1)=0x6, &(0x7f0000a7b000)=0x4) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) ioctl$KVM_GET_VCPU_EVENTS(r0, 0x8040ae9f, &(0x7f0000b7a000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$nl_xfrm(r1, &(0x7f0000853000-0x38)={&(0x7f0000285000-0xc)={0x10, 0x0, 0x0, 0x0}, 0xc, &(0x7f000098f000-0x10)={&(0x7f00004f7000)=@delpolicy={0x5c, 0x14, 0x301, 0xffffffffffffffff, 0xffffffffffffffff, {{@in6=@empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, @in6=@empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0xffffffffffffffff, 0x0}, [@policy_type={0xc, 0x10, {0x0, 0x0, 0x0}}]}, 0x5c}, 0x1, 0x0, 0x0, 0x0}, 0x0) 2018/02/01 04:11:31 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f0000590000-0x8)='./file0\x00', 0x14) write$selinux_create(r0, &(0x7f000074c000)=@access={'system_u:object_r:dpkg_exec_t:s0', 0x20, '/usr/sbin/cups-browsed', 0x20, 0x32, 0x30, 0x0}, 0x3b) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f00007cf000)='/dev/cuse\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_STATUS(r1, 0xc05c5340, &(0x7f0000b85000)={0x6, 0x100, 0x2, {0x0, 0x0}, 0x0, 0x4, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000801000-0x9)='/dev/ion\x00', 0x0, 0x0) r3 = syz_open_dev$binder(&(0x7f0000233000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r4 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0) r5 = dup2(r3, r4) write$tun(0xffffffffffffffff, &(0x7f0000577000)=@pi={0x0, 0x0, @eth={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x0}, [], {@canfd={0xd, {{0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0, "feb442a1f43ead325d71fed774c8f6028c2a6b79a4e418aa3c5f391769659fef9f596cdade428c389e511eaad39d2ee4334dee9516a31d00510baaf06efc0980"}}}}}, 0x5a) r6 = dup2(r4, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004ee000-0x76)='\x00', 0x1, 0x0, 0x0}], &(0x7f000000b000-0x30)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)=""}) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f00005da000)={0x0, 0x0, &(0x7f00000d8000)=[], 0x48, 0x0, &(0x7f000044c000-0x83)="a410778b7a640ab0384c4ead541b6ee57c5645909ef688d8ac3e5ecfc7039f5f8ba53f127b7f01947cd3689eaf6c090277915bab2a0c450988cb85688e2bcc101a80664d3081fcc0"}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000c5a000)={0x0, 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000a95000-0x30)={0x14, 0x0, &(0x7f0000b8f000)=[@increfs_done={0x40106308, r7, 0x1}], 0x0, 0x0, &(0x7f00002e4000-0x70)=""}) getsockopt$inet6_dccp_buf(r5, 0x21, 0xcf, &(0x7f0000e10000-0xcc)=""/204, &(0x7f000037d000-0x4)=0xcc) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000436000-0x30)={0x14, 0x0, &(0x7f0000136000)=[@increfs_done={0x40106308, 0x0, 0x0}], 0x0, 0x0, &(0x7f0000888000-0xb)=""}) close(r2) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000002000-0x38)={0x0, 0x0, &(0x7f0000003000)=[], 0x0, &(0x7f0000002000)=[{0x10, 0x10e, 0x0, ""}], 0x10, 0x0}, 0x0) [ 311.610536] binder: undelivered TRANSACTION_ERROR: 29189 [ 311.666469] SELinux: failed to load policy 2018/02/01 04:11:31 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) seccomp(0x1, 0x0, &(0x7f000089b000-0x10)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x407ffc0003}]}) shmctl$IPC_INFO(0x0, 0x3, &(0x7f0000564000)=""/4096) r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000b0c000-0xb)='/dev/hwrng\x00', 0x2000, 0x0) ioctl$DRM_IOCTL_MARK_BUFS(r0, 0x40206417, &(0x7f0000be2000-0x20)={0x9, 0x100000001, 0x0, 0x0, 0x4, 0x3}) ioctl$EVIOCGBITKEY(r0, 0x80404521, &(0x7f0000903000)=""/138) getsockopt$inet_sctp_SCTP_EVENTS(r0, 0x84, 0xb, &(0x7f0000fc8000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f0000c74000)=0xb) 2018/02/01 04:11:31 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f0000590000-0x8)='./file0\x00', 0x14) write$selinux_create(r0, &(0x7f000074c000)=@access={'system_u:object_r:dpkg_exec_t:s0', 0x20, '/usr/sbin/cups-browsed', 0x20, 0x32, 0x30, 0x0}, 0x3b) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f00007cf000)='/dev/cuse\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_STATUS(r1, 0xc05c5340, &(0x7f0000b85000)={0x6, 0x100, 0x2, {0x0, 0x0}, 0x0, 0x4, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000801000-0x9)='/dev/ion\x00', 0x0, 0x0) r3 = syz_open_dev$binder(&(0x7f0000233000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r4 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0) r5 = dup2(r3, r4) write$tun(0xffffffffffffffff, &(0x7f0000577000)=@pi={0x0, 0x0, @eth={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x0}, [], {@canfd={0xd, {{0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0, "feb442a1f43ead325d71fed774c8f6028c2a6b79a4e418aa3c5f391769659fef9f596cdade428c389e511eaad39d2ee4334dee9516a31d00510baaf06efc0980"}}}}}, 0x5a) r6 = dup2(r4, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004ee000-0x76)='\x00', 0x1, 0x0, 0x0}], &(0x7f000000b000-0x30)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)=""}) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f00005da000)={0x0, 0x0, &(0x7f00000d8000)=[], 0x48, 0x0, &(0x7f000044c000-0x83)="a410778b7a640ab0384c4ead541b6ee57c5645909ef688d8ac3e5ecfc7039f5f8ba53f127b7f01947cd3689eaf6c090277915bab2a0c450988cb85688e2bcc101a80664d3081fcc0"}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000c5a000)={0x0, 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000a95000-0x30)={0x14, 0x0, &(0x7f0000b8f000)=[@increfs_done={0x40106308, r7, 0x1}], 0x0, 0x0, &(0x7f00002e4000-0x70)=""}) getsockopt$inet6_dccp_buf(r5, 0x21, 0xcf, &(0x7f0000e10000-0xcc)=""/204, &(0x7f000037d000-0x4)=0xcc) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000436000-0x30)={0x14, 0x0, &(0x7f0000136000)=[@increfs_done={0x40106308, 0x0, 0x0}], 0x0, 0x0, &(0x7f0000888000-0xb)=""}) close(r2) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000002000-0x38)={0x0, 0x0, &(0x7f0000003000)=[], 0x0, &(0x7f0000002000)=[{0x10, 0x10e, 0x0, ""}], 0x10, 0x0}, 0x0) 2018/02/01 04:11:31 executing program 1: openat$ion(0xffffffffffffff9c, &(0x7f0000801000-0x9)='/dev/ion\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000233000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(0xffffffffffffffff, 0x84, 0x75, &(0x7f000050a000-0x8)={0x0, 0x7}, &(0x7f00004a7000)=0x8) setsockopt$inet_sctp_SCTP_SET_PEER_PRIMARY_ADDR(r1, 0x84, 0x5, &(0x7f00003e1000-0x8c)={r2, @in6={{0xa, 0x0, 0x100000001, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0xf}, 0x8000000000000000}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}}, 0x8c) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r3 = dup2(r0, r1) write$tun(0xffffffffffffffff, &(0x7f0000577000)=@pi={0x0, 0x0, @eth={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x0}, [], {@canfd={0xd, {{0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0, "feb442a1f43ead325d71fed774c8f6028c2a6b79a4e418aa3c5f391769659fef9f596cdade428c389e511eaad39d2ee4334dee9516a31d00510baaf06efc0980"}}}}}, 0x5a) r4 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004ee000-0x76)='\x00', 0x1, 0x0, 0x0}], &(0x7f000000b000-0x30)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)=""}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00005da000)={0x0, 0x0, &(0x7f00000d8000)=[], 0x48, 0x0, &(0x7f000044c000-0x83)="a410778b7a640ab0384c4ead541b6ee57c5645909ef688d8ac3e5ecfc7039f5f8ba53f127b7f01947cd3689eaf6c090277915bab2a0c450988cb85688e2bcc101a80664d3081fcc0"}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000c5a000)={0x0, 0x0, 0x0, 0x0}) mmap(&(0x7f0000000000/0x13000)=nil, 0x13000, 0x0, 0x32, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000a95000-0x30)={0xdc, 0x0, &(0x7f0000943000)=[@decrefs={0x40046307, 0x2}, @transaction={0x40406300, {0x3, 0x0, 0x20000000003, 0x0, 0x11, 0x0, 0x0, 0x0, 0x30, &(0x7f0000515000)=[], &(0x7f0000a17000)=[0x48, 0x18, 0x48, 0x30, 0x20, 0x38]}}, @enter_looper={0x630c}, @reply_sg={0x40486312, {{0x2, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x18, 0x18, &(0x7f000040e000-0x18)=[@fd={0x66642a85, 0x0, r0, 0x0, 0x0}], &(0x7f0000cd0000)=[0x38, 0x20, 0x78]}, 0xff}}, @reply_sg={0x40486312, {{0x0, 0x0, 0x3, 0x0, 0x10, 0x0, 0x0, 0x18, 0x18, &(0x7f0000263000-0x18)=[@fd={0x66642a85, 0x0, r3, 0x0, 0x0}], &(0x7f000082c000)=[0x48, 0x20, 0x38]}, 0x6}}, @reply={0x40406301, {0x4, 0x0, 0x4, 0x0, 0x11, 0x0, 0x0, 0x38, 0x20, &(0x7f0000a4d000)=[@flat={0x77682a85, 0x1, r5, 0x3}, @fda={0x66646185, 0x6, 0x2, 0x35}], &(0x7f00001b4000)=[0x68, 0x38, 0x0, 0x40]}}, @free_buffer={0x40086303, r5}, @clear_death={0x400c630f, 0x0, 0x2}], 0x0, 0x0, &(0x7f00002e4000-0x70)=""}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000436000-0x30)={0x20, 0x0, &(0x7f0000136000)=[@dead_binder_done={0x40086310, 0x3}, @increfs_done={0x40106308, r5, 0x0}], 0x0, 0x0, &(0x7f0000888000-0xb)=""}) [ 311.690251] binder: BINDER_SET_CONTEXT_MGR already set [ 311.690259] binder: 16012:16017 ioctl 40046207 0 returned -16 2018/02/01 04:11:31 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r0, &(0x7f0000022000-0x16)="01", 0x1, 0x0, &(0x7f0000031000-0x10)={0x2, 0xffffffffffffffff, @local={0xac, 0x14, 0xffffffffffffffff, 0xaa}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x10) shutdown(r0, 0x1) 2018/02/01 04:11:31 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000)=0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cuse\x00', 0x1, 0x0) fstat(0xffffffffffffffff, &(0x7f0000f5f000-0x44)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) getpgrp(0xffffffffffffffff) set_robust_list(&(0x7f00008d6000+0x60f)={&(0x7f0000482000/0x3000)=nil, 0x0, &(0x7f0000d76000/0x2000)=nil}, 0x18) getpgrp(0x0) getresuid(&(0x7f0000a6d000-0x4)=0x0, &(0x7f0000ae3000)=0x0, &(0x7f0000d7d000-0x4)=0x0) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0x7, &(0x7f00000b0000)={0x0, 0x0, 0x0, 0x0}, 0x10) ioctl$KVM_SIGNAL_MSI(r0, 0x4020aea5, &(0x7f0000ebc000-0x20)={0xd000, 0x4, 0x6, 0xef1, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) write$fuse(r0, &(0x7f000000b000-0x21)={0x28, 0x2, 0x0, @fuse_notify_inval_inode_out={0x0, 0x0, 0x0}}, 0x28) 2018/02/01 04:11:31 executing program 2: openat$ion(0xffffffffffffff9c, &(0x7f0000801000-0x9)='/dev/ion\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000d99000-0x18)='/selinux/avc/hash_stats\x00', 0x0, 0x0) ioctl$TIOCGSOFTCAR(r0, 0x5419, &(0x7f0000b45000-0x4)=0x0) r1 = syz_open_dev$binder(&(0x7f0000233000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) dup2(r1, r2) write$tun(0xffffffffffffffff, &(0x7f0000577000)=@pi={0x0, 0x0, @eth={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x0}, [], {@canfd={0xd, {{0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0, "feb442a1f43ead325d71fed774c8f6028c2a6b79a4e418aa3c5f391769659fef9f596cdade428c389e511eaad39d2ee4334dee9516a31d00510baaf06efc0980"}}}}}, 0x5a) r3 = dup2(r2, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004ee000-0x76)='\x00', 0x1, 0x0, 0x0}], &(0x7f000000b000-0x30)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)=""}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00005da000)={0x0, 0x0, &(0x7f00000d8000)=[], 0x48, 0x0, &(0x7f000044c000-0x83)="a410778b7a640ab0384c4ead541b6ee57c5645909ef688d8ac3e5ecfc7039f5f8ba53f127b7f01947cd3689eaf6c090277915bab2a0c450988cb85688e2bcc101a80664d3081fcc0"}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000c5a000)={0x0, 0x0, 0x0, 0x0}) mmap(&(0x7f0000000000/0x13000)=nil, 0x13000, 0x0, 0x32, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000a95000-0x30)={0x14, 0x0, &(0x7f0000b8f000)=[@increfs_done={0x40106308, r4, 0x1}], 0x0, 0x0, &(0x7f00002e4000-0x70)=""}) [ 311.690601] binder_alloc: 16007: binder_alloc_buf, no vma [ 311.690622] binder: 16012:16017 transaction failed 29189/-3, size 40-8 line 2903 2018/02/01 04:11:31 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f0000590000-0x8)='./file0\x00', 0x14) write$selinux_create(r0, &(0x7f000074c000)=@access={'system_u:object_r:dpkg_exec_t:s0', 0x20, '/usr/sbin/cups-browsed', 0x20, 0x32, 0x30, 0x0}, 0x3b) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f00007cf000)='/dev/cuse\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_STATUS(r1, 0xc05c5340, &(0x7f0000b85000)={0x6, 0x100, 0x2, {0x0, 0x0}, 0x0, 0x4, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000801000-0x9)='/dev/ion\x00', 0x0, 0x0) r3 = syz_open_dev$binder(&(0x7f0000233000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r4 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0) r5 = dup2(r3, r4) write$tun(0xffffffffffffffff, &(0x7f0000577000)=@pi={0x0, 0x0, @eth={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x0}, [], {@canfd={0xd, {{0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0, "feb442a1f43ead325d71fed774c8f6028c2a6b79a4e418aa3c5f391769659fef9f596cdade428c389e511eaad39d2ee4334dee9516a31d00510baaf06efc0980"}}}}}, 0x5a) r6 = dup2(r4, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004ee000-0x76)='\x00', 0x1, 0x0, 0x0}], &(0x7f000000b000-0x30)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)=""}) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f00005da000)={0x0, 0x0, &(0x7f00000d8000)=[], 0x48, 0x0, &(0x7f000044c000-0x83)="a410778b7a640ab0384c4ead541b6ee57c5645909ef688d8ac3e5ecfc7039f5f8ba53f127b7f01947cd3689eaf6c090277915bab2a0c450988cb85688e2bcc101a80664d3081fcc0"}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000c5a000)={0x0, 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000a95000-0x30)={0x14, 0x0, &(0x7f0000b8f000)=[@increfs_done={0x40106308, r7, 0x1}], 0x0, 0x0, &(0x7f00002e4000-0x70)=""}) getsockopt$inet6_dccp_buf(r5, 0x21, 0xcf, &(0x7f0000e10000-0xcc)=""/204, &(0x7f000037d000-0x4)=0xcc) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000436000-0x30)={0x14, 0x0, &(0x7f0000136000)=[@increfs_done={0x40106308, 0x0, 0x0}], 0x0, 0x0, &(0x7f0000888000-0xb)=""}) close(r2) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000002000-0x38)={0x0, 0x0, &(0x7f0000003000)=[], 0x0, &(0x7f0000002000)=[{0x10, 0x10e, 0x0, ""}], 0x10, 0x0}, 0x0) 2018/02/01 04:11:31 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$sock_linger(r0, 0x1, 0xd, &(0x7f00003d2000)={0x0, 0x0}, &(0x7f0000811000)=0x8) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000cc7000)='/dev/sequencer2\x00', 0x2000, 0x0) ioctl$KVM_CREATE_DEVICE(r1, 0xc00caee0, &(0x7f00006ae000-0xc)={0x6, r0, 0x1}) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000509000-0xb)='/dev/hwrng\x00', 0x298202, 0x0) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000ca2000)={r2, 0x50, &(0x7f00004c8000-0x50)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16}}, 0x10) sendto$inet(r0, &(0x7f0000022000-0x16)="01", 0x1, 0x0, &(0x7f0000031000-0x10)={0x2, 0xffffffffffffffff, @local={0xac, 0x14, 0xffffffffffffffff, 0xaa}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x10) shutdown(r0, 0x1) [ 311.692777] binder: send failed reply for transaction 1658 to 16007:16011 [ 311.693219] binder: 16004:16016 transaction failed 29189/-22, size 40-8 line 2788 [ 311.696286] binder: 16004:16016 BC_INCREFS_DONE u0000000000000000 no match [ 311.696440] binder: 16004:16016 BC_DEAD_BINDER_DONE 0000000000000003 not found [ 311.696450] binder: 16004:16016 BC_INCREFS_DONE u0000000000000000 no match [ 311.727834] binder: 16004:16022 BC_DEAD_BINDER_DONE 0000000000000003 not found [ 311.727848] binder: 16004:16022 BC_INCREFS_DONE u00000000204edf8a node 1670 cookie mismatch 0000000000000000 != 0000000000000001 [ 311.728433] binder: 16004:16016 BC_INCREFS_DONE node 1670 has no pending increfs request [ 311.736124] binder: undelivered TRANSACTION_ERROR: 29189 [ 311.744705] binder: 16007:16011 BC_INCREFS_DONE node 1667 has no pending increfs request [ 311.746117] binder: release 16004:16016 transaction 1669 out, still active [ 311.746124] binder: unexpected work type, 4, not freed [ 311.746128] binder: undelivered TRANSACTION_COMPLETE [ 311.746210] binder: send failed reply for transaction 1666 to 16007:16011 [ 311.746223] binder: send failed reply for transaction 1669, target dead [ 311.747262] NFS: bad mount option value specified: vs [ 311.774308] binder: undelivered TRANSACTION_COMPLETE [ 311.774318] binder: undelivered TRANSACTION_ERROR: 29189 [ 311.775883] binder: undelivered TRANSACTION_COMPLETE [ 311.775892] binder: undelivered TRANSACTION_ERROR: 29189 [ 311.803441] binder: 16027:16028 transaction failed 29189/-22, size 40-8 line 2788 [ 311.813142] binder: 16029:16037 DecRefs 0 refcount change on invalid ref 2 ret -22 [ 311.813153] binder: 16029:16037 got transaction to invalid handle [ 311.813166] binder: 16029:16037 transaction failed 29201/-22, size 0-48 line 2788 [ 311.813285] binder: send failed reply for transaction 1675 to 16029:16037 [ 311.823067] binder: send failed reply for transaction 1680 to 16035:16039 [ 311.830725] NFS: bad mount option value specified: vs [ 311.842433] binder: undelivered TRANSACTION_ERROR: 29189 [ 311.856841] binder: send failed reply for transaction 1684 to 16029:16037 [ 311.862881] binder: 16029:16037 DecRefs 0 refcount change on invalid ref 2 ret -22 [ 311.862893] binder: 16029:16037 got transaction to invalid handle [ 311.862902] binder: 16029:16037 transaction failed 29201/-22, size 0-48 line 2788 [ 311.862956] binder: 16029:16046 BC_DEAD_BINDER_DONE 0000000000000003 not found [ 311.862966] binder: 16029:16046 BC_INCREFS_DONE u00000000204edf8a no match [ 311.869242] binder_alloc: 16035: binder_alloc_buf, no vma [ 311.869270] binder: 16035:16039 transaction failed 29189/-3, size 40-8 line 2903 [ 311.872334] binder: BINDER_SET_CONTEXT_MGR already set [ 311.872344] binder: 16048:16052 ioctl 40046207 0 returned -16 [ 311.887961] binder: 16048:16052 transaction failed 29189/-22, size 40-8 line 2788 [ 311.889101] binder: undelivered TRANSACTION_COMPLETE [ 311.889112] binder: undelivered TRANSACTION_ERROR: 29189 [ 311.889116] binder: undelivered TRANSACTION_ERROR: 29201 [ 311.889147] binder: undelivered TRANSACTION_COMPLETE [ 311.889154] binder: undelivered TRANSACTION_ERROR: 29201 [ 311.889157] binder: undelivered TRANSACTION_ERROR: 29189 [ 311.889298] binder: undelivered TRANSACTION_COMPLETE [ 311.889305] binder: undelivered TRANSACTION_ERROR: 29189 [ 311.889363] binder: undelivered TRANSACTION_ERROR: 29189 [ 311.900781] binder: undelivered TRANSACTION_ERROR: 29189 [ 312.221580] syz-executor3: vmalloc: allocation failure: 0 bytes, mode:0x14000c0(GFP_KERNEL), nodemask=(null) [ 312.232231] syz-executor3 cpuset=/ mems_allowed=0 [ 312.237288] CPU: 0 PID: 16024 Comm: syz-executor3 Not tainted 4.15.0+ #290 [ 312.244298] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 312.253639] Call Trace: [ 312.256230] dump_stack+0x194/0x257 [ 312.259870] ? arch_local_irq_restore+0x53/0x53 [ 312.264529] ? idr_get_free_cmn+0xfd0/0xfd0 [ 312.268890] warn_alloc+0x19a/0x2b0 [ 312.272525] ? zone_watermark_ok_safe+0x400/0x400 [ 312.277361] ? avc_has_perm+0x43e/0x680 [ 312.281347] ? avc_has_perm_noaudit+0x520/0x520 [ 312.286019] ? lock_acquire+0x1d5/0x580 [ 312.289992] ? __fdget_pos+0x12b/0x190 [ 312.293914] __vmalloc_node_range+0x4f0/0x650 [ 312.298452] vmalloc+0x45/0x50 [ 312.301642] ? sel_write_load+0x1f5/0x1910 [ 312.305876] sel_write_load+0x1f5/0x1910 [ 312.309979] ? mutex_lock_io_nested+0x1900/0x1900 [ 312.314821] ? sel_read_bool+0x250/0x250 [ 312.318877] ? lock_release+0xa40/0xa40 [ 312.322862] ? __lock_is_held+0xb6/0x140 [ 312.326962] ? check_noncircular+0x20/0x20 [ 312.331193] ? __fget+0x35c/0x570 [ 312.334674] ? iterate_fd+0x3f0/0x3f0 [ 312.338466] ? mark_held_locks+0xaf/0x100 [ 312.342616] ? check_noncircular+0x20/0x20 [ 312.346846] ? __lock_is_held+0xb6/0x140 [ 312.350933] ? fd_install+0x4d/0x60 [ 312.354620] ? sel_read_bool+0x250/0x250 [ 312.358674] __vfs_write+0xef/0x970 [ 312.362292] ? lock_acquire+0x1d5/0x580 [ 312.366267] ? lock_acquire+0x1d5/0x580 [ 312.370234] ? vfs_write+0x407/0x510 [ 312.373952] ? kernel_read+0x120/0x120 [ 312.377862] ? __lock_is_held+0xb6/0x140 [ 312.381963] ? rcu_read_lock_sched_held+0x108/0x120 [ 312.386976] ? rcu_sync_lockdep_assert+0x6d/0xb0 [ 312.391728] ? __sb_start_write+0x209/0x2a0 [ 312.396059] vfs_write+0x189/0x510 [ 312.399618] SyS_write+0xef/0x220 [ 312.403079] ? SyS_read+0x220/0x220 [ 312.406696] ? trace_hardirqs_on_caller+0x421/0x5c0 [ 312.411715] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 312.416498] entry_SYSCALL_64_fastpath+0x29/0xa0 [ 312.422724] RIP: 0033:0x453299 [ 312.425904] RSP: 002b:00007f86033cbc58 EFLAGS: 00000212 ORIG_RAX: 0000000000000001 [ 312.433614] RAX: ffffffffffffffda RBX: 000000000071c010 RCX: 0000000000453299 [ 312.440877] RDX: 0000000000000000 RSI: 00000000200f8fd1 RDI: 0000000000000017 [ 312.448138] RBP: 00000000000003d6 R08: 0000000000000000 R09: 0000000000000000 [ 312.455403] R10: 0000000000000000 R11: 0000000000000212 R12: 00000000006f4cb0 [ 312.462664] R13: 00000000ffffffff R14: 00007f86033cc6d4 R15: 0000000000000006 [ 312.470227] warn_alloc_show_mem: 1 callbacks suppressed [ 312.470232] Mem-Info: [ 312.480831] active_anon:89255 inactive_anon:66 isolated_anon:0 [ 312.480831] active_file:5603 inactive_file:9340 isolated_file:0 [ 312.480831] unevictable:0 dirty:241 writeback:0 unstable:0 [ 312.480831] slab_reclaimable:9158 slab_unreclaimable:94952 [ 312.480831] mapped:24346 shmem:79 pagetables:701 bounce:0 [ 312.480831] free:1394796 