9d025249f955739f4e3bb6b0461709ad86c407b15fde58fa2b63dfd79c1529a7ee3b2f713cf6522dedf77074b2c60542361ddc4d8be5344078efb63c3deb967a1c61edc966592abcadabae6d4f9e5050dfc58000481b0ad60b8b34ce400b8b434bac774614334b7e5c8f002434aa1d946c3b031a31d6b8c536221c11e35dc8b6310931f7fdc767d8bb762fa6ea8013288984ed66b8ef55730627e87b43d2f77832abe9", 0xff, 0xffffffffffffffff) add_key$user(&(0x7f00006cc000-0x5)='user\x00', &(0x7f0000f3c000-0x5)={0x73, 0x79, 0x7a, 0x3}, &(0x7f00000cf000-0xb4)="1cb4605c1331e6cdb30b15a3076c40d02fe6529613232be4e39b3f764dc787e5663c1fbede2ccfc4a180b40f986b21b282106a212006bce965b5c2723c3f2850c056b8e1c70607d3c0051832c50a8eabb57191f19f45fb99955a3c1d6bf541efa0cbbbffe13a72f8dd24b8cb268ef3a78ab40d6362d5053d12c6336b28a0c82423608885a0a8c144be4300bf550ac28c650c0d94bf313f0d8f91d7b0b443dfea91e3b0a2fb9d007f9ccba89be8aa053d65944356", 0xb4, r6) openat$vcs(0xffffffffffffff9c, &(0x7f0000c17000-0x9)='/dev/vcs\x00', 0x204200, 0x0) setsockopt$inet6_IPV6_ADDRFORM(r4, 0x29, 0x1, &(0x7f0000436000)=0x2, 0x4) fcntl$getflags(r5, 0x3) close(r2) syz_open_dev$sg(&(0x7f0000a4b000-0x9)='/dev/sg#\x00', 0x2, 0x400000) 2018/02/10 14:10:07 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r0, r0, &(0x7f0000049000), 0x3d2) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000008000)={&(0x7f000000f000-0xc)={0x10, 0x34000}, 0xc, &(0x7f0000220000)={&(0x7f00008d6000-0x14)={0x14, 0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, {}, []}, 0x14}, 0x1}, 0x0) r1 = userfaultfd(0x80800) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000ff8000-0x20)={{&(0x7f0000012000/0x2000)=nil, 0x2000}, 0x1}) bpf$MAP_CREATE(0x0, &(0x7f0000fb4000)={0x2, 0x8000000000000004, 0x400, 0x7fd, 0x4, 0xffffffffffffffff}, 0x2c) userfaultfd(0x800) clock_gettime(0x0, &(0x7f0000132000)={0x0, 0x0}) socketpair(0x1d, 0x800, 0x4, &(0x7f0000589000)) r4 = syz_open_dev$mouse(&(0x7f00006eb000)='/dev/input/mouse#\x00', 0xde6e, 0x1) timer_settime(0x0, 0x1, &(0x7f000097e000)={{0x0, r3}, {r2, r3+10000000}}, &(0x7f0000939000)) fanotify_init(0x25, 0x802) r5 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000ef2000-0x1d)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f00002d8000-0xc)={0x0, 0x0}, &(0x7f0000d76000-0x4)=0xc) syz_open_procfs(r6, &(0x7f0000013000)='ns/cgroup\x00') openat$ion(0xffffffffffffff9c, &(0x7f0000dd5000)='/dev/ion\x00', 0x800, 0x0) pipe2(&(0x7f000058c000), 0x0) setsockopt$inet_IP_XFRM_POLICY(r4, 0x0, 0x11, &(0x7f0000e12000-0xe8)={{{@in6=@mcast1={0xff, 0x1, [], 0x1}, @in=@rand_addr, 0x2, 0xbd, 0x3, 0x20, 0xa, 0xa0, 0x80, 0xbf, 0x0, r7}, {0x0, 0x8, 0x0, 0x3, 0x6, 0x1fa8, 0x8, 0x20}, {0x1719, 0x7fff, 0x7ff, 0x7ff}, 0x1, 0x7, 0x0, 0x1, 0x1, 0x3}, {{@in=@broadcast=0xffffffff, 0x1, 0x7f}, 0xa, @in=@empty, 0xffffffffffffffff, 0x3, 0x0, 0xffffffffffffffbc, 0x20, 0x6, 0x2}}, 0xe8) openat$selinux_policy(0xffffffffffffff9c, &(0x7f000010e000-0x10)='/selinux/policy\x00', 0x0, 0x0) setsockopt$netlink_NETLINK_TX_RING(r5, 0x10e, 0x7, &(0x7f0000ab4000-0x10)={0x6, 0x7, 0x52, 0xfffffffffffffffc}, 0x10) 2018/02/10 14:10:07 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000a5000-0x8)) mmap(&(0x7f0000000000/0x19000)=nil, 0x19000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000924000-0xc)='/dev/rfkill\x00', 0x0, 0x0) r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000e54000-0x18)={0xaa}) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000008000-0x20)={{&(0x7f0000000000/0x4000)=nil, 0x4000}, 0x1}) readv(r0, &(0x7f00001f3000-0x10)=[{&(0x7f0000002000-0x4e)=""/1, 0x1}], 0x1) ioctl$RNDADDTOENTCNT(r0, 0x40045201, &(0x7f0000ee6000)=0xba) ioctl$sock_bt_hidp_HIDPGETCONNLIST(r1, 0x800448d2, &(0x7f0000140000-0x8)={0xa, &(0x7f0000117000-0x5c8)=[{}, {}, {}, {}, {}, {}, {}, {}, {}, {}]}) ioctl$RNDADDTOENTCNT(r0, 0x40045201, &(0x7f0000a81000)) creat(&(0x7f0000ff7000-0x8)='./file0\x00', 0x0) ioctl$UFFDIO_UNREGISTER(r1, 0xc020aa04, &(0x7f0000008000-0x4)={&(0x7f0000000000/0x2000)=nil, 0x2000}) 2018/02/10 14:10:07 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$evdev(&(0x7f0000dda000-0x12)='/dev/input/event#\x00', 0x0, 0x0) ioctl$EVIOCGRAB(r0, 0x40044590, &(0x7f0000e95000-0x4)) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000a19000)='/dev/sequencer2\x00', 0x80000, 0x0) getsockopt$inet_sctp6_SCTP_INITMSG(r1, 0x84, 0x2, &(0x7f0000a45000-0x8), &(0x7f0000a39000)=0x8) ioctl$TIOCSBRK(0xffffffffffffffff, 0x40044591) request_key(&(0x7f0000102000)='big_key\x00', &(0x7f0000ad3000)={0x73, 0x79, 0x7a, 0x3}, &(0x7f00006cc000-0x40)='deflate\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', 0xffffffffffffffff) ioctl$KVM_SET_FPU(r1, 0x41a0ae8d, &(0x7f0000d30000)={[], 0x400, 0x81, 0x101, 0x0, 0x218a, 0x1, 0x1000, [], 0x7aaf}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x2400, 0x9) 2018/02/10 14:10:07 executing program 1: mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ppp\x00', 0x200, 0x0) setsockopt$sock_linger(r0, 0x1, 0xd, &(0x7f00006e2000-0x8)={0xffffffffffffffa1}, 0x8) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00007d2000+0x1c8)=0x20000524a) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000001000)='/dev/ptmx\x00', 0x2, 0x0) ioctl$TCXONC(r1, 0x540a, 0x0) write(r1, &(0x7f000001d000-0x2)="b6", 0x1) ioctl$TCXONC(r1, 0x540a, 0x1) [ 65.192625] binder: 10929:10937 Acquire 1 refcount change on invalid ref 0 ret -22 [ 65.200495] binder: 10929:10937 unknown command 0 [ 65.206076] binder: 10929:10937 ioctl c0306201 2000a000 returned -22 [ 65.214480] binder: 10930:10939 got transaction with invalid handle, 0 [ 65.218877] binder: 10929:10937 got transaction with invalid handle, 0 [ 65.221483] binder: 10930:10939 transaction failed 29201/-22, size 56-8 line 3049 2018/02/10 14:10:07 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000c58000)={{{@in6=@ipv4={[], [], @local}, @in6=@mcast2, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast2}, 0x0, @in6=@dev}}, &(0x7f0000b01000-0x4)=0xe8) lstat(&(0x7f00008ac000-0x8)='./file0\x00', &(0x7f0000dd4000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_fuse_mount(&(0x7f0000ffd000-0x8)='./file0\x00', 0xa000, r0, r1, 0x80, 0x0) keyctl$dh_compute(0x17, &(0x7f00004cb000), &(0x7f0000dc6000-0x6f)=""/111, 0x6f, &(0x7f0000ed7000-0x2c)={&(0x7f00002e7000-0x40)={'cmac(tea-generic)\x00'}}) 2018/02/10 14:10:07 executing program 0: mmap(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x0, 0xa972, 0xffffffffffffffff, 0x0) mprotect(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x1000006) mprotect(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x5) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = add_key$keyring(&(0x7f0000a96000-0x8)='keyring\x00', &(0x7f0000001000-0x5)={0x73, 0x79, 0x7a, 0x3}, 0x0, 0x0, 0xfffffffffffffffe) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r1 = request_key(&(0x7f0000a96000)='rxrpc_s\x00', &(0x7f0000000000)={0x73, 0x79, 0x7a, 0x0}, &(0x7f0000000000)='em0\x00', 0xfffffffffffffffd) keyctl$unlink(0x9, r0, r1) 2018/02/10 14:10:07 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000a000)={0x34e, 0x0, &(0x7f00001e5000-0x8)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000006000-0x54)}) 2018/02/10 14:10:07 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000a000)={0x0, 0x0, &(0x7f00001e5000-0x8)=[], 0x0, 0x0, &(0x7f0000006000-0x54)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000-0x30)={0x44, 0x0, &(0x7f0000d06000)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x38, 0x8, &(0x7f000000d000)=[@fda={0x66646185}, @flat={0x73682a85}], &(0x7f0000006000)=[0x20]}}], 0x0, 0x0, &(0x7f0000176000-0x1)}) [ 65.228920] binder: 10929:10937 transaction failed 29201/-22, size 56-8 line 3049 [ 65.259604] binder: undelivered TRANSACTION_ERROR: 29201 [ 65.270186] binder: undelivered TRANSACTION_ERROR: 29201 2018/02/10 14:10:07 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f00007ad000)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_REM(r0, 0x84, 0x65, &(0x7f0000ef4000-0x10)=[@in={0x2, 0x2, @multicast1=0xe0000001}], 0x10) keyctl$dh_compute(0x17, &(0x7f00004cb000), &(0x7f0000dc6000-0x6f)=""/111, 0x6f, &(0x7f0000ed7000-0x2c)={&(0x7f00002e7000-0x40)={'cmac(tea-generic)\x00'}}) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f000038d000)='/dev/cuse\x00', 0x100, 0x0) ioctl$TIOCPKT(r1, 0x5420, &(0x7f0000f70000-0x4)=0x4) syz_open_dev$sndmidi(&(0x7f0000bad000)='/dev/snd/midiC#D#\x00', 0x1, 0x0) 2018/02/10 14:10:07 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000a000)={0x34e, 0x0, &(0x7f00001e5000-0x8)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000006000-0x54)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000-0x30)={0x44, 0x0, &(0x7f0000d06000)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x38, 0x8, &(0x7f000000d000)=[@fda={0x66646185}, @flat={0x73682a85}], &(0x7f0000006000)=[0x20]}}], 0x0, 0x0, &(0x7f0000176000-0x1)}) 2018/02/10 14:10:07 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r0, r0, &(0x7f0000049000), 0x3d2) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000008000)={&(0x7f000000f000-0xc)={0x10, 0x34000}, 0xc, &(0x7f0000220000)={&(0x7f00008d6000-0x14)={0x14, 0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, {}, []}, 0x14}, 0x1}, 0x0) r1 = userfaultfd(0x80800) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000ff8000-0x20)={{&(0x7f0000012000/0x2000)=nil, 0x2000}, 0x1}) bpf$MAP_CREATE(0x0, &(0x7f0000fb4000)={0x2, 0x8000000000000004, 0x400, 0x7fd, 0x4, 0xffffffffffffffff}, 0x2c) userfaultfd(0x800) clock_gettime(0x0, &(0x7f0000132000)={0x0, 0x0}) socketpair(0x1d, 0x800, 0x4, &(0x7f0000589000)) r4 = syz_open_dev$mouse(&(0x7f00006eb000)='/dev/input/mouse#\x00', 0xde6e, 0x1) timer_settime(0x0, 0x1, &(0x7f000097e000)={{0x0, r3}, {r2, r3+10000000}}, &(0x7f0000939000)) fanotify_init(0x25, 0x802) r5 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000ef2000-0x1d)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f00002d8000-0xc)={0x0, 0x0}, &(0x7f0000d76000-0x4)=0xc) syz_open_procfs(r6, &(0x7f0000013000)='ns/cgroup\x00') openat$ion(0xffffffffffffff9c, &(0x7f0000dd5000)='/dev/ion\x00', 0x800, 0x0) pipe2(&(0x7f000058c000), 0x0) setsockopt$inet_IP_XFRM_POLICY(r4, 0x0, 0x11, &(0x7f0000e12000-0xe8)={{{@in6=@mcast1={0xff, 0x1, [], 0x1}, @in=@rand_addr, 0x2, 0xbd, 0x3, 0x20, 0xa, 0xa0, 0x80, 0xbf, 0x0, r7}, {0x0, 0x8, 0x0, 0x3, 0x6, 0x1fa8, 0x8, 0x20}, {0x1719, 0x7fff, 0x7ff, 0x7ff}, 0x1, 0x7, 0x0, 0x1, 0x1, 0x3}, {{@in=@broadcast=0xffffffff, 0x1, 0x7f}, 0xa, @in=@empty, 0xffffffffffffffff, 0x3, 0x0, 0xffffffffffffffbc, 0x20, 0x6, 0x2}}, 0xe8) openat$selinux_policy(0xffffffffffffff9c, &(0x7f000010e000-0x10)='/selinux/policy\x00', 0x0, 0x0) setsockopt$netlink_NETLINK_TX_RING(r5, 0x10e, 0x7, &(0x7f0000ab4000-0x10)={0x6, 0x7, 0x52, 0xfffffffffffffffc}, 0x10) 2018/02/10 14:10:07 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00007d2000+0x1c8)=0x20000524a) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000001000)='/dev/ptmx\x00', 0x2, 0x0) ioctl$KDADDIO(r0, 0x4b34, 0x3) ioctl$TCXONC(r0, 0x540a, 0x0) splice(r0, &(0x7f00005ee000-0x8), r0, &(0x7f000098c000-0x8), 0x8, 0x2) write(r0, &(0x7f000001d000-0x2)="b6", 0x1) ioctl$TCXONC(r0, 0x540a, 0x1) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffff9c, 0x29, 0x23, &(0x7f0000e82000)={{{@in=@local, @in=@rand_addr, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast2}, 0x0, @in=@multicast2}}, &(0x7f00005bb000-0x4)=0xe8) getresgid(&(0x7f0000e9c000-0x4)=0x0, &(0x7f00004af000), &(0x7f000097d000-0x4)) fchown(r0, r1, r2) io_setup(0x1, &(0x7f0000cb3000)=0x0) r4 = openat$dsp(0xffffffffffffff9c, &(0x7f00005c1000-0x9)='/dev/dsp\x00', 0x202, 0x0) getsockopt$netrom_NETROM_IDLE(r4, 0x103, 0x7, &(0x7f0000deb000)=0x6, &(0x7f000070c000-0x4)=0x4) r5 = openat$autofs(0xffffffffffffff9c, &(0x7f0000206000-0xc)='/dev/autofs\x00', 0x80, 0x0) io_submit(r3, 0x2, &(0x7f0000373000)=[&(0x7f0000414000-0x40)={0x0, 0x0, 0x0, 0x2, 0xd4, r0, &(0x7f000062c000-0x1)='\'', 0x1, 0x0, 0x0, 0x1, r4}, &(0x7f0000258000)={0x0, 0x0, 0x0, 0x2, 0x400, r0, &(0x7f000044a000-0x75)="45cf39db48ff1283da30e7e6ebe30f7b92680f810bc7ca3fb07079444e21496054fea85fd6b243f40a0da03a266ade5a883dbce624b96f20f06b31c0413113d25c67421347e278104394f976fac585c74a276915e909c79dfe938772e5cbe8f62ef3a8cebed7f72996e1ade462a079bdb09c4e57d6", 0x75, 0xffffffffffffff09, 0x0, 0x1, r5}]) [ 65.297225] can: request_module (can-proto-4) failed. [ 65.308390] binder: 10954:10957 Acquire 1 refcount change on invalid ref 0 ret -22 [ 65.309953] binder: 10952:10958 got transaction with invalid handle, 0 [ 65.316234] binder: 10954:10957 unknown command 0 [ 65.332738] binder: 10952:10958 transaction failed 29201/-22, size 56-8 line 3049 [ 65.340550] binder: 10954:10957 ioctl c0306201 2000a000 returned -22 2018/02/10 14:10:07 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000a000)={0x0, 0x0, &(0x7f00001e5000-0x8)=[], 0x0, 0x0, &(0x7f0000006000-0x54)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000-0x30)={0x44, 0x0, &(0x7f0000d06000)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x38, 0x8, &(0x7f000000d000)=[@fda={0x66646185}, @flat={0x73682a85}], &(0x7f0000006000)=[0x20]}}], 0x0, 0x0, &(0x7f0000176000-0x1)}) 2018/02/10 14:10:07 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000a5000-0x8)) mmap(&(0x7f0000000000/0x19000)=nil, 0x19000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000924000-0xc)='/dev/rfkill\x00', 0x0, 0x0) r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000e54000-0x18)={0xaa}) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000008000-0x20)={{&(0x7f0000000000/0x4000)=nil, 0x4000}, 0x1}) fcntl$setpipe(r1, 0x407, 0x0) mremap(&(0x7f0000776000/0x3000)=nil, 0x3000, 0x3000, 0x3, &(0x7f0000b77000/0x3000)=nil) readv(r0, &(0x7f00001f3000-0x10)=[{&(0x7f0000002000-0x4e)=""/1, 0x1}], 0x1) ioctl$RNDADDTOENTCNT(r0, 0x40045201, &(0x7f0000b27000)) ioctl$RNDADDTOENTCNT(r0, 0x40045201, &(0x7f0000a81000)) ioctl$UFFDIO_UNREGISTER(r1, 0xc020aa04, &(0x7f0000008000-0x4)={&(0x7f0000000000/0x2000)=nil, 0x2000}) 2018/02/10 14:10:07 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) keyctl$dh_compute(0x17, &(0x7f00004cb000), &(0x7f0000dc6000-0x6f)=""/111, 0x6f, &(0x7f0000ed7000-0x2c)={&(0x7f00002e7000-0x40)={'cmac(tea-generic)\x00'}}) mlock(&(0x7f0000332000/0x4000)=nil, 0x4000) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffff9c, 0x89e2, &(0x7f0000dba000)={0xffffffffffffff9c}) getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r0, 0x84, 0xf, &(0x7f0000277000)={0x0, @in={{0x2, 0x3, @multicast1=0xe0000001}}, 0x0, 0x6, 0x480, 0x8, 0x1}, &(0x7f00009be000)=0xa0) getsockopt$inet_sctp_SCTP_DELAYED_SACK(r0, 0x84, 0x10, &(0x7f0000b30000-0x8)=@assoc_value={r1, 0x42}, &(0x7f0000d31000)=0x8) sendmsg$nl_netfilter(r0, &(0x7f0000e6c000)={&(0x7f0000265000-0xc)={0x10, 0x0, 0x0, 0x81000}, 0xc, &(0x7f0000aa8000)={&(0x7f0000dc8000)={0x280, 0x12, 0xf, 0x100, 0x5, 0x1, {0x0, 0x0, 0x7}, [@typed={0xc, 0x66, @u32=0x9b}, @typed={0xc, 0x6e, @str='GPL\x00'}, @typed={0x18, 0x34, @ipv6=@remote={0xfe, 0x80, [], 0x0, 0xbb}}, @generic="5a41743b95795e583e0c7e39e4fe4f6df9f47a5ba87c92ea8a97344d4559c35937a2611216bd2c1d31cf727766413d2b85368359f4003ff8844548dad14380338d0dc0b51b7d4ce6a238cb10a094de79cab28ad2d8eb2dd55a2ce8bcf6929636e506f98a2612ef9796ba93b1b818398bcb5b49", @nested={0x1bc, 0x47, [@typed={0xc, 0x95, @u32=0x3}, @typed={0x8, 0x8e}, @generic="ff712d3c6297c2edaa9774baef95468d85fc511c878f87f61cbea3f162cf02578d29b9259566ea5e68dbc38e2900963cf411f71981ab115ff1b6d907255dd0a7ade877f4f51ab4279de38d511b721ab3a574173058e6791c3701e09f52e07ee0b554d3a6eab58c23c05953951f95968de49e7e7416b758f5e1d7f603c91e6e07022d3b1a3004848a83882c519306bf77f4d3ede5cfd0a66be2dd4d87c8c0c85ab6c5669cf1e824f1fc2612eeb93c486371de8e65336d13c709e291811d0290", @generic="aa13986810c66a1b6be4d7bed8f6b1e21eed551997dae324f1f4ce3b0072c791db75eb63553959a0671f47b769f51cf25cd1db37174941dda8fe601b18c2330bf643df9a3a2911958f2e0bf49b3ac87b501f51537a83afd3ae260249891faa2ca14ff0ac0d356a31c4c814e4b882d0688249d99712c76b55202f7be4407117cb670303892fd77b394ca452238d385abc6213b1ee64f3051a60847e16b572b53c2f1b727f3c3ffb4453c079297529", @typed={0x24, 0x6d, @binary="0db11837b698abc6f726b58e45dfe2487b0ab5d33d83803b7c558a"}, @typed={0x10, 0x4b, @str='{em1\x00'}]}, @generic="376ff7643cbb01cbafe616"]}, 0x280}, 0x1, 0x0, 0x0, 0x800}, 0x10) 2018/02/10 14:10:07 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000a000)={0x34e, 0x0, &(0x7f00001e5000-0x8)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000006000-0x54)}) [ 65.370452] binder: undelivered TRANSACTION_ERROR: 29201 [ 65.393610] binder: 10966:10968 got transaction with invalid handle, 0 [ 65.393996] binder: 10963:10971 unknown command 0 [ 65.411267] binder: 10963:10971 ioctl c0306201 2000a000 returned -22 [ 65.423908] binder: 10966:10968 transaction failed 29201/-22, size 56-8 line 3049 [ 65.433645] binder: 10973:10975 unknown command 0 [ 65.439408] binder: release 10963:10976 transaction 186 out, still active [ 65.445090] binder: 10973:10975 ioctl c0306201 2000a000 returned -22 [ 65.446444] binder: undelivered TRANSACTION_COMPLETE [ 65.472225] binder: undelivered TRANSACTION_ERROR: 29201 [ 65.477809] binder: send failed reply for transaction 186, target dead [ 65.488314] can: request_module (can-proto-4) failed. 2018/02/10 14:10:07 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_ifreq(r0, 0x8990, &(0x7f000032b000)={@common='tunl0\x00', @ifru_map={0xfffffffffffffff9}}) ioctl$sock_SIOCGIFCONF(r0, 0x8910, &(0x7f000077b000-0x8)=@buf={0xba, &(0x7f0000cbe000-0xba)="5e65ca1fac01b21a4ae7bdfd8a6ace586ba8ebfdda14eb023ffd5611659d4d33a86c6a713d57631f7f897c91cfa7214dd47692c281f2b022bd3b5ed14685afd04ae99d1586cf4044a982d7a554babf8714eeb378ce0b2872cae3ad00330b140db3bc4422a0b18f6e250ee028737407bf003e0bb319f9eed35c0ca3f64c5219583df8ed0f3272f5c494b9868461742ed42eb73e8648ad2a167f7a569cd956dfa4b56652cf0c0c1b3ef30b71f9ebfb152ee17bda1be49b62796c9f"}) 2018/02/10 14:10:07 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) keyctl$dh_compute(0x17, &(0x7f00004cb000), &(0x7f0000dc6000-0x6f)=""/111, 0x6f, &(0x7f0000ed7000-0x2c)={&(0x7f00002e7000-0x40)={'cmac(tea-generic)\x00'}}) getsockopt$sock_cred(0xffffffffffffff9c, 0x1, 0x11, &(0x7f0000b6b000-0xc)={0x0}, &(0x7f0000b97000-0x4)=0xc) r1 = getpgrp(0x0) r2 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000946000-0xf)='/dev/sequencer\x00', 0x200000, 0x0) r3 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000cfe000)='/dev/sequencer2\x00', 0x4202, 0x0) sendmsg$nl_netfilter(r2, &(0x7f0000e9a000)={&(0x7f0000827000-0xc)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f000065a000-0x8)={&(0x7f0000eb7000)={0x1334, 0x5, 0x2, 0x300, 0x6, 0x1, {0xa, 0x0, 0x5}, [@generic="c5b709a936b2ae73aaa9a3df78d1c6ee3696bc50a068867beb6cf830726f3ff6356efe347b7e750fc49928d7651570078b517aaa894f7644f110d4729a9ca20a6050299cbf90cb7e276fee366fbb1916fd5e184e21eb859f6317d8b75de87c213c06ebb129cd4cca44956e2de63cd91abece5f0d4ec4d3e61fe30a33f53bff1f9da8d07eddfd5cab684007c76da5b6e7c02e68d0bb61ab3bf7ad0f7f6f70f33ae3ce5fa8f621deedd353b4e2b825adbecdd45baa9b744c8700b191d9acb55e41403967e5c39c01e2507db0241cf9358f75a7235d6c41aea7bc1a97df9772f077e93c256e8bda7035ab08faa74a1824f88ae239a1d799a3e44d670f574964b82fe08ac1674b9b48fe516ad43d168c6525e31ad739251bf3208b7611a7e202019e696fe261a3c3f5bfd5a7cf0be160d432fc4fce82b39233e7c401c94349e551b002cfa53a24b3c5a07f086ec1e5b5f87d517b5ddbb4f646632aed6615ebfd00f9f946d92304f52808209f942d422d8007921f66f70b84eb72dbeba29c25d28f2ab3ca06cf05b2018ee8ea93f14adddbf6f4a348cbb3ce402d1b2a990c888ec03d090b8636e753c295d894daf378052872fa426326354a71a16e1c6a1f1567029ed0535a5fb528dd6b2b97b6e4b5d957e000d05d29fa0b94635cb2b8e7c73cb08166c44582774aa9ac0c28f19fc20beba46cac5b887583fce1caa06b06be2d02d56140af72edecd1c39bb227615f524a512fa606a70038cfd352a4ab975b5cc02fa04226fdcf0aa302c1272de95d31daa734a9f0c9359ea682695da093b6553be3bd77241e9c78366e56cc5a81ef435baaada1065bca9f33c7f274466315432dbe355a25948d626af10dcecddfe7b2eb368fb696798c8a70137518cf069d8124b6759053e2768194af0c03c207b296d91b7c2d758f1f7cf7f29ebc5c2e8eece83b461e3f075c7e4d679c096008c7a2a4bd9c225aa7226df325acb04c38dcf4276578e6f38cf38214b636dc49515cef82c16c3061a824890efc4e36cbab1fb4f8f488d14f3b2656b6fda46379268c7e2371afce9401e32285a1591ba7600fb646ce72cb5452a95470cf357e83242c6ceccfa9bceb4be63a73d2752c8bd317be948b8b978cca44021b1f5102c9c89091eb35d6c49f933f7db1601c5906c55c4ea8c3e459187ca4a5d3528b6305eaacdb4dc6c5f618fbb73f5d83d56523a3e5a7723c356f0951f6129e8532c7b15def7b6911d80c944baf8082f5671e75b0e2e85055a672173a3d814946bb4424b06771b4200643130674aa6858b1d6470cec0346dcea21689943e41c77fb0d7e42e3876a39b6a4f9f4fea2e27755031f4c05c89b9e0375465f9c4b7613c440de8e655cfcb984dfdeff11dff4efa2d8796f23eb19368c72ff675a2517f7e7e1281589faabed98d09d02096683d1273e6f02b44dbc2d7d35057b54a5b75e36340f1f6638284010d6f28a9c1bf5deec9f9e988b2f0bbc23031ca174c4a69f692b1140ad6e9e945be9c086d5d86577d209e99105411251f91c4616dde92abd880ef8c9d147f2147040e18dffa1879df2f66ac318aeb0af07756906e88903f835fdc783f630f9a2e33c16098ac6e6f02ade5e0db9afaa0a53ff0a64555383441c9508d3e1bc9084ff973b4cd8e404b3a35bd8db06a25472982b61af7faa18bf250b57364f48aef47df17d323976ac0feb4170948611459f94dc3886566894ef4622e306fef1ff2a549aefd2e90c5feb2c94477b108913714ad8c15480a68f01f364e02b06fc07956401021ee35218b6b34310b6017136f20bd8d8f98157ce20db884637a4590b5850d8dd27e848cb640f826ceb148d9da1260463e60cb1d22cba36f0fa870ef177ec84ac412a83c1f4d634d730f5a6632766ab24e7dd8cd50adb4c2f760f28b3c2208d1d2a39638a84d9306f087f171564e0c4928be26f71bc1c751b9730047e5a6bf2c14f415c5b7825c1d1df418abb853a70065b0ba5e537f2f3a7ef9ea4e581cef3924ae206b39f9d225b64218a7f74de1713e0f2ab368f16a94684b654691a69b12619efdd2eee2548af3cdec285e36486437444d7fcded69d9e5f0fef231dac2927e807d95dfc0ebbd2c5ee4f46a59c6bd42c5433531a2f5145aeecc4aa19b55ddf36fee9ff40d73b70cd2f4dd8f1b7cc9a450300c914c43286f33e6caaec9605ccd69c64cf2324fad54cff3ff70fcd973779725f5b8fa5ed11d24810472280040375c501a0740534a513e6a1447deaeceb0767417aa8d6ff49602ba193fbf703ae2e4d615efd484b4ee4c3cb5630f8250972cff1c1c0b9e850d641a857263bd24f2fa6d74e5d5bbb0ea7c73bc0a15d87933514e7fbc4a436027f4ee01f176efbf7dc33711db841db84ac31b1f5de9d150a70330cc43cae96eb2cac139fefb4c0a512817a492886806d5e3367037090d2b70fa2f2d664ebeccca56cd86568207b90cd3a2bc726bd35aa580fbaf9771cb78d7d3b8b1e7992168eb4817ed3453cd8b8ad1059e6f676082c4b5141374344170d5fe016a8244b2e71c016dd4156e334ffd4bcaf0fb45534c60c04830c3fc9ce8c233e315415450701d43efe6a4ba9bc692186d14a8824ec68215c5b8291fa4259841b540394d9e55fac10ed37a87fed0acf597ff82eece6b64bd161939fd3d0fd2f851b813a868f82f33dce23a709d54df2ba9a56d04325d46464df4a7e2b9eb85ce1780308934cb695b5b8b3ad260ac9bdb9d6dcd2f97b67f725b10785c292e2d469087bf804715194d5e574166cbb3f44d3be919e6c1d9f6b43c2787fb4474b8781f236669ea2189d62b1c16f635222f96bfe6bfc26bdcb0e2f275e9fd926d69b732062b919642549fcf43cc86aae016f84ef2bbb9ced7bb03e01f2b25d50b8ab5847e9fda0bc8ce3a0ba5ca0f46b30fc3c0f05cd6dfa6a50839bc0a6dd26a943abb88ee552f494d6fb28a0b868f1b694fc9c2d62d018cdef2384a406b77ee9be54d9ec7ad9699b55e6067537eed978576d1a95dacf4ab28ef9e9dfee741a330ecf2293bc6072daf4b77c4e29a49fa69a94543fa5355bdc823335ddf13e404fc051162afbbe54f71c75ab01cb832f137e5e81ed093d39609c37f9369e99121130ff337fb2d142db9399b8acff8970c03035c706c4445255155f2b156c3b762d0f35957f4a86bcf3e0139be8b3520377f25fcf4f9221ac49dfd823531ff7f68836e067c30f32283c1aee4f3fcc9bd0030a0c90d8a4959e1156fbf2d2dadd741e357c482bd952881927c3ddf0a77202623925a26f6f7e0e1ac04aa42aec72ab7ad3ef1373f1ba39a0d729e804e0216df4e36f72de4b1bfc4ca390f59fbc70f56ef21f1b15c0795fcc4f6ef7cae1de702bfa173bd0628206b4ec971d4aba4ffc39596e163ee109400ac86b3b40c32373eef0bdded7e9f1277fdf77c4bc18f730c2e5cbe86984ad362f1a809d8187aea861d6929c9e4ee726755478f83cfc0ddcb32ed36115c6ee9ce5718a6ea1b58ba4e16baff8616b99878eadf42c5880cf86a0464cb7028c53c74693e383d21f428968e7aa8b66c2705b2158bf5d1914520b60586b62d8e2dfd742fe978bd07929c0b4410dbc39bc8b9a2061cbf5d4015f7ea46c128889dc15e733e63b6f083f951db8f2f30de697f7f1f35de93c5da4eebd8ae42b5b080e1196ab7d710b138e3f95a5e5d15b0f99ae8647cffe8788dd07f8096704d12cf8b040464998ccbd096b7165f2e14ad6b2adf40f0b5061a92731961b84410139711f0fe955a6f3bd3e267ff9756973e4abdb73918d642ce11de9ccb799a94bc429de86fd7a07177d2409aec4bf81f94a3a9c7b25529f25a338059866b6af7e1678b8827c5c5aee302bd686332149683ce510a12bde5a6a5d16cfbfb2b18e43b5c2de737b45294355fc1f7621349a8b5d37e8304979c8c174115f9149bafdd587241768789703c1289d436589beda586c161b3f7479f7cd29698b3bf0b4758c6f0bff662db91a77f45e7220aeda34194ccd2f6bfc921251dc44b5c32dee8773586d54ebd207f8d2f0afa865afe9b47aee2aba5a7584a0c42b0a85c7cc854c946a42c2eba0351e3e5423ad0b0215f7dc76c297c197413b6aa69b7e8aa7e13b0c23293ac71bd3e840081b2a94cf4027b170b77f3acf34f9d1e030eaa052e889dd649ee57b4bbb76680d038bdeaf260c8897df262a2a8d70a6d4ed1a77a1e3da97b9c39969ca944a690682a831927ef280e1997e6d6f1379a5a87f270fe0a138874945251b6a971a9a2d808abdb06f8f652da6e95e52f20ae55b4d2de25cec1c04100b6d184aca16494823b9c167db569c246e4b8dbcf18f3fbd3679f7945d20f01e5ab201b0fee89983b50d6da6a0acd6f808928d1322e572f7c4e51266fb9136a59f9475fee016e4701ece1eabd77aee35c8c97543916512e642bb09bd1b4c8d5dcd01fc590d10713e54ca3908d9428650f5dde24d6b2bf33fb4a15277159d81b98ca9caa8d3b144aa3cb9377d9aef22a41a1a2d25050f45e5f6d8b478fb9c2fbf824d2ab741400c601fc68f862343997613242d4b4a42fe4515fc9545b3f8398148206c73c25a2eb0405f806a822eb14967b8a9741bf5f3913819c4b6d47f2bf100a968c2160737e3cefe208549151c3325b9b7a9cec4fcb8174c415759bb548f0b2ce7d8590a870a64fcf2a2dde6673fad86936beaefba824ebb2077175a6d14dcf1c7e917dfbf6a93bdac19ddc65cd52efcdee00b6945af5275bf1e35e36199d67b0ed33d663a6f173a06470187ee6d8ecfdeeec7a18af6d0b017d9a9ac01134d31410d46528eb02aa844c79873b8a3790d767651db39dbca90bbee7d65b2914f5c0a9b68e31f51b2d4502cac2eea4fe9f7a65dba258d895fffe626040e4790f806ec351ed700f58e5b889d2c768b5a7addc3ae58066b17e5e69214d3b8aedc39fec5626a889722f320feaa3d906ffb180ab7aeaf2d01ca2ecb0661a58f51da842ed47c5d5bfd0ebbcce904dd85f0e2703a799cbbe8e768cd6f51080e2679bb18a104721f37d10044f5fc6863e15334b53556754900df7425dc9dd67d759f2bd8165127b554f63d2b7f4d9f6a973b07934961db63bc873f92a29d4e51650fa1fb4a6775faa596c5390f252fae9a10088334ce01dd22c1889dfa96f3640697fadba61aa80510e9aeaf9117f33045d1705edaed329c8610c529213da2e7889113567abe745eea5eefe837375b9b545dba24dc702d81dadbe336c53b4cbee3d489e35ff586739f96ab577eaabda0f34410596e497e9a31be42b09719a3e9b9d3585b7736d0bec945bfe21fef6b575908a4b91b4c308e5dc84bc445981348be4afba4e3b28a60f4d73d836548a150c8346cf5b153d98ca341f3e77045e4a10d4573309bf2bbdcc848062e5cf5754ca79d8de046ed4eb51e7de7fcd93ab0619d629c5422a919cf77b020d4a54620042fbf06e3828b6c1ca8e52f56ef36211f95893cb0fb0b77e29a9f563db227e7646e98355ab2f3363af75eae127b677eeb032a1b356a0d270c642d26848f9d74d9cb4544806e110498bf923769d0092f4d9d5aad6226c404115cf1a382d63a1a68435ec00f345ac9dea49ab064a8556c3efdee343632afad93bc4af31e3d0c3cd3ad506259c24ebd27fe95665c6f57536aa20691419b7b90d128e1e8ebf55fb217a25d4c66d1ed88acf8a40f509d0d6cd109eb5801c3b7b414adaf7a1f14724442320d33f24b406db0ed7d373d698b4daf98582d72e2e671b08d98d04f700d715a2c67bf50f34a4ac147df2ded", @typed={0xb4, 0x23, @binary="57d64c407007fa847840d0987ba60bd15946d141dfebda06ecb056094335b7ffe8c81ab6a1fb3ff414a70f78f9772998c75fc9036dc58fbb360ede29b1d75e25126d0cf7a2a40ee4cb603e37e0518ce05728ebd9520321661aea78f61d5ad296c6588efdbeb7b66f73c689a5edf7c30127c1999b834620258c8078e5590a77aa556f756ad3c089d804064f05716904348dd05544e8edb53071426aa72c08746a53cd11ac45f8736387"}, @typed={0xc, 0xa, @pid=r0}, @generic="b3c724464c720ae88d4687f8a8c12ec40f3571f1388fef91e63f5a60312716bcf192e8d1b40c4699d5b5e7272c40f3a9b19bbc6181a26fcf49676913f72b2e85c33687c409130607c14cdc2cc92236a03df2d7d637b59e9704b69f0ecc368acc3d5f5996314d1d0fc544337c57b5e4c3fff588908c8b0a0d9d1140249521ec83a8946ae4748fa7d032c9bb0408deac6b0af7c4adda31eaf3f37bdfbf4668c3da8b03fba5afced80baef749416a49a97fdaa0e53eb3", @nested={0x140, 0x68, [@typed={0xc, 0x1f, @pid=r1}, @typed={0xc, 0xb, @fd=r3}, @typed={0x10, 0x6d, @u64=0x128d745f}, @generic="1501a3b025f3e9768b3034df75088570e04443008a", @typed={0xc, 0x15, @ipv4=@broadcast=0xffffffff}, @typed={0x10, 0x4d, @u64=0x6}, @generic="b0234c9733df787916b3e0a5f9b2a2acf5440d3b92cf4685eb4c174c32a98457ba3fc61c2b99887beb95240f7101b815575f5949fdd20d8ea101a98beae56419b71929e451ff44bebe88a0c7461fcb544c2ed0802cf00d1135e1dbfa411924da5d0d1fb27fc189acd39cdfb4a6bc6fd5bdf33b8431036282f6b0a01c8427715bfaeeff57ff17003e8197d454eb8110b7f689fe36f1c153edb4919fce07cd24dfb993a1027f9e81493e7f82ca9aadc6cdb668f0a4166725ca849e32101af0446fc78b34f368013e11bcc8bcce552bcb4f7ee9dea5148233a509fa31dfd291101e00cc"]}, @generic="3acae1e03a8c58f579108bcc9006d1c3786ff2743c92775d9a5be07cd60ea1fa86ab21ccff7572eed938c2d06554bdd99d86a4818b1e34730b5fe7a469a794d4cee2abf11a1a306314978e61e3d70d57d44e3b4210db71827be9455cdf58020b2c971dc312f2e21ada"]}, 0x1334}, 0x1, 0x0, 0x0, 0x4000000}, 0x4000080) rt_tgsigqueueinfo(r0, r1, 0x41, &(0x7f0000b11000-0x10)={0x2, 0x6, 0x4, 0xf9}) 2018/02/10 14:10:07 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$evdev(&(0x7f0000dda000-0x12)='/dev/input/event#\x00', 0x0, 0x0) ioctl$EVIOCGRAB(r0, 0x40044590, &(0x7f0000e95000-0x4)) r1 = open(&(0x7f0000d13000)='./file0\x00', 0x101800, 0x18) ioctl$KDSETMODE(r1, 0x4b3a, 0x323) ioctl$TIOCSBRK(0xffffffffffffffff, 0x40044591) request_key(&(0x7f0000102000)='big_key\x00', &(0x7f0000ad3000)={0x73, 0x79, 0x7a, 0x3}, &(0x7f00006cc000-0x40)='deflate\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', 0xffffffffffffffff) 2018/02/10 14:10:07 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000a000)={0x34e, 0x0, &(0x7f00001e5000-0x8)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000006000-0x54)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000008000-0x30)={0x44, 0x0, &(0x7f0000d06000)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x38, 0x8, &(0x7f000000d000)=[@fda={0x66646185}, @flat={0x73682a85}], &(0x7f0000006000)=[0x20]}}], 0x0, 0x0, &(0x7f0000176000-0x1)}) 2018/02/10 14:10:07 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000a000)={0x34e, 0x0, &(0x7f00001e5000-0x8)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000006000-0x54)}) 2018/02/10 14:10:07 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000a5000-0x8)) mmap(&(0x7f0000000000/0x19000)=nil, 0x19000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000924000-0xc)='/dev/rfkill\x00', 0x0, 0x0) r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000e54000-0x18)={0xaa}) fdatasync(r1) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000008000-0x20)={{&(0x7f0000000000/0x4000)=nil, 0x4000}, 0x1}) readv(r0, &(0x7f00001f3000-0x10)=[{&(0x7f0000002000-0x4e)=""/1, 0x1}], 0x1) syz_open_dev$urandom(&(0x7f0000303000)='/dev/urandom\x00', 0x0, 0x101000) ioctl$RNDADDTOENTCNT(r0, 0x40045201, &(0x7f0000b27000)) ioctl$RNDADDTOENTCNT(r0, 0x40045201, &(0x7f0000a81000)) ioctl$UFFDIO_UNREGISTER(r1, 0xc020aa04, &(0x7f0000008000-0x4)={&(0x7f0000000000/0x2000)=nil, 0x2000}) getsockopt$sock_int(r0, 0x1, 0x17, &(0x7f0000633000), &(0x7f0000c53000-0x4)=0x4) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f00008a0000-0x20)={{&(0x7f00003d1000/0x4000)=nil, 0x4000}, 0x3}) 2018/02/10 14:10:07 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r0, r0, &(0x7f0000049000), 0x3d2) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000008000)={&(0x7f000000f000-0xc)={0x10, 0x34000}, 0xc, &(0x7f0000220000)={&(0x7f00008d6000-0x14)={0x14, 0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, {}, []}, 0x14}, 0x1}, 0x0) r1 = userfaultfd(0x80800) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000ff8000-0x20)={{&(0x7f0000012000/0x2000)=nil, 0x2000}, 0x1}) bpf$MAP_CREATE(0x0, &(0x7f0000fb4000)={0x2, 0x8000000000000004, 0x400, 0x7fd, 0x4, 0xffffffffffffffff}, 0x2c) userfaultfd(0x800) clock_gettime(0x0, &(0x7f0000132000)={0x0, 0x0}) socketpair(0x1d, 0x800, 0x4, &(0x7f0000589000)) r4 = syz_open_dev$mouse(&(0x7f00006eb000)='/dev/input/mouse#\x00', 0xde6e, 0x1) timer_settime(0x0, 0x1, &(0x7f000097e000)={{0x0, r3}, {r2, r3+10000000}}, &(0x7f0000939000)) fanotify_init(0x25, 0x802) r5 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000ef2000-0x1d)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f00002d8000-0xc)={0x0, 0x0}, &(0x7f0000d76000-0x4)=0xc) syz_open_procfs(r6, &(0x7f0000013000)='ns/cgroup\x00') openat$ion(0xffffffffffffff9c, &(0x7f0000dd5000)='/dev/ion\x00', 0x800, 0x0) pipe2(&(0x7f000058c000), 0x4800) setsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000e12000-0xe8)={{{@in6=@mcast1={0xff, 0x1, [], 0x1}, @in=@rand_addr, 0x2, 0xbd, 0x3, 0x20, 0xa, 0xa0, 0x80, 0xbf, 0x0, r7}, {0x0, 0x8, 0x0, 0x3, 0x6, 0x1fa8, 0x8, 0x20}, {0x1719, 0x7fff, 0x7ff, 0x7ff}, 0x1, 0x7, 0x0, 0x1, 0x1, 0x3}, {{@in=@broadcast=0xffffffff, 0x1, 0x7f}, 0xa, @in=@empty, 0xffffffffffffffff, 0x3, 0x0, 0xffffffffffffffbc, 0x20, 0x6, 0x2}}, 0xe8) openat$selinux_policy(0xffffffffffffff9c, &(0x7f000010e000-0x10)='/selinux/policy\x00', 0x0, 0x0) setsockopt$netlink_NETLINK_TX_RING(r5, 0x10e, 0x7, &(0x7f0000ab4000-0x10)={0x6, 0x7, 0x52, 0xfffffffffffffffc}, 0x10) 2018/02/10 14:10:07 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00007d2000+0x1c8)=0x20000524a) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000001000)='/dev/ptmx\x00', 0x2, 0x0) ioctl$TCXONC(r0, 0x540a, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) socket$l2tp(0x18, 0x1, 0x1) r1 = socket$inet(0x2, 0x2, 0x0) r2 = socket$l2tp(0x18, 0x1, 0x1) r3 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r3, &(0x7f00005fb000-0x2e)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x1, @multicast2=0xe0000002}, 0x4, 0x0, 0x2}}, 0x2e) perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) connect$l2tp(r2, &(0x7f0000e92000)=@pppol2tpv3={0x18, 0x1, {0x0, r1, {0x2, 0x1, @remote={0xac, 0x14, 0x0, 0xbb}}, 0x2, 0x0, 0x4}}, 0x2e) close(r1) write(r0, &(0x7f000001d000-0x2)="b6", 0x1) ioctl$TCXONC(r0, 0x540a, 0x1) 2018/02/10 14:10:07 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x1, 0x8010000400000084) getsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f00003e7000)={@local, 0x0}, &(0x7f00006de000-0x4)=0x14) setsockopt$inet6_mreq(r0, 0x29, 0x14, &(0x7f00009d8000)={@mcast2={0xff, 0x2, [], 0x1}, r1}, 0x14) bind$inet6(r0, &(0x7f00001c1000)={0xa, 0x0, 0x0, @empty}, 0x1c) sendto(r0, &(0x7f0000b08000)="41a826c385ba905b4b224b77613875afd2be57417fca9a", 0x17, 0x40, &(0x7f0000b21000-0x8)=@un=@abs={0x0, 0x0, 0x3}, 0x8) sendto$inet6(r0, &(0x7f00009f1000)='G', 0x1, 0x0, &(0x7f0000109000-0x1c)={0xa, 0x0, 0x0, @loopback={0x0, 0x1}}, 0x1c) setsockopt$inet_sctp6_SCTP_DELAYED_SACK(r0, 0x84, 0x10, &(0x7f00009c2000)=@sack_info={0x0, 0x9}, 0x158) 2018/02/10 14:10:07 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000a000)={0x34e, 0x0, &(0x7f00001e5000-0x8)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000006000-0x54)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000008000-0x30)={0x44, 0x0, &(0x7f0000d06000)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x38, 0x8, &(0x7f000000d000)=[@fda={0x66646185}, @flat={0x73682a85}], &(0x7f0000006000)=[0x20]}}], 0x0, 0x0, &(0x7f0000176000-0x1)}) [ 65.607877] binder: 10995:10998 Acquire 1 refcount change on invalid ref 0 ret -22 [ 65.615801] binder: 10995:10998 unknown command 0 [ 65.624964] binder: 10993:11000 unknown command 0 [ 65.630880] binder: 10993:11000 ioctl c0306201 2000a000 returned -22 [ 65.643772] binder: 10995:10998 ioctl c0306201 2000a000 returned -22 2018/02/10 14:10:07 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000a000)={0x34e, 0x0, &(0x7f00001e5000-0x8)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000006000-0x54)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000-0x30)={0x44, 0x0, &(0x7f0000d06000)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x38, 0x8, &(0x7f000000d000)=[@fda={0x66646185}, @flat={0x73682a85}], &(0x7f0000006000)=[0x20]}}], 0x0, 0x0, &(0x7f0000176000-0x1)}) [ 65.664285] can: request_module (can-proto-4) failed. 2018/02/10 14:10:07 executing program 4: mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) ioctl$KVM_GET_MSR_INDEX_LIST(r0, 0xc004ae02, &(0x7f0000001000-0x1c)={0x6, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) setsockopt$packet_rx_ring(r0, 0x107, 0x5, &(0x7f0000000000)=@req={0x4, 0x2, 0x800, 0x80}, 0x10) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) keyctl$dh_compute(0x17, &(0x7f00004cb000), &(0x7f0000dc6000-0x6f)=""/111, 0x6f, &(0x7f0000ed7000-0x2c)={&(0x7f00002e7000-0x40)={'cmac(tea-generic)\x00'}}) 2018/02/10 14:10:07 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r0, r0, &(0x7f0000049000), 0x3d2) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000008000)={&(0x7f000000f000-0xc)={0x10, 0x34000}, 0xc, &(0x7f0000220000)={&(0x7f00008d6000-0x14)={0x14, 0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, {}, []}, 0x14}, 0x1}, 0x0) r1 = userfaultfd(0x80800) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000ff8000-0x20)={{&(0x7f0000012000/0x2000)=nil, 0x2000}, 0x1}) bpf$MAP_CREATE(0x0, &(0x7f0000fb4000)={0x2, 0x8000000000000004, 0x400, 0x7fd, 0x4, 0xffffffffffffffff}, 0x2c) userfaultfd(0x800) clock_gettime(0x0, &(0x7f0000132000)={0x0, 0x0}) socketpair(0x1d, 0x800, 0x4, &(0x7f0000589000)) r4 = syz_open_dev$mouse(&(0x7f00006eb000)='/dev/input/mouse#\x00', 0xde6e, 0x1) timer_settime(0x0, 0x1, &(0x7f000097e000)={{0x0, r3}, {r2, r3+10000000}}, &(0x7f0000939000)) fanotify_init(0x25, 0x802) r5 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000ef2000-0x1d)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f00002d8000-0xc)={0x0, 0x0}, &(0x7f0000d76000-0x4)=0xc) syz_open_procfs(r6, &(0x7f0000013000)='ns/cgroup\x00') openat$ion(0xffffffffffffff9c, &(0x7f0000dd5000)='/dev/ion\x00', 0x800, 0x0) pipe2(&(0x7f000058c000), 0x4800) setsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000e12000-0xe8)={{{@in6=@mcast1={0xff, 0x1, [], 0x1}, @in=@rand_addr, 0x2, 0xbd, 0x3, 0x20, 0xa, 0xa0, 0x80, 0xbf, 0x0, r7}, {0x0, 0x8, 0x0, 0x3, 0x6, 0x1fa8, 0x8, 0x20}, {0x1719, 0x7fff, 0x7ff, 0x7ff}, 0x1, 0x7, 0x0, 0x1, 0x1, 0x3}, {{@in=@broadcast=0xffffffff, 0x1, 0x7f}, 0xa, @in=@empty, 0xffffffffffffffff, 0x3, 0x0, 0xffffffffffffffbc, 0x20, 0x6, 0x2}}, 0xe8) openat$selinux_policy(0xffffffffffffff9c, &(0x7f000010e000-0x10)='/selinux/policy\x00', 0x0, 0x0) setsockopt$netlink_NETLINK_TX_RING(r5, 0x10e, 0x7, &(0x7f0000ab4000-0x10)={0x6, 0x7, 0x52, 0xfffffffffffffffc}, 0x10) 2018/02/10 14:10:07 executing program 0: mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000001000-0x18)='/selinux/avc/hash_stats\x00', 0x0, 0x0) ioctl$TUNDETACHFILTER(r0, 0x400854d6, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r1 = socket$inet(0x2, 0x3, 0x2) ioctl$sock_proto_private(r1, 0x89e6, &(0x7f000047a000)="388d161c9100da8e6b1685fcf2cf08f9aa7b1ecf23b9c55f7add519fc11ebb2583c8e14384884d85337736ca5703d3c18a1f0070888a1d46cd227985f5839551fd2f034d2d8e7ebd3689d1bd6fc4ee1b3eccc4f458a90c56b817f401cb5c2cf0e6063aeccf28eb9c9dda9973f01c") setsockopt$inet_sctp_SCTP_EVENTS(r1, 0x84, 0xb, &(0x7f000056e000-0xb)={0x7, 0x0, 0x1, 0x573b, 0x80000000, 0x2, 0x5, 0x81, 0xea, 0x3f, 0xdd7}, 0xb) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r2 = timerfd_create(0x7, 0x0) read(r2, &(0x7f0000da2000)=""/8, 0x8) timerfd_settime(r2, 0x0, &(0x7f0000715000-0x20)={{0x0, 0x989680}, {0x0, 0x6}}, &(0x7f0000001000-0x20)) dup(r0) setsockopt$inet_opts(r1, 0x0, 0x4, &(0x7f00006ec000)="8907040000", 0x5) sendto$inet(r1, &(0x7f0000890000), 0x0, 0x0, &(0x7f0000970000-0x10)={0x2, 0xffffffffffffffff, @empty}, 0x10) [ 65.685740] binder: 11011:11014 unknown command 0 [ 65.701293] binder: 11011:11014 ioctl c0306201 2000a000 returned -22 [ 65.725080] binder: 11017:11021 unknown command 0 [ 65.745481] binder: 11017:11021 ioctl c0306201 2000a000 returned -22 [ 65.755548] binder: 11017:11024 transaction failed 29189/-22, size 56-8 line 2842 [ 65.790837] binder: undelivered TRANSACTION_ERROR: 29189 [ 65.808881] can: request_module (can-proto-4) failed. 