free_pcp:507 free_cma:0 [ 312.514865] Node 0 active_anon:357020kB inactive_anon:264kB active_file:22412kB inactive_file:37360kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:97384kB dirty:964kB writeback:0kB shmem:316kB shmem_thp: 0kB shmem_pmdmapped: 0kB anon_thp: 290816kB writeback_tmp:0kB unstable:0kB all_unreclaimable? no [ 312.544418] Node 0 DMA free:15908kB min:164kB low:204kB high:244kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15908kB mlocked:0kB kernel_stack:0kB pagetables:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 312.571208] lowmem_reserve[]: 0 2868 6378 6378 [ 312.576352] Node 0 DMA32 free:2939140kB min:30316kB low:37892kB high:45468kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:3129292kB managed:2939968kB mlocked:0kB kernel_stack:0kB pagetables:0kB bounce:0kB free_pcp:828kB local_pcp:132kB free_cma:0kB [ 312.605076] lowmem_reserve[]: 0 0 3510 3510 [ 312.609948] Node 0 Normal free:2624136kB min:37100kB low:46372kB high:55644kB active_anon:357020kB inactive_anon:264kB active_file:22412kB inactive_file:37360kB unevictable:0kB writepending:964kB present:4718592kB managed:3594332kB mlocked:0kB kernel_stack:4224kB pagetables:2804kB bounce:0kB free_pcp:1196kB local_pcp:568kB free_cma:0kB [ 312.641270] lowmem_reserve[]: 0 0 0 0 [ 312.645918] Node 0 DMA: 1*4kB (U) 0*8kB 0*16kB 1*32kB (U) 2*64kB (U) 1*128kB (U) 1*256kB (U) 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15908kB [ 312.660256] Node 0 DMA32: 1*4kB (M) 2*8kB (UM) 3*16kB (UM) 2*32kB (M) 2*64kB (UM) 2*128kB (M) 3*256kB (UM) 4*512kB (UM) 3*1024kB (UM) 2*2048kB (UM) 715*4096kB (M) = 2939140kB [ 312.677062] Node 0 Normal: 1442*4kB (UME) 2845*8kB (UME) 1501*16kB (UME) 1085*32kB (UME) 603*64kB (UME) 149*128kB (UME) 18*256kB (UM) 13*512kB (UME) 4*1024kB (UME) 5*2048kB (UM) 599*4096kB (UM) = 2624032kB [ 312.696288] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=2048kB [ 312.705519] 15021 total pagecache pages [ 312.710125] 0 pages in swap cache [ 312.714240] Swap cache stats: add 0, delete 0, find 0/0 [ 312.720138] Free swap = 0kB [ 312.723760] Total swap = 0kB [ 312.727291] 1965969 pages RAM [ 312.731279] 0 pages HighMem/MovableOnly [ 312.735968] 328417 pages reserved [ 312.740883] syz-executor3: vmalloc: allocation failure: 0 bytes, mode:0x14000c0(GFP_KERNEL), nodemask=(null) [ 312.752081] syz-executor3 cpuset=/ mems_allowed=0 [ 312.757082] CPU: 0 PID: 16019 Comm: syz-executor3 Not tainted 4.15.0+ #290 [ 312.764087] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 312.773431] Call Trace: [ 312.776020] dump_stack+0x194/0x257 [ 312.779660] ? arch_local_irq_restore+0x53/0x53 [ 312.784319] ? idr_get_free_cmn+0xfd0/0xfd0 [ 312.788682] warn_alloc+0x19a/0x2b0 [ 312.792320] ? zone_watermark_ok_safe+0x400/0x400 [ 312.797159] ? avc_has_perm+0x43e/0x680 [ 312.801150] ? avc_has_perm_noaudit+0x520/0x520 [ 312.805822] ? __mutex_lock+0x5bd/0x1a80 [ 312.809886] ? lock_downgrade+0x980/0x980 [ 312.814035] ? debug_mutex_add_waiter+0x250/0x250 [ 312.818905] __vmalloc_node_range+0x4f0/0x650 [ 312.823405] ? debug_mutex_wake_waiter+0x670/0x670 [ 312.828329] ? mutex_destroy+0x1d0/0x1d0 [ 312.832413] vmalloc+0x45/0x50 [ 312.835608] ? sel_write_load+0x1f5/0x1910 [ 312.839839] sel_write_load+0x1f5/0x1910 [ 312.843947] ? mutex_lock_io_nested+0x1900/0x1900 [ 312.848794] ? sel_read_bool+0x250/0x250 [ 312.852852] ? lock_release+0xa40/0xa40 [ 312.856838] ? __lock_is_held+0xb6/0x140 [ 312.860942] ? check_noncircular+0x20/0x20 [ 312.865190] ? __fget+0x35c/0x570 [ 312.868673] ? iterate_fd+0x3f0/0x3f0 [ 312.872482] ? check_noncircular+0x20/0x20 [ 312.876717] ? __lock_is_held+0xb6/0x140 [ 312.880837] ? sel_read_bool+0x250/0x250 [ 312.884892] __vfs_write+0xef/0x970 [ 312.888510] ? lock_acquire+0x1d5/0x580 [ 312.892475] ? lock_acquire+0x1d5/0x580 [ 312.896447] ? vfs_write+0x407/0x510 [ 312.900163] ? kernel_read+0x120/0x120 [ 312.904069] ? __lock_is_held+0xb6/0x140 [ 312.908174] ? rcu_read_lock_sched_held+0x108/0x120 [ 312.913191] ? rcu_sync_lockdep_assert+0x6d/0xb0 [ 312.917945] ? __sb_start_write+0x209/0x2a0 [ 312.922283] vfs_write+0x189/0x510 [ 312.925840] SyS_write+0xef/0x220 [ 312.929305] ? SyS_read+0x220/0x220 [ 312.932928] ? trace_hardirqs_on_caller+0x421/0x5c0 [ 312.937945] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 312.942730] entry_SYSCALL_64_fastpath+0x29/0xa0 [ 312.947477] RIP: 0033:0x453299 [ 312.950658] RSP: 002b:00007f86033ecc58 EFLAGS: 00000212 ORIG_RAX: 0000000000000001 [ 312.958367] RAX: ffffffffffffffda RBX: 000000000071bf58 RCX: 0000000000453299 [ 312.965629] RDX: 0000000000000000 RSI: 00000000200f8fd1 RDI: 0000000000000013 [ 312.972890] RBP: 0000000000000609 R08: 0000000000000000 R09: 0000000000000000 [ 312.980151] R10: 0000000000000000 R11: 0000000000000212 R12: 00000000006f8178 [ 312.987412] R13: 00000000ffffffff R14: 00007f86033ed6d4 R15: 0000000000000003 [ 312.996214] SELinux: failed to load policy 2018/02/01 04:11:33 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_PKTINFO(r0, 0x10e, 0x3, &(0x7f0000fbd000)=0x72, 0x4) write(r0, &(0x7f0000569000)="1f0000001a001bf200001321fdf3167600041d0100008d3d93391a0001454a", 0x400) recvmmsg(r0, &(0x7f0000659000)=[{{&(0x7f0000989000-0x14)=@ll={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @local={[0x0, 0x0, 0x0, 0x0], 0x0, 0x0}, [0x0, 0x0]}, 0x14, &(0x7f0000632000-0x10)=[], 0x0, &(0x7f0000eec000)=""/167, 0xa7, 0x0}, 0x0}], 0x1, 0x0, 0x0) 2018/02/01 04:11:33 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) seccomp(0x1, 0x0, &(0x7f000089b000-0x10)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x407ffc0003}]}) r0 = syz_open_dev$dmmidi(&(0x7f0000a51000)='/dev/dmmidi#\x00', 0x8dca, 0x200000) getsockopt$inet_sctp6_SCTP_LOCAL_AUTH_CHUNKS(0xffffffffffffff9c, 0x84, 0x1b, &(0x7f0000286000-0x99)={0x0, 0x91, "8d7d549a8b2a2232c21d22ff98a739efef075bb7a0164de51ba118f745e01ca269ef8d79ab9c02f8619a07c0e479b68ce5cffd008558b447a39eff8ffc99486cf83bec2569534966555611f4ae3a6c7ee3855547d38529af6fcdc71d2f325dd2a6318cd214b78ebafb51d9752cdd09f4b55a2e06a00f82946f764e3e235767cbb96d66ac2a56a25c2ae78bee4c1b1ce06a"}, &(0x7f000090b000)=0x99) setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r0, 0x84, 0x1f, &(0x7f00006bc000-0x98)={r1, @in6={{0xa, 0x1, 0xfffffffffffffffe, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x1}, 0x7}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x201, 0x8}, 0x98) ioctl$DRM_IOCTL_AGP_ACQUIRE(r0, 0x6430) shmctl$IPC_INFO(0x0, 0x3, &(0x7f0000564000)=""/4096) 2018/02/01 04:11:33 executing program 2: openat$ion(0xffffffffffffff9c, &(0x7f0000801000-0x9)='/dev/ion\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000233000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$sndmidi(&(0x7f00002b8000-0x12)='/dev/snd/midiC#D#\x00', 0x7fff, 0x80) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_INFO(r2, 0xc10c5541, &(0x7f000000a000-0x10c)={0xff, 0x3, 0x5, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x8, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) dup2(r0, r1) write$tun(0xffffffffffffffff, &(0x7f0000577000)=@pi={0x0, 0x0, @eth={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x0}, [], {@canfd={0xd, {{0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0, "feb442a1f43ead325d71fed774c8f6028c2a6b79a4e418aa3c5f391769659fef9f596cdade428c389e511eaad39d2ee4334dee9516a31d00510baaf06efc0980"}}}}}, 0x5a) r3 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004ee000-0x76)='\x00', 0x1, 0x0, 0x0}], &(0x7f000000b000-0x30)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)=""}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00005da000)={0x0, 0x0, &(0x7f00000d8000)=[], 0x48, 0x0, &(0x7f000044c000-0x83)="a410778b7a640ab0384c4ead541b6ee57c5645909ef688d8ac3e5ecfc7039f5f8ba53f127b7f01947cd3689eaf6c090277915bab2a0c450988cb85688e2bcc101a80664d3081fcc0"}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000c5a000)={0x0, 0x0, 0x0, 0x0}) mmap(&(0x7f0000000000/0x13000)=nil, 0x13000, 0x0, 0x32, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000a95000-0x30)={0x14, 0x0, &(0x7f0000b8f000)=[@increfs_done={0x40106308, r4, 0x1}], 0x0, 0x0, &(0x7f00002e4000-0x70)=""}) 2018/02/01 04:11:33 executing program 1: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000801000-0x9)='/dev/ion\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$VT_OPENQRY(r0, 0x5600, &(0x7f0000063000)=0x0) r1 = syz_open_dev$binder(&(0x7f0000233000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = openat(0xffffffffffffffff, &(0x7f000063c000)='./file0\x00', 0x40000, 0x80) getsockopt$inet6_dccp_buf(r3, 0x21, 0xe, &(0x7f0000fe9000)=""/212, &(0x7f0000bde000-0x4)=0xd4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) dup2(r1, r2) write$tun(0xffffffffffffffff, &(0x7f0000577000)=@pi={0x0, 0x0, @eth={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x0}, [], {@canfd={0xd, {{0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0, "feb442a1f43ead325d71fed774c8f6028c2a6b79a4e418aa3c5f391769659fef9f596cdade428c389e511eaad39d2ee4334dee9516a31d00510baaf06efc0980"}}}}}, 0x5a) r4 = dup2(r2, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004ee000-0x76)='\x00', 0x1, 0x0, 0x0}], &(0x7f000000b000-0x30)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)=""}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00005da000)={0x0, 0x0, &(0x7f00000d8000)=[], 0x48, 0x0, &(0x7f000044c000-0x83)="a410778b7a640ab0384c4ead541b6ee57c5645909ef688d8ac3e5ecfc7039f5f8ba53f127b7f01947cd3689eaf6c090277915bab2a0c450988cb85688e2bcc101a80664d3081fcc0"}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000c5a000)={0x0, 0x0, 0x0, 0x0}) mmap(&(0x7f0000000000/0x13000)=nil, 0x13000, 0x0, 0x32, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000a95000-0x30)={0x14, 0x0, &(0x7f0000b8f000)=[@increfs_done={0x40106308, r5, 0x1}], 0x0, 0x0, &(0x7f00002e4000-0x70)=""}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000436000-0x30)={0x20, 0x0, &(0x7f0000136000)=[@dead_binder_done={0x40086310, 0x3}, @increfs_done={0x40106308, r5, 0x0}], 0x0, 0x0, &(0x7f0000888000-0xb)=""}) 2018/02/01 04:11:33 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f0000590000-0x8)='./file0\x00', 0x14) write$selinux_create(r0, &(0x7f000074c000)=@access={'system_u:object_r:dpkg_exec_t:s0', 0x20, '/usr/sbin/cups-browsed', 0x20, 0x32, 0x30, 0x0}, 0x3b) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f00007cf000)='/dev/cuse\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_STATUS(r1, 0xc05c5340, &(0x7f0000b85000)={0x6, 0x100, 0x2, {0x0, 0x0}, 0x0, 0x4, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000801000-0x9)='/dev/ion\x00', 0x0, 0x0) r3 = syz_open_dev$binder(&(0x7f0000233000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r4 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0) r5 = dup2(r3, r4) write$tun(0xffffffffffffffff, &(0x7f0000577000)=@pi={0x0, 0x0, @eth={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x0}, [], {@canfd={0xd, {{0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0, "feb442a1f43ead325d71fed774c8f6028c2a6b79a4e418aa3c5f391769659fef9f596cdade428c389e511eaad39d2ee4334dee9516a31d00510baaf06efc0980"}}}}}, 0x5a) r6 = dup2(r4, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004ee000-0x76)='\x00', 0x1, 0x0, 0x0}], &(0x7f000000b000-0x30)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)=""}) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f00005da000)={0x0, 0x0, &(0x7f00000d8000)=[], 0x48, 0x0, &(0x7f000044c000-0x83)="a410778b7a640ab0384c4ead541b6ee57c5645909ef688d8ac3e5ecfc7039f5f8ba53f127b7f01947cd3689eaf6c090277915bab2a0c450988cb85688e2bcc101a80664d3081fcc0"}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000c5a000)={0x0, 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000a95000-0x30)={0x14, 0x0, &(0x7f0000b8f000)=[@increfs_done={0x40106308, r7, 0x1}], 0x0, 0x0, &(0x7f00002e4000-0x70)=""}) getsockopt$inet6_dccp_buf(r5, 0x21, 0xcf, &(0x7f0000e10000-0xcc)=""/204, &(0x7f000037d000-0x4)=0xcc) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000436000-0x30)={0x14, 0x0, &(0x7f0000136000)=[@increfs_done={0x40106308, r7, 0x0}], 0x0, 0x0, &(0x7f0000888000-0xb)=""}) close(0xffffffffffffffff) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000002000-0x38)={0x0, 0x0, &(0x7f0000003000)=[], 0x0, &(0x7f0000002000)=[{0x10, 0x10e, 0x0, ""}], 0x10, 0x0}, 0x0) 2018/02/01 04:11:33 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) seccomp(0x1, 0x0, &(0x7f000089b000-0x10)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x407ffc0003}]}) shmctl$IPC_INFO(0x0, 0x3, &(0x7f0000564000)=""/4096) r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000b0c000-0xb)='/dev/hwrng\x00', 0x2000, 0x0) ioctl$DRM_IOCTL_MARK_BUFS(r0, 0x40206417, &(0x7f0000be2000-0x20)={0x9, 0x100000001, 0x0, 0x0, 0x4, 0x3}) ioctl$EVIOCGBITKEY(r0, 0x80404521, &(0x7f0000903000)=""/138) getsockopt$inet_sctp_SCTP_EVENTS(r0, 0x84, 0xb, &(0x7f0000fc8000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f0000c74000)=0xb) 2018/02/01 04:11:33 executing program 7: r0 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000499000-0xd)='/selinux/mls\x00', 0x0, 0x0) ioctl$KVM_SET_SREGS(r0, 0x4138ae84, &(0x7f0000c2f000-0x138)={{0xf000, 0x2000, 0xf, 0x8, 0x101, 0x7ff, 0x6, 0x7ff, 0xfffffffffffffffc, 0x6, 0x1000000, 0x100000000, 0x0}, {0xd000, 0x4, 0xd, 0xdedd, 0x5, 0x9, 0x5, 0x1, 0x81, 0x3, 0xffffffffffffff7f, 0x8, 0x0}, {0x4, 0x2000, 0x1e, 0x20, 0x5, 0x4, 0x7fffffff, 0x0, 0x1, 0x6, 0x4, 0x5, 0x0}, {0x7003, 0x7000, 0xc, 0x6, 0xff, 0x8000000000000000, 0xfffffffffffffff9, 0x7, 0x4, 0x35, 0x138b524a, 0x0, 0x0}, {0x105000, 0x5000, 0x0, 0x0, 0x9, 0x2, 0x8, 0xfffffffffffffff7, 0xffffffffffff3809, 0x6, 0x7f, 0x1000, 0x0}, {0x6000, 0x1002, 0x4, 0xb74, 0x2, 0x5, 0x4, 0x8, 0x1, 0x5, 0x4, 0x3, 0x0}, {0x4000, 0x110000, 0x10, 0x18f, 0x0, 0xfffffffffffffff8, 0x6, 0x8, 0xfff, 0x81c, 0x7ff, 0x15, 0x0}, {0x2, 0x107001, 0xd, 0x6, 0x5, 0xffff, 0x800, 0xffffffff, 0x5, 0x0, 0x1, 0x6d3a, 0x0}, {0x0, 0xf004, [0x0, 0x0, 0x0]}, {0xf000, 0x5001, [0x0, 0x0, 0x0]}, 0x80000001, 0x0, 0x16000, 0x2041, 0x5, 0x4100, 0x2000, [0x7, 0x400, 0xffe00000, 0x3]}) r1 = socket$inet_sctp(0x2, 0x5, 0x84) ioctl$SNDRV_TIMER_IOCTL_NEXT_DEVICE(r0, 0xc0145401, &(0x7f0000e46000-0x14)={0x3, 0x0, 0x7, 0x1, 0x5}) ioctl$KDSKBMODE(r0, 0x4b45, &(0x7f0000534000)=0x1) sendto$inet(r1, &(0x7f0000022000-0x16)="01", 0x1, 0x0, &(0x7f0000031000-0x10)={0x2, 0xffffffffffffffff, @local={0xac, 0x14, 0xffffffffffffffff, 0xaa}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x10) openat$ptmx(0xffffffffffffff9c, &(0x7f00007a7000)='/dev/ptmx\x00', 0x4280, 0x0) shutdown(r1, 0x1) 2018/02/01 04:11:33 executing program 3: mmap(&(0x7f0000000000/0x5eb000)=nil, 0x5eb000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f00005eb000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f00005eb000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) pipe(&(0x7f00005eb000)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00005e9000-0xb2)='\\', 0x1) writev(r1, &(0x7f00002f4000-0x20)=[{&(0x7f000031f000)="b5679da58630ca42b18cfffe32ed7199f9f4febf15613a8ed96c0c50092955e9781ca2a29a0113425f0784e84f5695e59000e19b9c05862e58670b3eba4db1fc2c05cf4be06a1ee333ae6a2c2628805b5abb41f62d23ccc87d12d31bb8d24d4d45664a546f5746430a6a107a86a0f6f14a35c6f8de4b31d924f56832a7d05b4db2ae818e4918207eb2146614c10ce53893e2ed8a59f82f45e58a69836b3bf87b0d423c7335416ef5bb3634e22f98c164925a5effe4452705261161697a407ae51dc6fc3d4f49412349972886092de354ee19bee67e0bc8a087dfa02e1d856b52734e001e64ba82200b951a32d52d47a1519e9d9e02e4fcba2656c6a87cc458464508448f580ced9f97bedf21fe2fdcf136f693cffd98d1d097922f4f42a004ef66c92db8d64c97e78cdcb4a21fad973a133e8544e608e2365f5f9af29520715d5ed9510f096b85851e4722ba8bac8d6d75ca777c10887da6d2d6e2f3367b890e2bdf87bc9955785b5eacf05b80b3c79430f345fac7c1ffc0ef33aecdd1d5135dbbc84ac1bbffbddf77535a5e0b0d23733439d58078fc835def905d7b90bf09fa1af69edc9871225a5a231a6ff5b069c3e431aaa424ff0954ac6739cd9591113ecb539b39d9141237954ac4de43b48da264063f7e24fc5b86a564eea6b2bc456cc41f11cf82d61d4774080cfa8b043a46d2fe0420b721441543a49289a625149fe83f26a9b1866656ca0f362395979cbf401ba86a70392b9f77243eecd0c2d2d2e5996f573be62621df6c213167e08987b3c5286908e339d92d10c52b5cb5cfded61d15ad22a2e43d03b27bb66a3022d208b5f9b3ec4d47f0c2fa4be122d86a43d4136ffeacdbca2e33d1d414e0a81482032a9f9d1ed3e451c86bfdf985d59d3fb1d295e0fcda035ec8731cfd2367baa35e9c63e7c6422e1646839115acbc094f790485b6ea96dfb70b59bc83a3111a63b679edccff6539a06c2e3ed24142fdae2a2e861afb6b4314bebce2bf6e8c835b73914b7a840aed372dfe7c6cae9e014051e6948896457a0e9b0b78b0b298f5d94fb1aa6ac7b21b03d1de8b7835848047890e7239612517ff4b7886c2216789a7fa463f0beed88b8d682c78b1630f7cb9853c58f7b4b25c74369fab481ab316c1eca37fed630487ad017f9a3eb7d232fcd6b4e38d238a03456f47429a59a457207d73bb17921f5c0a93c95af77bc27668da4c4552bfd9ecdeafa11b4a11fec9a03968e26d967dab61c1632017b5e4987a4c30e275eab5bb702d7d0d1da61d10b17e36177ce8de1163bd6365b11e95c4197dafab6c524cc84c5d683d1dc13a2a7e1af080963f683db28dee4cf3ff2d1f46423d36872178c1984c5c8abe8608d72ea170294ddbfb2c32486d8ab39582ea3e24be52077a42ea658b885c8879d212357a27660c841aa2699ef986096fbb922ecfed8e42dcea0c7626eb4d81289e48647933b297396b7ac36785461c5333a654fa9580191f011020d72d0abb65f0b2e1bfc5bb7df30f3901d825455e056020dbe0fd7202c3804bfcb60e792643f21905fbdad49baf679f47e902d0e9bf6e433f5fa41d6c9df8752619caedf08f1782b68382b7b68beb796303ee8eeb0de4d0ae3aa8bf1d54bd9f8bcde29587f73e6c4b407599ea58238fe880f3a86ad275fce7cf93e43a1ecd1b1416391ad0e14167cdce776297ba993d8a47a94a5ff52b7dff918aef2d710997708362022d9c13b02270e2db545b05c989034a560f942448880037512528df5af4a6646bad1b502648db87a5194aa85830e91c9d094583228b39ffde51a364d1aec25b7d2a1a8a1f49a8bdb98da7158a79a464be8fc3254c7292ff4eae027c8038804945b5a9d78f1ae5461005230d393d1e5499b95a673004c7544e51c26d1ed50d51d5f8f6fa396f8c8a683ab5df841dda4286afaac339a2136d1336c0c667ebbf70c4f25149153e869faf0b452886dd53927b50000cd108f3db796b68e85fb003ae36a99f24a5bc52ba962221db6ba10a68214c5a293b43002402bd755c69fe30c38d010e2a96795b8bab76597bd7aede7130959258a9411914c92271a778ec2b62f35c5ebeccb76773f785ab1d6b58d3a479b812348efc525257c50a1676f7061167fc2ca5d5c6bf18b33a033a4218580c158943df69a3f886f4f76512f5b69926395e436f023c7cba961db9e0175f9c0f4f7c573ad16286de44db0569add7d52e2344989a54eee3bc4d2aa92fafc8a50afdda379315b3d8384e8a480e72c4c67bdc138c6d9cab2b2e61d36b64d7bcce945b45b48828095d1acd4424c256aa0928c3ae4df227b3d6c6054da23a8ace71068d1826f79d0fd307b8cf0c55495d0a5e4de141b2ed91cdae596d7ba2ea38d6490c3b09bfff86bac5bc59a36cd721af848e653f732f361dd4bfb12415a4530101ac4d6f5269f61e78f8496fcfa2f179cb61c0ad150f2dc3d0ca550eeb0b7bdbba4e00402f6d066027914c434ba8393b692b71f67f7fce72ec3db0e999fff6eaaf7b3a72288da55aa352d2071e4e585172dcf7caaaad371a5b1eaf91a29c3c5fe3862e8ac16e94c66be7072751519ac19f3ceb8f085c414462339fe1cff2b0212c3eb769e023552534e176090323552c10b8182a5edcf13b7d529833a03e5ce063852297aef9d6aa0a8004373d1399174bbe76cfd4d2d0c717a87459af3bfb0ec7b787d49a65bab2247408c922730b18b6bb36f0b5128355e40cdcdc469368b1a417a84872b7b5e61c001bdb9977f78aac420236432f8b1022ff7239278ab26435343928781642a4310b7f788c0163c3c5f3fd968590f095ce843d72f6adf584f51c61cc7f1d02093d3c333d6e9b0e2a1263ed25e6ecbfc0f64ab227aeecb3a25cb6869b31c280f274a9b30d52982fb978b18a6409a2e830061aac4ddfcd2dc981086f5074ebc64ce47e90560a8fc89f5340e4ed5678d508bef1932493a9253e3b574f1f1e05af949c273db657c7f9c189286b5d3ea7e26dd86ee4b04c1c7b61429afbf79302d5783075b7aa2857d8831ac1c89199ea769101273ae54e9cafa967c716b0a03659ae0bf3aede0686112a320c502228894876004f1e3778ea19151591f3ca0568eabca46f54ea4f0a59e48eb8a415e51de2e347ef6c80b256458be5f1f68b5e4d8ca6dd66243490d293db27e3822b502bec09a97eadba035b726a50de19f5349464f74e9d9193bb53b753d1d65d14ba11ebb162abb8d628a67258374e6dac246ca6847d50ed1fffcf9b3831c2f5faca68e055b126cec8b1a5993066c621ddceffc161284f8a7befd146f82b41b6845fa1af9717398c7b61866b82ed5480135b5dd9fc990a35decdcce48e6aac4ece9fec779cd24d10d6b54eb2a83dc39b94eae30286c0aa7602ffa46dee3e3a64a5a4cb1c3096df075a4765b7bb09494b89002db1e279484f8b37e95e4fe552571e0de27bbbe2abd47ed0b7a73d68e97530457dae7d577659225bce172acd2dbc51a7f6a4680e3ca2f529abebbc69b04f520ebcc8ed634c27a9934c6e904a5cc0cb5d2e14a44f52bfd3708be15b92aeb81c910bde117eb248cf2e0e73292587cecf07b7ea49042a7ad72623055c6b7a1fcfcb6ff707b27d86514d1f311e9a3984b0dbb07dc884ef8a15aab133d06c6aeb6e100c0c1160319e5ac915695f24645da66dbe9590e565c18028e4553b148c0e35a162aaecd44a77fa1770b07de6da7967001b1ed0474c32e3ca806f4144f14780901fdfec46855a626fe5082b5ac727a436d31408a06cf855d02c6eeff6ad8ad8916b1701ae273511ea0f040afbee37a202d5356fd30c6de3345c289aa734727523bd7718e21f612c45ca783066d447b4d828eb87ec3c27a53ed7305ac4c9254f537c6ed4ddc6e7cb4d012e057e3142e83d844d09159d31754643f6d558610c6101b6dd2097fd30c65981b51368e2d1e0a6d982df609ce9c1ba482388ba1851d437f2738eb85815c9e1800894140f8f05edae533ef61efe39a793ab170f91c5e2fd68565a2fa9241ae83d8c5bb4ee963b9afc16b6900deca2b63c7fb93d3e5a913bd2b6e32e76f97cd4e037271272a0c9468c130c988c219fa189c8e7cb53879dd3a69f9c21346c31b365b8a00439eb11e870749012144e0b0808156ef17ba4f5a4f8343c572be8e72617259a30ad31ea7940032f3b3ba397975692f25e7c029200dbd2cf7a08ea3baf19eb9246f50311619b594a65f2f6177af873b6f401683198daaeab32623f264aabc56e94296eca1b70ad05b3e4212e3104bd374ecabb4216ee66c7526428685fa593dc27af8019437d71c0cc6c7b017d01bf1efdde13165e5457da56babf448fd172f1b6766af8cbdc5a81cb5b4e3e74cc3c714563619ec1b59bb78a1dc891861523f673d05c2311120da6adef7c94a5c9991f0a6c0b2747780e9468d8dc1bb02a65a4400c0d6248261bba0ea84e1fa0d93ca2a132426c383e94c58a1fdd6ebfd2a862214f04634d506f248cab4a16e3e636250aefa8fb1ef582d4c2b16f172071673ad34f2112b439881aa219ab11cb7b523a263fe2d34c242dd77ab235ba0747d379cdd8e302ad1eac191bacecb5bb1f5b30838d75943141879fcfbf5565fc8324cd7d1ba69f04ace34f182ab70f53b99abc1b1f02003533715c2de9f50c3d360eb926866cbd184c5e3ad3c0475dc5873f3a109a24a4d7bb9554e02d98c1cbf63226f24492ec3e4adb43167d5ffe1cc02b37badbc6bd753ab03747b2269b3fa2d2bba3874c9f220fbfb054bc930fd57ceb7b5780325ddaef32a5a3ddb5d6165bdc0102db4db101c9586e31529a9663d3b320bd92e14554bbb5d41323712f9fa96e50b230372f1a8c7c8ae4885885016aeab7f3e73202cca4ab9ecdb0c632547042ea13a12b42f834ab12e2ae5325539f2aa5782de05de56a1db6919b967ff203a365acc70829606031c5639b51d644cf2f9ecd5475b7a84dbacd4e87de9f1a74bf60696f9f5d04a6d199b41dca5d6e12f1164822114b9739e93b7a0111de267853cb694d097c403962ac97d0808d62d0286d3528186c99ea1bd843befbf777b11a852f14ab863f3005fa47d74513b93fac26285b762bc7edf60da555a3aaa9e12ec06129a5e22e2240641c69e0579ffdda21855ec9628d89d611157d25f2b46858132bd79a76db4caffe111edf33d8d67adadf16f1ac0558a3ae28f0962a68d6c56996288aad21ae3d802f6161e5fcdc1ab3b414cef9e5b54307a7ac1adf9b25615d884f0a4314d94a588d4a456cfced904c571fc972bb06c813ebbec90350b9446bb2868f288301242b5edfbb37592ea64497ee334168f426bbe4410a10a9ec3151eed1b8c30717724778999dc1865199ca4f126abd52877a944b2335eacfd54cc5656a34c68520548b542612dd5a79b27a0b4c2056a06d10dc5fcc8b87d53549f545192bc68b460437852f73b616d3e19e13a4a8dcc7c6d0d5b99c3d4296dd0c2a42cefa7bd8aa3c0e385d65f663449e4adf6329db159f7e6d4d12751e8daeb600a7f21ce1aeecc3aad15cdbea7af4a269ad507c713170a08f2caae0ab2a0afc6c1e720330f6e19bba2b88eeb3ea940d80445de5ffe8d2e6843356fda187ce97be3a00b3f109a46598c33abcef5c86a1b9ddbbade532477eee3643215bc7d9ef9327a4d0ca3c1375fa6685552dd703d902fd93cce3e438d5374fd00f5ae0c77f5874cf1e4ecde57e0b443dc70b7b93a4253820d48468b3b640f73fccf232c83bad6b7a5462f2fe995d429f49898afa7ac5f245c71a30a2d7e8", 