2018/02/10 14:10:07 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000a000)={0x34e, 0x0, &(0x7f00001e5000-0x8)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000006000-0x54)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000008000-0x30)={0x44, 0x0, &(0x7f0000d06000)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x38, 0x8, &(0x7f000000d000)=[@fda={0x66646185}, @flat={0x73682a85}], &(0x7f0000006000)=[0x20]}}], 0x0, 0x0, &(0x7f0000176000-0x1)}) 2018/02/10 14:10:07 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$sock_SIOCGPGRP(0xffffffffffffff9c, 0x8904, &(0x7f0000bf9000-0x4)=0x0) sched_setaffinity(r0, 0x8, &(0x7f00000a5000-0x8)) mmap(&(0x7f0000000000/0x19000)=nil, 0x19000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r1 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000924000-0xc)='/dev/rfkill\x00', 0x0, 0x0) r2 = userfaultfd(0x0) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000e54000-0x18)={0xaa}) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000008000-0x20)={{&(0x7f0000000000/0x4000)=nil, 0x4000}, 0x1}) readv(r1, &(0x7f00001f3000-0x10)=[{&(0x7f0000002000-0x4e)=""/1, 0x1}], 0x1) ioctl$RNDADDTOENTCNT(r1, 0x40045201, &(0x7f0000b27000)) ioctl$RNDADDTOENTCNT(r1, 0x40045201, &(0x7f0000a81000)) ioctl$UFFDIO_UNREGISTER(r2, 0xc020aa04, &(0x7f0000008000-0x4)={&(0x7f0000000000/0x2000)=nil, 0x2000}) 2018/02/10 14:10:07 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00007d2000+0x1c8)=0x20000524a) r0 = syz_open_dev$sg(&(0x7f000057a000)='/dev/sg#\x00', 0xbe37, 0x0) ioctl$sock_inet6_tcp_SIOCOUTQ(r0, 0x5411, &(0x7f0000e92000-0x4)) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000413000-0xa)='/dev/ptmx\x00', 0x101000, 0x0) ioctl$TCXONC(r1, 0x540a, 0x0) write(r1, &(0x7f000001d000-0x2)="b6", 0x1) ioctl$TCXONC(r1, 0x540a, 0x1) 2018/02/10 14:10:07 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0xffff7fffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80, 0x0, 0x0, 0x2, 0x0, @perf_bp, 0x0, 0x0, 0x0, 0x80000000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$evdev(&(0x7f0000dda000-0x12)='/dev/input/event#\x00', 0x0, 0x0) ioctl$EVIOCGRAB(r0, 0x40044590, &(0x7f0000e95000-0x4)) ioctl$TIOCSBRK(0xffffffffffffffff, 0x40044591) request_key(&(0x7f0000102000)='big_key\x00', &(0x7f0000ad3000)={0x73, 0x79, 0x7a, 0x3}, &(0x7f00006cc000-0x40)='deflate\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', 0xffffffffffffffff) 2018/02/10 14:10:07 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f000000a000)={0x34e, 0x0, &(0x7f00001e5000-0x8)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000006000-0x54)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000008000-0x30)={0x44, 0x0, &(0x7f0000d06000)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x38, 0x8, &(0x7f000000d000)=[@fda={0x66646185}, @flat={0x73682a85}], &(0x7f0000006000)=[0x20]}}], 0x0, 0x0, &(0x7f0000176000-0x1)}) 2018/02/10 14:10:07 executing program 0: mmap(&(0x7f0000000000/0xb4a000)=nil, 0xb4a000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x2, 0x0) capset(&(0x7f0000000000)={0x19980330}, &(0x7f0000002000-0x18)) setsockopt$inet_opts(r0, 0x0, 0x4, &(0x7f000088f000)="8608006600", 0x5) pread64(r0, &(0x7f00008c9000)=""/76, 0x4c, 0x0) 2018/02/10 14:10:07 executing program 4: mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000001000-0x1e)='/selinux/commit_pending_bools\x00', 0x1, 0x0) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) getsockopt$SO_COOKIE(r0, 0x1, 0x39, &(0x7f0000000000), &(0x7f0000000000)=0x8) ioctl$KVM_ARM_SET_DEVICE_ADDR(r0, 0x4010aeab, &(0x7f0000001000-0x10)={0x6, 0xf002}) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) keyctl$dh_compute(0x17, &(0x7f00004cb000), &(0x7f0000dc6000-0x6f)=""/111, 0x6f, &(0x7f0000ed7000-0x2c)={&(0x7f00002e7000-0x40)={'cmac(tea-generic)\x00'}}) 2018/02/10 14:10:07 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r0, r0, &(0x7f0000049000), 0x3d2) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000008000)={&(0x7f000000f000-0xc)={0x10, 0x34000}, 0xc, &(0x7f0000220000)={&(0x7f00008d6000-0x14)={0x14, 0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, {}, []}, 0x14}, 0x1}, 0x0) r1 = userfaultfd(0x80800) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000ff8000-0x20)={{&(0x7f0000012000/0x2000)=nil, 0x2000}, 0x1}) bpf$MAP_CREATE(0x0, &(0x7f0000fb4000)={0x2, 0x8000000000000004, 0x400, 0x7fd, 0x4, 0xffffffffffffffff}, 0x2c) userfaultfd(0x800) clock_gettime(0x0, &(0x7f0000132000)={0x0, 0x0}) socketpair(0x1d, 0x800, 0x4, &(0x7f0000589000)) r4 = syz_open_dev$mouse(&(0x7f00006eb000)='/dev/input/mouse#\x00', 0xde6e, 0x1) timer_settime(0x0, 0x1, &(0x7f000097e000)={{0x0, r3}, {r2, r3+10000000}}, &(0x7f0000939000)) fanotify_init(0x25, 0x802) r5 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000ef2000-0x1d)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f00002d8000-0xc)={0x0, 0x0}, &(0x7f0000d76000-0x4)=0xc) syz_open_procfs(r6, &(0x7f0000013000)='ns/cgroup\x00') openat$ion(0xffffffffffffff9c, &(0x7f0000dd5000)='/dev/ion\x00', 0x800, 0x0) pipe2(&(0x7f000058c000), 0x4800) setsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000e12000-0xe8)={{{@in6=@mcast1={0xff, 0x1, [], 0x1}, @in=@rand_addr, 0x2, 0xbd, 0x3, 0x20, 0xa, 0xa0, 0x80, 0xbf, 0x0, r7}, {0x0, 0x8, 0x0, 0x3, 0x6, 0x1fa8, 0x8, 0x20}, {0x1719, 0x7fff, 0x7ff, 0x7ff}, 0x1, 0x7, 0x0, 0x1, 0x1, 0x3}, {{@in=@broadcast=0xffffffff, 0x1, 0x7f}, 0xa, @in=@empty, 0xffffffffffffffff, 0x3, 0x0, 0xffffffffffffffbc, 0x20, 0x6, 0x2}}, 0xe8) openat$selinux_policy(0xffffffffffffff9c, &(0x7f000010e000-0x10)='/selinux/policy\x00', 0x0, 0x0) setsockopt$netlink_NETLINK_TX_RING(r5, 0x10e, 0x7, &(0x7f0000ab4000-0x10)={0x6, 0x7, 0x52, 0xfffffffffffffffc}, 0x10) 2018/02/10 14:10:07 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f000000a000)={0x34e, 0x0, &(0x7f00001e5000-0x8)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000006000-0x54)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000008000-0x30)={0x44, 0x0, &(0x7f0000d06000)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x38, 0x8, &(0x7f000000d000)=[@fda={0x66646185}, @flat={0x73682a85}], &(0x7f0000006000)=[0x20]}}], 0x0, 0x0, &(0x7f0000176000-0x1)}) 2018/02/10 14:10:07 executing program 4: mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$SNDRV_SEQ_IOCTL_CLIENT_ID(0xffffffffffffffff, 0x80045301, &(0x7f0000000000)) fcntl$setflags(r0, 0x2, 0x1) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r1 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000668000-0x11)='/dev/qat_adf_ctl\x00', 0x40000, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_CLIENT_INFO(r1, 0xc0bc5310, &(0x7f0000e16000)) getsockopt$inet_sctp6_SCTP_MAX_BURST(r1, 0x84, 0x14, &(0x7f00007af000)=@assoc_value, &(0x7f0000426000-0x4)=0x371) keyctl$dh_compute(0x17, &(0x7f00004cb000), &(0x7f0000dc6000-0x6f)=""/111, 0x6f, &(0x7f0000ed7000-0x2c)={&(0x7f00002e7000-0x40)={'cmac(tea-generic)\x00'}}) 2018/02/10 14:10:07 executing program 0: pipe(&(0x7f0000d3f000-0x8)) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = fcntl$getown(0xffffffffffffffff, 0x9) perf_event_open(&(0x7f0000c68000-0x78)={0x2, 0x78, 0x3f, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, r0, 0x0, 0xffffffffffffffff, 0x0) 2018/02/10 14:10:07 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00007d2000+0x1c8)=0x20000524a) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000001000)='/dev/ptmx\x00', 0x2, 0x0) ioctl$TCXONC(r0, 0x540a, 0x0) write(r0, &(0x7f000001d000-0x2)="b6", 0x1) ioctl$TCXONC(r0, 0x540a, 0x1) [ 65.878347] binder: 11036:11046 unknown command 0 [ 65.889806] binder: 11036:11046 ioctl c0306201 2000a000 returned -22 [ 65.893328] can: request_module (can-proto-4) failed. 2018/02/10 14:10:08 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f000000a000)={0x34e, 0x0, &(0x7f00001e5000-0x8)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000006000-0x54)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000008000-0x30)={0x44, 0x0, &(0x7f0000d06000)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x38, 0x8, &(0x7f000000d000)=[@fda={0x66646185}, @flat={0x73682a85}], &(0x7f0000006000)=[0x20]}}], 0x0, 0x0, &(0x7f0000176000-0x1)}) 2018/02/10 14:10:08 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000a000)={0x34e, 0x0, &(0x7f00001e5000-0x8)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000006000-0x54)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000-0x30)={0x0, 0x0, &(0x7f0000d06000)=[], 0x0, 0x0, &(0x7f0000176000-0x1)}) [ 65.931493] QAT: Invalid ioctl 2018/02/10 14:10:08 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000a5000-0x8)) mmap(&(0x7f0000000000/0x19000)=nil, 0x19000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$adsp(&(0x7f000067e000-0xb)='/dev/adsp#\x00', 0x8, 0xa00) ioctl$sock_inet6_udp_SIOCOUTQ(r0, 0x5411, &(0x7f00004e5000-0x4)) r1 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000924000-0xc)='/dev/rfkill\x00', 0x0, 0x0) r2 = userfaultfd(0x0) setsockopt$inet_buf(r1, 0x0, 0x0, &(0x7f0000ece000-0x4e)="4380bae0897f6e80426608c307e6630ca11ced5e5098c110652292b66041d9f8bfab13a161e6e238d102a24a445f16b5c55a489f5ed38082d20a9897ed6e6cd92450a9a7e7ee8778e557ea177c2a", 0x4e) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000e54000-0x18)={0xaa}) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000008000-0x20)={{&(0x7f0000000000/0x4000)=nil, 0x4000}, 0x1}) readv(r1, &(0x7f00001f3000-0x10)=[{&(0x7f0000002000-0x4e)=""/1, 0x1}], 0x1) ioctl$RNDADDTOENTCNT(r1, 0x40045201, &(0x7f0000b27000)) ioctl$RNDADDTOENTCNT(r1, 0x40045201, &(0x7f0000a81000)) open_by_handle_at(r2, &(0x7f0000f85000-0x6d)={0x6d, 0x1000, "9d78cf7f4a2f966f9d952e5be01c5f1b41bc0d0c9fa1f60e65deae0aa24e5043e8ea79fcc75ddabacced9003b9c65b9f994f8e1030a68f678b33ed67b7ca3b3ffd6773f152aa638a02e1945f290afc35dafd1bbb643f101f51cf1ec92dcb4c7eb3c38ad6df"}, 0x101000) ioctl$UFFDIO_UNREGISTER(r2, 0xc020aa04, &(0x7f0000008000-0x4)={&(0x7f0000000000/0x2000)=nil, 0x2000}) 2018/02/10 14:10:08 executing program 4: unshare(0x800000) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$mixer(0xffffffffffffff9c, &(0x7f000045c000)='/dev/mixer\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x7, 0x7ff) epoll_ctl$EPOLL_CTL_MOD(r0, 0x3, r1, &(0x7f00007a2000-0xc)={0x1}) keyctl$dh_compute(0x17, &(0x7f00004cb000), &(0x7f0000dc6000-0x6f)=""/111, 0x6f, &(0x7f0000ed7000-0x2c)={&(0x7f00002e7000-0x40)={'cmac(tea-generic)\x00'}}) r2 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000a2b000)='/dev/rfkill\x00', 0x400000, 0x0) ioctl$EVIOCSABS3F(r2, 0x401845ff, &(0x7f0000a8b000-0x18)={0x2, 0x1, 0x8, 0x5, 0x8001, 0x3}) ioctl$sock_inet6_tcp_SIOCINQ(r1, 0x541b, &(0x7f0000466000-0x4)) ioctl$TIOCLINUX2(r2, 0x541c, &(0x7f0000211000)={0x2, 0x2e, 0x3, 0x0, 0x10001, 0xfffffffffffffffe}) 2018/02/10 14:10:08 executing program 6: r0 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000a000)={0x34e, 0x0, &(0x7f00001e5000-0x8)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000006000-0x54)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000-0x30)={0x44, 0x0, &(0x7f0000d06000)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x38, 0x8, &(0x7f000000d000)=[@fda={0x66646185}, @flat={0x73682a85}], &(0x7f0000006000)=[0x20]}}], 0x0, 0x0, &(0x7f0000176000-0x1)}) 2018/02/10 14:10:08 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000a000)={0x34e, 0x0, &(0x7f00001e5000-0x8)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000006000-0x54)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000-0x30)={0x0, 0x0, &(0x7f0000d06000)=[], 0x0, 0x0, &(0x7f0000176000-0x1)}) 2018/02/10 14:10:08 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r0, r0, &(0x7f0000049000), 0x3d2) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000008000)={&(0x7f000000f000-0xc)={0x10, 0x34000}, 0xc, &(0x7f0000220000)={&(0x7f00008d6000-0x14)={0x14, 0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, {}, []}, 0x14}, 0x1}, 0x0) r1 = userfaultfd(0x80800) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000ff8000-0x20)={{&(0x7f0000012000/0x2000)=nil, 0x2000}, 0x1}) bpf$MAP_CREATE(0x0, &(0x7f0000fb4000)={0x2, 0x8000000000000004, 0x400, 0x7fd, 0x4, 0xffffffffffffffff}, 0x2c) userfaultfd(0x800) clock_gettime(0x0, &(0x7f0000132000)={0x0, 0x0}) socketpair(0x1d, 0x800, 0x4, &(0x7f0000589000)) r4 = syz_open_dev$mouse(&(0x7f00006eb000)='/dev/input/mouse#\x00', 0xde6e, 0x1) timer_settime(0x0, 0x1, &(0x7f000097e000)={{0x0, r3}, {r2, r3+10000000}}, &(0x7f0000939000)) fanotify_init(0x25, 0x802) r5 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000ef2000-0x1d)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f00002d8000-0xc)={0x0, 0x0}, &(0x7f0000d76000-0x4)=0xc) syz_open_procfs(r6, &(0x7f0000013000)='ns/cgroup\x00') openat$ion(0xffffffffffffff9c, &(0x7f0000dd5000)='/dev/ion\x00', 0x800, 0x0) pipe2(&(0x7f000058c000), 0x4800) setsockopt$inet_IP_XFRM_POLICY(r4, 0x0, 0x11, &(0x7f0000e12000-0xe8)={{{@in6=@mcast1={0xff, 0x1, [], 0x1}, @in=@rand_addr, 0xffffffffffffffff, 0xbd, 0x3, 0x20, 0xa, 0xa0, 0x80, 0xbf, 0x0, r7}, {0x0, 0x8, 0x0, 0x3, 0x6, 0x1fa8, 0x8, 0x20}, {0x1719, 0x7fff, 0x7ff, 0x7ff}, 0x1, 0x7, 0x0, 0x1, 0x1, 0x3}, {{@in=@broadcast=0xffffffff, 0x1, 0x7f}, 0xa, @in=@empty, 0xffffffffffffffff, 0x3, 0x0, 0xffffffffffffffbc, 0x20, 0x6, 0x2}}, 0xe8) openat$selinux_policy(0xffffffffffffff9c, &(0x7f000010e000-0x10)='/selinux/policy\x00', 0x0, 0x0) setsockopt$netlink_NETLINK_TX_RING(r5, 0x10e, 0x7, &(0x7f0000ab4000-0x10)={0x6, 0x7, 0x52, 0xfffffffffffffffc}, 0x10) [ 65.961488] QAT: Invalid ioctl [ 65.962495] binder: 11066:11070 unknown command 0 [ 65.969839] binder: 11066:11070 ioctl c0306201 2000a000 returned -22 [ 66.045074] binder: 11083:11085 unknown command 0 [ 66.050920] binder: 11083:11085 ioctl c0306201 2000a000 returned -22 [ 66.071237] can: request_module (can-proto-4) failed. 2018/02/10 14:10:08 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00007d2000+0x1c8)=0x20000524a) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000001000)='/dev/ptmx\x00', 0x2, 0x0) ioctl$TCXONC(r0, 0x540a, 0x0) write(r0, &(0x7f000001d000-0x2)="b6", 0x1) ioctl$TCXONC(r0, 0x540a, 0x7) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000668000)) 2018/02/10 14:10:08 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000f8f000)='/selinux/commit_pending_bools\x00', 0x1, 0x0) r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f000027d000-0xf)='/dev/sequencer\x00', 0x88000, 0x0) ioctl$EVIOCGSW(r0, 0x8040451b, &(0x7f00005ad000-0x93)=""/147) r1 = syz_open_dev$evdev(&(0x7f0000dda000-0x12)='/dev/input/event#\x00', 0x2000000009fff, 0xfffffffffffffffe) ioctl$EVIOCGRAB(r1, 0x40044590, &(0x7f0000e95000-0x4)) syz_open_dev$sndpcmp(&(0x7f000093b000)='/dev/snd/pcmC#D#p\x00', 0x4, 0x2401) syz_open_dev$vcsn(&(0x7f0000f06000)='/dev/vcs#\x00', 0xffffffffffffd517, 0x0) openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f000004c000)='/selinux/avc/hash_stats\x00', 0x0, 0x0) openat$audio(0xffffffffffffff9c, &(0x7f0000cae000)='/dev/audio\x00', 0x404180, 0x0) r2 = syz_open_pts(0xffffffffffffff9c, 0x400000) ioctl$TIOCSBRK(r2, 0x40044591) request_key(&(0x7f0000102000)='big_key\x00', &(0x7f0000ad3000)={0x73, 0x79, 0x7a, 0x3}, &(0x7f00006cc000-0x40)='deflate\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', 0xffffffffffffffff) 2018/02/10 14:10:08 executing program 0: pipe(&(0x7f0000d3f000-0x8)) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = fcntl$getown(0xffffffffffffffff, 0x9) perf_event_open(&(0x7f0000c68000-0x78)={0x2, 0x78, 0x3f, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, r0, 0x0, 0xffffffffffffffff, 0x0) 2018/02/10 14:10:08 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = add_key(&(0x7f00002de000+0x175)='ceph\x00', &(0x7f000023d000)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000e21000-0x1000)="b6dd5b9abe6fb40c899acc1652dc5a91d41b1f5110b78c8cc362834bc029625e0665c060665cdf188dac44b6afb3979e26f5a28a9eb0698785163a20ffa26b42bd78ed4dd4c51ffbe87eee496ed2ba579201754b3481948809958ab68807994920927602df0e69105acb6b52dfb895ac771bd5142deb2d00f1278be53ff9fb5127a524b877fa3ad60ad69e07a084ba98663b37f2f329727923b68bd57499083a8ef0ae637d82e258089aeaf28e958ef3c11116518e34e204b0a41491d329e1e6034408539dd9bb91c0aa6370ca2169f4993ec50a4c40852bafdef372b0b151651c26aeaf19aa829c1562ee63e23a4c44e157c8e802bcbe44e693982f94a4757c08349799dca0b7a1300544c676b7e2263a2da28558969e58ea5a42f80839da9ebe8b800aa611f1e71d215be4986f69fd6327ad93b4da598525e6660d6e09e9baed219a0d24a61f0fad5eae2b5f13c5d140beda7c850a4018ce7825a9d8ff3163880ad86a085bf03931b7cf0e965bf0cb967599ec3c8ef38081429873f763c45aebec22f71cd19936e33ed8f10e72db02bcf98fa57b948ab6b928ad53fde625d9f3d7f86d2e69b9adf771825d1e175f46dc03171bc15a86af033ae0e3d949ca4c2b2555943dc704f3b1e89dc1a9c8ef9e430ef7d16bd9c48d875fa748b49300cd5a6972796b2b676f29fa6f4fdc0e123b7176135b9447adc79b316d300f99d93101210a3ad90cb42c350a459832d243c22a195378bdfcf36981defc366d220514aa3e96ab20ddfb02f1312e2a35b6e894af3f6db0467afb0ae7c20289ebed18db773ada05860a1cd9a09b79eab7079cad35309450048b3e958797aeb60e12647cae9b5999eb3917cab29a8f78853391067fa75be92194e8b49bb4038f37f9b9f73156d500481ba7812dc6f948268e02eb508d77c1a886581f4d1e5fd8937ab5997aaa47636a9b8f7334a8711b26b83eb8da68232cefc3f1c34281270a65b86080d85205f6292a6be17b6f8cbf9c6ff54168013983806ac7f61a3ccdddbba41a164368c76fcba5afcf64266648cd6e2c6708915c65a3dda48a25b5cfe4e9e448a12b1fd991de77a0b6628623fcc69e8c9b431873986fbb1064d14a9c18c113b94707326cf051788db414e44ec657d7169f526f48e2eca509abe0e4a3dedb861c05bb5def865ac917106cd526e4c33732fa334022ddc1454f026d39cb0d8e2d84a5e1ccca71f1bc2d6f9acc5e256ef1389eaa5021b12f8a920224f59297b260d14f91ffb201fa127c05d5f7989bffa1f61c1fdeea8adba1a0cc6793d367511049f00ceb9b9c68c795067dfb49beeb594bf5575526cc6eabb45deb5a51491b581bc6c2b3d32b88e0fc227a1290be655683f6f5723f42851dabec2313e2842361c9e02e8bf9565519a1ab34f32ddc4f97a7d60fd30d4203565b69f71279642ef2471f3e01ff8bce5c8a9cfca813edfb492a25a4433b9aeb6527a4f1426afd4590ebb8c098acb06074aec24c6f0c45e1b0b1fd56fe04d7ca16061514bb2d035a57a47109c4e9b30d531533a5503480edeec28e7bceb884ce0891b341da06357d9d69341c3d7bfbe97572840db3d1fee0d2f0aebe3545876ee525af4d9602cc477305e2dc40fb428f2b8c83345220c84e9bf4808ffeaff97cf51d63c7d7808489177c6e57f9e37094f77b4068e17d8b6eeebd7e20a13b9f27a75d1d9e2cb257d04fd5fa91b0ee1206857666f87bd2d77dad5e9a6e1d9cf5c0709497d67ea1c7b71e4db54dcb72875d2d9ed8b21c5b0813264d1a6ea54ca1dcad39eec993cbc15605302281573678de93c98f11682ea01c6caa2288612eef4ebf20cd1d23b279a55bc90278aa3a65c55646a2137e02076c3ad154bafa1c2c1a286ac9fe1a4cc7eafbc6f5651e6ecf7d7ae56b3b7b03fa7286bead02662a8c91b2dd3be974341d64368feeae546097fb6fbef33965d6ccd40a38ac4d8fd6eab7fada43cea9cc92119a1af7e12a269700fb9a39949b5d59a35e1357522523e7e798d66d68d731fb4f6aa0afdd7e850ac293068a39edbc44bcbb11b0ae79d7a5b6e3f9e97a33ee0cb9f3939f4beb132d5b5516f7eafc52204909ed804ab3621e9c99889a5c8b1285374efdf099201f97083c756a8e6f19a068ae3b6c9337554d29fefa066b8584ac185c165a050941b56972b4b7ea1351b61ba2fa8877a824a52492f1b5ea63b24af838326cd65c8db6cf4be29bdfade217cf2952bf74b7ecc08370436ab5f5022668361b00dfb3507146bcd39fbc2cf69c5f92d2d6c873607226d8e4dd7db5df31edbaa6fdae02f1f8e91c4edae3fc6130678e5b3431e9ef4cfc2213af36a4621b5dc0c3f945f93f365f65bc26b2daefad42c39771f6e602f0ad0611aef4c19eb7b148cf1c1c3bd9303afccb7bbe9c571eea11f91b7e96025312534747643f233ae125f02dee2975c01a2868069c4b31cfdea9a252d4907281128105638eecc89a944eebcac045f5f14a291cbced7c5361202ccf8cef49199b8c25a03d410ff3a2b8e51c926677a8e944a53f62e7e911f39bd6db37fb41a8695cc69052e39c6b2206f19c8c3866ba2a2b9af9e930bc3a30f856d2a18a73514d2664e2b91981759a361cdea08ae73f4aed2249f58611fe164cb55089a52c542c1f7fab9d3287ee4da18fb4532dffeb3e05ef68f546ac55fc9d98dc2f5fddf140b809e96cfd9576078c3191d4df6b4fb5a343c4262d39abce552f147df362265a5fca2ebb41ffa2daa909b9fd8f64b57f6b93714d29f8bc103e6ff6d28247c86be31837b4f0f2babc5479ffa770df2efdc3d04780ad3a0cf8451ad23dbcc5142dbbf46b37af68de4369f9a1837cfb28737dacba99feec456cf9a7a63ef0e32ddd89209785941e78a2ccc0dbad0b7453dc2f93afd92afe53af5ec996ca0c3d1c5ecd3d8eb996d6f6cae62e7627220e6e04bf72be7a4f35bdb42bf471e6409b8556c3b33555754342727ef5476cc1a90a598a9ccf71293222de48718972d8e0346948e728b57b0bbe1772620f5592e7e1be9fd33695b1843e09ef9c172cfb51a510d1f6a55259f8f74d34d005b28bec93c18b9ba5c919e0ad4531dff0068bcc2bd226e6ad7a1c305f1305712ff33043d46d163269ebe7379b016c7ce08270f0d6db584f70ef020929a9cae56da5d5743fb18731f21ab15123214aafae3190602b2a20d6807d250f5569b808131837fcfc7392771b1e119f162107016a97697febd5798e5baf5a9da4f6b5c8c4c379c91468d9559c5522eb3c63b4c5dc5a430dc8663076db13184e3835d54ef784f382fe378636442b04c7a6d57488804bb795908185c4d64d6617d0510217bf312c358ccf7fe06f22d2c8a4629e4d8136b6db44977e2ada10811dd5dac36404f0e980ca790e874a109f8cfe59ee4e9a0b963b503d852f261a321ca645fa8c295093b67cd0aacae0d50f9428efa407728f26dc3aba266e54be4b8f7ae3620f7f7bedcb1619f470db348b1b46acc955fad51f8570f3ecc1d09c72d5843d9121d00e825c2fdccbc045b69c5805c741a714cc82c6b4f8bb719df0b02759af52dc848d9ce016ce6ee4fdadb7d0deab98cc85067b5d565b3dc1325c1db479c02ac0fefafc1ffe5769eadb85a817ade266ab9b470a4134f780110a8c47dca890ddb46c4d39720b8b3677f7884e25467e4fa88cb44907afb92bf26df494e20b0fce150cfd46e0080d2e405dd539ac84c9f9a955af155a1216f0166503414b6b70237afb8dab09b8742a2e03050fd4cc33a45a2e102d05df97b69d40e0e79557e4876475bc1a053f10b043a97550efd0d1396c7369eb180c4083df2055195106a7e4ec7433383035c457f5e07df16d6dc255ec81575c22345f011d25573f4932b80fd9aa8dbc004310c723578120b1df74d9a94dcc5f276c00d370139eaf93a63a98465a9fb916883f93603ab7d15d6d8a8e43e2105ac8b23cb41b5e19dd16e4e31cc7bfb54a4fca6d8da7ac1a94b9b6e53c0b436fead3fb56a6d9dade8ed1c077c7d45070bb4af3bb29732bbbde6afef2408be5fdae649c2b62b7f51c97a48efe8663c1c3b0457b413147107e93aa03121139ac767c32b5829b89f0b872dea33a92be6ccf7829c2ec6b8c6c88ef7eaf1f3600d53e9a736fe8ea05421c534809a2829cde22922c3c65cefbc845a88d6acb6d08af2d52aa87c5d48691108d2041d3e8f89da09f78e88c20f302f21ebdb4a5f566222a0f7dc7b4ee3106619bc64831275adc6bd8269b43e64b2ec4e43da22007a9e441c80d3ec83fee3e899dc7f6d90103fae182dcf717cab3462233d8824a410ad6807bf3d1aeaee81e85474b41d09a0dbfd0db70e1a7ac904fea3424c2ad38179ddf3abb43b72f5e441eef18f748070d19c5cb19afc717ec9076369499021fdca0d2377042af2dc763dce3371a51cec51982ddc4330a105f65aced754f27cb0b6a3c2107a0b80263a42e330c6b2ed31033a9967b891e6d770f98cf1fc00ae52e067610ad2142fd7518b464970f8cd3a24d0eb1a6ffa65fe28d90419ac6594b0f51282941e568583bef5c28b39d39e17906f50d5bb7b505325bcbbd12ea3b7c3ea7b3fab28ed8a386f6433e8a2ed820f0f3ce34c8f1f1e2f236153567faed8b556a0a71b7be52e0272c155a3b222a847c66fe47081dee0ce9638e786e992f45746ce6f98f1c7bf6ea095f743a7f6736b53e0eb0b1b828a48e6610f3b40e97bc1c651bf210d0e2c4d2e88f3367ddd186e3a459df7ecb0adb86df65cfce8dd0f254d978ec381983372a8a3f09dcce3149797b5ae9c0b0d60f677f343951c2a895b1d5734a9000e8266f7943c3d2596cef8ac0b58cec742e60af7d38e8eaf2a839167f1d7c91d130f847569d6a909788de369fc2c004694ab52931f71f638a4f17b99ffc734dd2615e55ff2535d0984cbd0cd3016da48316b069ba82072cc6ae728ef08227c2dd533ff6ebcea9604c7cf9e80d20dcbc9ef9640f0ee6c2edaa64d9f52f8e42a4b0dcf7250f8a5e3f0a7c8a6a77fd36ae1d8c4da86dd4a2c407903234a9b8a8cecdf1759efaf0afba418228e3140c5ee11b3d6ef9dd281d29df75cd59e04e8c7865a75aaaef01d63ce635f198873d428d53b72df297cccdd687e47b6b256d661e470bf8190f7d2cc6a88ed4ec365c55e34fe3377e4dbd188c27103c1ff9f74eba6e5ebf2eedc6807b215db65581b0e42b37ad797659ae67857f91848c6afb70cfa4a38ca4cd6d51df32f9b552dc4b372c58e81c88bd8d320393b6647f09d63203b396121905152f39b55915303b7dc0a758e2c1c301ec9a85f763572749f5080e5d867a5497ed8f725a9abea53786feb1e14aca4e8ebbed6a6b31aa005f1ecdfeff9c6f7dc3737dd1797d072704e034414a10bf84b550242499558bdb92a13e1c1675c73c0595883ffde8093929b6136083d324d069b70299f5bec0d0960fbeedbabfc3653d1bb24c020066c12714167e69489991c02569d029718a5ca3f9f400e033de5a08f108f0000c60e1696c75840c54f45ca888ebc5f5ee0340d32feb715e46ce40ddc1f797f35ec67a2ea9a906e313ed253ee07b8e13dd791b7173c1b40dfc7f61058d154457067529e54a7a3cda80296c099d3cdeb0244e8fcbc88350af9012a7c8c76a0135dd30e0d9f297e3d9c3fe914e3f66f1e14a0aeaa4850ec18f7f513a06c4bef3f1e7ee18dcd5e17d3cbe35f88c7fd7821a94b13ec3b417cfe1da9121ecf94b85f2496849c21f223749b5c6a174e3d708219137a723782e07a3a965bea9ea21bd7156625fdcff", 0x1000, 0xfffffffffffffffe) r1 = add_key(&(0x7f0000972000)='rxrpc\x00', &(0x7f0000914000-0x5)={0x73, 0x79, 0x7a, 0x2}, 0x0, 0x0, r0) keyctl$dh_compute(0x17, &(0x7f00004cb000)={0x0, 0x0, r1}, &(0x7f0000dc6000-0x6f)=""/111, 0xfffffecd, &(0x7f0000d3a000-0x2c)={&(0x7f00002e7000-0x40)={'crc32c-generic\x00'}, 0x0}) r2 = syz_open_dev$sg(&(0x7f0000f7d000)='/dev/sg#\x00', 0x7, 0x14c36b1ee0b1df58) r3 = socket$pptp(0x18, 0x1, 0x2) ioctl$sock_kcm_SIOCKCMCLONE(r2, 0x89e2, &(0x7f00005a0000-0x4)={r3}) 2018/02/10 14:10:08 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000a000)={0x34e, 0x0, &(0x7f00001e5000-0x8)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000006000-0x54)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000-0x30)={0x0, 0x0, &(0x7f0000d06000)=[], 0x0, 0x0, &(0x7f0000176000-0x1)}) 2018/02/10 14:10:08 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r0, r0, &(0x7f0000049000), 0x3d2) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000008000)={&(0x7f000000f000-0xc)={0x10, 0x34000}, 0xc, &(0x7f0000220000)={&(0x7f00008d6000-0x14)={0x14, 0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, {}, []}, 0x14}, 0x1}, 0x0) r1 = userfaultfd(0x80800) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000ff8000-0x20)={{&(0x7f0000012000/0x2000)=nil, 0x2000}, 0x1}) bpf$MAP_CREATE(0x0, &(0x7f0000fb4000)={0x2, 0x8000000000000004, 0x400, 0x7fd, 0x4, 0xffffffffffffffff}, 0x2c) userfaultfd(0x800) clock_gettime(0x0, &(0x7f0000132000)={0x0, 0x0}) socketpair(0x1d, 0x800, 0x4, &(0x7f0000589000)) r4 = syz_open_dev$mouse(&(0x7f00006eb000)='/dev/input/mouse#\x00', 0xde6e, 0x1) timer_settime(0x0, 0x1, &(0x7f000097e000)={{0x0, r3}, {r2, r3+10000000}}, &(0x7f0000939000)) fanotify_init(0x25, 0x802) r5 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000ef2000-0x1d)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f00002d8000-0xc)={0x0, 0x0}, &(0x7f0000d76000-0x4)=0xc) syz_open_procfs(r6, &(0x7f0000013000)='ns/cgroup\x00') openat$ion(0xffffffffffffff9c, &(0x7f0000dd5000)='/dev/ion\x00', 0x800, 0x0) pipe2(&(0x7f000058c000), 0x4800) setsockopt$inet_IP_XFRM_POLICY(r4, 0x0, 0x11, &(0x7f0000e12000-0xe8)={{{@in6=@mcast1={0xff, 0x1, [], 0x1}, @in=@rand_addr, 0xffffffffffffffff, 0xbd, 0x3, 0x20, 0xa, 0xa0, 0x80, 0xbf, 0x0, r7}, {0x0, 0x8, 0x0, 0x3, 0x6, 0x1fa8, 0x8, 0x20}, {0x1719, 0x7fff, 0x7ff, 0x7ff}, 0x1, 0x7, 0x0, 0x1, 0x1, 0x3}, {{@in=@broadcast=0xffffffff, 0x1, 0x7f}, 0xa, @in=@empty, 0xffffffffffffffff, 0x3, 0x0, 0xffffffffffffffbc, 0x20, 0x6, 0x2}}, 0xe8) openat$selinux_policy(0xffffffffffffff9c, &(0x7f000010e000-0x10)='/selinux/policy\x00', 0x0, 0x0) setsockopt$netlink_NETLINK_TX_RING(r5, 0x10e, 0x7, &(0x7f0000ab4000-0x10)={0x6, 0x7, 0x52, 0xfffffffffffffffc}, 0x10) 2018/02/10 14:10:08 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000a5000-0x8)) mmap(&(0x7f0000000000/0x19000)=nil, 0x19000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$rfkill(0xffffffffffffff9c, &(0x7f000056f000-0xc)='/dev/rfkill\x00', 0xfffffffffffffffa, 0x0) r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000e54000-0x18)={0xaa}) setsockopt$inet_sctp6_SCTP_ADAPTATION_LAYER(r0, 0x84, 0x7, &(0x7f0000101000-0x4)={0x200}, 0x4) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000008000-0x20)={{&(0x7f0000000000/0x4000)=nil, 0x4000}, 0x1}) socketpair$ipx(0x4, 0x2, 0x0, &(0x7f000084d000-0x8)) readv(r0, &(0x7f00001f3000-0x10)=[{&(0x7f0000002000-0x4e)=""/1, 0x1}], 0x1) r2 = add_key$keyring(&(0x7f00008da000-0x8)='keyring\x00', &(0x7f0000ccd000)={0x73, 0x79, 0x7a, 0x3}, 0x0, 0x0, 0xfffffffffffffff9) r3 = request_key(&(0x7f000079f000-0xd)='dns_resolver\x00', &(0x7f00008d1000)={0x73, 0x79, 0x7a, 0x3}, &(0x7f000040e000)='vboxnet0\x00', 0xfffffffffffffff9) keyctl$instantiate_iov(0x14, r2, &(0x7f00005fb000)=[{&(0x7f0000699000)="88b6f2aa53630867a39b2d2910f8", 0xe}], 0x1, r3) ioctl$RNDADDTOENTCNT(r0, 0x40045201, &(0x7f0000b27000)) ioctl$RNDADDTOENTCNT(r0, 0x40045201, &(0x7f0000a81000)) ioctl$UFFDIO_UNREGISTER(r1, 0xc020aa04, &(0x7f0000008000-0x4)={&(0x7f0000000000/0x2000)=nil, 0x2000}) 2018/02/10 14:10:08 executing program 6: r0 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000a000)={0x34e, 0x0, &(0x7f00001e5000-0x8)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000006000-0x54)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000-0x30)={0x44, 0x0, &(0x7f0000d06000)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x38, 0x8, &(0x7f000000d000)=[@fda={0x66646185}, @flat={0x73682a85}], &(0x7f0000006000)=[0x20]}}], 0x0, 0x0, &(0x7f0000176000-0x1)}) 2018/02/10 14:10:08 executing program 6: r0 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000a000)={0x34e, 0x0, &(0x7f00001e5000-0x8)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000006000-0x54)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000-0x30)={0x44, 0x0, &(0x7f0000d06000)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x38, 0x8, &(0x7f000000d000)=[@fda={0x66646185}, @flat={0x73682a85}], &(0x7f0000006000)=[0x20]}}], 0x0, 0x0, &(0x7f0000176000-0x1)}) 2018/02/10 14:10:08 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f00004d8000-0x78)={0x0, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = open(&(0x7f000000d000-0x8)='./file0\x00', 0x80040, 0x0) fcntl$setlease(r0, 0x400, 0x0) chown(&(0x7f0000e89000)='./file0\x00', 0x0, 0x0) [ 66.151045] binder: 11095:11102 unknown command 0 [ 66.163531] binder: 11095:11102 ioctl c0306201 2000a000 returned -22 2018/02/10 14:10:08 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$amidi(&(0x7f0000dea000)='/dev/amidi#\x00', 0x8001, 0x200000) ioctl$PIO_FONT(r0, 0x4b61, &(0x7f0000b0c000-0x1000)="b50f8033400a99123a437681f2ef4d58432d481ed1184c321107aecd3fab69fbebd70dc1b8a6c8ba210eae3dbddc27141d61c304760158b301146b3bef172ed3639d28d2719a964c68c147d39a39e93664e46d841184eb20acd334e60e6064e054911171fd29d827ac064198f1eb57cfbb884e97a08b9b88b1456f08f5abe96d4a3e85767358134da48620c8630365dd5f097bd0e68d8afae070b8fd634fae1ffcdf3c57c87120f523d6cd5bcecbb7a31c8c6136c27224e31f87e9646c67ab446f1920c87dac54e50da348ae1b766e4f7f1be9ac15ae80ba025b3a7e1158ca8c7d8481c0ef06ebbe71cafa579c9346c9d083dab802fa7684ab03d819e523f94043fdc9d88f6ea398f7be88536ae2e1b7eab3f8896c6ac1ad72be169a525ba750f238eb08ee68270b1fcbc771327dc71b47edd77383e0badf398b5747cf7d0190e546d34e6119fa4db3e1484a95f70836c364aa89b4db070cd174153c2f43c2d5fc5ad271c4e4b4d7910b190227ec215c7847f0d7ec2bd2812e8f192ebe30ccd25dce65c8b211ff5c3dbf42ee6afb38feb2a245fb9f59a28d897f064a346ca1a2bc0f2eca5fb2550e4a9000cba42c17182031bc6c38a263b7d8fd99cbec1d0b1d95fdd76b2066f832a5af063b9f722c693861000fe15a8235624a617da6a7f646d19ab09aebd8629789e336cc9ffe51161270cde90ab2260ef6ba7fc0f811761dd1f114115f2572a48c4fac3dd88f0e1afdb4532c386c6de95a2b8566d52aeea206d8236f8328bb3b9d2581e0a9f16ec09f082892d6dfdbf26807ea96447d7cd178f8c9cd08d34a73a693ecc5f0eb9c660432faaf51baf4a25f400f2595c4a2be464397eb934eee425047f6072b7c9b06024478a4891117c5de40d859ae90e70d348609a87eb4e6f490dccdd60be544e93421d2dcc90bc50070a8fb320598ce9b9cda75b79536a60b4fd152a1841ea305862a933f4f4bd201e17f770f2b090d6baa31a3b99510ca0fbd19958ab744ecc6a6e49577f7bbefaa7814b8fce689e076a8bed87468f5a826bc8313c4800c8555504d6b962775d3430842e1991c4d1d4ef54fc7965a2ba749e4c3164e8cafb592a93227d7848409922b75b418a583d37e331e7dd1d88c517b8da2d9a0dd43796ebeef84391d03e2bd96d8a39339737eeb4420c91898c29d4dbd625e87298a474d5453b1cbc77f58f5767eadd2e8ea2bdf64ce0b8a1df553eb60e7947907777c8c713fcd045554fb610066e14963d2cc8d3fee4d670cb01d3691a5b20ad776ac2ffb0cf98c8838941f80e7249d540d752a30077034f6c45979e2b9f2912a0ecf92ff466329929d437780640d81e447f39f5f599b58240322640cfb829efb4d6685b39a098fe56891f89fd74854ba83164a940bac4889f6172c69bb0222f71e879218edb978cd0b8332a6c3cd483122ae42647e18ca497c831ed3080d85c633663d80b2bb0038bde27f467e8f036b97cd4a90809d483e7db7ae4132b0538bd1ec0ce0342d5e2c5ac2b4c6ef1f8048d48a4a096e8a70117f9b6ca1cda543928a89915b1109d3cabfd094083c235798a0a7183e696511f13a23e44523bc8561f6052993b8fa43f68bdfad16e54e69a3f619826595ae502d108f998682478a3bd1936c9667812346e8a3853e7c3cf68853472528c4d9025fd2ac3bb36cac1588f0747a5c2bb6c1eeea67b8b9f1de8855cdcc15d59732f77781df93bf776c39fe7f4df6e3d7fd246a3bc901a4e555312fe25a9a0bbc428744cc5d21d56dad5439ff6d4a6b67e876544ef788d464ee08bbc6ba246d8ea44eaf7416d203f8645266d427356cf8be67161c7e649d4b17398fd39e106f236c511002cda099dc094747585e732f26f794032d272fc2fa2e97dc6b4895cab8a89654d4817e38d9b3a08dce29da987405b1e5e5c2a3af8267c190afd97fe023a864ff7108b5571e8baf074d32504b6641e995facd4f59f93b620835753947118ad3cf48076c4ff0862cad1d64d872eacecb5410ce26722a1680febabdd78c5f7f1ae5e43660e89c036580cfa09c78d990a181b7c822ba613f95ffb4d0d84867b5d3b741d6c7a04d6be5ffd2593e54a29b874b73e2e0faa0c0cf0bcb0d8ce5313f0ad587725ba656ef2ca7dc1255a70549cbc0d8ecdd09fa0a0261af2a9d52dc9bde3badc7d941c7f618178a58b96bd0b737ecf2ec9637107a48995a74868e0850e26b38808b6020e91386f55852aa79b252baa2fb6d77e130c3ca5ea2f37fdb6e818b1b5991ebc51c26b564fe6183833176a1d70628420621e5c23c108e59b03e4e2e680396acbc082df5f6ed59319c24e021e2f14f33e721f747d498c3d1e9ae7f674da90f810a4dc733f541556d756fb62e91fccd5b6f70ce0037686d47fd5ae04af07c70f4176ea90b874b19e996334ad9b6783f9d0cf39b0528e8df06ddeb81dca49b0d4577e6a08c04dd639143abab5f96efecadefb70fdb1955bfd302f3c898db0c6963412bfca19e37a3f4665485f3780db0d7e24d787fee013a1a8007a99d6c14a04ab60f93f2d52986c8089d8ac8a26581cb204f4be5e3a02e509dc82fb8cb86ab0da34a78c8e750585e8c2dba1e35392570b55119f6e190640fed01f71e17c4d1da25366ac338a90e5a6752c2cf82a42ef6d9ced8ed6f896bef27d2e0eab8a90a20a65887baea717d861717556aaccca0e1c4f6980094075d7d9ded35e3ef828a2b3c2f694fa548c7e9c97eb2ac8f7d6b09b0a22a337b8a0c0e150cc38bb01034a60f10fe9c2a1200e14cae3fc50d932cf35bd9ff58e4062c3d91fa32bce16cd05e28bbfae93879334647c7817ca9f4f50681d9efd6013d25741b167af366023fdc331b642c40f2c8a9a1ce48d867027f947ac229b75f76c30374803a6929d8f54dda48ce48208b7914aa228860668fce01894b0f47c2ae71ee7edc55cc9e6a06cf36054f1e3f21f5d0ec2513a29aab804bce725643d67435899d9702429090e07c5fe1f8f50837386a58b8c2d00bf4cdcbe527971aedd5fbeaf6458d70975ce6f5ecf2e5624529f53ca65fbed2d64fe01b9aeff2e12e710085d7fa838eeb382cc1cbd77c8e59e6b1d730efa8d7df5cfa6c5c00f9c7f298c8a3584a09cd0620683126d6578f31dc0d903f8cad9b92d8523ac7f5d33aadb86bb0209bdda7c8a440e9fc88cef6463e38c861721c14ad319fb87f2003cf81fb4a1cf4c62ece26b9750053490de41857ab9be4d2450cf0335eaf4d021c9b94ad39c50381193855d7f6970223cdb102785f5936be59f0e269760141764ef630009156ff2cff2dfc73d546e729d81425263fb499293bebbb8b17f58645e16973fef4f7c4b4bdefaf040fc276cb14f57b7a689bdd238a7b4f4168c2cad861e7f64251b87101562fe4ab3e83db781a6c43749e0488800e30d61827064538d8c902747a9204d6188a58815d846513b8da3287cf8db29218b8c711a8e212e4cd5e1fbef59fd9270ebf9bb13720a2c7c4327000f330f61b198c71341742fffec3c7189dcb35621f7666449cf9f9934fafbdab2a3f82c875068a74698504df948863fda4bcd6b696550b97385ddce7e96fa91849e5149aa773bd4b92c225a27d7c886f2465c1a7a85df61d25d96ebf4b9f46ae958f8673434626cc81ca5170017cb2b82eb5f054697a3b5db2c79ebd3c5f86706446d91d80a8a822f27a571fd6ffd9514b9b5acb141da2eefb684b11ea72215b3ba896c60c8d24f22e988984a082736b3e7ddc1c188db454458e420b982082726f56fcdbfa62bcbeb3adc8cfeac0dd1ab5621ce0dd4dad9adce75e0c955617eaf84566b71879b336d9cd2cf7bb578e4e67106d24b5d4a849a88e08c30adad69557284d579bf71ab4697d1c483ae1b2076bebe976848bb1e8572a0334e56109f10dd9729521f24db525b893e98631de2facaf177c4b03f2c2a12a51dc5c22e249af7cecc65e6e356892a4b9dde1b06241e0ec3d5ea47479deb4c3e9fcfa0dae657db4a44d5543f0ce6f60a16393864cff1945b02151ea0fca0c6bc6d93ff7c3f1f0f71762707e276cfc6b47bec00ce082bb813b9f4c4ece6297f2cea02dbb1830fde6802c11210ed54caab64e2e8607cf9400ab17df44e2fce8c59aac515185ecca98b49a75096f1dca47d0b8598f508304c65528da285e3094f994f1a7fee504596afc461cc80938b2d26ea4edfec916dfef091b750828b7459b43f70bb0d209b603ee90af3024eab16b58e025f1d018e70f994faecadcc6f3ed589463a62526a66f736a84b461c9105d703c0cae647d6ba0de49aeab4ace12aa1da7a1606366fe3962a99404cb036a833c35aaba41a03f4e5514d51e09e69fb34781a11321633511e2597830e6aef5f6c3e7c0c2254b31b317c4c4bb888dc869f4f1135132773f9b0e2628db5f7950114a5b62a2f467adc7adadb87b1660c9d952302e69242a68cf1be2130a996024bd944c1cb62b3d96be8d288a073e33afbb6901ed74349c5f1b74ee5e061164c73a369b28040ab4a1bbed1e15b06622e469040c18e0ffb5c9dde4d6d0834a51abeb196bf1815031a0b4361063beb604a1fde459160f5905be75b616a899fa574fce1fe47a7f1c1186931f061e63856979f476f000a864406fe3eb94b16b898f73bbbc435441c1da89c25050b8324f3db16e6a059324995cc2d258f6c261e1249b3ea1d9fe30aecb766c5d187e3d4d749273474710804f98c88da6f00cefd27364bbfb8162541b8d4e1f8767e429193dd9f92ba949c9b33325a44939b61170ae455c527a22f280de2656185a2a1a9e00a4a1eea67d44eca3e49a8d0b1bede3a80483b633e091ab0516a62dc0578ce84e240eb98f59ca1ba8f13a0be36c7ad6ad94511efd883a744ee20f3dc5d96ed11ecf8d147692ebf5fbabb81e5d9c3d1c638d2c27c518f863ba36057d31249fe5e243798b462709b24d1720e04731729403ae574c12e01edeee056a8d955b8b96e21de97b7136006be6aa3b2e95108d814fb149acd080512b6807c50bc5bd109c1d8908ad64423a451b4486086d19c16a0110201357035c3b784cccedcdfeeb1926bfdf36ad8ad03965ce65fd0d49a328fedfea536d39e09936a862dc54bae8b5c660bc4f5f28877ac1fcc1890b1b45f3299b49363857ad471fd303eef7e401e083586303f4da85587f188900ad5ef51e0884e1d79860bfe52bf239ae622a25d4835b4c04584702f4e016f9ffa6f13d3bde44e7f579517f164d5c09ffd09ef5079e168842324ebab1b3eaf03565a139e7212f1ae976188753a3c25966d6d9b29de63ce05c562f3c22cb8952e8903bbe000a9fd8c6a8fc5247480ca5496b4e6fa644bf18593a8615ba3d097a59eb9b6cef5d1c5385a37540b40da29759434576b066b8b555c5b07f06f446eb9bdc4907614709a3749fe5936be6d07b976c2cd0c60bfff4792a665d62faee02e29567f94268f5dfc4b12ca6e2c0f8ee6c1b71ce0ca1f255db54159d21081993f78dbf447829821d00a4a0ea6204834d11413e6a83a598054fc95df1090af12cfab058c6257bc2fa3d01248950cfeb75a27febab6ab07ccc28e719b057aeb8982abb51fd98383e57cd66ac628f42009d61e3d00a7b14d870903e4304b23cf2a542b5e10fa34dfa69036425ce98d809024a5f803f398bc31dc067bb052b373d4f6581c4bd5ba269f3133de7db423972b7123f1d230c24185967207318fb38831888b6e5251d3a95de15e174fa639d4d463f335a6c8abfea30c9188f6b3b60c5c0f4f58062da3e92e07b6ebd143a3cfac3") keyctl$dh_compute(0x17, &(0x7f00004cb000), &(0x7f0000dc6000-0x6f)=""/111, 0x6f, &(0x7f0000ed7000-0x2c)={&(0x7f00002e7000-0x40)={'cmac(tea-generic)\x00'}}) 2018/02/10 14:10:08 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000a000)={0x34e, 0x0, &(0x7f00001e5000-0x8)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000006000-0x54)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000-0x30)={0x44, 0x0, &(0x7f0000d06000)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f000000d000)=[@flat={0x73682a85}], &(0x7f0000006000)=[0x20]}}], 0x0, 0x0, &(0x7f0000176000-0x1)}) [ 66.195308] can: request_module (can-proto-4) failed. [ 66.223240] binder: 11120:11122 unknown command 0 [ 66.235200] binder: 11120:11122 ioctl c0306201 2000a000 returned -22 [ 66.262635] binder: 11120:11127 got transaction with invalid offset (32, min 0 max 24) or object. [ 66.271934] binder: 11120:11127 transaction failed 29201/-22, size 24-8 line 3020 [ 66.286879] binder: undelivered TRANSACTION_ERROR: 29201 2018/02/10 14:10:08 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x0, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000a000)={0x34e, 0x0, &(0x7f00001e5000-0x8)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000006000-0x54)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000-0x30)={0x44, 