0x1001}], 0x1) fcntl$setflags(r1, 0x2, 0x1) signalfd(r0, &(0x7f0000052000)={0xfffffffffffffffa}, 0x8) 2018/02/01 04:11:33 executing program 3: r0 = shmget(0x0, 0x1000, 0x0, &(0x7f0000dfd000/0x1000)=nil) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f0000a45000-0xe8)={{{@in=@multicast2=0x0, @in=@multicast1=0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, {0x0, 0x0, 0x0, 0x0}, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, {{@in=@remote={0x0, 0x0, 0xffffffffffffffff, 0x0}, 0xffffffffffffffff, 0x0}, 0x0, @in6=@empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, &(0x7f0000d13000)=0xe8) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) getresgid(&(0x7f0000000000)=0x0, &(0x7f0000e32000-0x4)=0x0, &(0x7f0000000000)=0x0) r3 = getuid() mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) lstat(&(0x7f0000001000-0x8)='./file0\x00', &(0x7f0000057000-0x44)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r5 = gettid() ioctl$sock_FIOGETOWN(0xffffffffffffff9c, 0x8903, &(0x7f000060e000-0x4)=0x0) shmctl$IPC_SET(r0, 0x1, &(0x7f00006b5000-0x70)={{0x9, r1, r2, r3, r4, 0x19, 0x7ff, 0x0, 0x0, 0x0}, 0x3, 0x7ecd, 0x2, 0x81, r5, r6, 0x8, 0x0, 0x0, 0x0}) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) seccomp(0x2, 0x1, &(0x7f00003f1000-0x10)={0x1, &(0x7f0000228000)=[{0x6, 0x0, 0x2, 0x407ffc0004}]}) fremovexattr(0xffffffffffffffff, &(0x7f00000e6000-0x9)=@known='user.syz\x00') [ 313.243466] binder: send failed reply for transaction 1692 to 16061:16065 [ 313.251645] binder_alloc: 16062: binder_alloc_buf, no vma [ 313.258107] binder: BINDER_SET_CONTEXT_MGR already set 2018/02/01 04:11:33 executing program 5: r0 = shmat(0x0, &(0x7f0000444000/0x4000)=nil, 0x2000) shmdt(r0) mmap(&(0x7f0000000000/0xe000)=nil, 0xe000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$sndctrl(&(0x7f000000a000)='/dev/snd/controlC#\x00', 0x0, 0x0) perf_event_open(&(0x7f0000001000)={0x0, 0x78, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8cd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xfffffffffffffff7, 0x2}, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f000000e000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$SNDRV_CTL_IOCTL_PVERSION(r1, 0xc1105517, &(0x7f000000f000-0xfa)=""/250) 2018/02/01 04:11:33 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r0, &(0x7f0000022000-0x16)="01", 0x1, 0x0, &(0x7f0000031000-0x10)={0x2, 0xffffffffffffffff, @local={0xac, 0x14, 0xffffffffffffffff, 0xaa}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x10) connect(r0, &(0x7f000058d000)=@vsock={0x28, 0x0, 0xffffffff, @reserved=0x1, 0x0}, 0x10) shutdown(r0, 0x1) 2018/02/01 04:11:33 executing program 2: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000801000-0x9)='/dev/ion\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) getsockopt$bt_BT_SNDMTU(r0, 0x112, 0xc, &(0x7f0000f59000-0x2)=0x1, &(0x7f0000c4c000-0x8)=0x2) r1 = syz_open_dev$binder(&(0x7f0000233000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) r3 = dup2(r1, r2) write$tun(0xffffffffffffffff, &(0x7f0000577000)=@pi={0x0, 0x0, @eth={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x0}, [], {@canfd={0xd, {{0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0, "feb442a1f43ead325d71fed774c8f6028c2a6b79a4e418aa3c5f391769659fef9f596cdade428c389e511eaad39d2ee4334dee9516a31d00510baaf06efc0980"}}}}}, 0x5a) r4 = dup2(r2, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004ee000-0x76)='\x00', 0x1, 0x0, 0x0}], &(0x7f000000b000-0x30)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)=""}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00005da000)={0x0, 0x0, &(0x7f00000d8000)=[], 0x48, 0x0, &(0x7f000044c000-0x83)="a410778b7a640ab0384c4ead541b6ee57c5645909ef688d8ac3e5ecfc7039f5f8ba53f127b7f01947cd3689eaf6c090277915bab2a0c450988cb85688e2bcc101a80664d3081fcc0"}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000c5a000)={0x0, 0x0, 0x0, 0x0}) setsockopt$ax25_buf(r3, 0x101, 0x19, &(0x7f00009e3000)="3e0b2ffdc3e6de3d9e591b52b12c7158d17ac5fae7a7914faf93e3e6f067df1e30a6a38d4bb36913c879b8fbddc1dfcf23d10d75b72144fb5047f9453f67f003ce8577437163da68f61e0ddc596460c5c812f2a53ad85fcad4570da5d82cf16a85e33f64deb930d2b7e3e8e620d1fc28051ad2382e16924a9cf259f1f49ecebe98b959f3a26315c1367c3df748a484a4dbb03ed773d2ad", 0x97) mmap(&(0x7f0000000000/0x13000)=nil, 0x13000, 0x0, 0x32, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000a95000-0x30)={0x14, 0x0, &(0x7f0000b8f000)=[@increfs_done={0x40106308, r5, 0x1}], 0x0, 0x0, &(0x7f00002e4000-0x70)=""}) ioctl$ASHMEM_GET_NAME(r3, 0x81007702, &(0x7f00001e6000)=""/35) 2018/02/01 04:11:33 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) seccomp(0x1, 0x0, &(0x7f000089b000-0x10)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x407ffc0003}]}) r0 = syz_open_procfs(0x0, &(0x7f00000d5000-0xe)='net/mcfilter6\x00') accept$netrom(r0, &(0x7f00001da000)=@full={{0x0, {""/7}, 0x0}, [{""/7}, {""/7}, {""/7}, {""/7}, {""/7}, {""/7}, {""/7}, {""/7}]}, &(0x7f0000062000)=0x48) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f000038d000-0x9)='/dev/ppp\x00', 0x200041, 0x0) getsockopt$packet_int(r1, 0x107, 0xc, &(0x7f00001c0000)=0x0, &(0x7f0000b9c000)=0x4) shmctl$IPC_INFO(0x0, 0x3, &(0x7f0000564000)=""/4096) 2018/02/01 04:11:33 executing program 1: openat$ion(0xffffffffffffff9c, &(0x7f0000801000-0x9)='/dev/ion\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000233000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) write$tun(0xffffffffffffffff, &(0x7f0000577000)=@pi={0x0, 0x0, @eth={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x0}, [], {@canfd={0xd, {{0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0, "feb442a1f43ead325d71fed774c8f6028c2a6b79a4e418aa3c5f391769659fef9f596cdade428c389e511eaad39d2ee4334dee9516a31d00510baaf06efc0980"}}}}}, 0x5a) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004ee000-0x76)='\x00', 0x1, 0x0, 0x0}], &(0x7f000000b000-0x30)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)=""}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00005da000)={0x0, 0x0, &(0x7f00000d8000)=[], 0x48, 0x0, &(0x7f000044c000-0x83)="a410778b7a640ab0384c4ead541b6ee57c5645909ef688d8ac3e5ecfc7039f5f8ba53f127b7f01947cd3689eaf6c090277915bab2a0c450988cb85688e2bcc101a80664d3081fcc0"}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000c5a000)={0x0, 0x0, 0x0, 0x0}) recvfrom$unix(r2, &(0x7f0000134000-0xa7)=""/167, 0xa7, 0x2001, &(0x7f0000df8000-0xa)=@file={0x1, './file0\x00'}, 0xa) mmap(&(0x7f0000000000/0x13000)=nil, 0x13000, 0x0, 0x32, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000a95000-0x30)={0x14, 0x0, &(0x7f0000b8f000)=[@increfs_done={0x40106308, r3, 0x1}], 0x0, 0x0, &(0x7f00002e4000-0x70)=""}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000436000-0x30)={0x20, 0x0, &(0x7f0000136000)=[@dead_binder_done={0x40086310, 0x3}, @increfs_done={0x40106308, r3, 0x0}], 0x0, 0x0, &(0x7f0000888000-0xb)=""}) [ 313.258140] binder: 16058:16068 ioctl 40046207 0 returned -16 [ 313.269209] binder: 16058:16068 transaction failed 29189/-22, size 40-8 line 2788 2018/02/01 04:11:33 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000)=0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) close(r1) sendmsg$nl_netfilter(r0, &(0x7f0000066000-0x38)={&(0x7f0000791000)={0x10, 0x0, 0x0, 0x0}, 0xc, &(0x7f0000df6000)={&(0x7f0000b06000-0x130c)={0x14, 0x13, 0xa, 0xfffffffffffffffd, 0xffffffffffffffff, 0xffffffffffffffff, {0x0, 0x0, 0x0}, []}, 0x14}, 0x1, 0x0, 0x0, 0x0}, 0x0) r2 = syz_open_dev$dspn(&(0x7f00004b2000+0xd3d)='/dev/dsp#\x00', 0x5, 0x10180) connect$vsock_dgram(r2, &(0x7f00003e4000-0x10)={0x28, 0x0, 0xffffffff, @hyper=0x0, 0x0}, 0x10) 2018/02/01 04:11:33 executing program 3: mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$mice(&(0x7f0000002000-0x10)='/dev/input/mice\x00', 0x0, 0x84800) mmap(&(0x7f0000003000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x14, &(0x7f0000003000-0x4)=0xffffffff, 0x4) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000001000-0xb)='/dev/audio\x00', 0x800, 0x0) ioctl$DRM_IOCTL_RES_CTX(r1, 0xc0106426, &(0x7f0000002000)={0x6, &(0x7f0000004000-0x30)=[{0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}]}) mmap(&(0x7f0000004000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) setsockopt$inet_sctp6_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f0000004000-0x4)=0x7fffffff, 0x4) getpeername(r0, &(0x7f0000005000-0x1e)=@pppoe={0x0, 0x0, {0x0, @local={[0x0, 0x0, 0x0, 0x0], 0xffffffffffffffff, 0x0}, @generic=""/16}}, &(0x7f0000001000-0x4)=0x1e) mmap(&(0x7f0000004000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) read$eventfd(r0, &(0x7f0000000000)=0x0, 0x8) mmap(&(0x7f0000005000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) getrlimit(0x5, &(0x7f0000006000-0x10)={0x0, 0x0}) ioctl$DRM_IOCTL_SET_SAREA_CTX(r0, 0x4010641c, &(0x7f0000005000-0x10)={r2, &(0x7f0000004000)=""/84}) read(r1, &(0x7f0000822000-0x8)=""/8, 0xffffff3d) [ 313.274128] binder: 16058:16068 BC_INCREFS_DONE u0000000000000000 no match [ 313.274257] binder: 16058:16068 BC_DEAD_BINDER_DONE 0000000000000003 not found [ 313.274268] binder: 16058:16068 BC_INCREFS_DONE u0000000000000000 no match [ 313.296217] binder: 16062:16074 BC_INCREFS_DONE u0000000000000000 no match [ 313.298595] binder: BINDER_SET_CONTEXT_MGR already set [ 313.298605] binder: 16058:16068 ioctl 40046207 0 returned -16 [ 313.300265] binder: 16058:16068 transaction failed 29189/-22, size 40-8 line 2788 [ 313.303435] binder: 16061:16065 transaction failed 29189/-22, size 40-8 line 2788 [ 313.303882] binder: 16058:16068 BC_INCREFS_DONE u0000000000000000 no match [ 313.303933] binder: 16058:16068 BC_DEAD_BINDER_DONE 0000000000000003 not found [ 313.303942] binder: 16058:16068 BC_INCREFS_DONE u0000000000000000 no match [ 313.326053] binder: undelivered TRANSACTION_ERROR: 29189 [ 313.326302] binder: undelivered TRANSACTION_COMPLETE [ 313.326310] binder: undelivered TRANSACTION_ERROR: 29189 [ 313.389308] binder: send failed reply for transaction 1702 to 16088:16090 [ 313.392202] binder: 16088:16090 BC_DEAD_BINDER_DONE 0000000000000003 not found [ 313.392217] binder: 16088:16090 BC_INCREFS_DONE u00000000204edf8a node 1703 cookie mismatch 0000000000000000 != 0000000000000001 [ 313.409857] binder: BINDER_SET_CONTEXT_MGR already set [ 313.409866] binder: 16088:16090 ioctl 40046207 0 returned -16 [ 313.412266] binder: send failed reply for transaction 1706 to 16083:16092 [ 313.412965] binder: 16088:16090 transaction failed 29189/-22, size 40-8 line 2788 [ 313.413440] binder: 16083:16092 ioctl 81007702 201e6000 returned -22 [ 313.422909] binder: 16088:16096 BC_INCREFS_DONE u0000000000000000 no match [ 313.439919] binder: undelivered TRANSACTION_COMPLETE [ 313.439929] binder: undelivered TRANSACTION_ERROR: 29189 [ 313.439984] binder: undelivered TRANSACTION_ERROR: 29189 [ 313.458911] binder: send failed reply for transaction 1711 to 16083:16097 [ 313.465912] binder: 16083:16092 BC_INCREFS_DONE u00000000204edf8a no match [ 313.465943] binder: 16083:16097 ioctl 81007702 201e6000 returned -22 [ 313.482524] binder: undelivered TRANSACTION_COMPLETE [ 313.482532] binder: undelivered TRANSACTION_ERROR: 29189 [ 313.482554] binder: undelivered TRANSACTION_COMPLETE 2018/02/01 04:11:33 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_PKTINFO(r0, 0x10e, 0x3, &(0x7f0000fbd000)=0x72, 0x4) write(r0, &(0x7f0000569000)="1f0000001a001bf200001321fdf3167600041d0100008d3d93391a0001454a", 0x400) recvmmsg(r0, &(0x7f0000659000)=[{{&(0x7f0000989000-0x14)=@ll={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @local={[0x0, 0x0, 0x0, 0x0], 0x0, 0x0}, [0x0, 0x0]}, 0x14, &(0x7f0000632000-0x10)=[], 0x0, &(0x7f0000eec000)=""/167, 0xa7, 0x0}, 0x0}], 0x1, 0x0, 0x0) 2018/02/01 04:11:33 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) seccomp(0x1, 0x0, &(0x7f000089b000-0x10)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x407ffc0003}]}) shmctl$IPC_INFO(0x0, 0x3, &(0x7f0000564000)=""/4096) r0 = openat$mixer(0xffffffffffffff9c, &(0x7f0000217000-0xb)='/dev/mixer\x00', 0x6002, 0x0) getsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(0xffffffffffffffff, 0x84, 0x22, &(0x7f000076a000)={0x8001, 0x4, 0x7ff, 0x4d0, 0x0}, &(0x7f00000d0000-0x4)=0x10) setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r0, 0x84, 0x1f, &(0x7f0000b99000-0x98)={r1, @in6={{0xa, 0x0, 0x1, @loopback={0x0, 0x1}, 0x94b}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0xff, 0x10001}, 0x98) 2018/02/01 04:11:33 executing program 1: openat$ion(0xffffffffffffff9c, &(0x7f0000801000-0x9)='/dev/ion\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000233000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) write$tun(0xffffffffffffffff, &(0x7f0000577000)=@pi={0x0, 0x0, @eth={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x0}, [], {@canfd={0xd, {{0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0, "feb442a1f43ead325d71fed774c8f6028c2a6b79a4e418aa3c5f391769659fef9f596cdade428c389e511eaad39d2ee4334dee9516a31d00510baaf06efc0980"}}}}}, 0x5a) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004ee000-0x76)='\x00', 0x1, 0x0, 0x0}], &(0x7f000000b000-0x30)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)=""}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00005da000)={0x0, 0x0, &(0x7f00000d8000)=[], 0x48, 0x0, &(0x7f000044c000-0x83)="a410778b7a640ab0384c4ead541b6ee57c5645909ef688d8ac3e5ecfc7039f5f8ba53f127b7f01947cd3689eaf6c090277915bab2a0c450988cb85688e2bcc101a80664d3081fcc0"}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000c5a000)={0x0, 0x0, 0x0, 0x0}) mmap(&(0x7f0000000000/0x13000)=nil, 0x13000, 0x0, 0x32, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000a95000-0x30)={0x14, 0x0, &(0x7f0000ddf000)=[@increfs_done={0x40106308, r3, 0x0}], 0x0, 0x0, &(0x7f00002e4000-0x70)=""}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000436000-0x30)={0x20, 0x0, &(0x7f0000136000)=[@dead_binder_done={0x40086310, 0x3}, @increfs_done={0x40106308, r3, 0x0}], 0x0, 0x0, &(0x7f0000888000-0xb)=""}) 2018/02/01 04:11:33 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f00001f3000)={0x0, 0x0, 0x0}, &(0x7f0000420000)=0xc) rt_sigqueueinfo(r0, 0x1f, &(0x7f0000c4a000-0x10)={0x30, 0x87, 0x7ff, 0x0}) r1 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r1, &(0x7f0000022000-0x16)="01", 0x1, 0x0, &(0x7f0000031000-0x10)={0x2, 0xffffffffffffffff, @local={0xac, 0x14, 0xffffffffffffffff, 0xaa}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x10) shutdown(r1, 0x1) recvfrom(r1, &(0x7f0000b79000)=""/228, 0xe4, 0x40000002, &(0x7f00006d9000-0x26)=@pppol2tp={0x18, 0x1, {0x0, r1, {0x2, 0x1, @multicast1=0xe0000001, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x4, 0x4, 0x0, 0x1}}, 0x26) 2018/02/01 04:11:33 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000e5b000)={0x2, 0x0, @multicast1=0xe0000001, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x10) connect$inet(r0, &(0x7f0000ccb000)={0x2, 0x0, @empty=0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x10) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000eb1000-0x48)={0x1, 0x3, &(0x7f0000b27000-0x18)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, [], {0x95, 0x0, 0x0, 0x0}}, &(0x7f00002bf000)='syzkaller\x00', 0x4, 0xb7, &(0x7f00006ab000)=""/183, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0}, 0x48) r2 = socket$kcm(0x29, 0x2, 0x0) ioctl$sock_kcm_SIOCKCMATTACH(r2, 0x89e0, &(0x7f000031b000-0x8)={r0, r1}) setsockopt$inet_tcp_int(r0, 0x6, 0x1, &(0x7f0000c5b000-0x4)=0xffffffffffffffff, 0x4) 2018/02/01 04:11:33 executing program 2: openat$ion(0xffffffffffffff9c, &(0x7f0000801000-0x9)='/dev/ion\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000233000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = dup2(r0, r1) write$tun(0xffffffffffffffff, &(0x7f0000577000)=@pi={0x0, 0x0, @eth={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x0}, [], {@canfd={0xd, {{0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0, "feb442a1f43ead325d71fed774c8f6028c2a6b79a4e418aa3c5f391769659fef9f596cdade428c389e511eaad39d2ee4334dee9516a31d00510baaf06efc0980"}}}}}, 0x5a) r3 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004ee000-0x76)='\x00', 0x1, 0x0, 0x0}], &(0x7f000000b000-0x30)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)=""}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00005da000)={0x0, 0x0, &(0x7f00000d8000)=[], 0x48, 0x0, &(0x7f000044c000-0x83)="a410778b7a640ab0384c4ead541b6ee57c5645909ef688d8ac3e5ecfc7039f5f8ba53f127b7f01947cd3689eaf6c090277915bab2a0c450988cb85688e2bcc101a80664d3081fcc0"}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000c5a000)={0x0, 0x0, 0x0, 0x0}) mmap(&(0x7f0000000000/0x13000)=nil, 0x13000, 0x0, 0x32, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000a95000-0x30)={0x14, 0x0, &(0x7f0000b8f000)=[@increfs_done={0x40106308, r4, 0x1}], 0x0, 0x0, &(0x7f00002e4000-0x70)=""}) ioctl$KVM_GET_XSAVE(r2, 0x9000aea4, &(0x7f0000bf6000)={""/1024}) 2018/02/01 04:11:33 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f0000590000-0x8)='./file0\x00', 0x14) write$selinux_create(r0, &(0x7f000074c000)=@access={'system_u:object_r:dpkg_exec_t:s0', 0x20, '/usr/sbin/cups-browsed', 0x20, 0x32, 0x30, 0x0}, 0x3b) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f00007cf000)='/dev/cuse\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_STATUS(r1, 0xc05c5340, &(0x7f0000b85000)={0x6, 0x100, 0x2, {0x0, 0x0}, 0x0, 0x4, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000801000-0x9)='/dev/ion\x00', 0x0, 0x0) r3 = syz_open_dev$binder(&(0x7f0000233000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r4 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0) r5 = dup2(r3, r4) write$tun(0xffffffffffffffff, &(0x7f0000577000)=@pi={0x0, 0x0, @eth={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x0}, [], {@canfd={0xd, {{0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0, "feb442a1f43ead325d71fed774c8f6028c2a6b79a4e418aa3c5f391769659fef9f596cdade428c389e511eaad39d2ee4334dee9516a31d00510baaf06efc0980"}}}}}, 0x5a) r6 = dup2(r4, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004ee000-0x76)='\x00', 0x1, 0x0, 0x0}], &(0x7f000000b000-0x30)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)=""}) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f00005da000)={0x0, 0x0, &(0x7f00000d8000)=[], 0x48, 0x0, &(0x7f000044c000-0x83)="a410778b7a640ab0384c4ead541b6ee57c5645909ef688d8ac3e5ecfc7039f5f8ba53f127b7f01947cd3689eaf6c090277915bab2a0c450988cb85688e2bcc101a80664d3081fcc0"}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000c5a000)={0x0, 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000a95000-0x30)={0x14, 0x0, &(0x7f0000b8f000)=[@increfs_done={0x40106308, r7, 0x1}], 0x0, 0x0, &(0x7f00002e4000-0x70)=""}) getsockopt$inet6_dccp_buf(r5, 0x21, 0xcf, &(0x7f0000e10000-0xcc)=""/204, &(0x7f000037d000-0x4)=0xcc) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000436000-0x30)={0x14, 0x0, &(0x7f0000136000)=[@increfs_done={0x40106308, r7, 0x0}], 0x0, 0x0, &(0x7f0000888000-0xb)=""}) close(0xffffffffffffffff) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000002000-0x38)={0x0, 0x0, &(0x7f0000003000)=[], 0x0, &(0x7f0000002000)=[{0x10, 