0x0, &(0x7f0000d06000)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x38, 0x8, &(0x7f000000d000)=[@fda={0x66646185}, @flat={0x73682a85}], &(0x7f0000006000)=[0x20]}}], 0x0, 0x0, &(0x7f0000176000-0x1)}) 2018/02/10 14:10:08 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00007d2000+0x1c8)=0x20000524a) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000001000)='/dev/ptmx\x00', 0x2, 0x0) r1 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000a3c000)='/dev/rfkill\x00', 0x802, 0x0) getsockopt$inet_sctp6_SCTP_I_WANT_MAPPED_V4_ADDR(r1, 0x84, 0xc, &(0x7f0000de7000), &(0x7f0000e9b000)=0x4) ioctl$TCXONC(r0, 0x540a, 0x0) write(r0, &(0x7f000001d000-0x2)="b6", 0x1) ioctl$TCXONC(r1, 0x540a, 0xffffffffffffffff) 2018/02/10 14:10:08 executing program 0: mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$vcsa(&(0x7f0000001000-0xb)='/dev/vcsa#\x00', 0x9901, 0x40000) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f0000001000-0x8c)={0x0, @in={{0x2, 0x0, @local={0xac, 0x14, 0x0, 0xaa}}}}, &(0x7f0000001000-0x4)=0x8c) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) setsockopt$inet_sctp6_SCTP_AUTH_DELETE_KEY(r0, 0x84, 0x19, &(0x7f0000001000-0x6)={r1, 0x100000001}, 0x6) poll(&(0x7f00005d5000)=[], 0x20000091, 0x0) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffffff, 0x89e2, &(0x7f0000001000-0x4)={0xffffffffffffff9c}) sendto$packet(r2, &(0x7f0000693000)="070fced1ba722833cd9d62bd2e775b3ba6b8ee8b611b41f68c42b244885371ef4e49e1d1a715ed2ef76aa66327da3d54645b0ef9ed0d339eb696c96dd0fdc0b3b5f69f61cc568ab996ae4b306d2255ede881fb23050bf002b3274535a79d3017ee006ea91da54cc1e41bc78a9851ca99985bfd44c429df0391c0156be95df195b51409ea0326dc739f1f8db76d0def8dc1212049606a0756e811f352aefa064a6ba6561566", 0xa5, 0x40000, 0x0, 0x0) 2018/02/10 14:10:08 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r0, r0, &(0x7f0000049000), 0x3d2) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000008000)={&(0x7f000000f000-0xc)={0x10, 0x34000}, 0xc, &(0x7f0000220000)={&(0x7f00008d6000-0x14)={0x14, 0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, {}, []}, 0x14}, 0x1}, 0x0) r1 = userfaultfd(0x80800) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000ff8000-0x20)={{&(0x7f0000012000/0x2000)=nil, 0x2000}, 0x1}) bpf$MAP_CREATE(0x0, &(0x7f0000fb4000)={0x2, 0x8000000000000004, 0x400, 0x7fd, 0x4, 0xffffffffffffffff}, 0x2c) userfaultfd(0x800) clock_gettime(0x0, &(0x7f0000132000)={0x0, 0x0}) socketpair(0x1d, 0x800, 0x4, &(0x7f0000589000)) r4 = syz_open_dev$mouse(&(0x7f00006eb000)='/dev/input/mouse#\x00', 0xde6e, 0x1) timer_settime(0x0, 0x1, &(0x7f000097e000)={{0x0, r3}, {r2, r3+10000000}}, &(0x7f0000939000)) fanotify_init(0x25, 0x802) r5 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000ef2000-0x1d)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f00002d8000-0xc)={0x0, 0x0}, &(0x7f0000d76000-0x4)=0xc) syz_open_procfs(r6, &(0x7f0000013000)='ns/cgroup\x00') openat$ion(0xffffffffffffff9c, &(0x7f0000dd5000)='/dev/ion\x00', 0x800, 0x0) pipe2(&(0x7f000058c000), 0x4800) setsockopt$inet_IP_XFRM_POLICY(r4, 0x0, 0x11, &(0x7f0000e12000-0xe8)={{{@in6=@mcast1={0xff, 0x1, [], 0x1}, @in=@rand_addr, 0xffffffffffffffff, 0xbd, 0x3, 0x20, 0xa, 0xa0, 0x80, 0xbf, 0x0, r7}, {0x0, 0x8, 0x0, 0x3, 0x6, 0x1fa8, 0x8, 0x20}, {0x1719, 0x7fff, 0x7ff, 0x7ff}, 0x1, 0x7, 0x0, 0x1, 0x1, 0x3}, {{@in=@broadcast=0xffffffff, 0x1, 0x7f}, 0xa, @in=@empty, 0xffffffffffffffff, 0x3, 0x0, 0xffffffffffffffbc, 0x20, 0x6, 0x2}}, 0xe8) openat$selinux_policy(0xffffffffffffff9c, &(0x7f000010e000-0x10)='/selinux/policy\x00', 0x0, 0x0) setsockopt$netlink_NETLINK_TX_RING(r5, 0x10e, 0x7, &(0x7f0000ab4000-0x10)={0x6, 0x7, 0x52, 0xfffffffffffffffc}, 0x10) 2018/02/10 14:10:08 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) 2018/02/10 14:10:08 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000a5000-0x8)) mmap(&(0x7f0000000000/0x19000)=nil, 0x19000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000924000-0xc)='/dev/rfkill\x00', 0x0, 0x0) r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000e54000-0x18)={0xaa}) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000008000-0x20)={{&(0x7f0000000000/0x4000)=nil, 0x4000}, 0x1}) readv(r0, &(0x7f00001f3000-0x10)=[{&(0x7f0000002000-0x4e)=""/1, 0x1}], 0x1) ioctl$RNDADDTOENTCNT(r0, 0x40045201, &(0x7f0000b27000)) ioctl$RNDADDTOENTCNT(r0, 0x40045201, &(0x7f0000a81000)) ioctl$UFFDIO_UNREGISTER(r1, 0xc020aa04, &(0x7f0000008000-0x4)={&(0x7f0000000000/0x2000)=nil, 0x2000}) 2018/02/10 14:10:08 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000588000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x4003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x0, 0x4}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$evdev(&(0x7f0000dda000-0x12)='/dev/input/event#\x00', 0x0, 0x0) ioctl$EVIOCGRAB(r0, 0x40044590, &(0x7f0000e95000-0x4)) ioctl$EVIOCSKEYCODE_V2(r0, 0x40284504, &(0x7f0000b44000)={0x4, 0x1b, 0x852, 0x319c857e, "b10d3ee382403740a3918ee6fd843c99926f6330d2cc704eaaf4cfa4445975e4"}) r1 = syz_open_procfs(0x0, &(0x7f0000b34000-0x7)='timers\x00') fadvise64(r1, 0x0, 0x0, 0x0) ioctl$TIOCSBRK(r1, 0x40044591) request_key(&(0x7f0000102000)='big_key\x00', &(0x7f0000ad3000)={0x73, 0x79, 0x7a, 0x3}, &(0x7f00006cc000-0x40)='deflate\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', 0xffffffffffffffff) 2018/02/10 14:10:08 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000a000)={0x34e, 0x0, &(0x7f00001e5000-0x8)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000006000-0x54)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000-0x30)={0x44, 0x0, &(0x7f0000d06000)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f000000d000)=[@flat={0x73682a85}], &(0x7f0000006000)=[0x20]}}], 0x0, 0x0, &(0x7f0000176000-0x1)}) 2018/02/10 14:10:08 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x0, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000a000)={0x34e, 0x0, &(0x7f00001e5000-0x8)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000006000-0x54)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000-0x30)={0x44, 0x0, &(0x7f0000d06000)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x38, 0x8, &(0x7f000000d000)=[@fda={0x66646185}, @flat={0x73682a85}], &(0x7f0000006000)=[0x20]}}], 0x0, 0x0, &(0x7f0000176000-0x1)}) 2018/02/10 14:10:08 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) keyctl$dh_compute(0x17, &(0x7f00004cb000), &(0x7f0000092000)=""/111, 0x6f, &(0x7f0000ed7000-0x2c)={&(0x7f00003a1000)={'cmac(tea-generic)\x00'}}) openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f000036d000-0x1e)='/selinux/commit_pending_bools\x00', 0x1, 0x0) socketpair$inet_tcp(0x2, 0x1, 0x0, &(0x7f0000e2e000-0x8)={0x0}) fsync(r0) 2018/02/10 14:10:08 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x0, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000a000)={0x34e, 0x0, &(0x7f00001e5000-0x8)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000006000-0x54)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000-0x30)={0x44, 0x0, &(0x7f0000d06000)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x38, 0x8, &(0x7f000000d000)=[@fda={0x66646185}, @flat={0x73682a85}], &(0x7f0000006000)=[0x20]}}], 0x0, 0x0, &(0x7f0000176000-0x1)}) 2018/02/10 14:10:08 executing program 0: r0 = socket$inet(0x2, 0x3, 0x5) setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x485, &(0x7f0000c79000)=@raw={'raw\x00', 0x9, 0x4, 0x230, 0x0, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x0, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x4, &(0x7f0000002000), {[{{@ip={@local={0xac, 0x14, 0xffffffffffffffff, 0xaa}, @local={0xac, 0x14, 0xffffffffffffffff, 0xaa}, 0xffffff00, 0x0, @generic="10ad22fa72be7d01dd9c88e65e811834", @syzn={0x73, 0x79, 0x7a}}, 0x0, 0x56, 0xd0, 0x0, {}, []}, @unspec=@CT2={0x60, 'CT\x00', 0x2, {0x0, 0x0, 0x80000, 0x0, 'snmp\x00', 'syz0\x00'}}}, {{@uncond, 0x0, 0x70, 0xcc, 0x0, {}, []}, @common=@CLUSTERIP={0x5c, 'CLUSTERIP\x00', 0x0, {0x0, @remote={[0xaa, 0xaa, 0xaa, 0xaa], 0xffffffffffffffff, 0xbb}}}}], {{[], 0x0, 0x70, 0x94}, {0x24, '\x00', 0x0, 0x70}}}}, 0x28c) 2018/02/10 14:10:08 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) keyctl$dh_compute(0x17, &(0x7f00004cb000), &(0x7f0000dc6000-0x6f)=""/111, 0x6f, &(0x7f0000ed7000-0x2c)={&(0x7f00002e7000-0x40)={'cmac(tea-generic)\x00'}}) r0 = syz_open_dev$sndpcmc(&(0x7f0000903000-0x12)='/dev/snd/pcmC#D#c\x00', 0xfffffffffffffffb, 0x4000) r1 = add_key(&(0x7f000053a000-0x6)='logon\x00', &(0x7f000038e000-0x5)={0x73, 0x79, 0x7a, 0x0}, &(0x7f0000d68000)="d549ccd52221f8e7fbc9b46b883fd6c4b088925858b87560f2dfdbe2c41faad36db51fe70ea105f4ba2eb59d9f76234effe9bb00940822ac291c304616f63157e0502ba6d915cbe7e7ad69cd1dacd705d9f69516b33a90f5eddc3d55f6ed0082673a4d39260488", 0x67, 0xfffffffffffffff8) r2 = add_key(&(0x7f00007bf000)='keyring\x00', &(0x7f0000f19000-0x5)={0x73, 0x79, 0x7a, 0x3}, 0x0, 0x0, 0xffffffffffffffff) r3 = add_key(&(0x7f000032e000-0xd)='dns_resolver\x00', &(0x7f000067a000-0x5)={0x73, 0x79, 0x7a, 0x1}, &(0x7f000046a000)="52c657fc8538c9364e3abe9dc63b353234ffb750d8e22c20a6cd51d89a3b63e8cb1a4b4d1fae5b8b03c0b20a312c1f85ed1a527ba122717b8aa151e3e4a7b1fee9296405b106023656c09971a29dfa88d2a0cf9c22f2c19f33cf45297df0a33176c66aef184beb2ccd98ecb6efae22eb15e82f0f31297dd1a5a464ff8e4178ffb6ccd387e4ead7a8ce3e17b78f991e09fcf0f7d3eff5955ece3f2d52151a5b6bfa411b0e921eaee7d8eca03cc5d2c98e06128a25eebcc0088a1d627598", 0xbd, 0xfffffffffffffffa) keyctl$dh_compute(0x17, &(0x7f0000e47000-0xc)={r1, r2, r3}, &(0x7f00006da000-0x1000)=""/4096, 0x1000, &(0x7f0000c55000)={&(0x7f0000b3f000)={'crct10dif-pclmul\x00'}}) ioctl$KVM_SET_PIT(r0, 0x8048ae66, &(0x7f0000eeb000-0x70)={[{0x1f, 0x9, 0x9, 0x1, 0x1, 0xd3, 0x4, 0x7, 0x7fff, 0xd4, 0xad4, 0x3, 0x636}, {0x1000, 0xfffffffffffff038, 0x7, 0x1, 0x8000, 0x9b5e, 0x100000000, 0x1, 0x7, 0x4, 0x200, 0x4, 0x9}, {0x8, 0x4, 0xe9c1, 0x7, 0x9ca, 0x400, 0x8001, 0xe86, 0x7fffffff, 0x7, 0x5, 0x8001, 0x335b}], 0x9}) ioctl$SNDRV_TIMER_IOCTL_TREAD(r0, 0x40045402, &(0x7f0000c76000-0x4)=0x1) [ 66.353863] binder: 11141:11145 unknown command 0 [ 66.360263] binder: 11141:11145 ioctl c0306201 2000a000 returned -22 [ 66.378830] binder: 11141:11149 got transaction with invalid offset (32, min 0 max 24) or object. 2018/02/10 14:10:08 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00007d2000+0x1c8)=0x20000524a) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000001000)='/dev/ptmx\x00', 0x2, 0x0) ioctl$TCXONC(r0, 0x540a, 0x0) write(r0, &(0x7f000001d000-0x2)="b6", 0x1) ioctl$TCXONC(r0, 0x540a, 0x1) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000d38000)='/dev/ppp\x00', 0x0, 0x0) ioctl$sock_bt_cmtp_CMTPGETCONNINFO(r1, 0x800443d3, &(0x7f0000dc6000)={{0x4, 0x7, 0xec0, 0x1, 0x7, 0x6}, 0xfffffffffffffffb, 0x5db, 0x8}) getsockopt$inet_sctp6_SCTP_PR_SUPPORTED(r1, 0x84, 0x71, &(0x7f00006b0000-0x8)={0x0, 0x3}, &(0x7f0000833000-0x4)=0x8) setsockopt$inet_sctp_SCTP_SET_PEER_PRIMARY_ADDR(r1, 0x84, 0x5, &(0x7f0000eeb000)={r2, @in6={{0xa, 0x3, 0x7fff, @loopback={0x0, 0x1}, 0x401}}}, 0x8c) ioctl$PIO_UNISCRNMAP(r0, 0x4b6a, &(0x7f0000f62000-0x55)="4a216b7c87aa4fb67408393b172406419c07a38fa983e41b8699585616b82f8f1713f0d74b4432df2009145e9fcd0de0eab78b0151bf95f5f5f75e4da59040da3b2a42342968f2ce810eb32e81bf4faaf2dabf01dc") setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r1, 0x84, 0x7b, &(0x7f0000035000-0x8)={r2, 0x9}, 0x8) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) r4 = getpgrp(0x0) ioctl$SNDRV_CTL_IOCTL_HWDEP_INFO(r1, 0x80dc5521, &(0x7f00005d6000)=""/97) r5 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f00008c4000-0x11)='/dev/vga_arbiter\x00', 0x800, 0x0) fcntl$getown(r0, 0x9) getsockopt$inet_sctp_SCTP_MAXSEG(0xffffffffffffff9c, 0x84, 0xd, &(0x7f0000559000-0x4)=@assoc_id=0x0, &(0x7f00000fb000-0x4)=0x4) getsockopt$inet_sctp_SCTP_DELAYED_SACK(r5, 0x84, 0x10, &(0x7f0000799000-0x8)=@assoc_value={r6, 0x8}, &(0x7f0000ad1000)=0x8) ioctl$sock_SIOCSPGRP(r3, 0x8902, &(0x7f00005b2000)=r4) [ 66.407830] can: request_module (can-proto-4) failed. [ 66.419559] binder: 11141:11149 transaction failed 29201/-22, size 24-8 line 3020 2018/02/10 14:10:08 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000a000)={0x34e, 0x0, &(0x7f00001e5000-0x8)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000006000-0x54)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000-0x30)={0x44, 0x0, &(0x7f0000d06000)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x38, 0x8, &(0x7f000000d000)=[@fda={0x66646185}, @flat={0x73682a85}], &(0x7f0000006000)=[0x20]}}], 0x0, 0x0, &(0x7f0000176000-0x1)}) 2018/02/10 14:10:08 executing program 0: mmap(&(0x7f0000000000/0x14000)=nil, 0x14000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000014000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000015000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$admmidi(&(0x7f0000016000-0xe)='/dev/admmidi#\x00', 0xad8, 0x20000) ioctl$SNDRV_TIMER_IOCTL_STATUS(r0, 0x80585414, &(0x7f000000c000)=""/250) r1 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000014000)='/selinux/avc/hash_stats\x00', 0x0, 0x0) mmap(&(0x7f0000014000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r2 = getpgrp(0xffffffffffffffff) getpgrp(r2) getsockname$inet6(r1, &(0x7f0000014000-0x1c)={0x0, 0xffffffffffffffff, 0x0, @loopback}, &(0x7f0000014000)=0x1c) r3 = socket$inet_tcp(0x2, 0x1, 0x0) mmap(&(0x7f0000014000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) openat$audio(0xffffffffffffff9c, &(0x7f0000015000-0xb)='/dev/audio\x00', 0x40200, 0x0) mmap(&(0x7f0000014000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) signalfd(r1, &(0x7f000000c000), 0x8) getsockopt$inet_buf(r3, 0x0, 0x30, &(0x7f0000012000-0x8a)=""/167, &(0x7f0000011000)=0xa7) mmap(&(0x7f0000015000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) syz_open_dev$adsp(&(0x7f0000016000-0xb)='/dev/adsp#\x00', 0xb303, 0x151080) 2018/02/10 14:10:08 executing program 5: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f000070f000)='/dev/cuse\x00', 0x2000, 0x0) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$KVM_REGISTER_COALESCED_MMIO(r0, 0x4010ae67, &(0x7f0000001000-0x10)={0x0, 0x102000}) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) socketpair$inet(0x2, 0x7, 0xfff, &(0x7f0000002000)) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000a5000-0x8)) mmap(&(0x7f0000000000/0x19000)=nil, 0x19000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r1 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000924000-0xc)='/dev/rfkill\x00', 0x0, 0x0) r2 = userfaultfd(0x0) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000e54000-0x18)={0xaa}) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000008000-0x20)={{&(0x7f0000000000/0x4000)=nil, 0x4000}, 0x1}) readv(r1, &(0x7f00001f3000-0x10)=[{&(0x7f0000002000-0x4e)=""/1, 0x1}], 0x1) ioctl$RNDADDTOENTCNT(r1, 0x40045201, &(0x7f0000b27000)) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r1, 0x40605346, &(0x7f00009d0000)={0x401, 0x3, {0x0, 0x2, 0x8001, 0x2, 0x50ff}}) socket$vsock_dgram(0x28, 0x2, 0x0) ioctl$RNDADDTOENTCNT(r1, 0x40045201, &(0x7f0000a81000)) userfaultfd(0x80000) ioctl$UFFDIO_UNREGISTER(r2, 0xc020aa04, &(0x7f0000008000-0x4)={&(0x7f0000000000/0x2000)=nil, 0x2000}) ioctl$SNDRV_SEQ_IOCTL_DELETE_PORT(r0, 0x40a45321, &(0x7f0000400000)={{0x0, 0x40}, 'port1\x00', 0x47, 0x100000, 0x656, 0x4, 0x200, 0x5, 0x0, 0x0, 0x1, 0x2db4}) 2018/02/10 14:10:08 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000a000)={0x34e, 0x0, &(0x7f00001e5000-0x8)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000006000-0x54)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000-0x30)={0x44, 0x0, &(0x7f0000d06000)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f000000d000)=[@flat={0x73682a85}], &(0x7f0000006000)=[0x20]}}], 0x0, 0x0, &(0x7f0000176000-0x1)}) [ 66.455946] binder: undelivered TRANSACTION_ERROR: 29201 [ 66.502766] binder: 11175:11176 unknown command 0 [ 66.507887] binder: 11175:11176 ioctl c0306201 2000a000 returned -22 [ 66.517203] binder: 11175:11176 got transaction with invalid offset (32, min 0 max 24) or object. [ 66.526585] binder: 11175:11176 transaction failed 29201/-22, size 24-8 line 3020 [ 66.539932] binder: undelivered TRANSACTION_ERROR: 29201 2018/02/10 14:10:08 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$KVM_CREATE_DEVICE(0xffffffffffffffff, 0xc00caee0, &(0x7f00002d3000)={0x1, 0xffffffffffffff9c, 0x1}) syz_open_dev$sndtimer(&(0x7f00007f8000)='/dev/snd/timer\x00', 0x0, 0x40041) setsockopt$inet_sctp6_SCTP_I_WANT_MAPPED_V4_ADDR(r0, 0x84, 0xc, &(0x7f000066e000-0x4)=0x7fff, 0x4) 2018/02/10 14:10:08 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00007d2000+0x1c8)=0x20000524a) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000001000)='/dev/ptmx\x00', 0x2, 0x0) ioctl$TCXONC(r0, 0x540a, 0x0) write(r0, &(0x7f000001d000-0x2)="b6", 0x1) open(&(0x7f0000b97000)='./file0\x00', 0x800, 0xc) ioctl$TCXONC(r0, 0x540a, 0x1) 2018/02/10 14:10:08 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000a000)={0x34e, 0x0, &(0x7f00001e5000-0x8)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000006000-0x54)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000-0x30)={0x44, 0x0, &(0x7f0000d06000)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20, 0x8, &(0x7f000000d000)=[@fda={0x66646185}], &(0x7f0000006000)=[0x20]}}], 0x0, 0x0, &(0x7f0000176000-0x1)}) 2018/02/10 14:10:08 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r0, r0, &(0x7f0000049000), 0x3d2) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000008000)={&(0x7f000000f000-0xc)={0x10, 0x34000}, 0xc, &(0x7f0000220000)={&(0x7f00008d6000-0x14)={0x14, 0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, {}, []}, 0x14}, 0x1}, 0x0) r1 = userfaultfd(0x80800) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000ff8000-0x20)={{&(0x7f0000012000/0x2000)=nil, 0x2000}, 0x1}) bpf$MAP_CREATE(0x0, &(0x7f0000fb4000)={0x2, 0x8000000000000004, 0x400, 0x7fd, 0x4, 0xffffffffffffffff}, 0x2c) userfaultfd(0x800) clock_gettime(0x0, &(0x7f0000132000)={0x0, 0x0}) socketpair(0x1d, 0x800, 0x4, &(0x7f0000589000)) r4 = syz_open_dev$mouse(&(0x7f00006eb000)='/dev/input/mouse#\x00', 0xde6e, 0x1) timer_settime(0x0, 0x1, &(0x7f000097e000)={{0x0, r3}, {r2, r3+10000000}}, &(0x7f0000939000)) fanotify_init(0x25, 0x802) r5 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000ef2000-0x1d)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f00002d8000-0xc)={0x0, 0x0}, &(0x7f0000d76000-0x4)=0xc) syz_open_procfs(r6, &(0x7f0000013000)='ns/cgroup\x00') openat$ion(0xffffffffffffff9c, &(0x7f0000dd5000)='/dev/ion\x00', 0x800, 0x0) pipe2(&(0x7f000058c000), 0x4800) setsockopt$inet_IP_XFRM_POLICY(r4, 0x0, 0x11, &(0x7f0000e12000-0xe8)={{{@in6=@mcast1={0xff, 0x1, [], 0x1}, @in=@rand_addr, 0x2, 0x0, 0x3, 0x20, 0xa, 0xa0, 0x80, 0xbf, 0x0, r7}, {0x0, 0x8, 0x0, 0x3, 0x6, 0x1fa8, 0x8, 0x20}, {0x1719, 0x7fff, 0x7ff, 0x7ff}, 0x1, 0x7, 0x0, 0x1, 0x1, 0x3}, {{@in=@broadcast=0xffffffff, 0x1, 0x7f}, 0xa, @in=@empty, 0xffffffffffffffff, 0x3, 0x0, 0xffffffffffffffbc, 0x20, 0x6, 0x2}}, 0xe8) openat$selinux_policy(0xffffffffffffff9c, &(0x7f000010e000-0x10)='/selinux/policy\x00', 0x0, 0x0) setsockopt$netlink_NETLINK_TX_RING(r5, 0x10e, 0x7, &(0x7f0000ab4000-0x10)={0x6, 0x7, 0x52, 0xfffffffffffffffc}, 0x10) 2018/02/10 14:10:08 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000a000)={0x34e, 0x0, &(0x7f00001e5000-0x8)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000006000-0x54)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000-0x30)={0x44, 0x0, &(0x7f0000d06000)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x38, 0x8, &(0x7f000000d000)=[@fda={0x66646185}, @flat={0x73682a85}], &(0x7f0000006000)=[0x20]}}], 0x0, 0x0, &(0x7f0000176000-0x1)}) 2018/02/10 14:10:08 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$EVIOCGRAB(0xffffffffffffffff, 0x40044590, &(0x7f0000e95000-0x4)) ioctl$TIOCSBRK(0xffffffffffffffff, 0x40044591) request_key(&(0x7f0000102000)='big_key\x00', &(0x7f0000556000-0x5)={0x73, 0x79, 0x7a, 0x3}, &(0x7f00006cc000-0x40)='deflate\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', 0xffffffffffffffff) socket$inet6_sctp(0xa, 0x1, 0x84) 2018/02/10 14:10:08 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000086000-0x8)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$lock(r0, 0x7, &(0x7f00001cd000)) r1 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f000081f000-0x18)='/selinux/avc/hash_stats\x00', 0x0, 0x0) fcntl$lock(r0, 0x25, &(0x7f0000016000)) ioctl$sock_inet_SIOCSIFNETMASK(r1, 0x891c, &(0x7f0000931000-0x20)={@syzn={0x73, 0x79, 0x7a, 0x0}, @ifru_flags=0x202}) dup2(r1, r0) 2018/02/10 14:10:08 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000a5000-0x8)) mmap(&(0x7f0000000000/0x19000)=nil, 0x19000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000924000-0xc)='/dev/rfkill\x00', 0x0, 0x0) r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000e54000-0x18)={0xaa}) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000008000-0x20)={{&(0x7f0000000000/0x4000)=nil, 0x4000}, 0x1}) readv(r0, &(0x7f00001f3000-0x10)=[{&(0x7f0000002000-0x4e)=""/1, 0x1}], 0x1) ioctl$RNDADDTOENTCNT(r0, 0x40045201, &(0x7f0000b27000)) r2 = getpid() process_vm_writev(r2, &(0x7f0000e97000-0x38)=[{&(0x7f000031e000)=""/141, 0x8d}, {&(0x7f00002d2000-0x1000)=""/4096, 0x1000}, {&(0x7f000046c000)=""/208, 0xd0}, {&(0x7f0000a4b000-0x12)=""/18, 0x12}, {&(0x7f0000c9a000)=""/149, 0x95}, {&(0x7f00002c5000-0x76)=""/118, 0x76}, {&(0x7f0000db4000)=""/113, 0x71}], 0x7, &(0x7f0000adc000)=[{&(0x7f000024f000-0xda)=""/218, 0xda}], 0x1, 0x0) ioctl$RNDADDTOENTCNT(r0, 0x40045201, &(0x7f0000a81000)) ioctl$UFFDIO_UNREGISTER(r1, 0xc020aa04, &(0x7f0000008000-0x4)={&(0x7f0000000000/0x2000)=nil, 0x2000}) 2018/02/10 14:10:08 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$amidi(&(0x7f0000615000-0x5)='/dev/amidi#\x00', 0x1, 0x40) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f000084a000)={0x2, 0x0, [{0xd002, 0x1000, &(0x7f0000e89000)=""/4096}, {0x100000, 0x7e, &(0x7f0000ad5000-0x7e)=""/126}]}) 2018/02/10 14:10:08 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000a000)={0x34e, 0x0, &(0x7f00001e5000-0x8)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000006000-0x54)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000-0x30)={0x44, 0x0, &(0x7f0000d06000)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x38, 0x8, &(0x7f000000d000)=[@fda={0x66646185}, @flat={0x73682a85}], &(0x7f0000006000)=[0x20]}}], 0x0, 0x0, &(0x7f0000176000-0x1)}) 2018/02/10 14:10:08 executing program 0: mprotect(&(0x7f00004c0000/0x12000)=nil, 0x12000, 0x3000008) clock_gettime(0x0, &(0x7f0000828000-0x8)={0x0, 0x0}) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f0000000000)=0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) process_vm_writev(r2, &(0x7f0000000000)=[{&(0x7f0000002000-0xc8)=""/200, 0xc8}, {&(0x7f0000002000-0x8f)=""/143, 0x8f}, {&(0x7f0000000000)=""/57, 0x39}, {&(0x7f0000002000-0xba)=""/186, 0xba}, {&(0x7f0000001000-0x5b)=""/91, 0x5b}, {&(0x7f0000000000)=""/14, 0xe}], 0x6, &(0x7f0000001000)=[{&(0x7f0000002000-0xbf)=""/191, 0xbf}, {&(0x7f0000001000)=""/4096, 0x1000}, {&(0x7f0000001000-0x28)=""/40, 0x28}, {&(0x7f0000001000-0x7)=""/7, 0x7}], 0x4, 0x0) clock_nanosleep(0x7, 0x1, &(0x7f0000000000)={r0, r1+10000000}, &(0x7f0000361000)) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) sigaltstack(&(0x7f0000534000/0x2000)=nil, &(0x7f0000001000)) r3 = syz_open_pts(0xffffffffffffff9c, 0x400800) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$KDSKBMETA(r3, 0x4b63, &(0x7f0000001000-0x4)=0x80000000) 2018/02/10 14:10:08 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f000000a000)={0x34e, 0x0, &(0x7f00001e5000-0x8)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000006000-0x54)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000-0x30)={0x44, 0x0, &(0x7f0000d06000)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x38, 0x8, &(0x7f000000d000)=[@fda={0x66646185}, @flat={0x73682a85}], &(0x7f0000006000)=[0x20]}}], 0x0, 0x0, &(0x7f0000176000-0x1)}) [ 66.648684] binder: 11189:11195 unknown command 0 [ 66.656859] binder: 11189:11195 ioctl c0306201 2000a000 returned -22 [ 66.664617] binder: 11189:11195 got transaction with invalid offset (32, min 0 max 32) or object. [ 66.674927] binder: 11189:11195 transaction failed 29201/-22, size 32-8 line 3020 2018/02/10 14:10:08 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000a000)={0x34e, 0x0, &(0x7f00001e5000-0x8)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000006000-0x54)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000-0x30)={0x44, 0x0, &(0x7f0000d06000)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20, 0x8, &(0x7f000000d000)=[@fda={0x66646185}], &(0x7f0000006000)=[0x20]}}], 0x0, 0x0, &(0x7f0000176000-0x1)}) 2018/02/10 14:10:08 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) keyctl$dh_compute(0x17, &(0x7f00004cb000), &(0x7f0000dc6000-0x6f)=""/111, 0x6f, &(0x7f0000ed7000-0x2c)={&(0x7f00002e7000-0x40)={'cmac(tea-generic)\x00'}}) r0 = add_key$keyring(&(0x7f000078b000)='keyring\x00', &(0x7f0000023000-0x5)={0x73, 0x79, 0x7a, 0x2}, 0x0, 0x0, 0xfffffffffffffffd) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000d58000)='/dev/cuse\x00', 0x40000, 0x0) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r1, 0x84, 0x64, &(0x7f0000be5000-0x4c)=[@in6={0xa, 0x1, 0x5, @remote={0xfe, 0x80, [], 0x0, 0xbb}, 0x7}, @in={0x2, 0x0, @loopback=0x7f000001}, @in={0x2, 0x0, @multicast1=0xe0000001}, @in={0x2, 0x3, @empty}], 0x4c) add_key$user(&(0x7f0000d58000-0x5)='user\x00', &(0x7f0000536000-0x5)={0x73, 0x79, 0x7a, 0x2}, &(0x7f00006ac000-0x52)="48035f032deda919d16090863f74809686e6f30975e4b6dcee9a5903ccd977126389a7fa0a2f21ec3d743068e0a4f523a3f6235cad61cbd33c1d08218c51d2b63a229fa6b8c7f30667db55c10f2a6570785c", 0x52, r0) 2018/02/10 14:10:08 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00007d2000+0x1c8)=0x20000524a) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000001000)='/dev/ptmx\x00', 0x2, 0x0) ioctl$TCXONC(r0, 0x540a, 0x0) syncfs(r0) write(r0, &(0x7f000001d000-0x2)="b6", 0x1) openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f000087a000-0x11)='/dev/qat_adf_ctl\x00', 0x200, 0x0) ioctl$TCXONC(r0, 0x540a, 0x1) [ 66.711863] binder: undelivered TRANSACTION_ERROR: 29201 [ 66.717096] binder: 11214:11215 transaction failed 29189/-22, size 56-8 line 2842 [ 66.731492] can: request_module (can-proto-4) failed. 2018/02/10 14:10:08 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f000000a000)={0x34e, 0x0, &(0x7f00001e5000-0x8)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000006000-0x54)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000-0x30)={0x44, 0x0, &(0x7f0000d06000)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x38, 0x8, &(0x7f000000d000)=[@fda={0x66646185}, @flat={0x73682a85}], &(0x7f0000006000)=[0x20]}}], 0x0, 0x0, &(0x7f0000176000-0x1)}) [ 66.764984] binder: undelivered TRANSACTION_ERROR: 29189 [ 66.765884] binder: 11219:11226 unknown command 0 [ 66.795581] binder: 11219:11230 got transaction with invalid offset (32, min 0 max 32) or object. [ 66.806532] binder: 11219:11226 ioctl c0306201 2000a000 returned -22 2018/02/10 14:10:08 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r0, &(0x7f0000710000-0x1d)={0xa, 0x0, 0x0, @empty}, 0x1c) r1 = syz_open_procfs(0x0, &(0x7f0000387000)='fdinfo\x00') getsockopt$inet_sctp6_SCTP_RESET_STREAMS(r0, 0x84, 0x77, &(0x7f0000a66000-0x14)={0x0, 0x0, 0x6, [0x27a, 0x7, 0x80, 0xc08, 0x7, 0x2]}, &(0x7f00007cc000)=0x14) getsockopt$inet_sctp_SCTP_GET_PEER_ADDRS(r1, 0x84, 0x6c, &(0x7f0000904000)={r2, 0x14, "3c6618dcc47c7e5533ff80ecdf88a9b73de2b35b"}, &(0x7f00005a0000-0x4)=0x1c) sendto$inet6(r0, &(0x7f000023f000-0x2)="7f", 0x1, 0x0, &(0x7f000010e000)={0xa, 0x0, 0x0, @loopback={0x0, 0x1}}, 0x1c) getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(r0, 0x84, 0x6c, &(0x7f000092b000-0x5c)={0x0, 0x1c, "6c635461257d4861c0beecd6fbec34f1df1a7a8781ead8aeb38f5bef"}, &(0x7f0000a37000)=0x24) 2018/02/10 14:10:08 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000a5000-0x8)) mmap(&(0x7f0000000000/0x19000)=nil, 0x19000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000924000-0xc)='/dev/rfkill\x00', 0x0, 0x0) r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000e54000-0x18)={0xaa}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000328000)={{&(0x7f00003ed000/0x1000)=nil, 0x1000}, 0x1}) readv(r0, &(0x7f00001f3000-0x10)=[{&(0x7f0000002000-0x4e)=""/1, 0x1}], 0x1) ioctl$RNDADDTOENTCNT(r0, 0x40045201, &(0x7f0000b27000)) ioctl$RNDADDTOENTCNT(r0, 0x40045201, &(0x7f0000a81000)) ioctl$UFFDIO_UNREGISTER(r1, 0xc020aa04, &(0x7f0000008000-0x4)={&(0x7f0000000000/0x2000)=nil, 0x2000}) 2018/02/10 14:10:08 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r0, r0, &(0x7f0000049000), 0x3d2) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000008000)={&(0x7f000000f000-0xc)={0x10, 0x34000}, 0xc, &(0x7f0000220000)={&(0x7f00008d6000-0x14)={0x14, 0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, {}, []}, 0x14}, 0x1}, 0x0) r1 = userfaultfd(0x80800) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000ff8000-0x20)={{&(0x7f0000012000/0x2000)=nil, 0x2000}, 0x1}) bpf$MAP_CREATE(0x0, &(0x7f0000fb4000)={0x2, 0x8000000000000004, 0x400, 0x7fd, 0x4, 0xffffffffffffffff}, 0x2c) userfaultfd(0x800) clock_gettime(0x0, &(0x7f0000132000)={0x0, 0x0}) socketpair(0x1d, 0x800, 0x4, &(0x7f0000589000)) r4 = syz_open_dev$mouse(&(0x7f00006eb000)='/dev/input/mouse#\x00', 0xde6e, 0x1) timer_settime(0x0, 0x1, &(0x7f000097e000)={{0x0, r3}, {r2, r3+10000000}}, &(0x7f0000939000)) fanotify_init(0x25, 0x802) r5 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000ef2000-0x1d)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f00002d8000-0xc)={0x0, 0x0}, &(0x7f0000d76000-0x4)=0xc) syz_open_procfs(r6, &(0x7f0000013000)='ns/cgroup\x00') openat$ion(0xffffffffffffff9c, &(0x7f0000dd5000)='/dev/ion\x00', 0x800, 0x0) pipe2(&(0x7f000058c000), 0x4800) setsockopt$inet_IP_XFRM_POLICY(r4, 0x0, 0x11, &(0x7f0000e12000-0xe8)={{{@in6=@mcast1={0xff, 0x1, [], 0x1}, @in=@rand_addr, 0x2, 0x0, 0x3, 0x20, 0xa, 0xa0, 0x80, 0xbf, 0x0, r7}, {0x0, 0x8, 0x0, 0x3, 0x6, 0x1fa8, 0x8, 0x20}, {0x1719, 0x7fff, 0x7ff, 0x7ff}, 0x1, 0x7, 0x0, 0x1, 0x1, 0x3}, {{@in=@broadcast=0xffffffff, 0x1, 0x7f}, 0xa, @in=@empty, 0xffffffffffffffff, 0x3, 0x0, 0xffffffffffffffbc, 0x20, 0x6, 0x2}}, 0xe8) openat$selinux_policy(0xffffffffffffff9c, &(0x7f000010e000-0x10)='/selinux/policy\x00', 0x0, 0x0) setsockopt$netlink_NETLINK_TX_RING(r5, 0x10e, 0x7, &(0x7f0000ab4000-0x10)={0x6, 0x7, 0x52, 0xfffffffffffffffc}, 0x10) 2018/02/10 14:10:08 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f000000a000)={0x34e, 0x0, &(0x7f00001e5000-0x8)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000006000-0x54)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000-0x30)={0x44, 0x0, &(0x7f0000d06000)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x38, 0x8, &(0x7f000000d000)=[@fda={0x66646185}, @flat={0x73682a85}], &(0x7f0000006000)=[0x20]}}], 0x0, 0x0, &(0x7f0000176000-0x1)}) 2018/02/10 14:10:08 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000a000)={0x34e, 0x0, &(0x7f00001e5000-0x8)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000006000-0x54)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000-0x30)={0x44, 0x0, &(0x7f0000d06000)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20, 0x8, &(0x7f000000d000)=[@fda={0x66646185}], &(0x7f0000006000)=[0x20]}}], 0x0, 0x0, &(0x7f0000176000-0x1)}) 2018/02/10 14:10:08 executing program 4: keyctl$dh_compute(0x17, &(0x7f00004cb000), &(0x7f0000dc6000-0x6f)=""/111, 0x6f, &(0x7f0000ed7000-0x2c)={&(0x7f00002e7000-0x40)={'cmac(tea-generic)\x00'}}) 2018/02/10 14:10:08 executing program 1: mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/net/pfkey\x00', 0x4400, 0x0) ioctl$VT_WAITACTIVE(r0, 0x5607) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00007d2000+0x1c8)=0x20000524a) ioctl$TCXONC(0xffffffffffffffff, 0x540a, 0x0) ioctl$sock_SIOCGPGRP(r0, 0x8904, &(0x7f0000cd5000-0x4)) ioctl$KDGETLED(0xffffffffffffffff, 0x4b31, &(0x7f0000722000)) setsockopt$inet_sctp_SCTP_AUTH_CHUNK(r0, 0x84, 0x15, &(0x7f0000a83000-0x1)={0x401}, 0x1) getpeername$unix(r0, &(0x7f0000976000-0x8)=@abs, &(0x7f000066d000-0x4)=0x8) ioctl$sock_inet_udp_SIOCINQ(r0, 0x541b, &(0x7f00001a8000)) write(0xffffffffffffffff, &(0x7f000041c000-0x1)="b6", 0x1) ioctl$TCXONC(0xffffffffffffffff, 0x540a, 0x1) getsockopt$inet_sctp6_SCTP_PARTIAL_DELIVERY_POINT(r0, 0x84, 0x13, &(0x7f0000c80000)={0x0, 0xfff}, &(0x7f0000d43000-0x4)=0x8) setsockopt$inet_sctp_SCTP_ASSOCINFO(r0, 0x84, 0x1, &(0x7f00008a2000)={r1, 0x9, 0x101, 0x0, 0x0, 0x3}, 0x14) ioctl$UFFDIO_ZEROPAGE(r0, 0xc020aa04, &(0x7f0000bea000-0x10)={&(0x7f000096c000/0x1000)=nil, 0x1000}) openat$rtc(0xffffffffffffff9c, &(0x7f0000e99000)='/dev/rtc\x00', 0x200, 0x0) 2018/02/10 14:10:08 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$evdev(&(0x7f0000dda000-0x12)='/dev/input/event#\x00', 0x0, 0x0) ioctl$EVIOCGRAB(r0, 0x40044590, &(0x7f0000e95000-0x4)) ioctl$TIOCSBRK(0xffffffffffffffff, 0x40044591) request_key(&(0x7f0000102000)='big_key\x00', &(0x7f0000ad3000)={0x73, 0x79, 0x7a, 0x3}, &(0x7f00006cc000-0x40)='deflate\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', 0xffffffffffffffff) [ 66.814894] binder: 11219:11230 transaction failed 29201/-22, size 32-8 line 3020 [ 66.830381] binder: undelivered TRANSACTION_ERROR: 29201 [ 66.839575] binder: 11228:11233 transaction failed 29189/-22, size 56-8 line 2842 [ 66.852176] binder: undelivered TRANSACTION_ERROR: 29189 2018/02/10 14:10:08 executing program 4: mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/checkreqprot\x00', 0x400, 0x0) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) bind$vsock_dgram(r0, &(0x7f0000001000-0x10)={0x28, 0x0, 0x0, @my=0x1}, 0x10) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$TIOCLINUX5(r0, 0x541c, &(0x7f0000002000-0x28)={0x5, 0x1, 0xfffffffffffffff1, 0x6ed580, 0x80000000}) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r1 = add_key$user(&(0x7f00000be000-0x5)='user\x00', &(0x7f0000c48000-0x5)={0x73, 0x79, 0x7a, 0x2}, &(0x7f0000988000-0x49)="c86bf44c493b1afd3de31907b39936589d4baccd5a9902bc3df11fb80e0029b8294aacb7386d20ee700634742406d07fc5435434485ca08ac29f45e172f7c927eee8080d1f471e1e55", 0x49, 0xfffffffffffffffc) keyctl$dh_compute(0x17, &(0x7f00004cb000)={r1}, &(0x7f0000dc6000-0x6f)=""/111, 0x6f, &(0x7f0000ed7000-0x2c)={&(0x7f00002e7000-0x40)={'cmac(tea-generic)\x00'}}) [ 66.882947] binder: 11240:11245 unknown command 0 [ 66.902815] binder: 11247:11249 got transaction with invalid handle, 0 [ 66.910496] binder: 11240:11245 ioctl c0306201 2000a000 returned -22 [ 66.918268] binder: 11247:11249 transaction failed 29201/-22, size 56-8 line 3049 2018/02/10 14:10:09 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000a5000-0x8)) mmap(&(0x7f0000000000/0x19000)=nil, 0x19000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000924000-0xc)='/dev/rfkill\x00', 0x0, 0x0) r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000e54000-0x18)={0xaa}) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000008000-0x20)={{&(0x7f0000000000/0x4000)=nil, 0x4000}, 0x1}) readv(r0, &(0x7f00001f3000-0x10)=[{&(0x7f0000002000-0x4e)=""/1, 0x1}], 0x1) ioctl$RNDADDTOENTCNT(r0, 0x40045201, &(0x7f0000b27000)) socketpair$inet6_sctp(0xa, 0x5, 0x84, &(0x7f0000e9a000)) ioctl$RNDADDTOENTCNT(r0, 0x40045201, &(0x7f0000a81000)) ioctl$UFFDIO_UNREGISTER(r1, 0xc020aa04, &(0x7f0000008000-0x4)={&(0x7f0000000000/0x2000)=nil, 0x2000}) [ 66.920135] binder: 11240:11255 got transaction with invalid offset (32, min 0 max 32) or object. 2018/02/10 14:10:09 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000a000)={0x0, 0x0, &(0x7f00001e5000-0x8)=[], 0x0, 0x0, &(0x7f0000006000-0x54)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000-0x30)={0x44, 0x0, &(0x7f0000d06000)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x38, 0x8, &(0x7f000000d000)=[@fda={0x66646185}, @flat={0x73682a85}], &(0x7f0000006000)=[0x20]}}], 0x0, 0x0, &(0x7f0000176000-0x1)}) 2018/02/10 14:10:09 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x0, 0x78}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone(0x0, &(0x7f000065a000-0x2), &(0x7f00003c7000-0x4), &(0x7f0000a2f000-0x4), &(0x7f00007c4000)) rt_sigprocmask(0x0, &(0x7f000021f000)={0xfffffffffffffffe}, 0x0, 0x8) clone(0x0, &(0x7f000075d000-0xad), &(0x7f000015e000-0x4), &(0x7f0000b26000-0x4), &(0x7f0000923000)) r0 = getpid() socketpair$unix(0x1, 0x1, 0x0, &(0x7f000064e000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$int_in(r1, 0x5452, &(0x7f00005ec000-0x8)=0x3f) fcntl$setsig(r1, 0xa, 0x12) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f000053b000/0x18000)=nil, &(0x7f00007d1000)=[@text32={0x20, &(0x7f000027b000)="b9ad030000b8750d0000ba000000000f300f21083e670f23da66b80f010f00d80f060f20c035000004000f22c0f20f209526640fc76c730c66b827018ee0660f388080ad108e47", 0x47}], 0x1, 0x0, &(0x7f00003db000)=[], 0x0) fcntl$setownex(r1, 0xf, &(0x7f0000704000)={0x2, r0}) recvmsg(r2, &(0x7f000095d000-0x38)={&(0x7f0000894000-0x8)=@sco, 0x8, &(0x7f00000a5000-0x50)=[], 0x0, &(0x7f0000b30000)}, 0x0) dup2(r1, r2) socket$vsock_stream(0x28, 0x1, 0x0) tkill(r0, 0x15) wait4(0x0, 0x0, 0x80000000, &(0x7f000005b000-0x90)) wait4(0x0, 0x0, 0x60000002, &(0x7f0000a95000-0x90)) 2018/02/10 14:10:09 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00007d2000+0x1c8)=0x20000524a) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000a33000)='/dev/ptmx\x00', 0x0, 0x0) r1 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000350000-0x10)='/selinux/status\x00', 0x0, 0x0) getsockopt$inet_sctp_SCTP_ASSOCINFO(r0, 0x84, 0x1, &(0x7f0000add000)={0x0, 0x1ff, 0xfffffffffffffff8, 0x9, 0xff, 0x8001}, &(0x7f00005c8000)=0x14) setsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r1, 0x84, 0x72, &(0x7f0000774000-0xc)={r2, 0x200, 0x10}, 0xc) r3 = syz_open_dev$sndmidi(&(0x7f00007c6000)='/dev/snd/midiC#D#\x00', 0x0, 0x0) ioctl$EVIOCRMFF(r3, 0x40044581, &(0x7f000076d000-0x4)) r4 = syz_open_dev$amidi(&(0x7f000041d000-0xc)='/dev/amidi#\x00', 0x8, 0x84200) ioctl$PPPOEIOCDFWD(r4, 0xb101, 0x0) ioctl$TCXONC(r0, 0x540a, 0x0) write(r0, &(0x7f000001d000-0x2)="b6", 0x1) ioctl$TCXONC(r0, 0x540a, 0x1) [ 66.962428] binder: undelivered TRANSACTION_ERROR: 29201 [ 66.972969] binder: 11240:11255 transaction failed 29201/-22, size 32-8 line 3020 [ 66.985305] binder: 11263:11264 got transaction with invalid handle, 0 [ 66.997160] binder: undelivered TRANSACTION_ERROR: 29201 2018/02/10 14:10:09 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000a000)={0x34e, 0x0, &(0x7f00001e5000-0x8)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000006000-0x54)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000-0x30)={0x44, 0x0, &(0x7f0000d06000)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x38, 0x8, &(0x7f000000d000)=[@fda={0x66646185}, @flat], &(0x7f0000006000)=[0x20]}}], 0x0, 0x0, &(0x7f0000176000-0x1)}) [ 67.009208] binder: 11263:11264 transaction failed 29201/-22, size 56-8 line 3049 [ 67.023178] binder: undelivered TRANSACTION_ERROR: 29201 [ 67.044479] binder: 11268:11273 unknown command 0 [ 67.060127] binder: 11268:11273 ioctl c0306201 2000a000 returned -22 [ 67.070499] binder: 11268:11273 got transaction with invalid offset (32, min 0 max 56) or object. [ 67.090401] binder: 11268:11273 transaction failed 29201/-22, size 56-8 line 3020 2018/02/10 