0x10e, 0x0, ""}], 0x10, 0x0}, 0x0) 2018/02/01 04:11:33 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000)=0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000fd4000-0x11)='/selinux/enforce\x00', 0x101001, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000475000-0x548)=@mangle={'mangle\x00', 0x1f, 0x4, 0x4e8, 0x2b8, 0x2b8, 0x2b8, 0x2b8, 0xd0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000a41000-0x40)=[{0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}], {{{[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0xa8, 0xd0, 0x0, {0x0, 0x0}}, {0x28, '\x00', 0x0, 0x1e8}}, [{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0xd0, 0x118, 0x0, {0x0, 0x0}, [@unspec=@rpfilter={0x28, 'rpfilter\x00', 0x0, {0x1}}]}, @SNPT={0x48, 'SNPT\x00', 0x0, {@ipv4=@dev={0xac, 0x14, 0x0, 0x10}, @ipv4=@rand_addr=0x5, 0x31, 0x27, 0x6}}}, {{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0xa8, 0xd0, 0x0, {0x0, 0x0}, [@unspec=@void=""]}, @common=@unspec=@SYNPROXY={0x28, 'SYNPROXY\x00', 0x0, {0x3, 0x8, 0x14ad}}}, {{@ipv6={@mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x1}, @remote={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0xbb}, [0xffffffff, 0xffffff00, 0x0, 0xff], [0xff000000, 0xffffffff, 0xff000000, 0xffffffff], @common='vlan0\x00', @generic="099f142f4de2676316c8999f40a21b1d", {0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, {0xff, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x3b, 0x1, 0x1, 0x4}, 0x0, 0x208, 0x230, 0x0, {0x0, 0x0}, [@common=@rt={0x138, 'rt\x00', 0x0, {0x40, 0x83a, 0xc2074fa, 0x1, 0x10, 0x1, [@mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x1}, @loopback={0x0, 0x1}, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x1}, @loopback={0x0, 0x1}, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], [0xff, 0xff], @local={0xac, 0x14, 0x0, 0xaa}}, @remote={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0xbb}, @remote={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0xbb}, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x1}, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x1}, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], [0xff, 0xff], @dev={0xac, 0x14, 0x0, 0xb}}, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x1}, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x1}, @local={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0xaa}, @local={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0xaa}], 0xb}}, @unspec=@rpfilter={0x28, 'rpfilter\x00', 0x0, {0x9}}]}, @HL={0x28, 'HL\x00', 0x0, {0x2, 0xa7e}}}]}}, 0x548) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x6, 0x8000000000000004, 0x3ff, 0x5, 0x0, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x1c) pipe2(&(0x7f0000e7d000-0x8)={0x0, 0x0}, 0x84800) ioctl$DRM_IOCTL_RM_MAP(r3, 0x4028641b, &(0x7f0000105000-0x28)={&(0x7f0000000000/0x1000)=nil, 0x7, 0x7, 0x0, &(0x7f0000840000/0x1000)=nil, 0x100}) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r1, 0xc0045516, &(0x7f0000a41000-0x4)=0xfffffffffffffffa) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000f4c000-0x20)={r2, &(0x7f0000322000)="", &(0x7f0000132000)="", 0x0}, 0x20) ioctl$KVM_S390_VCPU_FAULT(r0, 0x4008ae52, &(0x7f000037e000-0x8)=0x40) [ 313.482560] binder: undelivered TRANSACTION_ERROR: 29189 [ 313.664639] binder: 16062:16067 transaction failed 29189/-3, size 40-8 line 2903 [ 313.680107] binder: undelivered TRANSACTION_ERROR: 29189 2018/02/01 04:11:33 executing program 2: openat$ion(0xffffffffffffff9c, &(0x7f0000801000-0x9)='/dev/ion\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000233000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = dup2(r0, r1) setsockopt$inet_sctp_SCTP_AUTO_ASCONF(r2, 0x84, 0x1e, &(0x7f0000c91000-0x4)=0x1, 0x4) write$tun(0xffffffffffffffff, &(0x7f0000577000)=@pi={0x0, 0x0, @eth={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x0}, [], {@canfd={0xd, {{0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0, "feb442a1f43ead325d71fed774c8f6028c2a6b79a4e418aa3c5f391769659fef9f596cdade428c389e511eaad39d2ee4334dee9516a31d00510baaf06efc0980"}}}}}, 0x5a) r3 = dup2(r1, r0) bind$bt_sco(r3, &(0x7f0000a25000)={0x1f, {0x0, 0x4, 0x1ff0000000000, 0x8001, 0x1, 0x5}}, 0x8) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004ee000-0x76)='\x00', 0x1, 0x0, 0x0}], &(0x7f000000b000-0x30)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)=""}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00005da000)={0x0, 0x0, &(0x7f00000d8000)=[], 0x48, 0x0, &(0x7f000044c000-0x83)="a410778b7a640ab0384c4ead541b6ee57c5645909ef688d8ac3e5ecfc7039f5f8ba53f127b7f01947cd3689eaf6c090277915bab2a0c450988cb85688e2bcc101a80664d3081fcc0"}) r4 = mmap$binder(&(0x7f0000fc4000/0x2000)=nil, 0x2000, 0x4, 0x11, r0, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000bb7000)={r4, 0x0, 0x0, 0x0}) mmap(&(0x7f0000000000/0x13000)=nil, 0x13000, 0x0, 0x32, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000a95000-0x30)={0x14, 0x0, &(0x7f0000b8f000)=[@increfs_done={0x40106308, r5, 0x1}], 0x0, 0x0, &(0x7f00002e4000-0x70)=""}) [ 313.738630] binder: 16106:16109 BC_INCREFS_DONE u00000000204edf8a node 1716 cookie mismatch 0000000000000000 != 0000000000000001 [ 313.751888] binder: send failed reply for transaction 1715 to 16106:16109 2018/02/01 04:11:33 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r0, &(0x7f0000022000-0x16)="01", 0x1, 0x0, &(0x7f0000031000-0x10)={0x2, 0xffffffffffffffff, @local={0xac, 0x14, 0xffffffffffffffff, 0xaa}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x10) shutdown(r0, 0x0) ioctl$sock_inet_SIOCADDRT(r0, 0x890b, &(0x7f00000cb000-0x78)={0xffff, {0x2, 0x3, @remote={0xac, 0x14, 0x0, 0xbb}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, {0x2, 0x2, @multicast2=0xe0000002, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, {0x2, 0x0, @loopback=0x7f000001, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x9, 0x200, 0x1f, 0x4f6, 0xfa, 0x0, 0xfb1, 0x9, 0x3}) 2018/02/01 04:11:33 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f0000590000-0x8)='./file0\x00', 0x14) write$selinux_create(r0, &(0x7f000074c000)=@access={'system_u:object_r:dpkg_exec_t:s0', 0x20, '/usr/sbin/cups-browsed', 0x20, 0x32, 0x30, 0x0}, 0x3b) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f00007cf000)='/dev/cuse\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_STATUS(r1, 0xc05c5340, &(0x7f0000b85000)={0x6, 0x100, 0x2, {0x0, 0x0}, 0x0, 0x4, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000801000-0x9)='/dev/ion\x00', 0x0, 0x0) r3 = syz_open_dev$binder(&(0x7f0000233000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r4 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0) r5 = dup2(r3, r4) write$tun(0xffffffffffffffff, &(0x7f0000577000)=@pi={0x0, 0x0, @eth={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x0}, [], {@canfd={0xd, {{0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0, "feb442a1f43ead325d71fed774c8f6028c2a6b79a4e418aa3c5f391769659fef9f596cdade428c389e511eaad39d2ee4334dee9516a31d00510baaf06efc0980"}}}}}, 0x5a) r6 = dup2(r4, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004ee000-0x76)='\x00', 0x1, 0x0, 0x0}], &(0x7f000000b000-0x30)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)=""}) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f00005da000)={0x0, 0x0, &(0x7f00000d8000)=[], 0x48, 0x0, &(0x7f000044c000-0x83)="a410778b7a640ab0384c4ead541b6ee57c5645909ef688d8ac3e5ecfc7039f5f8ba53f127b7f01947cd3689eaf6c090277915bab2a0c450988cb85688e2bcc101a80664d3081fcc0"}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000c5a000)={0x0, 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000a95000-0x30)={0x14, 0x0, &(0x7f0000b8f000)=[@increfs_done={0x40106308, r7, 0x1}], 0x0, 0x0, &(0x7f00002e4000-0x70)=""}) getsockopt$inet6_dccp_buf(r5, 0x21, 0xcf, &(0x7f0000e10000-0xcc)=""/204, &(0x7f000037d000-0x4)=0xcc) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000436000-0x30)={0x14, 0x0, &(0x7f0000136000)=[@increfs_done={0x40106308, r7, 0x0}], 0x0, 0x0, &(0x7f0000888000-0xb)=""}) close(0xffffffffffffffff) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000002000-0x38)={0x0, 0x0, &(0x7f0000003000)=[], 0x0, &(0x7f0000002000)=[{0x10, 0x10e, 0x0, ""}], 0x10, 0x0}, 0x0) 2018/02/01 04:11:33 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) unshare(0x20020000) mknod$loop(&(0x7f0000211000)='./file0\x00', 0x0, 0xffffffffffffffff) mount(&(0x7f0000018000)='./file0\x00', &(0x7f0000027000)='./file0\x00', &(0x7f0000019000-0x6)='Qamfs\x00', 0x105403, &(0x7f000000a000)="") r0 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000be9000)='/dev/vga_arbiter\x00', 0x10000, 0x0) ioctl$KVM_SET_CLOCK(r0, 0x4030ae7b, &(0x7f00008a2000)={0x2fae, 0x9, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) poll(&(0x7f0000cf4000)=[], 0x0, 0x7f) unlink(&(0x7f0000934000-0x8)='./file0\x00') [ 313.763304] binder: 16110:16113 ioctl 9000aea4 20bf6000 returned -22 [ 313.768200] binder: send failed reply for transaction 1719 to 16110:16113 2018/02/01 04:11:33 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) seccomp(0x1, 0x0, &(0x7f000089b000-0x10)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x407ffc0003}]}) shmctl$IPC_INFO(0x0, 0x3, &(0x7f00006f4000-0x1000)=""/4096) 2018/02/01 04:11:33 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f0000590000-0x8)='./file0\x00', 0x14) write$selinux_create(r0, &(0x7f000074c000)=@access={'system_u:object_r:dpkg_exec_t:s0', 0x20, '/usr/sbin/cups-browsed', 0x20, 0x32, 0x30, 0x0}, 0x3b) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f00007cf000)='/dev/cuse\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_STATUS(r1, 0xc05c5340, &(0x7f0000b85000)={0x6, 0x100, 0x2, {0x0, 0x0}, 0x0, 0x4, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000801000-0x9)='/dev/ion\x00', 0x0, 0x0) r3 = syz_open_dev$binder(&(0x7f0000233000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r4 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0) r5 = dup2(r3, r4) write$tun(0xffffffffffffffff, &(0x7f0000577000)=@pi={0x0, 0x0, @eth={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x0}, [], {@canfd={0xd, {{0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0, "feb442a1f43ead325d71fed774c8f6028c2a6b79a4e418aa3c5f391769659fef9f596cdade428c389e511eaad39d2ee4334dee9516a31d00510baaf06efc0980"}}}}}, 0x5a) r6 = dup2(r4, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004ee000-0x76)='\x00', 0x1, 0x0, 0x0}], &(0x7f000000b000-0x30)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)=""}) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f00005da000)={0x0, 0x0, &(0x7f00000d8000)=[], 0x48, 0x0, &(0x7f000044c000-0x83)="a410778b7a640ab0384c4ead541b6ee57c5645909ef688d8ac3e5ecfc7039f5f8ba53f127b7f01947cd3689eaf6c090277915bab2a0c450988cb85688e2bcc101a80664d3081fcc0"}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000c5a000)={0x0, 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000a95000-0x30)={0x14, 0x0, &(0x7f0000b8f000)=[@increfs_done={0x40106308, r7, 0x1}], 0x0, 0x0, &(0x7f00002e4000-0x70)=""}) getsockopt$inet6_dccp_buf(r5, 0x21, 0xcf, &(0x7f0000e10000-0xcc)=""/204, &(0x7f000037d000-0x4)=0xcc) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000436000-0x30)={0x14, 0x0, &(0x7f0000136000)=[@increfs_done={0x40106308, r7, 0x0}], 0x0, 0x0, &(0x7f0000888000-0xb)=""}) close(r2) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000002000-0x38)={0x0, 0x0, &(0x7f0000003000)=[], 0x0, &(0x7f0000002000)=[], 0x0, 0x0}, 0x0) 2018/02/01 04:11:33 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f0000590000-0x8)='./file0\x00', 0x14) write$selinux_create(r0, &(0x7f000074c000)=@access={'system_u:object_r:dpkg_exec_t:s0', 0x20, '/usr/sbin/cups-browsed', 0x20, 0x32, 0x30, 0x0}, 0x3b) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f00007cf000)='/dev/cuse\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_STATUS(r1, 0xc05c5340, &(0x7f0000b85000)={0x6, 0x100, 0x2, {0x0, 0x0}, 0x0, 0x4, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) openat$ion(0xffffffffffffff9c, &(0x7f0000801000-0x9)='/dev/ion\x00', 0x0, 0x0) r2 = syz_open_dev$binder(&(0x7f0000233000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) r4 = dup2(r2, r3) write$tun(0xffffffffffffffff, &(0x7f0000577000)=@pi={0x0, 0x0, @eth={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x0}, [], {@canfd={0xd, {{0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0, "feb442a1f43ead325d71fed774c8f6028c2a6b79a4e418aa3c5f391769659fef9f596cdade428c389e511eaad39d2ee4334dee9516a31d00510baaf06efc0980"}}}}}, 0x5a) r5 = dup2(r3, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004ee000-0x76)='\x00', 0x1, 0x0, 0x0}], &(0x7f000000b000-0x30)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)=""}) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f00005da000)={0x0, 0x0, &(0x7f00000d8000)=[], 0x48, 0x0, &(0x7f000044c000-0x83)="a410778b7a640ab0384c4ead541b6ee57c5645909ef688d8ac3e5ecfc7039f5f8ba53f127b7f01947cd3689eaf6c090277915bab2a0c450988cb85688e2bcc101a80664d3081fcc0"}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r3, 0xc018620b, &(0x7f0000c5a000)={0x0, 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000a95000-0x30)={0x14, 0x0, &(0x7f0000b8f000)=[@increfs_done={0x40106308, r6, 0x1}], 0x0, 0x0, &(0x7f00002e4000-0x70)=""}) getsockopt$inet6_dccp_buf(r4, 0x21, 0xcf, &(0x7f0000e10000-0xcc)=""/204, &(0x7f000037d000-0x4)=0xcc) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000436000-0x30)={0x14, 0x0, &(0x7f0000136000)=[@increfs_done={0x40106308, r6, 0x0}], 0x0, 0x0, &(0x7f0000888000-0xb)=""}) close(0xffffffffffffffff) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000002000-0x38)={0x0, 0x0, &(0x7f0000003000)=[], 0x0, &(0x7f0000002000)=[{0x10, 0x10e, 0x0, ""}], 0x10, 0x0}, 0x0) 2018/02/01 04:11:33 executing program 2: openat$ion(0xffffffffffffff9c, &(0x7f0000801000-0x9)='/dev/ion\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000233000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000da5000)='/dev/audio\x00', 0x8000, 0x0) ioctl$SNDRV_TIMER_IOCTL_GINFO(r1, 0xc0f85403, &(0x7f0000085000)={{0x3, 0x3, 0x1, 0x2, 0x3}, 0x7fffffff, 0xfffffffffffffff7, 'id0\x00', 'timer1\x00', 0x0, 0x1, 0xfffffffffffffffd, 0x3, 0x7, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) r2 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0) finit_module(r2, &(0x7f00002e3000)='timer1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', 0x1) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) dup2(r0, r2) write$tun(0xffffffffffffffff, &(0x7f0000577000)=@pi={0x0, 0x0, @eth={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x0}, [], {@canfd={0xd, {{0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0, "feb442a1f43ead325d71fed774c8f6028c2a6b79a4e418aa3c5f391769659fef9f596cdade428c389e511eaad39d2ee4334dee9516a31d00510baaf06efc0980"}}}}}, 0x5a) r3 = dup2(r2, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004ee000-0x76)='\x00', 0x1, 0x0, 0x0}], &(0x7f000000b000-0x30)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)=""}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00005da000)={0x0, 0x0, &(0x7f00000d8000)=[], 0x48, 0x0, &(0x7f000044c000-0x83)="a410778b7a640ab0384c4ead541b6ee57c5645909ef688d8ac3e5ecfc7039f5f8ba53f127b7f01947cd3689eaf6c090277915bab2a0c450988cb85688e2bcc101a80664d3081fcc0"}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000c5a000)={0x0, 0x0, 0x0, 0x0}) mmap(&(0x7f0000000000/0x13000)=nil, 0x13000, 0x0, 0x32, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000a95000-0x30)={0x14, 0x0, &(0x7f0000b8f000)=[@increfs_done={0x40106308, r4, 0x1}], 0x0, 0x0, &(0x7f00002e4000-0x70)=""}) [ 313.769044] binder: 16111:16116 transaction failed 29189/-22, size 40-8 line 2788 [ 313.773806] binder: 16106:16121 BC_DEAD_BINDER_DONE 0000000000000003 not found [ 313.773825] binder: 16106:16121 BC_INCREFS_DONE u00000000204edf8a node 1716 cookie mismatch 0000000000000000 != 0000000000000001 [ 313.778613] binder_alloc: 16110: binder_alloc_buf, no vma [ 313.778639] binder: 16110:16113 transaction failed 29189/-3, size 40-8 line 2903 [ 313.788897] binder: 16110:16113 ioctl 9000aea4 20bf6000 returned -22 [ 313.798202] binder: undelivered TRANSACTION_ERROR: 29189 [ 313.798243] binder: undelivered TRANSACTION_COMPLETE [ 313.798250] binder: undelivered TRANSACTION_ERROR: 29189 [ 313.826420] binder: 16106:16124 transaction failed 29189/-22, size 40-8 line 2788 [ 313.831455] binder: undelivered TRANSACTION_ERROR: 29189 [ 313.836164] binder: 16106:16121 BC_INCREFS_DONE u00000000204edf8a node 1716 cookie mismatch 0000000000000000 != 0000000000000001 [ 313.862664] binder: send failed reply for transaction 1729 to 16126:16130 [ 313.862831] binder: 16126:16130 BC_INCREFS_DONE u0000000000000000 no match [ 313.866107] binder_alloc: 16132: binder_alloc_buf, no vma [ 313.866131] binder: 16132:16133 transaction failed 29189/-3, size 40-8 line 2903 [ 313.876336] binder_alloc: binder_alloc_mmap_handler: 16126 20000000-20002000 already mapped failed -16 [ 313.878536] binder: BINDER_SET_CONTEXT_MGR already set [ 313.878546] binder: 16126:16130 ioctl 40046207 0 returned -16 [ 313.881567] binder: undelivered TRANSACTION_ERROR: 29189 [ 313.890462] binder: 16126:16130 transaction failed 29189/-22, size 40-8 line 2788 [ 313.890657] binder_alloc: binder_alloc_mmap_handler: 16126 20fc4000-20fc6000 already mapped failed -16 [ 313.903559] binder: undelivered TRANSACTION_ERROR: 29189 [ 313.903563] binder: undelivered TRANSACTION_ERROR: 29189 [ 313.944599] binder: send failed reply for transaction 1736 to 16142:16145 [ 313.944955] binder_alloc: 16144: binder_alloc_buf, no vma [ 313.944977] binder: 16144:16148 transaction failed 29189/-3, size 40-8 line 2903 [ 313.948325] binder: BINDER_SET_CONTEXT_MGR already set [ 313.948333] binder: 16143:16146 ioctl 40046207 0 returned -16 [ 313.951648] binder: 16143:16146 transaction failed 29189/-22, size 40-8 line 2788 [ 313.961073] binder: undelivered TRANSACTION_ERROR: 29189 [ 313.962735] binder: undelivered TRANSACTION_ERROR: 29189 [ 313.967363] binder: 16142:16149 transaction failed 29189/-22, size 40-8 line 2788 [ 313.988087] binder: undelivered TRANSACTION_ERROR: 29189 [ 313.988099] binder: undelivered TRANSACTION_ERROR: 29189 [ 314.200958] binder: undelivered TRANSACTION_COMPLETE [ 314.206208] binder: undelivered TRANSACTION_ERROR: 29189 2018/02/01 04:11:34 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000bca000-0xc)='/dev/rfkill\x00', 0x280340, 0x0) ioctl$KDSKBMETA(r0, 0x4b63, &(0x7f0000609000-0x8)=0x5) getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffffff, 0x84, 0x6c, &(0x7f0000001000-0x1008)={0x0, 0x0, ""}, &(0x7f0000000000)=0x8) perf_event_open(&(0x7f000001d000)={0x5, 0x78, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x68, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, @perf_bp={&(0x7f0000000000)=0x0, 0x1}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$netlink(0xa, 0x6, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r1, 0x10d, 0xb, &(0x7f0000000000)=0x0, 0x4) 2018/02/01 04:11:34 executing program 4: r0 = syz_open_procfs(0x0, &(0x7f0000051000-0x7)='ns/mnt\x00') mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000a5c000)=@raw={'raw\x00', 0x9, 0x4, 0x3e8, 0x300, 0xffffffff, 0xffffffff, 0x300, 0xffffffff, 0x0, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x4, &(0x7f0000000000)=[{0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}], {{{[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0xa8, 0xd0, 0x0, {0x0, 0x0}}, {0x28, '\x00', 0x0, 0x300}}, [{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0xf8, 0x120, 0x0, {0x0, 0x0}, [@unspec=@rpfilter={0x28, 'rpfilter\x00', 0x0, {0x2}}, @unspec=@rpfilter={0x28, 'rpfilter\x00', 0x0, {0x4}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00', 0x0, {0x6}}}, {{@ipv6={@remote={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0xbb}, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x1}, [0x0, 0x0, 0xffffffff, 0xffffffff], [0x0, 0xffffff00, 0xffffffff, 0xff], @generic="00bf24ec722f363e6fab56a8b8cf5541", @syzn={0x73, 0x79, 0x7a, 0x0, 0x0}, {0xff, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, {0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x3f, 0x4, 0x1, 0x42}, 0x0, 0xa8, 0x110, 0x0, {0x0, 0x0}, [@unspec=@void="", @unspec=@void=""]}, @unspec=@CT1={0x68, 'CT\x00', 0x1, {0x5, 0x5, 0x401, 0x0, 'snmp\x00', 'syz1\x00', 0x8}}}, {{@ipv6={@empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, @local={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0xaa}, [0xff000000, 0xff000000, 0xffffffff, 0x0], [0x0, 0xffffffff, 0xff000000, 0x0], @generic="6d758b1dadac4fb4efa6f72657312196", @common='teql0\x00', {0xff, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, {0xff, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x0, 0x3, 0x0, 0x40}, 0x0, 0xa8, 0xe8, 0x0, {0x0, 0x0}, [@unspec=@void="", @unspec=@void=""]}, @common=@unspec=@TCPOPTSTRIP={0x40, 'TCPOPTSTRIP\x00', 0x0, {[0x1, 0x3, 0x2, 0x30, 0xbd0, 0x9, 0x1, 0xfffffffffffffffd]}}}]}}, 0x448) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) seccomp(0x1, 0x0, &(0x7f000089b000-0x10)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x407ffc0003}]}) shmctl$IPC_INFO(0x0, 0x3, &(0x7f0000564000)=""/4096) 2018/02/01 04:11:34 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet_sctp(0x2, 0x4, 0x84) sendto$inet(r0, &(0x7f0000022000-0x16)="01", 0x1, 0x0, &(0x7f0000031000-0x10)={0x2, 0xffffffffffffffff, @local={0xac, 0x14, 0xffffffffffffffff, 0xaa}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x10) r1 = syz_open_dev$sndpcmc(&(0x7f0000001000-0x12)='/dev/snd/pcmC#D#c\x00', 0x9, 0x2) sendmsg$nl_netfilter(r1, &(0x7f00004e0000-0x38)={&(0x7f00008b3000)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000572000-0x10)={&(0x7f0000980000-0x25c)={0x25c, 0x10, 0xf, 0x302, 0x2, 0x3, {0x3, 0x0, 0x9}, [@generic="63aa9f16486bd1bb21fe6ed9a03271d473a0d106448bdb8002da8228a08b23a25a0f3981dcf59e4d705d4b7f68b342d2b7237b108fad2f2b68def97070ccef207be8b7cf97e306b08de3181c6fb9becc5817d6", @generic="b05f8b1051793c6ace893160c9dee8fc5a54b54cca41b2a8f942a927018c4f15b234ccb193df33518b131abd5e8afb3de0e85f93ecc8ffff77613aa5352de86539d2aae242ded813ff50137b32c88a615f15c8a152029e2f4fb57e62692392c8e44b378a7be99c39901df08ed6554a5d7f4da954b81fd1d13eaf64a14f5c755c94280dbb75798b427546d323aaf8d2ae98aa7127f527b7538235c4262c67412ac64ffacd2d031ad560d1738381d0d9d25cbda4a02c1b2e00c21b122a8372b0869c4df0276c72529531e87eec3f82b51a0aaaed3cc49a6615078d2d27b15de1f5982d95c527af64a8df8c61007b67137661a75079207fe4b398b4d0a9", @generic="20634221d28be57859ff35b003c87210f26fac659af179326c7d45786442a6180c8592f7c220b77c1576c9dbd5776b74dff818afdf1387e8166df669c77bac2ecd73e4de5f749f0426419e27b61ee5a119bd120ca5a5be0a179dbe87a7d170fd592646a57e43f04c846afcacc3c647f055a66fae55f3f29fd6e80da48362518ba4f3f3708480296e2841386d8779c1872957cbf30cf01a519c294c84783b023fd54b0b5909a48ae405899e3e66fde7b72ce2e046c8419afa997ab10eb440a97cfd47c6d161221cf32b8d87885f77de3f7c8a0d89f12525b6e0048cf6de95327d2c7d19fcba7d3abb259f1d5ea16dedb44d12da9e1f947a03e0"]}, 0x25c}, 0x1, 0x0, 0x0, 0x44801}, 0x10) fcntl$setstatus(r0, 0x4, 0x0) shutdown(r0, 0x1) 2018/02/01 04:11:34 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f0000590000-0x8)='./file0\x00', 0x14) write$selinux_create(r0, &(0x7f000074c000)=@access={'system_u:object_r:dpkg_exec_t:s0', 0x20, '/usr/sbin/cups-browsed', 0x20, 0x32, 0x30, 0x0}, 0x3b) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f00007cf000)='/dev/cuse\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_STATUS(r1, 0xc05c5340, &(0x7f0000b85000)={0x6, 0x100, 0x2, {0x0, 0x0}, 0x0, 0x4, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000801000-0x9)='/dev/ion\x00', 0x0, 0x0) r3 = syz_open_dev$binder(&(0x7f0000233000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r4 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0) r5 = dup2(r3, r4) write$tun(0xffffffffffffffff, &(0x7f0000577000)=@pi={0x0, 0x0, @eth={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x0}, [], {@canfd={0xd, {{0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0, "feb442a1f43ead325d71fed774c8f6028c2a6b79a4e418aa3c5f391769659fef9f596cdade428c389e511eaad39d2ee4334dee9516a31d00510baaf06efc0980"}}}}}, 0x5a) r6 = dup2(r4, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004ee000-0x76)='\x00', 0x1, 0x0, 0x0}], &(0x7f000000b000-0x30)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)=""}) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f00005da000)={0x0, 0x0, &(0x7f00000d8000)=[], 0x48, 0x0, &(0x7f000044c000-0x83)="a410778b7a640ab0384c4ead541b6ee57c5645909ef688d8ac3e5ecfc7039f5f8ba53f127b7f01947cd3689eaf6c090277915bab2a0c450988cb85688e2bcc101a80664d3081fcc0"}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000c5a000)={0x0, 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000a95000-0x30)={0x14, 0x0, &(0x7f0000b8f000)=[@increfs_done={0x40106308, r7, 0x1}], 0x0, 0x0, &(0x7f00002e4000-0x70)=""}) getsockopt$inet6_dccp_buf(r5, 0x21, 0xcf, &(0x7f0000e10000-0xcc)=""/204, &(0x7f000037d000-0x4)=0xcc) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000436000-0x30)={0x14, 0x0, &(0x7f0000136000)=[@increfs_done={0x40106308, r7, 0x0}], 0x0, 0x0, &(0x7f0000888000-0xb)=""}) close(r2) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000002000-0x38)={0x0, 0x0, &(0x7f0000003000)=[], 0x0, &(0x7f0000002000)=[], 0x0, 0x0}, 0x0) 2018/02/01 04:11:34 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = dup2(0xffffffffffffff9c, 0xffffffffffffffff) setsockopt$packet_rx_ring(r0, 0x107, 0x5, &(0x7f000059c000)=@req3={0x7f, 0x6, 0x1, 0x100000000, 0x1, 0x6, 0x80000001}, 0x1c) r1 = socket$inet(0x2, 0x1, 0x0) bind$inet(r1, &(0x7f00000f1000-0x10)={0x2, 0x3, @broadcast=0xffffffff, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x10) connect$inet(r1, &(0x7f0000987000)={0x2, 0x3, @empty=0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x10) sendmmsg(r1, &(0x7f0000605000)=[{{&(0x7f0000a4e000-0x10)=@vsock={0x28, 0x0, 0x0, @any=0xffffffff, 0x0}, 0x10, &(0x7f0000909000-0x80)=[], 0x0, &(0x7f0000f28000)=[{0x10, 0x1, 0x0, ""}], 0x10, 0x0}, 0x0}], 0x1, 0x0) 2018/02/01 04:11:34 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = perf_event_open(&(0x7f00000bf000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000)=0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000015000-0x78)={0x1, 0x78, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000)=0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r1, 0x2405, r0) r2 = dup3(r0, r1, 0x80000) getsockopt$inet_sctp6_SCTP_NODELAY(r2, 0x84, 0x3, &(0x7f0000595000)=0x0, &(0x7f000077c000)=0x4) 2018/02/01 04:11:34 executing program 2: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000801000-0x9)='/dev/ion\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000233000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) dup2(r2, r0) write$tun(0xffffffffffffffff, &(0x7f0000577000)=@pi={0x0, 0x0, @eth={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x0}, [], {@canfd={0xd, {{0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0, "feb442a1f43ead325d71fed774c8f6028c2a6b79a4e418aa3c5f391769659fef9f596cdade428c389e511eaad39d2ee4334dee9516a31d00510baaf06efc0980"}}}}}, 0x5a) r3 = dup2(r2, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004ee000-0x76)='\x00', 0x1, 0x0, 0x0}], &(0x7f000000b000-0x30)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)=""}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00005da000)={0x0, 0x0, &(0x7f00000d8000)=[], 0x48, 0x0, &(0x7f000044c000-0x83)="a410778b7a640ab0384c4ead541b6ee57c5645909ef688d8ac3e5ecfc7039f5f8ba53f127b7f01947cd3689eaf6c090277915bab2a0c450988cb85688e2bcc101a80664d3081fcc0"}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000c5a000)={0x0, 0x0, 0x0, 0x0}) mmap(&(0x7f0000000000/0x13000)=nil, 0x13000, 0x0, 0x32, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000a95000-0x30)={0x14, 0x0, &(0x7f0000b8f000)=[@increfs_done={0x40106308, r4, 0x1}], 0x0, 0x0, &(0x7f00002e4000-0x70)=""}) 2018/02/01 04:11:34 executing program 1: openat$ion(0xffffffffffffff9c, &(0x7f0000801000-0x9)='/dev/ion\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000233000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = dup2(r0, r1) write$tun(0xffffffffffffffff, &(0x7f0000577000)=@pi={0x0, 0x0, @eth={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x0}, [], {@canfd={0xd, {{0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0, "feb442a1f43ead325d71fed774c8f6028c2a6b79a4e418aa3c5f391769659fef9f596cdade428c389e511eaad39d2ee4334dee9516a31d00510baaf06efc0980"}}}}}, 0x5a) r3 = dup2(r1, r0) linkat(r2, &(0x7f00009ad000)='./file0\x00', r2, &(0x7f00003d7000)='./file0\x00', 0x400) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004ee000-0x76)='\x00', 0x1, 0x0, 0x0}], &(0x7f000000b000-0x30)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)=""}) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000cdc000)={0x1, &(0x7f000024a000-0x8)=[{0x8, 0x2, 0x5, 0x1}]}, 0x10) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00005da000)={0x0, 0x0, &(0x7f00000d8000)=[], 0x48, 0x0, &(0x7f000044c000-0x83)="a410778b7a640ab0384c4ead541b6ee57c5645909ef688d8ac3e5ecfc7039f5f8ba53f127b7f01947cd3689eaf6c090277915bab2a0c450988cb85688e2bcc101a80664d3081fcc0"}) accept4$llc(r2, &(0x7f00008f0000-0x10)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={[0x0, 0x0, 0x0, 0x0], 0xffffffffffffffff, 0x0}, [0x0, 0x0]}, &(0x7f0000b4e000-0x4)=0x10, 0x80800) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000c5a000)={0x0, 0x0, 0x0, 0x0}) mmap(&(0x7f0000000000/0x13000)=nil, 0x13000, 0x0, 0x32, 0xffffffffffffffff, 0x0) ioctl$KVM_X86_GET_MCE_CAP_SUPPORTED(r2, 0x8008ae9d, &(0x7f0000974000)=""/51) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000a95000-0x30)={0x14, 0x0, &(0x7f0000b8f000)=[@increfs_done={0x40106308, r4, 0x1}], 0x0, 0x0, &(0x7f00002e4000-0x70)=""}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000436000-0x30)={0x20, 0x0, &(0x7f0000136000)=[@dead_binder_done={0x40086310, 0x3}, @increfs_done={0x40106308, r4, 0x0}], 0x0, 0x0, &(0x7f0000888000-0xb)=""}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000c64000-0x30)={0x78, 0x0, &(0x7f00004c4000)=[@reply={0x40406301, {0x2, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20, &(0x7f0000b4c000)=[], &(0x7f000061e000)=[0x38, 0x78, 0x38, 0x48]}}, @decrefs={0x40046307, 0x4}, @dead_binder_done={0x40086310, 0x0}, @dead_binder_done={0x40086310, 0x3}, @dead_binder_done={0x40086310, 0x0}, @exit_looper={0x630d}, @register_looper={0x630b}], 0xf9, 0x0, &(0x7f00004a6000)="2f903fb3cdadc1f8e06380d2763c0f9dff792f7a793737baa3ed31c4a70bf8f40854628a0ceedbcc75366e9061a7cf984245f47c8a99de71f6c1a59e13238acd18760b6a948a2175b6708461bfea6f643e74bd234bf032d49785e55a84b4461e5a3cbf101d2c87bc1bc8dcbac8adbeb690ee3ffef949337916d800a44a74786e2984a66b44f13c1f984f904a39158f02fe7d295890a4b37dac787a565fd48dfcc1e0085193c5f106b60535897a61f6b3abda926ca6452d83f4029092caafa1d27f2a0a18e3733e6ba6e3316bd73681f76b5adf0ea11946d8a4a39f661e473fd5f7ea59301f7533bcb28cd89a70be4346bcb120b23f42108f00"}) [ 314.212317] binder: undelivered TRANSACTION_ERROR: 29189 2018/02/01 04:11:34 executing program 5: mmap(&(0x7f0000000000/0xd33000)=nil, 0xd33000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) socket$packet(0x11, 0x3, 0x300) getsockopt$inet_tcp_int(r0, 0x6, 0x11, &(0x7f000003a000+0x337)=0x0, &(0x7f00009e0000-0x4)=0x4) mmap(&(0x7f0000d33000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r1 = semget(0x2, 0x2, 0x0) semctl$GETALL(r1, 0x0, 0xd, &(0x7f0000484000-0x82)=""/130) getsockopt$sock_buf(r0, 0x1, 0x1c, &(0x7f0000099000-0x10)=""/16, &(0x7f0000d33000)=0x10) 2018/02/01 04:11:34 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000)=0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ion\x00', 0x0, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000002000-0x38)={0x0, 0x0, &(0x7f0000003000)=[], 0x0, &(0x7f0000002000)=[{0x10, 0x10e, 0x0, ""}], 0x10, 0x0}, 0x0) ioctl(r0, 0xc0184908, &(0x7f0000002000)="") r1 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000630000-0x1e)='/selinux/commit_pending_bools\x00', 0x1, 0x0) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(0xffffffffffffffff, 0x84, 0x6d, &(0x7f00000ff000)={0x0, 0x1000, "5b9d0a9ad70fd1ae4c0eedaa339ebeac131502a5e80ac230c57c7f073c09d999c15f95d1dccf90d902c301abcfaab9b6006878e44993f7fd25209989ba0c447ee483633b3972cb10b0f4da04afd1d2c7df4b876f455c0b7b85f04d4d22ae2f0b62df76bc449a7d8bf37303fd6ccc1a1fc22221901c209c8e840e067fcb0bb7230394120da657bd017c0d5696e3ab5cfb2ea7677ea04ce27744569b63ad283253d06c9bf50247ff358b582301c8a86df75efde0e9f0dbf7aba0633be7f868cd2a230f63456ee3354c0db20614a817dc3bda27043b8d360d52a711ade33ce97db2954bd7ba6206bab0fc46c0d344c6b5114254fa19dfd23216184180f06b5b6b7db64446dac53932d6996a3abccfdfe9f5112678a2a4762401fb2f7651c1fb385eecb53120f272bd4bc05ee72aafff02031cdcc9ec605258f0f91fcaeb9f459fa493960fe510506df7d3482b624867bd6204c99eab0c8a30b419c3adf365d25e46867197ce986ab37918aa045b3e7b500360e589785a71e002fb3dfb66dbc122757018be23d2bb0d565ea3d69dc5bc8c669cf5424a6442e5ece62d0bc92342fce04c9dde152a00fd4c3aa61522a3aade5a6a3be32ea3dac70aa058292727fc51599845ca6dfda04b550c94ed032bc978350d5b662fe224a62d5de9c27ff5b9e00528b22e19a556cc229a44df39b6cc2d039da45af9ed90c4216b1eb7e9aba6a81c0492a476a51be4e0544fd6f08c63f8e7fe0117d0786b2cca7df3a8c531798ff72cafefb9ab224e0bfd68c40b5fc265d5491c39b0d59177f931dcdbefccf45b512efc05333599341ebdabb45e81b45182035eba1e1f941791de63364a40b6be19000f6376badd387dc3066ee091247e715c881780d85b9b78f697b1406517151262f6b66548eb4ae3c5fde9cb11947823dde9fd07b6c9b93276f82c91a90a3b71e900307cbc305295e1c032ba9af609dc2cd40c2471367b823c88f337d0d3b6413ae0f727c92165ba7da45696f3421b137cb9d5e78d992fd0641214b80fe3ed7bca20680d87a025223ab47fa52a51b50fad9030ce6688cd107936a78d61e91ffe6f389a5d41ecc64f798e1f7f92199e0719e57b95529dc784438f36cf585a8d1bf6624786b3aeb73a7c830851dc0db5691e30eb7cefb975f61cab4c00f4dc75fb2021d69bb68f41743ff2b020b581059da52916e40567b04c603d9c1fbaec3208c649398058526ab1fc181f062929accf4078b207eddfdf34ac395830dcc9826b278ea90af395a65cd7ddc2613f671a31ef2ce216b8a0db440290e88811b0390cbaecce0d5824c08c7ba15a75f8666c403a88ab3c06ede46b598eb4978df83c904ec3a2a48f25af932d41e332b221d61626c3595199a92461f8790a325716b78c2c3adda7a29bf08e733bafd9759c4989700d6bcd4f6c8c0b4f467da2e8273202ac8ba65bce64d408b78e584b373f438a3a53673e3708f766a8a3b6477ce373364ce45279359ef2d31931936298d18f9b765d9229aa59db14233e02fd0abd13de1c4d4a90d3bbdb0f3afce403cc22e012a07b1ac42c7ab0ad92f7db5cc65e9e09304a9fbc00ea47049b372d2883b2d43109de19b1eb851de8a4a5de5180b920d97f2f315e2a3cebdc9c7144b8f3429fcb87613e7e9b6a8fd838b2cc8e559ab8492ef45f17b0ecbe99f0b6ef6a3d62323c6a740beea26fb69ef0b2ec9a2cb6806c509eff661a3f6ba872c76f45bb0c6a991965447a002a9ea62adf814949c733390cdd28a13de38dea5fe1441cc6d0399475294294705ccd6686a0cc59e4b10d338aa18927fea2026dcc81011899f2045ed6b9b017924ae71190abc5291eed817d6a317a30609dc3750bff39a98998f7eff022cbe013656e56e62deaa345854d5abbdf6a19c9d07c16c9a2e42d4ebfcdc06f4d1cb118a1cc5445e28945ecec214f4a3ad95bb1f2ca2a3bb1766d756465b8efabdff159c76e8b94d206868311cecb935165cd60a3bf996bacf6bb5e36223f096aab20189f330887e9713995683dbfec5efdf50ddddececae8d382105a385e7244d9657f60381fd68cd6a9576f6af985a4f563410c20b3b70fb915c3d886c0e503a6ec46f97317e1cbf74b0f3e779127c26f3710a6877583ec40c1b064f92265eff4e14118278f7a486a55cd00dcf38143379ab831e94808e015c5c050f248bc36dd8f15e20e5bfc80198f11d5825222785e403d42dd145273dd784af404a741c48313da84febcee153291bf40242329cdc96e7b03f3e29196075f3f8f0fbd6726acb98556dccb5d4745cc5581c17a4c15a9eb16eda983e39d2ec08530765ba2b2791164a85973cef2f9f351e89ab29c4125158f4b9b88bc28349e5813ac4428257a10273bb8e3d86ea9007872143f8c54fb7edcf3ae6d046bec3e5c757add3b07222970be8a71c6a64499e1ae6468a91200d94fc765d45604b5595c2ba074d89f56e0e85ef5c558956139cee4b205ef1762d02931d510882683eb8dae0afff266400ba29f7ebf28507b965c69ae2717c506a4cd00b118466ab2a8b7ff3c47688c32d90a6fd0d9faf47b427b40bd43e7bb9cf7cf808b81236bc6d59b7b6f9bb866f25e6adbe808f3d4bc27407e2e11856965c1f7676e5d9e3332f861f9d49a4d6c613aca486a79835eefeb114dc2995ff14eaa5b87c4a94c5e5fdebe5adf9833fc2c3b35fdfe392ea9c64cae06aee08d1de2daae281e6473089b828b49d88bd46822397afea282b6a7cb7924a56d6724923e44e0a3528186bd9cf8c04632838ca9051320a848f4508db1d82a7ec5c5181462d41c3ae9c5233c14bafd46675414890359a1be52faa75c8b386a2af734c53d6cb684a8f860714e51bf6ff123bc709b377a6f5c395df9fa5f1853cb6ef65eef5c4ee8806e48a8fbd38cf095c8206cf02a8605061f88a41c13091722f9c2eb5df073e62b2287e9b30a3e1a0201a3468da8e2f043986c4c1bb7d613120d975d289d0204f2516cf534966d8c39a19400794aa6d91ff7e9a50888fff93eec55de85061a6cb391735a9923b03c03967fcf3c81648d69e3c02966ed71b440ac0110913c6a7e131250ad0c211141b2aeefa51131bc5eace40c7aa59a5bc2b06c02589ed79e3c6ee13418bd060a083363d58ed14cc49bbd6eafc8cb89f27982c07e9836941c00c92c2c917e4e3608a0da68779125c77c75aeb7b71c2f65a398f903963a9e93a53c460f22dcfbe34b166f2059404d93f13c8bd0cf1b4fca328431b0106b1a136d1dca3dc9e539bb8ecea8aafd8119cc0d72f234eeed94b43a55fe71336cca7a4d6bdb768d59756f35b897d161413ed9d1dbf07b1d4aedd923cd08f1baa85dd114c6542192cf0644851d1200fd9d3340a283b179bc70caf2d73a61b859071e18a78b373d5357b140ff358555e2105f10893c8d8c68d5db9ff1fa467d3b6c3450e419ea062bf03b89ed24dc656803efa746661c06256a33628f6fc333590ad22923cd0a833fac9efc54974bba6ebad9a2e7a7e7659208a91858cbcdc2c6dc7ca74c5f66bb0e28aa484c591af37bc571ca19ff035bd558cbfc3cb6816785596bd4ef9ada21c0539ebbae7c23ce6cb873199248befcb6ee562088b87e93b398852e3744bd118e6b1310106407be59167f3abcb6121acb7abe633a5393c0bf60553506f638157002a892fba2a912fa36c66b38a06682d31891df992dec5d0ecef7c281c93c62ca6e0a5dcb4689788cf122cc2e4d244d1cf2e8590ff41470f059ec1bc010cb5a7590fcbb889f5bcda9848d241ec714db596761c963f8f871b3d283453bacc376407214f6a1f29d8d0ae44f25937d853622e2c64e9cfabb398d0606f49997d2113abbd7bf9c3004c4ada3b1ac481ab7af8cc8ac973a41ed294074d44556781a42feb6b8e61cee4b9cfe47410a112f209021fc995f89f85b2a85b82fefde2c50b067f6690cafeaa62679b716ca81d4a754c65aae606b1b7e7b6c4356af87747cd7babdf95f53eb8e0d64ff5d20eba5f386dd175d8d92d0e3a0f4ee328004e9e2a39819b0c70414bb0b52e427d1abb4aeef31a0684c2af4a53f4c99ca6ca87fb0895fcffbdcf6084d469d5c62e9ff0d9a0c7d1a383ce1fcf799e4a60590eaf88bed3355ae7628b89e12f10926f98db244ba480944371086118e3a73ffdb90fa3da135cfd79681faca5ab3f2ab55212c28e1c02d4b37c3a9e3573567b663ebe89e180628274b6caefbb9d7c146a8784b118f8204aeaef9fde95dcbcbbc583880580b073d09abcdc097cf3a9f855e81e3058217d955a9e0626b860933982623fc364c805c858784655dc32e75607656fa32751a9a59f97c731eff314be139988b57e701645602f8b6d6ec3646e53d576fd90fe064d6512b20ad54eae1a7a97f516101ae8860aae6acc45e6665b84c7f0744b7fc6316ed7e867b4165bdb9176c85d56e43cf5b16c84dc212f8bfb35db4677b6777b5ef8495759c00de228a992dbc1f2878912a48a0e9ba50b064e1c247fc125768f2b9e8c9bb785d72463e2cf0c5c8b5bcf09c3fd9ba980bc500de377bf67d10b9c6af70c46e57d828aab52c1e5e8ef34fca8b167e4c2270495834e4b10f36bb0bee82373f801eeb13c4dc06b843a6861f7fbf364e55cb92e259f0db1f4c5cb27269066ca4c5314aa1bde5c00b455945f52cd0f69c7def756a58582ca3a932582e46ab21823f9febc9346afa0d280c6c30f25af5298037cba3e2f72a54503be3b0adfb9044e5e016600a8b3bb671b1d8c6984af24076bdac9c2bebb8d9a0e182fd48e8e9a241d7491796559678cfb7abae6670c5d824acf5f97b883aeb14da9cc8f230c73246c92f564f6f3ad2313e36257014426f238201003b43763f2143fc40d61ebd19838aae3ee2e5e5ab29a0ab7118b9befc85c7cb429a18eae19eb5f956253cc6347ffae5a5906d86b62c7fdcdfb5a2a67911b4f5358b94b43ab96a0b0d88066c1375e606174ee91edc3dfd6910b965aaefde920ff439bd6ab9fdfeee9064b7d0bc5fe30505e13480d55ded9181490088676e20e43d4c1207ec34261a72406493a07fd425dd20bc431442c13981569217cf7df877ac0fdce2451eb88e70dea154f213de02975f3b2faaac5b4320b959c850dbb41ab6e5690d1ebbf4c9b21b422a55abfdc7e034510eb410ec62df83cf6c4f000405be770cab90aa45d246075fed39f623dd40dab421c643fcdb001ef4297d083200753b8dc6aaab401e9afbc23f631d786ce2a7e5c3c8a023f185a080056adde2f014f72e64ecefe19c0f8706374478c72c89fbb1856fb70cf9c9b13b0514f792f2a558ed21ed3293f792cf39381b16129317bf24c27159e1e29c38d1a756cdc6966bf811301bef94655ccaa12f66683b05563365ad3081b2bbde2ca4918a546ba806e419b076526ea75731bac4f6be47498ff27931657a2776e4fe57e2e0c2f01d7e11056e534afdcd28038ed298ed680b3b89169525eba4d80e2f14efa9bda5c05c873a5b7c075eceac2725fe8e822555d89ba674527800e9f68212dfa8452168203860f5b7e7681ba88aa451acefecce39287219d49d1675c4a0fd896e70c1c7c0380409710126ac89fcaf390e5d1f930a017743385c8407b7e5ed02b621ca1497cd60bf63aa22213a6e8a22474127fa86698da734a49b9003804dde5cf16dc0a811369c994953d4ebfa796d4bde27e8421493c0522c69b968a612a95b9d1712cf5a3664e3b45622b8bbf5eb2be07c047850debc5abb9b057e15889eb42d337e9f6e1d474be57b08e01bf3d811853a10"}, &(0x7f00009e1000-0x4)=0x1008) setsockopt$inet_sctp6_SCTP_AUTH_KEY(r1, 0x84, 0x17, &(0x7f0000860000)={r2, 0xffff, 0x7c, "d423a7b3ead08634ffeb6a6b58c6c8076c6730e2ab51b40e868dad7eb02afd5d45f9f4d09223da353cc5ffd04e8cc3aba290070fb86a98e017acaf8c6cae6663a2eba293a87992732a5a15b25f7d6aff89dc7c74377920e9723ba273cfa46699dd160ab8388d2b875366f4ef9c4c735926fb68afb5cc444765e3c500"}, 0x84) r3 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000181000+0x695)='/dev/vga_arbiter\x00', 0x101042, 0x0) getsockopt$bt_BT_FLUSHABLE(r3, 0x112, 0x8, &(0x7f00005a6000)=0x800, &(0x7f0000226000)=0x4) [ 314.275297] binder: BINDER_SET_CONTEXT_MGR already set [ 314.292245] binder_alloc: binder_alloc_mmap_handler: 16159 20000000-20002000 already mapped failed -16 2018/02/01 04:11:34 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket(0xe, 0x7, 0x6) setsockopt$inet_sctp_SCTP_AUTOCLOSE(r0, 0x84, 0x4, &(0x7f0000dd7000)=0x1f, 0x4) r1 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000309000)='/dev/rfkill\x00', 0x0, 0x0) ioctl$KVM_GET_DIRTY_LOG(r1, 0x4010ae42, &(0x7f0000df6000-0x10)={0x1ff, 0x0, &(0x7f0000411000/0x3000)=nil}) seccomp(0x1, 0x0, &(0x7f000089b000-0x10)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x407ffc0003}]}) getsockopt$inet_sctp_SCTP_PR_SUPPORTED(r0, 0x84, 0x71, &(0x7f000038a000)={0x0, 0x7}, &(0x7f0000bd6000)=0x8) ioctl$PERF_EVENT_IOC_RESET(r1, 0x2403, 0x6) getsockopt$inet_sctp6_SCTP_STATUS(r0, 0x84, 0xe, &(0x7f0000007000)={r2, 0x1, 0x6, 0xa00000, 0xfffc000000000000, 0x81, 0x8000, 0x458f, {0x0, @in6={{0xa, 0x0, 0x80000001, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x1}, 0x80000000}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x40, 0x4, 0x6, 0x9, 0x3}}, &(0x7f0000f17000)=0xb8) shmctl$IPC_INFO(0x0, 0x3, &(0x7f0000564000)=""/4096) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r0, 0x84, 0x8, &(0x7f0000c3a000-0x4)=0x0, &(0x7f00007a3000-0x4)=0x4) 2018/02/01 