14:10:09 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000a000)={0x0, 0x0, &(0x7f00001e5000-0x8)=[], 0x0, 0x0, &(0x7f0000006000-0x54)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000-0x30)={0x44, 0x0, &(0x7f0000d06000)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x38, 0x8, &(0x7f000000d000)=[@fda={0x66646185}, @flat={0x73682a85}], &(0x7f0000006000)=[0x20]}}], 0x0, 0x0, &(0x7f0000176000-0x1)}) 2018/02/10 14:10:09 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) 2018/02/10 14:10:09 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r0, r0, &(0x7f0000049000), 0x3d2) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000008000)={&(0x7f000000f000-0xc)={0x10, 0x34000}, 0xc, &(0x7f0000220000)={&(0x7f00008d6000-0x14)={0x14, 0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, {}, []}, 0x14}, 0x1}, 0x0) r1 = userfaultfd(0x80800) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000ff8000-0x20)={{&(0x7f0000012000/0x2000)=nil, 0x2000}, 0x1}) bpf$MAP_CREATE(0x0, &(0x7f0000fb4000)={0x2, 0x8000000000000004, 0x400, 0x7fd, 0x4, 0xffffffffffffffff}, 0x2c) userfaultfd(0x800) clock_gettime(0x0, &(0x7f0000132000)={0x0, 0x0}) socketpair(0x1d, 0x800, 0x4, &(0x7f0000589000)) r4 = syz_open_dev$mouse(&(0x7f00006eb000)='/dev/input/mouse#\x00', 0xde6e, 0x1) timer_settime(0x0, 0x1, &(0x7f000097e000)={{0x0, r3}, {r2, r3+10000000}}, &(0x7f0000939000)) fanotify_init(0x25, 0x802) r5 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000ef2000-0x1d)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f00002d8000-0xc)={0x0, 0x0}, &(0x7f0000d76000-0x4)=0xc) syz_open_procfs(r6, &(0x7f0000013000)='ns/cgroup\x00') openat$ion(0xffffffffffffff9c, &(0x7f0000dd5000)='/dev/ion\x00', 0x800, 0x0) pipe2(&(0x7f000058c000), 0x4800) setsockopt$inet_IP_XFRM_POLICY(r4, 0x0, 0x11, &(0x7f0000e12000-0xe8)={{{@in6=@mcast1={0xff, 0x1, [], 0x1}, @in=@rand_addr, 0x2, 0x0, 0x3, 0x20, 0xa, 0xa0, 0x80, 0xbf, 0x0, r7}, {0x0, 0x8, 0x0, 0x3, 0x6, 0x1fa8, 0x8, 0x20}, {0x1719, 0x7fff, 0x7ff, 0x7ff}, 0x1, 0x7, 0x0, 0x1, 0x1, 0x3}, {{@in=@broadcast=0xffffffff, 0x1, 0x7f}, 0xa, @in=@empty, 0xffffffffffffffff, 0x3, 0x0, 0xffffffffffffffbc, 0x20, 0x6, 0x2}}, 0xe8) openat$selinux_policy(0xffffffffffffff9c, &(0x7f000010e000-0x10)='/selinux/policy\x00', 0x0, 0x0) setsockopt$netlink_NETLINK_TX_RING(r5, 0x10e, 0x7, &(0x7f0000ab4000-0x10)={0x6, 0x7, 0x52, 0xfffffffffffffffc}, 0x10) 2018/02/10 14:10:09 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000a5000-0x8)) mmap(&(0x7f0000000000/0x19000)=nil, 0x19000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000321000-0xc)='/dev/rfkill\x00', 0xfffffffffffffffe, 0x0) r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000e54000-0x18)={0xaa}) ioctl$DRM_IOCTL_SET_UNIQUE(r0, 0x40086410, &(0x7f0000386000)={0x5, &(0x7f0000de0000)="df840d1e77"}) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000008000-0x20)={{&(0x7f0000000000/0x4000)=nil, 0x4000}, 0x1}) readv(r0, &(0x7f00001f3000-0x10)=[{&(0x7f0000002000-0x4e)=""/1, 0x1}], 0x1) ioctl$RNDADDTOENTCNT(r0, 0x40045201, &(0x7f0000b27000)) ioctl$RNDADDTOENTCNT(r0, 0x40045201, &(0x7f0000a81000)) ioctl$UFFDIO_UNREGISTER(r1, 0xc020aa04, &(0x7f0000008000-0x4)={&(0x7f0000000000/0x2000)=nil, 0x2000}) ioctl$sock_bt_bnep_BNEPGETSUPPFEAT(r0, 0x800442d4, &(0x7f0000e06000)=0x7) 2018/02/10 14:10:09 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00007d2000+0x1c8)=0x20000524a) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000001000)='/dev/ptmx\x00', 0x2, 0x0) ioctl$TCXONC(r0, 0x540a, 0x0) mmap(&(0x7f0000000000/0x9000)=nil, 0x9000, 0x3, 0x32, 0xffffffffffffffff, 0x0) futex(&(0x7f0000002000), 0xb, 0x0, &(0x7f0000001000-0x8), &(0x7f0000002000), 0x0) write(r0, &(0x7f0000ea2000-0x1)="b6", 0x1) r1 = getpgrp(0x0) getpgid(r1) ioctl$TCXONC(r0, 0x540a, 0x1) 2018/02/10 14:10:09 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000a000)={0x34e, 0x0, &(0x7f00001e5000-0x8)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000006000-0x54)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000-0x30)={0x44, 0x0, &(0x7f0000d06000)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x38, 0x8, &(0x7f000000d000)=[@fda={0x66646185}, @flat], &(0x7f0000006000)=[0x20]}}], 0x0, 0x0, &(0x7f0000176000-0x1)}) 2018/02/10 14:10:09 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$evdev(&(0x7f0000dda000-0x12)='/dev/input/event#\x00', 0x0, 0x0) ioctl$EVIOCGRAB(r0, 0x40044590, &(0x7f0000e95000-0x4)) ioctl$TIOCSBRK(0xffffffffffffffff, 0x40044591) request_key(&(0x7f0000102000)='big_key\x00', &(0x7f0000ad3000)={0x73, 0x79, 0x7a, 0x3}, &(0x7f00006cc000-0x40)='deflate\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', 0xffffffffffffffff) keyctl$join(0x1, &(0x7f0000709000)={0x73, 0x79, 0x7a, 0x0}) 2018/02/10 14:10:09 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000a000)={0x34e, 0x0, &(0x7f00001e5000-0x8)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000006000-0x54)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000-0x30)={0x44, 0x0, &(0x7f0000d06000)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x38, 0x8, &(0x7f000000d000)=[@fda={0x66646185}, @flat], &(0x7f0000006000)=[0x20]}}], 0x0, 0x0, &(0x7f0000176000-0x1)}) 2018/02/10 14:10:09 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = add_key$user(&(0x7f00006bc000)='user\x00', &(0x7f0000cec000+0xf81)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000f42000)="2a0f8bcf8e568d1eb76b29963c43def598f9f6aa004007d1e56f3b7208f4d59d0e43d84c157524efd26bb85282b071886c3e8d6b0b6c54feb63962442cc2c14d9ad63db1784844747508618d6de32fbdd59f830e49bac9a2db2ad85afd2c987fdb942605a0b85474a958ddfbefae36f708ffefc11f17c1d188914b400711a065b06dfdc4570953e9e9c7549dd506c6e1c59e6d4e85fc32c67a25e0691c00e6f4e760d26ca130", 0xa6, 0xfffffffffffffffd) add_key(&(0x7f0000a73000)='rxrpc_s\x00', &(0x7f0000e8b000)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000625000)="e0f6644f6dbc05919d22032948a751e905a8643524d9e646b5785e0c36f8d8e726423f3e20c757469c01373013196550b0175f9f23a7045302cfb172a86379c6bef020fd711c23904f924b22204c94a9b1cab5b0cb755567eec35506d87700773115a733fe49bc6337da0cf68ded32a2fb326c725ee9fa0d5e6358ba5bdadcb38b968d65e352a2c589309d877ae43c90beb0235fcb50fc37706ed5dcac946796fc742c9497ee4b508edcbedf2eeb650cad1779cc6cf5e3aa1b0ecf6f87626cf61ae432d602a65682d7a73625b33f12610930e673f3ed3b9be7f839c8608b90213993b62613c32a8c21617d193f0fa1ea1dec5030ec3c89a5798d1c21adb06d8183f39c6662ad4828df3480f39775753f93a35458b2c5daa9f4bc86141e99f10ee9cbcf4179239dea6bc04ebb8390ff462fd2b868adb4e258b1924ca83faeecb82ccee17bec1eeadad88595b64b1696fa67bb38e9db724185e88317eb2e0943e3032bd5b66b95ee35813b30de8f81eebd86d4914a2037beb258ab676d636d7bc2015decf04e1440f05934635b7c0ea29895d0f541e624f8ccd414002bdd0702f4fce8475fa3a94694316719d61db3664d0638e635886d8b5a946628d35553da37786669fb7cdd7d4fe9a979dadbdb61222f7d285e99c4f4f1581459af6ef7b4876a6bbd535622ab103a6a0783832a2d6c4c12eeb352ac43052148671ed194844b43fbe740df223492a4694e3c386f82f612ce34a4770212f896ddf8d7fceb5f5e07e7412a5e78a7a047610a0c10515f6b33ca35eb416017854a3d2df0ec360710d504d00048576b9bfed54e8b1eb52513cd18161007b1763eba9eb7bc9cc62176f1cc0ba5a6e004dfa7ecac5f927ff3488b6761f99051dba4ade04867d768691400c512b112787d5bb390db7a87c8bd2cd960fd1098526742bf0aa60cbff5d56089b6ce665e09b4485f2036207872b1b4bfb19912d5f8113458866df14e1d2b9762ae6be57e45d0c334a05cb5c187f5d669e5d8c7e577eadcb24163d5b5b78fedb9bce20bb13b897d22f59cd393aa8872388dca88a453591c7f1047b318eac02ae079a685a29dfcd1e1df28960936a13162bcc75435c2cc50a074d8d59fa4669dda45a5374bce84eaa0cc03ac160e4c688eed5b34189a148e98812a6b97a17299ffe9f049af6bec39e6c8566d008e2125fc2635bc3dd1fde5291bf7fc3c8c36a8076a7f78be50da56723a914e321105b51a4624be6b818af89c2e00cbf9848ddd135aa9da1c2e3b4764fc9bcbf8d7ae98e6b82ec065f4d02eed00381a297380eafabbdbe92f832d40c754c0f22355f03c1cc19fa9d8a08f9dcb760b652abb55b5e0946804a7c32d92708965fd723cdbb26bf3f88c1c3df7296e9b0ec0223d49f63456d526db25674411159de0e4585024bdaefec930a9085e92222179db969f845a7fed6e32eae78a8398e764677e38c762c7ae2ff32df8903709b37de9e46e1997cbb84431b311b6f91a4fb4b101c7951a02a33ffb3fbfddfef97c71a4ca96b7d34c40b156c3aa4ff99f04ad95c50ebeabed9d43f5f2700d814ee7280284d96421e46614de7264a24e7758306cbe8249773b0ef67ad14970346b128e3a916f0c9c5c7083361221d15aa73a111c58f0c0a84846ea3a34b3868491ed880200e7849db6b97718d190cf043c8c57cf4e874e0310cce39ba5c1e7df7e105db844cce2082867468add7f368978d69ee51e03e01d418ef9558367db72b8f03c65db50db777ea40b059998abba49169588e069235732676e794368264fb7225cd6b9b8d9da8c145cd3e4f2677ec94399ec8c4a5e36f392c266431f4010f18a358192159a75ceac2d75c4f02c3194bf7505debbd7fe6f939ebb1c90c4f85def056c40ee8052fc0e547a85bde1d39acc0f1c2c3dce449ed5e504b0df2a6040521d9856efee3852733fe1f1c352eda9e4f15ea3b53c21e8389cd7abc20417274df7d5d25b5d8e1c7259c5ffbbe93d3718299c87fafefaf890881d4ba1ba538412d1b28ef2efaa9992f556276e9a4edbfeed162326e4aad273f64916b6b9ebfc38c8e406f68eb882888a3475fc342171cd426ebdf9e6282de6d2c714d51c648943cf2273fb173bc61cab2890caccd80e84e91314743793a63f0affd6c885abf3633f0909ca63de321c96f1a684307a0fa945b2c6f5d59a7a36edfc6282bddd8a2e6e5441422af29ff83a8594d58fc976eefd725c44818e6e5bc96b6cee5ec73f54e2b24ed4f02ed4966fc32260a1da953dd35dbc65ac2e50c53efe82e44f04f514a7a5bbb1984e310c07cfec3b63c247a4b99bd01e52b6e781676dd982fb5ca027cdd5cdbd4d08da2c694fe962bc1f66dbfef89c68755f325b6e9984ddbae2b9a9bcf4323ecd4a3baae74cc89a9a595831a897c04d9ddd48dc87e8c734efe835030171f08847c810e75168adb80531432ca58667506dcac679035b7de530a034ff07d4deca964299b01de5e9e62fc39f9a60281234a36081b157e0db174f5dc59686e9fb9812ee4d1d57dc90a5cdc2384b338e9157ce74aa16b73cb38d64ae8b6d62897ea9fdfe01c1c0ca7c980b36b428148c5822606c81984dbded704848b9b254d9c238bcff327960620418a8a8ded5dcc21c722c2295430fb32c48af59fcf2138d1695403843ad9823f0e96219478e0034f019e88ce0f3734bee2c4c544d7d264cb16b94206314f62b5e05b4901b162cac91a5bcbc9b78e886e0ad5a1a0f6b473fe71dbb716e87d6f35666b055afc8c5e93101826c1f20af972bf2fadbac75caff86af86ef5187bd79ac192199cd2762a4272ca93000acbefd2bb1cf2d7e3b0178e2c4df8a3c203e0317662268b85d9b8fcedcc48fd322ce6887a33ab3d6714def1a02de3df277077e4e75652a5cb3ada90fdf42e46143666d924990c9fb00303a841f1050fd354a2c38e7afd57ccedb1f8365d22ae5d488d5a098fd947a834b8787705d27882cc0de88b94856cca2c6694ef9cb633f3d79362b8ac39c0b1ddee58d80515e3e2b35b5375cc3bf0341a4da82eb2fbb6e30a9faa5aec7ec48b5e342771b0c87841b7907217df5c2434aef839133f9037c2c806319bdcdf3e4fdc87b8181d390530a3b0ae78288f057e3c903a4934b0c37ad8659d7a66aa56a576e819bc94fb47827ef9bd28fb5417f66119b1dd8666d71b8f596fca875c2c19bfc2f627434835d6afca85fe8d136097c339ee1572411e6aab9c3e0d149db117451cecd9b27ff39ba6e960321fd92e57e080e3db7e027197960cfb23e5e9b2e5d249d3156a752cbb3ac1326987ad3f5a087978af2ead7c90191c8126887e3d584a2baea1aa76bdb02ba72bbd05b9c2fdaac5dbb2bd0dfd8df0c9cf5d8170eed528cc10160e71881961909dcf84cfce73eab6f3d5cf4fb75f668e8439c0b4e2c65cb238480ea317c2ffb2593b1e57c155c413c64d7878d20d2d8677869c6af749823b1bb4e332c7ddc8f847bc265abc8c1c0e4edada469d462bd685397db84e26b70df99e5cc8eb9d0d177423ac0b1346a8b5f9b835630a8ec72dec71ee302bfa5b3c306b2f9c98268e3539cb03891d8ed478ed41e31d0fb45f1dc55ba02e1a250bc1bbb9cc99399bc9e10299127f8a4d75d83d050084720e8529a88fefcaa08b07d8ebec3a731afd6f30ce8d4d82cc290024cc9db86a8ff8ab0d8c5f6c5f90ff718695c6a7d26f70804a82f34d03f4071137097aea97b8da96b4115f583310d7dcac6609a68c357e05e5b125b0274c19afc9ba04445495ce704ac536cc147fc1779308f4eacf231c022a0d0f271871c08854f8856aacf0605049cbe9046600060e4c9acc2fe10bae1b06120c0bf92523b0171ab87b27269f613ba0f3f5e70c9a7a74e643e0ce3950918f5c41656dfc68746f2cbc9a03bbf63cb77250a27086718ad037aa70bda4b21f4935cbde1274cae2945f6ffb575f602ccfd1069a31c8fa168c910a7af84db374fd85fdeaa5ac46b5461ae06a801411f1576b79337914f1358f84c2004816e108325293e407c101a4b9b67243018eaa46defb45e9799c7bfbf64c0fe5ee313fb3210c1972dcf754295f9c1817c63d0b1cbe57a7810e2b4923fe10bbeaee236fb406f63128869b0158b077e40c1813db7af119971f730d2e6382ef1489711fc09fb2b45cd40b7e784af0423792576f3c288340958d6460cbfc26f6930c186d2c177c06c192d753aacbe9ff47ca1d7efc67ea63938cfade5defc03d193a033098300f0b25b3b45af7417e5aa593a82d9fdf15c91cf65834492aaca72b5fb1c6abb895e280b863c65a85411da01352cac24886cfd226d56bf7060e494292c3252858747bf76146cdd50865676b41183e7999fa26f3a628dc6354aee467b9562d1129658b077456bfbdb72f47ca251ac6de1ee4b440d40ff22c4dd524d61edb381cef8099fecef70870f4e9483f1ce592804d888cac378cf1f325d50968a1415206fc1f477a170b5b9111510311305cecb8895c96d60bc901a2ea449ca2672705830c498e5719dbac1d432010978f1969bade1c1220ac64fae00ed0c6ea0a01d7ef86bb769da9816b8202f5a1e13ab4f303e038cb5f04b3af305731e395c3ff8b84e2190013cac9047e17a9d4817dcfc1b0e30535d74a3385d29a5a633574b6b42fb9ec24e0357828cc9e132201d8502216e5747ef6f6b869c497100d3d911ef0d5d86a92dbdb4bf91c1e10b6b469c9628663f97871de6dd13849eeb948397a68d008e63b9c61929140d2816b7e6b655c69c89bc63d87fac84a9deec9c877d9cce61754b0925348dad4b09d35202d6e4b64dcb097243097f11f0d95e3c3375a99078dd3766741e3c3b74930c573f8c563536e57988ae32c0c8120a6230369474de4eadbf07addccdaa66c90c6efb3f5d15c61f79f77d0b657a8039f300675c0592cebda3584fda3c9244faae8dea0471cf4adee6307abd4ca8f8013b18ccf6e14b70ad669f3e59fb507e0cf15ffbde7cb0685fbb01f96d7e777f0f6be6df28d906163975219d2b8bbc0d2dc82059ce3e2ecb30a71a244a64414f394b63e2a457c3982ec3611ce4a6335ae8667d75b101b68c03c0e1fc6a999e8dc4b39f0b79a5192856f2f3c36396522a694945ce0570a37f5c20331e495ebbbfd79accb20220104ffbb2c7ea14e554d8bab9eed1b329c157ce726d767bf4fd0d2f9dfd7e3428693d958b7f87afe7cf984650134db75d42301b4c72c901e5728663d987eda25d68cb8f96f0cd1a2e9b3b06870581e30255cd9af1cc48acff9188b8176d5caec02b0dd0bf66e7ed9375c815bde4cec184096a568867d01ff96ff0949039a20024e0913e5588a12f765ebe08324f1e9bc169e03a1ac65ccf742af4c8d618d26c37ad7401452d9fb32e52a98119e4d776c486e8d75b80e8edda8caa199b69c1764c379a839a82b23b028470a9575f0e32d595c625e4b3ad57d7aba67922c2bd6d6a4fd71c05fc8d8db27b182b0dcb7b0894b3497cb36696fbc1bff8d19da1903a486c4141aa248ba0d6289cf2f8b851b4248f6897eb213371b12ec6d98e9300c1c1874800fb2f22360cb5df199be499145d8ea9d51ca86665c26c6e83dbd3aaf3445dd194d4128cf216f29a9c1abf3e4268faf288f26e70799ed77a28a20e821eb164ca18a41700d55a4a9b5b0a194440640df71743026f66ff834e2751f05a7852fde7a2bdfc850d5a6e02fdecd0c5f9355bc50ac704bb61f88969203868e4927a10179f41c8a32979daf30036d2572f81fdcdedf8c238042daf8c9c828040dc", 0x1000, 0xfffffffffffffffa) r1 = request_key(&(0x7f0000f76000-0x4)='big_key\x00', &(0x7f0000ad8000)={0x73, 0x79, 0x7a, 0x2}, &(0x7f0000292000)='.cgroup#\x00', 0xfffffffffffffffc) keyctl$dh_compute(0x17, &(0x7f0000df2000)={r0, r1}, &(0x7f0000dc6000-0x6f)=""/111, 0x5a, &(0x7f0000ed7000-0x2c)={&(0x7f00002e7000-0x40)={'cryptd(sha1-ssse3)\x00'}, 0x0, 0xad}) r2 = syz_open_dev$vcsa(&(0x7f0000515000)='/dev/vcsa#\x00', 0x22, 0x7e) getsockopt$inet_mreqn(0xffffffffffffff9c, 0x0, 0x23, &(0x7f0000601000)={@local, @empty, 0x0}, &(0x7f0000b8a000)=0xc) setsockopt$inet6_IPV6_PKTINFO(r2, 0x29, 0x32, &(0x7f0000c59000)={@local={0xfe, 0x80, [], 0x0, 0xaa}, r3}, 0x14) [ 67.117894] binder: undelivered TRANSACTION_ERROR: 29201 [ 67.169490] binder: 11294:11296 unknown command 0 [ 67.175334] binder: 11285:11287 got transaction with invalid handle, 0 [ 67.177906] binder: BINDER_SET_CONTEXT_MGR already set [ 67.187398] binder: 11294:11296 ioctl c0306201 2000a000 returned -22 [ 67.187830] binder: 11285:11287 transaction failed 29201/-22, size 56-8 line 3049 [ 67.194668] binder: 11297:11301 ioctl 40046207 0 returned -16 [ 67.209467] binder: 11294:11296 got transaction with invalid offset (32, min 0 max 56) or object. 2018/02/10 14:10:09 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000a000)={0x0, 0x0, &(0x7f00001e5000-0x8)=[], 0x0, 0x0, &(0x7f0000006000-0x54)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000-0x30)={0x44, 0x0, &(0x7f0000d06000)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x38, 0x8, &(0x7f000000d000)=[@fda={0x66646185}, @flat={0x73682a85}], &(0x7f0000006000)=[0x20]}}], 0x0, 0x0, &(0x7f0000176000-0x1)}) 2018/02/10 14:10:09 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r0, r0, &(0x7f0000049000), 0x3d2) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000008000)={&(0x7f000000f000-0xc)={0x10, 0x34000}, 0xc, &(0x7f0000220000)={&(0x7f00008d6000-0x14)={0x14, 0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, {}, []}, 0x14}, 0x1}, 0x0) r1 = userfaultfd(0x80800) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000ff8000-0x20)={{&(0x7f0000012000/0x2000)=nil, 0x2000}, 0x1}) bpf$MAP_CREATE(0x0, &(0x7f0000fb4000)={0x2, 0x8000000000000004, 0x400, 0x7fd, 0x4, 0xffffffffffffffff}, 0x2c) userfaultfd(0x800) clock_gettime(0x0, &(0x7f0000132000)={0x0, 0x0}) socketpair(0x1d, 0x800, 0x4, &(0x7f0000589000)) r4 = syz_open_dev$mouse(&(0x7f00006eb000)='/dev/input/mouse#\x00', 0xde6e, 0x1) timer_settime(0x0, 0x1, &(0x7f000097e000)={{0x0, r3}, {r2, r3+10000000}}, &(0x7f0000939000)) fanotify_init(0x25, 0x802) r5 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000ef2000-0x1d)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f00002d8000-0xc)={0x0, 0x0}, &(0x7f0000d76000-0x4)=0xc) syz_open_procfs(r6, &(0x7f0000013000)='ns/cgroup\x00') openat$ion(0xffffffffffffff9c, &(0x7f0000dd5000)='/dev/ion\x00', 0x800, 0x0) pipe2(&(0x7f000058c000), 0x4800) setsockopt$inet_IP_XFRM_POLICY(r4, 0x0, 0x11, &(0x7f0000e12000-0xe8)={{{@in6=@mcast1={0xff, 0x1, [], 0x1}, @in=@rand_addr, 0x2, 0xbd, 0xffffffffffffffff, 0x20, 0xa, 0xa0, 0x80, 0xbf, 0x0, r7}, {0x0, 0x8, 0x0, 0x3, 0x6, 0x1fa8, 0x8, 0x20}, {0x1719, 0x7fff, 0x7ff, 0x7ff}, 0x1, 0x7, 0x0, 0x1, 0x1, 0x3}, {{@in=@broadcast=0xffffffff, 0x1, 0x7f}, 0xa, @in=@empty, 0xffffffffffffffff, 0x3, 0x0, 0xffffffffffffffbc, 0x20, 0x6, 0x2}}, 0xe8) openat$selinux_policy(0xffffffffffffff9c, &(0x7f000010e000-0x10)='/selinux/policy\x00', 0x0, 0x0) setsockopt$netlink_NETLINK_TX_RING(r5, 0x10e, 0x7, &(0x7f0000ab4000-0x10)={0x6, 0x7, 0x52, 0xfffffffffffffffc}, 0x10) 2018/02/10 14:10:09 executing program 4: r0 = syz_open_dev$sndmidi(&(0x7f000004d000)='/dev/snd/midiC#D#\x00', 0x0, 0x800) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x3, 0x32, 0xffffffffffffffff, 0x0) getsockopt$inet_sctp_SCTP_GET_LOCAL_ADDRS(0xffffffffffffffff, 0x84, 0x6d, &(0x7f0000001000-0x1008)={0x0, 