04:11:34 executing program 2: openat$ion(0xffffffffffffff9c, &(0x7f0000801000-0x9)='/dev/ion\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000bbf000)='/dev/binder#\x00', 0x0, 0x0) r1 = creat(&(0x7f000064a000+0x396)='./file0\x00', 0x15) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000df2000)={r1, 0xffffffffffffff7d, &(0x7f0000e0b000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16}}, 0xfffffffffffffddf) r2 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) r3 = dup2(r0, r2) write$tun(0xffffffffffffffff, &(0x7f0000577000)=@pi={0x0, 0x0, @eth={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x0}, [], {@canfd={0xd, {{0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0, "feb442a1f43ead325d71fed774c8f6028c2a6b79a4e418aa3c5f391769659fef9f596cdade428c389e511eaad39d2ee4334dee9516a31d00510baaf06efc0980"}}}}}, 0x5a) r4 = dup2(r2, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004ee000-0x76)='\x00', 0x1, 0x0, 0x0}], &(0x7f000000b000-0x30)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)=""}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00005da000)={0x0, 0x0, &(0x7f00000d8000)=[], 0x48, 0x0, &(0x7f000044c000-0x83)="a410778b7a640ab0384c4ead541b6ee57c5645909ef688d8ac3e5ecfc7039f5f8ba53f127b7f01947cd3689eaf6c090277915bab2a0c450988cb85688e2bcc101a80664d3081fcc0"}) ioctl$DRM_IOCTL_AGP_ALLOC(r4, 0xc0206434, &(0x7f000098a000)={0x1, 0x0, 0x10001, 0x6}) ioctl$DRM_IOCTL_AGP_ALLOC(r3, 0xc0206434, &(0x7f00005a0000)={0xfffffffffffffffd, r5, 0x2, 0x6}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000c5a000)={0x0, 0x0, 0x0, 0x0}) mmap(&(0x7f0000000000/0x13000)=nil, 0x13000, 0x0, 0x32, 0xffffffffffffffff, 0x0) accept4$vsock_stream(r4, &(0x7f000090f000)={0x28, 0x0, 0x4638225dd56c2a26, @reserved=0x1, 0x0}, 0x10, 0x80000) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000a95000-0x30)={0x14, 0x0, &(0x7f0000b8f000)=[@increfs_done={0x40106308, r6, 0x1}], 0x0, 0x0, &(0x7f00002e4000-0x70)=""}) getresgid(&(0x7f0000e16000-0x4)=0x0, &(0x7f0000ebb000)=0x0, &(0x7f00001fa000)=0x0) lstat(&(0x7f0000b21000-0x8)='./file0\x00', &(0x7f0000e13000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) lstat(&(0x7f0000628000-0x8)='./file0\x00', &(0x7f0000f28000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) getgroups(0x3, &(0x7f00009de000)=[r7, r8, r9]) 2018/02/01 04:11:34 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet_sctp(0x2, 0x1, 0x84) socketpair(0x7, 0x6, 0x2a64, &(0x7f000047d000)={0x0, 0x0}) bind$vsock_dgram(r1, &(0x7f0000cb3000)={0x28, 0x0, 0xffffffff, @hyper=0x0, 0x0}, 0x10) sendto$inet(r0, &(0x7f0000022000-0x16)="01", 0x1, 0x0, &(0x7f0000031000-0x10)={0x2, 0xffffffffffffffff, @local={0xac, 0x14, 0xffffffffffffffff, 0xaa}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x10) shutdown(r0, 0x1) 2018/02/01 04:11:34 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f0000590000-0x8)='./file0\x00', 0x14) write$selinux_create(r0, &(0x7f000074c000)=@access={'system_u:object_r:dpkg_exec_t:s0', 0x20, '/usr/sbin/cups-browsed', 0x20, 0x32, 0x30, 0x0}, 0x3b) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f00007cf000)='/dev/cuse\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_STATUS(r1, 0xc05c5340, &(0x7f0000b85000)={0x6, 0x100, 0x2, {0x0, 0x0}, 0x0, 0x4, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000801000-0x9)='/dev/ion\x00', 0x0, 0x0) r3 = syz_open_dev$binder(&(0x7f0000233000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r4 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0) r5 = dup2(r3, r4) write$tun(0xffffffffffffffff, &(0x7f0000577000)=@pi={0x0, 0x0, @eth={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x0}, [], {@canfd={0xd, {{0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0, "feb442a1f43ead325d71fed774c8f6028c2a6b79a4e418aa3c5f391769659fef9f596cdade428c389e511eaad39d2ee4334dee9516a31d00510baaf06efc0980"}}}}}, 0x5a) r6 = dup2(r4, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004ee000-0x76)='\x00', 0x1, 0x0, 0x0}], &(0x7f000000b000-0x30)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)=""}) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f00005da000)={0x0, 0x0, &(0x7f00000d8000)=[], 0x48, 0x0, &(0x7f000044c000-0x83)="a410778b7a640ab0384c4ead541b6ee57c5645909ef688d8ac3e5ecfc7039f5f8ba53f127b7f01947cd3689eaf6c090277915bab2a0c450988cb85688e2bcc101a80664d3081fcc0"}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000c5a000)={0x0, 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000a95000-0x30)={0x14, 0x0, &(0x7f0000b8f000)=[@increfs_done={0x40106308, r7, 0x1}], 0x0, 0x0, &(0x7f00002e4000-0x70)=""}) getsockopt$inet6_dccp_buf(r5, 0x21, 0xcf, &(0x7f0000e10000-0xcc)=""/204, &(0x7f000037d000-0x4)=0xcc) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000436000-0x30)={0x14, 0x0, &(0x7f0000136000)=[@increfs_done={0x40106308, r7, 0x0}], 0x0, 0x0, &(0x7f0000888000-0xb)=""}) close(r2) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000002000-0x38)={0x0, 0x0, &(0x7f0000003000)=[], 0x0, &(0x7f0000002000)=[], 0x0, 0x0}, 0x0) [ 314.339376] binder: 16161:16167 ioctl 40046207 0 returned -16 [ 314.339429] binder: BINDER_SET_CONTEXT_MGR already set 2018/02/01 04:11:34 executing program 5: mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$usbmon(&(0x7f0000001000-0xd)='/dev/usbmon#\x00', 0xffff, 0x400) connect$vsock_stream(r0, &(0x7f0000f3a000)={0x28, 0x0, 0xffffffff, @hyper=0x0, 0x0}, 0x10) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000012000)={0x2, 0x78, 0xfffffffffffffff5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x33, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000)=0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0x0, 0xffffffffffffffff, 0x0) keyctl$join(0x1, 0x0) timer_create(0x800000000007, &(0x7f0000b3d000)={0x0, 0x3c, 0x0, @thr={&(0x7f000022f000)="", &(0x7f0000298000)=""}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, &(0x7f0000a7e000)=0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f00007e2000-0x10)='/dev/sequencer2\x00', 0x2000, 0x0) clock_gettime(0x0, &(0x7f000041b000-0x10)={0x0, 0x0}) timer_settime(0x0, 0x0, &(0x7f000005c000-0x20)={{0x0, 0x0}, {0x0, r1+30000000}}, &(0x7f0000046000)={{0x0, 0x0}, {0x0, 0x0}}) exit(0xfffffffffffffffe) timer_settime(0x0, 0x0, &(0x7f0000147000)={{0x0, 0x0}, {0x0, 0x0}}, &(0x7f0000040000)={{0x0, 0x0}, {0x0, 0x0}}) [ 314.339449] binder: 16156:16164 ioctl 40046207 0 returned -16 [ 314.345374] binder: BINDER_SET_CONTEXT_MGR already set 2018/02/01 04:11:34 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f0000590000-0x8)='./file0\x00', 0x14) write$selinux_create(r0, &(0x7f000074c000)=@access={'system_u:object_r:dpkg_exec_t:s0', 0x20, '/usr/sbin/cups-browsed', 0x20, 0x32, 0x30, 0x0}, 0x3b) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f00007cf000)='/dev/cuse\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_STATUS(r1, 0xc05c5340, &(0x7f0000b85000)={0x6, 0x100, 0x2, {0x0, 0x0}, 0x0, 0x4, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000801000-0x9)='/dev/ion\x00', 0x0, 0x0) r3 = syz_open_dev$binder(&(0x7f0000233000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r4 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0) r5 = dup2(r3, r4) write$tun(0xffffffffffffffff, &(0x7f0000577000)=@pi={0x0, 0x0, @eth={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x0}, [], {@canfd={0xd, {{0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0, "feb442a1f43ead325d71fed774c8f6028c2a6b79a4e418aa3c5f391769659fef9f596cdade428c389e511eaad39d2ee4334dee9516a31d00510baaf06efc0980"}}}}}, 0x5a) r6 = dup2(r4, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004ee000-0x76)='\x00', 0x1, 0x0, 0x0}], &(0x7f000000b000-0x30)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)=""}) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f00005da000)={0x0, 0x0, &(0x7f00000d8000)=[], 0x48, 0x0, &(0x7f000044c000-0x83)="a410778b7a640ab0384c4ead541b6ee57c5645909ef688d8ac3e5ecfc7039f5f8ba53f127b7f01947cd3689eaf6c090277915bab2a0c450988cb85688e2bcc101a80664d3081fcc0"}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000c5a000)={0x0, 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000a95000-0x30)={0x14, 0x0, &(0x7f0000b8f000)=[@increfs_done={0x40106308, r7, 0x1}], 0x0, 0x0, &(0x7f00002e4000-0x70)=""}) getsockopt$inet6_dccp_buf(r5, 0x21, 0xcf, &(0x7f0000e10000-0xcc)=""/204, &(0x7f000037d000-0x4)=0xcc) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000436000-0x30)={0x14, 0x0, &(0x7f0000136000)=[@increfs_done={0x40106308, r7, 0x0}], 0x0, 0x0, &(0x7f0000888000-0xb)=""}) close(r2) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000002000-0x38)={0x0, 0x0, &(0x7f0000003000)=[], 0x0, &(0x7f0000002000)=[{0x10, 0x0, 0x0, ""}], 0x10, 0x0}, 0x0) [ 314.345393] binder: 16159:16163 ioctl 40046207 0 returned -16 [ 314.345640] binder_alloc: 16159: binder_alloc_buf, no vma [ 314.345663] binder: 16159:16170 transaction failed 29189/-3, size 40-8 line 2903 [ 314.345694] binder: 16159:16170 ioctl c0306201 20008000 returned -14 [ 314.348955] binder_alloc: 16159: binder_alloc_buf, no vma [ 314.348974] binder_alloc: 16159: binder_alloc_buf, no vma [ 314.348982] binder: 16156:16175 transaction failed 29189/-3, size 40-8 line 2903 [ 314.348992] binder: 16161:16172 transaction failed 29189/-3, size 40-8 line 2903 [ 314.351970] binder: release 16159:16163 transaction 1745 out, still active [ 314.351975] binder: undelivered TRANSACTION_COMPLETE [ 314.352064] binder: send failed reply for transaction 1745, target dead [ 314.352134] binder: undelivered TRANSACTION_ERROR: 29189 [ 314.363162] binder: 16156:16164 BC_INCREFS_DONE u0000000000000000 no match [ 314.365958] binder: 16161:16172 ioctl 8008ae9d 20974000 returned -22 [ 314.367092] binder: 16161:16172 BC_INCREFS_DONE u0000000000000000 no match [ 314.368271] binder: 16161:16172 BC_DEAD_BINDER_DONE 0000000000000003 not found [ 314.368280] binder: 16161:16172 BC_INCREFS_DONE u0000000000000000 no match [ 314.372259] binder: 16161:16172 got reply transaction with no transaction stack [ 314.372267] binder: 16161:16172 transaction failed 29201/-71, size 0-32 line 2703 [ 314.388875] binder: undelivered TRANSACTION_ERROR: 29189 [ 314.407707] binder_alloc: 16161: binder_alloc_buf, no vma [ 314.407737] binder: 16161:16184 transaction failed 29189/-3, size 40-8 line 2903 [ 314.414870] binder: BINDER_SET_CONTEXT_MGR already set [ 314.414881] binder: 16192:16195 ioctl 40046207 0 returned -16 [ 314.418207] binder: 16161:16184 ioctl 8008ae9d 20974000 returned -22 [ 314.419369] binder: 16161:16184 BC_DEAD_BINDER_DONE 0000000000000003 not found [ 314.419384] binder: 16161:16184 BC_INCREFS_DONE node 1752 has no pending increfs request [ 314.419445] binder: 16161:16172 BC_INCREFS_DONE u0000000000000000 node 1752 cookie mismatch 0000000000000001 != 0000000000000000 [ 314.425044] binder: 16192:16195 transaction failed 29189/-22, size 40-8 line 2788 [ 314.440346] binder: 16192:16195 ioctl c0206434 2098a000 returned -22 [ 314.440412] binder: 16192:16195 ioctl c0206434 205a0000 returned -22 [ 314.440939] binder: 16192:16195 BC_INCREFS_DONE u0000000000000000 no match [ 314.443132] binder: BINDER_SET_CONTEXT_MGR already set [ 314.443140] binder: 16198:16200 ioctl 40046207 0 returned -16 [ 314.443516] binder_alloc: 16161: binder_alloc_buf, no vma [ 314.443541] binder: 16198:16200 transaction failed 29189/-3, size 40-8 line 2903 [ 314.464250] binder: undelivered TRANSACTION_ERROR: 29189 [ 314.473609] binder: BINDER_SET_CONTEXT_MGR already set [ 314.473620] binder: 16192:16195 ioctl 40046207 0 returned -16 [ 314.482426] binder: 16192:16195 transaction failed 29189/-22, size 40-8 line 2788 [ 314.492147] binder: 16192:16195 ioctl c0206434 2098a000 returned -22 [ 314.492187] binder: 16192:16205 ioctl c0206434 205a0000 returned -22 [ 314.494969] binder: 16192:16205 BC_INCREFS_DONE u0000000000000000 no match [ 314.504916] binder: BINDER_SET_CONTEXT_MGR already set 2018/02/01 04:11:34 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = memfd_create(&(0x7f00006a9000)="526d65762f76637323f659cc2618b49510b14683ba232e03e075673d8fa0f98adb3391113da0ae9c167072af9938c48db79d64e1fc6b1e1598e3652ab83843c8bdc95afa1ace035ff299e1170f549a1a357f1d545549513ec90f229e643c3519794e39ec1fb124cc7298061a0dac386788315efb9b23817c3b56498b569f2799c2f1b49d467cbc09604e05fdd7f20e66219238db422f984b358e523318f27bbf934ac2d655771ba507ece102cc852e6d68cc4c9f7a0b6399e11b3024a13b5f0d93168c92e093b93a4037f032446f1a440986a3cc89ba2f2e59a96fc639bb39bdc33dd147c8bc37", 0x0) rt_sigaction(0x6, &(0x7f0000c4a000-0x20)={0xa, {0x0}, 0x0, 0x0}, &(0x7f0000278000)={0x0, {0x0}, 0x0, 0x0}, 0x8, &(0x7f000077e000-0x8)={0x0}) mmap(&(0x7f0000000000/0xaa2000)=nil, 0xaa2000, 0x9, 0x11, r0, 0x0) rt_sigaction(0xd, &(0x7f0000fc3000-0x20)={0x428425, {0x200}, 0x0, 0x0}, &(0x7f00009fb000)={0x0, {0x0}, 0x0, 0x0}, 0x8, &(0x7f00001a4000-0x8)={0x0}) syz_open_procfs(0x0, &(0x7f000036b000)='net/rfcomm\x00') 2018/02/01 04:11:34 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000)=0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000531000)='cpuset\x00') ppoll(&(0x7f0000d3a000-0x28)=[{r0, 0x4, 0x0}, {r0, 0x2002, 0x0}, {r0, 0x4, 0x0}, {r0, 0x10, 0x0}, {r0, 0x220, 0x0}], 0x5, &(0x7f0000889000)={0x0, 0x0}, &(0x7f0000e2b000)={0x1f}, 0x8) sendfile(r0, r0, &(0x7f00003a7000)=0x0, 0x400000ff) prctl$void(0x20) 2018/02/01 04:11:34 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$adsp(&(0x7f00002f0000-0xb)='/dev/adsp#\x00', 0xab9, 0x100) setsockopt$SO_VM_SOCKETS_BUFFER_SIZE(r0, 0x28, 0x0, &(0x7f000018d000)=0xe54, 0x8) ioctl$KVM_SET_TSS_ADDR(r0, 0xae47, 0xd000) seccomp(0x1, 0x0, &(0x7f000089b000-0x10)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x407ffc0003}]}) r1 = syz_open_dev$mouse(&(0x7f000024c000+0x6b4)='/dev/input/mouse#\x00', 0x401, 0x840) r2 = openat$rtc(0xffffffffffffff9c, &(0x7f0000926000-0x9)='/dev/rtc\x00', 0x81b5cd4e568f08d1, 0x0) syz_open_dev$sndpcmp(&(0x7f00001c0000-0x12)='/dev/snd/pcmC#D#p\x00', 0x3, 0x80000) bind$vsock_stream(r2, &(0x7f0000671000)={0x28, 0x0, 0x2710, @hyper=0x0, 0x0}, 0x10) shmctl$IPC_INFO(0x0, 0x3, &(0x7f0000564000)=""/4096) unlinkat(r1, &(0x7f0000510000)='./file0\x00', 0x200) clock_gettime(0x1, &(0x7f0000979000)={0x0, 0x0}) 2018/02/01 04:11:34 executing program 2: openat$ion(0xffffffffffffff9c, &(0x7f0000801000-0x9)='/dev/ion\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000233000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000a7c000)='/dev/binder#\x00', 0xffffffffffffffff, 0x3) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) write$tun(0xffffffffffffffff, &(0x7f0000577000)=@pi={0x0, 0x0, @eth={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x0}, [], {@canfd={0xd, {{0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0, "feb442a1f43ead325d71fed774c8f6028c2a6b79a4e418aa3c5f391769659fef9f596cdade428c389e511eaad39d2ee4334dee9516a31d00510baaf06efc0980"}}}}}, 0x5a) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004ee000-0x76)='\x00', 0x1, 0x0, 0x0}], &(0x7f000000b000-0x30)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)=""}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00005da000)={0x0, 0x0, &(0x7f00000d8000)=[], 0x48, 0x0, &(0x7f000044c000-0x83)="a410778b7a640ab0384c4ead541b6ee57c5645909ef688d8ac3e5ecfc7039f5f8ba53f127b7f01947cd3689eaf6c090277915bab2a0c450988cb85688e2bcc101a80664d3081fcc0"}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000c5a000)={0x0, 0x0, 0x0, 0x0}) mmap(&(0x7f0000000000/0x13000)=nil, 0x13000, 0x0, 0x32, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000a95000-0x30)={0x14, 0x0, &(0x7f0000b8f000)=[@increfs_done={0x40106308, r3, 0x1}], 0x0, 0x0, &(0x7f00002e4000-0x70)=""}) 2018/02/01 04:11:34 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f0000590000-0x8)='./file0\x00', 0x14) write$selinux_create(r0, &(0x7f000074c000)=@access={'system_u:object_r:dpkg_exec_t:s0', 0x20, '/usr/sbin/cups-browsed', 0x20, 0x32, 0x30, 0x0}, 0x3b) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f00007cf000)='/dev/cuse\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_STATUS(r1, 0xc05c5340, &(0x7f0000b85000)={0x6, 0x100, 0x2, {0x0, 0x0}, 0x0, 0x4, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000801000-0x9)='/dev/ion\x00', 0x0, 0x0) r3 = syz_open_dev$binder(&(0x7f0000233000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r4 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0) r5 = dup2(r3, r4) write$tun(0xffffffffffffffff, &(0x7f0000577000)=@pi={0x0, 0x0, @eth={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x0}, [], {@canfd={0xd, {{0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0, "feb442a1f43ead325d71fed774c8f6028c2a6b79a4e418aa3c5f391769659fef9f596cdade428c389e511eaad39d2ee4334dee9516a31d00510baaf06efc0980"}}}}}, 0x5a) r6 = dup2(r4, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004ee000-0x76)='\x00', 0x1, 0x0, 0x0}], &(0x7f000000b000-0x30)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)=""}) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f00005da000)={0x0, 0x0, &(0x7f00000d8000)=[], 0x48, 0x0, &(0x7f000044c000-0x83)="a410778b7a640ab0384c4ead541b6ee57c5645909ef688d8ac3e5ecfc7039f5f8ba53f127b7f01947cd3689eaf6c090277915bab2a0c450988cb85688e2bcc101a80664d3081fcc0"}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000c5a000)={0x0, 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000a95000-0x30)={0x14, 0x0, &(0x7f0000b8f000)=[@increfs_done={0x40106308, r7, 0x1}], 0x0, 0x0, &(0x7f00002e4000-0x70)=""}) getsockopt$inet6_dccp_buf(r5, 0x21, 0xcf, &(0x7f0000e10000-0xcc)=""/204, &(0x7f000037d000-0x4)=0xcc) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000436000-0x30)={0x14, 0x0, &(0x7f0000136000)=[@increfs_done={0x40106308, r7, 0x0}], 0x0, 0x0, &(0x7f0000888000-0xb)=""}) close(r2) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000002000-0x38)={0x0, 0x0, &(0x7f0000003000)=[], 0x0, &(0x7f0000002000)=[{0x10, 0x0, 0x0, ""}], 0x10, 0x0}, 0x0) 2018/02/01 04:11:34 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r0, &(0x7f0000022000-0x16)="01", 0x1, 0x0, &(0x7f00008d1000-0x10)={0x2, 0x0, @local={0xac, 0x14, 0xffffffffffffffff, 0xaa}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x10) shutdown(r0, 0x1) 2018/02/01 04:11:34 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000eb1000-0x48)={0x1, 0x3, &(0x7f00009ff000)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, [], {0x95, 0x0, 0x0, 0x0}}, &(0x7f00002bf000)='syzkaller\x00', 0x4, 0xb7, &(0x7f0000062000-0xb7)=""/183, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0}, 0x48) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000fd8000-0x8)={0x0, 0x0}) bind(r1, &(0x7f00006d9000-0x6)=@hci={0x1f, 0x1c8bfcc4, 0x1}, 0x6) r3 = socket$kcm(0x29, 0x2, 0x0) r4 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f000006c000)='/selinux/checkreqprot\x00', 0x840, 0x0) setsockopt$inet6_buf(r4, 0x29, 0xdb87e09d758ee1b5, &(0x7f000030a000)="21ff630ab97fb562efa3ad12d58bf6e8d9d8d2b582d657235560c393ddffd90af9820c3d3f83b9cf6410e601a583c447ba106591af5766e0557463e65efdffd1c8edadf58f5ac435ff8c1a6b65090c069a2943662a7b35749543324b4e582bf4ee71651b9a41c64128456e2598", 0x6d) ioctl$sock_kcm_SIOCKCMATTACH(r3, 0x89e0, &(0x7f0000583000-0x8)={r2, r0}) shutdown(r1, 0x2) 2018/02/01 04:11:34 executing program 1: openat$ion(0xffffffffffffff9c, &(0x7f0000801000-0x9)='/dev/ion\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000233000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) write$tun(0xffffffffffffffff, &(0x7f0000577000)=@pi={0x0, 0x0, @eth={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x0}, [], {@canfd={0xd, {{0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0, "feb442a1f43ead325d71fed774c8f6028c2a6b79a4e418aa3c5f391769659fef9f596cdade428c389e511eaad39d2ee4334dee9516a31d00510baaf06efc0980"}}}}}, 0x5a) ustat(0x0, &(0x7f0000381000-0x20)={0x0, 0x0, 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004ee000-0x76)='\x00', 0x1, 0x0, 0x0}], &(0x7f000000b000-0x30)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)=""}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000b21000-0x30)={0x0, 0x0, &(0x7f00000d8000)=[], 0x48, 0x0, &(0x7f0000996000+0x33d)="a410778b7a640ab0384c4ead541b6ee57c5645909ef688d8ac3e5ecfc7039f5f8ba53f127b7f01947cd3689eaf6c090277915bab2a0c450988cb85688e2bcc101a80664d3081fcc0"}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000c5a000)={0x0, 0x0, 0x0, 0x0}) mmap(&(0x7f0000000000/0x13000)=nil, 0x13000, 0x0, 0x32, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000436000-0x30)={0x20, 0x0, &(0x7f0000136000)=[@dead_binder_done={0x40086310, 0x3}, @increfs_done={0x40106308, r3, 0x0}], 0x0, 0x0, &(0x7f0000888000-0xb)=""}) [ 314.504925] binder: 16207:16208 ioctl 40046207 0 returned -16 [ 314.505319] binder_alloc: 16161: binder_alloc_buf, no vma [ 314.505342] binder: 16207:16208 transaction failed 29189/-3, size 40-8 line 2903 [ 314.529826] binder: undelivered TRANSACTION_ERROR: 29189 [ 314.546959] binder: undelivered TRANSACTION_ERROR: 29189 2018/02/01 04:11:34 executing program 7: r0 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000626000-0x10)='/selinux/status\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) faccessat(r0, &(0x7f0000000000+0xa2b)='./file0\x00', 0x8, 0xc00) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r1 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r1, &(0x7f0000022000-0x16)="01", 0x1, 0x0, &(0x7f0000031000-0x10)={0x2, 0xffffffffffffffff, @local={0xac, 0x14, 0xffffffffffffffff, 0xaa}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x10) shutdown(r1, 0x1) 2018/02/01 04:11:34 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f0000590000-0x8)='./file0\x00', 0x14) write$selinux_create(r0, &(0x7f000074c000)=@access={'system_u:object_r:dpkg_exec_t:s0', 0x20, '/usr/sbin/cups-browsed', 0x20, 0x32, 0x30, 0x0}, 0x3b) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f00007cf000)='/dev/cuse\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_STATUS(r1, 0xc05c5340, &(0x7f0000b85000)={0x6, 0x100, 0x2, {0x0, 0x0}, 0x0, 0x4, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000801000-0x9)='/dev/ion\x00', 0x0, 0x0) r3 = syz_open_dev$binder(&(0x7f0000233000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r4 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0) r5 = dup2(r3, r4) write$tun(0xffffffffffffffff, &(0x7f0000577000)=@pi={0x0, 0x0, @eth={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x0}, [], {@canfd={0xd, {{0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0, "feb442a1f43ead325d71fed774c8f6028c2a6b79a4e418aa3c5f391769659fef9f596cdade428c389e511eaad39d2ee4334dee9516a31d00510baaf06efc0980"}}}}}, 0x5a) r6 = dup2(r4, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004ee000-0x76)='\x00', 0x1, 0x0, 0x0}], &(0x7f000000b000-0x30)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)=""}) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f00005da000)={0x0, 0x0, &(0x7f00000d8000)=[], 0x48, 0x0, &(0x7f000044c000-0x83)="a410778b7a640ab0384c4ead541b6ee57c5645909ef688d8ac3e5ecfc7039f5f8ba53f127b7f01947cd3689eaf6c090277915bab2a0c450988cb85688e2bcc101a80664d3081fcc0"}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000c5a000)={0x0, 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000a95000-0x30)={0x14, 0x0, &(0x7f0000b8f000)=[@increfs_done={0x40106308, r7, 0x1}], 0x0, 0x0, &(0x7f00002e4000-0x70)=""}) getsockopt$inet6_dccp_buf(r5, 0x21, 0xcf, &(0x7f0000e10000-0xcc)=""/204, &(0x7f000037d000-0x4)=0xcc) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000436000-0x30)={0x14, 0x0, &(0x7f0000136000)=[@increfs_done={0x40106308, r7, 0x0}], 0x0, 0x0, &(0x7f0000888000-0xb)=""}) close(r2) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000002000-0x38)={0x0, 0x0, &(0x7f0000003000)=[], 0x0, &(0x7f0000002000)=[{0x10, 0x0, 0x0, ""}], 0x10, 0x0}, 0x0) 2018/02/01 04:11:34 executing program 5: mmap(&(0x7f0000000000/0x12000)=nil, 0x12000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket(0x18, 0x0, 0x1) sendmmsg(0xffffffffffffffff, &(0x7f0000005000-0x3c)=[{{&(0x7f0000003000)=@in6={0xa, 0x0, 0x0, @remote={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0xbb}, 0x0}, 0x1c, &(0x7f0000005000-0x60)=[{&(0x7f0000002000)="4c5614c0040101dbf8a669ebdedd102c4f7a79f306457dfdf09e2ec2ed253b", 0x1f}], 0x1, &(0x7f0000003000-0x2d0)=[], 0x0, 0x0}, 0x0}], 0x1, 0x0) connect(r0, &(0x7f0000002000)=@sco={0x1f, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0}}, 0x26) ioctl$sock_inet_SIOCRTMSG(r0, 0x890d, &(0x7f000000b000-0x78)={0x1ff, {0x2, 0x3, @rand_addr=0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, {0x2, 0x0, @remote={0xac, 0x14, 0x0, 0xbb}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, {0x2, 0x1, @dev={0xac, 0x14, 0x0, 0xe}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x20, 0x0, 0xab, 0x7ff, 0xfffffffffffffff7, 0x0, 0x58b1, 0xff, 0x7fff}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000001, 0x8031, 0xffffffffffffffff, 0x0) ioctl$sock_inet_SIOCSIFDSTADDR(r0, 0x80487436, &(0x7f0000011000-0x20)={@common='ip6_vti0\x00', @ifru_flags=0x0}) [ 314.913831] binder_alloc: 16220: binder_alloc_buf, no vma [ 314.926499] binder: 16221:16226 transaction failed 29189/-22, size 40-8 line 2788 2018/02/01 04:11:34 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6_udp(0xa, 0x2, 0x0) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r1 = userfaultfd(0x80002) getrlimit(0x0, &(0x7f0000003000-0xe)={0x0, 0x0}) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000001000-0x18)={0xaa, 0x0, 0x0}) io_setup(0x3, &(0x7f000033f000-0x8)=0x0) io_getevents(r2, 0x6, 0x2, &(0x7f00004b2000-0x40)=[{0x0, 0x0, 0x0, 0x0}, {0x0, 0x0, 0x0, 0x0}], &(0x7f0000a18000-0x10)={0x0, 0x1c9c380}) pkey_mprotect(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x5, 0xffffffffffffffff) ioctl$UFFDIO_REGISTER(r1, 0xc028aa03, &(0x7f0000003000-0x20)={{&(0x7f0000012000/0x2000)=nil, 0x2000}, 0x0, 0x0}) r3 = syz_open_dev$adsp(&(0x7f0000674000-0xb)='/dev/adsp#\x00', 0xd69, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000398000-0xe8)={{{@in=@loopback=0x0, @in=@multicast1=0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, {0x0, 0x0, 0x0, 0x0}, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, {{@in=@multicast2=0x0, 0xffffffffffffffff, 0x0}, 0x0, @in6=@remote={0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0xffffffffffffffff, 0x0}, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, &(0x7f000068a000)=0xe8) ioctl$TUNSETOWNER(r3, 0x400454cc, &(0x7f000086f000-0x4)=r4) sendmmsg(r0, &(0x7f0000f56000)=[{{&(0x7f0000b46000)=@in6={0xa, 0x1, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x0}, 0x1c, &(0x7f00000f9000)=[], 0x0, &(0x7f000003d000-0x3b8)=[{0x18, 0x29, 0x37, "359d"}], 0x18, 0x0}, 0x0}], 0x1, 0x0) 2018/02/01 04:11:34 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) seccomp(0x1, 0x0, &(0x7f000089b000-0x10)={0xce, &(0x7f0000cb1000-0x8)=[{0x6, 0x7f, 0x1, 0x269}]}) shmctl$IPC_INFO(0x0, 0x3, &(0x7f0000564000)=""/4096) 2018/02/01 04:11:34 executing program 1: openat$ion(0xffffffffffffff9c, &(0x7f0000801000-0x9)='/dev/ion\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000233000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r0, r1) write$tun(0xffffffffffffffff, &(0x7f0000577000)=@pi={0x0, 0x0, @eth={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x0}, [], {@canfd={0xd, {{0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0, "feb442a1f43ead325d71fed774c8f6028c2a6b79a4e418aa3c5f391769659fef9f596cdade428c389e511eaad39d2ee4334dee9516a31d00510baaf06efc0980"}}}}}, 0x5a) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004ee000-0x76)='\x00', 0x1, 0x0, 0x0}], &(0x7f000000b000-0x30)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)=""}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00005da000)={0x0, 0x0, &(0x7f00000d8000)=[], 0x48, 0x0, &(0x7f000044c000-0x83)="a410778b7a640ab0384c4ead541b6ee57c5645909ef688d8ac3e5ecfc7039f5f8ba53f127b7f01947cd3689eaf6c090277915bab2a0c450988cb85688e2bcc101a80664d3081fcc0"}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000c5a000)={0x0, 0x0, 0x0, 0x0}) mmap(&(0x7f0000000000/0x13000)=nil, 0x13000, 0x0, 0x32, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000af8000)={0x14, 0x0, &(0x7f0000b8f000)=[@increfs_done={0x40106308, r3, 0x1}], 0xfffffffffffffff4, 0x0, &(0x7f00002e4000-0x70)=""}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000436000-0x30)={0x20, 0x0, &(0x7f0000136000)=[@dead_binder_done={0x40086310, 0x3}, @increfs_done={0x40106308, r3, 0x0}], 0x0, 0x0, &(0x7f0000888000-0xb)=""}) 2018/02/01 04:11:34 executing program 6 (fault-call:14 fault-nth:0): mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f0000590000-0x8)='./file0\x00', 0x14) write$selinux_create(r0, &(0x7f000074c000)=@access={'system_u:object_r:dpkg_exec_t:s0', 0x20, '/usr/sbin/cups-browsed', 0x20, 0x32, 0x30, 0x0}, 0x3b) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f00007cf000)='/dev/cuse\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_STATUS(r1, 0xc05c5340, &(0x7f0000b85000)={0x6, 0x100, 0x2, {0x0, 0x0}, 0x0, 0x4, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000801000-0x9)='/dev/ion\x00', 0x0, 0x0) r3 = syz_open_dev$binder(&(0x7f0000233000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r4 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0) r5 = dup2(r3, r4) write$tun(0xffffffffffffffff, &(0x7f0000577000)=@pi={0x0, 0x0, @eth={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x0}, [], {@canfd={0xd, {{0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0, "feb442a1f43ead325d71fed774c8f6028c2a6b79a4e418aa3c5f391769659fef9f596cdade428c389e511eaad39d2ee4334dee9516a31d00510baaf06efc0980"}}}}}, 0x5a) r6 = dup2(r4, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004ee000-0x76)='\x00', 0x1, 0x0, 0x0}], &(0x7f000000b000-0x30)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)=""}) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f00005da000)={0x0, 0x0, &(0x7f00000d8000)=[], 0x48, 0x0, &(0x7f000044c000-0x83)="a410778b7a640ab0384c4ead541b6ee57c5645909ef688d8ac3e5ecfc7039f5f8ba53f127b7f01947cd3689eaf6c090277915bab2a0c450988cb85688e2bcc101a80664d3081fcc0"}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000c5a000)={0x0, 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000a95000-0x30)={0x14, 0x0, &(0x7f0000b8f000)=[@increfs_done={0x40106308, r7, 0x1}], 0x0, 0x0, &(0x7f00002e4000-0x70)=""}) getsockopt$inet6_dccp_buf(r5, 0x21, 0xcf, &(0x7f0000e10000-0xcc)=""/204, &(0x7f000037d000-0x4)=0xcc) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000436000-0x30)={0x14, 0x0, &(0x7f0000136000)=[@increfs_done={0x40106308, r7, 0x0}], 0x0, 0x0, &(0x7f0000888000-0xb)=""}) close(r2) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000002000-0x38)={0x0, 0x0, &(0x7f0000003000)=[], 0x0, &(0x7f0000002000)=[{0x10, 0x10e, 0x0, ""}], 0x10, 0x0}, 0x0) [ 314.942308] binder: 16224:16229 BC_DEAD_BINDER_DONE 0000000000000003 not found [ 314.942323] binder: 16224:16229 BC_INCREFS_DONE u00000000204edf8a node 1764 cookie mismatch 0000000000000000 != 0000000000000001 2018/02/01 04:11:35 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) seccomp(0x1, 0x0, &(0x7f000089b000-0x10)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x407ffc0003}]}) shmctl$IPC_INFO(0x0, 0x3, &(0x7f0000564000)=""/4096) r0 = syz_open_dev$sndpcmc(&(0x7f000071d000-0x12)='/dev/snd/pcmC#D#c\x00', 0x5, 0x4401) ioctl$KVM_GET_TSC_KHZ(r0, 0xaea3) [ 314.959572] binder: send failed reply for transaction 1763 to 16224:16229 [ 314.960567] binder: 16220:16233 BC_INCREFS_DONE u0000000000000000 no match [ 314.965912] binder: undelivered TRANSACTION_ERROR: 29189 [ 314.994961] binder: 16220:16233 transaction failed 29189/-22, size 40-8 line 2788 [ 315.001575] binder: 16224:16234 transaction failed 29189/-22, size 40-8 line 2788 [ 315.006993] binder: 16224:16229 BC_DEAD_BINDER_DONE 0000000000000003 not found [ 315.007012] binder: 16224:16229 BC_INCREFS_DONE u00000000204edf8a node 1764 cookie mismatch 0000000000000000 != 0000000000000001 [ 315.014221] binder_alloc: 16238: binder_alloc_buf, no vma [ 315.014243] binder: 16238:16240 transaction failed 29189/-3, size 40-8 line 2903 [ 315.026675] binder: undelivered TRANSACTION_ERROR: 29189 [ 315.026687] binder: undelivered TRANSACTION_ERROR: 29189 [ 315.055400] binder: undelivered TRANSACTION_ERROR: 29189 [ 315.063211] binder: send failed reply for transaction 1773 to 16246:16248 [ 315.067349] binder: 16246:16248 BC_DEAD_BINDER_DONE 0000000000000003 not found [ 315.067362] binder: 16246:16248 BC_INCREFS_DONE u00000000204edf8a node 1774 cookie mismatch 0000000000000000 != 0000000000000001 [ 315.106671] binder: 16246:16248 transaction failed 29189/-22, size 40-8 line 2788 [ 315.107796] binder: 16252:16253 transaction failed 29189/-22, size 40-8 line 2788 [ 315.111346] binder: 16246:16248 BC_DEAD_BINDER_DONE 0000000000000003 not found [ 315.111361] binder: 16246:16248 BC_INCREFS_DONE u00000000204edf8a node 1774 cookie mismatch 0000000000000000 != 0000000000000001 [ 315.134388] binder: undelivered TRANSACTION_ERROR: 29189 2018/02/01 04:11:35 executing program 0: r0 = socket$vsock_stream(0x28, 0x1, 0x0) r1 = accept4$vsock_stream(r0, &(0x7f00003a9000)={0x28, 0x0, 0x0, @host=0x2, 0x0}, 0x10, 0x800) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$mouse(&(0x7f0000000000)='/dev/input/mouse#\x00', 0x9, 0x0) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) epoll_ctl$EPOLL_CTL_MOD(r2, 0x3, r0, &(0x7f0000001000-0xc)={0x40000001, 0x0}) ioctl$LOOP_GET_STATUS(r2, 0x4c03, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/64, ""/32, [0x0, 0x0], 0x0}) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) setsockopt$inet6_dccp_buf(r2, 0x21, 0xcc, &(0x7f0000002000-0x8)="f3f2417912a9a0c2", 0x8) mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) setsockopt$inet6_IPV6_ADDRFORM(r2, 0x29, 0x1, &(0x7f0000002000)=0x2, 0x4) mmap(&(0x7f0000003000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$VT_SETMODE(r2, 0x5602, &(0x7f0000003000)={0x5, 0xc487, 0x8, 0xff, 0x7ff}) mmap(&(0x7f0000004000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r1, 0x10e, 0xa, &(0x7f0000005000-0x4)=0xffff, 0x4) ioctl$TUNSETNOCSUM(r2, 0x400454c8, &(0x7f0000004000-0x4)=0x2) mmap(&(0x7f0000005000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000005000)=@nat={'nat\x00', 0x1b, 0x4, 0x468, 0x230, 0x230, 0xffffffff, 0xd0, 0x230, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x4, &(0x7f0000001000)=[{0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}], {{{[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0xa8, 0xd0, 0x0, {0x0, 0x0}}, {0x28, '\x00', 0x0, 0x230}}, [{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0x118, 0x160, 0x0, {0x0, 0x0}, [@common=@eui64={0x28, 'eui64\x00', 0x0, 0x0}, @common=@dst={0x48, 'dst\x00', 0x0, {0x7fff, 0x0, 0x1, [0xeb8, 0x5, 0x6, 0x81, 0x11, 0x1, 0x1f, 0x80000000, 0xffffc00000000000, 0x70, 0x10000, 0x7ff, 0x2, 0x401, 0xda8, 0x6], 0x2}}]}, @REDIRECT={0x48, 'REDIRECT\x00', 0x0, {0x8, @ipv4=@multicast2=0xe0000002, @ipv6=@remote={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0xbb}, @icmp_id=0x3, @port=0x0}}}, {{@ipv6={@mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x1}, @local={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0xaa}, [0xffffffff, 0xff, 0x0, 0xffffffff], [0xff0000ff, 0xffffffff, 0x0, 0xff000000], @common='tunl0\x00', @generic="37d9f767ac5143b1466cad0d60ad2aba", {0xff, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, {0x9eceab6f39e96ebc, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0xdd, 0xfffffffffffff800, 0x5, 0x45}, 0x0, 0xd0, 0x118, 0x0, {0x0, 0x0}, [@common=@ipv6header={0x28, 'ipv6header\x00', 0x0, {0x21, 0x2, 0x0}}]}, @REDIRECT={0x48, 'REDIRECT\x00', 0x0, {0x4, @ipv4=@multicast1=0xe0000001, @ipv6=@local={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0xaa}, @icmp_id=0x1, @gre_key=0x9}}}, {{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0xd8, 0x120, 0x0, {0x0, 0x0}, [@common=@ah={0x30, 'ah\x00', 0x0, {0x1, 0x1, 0x8000, 0x80000000, 0x3}}]}, @REDIRECT={0x48, 'REDIRECT\x00', 0x0, {0x6, @ipv6=@mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x1}, @ipv6=@empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, @port=0x3, @port=0x0}}}]}}, 0x4c8) mmap(&(0x7f0000006000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) setsockopt$inet6_MCAST_LEAVE_GROUP(r2, 0x29, 0x2d, &(0x7f0000007000-0x88)={0x1, {{0xa, 0x3, 0x3, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x1}, 0x4}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}}, 0x88) r3 = getpgrp(0x0) mmap(&(0x7f0000007000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ptrace$getsig(0x4202, r3, 0x4, &(0x7f0000008000-0x10)={0x0, 0x0, 0x0, 0x0}) mmap(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) getsockopt$inet_sctp_SCTP_PR_SUPPORTED(r2, 0x84, 0x71, &(0x7f0000008000)={0x0, 0xfffffffffffffff9}, &(0x7f0000002000)=0x8) mmap(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) getsockopt$inet_sctp_SCTP_DEFAULT_SEND_PARAM(r2, 0x84, 0xa, &(0x7f0000009000-0x20)={0x7, 0x3f, 0xa, 0x5, 0xf524, 0x2a, 0x6, 0x100, r4}, &(0x7f0000006000)=0x20) ioctl$void(r1, 0xc0045878) socket$nl_xfrm(0x10, 0x3, 0x6) mmap(&(0x7f0000009000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_ADD(r2, 0xc1105517, &(0x7f0000009000-0x110)={{0xc6, 0x7, 0x1000, 0x9, "5e45d9c42b40dcce8d9c5df90a23eaee4d3000db414b7acfeb449e90a41a16d36d5cf473df910ad9825cbcd9", 0x1}, 0x0, 0x0, 0x400, r3, 0xffff, 0xc5, "832af6b976c4e41a2c79607f46ce2a39668c6de6b23464cf23ee5693ef9c5c4b03f47740b8eff0c506f6f0aee35462298b009b1d2e86164553caae1cf56eb4d1", &(0x7f0000009000)='nat\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', 0x20, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], [0xffffffff, 0x3dcb, 0x8, 0xe56f], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) 2018/02/01 04:11:35 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f0000590000-0x8)='./file0\x00', 0x14) write$selinux_create(r0, &(0x7f000074c000)=@access={'system_u:object_r:dpkg_exec_t:s0', 0x20, '/usr/sbin/cups-browsed', 0x20, 0x32, 0x30, 0x0}, 0x3b) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f00007cf000)='/dev/cuse\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_STATUS(r1, 0xc05c5340, &(0x7f0000b85000)={0x6, 0x100, 0x2, {0x0, 0x0}, 0x0, 0x4, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000801000-0x9)='/dev/ion\x00', 0x0, 0x0) r3 = syz_open_dev$binder(&(0x7f0000233000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r4 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0) r5 = dup2(r3, r4) write$tun(0xffffffffffffffff, &(0x7f0000577000)=@pi={0x0, 0x0, @eth={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x0}, [], {@canfd={0xd, {{0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0, "feb442a1f43ead325d71fed774c8f6028c2a6b79a4e418aa3c5f391769659fef9f596cdade428c389e511eaad39d2ee4334dee9516a31d00510baaf06efc0980"}}}}}, 0x5a) r6 = dup2(r4, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004ee000-0x76)='\x00', 0x1, 0x0, 0x0}], &(0x7f000000b000-0x30)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)=""}) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f00005da000)={0x0, 0x0, &(0x7f00000d8000)=[], 0x48, 0x0, &(0x7f000044c000-0x83)="a410778b7a640ab0384c4ead541b6ee57c5645909ef688d8ac3e5ecfc7039f5f8ba53f127b7f01947cd3689eaf6c090277915bab2a0c450988cb85688e2bcc101a80664d3081fcc0"}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000c5a000)={0x0, 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000a95000-0x30)={0x14, 0x0, &(0x7f0000b8f000)=[@increfs_done={0x40106308, r7, 0x1}], 0x0, 0x0, &(0x7f00002e4000-0x70)=""}) getsockopt$inet6_dccp_buf(r5, 0x21, 0xcf, &(0x7f0000e10000-0xcc)=""/204, &(0x7f000037d000-0x4)=0xcc) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000436000-0x30)={0x14, 0x0, &(0x7f0000136000)=[@increfs_done={0x40106308, r7, 0x0}], 0x0, 0x0, &(0x7f0000888000-0xb)=""}) close(r2) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000002000-0x38)={0x0, 0x0, &(0x7f0000003000)=[], 0x0, &(0x7f0000002000)=[{0x10, 0x10e, 0x0, ""}], 0x10, 0x0}, 0x0) 2018/02/01 04:11:35 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r0, &(0x7f0000022000-0x16)="01", 0x1, 0x0, &(0x7f0000031000-0x10)={0x2, 0xffffffffffffffff, @local={0xac, 0x14, 0xffffffffffffffff, 0xaa}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x10) shutdown(r0, 0x4) ioctl$sock_inet_SIOCSIFPFLAGS(r0, 0x8934, &(0x7f0000138000)={@common='bond0\x00', @ifru_addrs={0x2, 0x1, @rand_addr=0x5, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}}) 2018/02/01 04:11:35 executing program 1: openat$ion(0xffffffffffffff9c, &(0x7f0000801000-0x9)='/dev/ion\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000233000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = dup2(r0, r1) write$tun(0xffffffffffffffff, &(0x7f0000577000)=@pi={0x0, 0x0, @eth={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x0}, [], {@canfd={0xd, {{0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0, "feb442a1f43ead325d71fed774c8f6028c2a6b79a4e418aa3c5f391769659fef9f596cdade428c389e511eaad39d2ee4334dee9516a31d00510baaf06efc0980"}}}}}, 0x5a) r3 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004ee000-0x76)='\x00', 0x1, 0x0, 0x0}], &(0x7f000000b000-0x30)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)=""}) getsockopt$inet_sctp_SCTP_SOCKOPT_PEELOFF(r2, 0x84, 0x66, &(0x7f0000771000-0x8)={0x0, 0xfffffffffffffffe}, &(0x7f0000f6f000-0x4)=0x8) fdatasync(r3) setsockopt$inet_sctp6_SCTP_RESET_STREAMS(r3, 0x84, 0x77, &(0x7f0000a48000)={r4, 0x5b, 0xa, [0x1, 0x7, 0xff, 0x8, 0x0, 0xfffffffffffff1cb, 0xffffffff, 0x0, 0xef, 0x7fff]}, 0x1c) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r2, 0x84, 0x18, &(0x7f00005e3000-0x6)={r4, 0x3}, &(0x7f0000397000-0x4)=0x6) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00005da000)={0x0, 0x0, &(0x7f00000d8000)=[], 0x48, 0x0, &(0x7f000044c000-0x83)="a410778b7a640ab0384c4ead541b6ee57c5645909ef688d8ac3e5ecfc7039f5f8ba53f127b7f01947cd3689eaf6c090277915bab2a0c450988cb85688e2bcc101a80664d3081fcc0"}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000c5a000)={0x0, 0x0, 0x0, 0x0}) mmap(&(0x7f0000000000/0x13000)=nil, 0x13000, 0x0, 0x32, 0xffffffffffffffff, 0x0) ioctl$LOOP_SET_FD(r2, 0x4c00, r2) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000a95000-0x30)={0x14, 0x0, &(0x7f0000b8f000)=[@increfs_done={0x40106308, r5, 0x1}], 0x0, 0x0, &(0x7f00002e4000-0x70)=""}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000436000-0x30)={0x20, 0x0, &(0x7f0000136000)=[@dead_binder_done={0x40086310, 0x3}, @increfs_done={0x40106308, r5, 0x0}], 0x0, 0x0, &(0x7f0000888000-0xb)=""}) getsockopt$bt_BT_DEFER_SETUP(r2, 0x112, 0x7, &(0x7f00000f2000)=0x3f, &(0x7f000099a000-0x8)=0x4) 2018/02/01 04:11:35 executing program 4: modify_ldt$read_default(0x2, &(0x7f0000891000-0xb68)=""/4096, 0x1000) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) seccomp(0x1, 0x0, &(0x7f000089b000-0x10)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x407ffc0003}]}) shmctl$IPC_INFO(0x0, 0x3, &(0x7f0000564000)=""/4096) 2018/02/01 04:11:35 executing program 3: prctl$intptr(0x6, 0x6) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00009a9000)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) r3 = dup3(r2, r0, 0x0) socketpair$ipx(0x4, 0x2, 0x0, &(0x7f0000ba0000)={0x0, 0x0}) ioctl$KVM_SET_MSRS(r3, 0x4008ae89, &(0x7f0000f3f000)={0x0, 0x0, []}) openat$vsock(0xffffffffffffff9c, &(0x7f000093b000)='/dev/vhost-vsock\x00', 0x2, 0x0) 2018/02/01 04:11:35 executing program 5: r0 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_GET_PEER_ADDRS(0xffffffffffffff9c, 0x84, 0x6c, &(0x7f00007f7000)={0x0, 0x6f, "61d586f1cc107bb0caa013f5d40827b5af2eee71f4c0605b8a1b91df423a53314d9c62b5fe7bc7b345a354f7f9bbe8c671fc5d63c1b744fc543f6c1c8b6027e4f52a6781a73243a03546bccb94bc620bdc5fa97ed8bee6e9a82b35566f57ebf6f57a63cd5c7dfb852862e20c79d8da"}, &(0x7f0000826000-0x4)=0x77) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) getsockopt$inet_sctp_SCTP_MAXSEG(r0, 0x84, 0xd, &(0x7f0000df3000-0x8)=@assoc_value={r1, 0x873d}, &(0x7f0000001000-0x4)=0x8) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r3 = perf_event_open(&(0x7f000001d000)={0x2, 0x78, 0xe2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000)=0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$KVM_CREATE_DEVICE(0xffffffffffffffff, 0xc00caee0, &(0x7f00003f9000-0xc)={0x6, r3, 0x1}) ioctl$sock_bt_hidp_HIDPGETCONNLIST(r4, 0x800448d2, &(0x7f0000da0000)={0x2, &(0x7f00001d9000-0x128)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, ""/128}, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, ""/128}]}) r5 = gettid() getsockopt$inet_sctp_SCTP_GET_LOCAL_ADDRS(r4, 0x84, 0x6d, &(0x7f0000562000-0x1008)={r2, 0x1000, "763001998e268215fc04148535e0ca65612e6332ff88d517fe074c595785fc5fef2beeb638aa6c62dce42639d97eb7173a2241caa4099b7a82077835a2fecc5ff2a96fde3967ae6e42c65c741ec3730c830a46fa963679034644343e5a61e78dc1c078857a57c0e5fdbc4fb005eff9ca584faedfa3156daa7a86b46993ae73a39b0adbe8fde04504939d3dd7bf0c14e82329e251d6ab0f3bfdd3a019c9551ea969ef8736b2eccbf2f19eb7ba318e401dbf109daa9dd6e1086b0357cf13980bdd475af703831a655e0e8504982e34b3b9d3b85d5390178cb5ad02767f3eeca26bdc5f868123c00f6e1ad34ab75c4df171a6b144c94b468b0b836fda5f38b14edf5f02a512e96479ac1e1faf4893d3389f0dc52b47417cec9f719963f019cd87a954f3470b115109f773c714eb02e2203739430c23c8b0c4ecc17e343ab0f25511c3f136d0fda77854f54135059af47457ddc7f0db50e9d2032b611be7c9203e4372b63706e2ff3ff1f5db66baad9fe5ac726bf288c799cd798f01223824eadecdb4f7ffc809b97cdbe2e9e789f0857b841e4cd57bfbf2b54d2c494c6cc53100d4497fb4fde3b6ee4a8e2f213d7b7e5399711d342a8ba9e587dab80fb318944ff762bc65dc16ba6141304ff98136943f3e20e7903dc04fae21c11a626341ac0d719fbd618989e686e3a0a3f7f1e30c481f676287e8633039e7489ff02f17189e85f83d8eda0a373d8ee68c949d23f0bd02a10c5205f6f10d3ea87511c4d8ac5cc85c4c6f2de0680096f1d33611a10138272678eecdd5f00795d34e4483794e19cf479e8dd533b4fb95eff777a8a487cebf4870835459b2b7234df2ba32f6102cea88df607f02d3ffce0740e651c793869f72d5e9378eb7173df84235be3faafed5d761212a3234fbaa5db63bfcb7db0118f0f6c1a3d2a534ffe25a1f8a88bce46e2d8d2b0fe3aa60f71489bd6b2f383e84de90794a345db9348fc26d7c9e620c145ae9a3ae824b8ee344296814a3115fa847119c08f18465dbc7e4b98d30aa37db49fcd08d1e055441befef1216f5595309b810f3835982284b641bdc14602b6b10eee9939d52f222b85005a22be57365e9695e72bb0eb40a8923e5ba7362ecd045d9810d61f5b501bc4ac0d3ff98b652f80ba9fff446c1dad98685374fd446d1586adfa128de45e21681e05a1d06abfc0818c68d91bbebf7f04ca57b05af2672ec2ee826db9d35fd643fc3b4e062fb039afb326a1fbee7270676b30001e4e3ddb93bae1fb8897af8a040c2d38a15fe13818e484eadaf720bd2892f0ebee0cecc50a27c6be4b4af92941185fba7efc14c2351e697cf9b5ae8c593070878b6e7cb03a16965c4a734eae10f67c1b1c840f7f804c716b484fc51ee466628cfe82de149f46d9a5c16e5f47c5ae6da912ab2e56281e77cb80d353818b0b6bb652702adfb0507ff3ee23e2b0b3d87f38409a9c27cf431924e2bbb7fce395b472b70d4f991afb72fee6112d70f88bbf923c766dedeceed6d026ce7d1135260f4fec07fd05ede24428e6cb4fbe51905937804563d4780d965d42c7cba7c1594d1dba6ff0b8fd0f667310594ca60b99687aa018f5093a15f4785ec612074c54c114fa62f80d861fe00609fc8564449d7cd201577664538288b6eb8f2d82d84990a686bb2e29d6a6bab89ed68c0fb5a03b9573bdcc35358e7c2071036d461cfb4a56cbaae69ca1959d6b4ff883b5cc4081371a110def85244d251361b147f145b5bbc51a59e7e0a276a49f43fa22d420621968009ace0a61e9ac4af66d42a2e538f666f7195ce3532e5b76e1cb670a48769bef90f4096f299bb450a858727320551d9b4caff61172f19b70719efb264ca9578316b696aab60464824bedf555b218f03d7451b6e9bc7cf4d57a103b1026487ea582389987fc1a79c1084f06000e52a03a36f772c211466b8d65f351a71c7b0b75f1cd864ee43b165e5102dee467409ea96d1d53a14beb14d4aee1d6b35a94baa0609279c7261e257327a91ecc981279166f6dfc114d94159a49b195a0deeb6111467bafb53f7fd5765e5591da0c509587daeb8e23b8fb35f3d1d9b143574a50867be49650c836995ac268eb20fd41a08658eca0a9661fd6bdc3ecb6531e7e561ba65372cb658c519bbf0123b4c50b512654c6a5f5d02034f6441fae5b01a0b7f27bb94f7a4ccf2710246d25987bcf01096c412f200686e6279f576868f03c71a2aacb2f4383dd3aeb3590836189d9a7d9622a56dc845cc6d2e292b3a3c35b2b9c6bca79d56188fcc729fc9b467bdd9befd061e8e906ef099ca4b902df7f47923bd65ec6b5dc3629274461d7e65b8e3219c48ae882c0e321278cc1fa6aa4fa7d14165b0a42781b11e251c017fdc3a981c19d657f5b0b4e05f0c2e6fbaf26cf92bf7a43e50aa7abd7dd66f173efeefca6d001fe78bf1bb28f2fc204602a4286f0ae7de326a317305afb05d82506046c45b37e886ab531cf4095df26ad889dd042f7fdbc4023311d0a65ea46c500e4c404114ad02a18851d2b2727cfb6c3f05a7e0ef289fc3371f19237648b3baaa5586b61d8175be417b81e1f94d93a6519b2ea13175bc6536e2b9a48d9e648ae1dab018bfb91acd1ba277c7ee55864a4c4a241a8743034b8c530a7bc40253498dcb9c222b6c7adcd03bdfedd929106e4bd16cc2be4dad11185ba40b1f4162d23349de2deeacd6f39a777a69bc53f882390b31249cf5a349f8625666c158116ac839537f165cc45c6bf6cf18cf28cd03d46424f03f937ec7c7584100e3fc9e60901c709c9b7ec06f75013383dd1b8988f6bf971979e874c5dfb3211e131a1e9c86be02f5ecbd185718f2b0409dddb8c809bbe0ca545f75090d45642673ffef3459a17e7b264f9ce8db847b7541780e6a4eb45d54a8cfa8569975b93897cb9a9c21385e259fa81adb42fa7e4631115ce93f4f6dfe7466f68241ab012e1887ffa38a6b93943ffb8052d7244e85d348f3a662c73c7a8df6e5d115e0bc33c7f080d2aaf16c9956e1a2605d9fa26ecdcee80363993ab3ddc0542fa9c2ace224bb82981b3be20386c13fad7976be2df095c7e1d60a53f8daa1910f316e162dc2b49a111fc388d74742536b8fc4df749ffc825d908ae31a3bbdfa1a74fbc331b888ed34c1ae1311f65e121f36c7e21b4c842a865509302e0287ea1e32d7a3a7d9ea89ef41d9d133521870a0d411c5a9da22b0b8ec2e8f445b9d514fd8da10e56c9f4d950291c80aa0bc4535cdfd946054d3aad19152dd661f64a0376398f251e458a6fd5a09116d74905b9a11c278a568edde3eb490334603d2025c5e48aa3e93c371cd30039a95e70b02499f35b46f20735089809e9b136ff40db374b7daad3a3fa8f1e2b308411780987e32e8933ea0c35cbfd842e25bb1f6a4e98f66b318b771798268fa4f5845537e959b2bb4962fc861e42349ed237943367690332b3bcc6510b9bc961313b1f57ebca1a935f483490ed66b43de002a5a9defce9a30a376e33600193cbd0e76a68ada5644d99c6ac8f729062e70d15f937f3a6aeac3016cbf566dc023371ecad98b7495ad41500bd27cb2fa72fe7e28f55269132a7896f1eb9d88e23f9d95a12fe9cd36a7f2d01e39a321f92792079e1f841c8e1efe886cf3343aee11ff78e4efd41548971ccf6d6dd19dace1128b55e9663b4d32d08bcf878a64fcc7861ff32c392b5f1e99380c5c8b7b7920cdeef56c140f9f036c285f0fa7ba3aff09c1530cecd937e02d1c1538a9e7b64017b110bfe721f3ec213afa3b5f8df8367881f3dcd1e7d40dbce43a046ab8d1d6f8c3bf3bd5b040ac59cd1e2f7bfc5fc6ee2d2ef9961daadec8fe84c00b8370f900910a97c6849d6ddd0de5142ba9d7c7dd34f1ccbafb7f60f90e626ef6999953e08acecad634acf3270e57ed511264f83207929f40e8b12918c39724913c68242c01c06be8bce2abdb1414a5e38c86735a45b08c60e22de2af088374393e13d549c953ab4a5eb8f9e9ab68fb6e64d00c498865b03ebad4702a4b0c977999441e3001f0cf0e06fcec4ef6b9e75d23778e1464a3c69a3a4d12ecbabe703066837c0be1bd546c12056ff405c759f19e1d412b7eab4a91d20d3373b10bf9d1491d08652925f33440623a420164cc35f3e0d7ad8c517c59f8f46c919a28d87a141e3b7c7c64063920307e3c50b7abd19abc6c7cdfcec18574f5f51b7a407ea8fc8aeada5e212cad1ac5758bf33e2dc1fe46893a28219305f97d309c8dc141d3f3fcca139f3b96a64a622289a07fdbf16f93e8bc25ee4d606150618956d6c9c1846c521bab4ad915d12bdc54d538a7de5dc28b37ddf73f189a6628905e6d138c5ec0547374904e6c2f7c6e8625ebb984526ac0d3c07fde7590a3929644646024749340dda92bd4ea99a5a77196fa630549cc8b3d0adb7c3393a43e4c4ac926aa47a6760c4d6a062fad64b5a9dea65c0922a62111bd119711a2b9f840123f7a7beab5af48c99e2f572ff0fbbbd0b44034bf5b0c814a08fa188ce78f09af7f4659e2e50362f375b7a7a73bd4f85111a33d66dba44b6f989d31884ed9a648ad43274acb8a5b624be2d11478522d6a79e828d3eb94ac3d5b0df5d50af291913bd815784e5e3a5ae808c4f9e5ae6b96c920dfcc2a755c176c0d8e8a481f16c3b4ea94c3368cac7b51c40db11daa3ea77642b6214b5a7f4a94e0f6b0bfe4cae995343b5f46d32c3265cdc3b5f84326856288cd54269d9965415b39db90756cf894e2531da65b5ba28b46131283daa0fe31b572897cc54870387ccdabb2be7b08bb8baf7d6de88d0d66c429264f7f5250f0acb320baf0bbbcd9cae85d9013be2d42ef9a1cf7efea65586bf5da9c93a3a91daddf4bf70f37be89ccea3b902b46c8782de988dd8b1e720916f105792675b396cc79d171097806ca0ff1f4ba188fb6d15219c0d2e79608b404af36e842df7d92aed1348bf6f8f6acedc4de47ec1339545b3135ec40bdd2309f4e680f4d04065d61dbf64febea9bc73201b9667738946f3334edf796f1b02d953dcef8746fce6f9685412fb36c7b3ce738f3a639247f162f3f410c15a89067420bcc363bd80917673271d8810b4dc57bb740e684c0f7d7367cca2e4a2cc50bf795ac0e2a25ecd48641e706627139effbb763741d2177b80339eeeb986093594e4df9781793a3b099e971f895b6844c8f5e9f5eefddbf747d0b73852e755c0b35fa64cc2649a9d6d73204eddbb06a43ddfca96d32e808193212629cd4a8539374668fd311b2313b7d77a6040a95f9fe4caaa533b5713eea310410577d46d20cf9bd66aa53f73612da84cfe1f494b79fd5a7593f38551ef81e9996d3d4b09716040db5da03ccc789991a8c426d9ac6cc492c25f718ec735cb744b109b2ef60437ed93d8e6ed85a47acaa009243069a4d5f1d7ca8aecd1d1186d140cb8b25b86e0dfbb145d393ae674ef32ad5b843039e6d2706cec7dd03d12cdf70c012dbe3569a65acef521b9a18a702a74f7a5198c29a71ddbb14edead769598873b2ddd2fdedacd51da2c4a7ca7e2485395ad30584500efdde430138e7ebf9204514d82c42003556d27565403841d122112e93b6a745119aea391ede9c39e4e850397e3bb056f080741e2129cd8bcb9f27e554d0c05110194e4e1a7dccdaeae59e8107fcbe1772ea14961661eb9d61bf11132a10acf5474d7a68713a15acf77cbfdc59fd1395a043ecd2d162bcc76a80960b833a54003fadd110dc34f56311e81750df93ddbd4e955c6ccc833fc698c5ca71b9b96035638"}, &(0x7f0000c8a000)=0x1008) r6 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000971000-0x10)='/selinux/policy\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_REPLACE(r6, 0xc1105518, &(0x7f00005ce000)={{0x8, 0x0, 0x69, 0x1, "355633ba805765c008423c1f23a04b29a013e615f38d2857241da13ef18371bf095e283a458f65476fdcdedd", 0x2}, 0x0, 0x0, 0x10001, r5, 0x5, 0xffff, "0e73b54b1bd64729d54efa46a8edc51c5c9c5fdc9497a6dfef9218a8df5281225bc80c9ea88a9b3ada53e13512781a805fa150147618d759acb7138f32036eb9", &(0x7f00000f1000-0xb)='mime_typeu\x00', 0xb, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], [0x0, 0x7, 0x7fffffff, 0x3], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) capget(&(0x7f00000d8000)={0x20071026, r5}, &(0x7f00007be000-0x18)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 2018/02/01 04:11:35 executing program 2: openat$ion(0xffffffffffffff9c, &(0x7f0000801000-0x9)='/dev/ion\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000233000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = dup2(r0, r1) write$tun(0xffffffffffffffff, &(0x7f0000577000)=@pi={0x0, 0x0, @eth={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x0}, [], {@canfd={0xd, {{0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0, "feb442a1f43ead325d71fed774c8f6028c2a6b79a4e418aa3c5f391769659fef9f596cdade428c389e511eaad39d2ee4334dee9516a31d00510baaf06efc0980"}}}}}, 0x5a) r3 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x44, 0x0, &(0x7f0000005000-0x44)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x8, &(0x7f000026c000)=[@ptr={0x73622a85, 0x0, &(0x7f00004ee000-0x76)='\x00', 0x1, 0x0, 0x0}], &(0x7f000000b000-0x30)=[0x0]}}], 0x0, 0x0, &(0x7f0000009000)=""}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00005da000)={0x0, 0x0, &(0x7f00000d8000)=[], 0x48, 0x0, &(0x7f000044c000-0x83)="a410778b7a640ab0384c4ead541b6ee57c5645909ef688d8ac3e5ecfc7039f5f8ba53f127b7f01947cd3689eaf6c090277915bab2a0c450988cb85688e2bcc101a80664d3081fcc0"}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000c5a000)={0x0, 0x0, 0x0, 0x0}) mmap(&(0x7f0000000000/0x13000)=nil, 0x13000, 0x0, 0x32, 0xffffffffffffffff, 0x0) fcntl$F_SET_FILE_RW_HINT(r3, 0x40e, &(0x7f0000bab000-0x8)=0x3) ioctl$PERF_EVENT_IOC_SET_FILTER(r3, 0x40082406, &(0x7f0000ad4000)='/dev/ion\x00') write$selinux_load(r2, &(0x7f0000df2000)={0xf97cff8c, 0x8, 'SE Linux', "4b79e641e5aa5a00b98215ea2d9eb2347db4517839c74c0523f726742be57f6df6aaa59183c9b8195a989264b6e9b50a9a8ffddff9865b1c8951f283da660a258e5b6a632b943899184b2cc3ba87db9d49519bc055fb18f06479b5b9985c58d515df6cc35ca9140085a8b99f67d9c7a0f12200045ac16f1d404b340ac99a52c1f343c70d2e41221c567937958029cd1d36f3bb54fd87ca4dbfa3d405691977f2924db3afdb0ebe1c36d8057fcae9c6033ceab6f4bc10151f2498a61a2f1bf009532da2687e043db4e90823cb08f255397b827939a2767878ab3761e44f2ca9cec4b4b732e0af"}, 0xf6) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000a95000-0x30)={0x14, 0x0, &(0x7f0000b8f000)=[@increfs_done={0x40106308, r4, 0x1}], 0x0, 0x0, &(0x7f00002e4000-0x70)=""}) [ 315.330999] binder: 16220:16225 transaction failed 29189/-3, size 40-8 line 2903 [ 315.338959] binder: 16220:16225 ioctl c0306201 20008000 returned -14 [ 315.351491] binder: undelivered TRANSACTION_ERROR: 29189 [ 315.357130] binder: undelivered TRANSACTION_ERROR: 29189 2018/02/01 04:11:35 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f00009e3000-0xd)='/selinux/mls\x00', 0x0, 0x0) ioctl$KVM_SET_NR_MMU_PAGES(r0, 0xae44, 0xfffffffffffff5d7) seccomp(0x1, 0x0, &(0x7f000089b000-0x10)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x407ffc0003}]}) shmctl$IPC_INFO(0x0, 0x3, &(0x7f0000564000)=""/4096) [ 315.402749] binder: BINDER_SET_CONTEXT_MGR already set [ 315.417199] binder: BINDER_SET_CONTEXT_MGR already set [ 315.422629] binder: 16262:16273 ioctl 40046207 0 returned -16 2018/02/01 04:11:35 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r0, &(0x7f0000022000-0x16)="01", 0x1, 0x0, &(0x7f0000031000-0x10)={0x2, 0xffffffffffffffff, @local={0xac, 0x14, 0xffffffffffffffff, 0xaa}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x10) socketpair$ipx(0x4, 0x2, 0x0, &(0x7f00005bf000-0x8)={0x0, 0x0}) shutdown(r0, 0x1) [ 315.426622] binder: send failed reply for transaction 1781 to 16264:16271 [ 315.428790] binder: 16264:16271 ioctl 4c00 14 returned -22 [ 315.428930] binder: 16264:16271 BC_DEAD_BINDER_DONE 0000000000000003 not found [ 315.428944] binder: 16264:16271 BC_INCREFS_DONE u00000000204edf8a node 1782 cookie mismatch 0000000000000000 != 0000000000000001 [ 315.429627] binder: 16270:16275 ioctl 40046207 0 returned -16 [ 315.432597] binder: 16270:16275 transaction failed 29189/-22, size 40-8 line 2788 [ 315.434602] binder: 16270:16275 ioctl 40082406 20ad4000 returned -22 [ 315.434705] binder: 16270:16275 BC_INCREFS_DONE u0000000000000000 no match [ 315.449784] binder: BINDER_SET_CONTEXT_MGR already set [ 315.449794] binder: 16264:16271 ioctl 40046207 0 returned -16 [ 315.455244] binder: 16262:16281 BC_INCREFS_DONE node 1787 has no pending increfs request [ 315.460541] binder: 16264:16271 ioctl 4c00 16 returned -22 [ 315.460585] binder: 16264:16271 BC_INCREFS_DONE node 1782 has no pending increfs request [ 315.460638] binder: 16264:16271 BC_DEAD_BINDER_DONE 0000000000000003 not found [ 315.460651] binder: 16264:16271 BC_INCREFS_DONE u00000000204edf8a node 1782 cookie mismatch 0000000000000000 != 0000000000000001 [ 315.469522] binder: 16270:16282 ioctl 40082406 20ad4000 returned -22 [ 315.470759] binder: 16270:16282 BC_INCREFS_DONE node 1792 has no pending increfs request [ 315.488578] binder: release 16270:16275 transaction 1791 out, still active [ 315.488586] binder: unexpected work type, 4, not freed [ 315.488590] binder: undelivered TRANSACTION_COMPLETE [ 315.488666] binder: send failed reply for transaction 1786 to 16262:16281 [ 315.488681] binder: send failed reply for transaction 1789 to 16264:16271 [ 315.488684] ------------[ cut here ]------------ [ 315.488688] Unexpected reply error: 29189 [ 315.488830] WARNING: CPU: 1 PID: 24 at drivers/android/binder.c:1937 binder_send_failed_reply+0x13b/0x350 [ 315.488835] Kernel panic - not syncing: panic_on_warn set ... [ 315.488835] [ 315.488843] CPU: 1 PID: 24 Comm: kworker/1:1 Not tainted 4.15.0+ #290 [ 315.488848] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 315.488856] Workqueue: events binder_deferred_func [ 315.488862] Call Trace: [ 315.488875] dump_stack+0x194/0x257 [ 315.488891] ? arch_local_irq_restore+0x53/0x53 [ 315.488910] ? vsnprintf+0x1ed/0x1900 [ 315.488930] panic+0x1e4/0x41c [ 315.488940] ? refcount_error_report+0x214/0x214 [ 315.488948] ? show_regs_print_info+0x18/0x18 [ 315.488968] ? __warn+0x1c1/0x200 [ 315.488980] ? binder_send_failed_reply+0x13b/0x350 [ 315.488986] __warn+0x1dc/0x200 [ 315.488993] ? binder_send_failed_reply+0x13b/0x350 [ 315.489006] report_bug+0x211/0x2d0 [ 315.489030] fixup_bug.part.11+0x37/0x80 [ 315.489042] do_error_trap+0x2d7/0x3e0 [ 315.489049] ? __down_trylock_console_sem+0x10d/0x1e0 [ 315.489063] ? math_error+0x400/0x400 [ 315.489069] ? vprintk_emit+0x3ea/0x590 [ 315.489079] ? vprintk_emit+0x3ea/0x590 [ 315.489100] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 315.489122] do_invalid_op+0x1b/0x20 [ 315.489130] invalid_op+0x22/0x40 [ 315.489136] RIP: 0010:binder_send_failed_reply+0x13b/0x350 [ 315.489140] RSP: 0018:ffff8801d9867128 EFLAGS: 00010286 [ 315.489146] RAX: dffffc0000000008 RBX: ffff8801b2dc3000 RCX: ffffffff815a4e0e [ 315.489150] RDX: 0000000000000000 RSI: 1ffff1003b30b5e5 RDI: 0000000000000293 [ 315.489154] RBP: ffff8801d9867150 R08: 1ffff1003b30cdb8 R09: 0000000000000000 [ 315.489159] R10: ffff8801d9866fa0 R11: 0000000000000000 R12: ffff8801aed18cc0 [ 315.489163] R13: 0000000000007205 R14: 0000000000007205 R15: 0000000000003f88 [ 315.489188] ? vprintk_func+0x5e/0xc0 [ 315.489205] ? binder_send_failed_reply+0x13b/0x350 [ 315.489221] binder_cleanup_transaction+0xd2/0x140 [ 315.489235] binder_release_work+0x340/0x490 [ 315.489244] ? lock_downgrade+0x980/0x980 [ 315.489261] ? kzalloc.constprop.50+0x20/0x20 [ 315.489280] ? do_raw_spin_trylock+0x190/0x190 [ 315.489290] ? binder_free_ref+0x78/0x90 [ 315.489300] ? trace_hardirqs_on_caller+0x421/0x5c0 [ 315.489320] ? _raw_spin_unlock+0x22/0x30 [ 315.489335] binder_deferred_func+0xe42/0x1340 [ 315.489367] ? binder_cleanup_ref_olocked+0xab0/0xab0 [ 315.489379] ? debug_object_deactivate+0x364/0x560 [ 315.489401] ? lock_release+0xa40/0xa40 [ 315.489417] ? find_held_lock+0x35/0x1d0 [ 315.489433] ? check_noncircular+0x20/0x20 [ 315.489444] ? lock_acquire+0x1d5/0x580 [ 315.489455] ? process_one_work+0xb01/0x1af0 [ 315.489485] ? __lock_is_held+0xb6/0x140 [ 315.489520] process_one_work+0xbbf/0x1af0 [ 315.489528] ? trace_hardirqs_on+0xd/0x10 [ 315.489559] ? pwq_dec_nr_in_flight+0x450/0x450 [ 315.489582] ? perf_trace_lock_acquire+0xe3/0x980 [ 315.489590] ? __schedule+0x8f3/0x2060 [ 315.489597] ? _raw_spin_unlock_irqrestore+0xa6/0xba [ 315.489619] ? perf_trace_lock+0x900/0x900 [ 315.489635] ? retint_kernel+0x10/0x10 [ 315.489655] ? check_noncircular+0x20/0x20 [ 315.489665] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 315.489714] ? lock_acquire+0x1d5/0x580 [ 315.489722] ? lock_acquire+0x1d5/0x580 [ 315.489730] ? worker_thread+0x4a3/0x1990 [ 315.489752] ? lock_release+0xa40/0xa40 [ 315.489763] ? retint_kernel+0x10/0x10 [ 315.489775] ? do_raw_spin_trylock+0x190/0x190 [ 315.489808] worker_thread+0x223/0x1990 [ 315.489859] ? process_one_work+0x1af0/0x1af0 [ 315.489874] ? _raw_spin_unlock_irq+0x27/0x70 [ 315.489888] ? trace_hardirqs_on_caller+0x421/0x5c0 [ 315.489899] ? trace_hardirqs_on+0xd/0x10 [ 315.489907] ? mmdrop+0x18/0x30 [ 315.489918] ? finish_task_switch+0x1f6/0x740 [ 315.489932] ? copy_overflow+0x20/0x20 [ 315.489963] ? __schedule+0x8f3/0x2060 [ 315.489994] ? check_noncircular+0x20/0x20 [ 315.490019] ? find_held_lock+0x35/0x1d0 [ 315.490044] ? find_held_lock+0x35/0x1d0 [ 315.490067] ? complete+0x62/0x80 [ 315.490094] ? __schedule+0x2060/0x2060 [ 315.490102] ? do_wait_intr_irq+0x3e0/0x3e0 [ 315.490111] ? __lockdep_init_map+0xe4/0x650 [ 315.490123] ? do_raw_spin_trylock+0x190/0x190 [ 315.490132] ? lockdep_init_map+0x9/0x10 [ 315.490142] ? _raw_spin_unlock_irqrestore+0x31/0xba [ 315.490155] ? trace_hardirqs_on_caller+0x421/0x5c0 [ 315.490167] ? trace_hardirqs_on+0xd/0x10 [ 315.490178] ? __kthread_parkme+0x175/0x240 [ 315.490196] kthread+0x33c/0x400 [ 315.490205] ? process_one_work+0x1af0/0x1af0 [ 315.490212] ? kthread_stop+0x7a0/0x7a0 [ 315.490226] ret_from_fork+0x3a/0x50 [ 315.490984] Dumping ftrace buffer: [ 315.491082] (ftrace buffer empty) [ 315.491085] Kernel Offset: disabled [ 316.087862] Rebooting in 86400 seconds..