0x1000, "ecd6b7c8aad81b96c3b9f1c7f35ceaadd5ca3568cdc25e53b7f6a550dd8355cd7792331774c2acdf08323d851a92f4d3687a3959894e6ca9a2a38296cab2563597ca9e3a9ea7b7ba8219331487fe6a7fe1d1db85d972236101ea5cfa941eeafd3390f025b94be6e847ab096c8a75a2bb02920a6e9281175b8fcd8c53e0afcc7af5c449815042c5e673e9ccf200ca549471b217924a869212d7d66a095543b65ea202b8fae0c0175a5d805df321f181d39c1f8eb0ab8ad9e792d3f4c0beb1995eadb3a468e863b7dbf683483f853e6cae62e8882ab36dbc060397376b0f0a717353ceb946640d323e3ee2a2dfa560de854b853aef1471af524f6a8f046f854c38ecc5875e34aef3f2780298025edccdbdb0be735959e42088d7046416539432134ac7c2eeb982e7edbb4ee1c6834e3484945121c71735843327092e6da8509faab381151ef39eacfb5277bf2bfd3074c2a41aa572e491eb148c16ed46a079145d1a7dec9bc31bda1d5489ddca6b0dbdc1775b32ffa7d7fd4ab25f4f206c5fcfed575e9d24b2d3e52553a6108fc346af50c91c163adbc994c2cd15a7c8780e24c2966e9fe75843bbedd8e19d6fc5b63b3fc7c23b21de723a2871fdc126964b6b5cc69d566107db0bd6b580ccb6f9c3df49eb4a3525a8c56b491f81b3f399abbf8a35bb900e98e5b3531c854b4baa0eef6cf9fe90de9c548a78806ba7c5ed4e07353ce35e58914f8f8101e2898e6f7b897ec370d7745289bd9edf37a0e99581949caa72b06ac8284d3425c060338442765875321c9e4b62faa4ace747eacd5df23f9bc0a8250c1aacd2bd2feb270764243924473abc7c31cc33e0ee3fa037fae861995be3504a0027afce7ddee1a28b27ea274fe6b95e216f9114f9d9ba4dc0db3554ab72a7c153b7067df0e569b36133376790b727731f7c88c8d53cdb42197c461a6757b4e1938317dc012a2ec7e38e059472f378597ba5bcd834dc318dafb46fcfb7e8f46dc55b81d37b6a4b9b39066eeed10be8e21f379ba442d3ac66c53dd40e35cb86676eacdf33eb73b4bded3f303d4c4ddb952af88a29878ea08f606c916fb1f9709fb4aee8f8de5fc8b76e22a454cb930ae26a362155f5a2473f08da373167d9bfd70964b32127762628022ff685339c63d7842f51cb5d2c703ef6b6c9262f7980ab7da039874fc7ec4aabe23ec5d5b0bd96bb6cfb3d4d345aac549c11ffaba66e6b6f24443579f19e7c05b7991f0cb43c346b88ffb332943175d59e71b1ea3da03c460f2be0f5bf5d0981446f8676728adc4687df0fac5d8dba520be7b97dafaac5201bcfff88013a0bb6dc2061c0da3c45cda80f2ec947caa7db40a883810eb7943399f946b6ff473e4b712ccb02b78fcc6a100de1239bd6ab6a265ecc8cf6bdbcc8458a41b5d297f3151506f1246fa74ffc3179f5dab4ebc2e2b0d69fdd33a51f5118d06cc6f65357cba03454aad2d8e3d9dc20e6ba04f51423cae841aa2c9be5ee41eca221ac9c0a1e52c681668d828543538435d51b0fd1e78d64b1164135498bd74bd616a9d67e2d62afc8b70d15d536f521a42f14b43b51e01f21232d410c253d6edec6dba4d635d26082d61ff8f8280d037bd662871f10a2610bd0767d6582a0adc014651874ec2e14a4ce88880236ebbb1327df8cbbfcc1e0302e9b7fa58918440ffbd365f2df8c2f2ef33a2bdc9153fcbe3f283934f418757c4410253c6d7c768d0dabea56cfc567f76a3b6dd803c5adf220714c081a80c5d73da978e384718dfec68d4e38dfa28eef83b36add38500e607e9114b1705b306e49d8503bd3140d7a1f087bce51e8454993558d21c40ef10548f883030b3a6fec3c9f3f9e3e5bb09b50069f2f1b91b9ba4d930ebb1d8ae52e76ce126147f360fb4dedf4f03122866fa889d9fc1018cab1fff1d75f411601d265b73837ebbed161c228adc9831eeeff03f8cc235df635ebb52d10ac43479263800d1bacb16d03c85b96f7025ddc2f2bf1fc8a894f072794a8334e0194d46b0bec84a30f2ab655431d4f3406a36f720ada142a389e3a87b5e1eb313a1185559244567fb98ff08bdbd462a59a00d68975b0dea53fec8e388231804590c46d30a9213e21c0f5417752350a77b3e82ea5a3b27e7ace4d89063c4ac886bf6a63803a5b5447a143c65c0b9e2e788af808509662b89dcb8e91bcf048851e1de3e342d7c2eab0570ff96cc6574ae9c0babe54a7049037cf74370571a3cc6baaae4c3cd33727b10a55795d46b10a4fd700a8cb9b000dc128774ee5846af53cf121ab176124944cbcade7b8a8e4a41128781282c8c9b90e03d71f137c349b0b86a6a405a804f90cefee4637df185013ffed2feab40f1d183afe77ef6a55dd1b3a55e111044601cd7216b3b93dd6de7dd9d9e0ab82b4c303d172da7f0c5133246afcc414a11f8f507c19be5baae322f7577780631c6ee82cb58bef7361fbcd5acea804515fd737feb5e14e9a08f9aee5c831722d450f3ab20eee09e546dabd0dad9ea441cd823f3a76902dba34d7c96d10d7af727c0dc046262d73f54f45c90a0addf4c78fbf9bed91e3030d01016dc18b9a5a704f82ac407f1d76f1d601c523ed8667b175195198514f3a0f431b1bb0ef1b3c4a0360855f91ade368e1f91ce788270e084a2c14be3284a7bc2e5dbb300f052e26366aa0639da5f2304cfd72c5d6366917cbc04dbc193e470b501b74394ae2563f55aea4282781a8018473270c3089d35d6082227e5f2e5f723c574ace4d5cdc51ba8e20fede8be164b82fae3dbef0dbb31139ecfbee90433c4234fefca889eac4179aecb3ad724eaa10d8f3ce3b9f0ae3e4298995dd228fb7cef8f2cfb8abd82f435b62c14dbd09e3433c47b07a9c9c7d1acab349ddc4434c02950fc4b01d11af1ce1ac77d8b017e29b2008037f952d42b7d28d79d617b84fcab2eb640be06769776e65dad9201c863f8247fe86f8ca03928ea36d35c095c926e178790c1b2c0a63f3931fe5db5576590ca1db1a529c76a657a826a35809ef060f72a6e09077a56b02c9df4cc3409805b47bd914f24805e8201af7729711b88896e73380948b111c5bf71c305143b8ae1c861ee7971f29767d60af7ea1deeeb28fc2fe0cd8546e5d6d444af5ae14e4dd32943beff9743e754fdadcabc54389495d40d6b6d172a37cca48f0d30ea3c070dd4085a34c8e93c811a6dba1f4a92ec261ebf3bc6a89bef30141c4945412f90cac142c2499bcdc764529d5d7017647ba21ba218a5a481f31decd84bcb8444f9d35ba79c07431b3cfab312891970cc2c6be18607b00f949b09ffe4205c58a1a4a970dba0d1032c641af6c1abc27ba257fee680f2ff9260f12cd41b15b3fa6dba3e4ee2617b05df98da22d09b012958a4d237ab2b2cac51883679ecf54174d5935d01a7c84d458076506f05bc350d04299727507736e63988795619a15e988e8ba4dbad4b9e745002a6df3496b6a6187d4cacc763a23e2238afcdcf25c6209c0e8cf774a251ae19f9b722c76ce9d6a42419963a3411e1faba815b277819df68f86bb23160d20e93e64c987622f1a19f3dbe4168b67f98ce4426c3ace5c4af52ea1e96d1c7c8fc7e9411680a1f2f3c74e51577b628901eb766b96430860b9662e76685f7911650d59591edabc14fff486849c326202ab38494dbb5edf9be0411d9aba8d530085e4dd733a35dc65947d59133c66c565e5407622a471b9d8c50bfd61c79fe2accc7641d9c5171e769f8ba871b2a89f43296079db3a1a06bac7f531ab5627fa47df0c7dea11e174e70c66170b2134265deb3dd075cae1c97bdfd710c4e170fc003e72f6262b03975baab2afc932c6c6f0e5f2a9f4be8dd924c0e0bb9376a5e7c9d79a887a3223804a665110cf5b7557db9dc04da1645279390f356ff7bd727795892308ccc30d250e92567e266eeea3ab983205995ce5b8b373d3c8106203fe2287230261a21bb96f3b39a8be64e77af5d1fd25578561765006d7a481e5926b5bfe3f60c64573eecea442b08cb73f154a84088a24a10fadcab7c06463c421d5af913e015af39600d3450e037e86ad49bd8944d7dfb4fec931778e8a0627698b5f21c2b7bb4c7948bb4e0cc51e1ce8293df5eba81fa74ad3d6baef29de2b2c681374dc2f250d63ab9dc689bcefc3b6a2fa4129bd1de954e63a7127b0af18db41368fb27f7fe2e59ef1350456fe2cf19ff5264d85c367dd5ed601855693b859de774ddf7f4b21c73decba4b2ede0e2858b18ff01ef01901779798bf87e1ead8fa2c33a4255392c015ca0a52cfe26dc5e6e6f921ab9e2e5d220f977b10cce142a88bf0995c738da5502314faa792dcd83d2205aaadff3e94781b78fb217736ae0d95d770989884fc2f13bb49193ee489d3897ba9e77678bcf48cc434c96bafcd4c3534c26d53ab033ec7e4ab9b487a5089ce3b76806d95c1f34bc974b0edeca229d8857385ee5f56f0bcf9c6dfe18189f28d4a982d4dfe54d901217d832d7d95f98f4b4e45c7f9635ed3cb4173c5108d2f134cbe2aea84ecfe8bdee324767d17b628de1e9cf752c6b97bb7cb3aed16de40277706d523f09bbd63fd33661d9e0f9d6b6c67264adb8653fd62aaf7093b579c08d7c7baba66288205e2ebf68405087038be0cda2fd18de883feb0cba8161035e66a041aef355c3bf4a11b16b05369c52458ef48d7a1c5b9cdc246454393a8328d7d9a8d1a0167ca1103cf8e1d38c3a114bc8d25df22bfdfde6d89cb7ded8e8aaa552412fdeafd353f482b40d7b05b1f5dad8476aa839ecb87e2435b375a5278e5673a5cc93964b7b19aacbbfe4b787210f23dd723894e302f84723214d56698fad6abcb0b4fd5a7f6949e48c574ede5f0ccaa5e72c0ec237e44d1093a6c93df7e97d573e7d6a62e16932fa438e6e63cc1524e191d8185c0439ae262aa23c6d5406cb6fe51f51bf7310942d26256a23d62e92ec1219c39570b70c2528206c74c93571587cd94ae5d0eec8b882236a46b11e407edc71d11c5498f9edbba3aa802b1617c29c483b8c85aabaf5fe4845847c598e983fcd4d34e71f9f71a43a1f25fec71ddb2afb4009bbb5319dafe9c711f806cfde5afe23f53845d32ae9c4590753104da7e3ee19956779ef56ab555e8babe4f7a78a4beffc74091180dad9d9742187f5922a408a6ae6302f30f3c7903dd697ec4ade96e8a87ccac413f97d6899a77bb9f3c16b8016aa92ba6ea68c3e2fb6f6b6f444f077fe96240aedc2c4e4776609ab421d72fb579e8b20d3db808b9c9144004281eea156e12c12f781e8870b57737d2bcaedf75d08ab74acf4f4d4c9f5ab4f2a45ea8e6d7f0f8e92354eb492f87fb167cbf76763b7888f4f0d018ff5697e19ddc8131f382284f605199b065b8b8cf0ef171b41c9da42cb41458d1f1d1e1cffd737b8a3d338026e69c76c2c57fbecb6e0d749891374ba56015b8523f5ecb5498288d3608fefd654a221555397af74727b74bd76544357054b6b4a4b5c9343ddf094fccca1d5427699d80c68bce24c26a69ad00faf4685ba8c8601762bb9a07c730c469c27370aa4836a3e4ac915b040bdfaf50389c8a9c3a5f785b789e5605e07f5ed597e0d733f623d7f74d8d51937d6d2e4d3dbe318d80858c886da524e4105ea476fb3c5b2b0d44980b819f304e9ccd6182a2c609bf7c2dc396fb81a7b50ef645fd10a554fcea5ea4b6e54775067ffdf3334fdd6c8e40af9741d139fb325a893dac99f47f4a922f5c63f77dee6c5484b3275f091558f498387fed260a06e82c73f7756037868f5e"}, &(0x7f00006f7000-0x4)=0x1008) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) setsockopt$inet_sctp_SCTP_PRIMARY_ADDR(r0, 0x84, 0x6, &(0x7f0000001000-0x8c)={r1, @in6={{0xa, 0x2, 0x3, @empty, 0x4}}}, 0x8c) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) keyctl$dh_compute(0x17, &(0x7f00004cb000), &(0x7f0000dc6000-0x6f)=""/111, 0x6f, &(0x7f0000ed7000-0x2c)={&(0x7f00002e7000-0x40)={'cmac(tea-generic)\x00'}}) 2018/02/10 14:10:09 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000a5000-0x8)) mmap(&(0x7f0000000000/0x19000)=nil, 0x19000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000924000-0xc)='/dev/rfkill\x00', 0x0, 0x0) getsockname$packet(r0, &(0x7f0000e7e000-0x14)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @random}, &(0x7f0000ca5000)=0x14) r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000e54000-0x18)={0xaa}) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000008000-0x20)={{&(0x7f0000000000/0x4000)=nil, 0x4000}, 0x1}) readv(r0, &(0x7f00001f3000-0x10)=[{&(0x7f0000002000-0x4e)=""/1, 0x1}], 0x1) ioctl$RNDADDTOENTCNT(r0, 0x40045201, &(0x7f0000b27000)) openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f00005bd000-0x1d)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) ioctl$RNDADDTOENTCNT(r0, 0x40045201, &(0x7f0000a81000)) sendmsg$key(r0, &(0x7f0000808000)={0x0, 0x0, &(0x7f000062f000-0x8)={&(0x7f00003e2000-0xb0)={0x2, 0xa, 0x2, 0x7, 0x16, 0x0, 0x4, 0x3, [@sadb_address={0x5, 0x17, 0x32, 0xa0, 0x0, @in6={0xa, 0x2, 0x74f5d09f, @mcast1={0xff, 0x1, [], 0x1}, 0x7}}, @sadb_x_nat_t_type={0x1, 0x14, 0x4}, @sadb_x_nat_t_type={0x1, 0x14, 0xfffffffffffffffd}, @sadb_x_kmaddress={0x7, 0x19, 0x0, @in={0x2, 0x0, @loopback=0x7f000001}, @in6={0xa, 0x2, 0x1, @local={0xfe, 0x80, [], 0x0, 0xaa}, 0x5}}, @sadb_address={0x5, 0x7, 0xff, 0x20, 0x0, @in6={0xa, 0x0, 0xffffffffffff8001, @empty, 0x2}}, @sadb_x_nat_t_type={0x1, 0x14, 0x800}]}, 0xb0}, 0x1}, 0x40001) ioctl$UFFDIO_UNREGISTER(r1, 0xc020aa04, &(0x7f0000008000-0x4)={&(0x7f0000000000/0x2000)=nil, 0x2000}) [ 67.220799] binder: 11294:11296 transaction failed 29201/-22, size 56-8 line 3020 [ 67.233806] binder: undelivered TRANSACTION_ERROR: 29201 [ 67.248444] binder: 11297:11301 got transaction with invalid offset (32, min 0 max 56) or object. [ 67.258259] binder: 11297:11307 unknown command 0 2018/02/10 14:10:09 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000a000)={0x34e, 0x0, &(0x7f00001e5000-0x8)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000006000-0x54)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000-0x30)={0x44, 0x0, &(0x7f0000d06000)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x38, 0x8, &(0x7f000000d000)=[@fda={0x66646185}, @flat], &(0x7f0000006000)=[0x20]}}], 0x0, 0x0, &(0x7f0000176000-0x1)}) 2018/02/10 14:10:09 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = dup2(0xffffffffffffffff, 0xffffffffffffffff) ioctl$TIOCSETD(r0, 0x5423, &(0x7f000088e000)=0x10000) sched_setaffinity(0x0, 0x8, &(0x7f00007d2000+0x1c8)=0x20000524a) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000001000)='/dev/ptmx\x00', 0x2, 0x0) ioctl$TCXONC(r1, 0x540a, 0x0) write(r1, &(0x7f000001d000-0x2)="b6", 0x1) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000a61000)={r0, 0x28, &(0x7f000059c000)={0x0, 0x0}}, 0x10) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000850000-0xc)={r2, 0x0, 0x18}, 0xc) ioctl$TCXONC(r1, 0x540a, 0x1) 2018/02/10 14:10:09 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000a000)={0x34e, 0x0, &(0x7f00001e5000-0x8)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000006000-0x54)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000-0x30)={0x44, 0x0, &(0x7f0000d06000)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x38, 0x8, &(0x7f000000d000)=[@fda={0x66646185}, @flat], &(0x7f0000006000)=[0x20]}}], 0x0, 0x0, &(0x7f0000176000-0x1)}) [ 67.283158] binder: 11297:11301 transaction failed 29201/-22, size 56-8 line 3020 [ 67.284317] binder: undelivered TRANSACTION_ERROR: 29201 [ 67.293734] binder: 11311:11315 transaction failed 29189/-22, size 56-8 line 2842 [ 67.311654] binder: 11297:11307 ioctl c0306201 2000a000 returned -22 [ 67.320301] binder: 11319:11320 unknown command 0 2018/02/10 14:10:09 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000a000)={0x34e, 0x0, &(0x7f00001e5000-0x8)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000006000-0x54)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000008000-0x30)={0x44, 0x0, &(0x7f0000d06000)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x38, 0x8, &(0x7f000000d000)=[@fda={0x66646185}, @flat={0x73682a85}], &(0x7f0000006000)=[0x20]}}], 0x0, 0x0, &(0x7f0000176000-0x1)}) 2018/02/10 14:10:09 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = request_key(&(0x7f00006f8000)='syzkaller\x00', &(0x7f0000d92000)={0x73, 0x79, 0x7a, 0x2}, &(0x7f000089c000-0x3)='&$\x00', 0xfffffffffffffffe) keyctl$dh_compute(0x17, &(0x7f00004cb000)={0x0, 0x0, r0}, &(0x7f0000dc6000-0x6f)=""/111, 0x6f, &(0x7f0000ed7000-0x2c)={&(0x7f00002e7000-0x40)={'cmac(tea-generic)\x00'}}) [ 67.333856] binder: 11319:11320 ioctl c0306201 2000a000 returned -22 [ 67.336150] binder: undelivered TRANSACTION_ERROR: 29189 [ 67.344601] binder: 11319:11323 got transaction with invalid offset (32, min 0 max 56) or object. [ 67.367145] binder: undelivered TRANSACTION_ERROR: 29201 [ 67.376501] binder: 11326:11331 unknown command 0 2018/02/10 14:10:09 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000a000)={0x34e, 0x0, &(0x7f00001e5000-0x8)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000006000-0x54)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000008000-0x30)={0x0, 0x0, &(0x7f0000d06000)=[], 0x0, 0x0, &(0x7f0000176000-0x1)}) 2018/02/10 14:10:09 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000a000)={0x0, 0x0, &(0x7f00001e5000-0x8)=[], 0x0, 0x0, &(0x7f0000006000-0x54)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000-0x30)={0x44, 0x0, &(0x7f0000d06000)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x38, 0x8, &(0x7f000000d000)=[@fda={0x66646185}, @flat={0x73682a85}], &(0x7f0000006000)=[0x20]}}], 0x0, 0x0, &(0x7f0000176000-0x1)}) 2018/02/10 14:10:09 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000b93000-0x8)='trusted\x00', &(0x7f0000093000)={0x73, 0x79, 0x7a, 0x3}, 0x0, 0x0, 0xfffffffffffffff9) r0 = request_key(&(0x7f0000d39000)='big_key\x00', &(0x7f0000ff9000)={0x73, 0x79, 0x7a, 0x2}, &(0x7f0000cd9000-0x1)='\x00', 0x0) r1 = request_key(&(0x7f0000faf000)='trusted\x00', &(0x7f00009c5000-0x5)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000131000)='\x00', 0xfffffffffffffff8) keyctl$dh_compute(0x17, &(0x7f0000842000)={r1, r0}, &(0x7f0000dc6000-0x6f)=""/111, 0xffffffb6, &(0x7f00009cf000-0x2c)={&(0x7f00002e7000-0x40)={'cmac(tea-generic)\x00'}}) 2018/02/10 14:10:09 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000a000)={0x34e, 0x0, &(0x7f00001e5000-0x8)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000006000-0x54)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000-0x30)={0x44, 0x0, &(0x7f0000d06000)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x38, 0x0, &(0x7f000000d000)=[@fda={0x66646185}, @flat={0x73682a85}], &(0x7f0000006000)=[]}}], 0x0, 0x0, &(0x7f0000176000-0x1)}) [ 67.383856] binder: 11326:11331 ioctl c0306201 2000a000 returned -22 [ 67.403182] binder: 11319:11323 transaction failed 29201/-22, size 56-8 line 3020 [ 67.420452] binder: undelivered TRANSACTION_ERROR: 29201 [ 67.452652] binder: 11343:11344 unknown command 0 [ 67.453332] binder: 11339:11342 unknown command 0 [ 67.460438] binder: 11343:11344 ioctl c0306201 2000a000 returned -22 [ 67.471217] binder: 11338:11340 got transaction with invalid handle, 0 [ 67.471945] binder: 11339:11342 ioctl c0306201 2000a000 returned -22 [ 67.482327] binder: 11338:11340 transaction failed 29201/-22, size 56-8 line 3049 2018/02/10 14:10:09 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000dda000-0x12)='/dev/input/event#\x00', 0x0, 0x0) dup(r0) ioctl$EVIOCGRAB(r1, 0x40044590, &(0x7f0000e95000-0x4)) ioctl$TIOCSBRK(0xffffffffffffffff, 0x40044591) request_key(&(0x7f0000102000)='big_key\x00', &(0x7f0000ad3000)={0x73, 0x79, 0x7a, 0x3}, &(0x7f00006cc000-0x40)='deflate\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', 0xffffffffffffffff) 2018/02/10 14:10:09 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00007d2000+0x1c8)=0x20000524a) r0 = socket(0x11, 0x0, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000b0b000-0x20)={@empty, 0xef0a, 0x2, 0x2, 0x2, 0xca, 0xfffffffffffffb3d, 0x8001}, 0x20) r1 = openat$audio(0xffffffffffffff9c, &(0x7f000091e000)='/dev/audio\x00', 0x44000, 0x0) ioctl$KDGKBSENT(r1, 0x4b48, &(0x7f00003db000-0x4)={0x6, 0xfffffffffffffc00, 0x6}) ioctl$GIO_FONTX(r1, 0x4b6b, &(0x7f000048b000)) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000e93000-0xa)='/dev/ptmx\x00', 0x10002, 0x0) ioctl$TCXONC(r2, 0x540a, 0x0) ustat(0x1800000000000, &(0x7f00008f0000-0x14)) write(r1, &(0x7f0000adf000)="2a3a9a", 0x3) ioctl$TCXONC(r2, 0x540a, 0x1) 2018/02/10 14:10:09 executing program 5: sched_setaffinity(0x0, 0x8, &(0x7f00000a5000-0x8)) mmap(&(0x7f0000000000/0x19000)=nil, 0x19000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000924000-0xc)='/dev/rfkill\x00', 0x0, 0x0) r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000e54000-0x18)={0xaa}) write$selinux_access(r0, &(0x7f00003e5000-0x46)={'system_u:object_r:system_dbusd_var_lib_t:s0', 0x20, '/usr/sbin/cups-browsed', 0x20, 0x36, 0x37}, 0x46) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000008000-0x20)={{&(0x7f0000000000/0x4000)=nil, 0x4000}, 0x1}) readv(r0, &(0x7f0000fe2000-0x8)=[], 0x0) ioctl$UFFDIO_ZEROPAGE(r0, 0xc020aa04, &(0x7f00000d0000)={&(0x7f000063d000/0x7000)=nil, 0x7000}) ioctl$RNDADDTOENTCNT(r0, 0x40045201, &(0x7f0000b27000)) ioctl$RNDADDTOENTCNT(r0, 0x40045201, &(0x7f0000a81000)) ioctl$UFFDIO_UNREGISTER(r1, 0xc020aa04, &(0x7f0000008000-0x4)={&(0x7f0000000000/0x2000)=nil, 0x2000}) 2018/02/10 14:10:09 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000a000)={0x0, 0x0, &(0x7f00001e5000-0x8)=[], 0x0, 0x0, &(0x7f0000006000-0x54)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000-0x30)={0x44, 0x0, &(0x7f0000d06000)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x38, 0x8, &(0x7f000000d000)=[@fda={0x66646185}, @flat={0x73682a85}], &(0x7f0000006000)=[0x20]}}], 0x0, 0x0, &(0x7f0000176000-0x1)}) 2018/02/10 14:10:09 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000a000)={0x34e, 0x0, &(0x7f00001e5000-0x8)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000006000-0x54)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000-0x30)={0x44, 0x0, &(0x7f0000d06000)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x38, 0x0, &(0x7f000000d000)=[@fda={0x66646185}, @flat={0x73682a85}], &(0x7f0000006000)=[]}}], 0x0, 0x0, &(0x7f0000176000-0x1)}) 2018/02/10 14:10:09 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r0, r0, &(0x7f0000049000), 0x3d2) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000008000)={&(0x7f000000f000-0xc)={0x10, 0x34000}, 0xc, &(0x7f0000220000)={&(0x7f00008d6000-0x14)={0x14, 0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, {}, []}, 0x14}, 0x1}, 0x0) r1 = userfaultfd(0x80800) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000ff8000-0x20)={{&(0x7f0000012000/0x2000)=nil, 0x2000}, 0x1}) bpf$MAP_CREATE(0x0, &(0x7f0000fb4000)={0x2, 0x8000000000000004, 0x400, 0x7fd, 0x4, 0xffffffffffffffff}, 0x2c) userfaultfd(0x800) clock_gettime(0x0, &(0x7f0000132000)={0x0, 0x0}) socketpair(0x1d, 0x800, 0x4, &(0x7f0000589000)) r4 = syz_open_dev$mouse(&(0x7f00006eb000)='/dev/input/mouse#\x00', 0xde6e, 0x1) timer_settime(0x0, 0x1, &(0x7f000097e000)={{0x0, r3}, {r2, r3+10000000}}, &(0x7f0000939000)) fanotify_init(0x25, 0x802) r5 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000ef2000-0x1d)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f00002d8000-0xc)={0x0, 0x0}, &(0x7f0000d76000-0x4)=0xc) syz_open_procfs(r6, &(0x7f0000013000)='ns/cgroup\x00') openat$ion(0xffffffffffffff9c, &(0x7f0000dd5000)='/dev/ion\x00', 0x800, 0x0) pipe2(&(0x7f000058c000), 0x4800) setsockopt$inet_IP_XFRM_POLICY(r4, 0x0, 0x11, &(0x7f0000e12000-0xe8)={{{@in6=@mcast1={0xff, 0x1, [], 0x1}, @in=@rand_addr, 0x2, 0xbd, 0xffffffffffffffff, 0x20, 0xa, 0xa0, 0x80, 0xbf, 0x0, r7}, {0x0, 0x8, 0x0, 0x3, 0x6, 0x1fa8, 0x8, 0x20}, {0x1719, 0x7fff, 0x7ff, 0x7ff}, 0x1, 0x7, 0x0, 0x1, 0x1, 0x3}, {{@in=@broadcast=0xffffffff, 0x1, 0x7f}, 0xa, @in=@empty, 0xffffffffffffffff, 0x3, 0x0, 0xffffffffffffffbc, 0x20, 0x6, 0x2}}, 0xe8) openat$selinux_policy(0xffffffffffffff9c, &(0x7f000010e000-0x10)='/selinux/policy\x00', 0x0, 0x0) setsockopt$netlink_NETLINK_TX_RING(r5, 0x10e, 0x7, &(0x7f0000ab4000-0x10)={0x6, 0x7, 0x52, 0xfffffffffffffffc}, 0x10) 2018/02/10 14:10:09 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000a000)={0x34e, 0x0, &(0x7f00001e5000-0x8)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000006000-0x54)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000008000-0x30)={0x0, 0x0, &(0x7f0000d06000)=[], 0x0, 0x0, &(0x7f0000176000-0x1)}) 2018/02/10 14:10:09 executing program 4: socketpair$inet6_udp(0xa, 0x2, 0x0, &(0x7f00006e3000-0x8)={0x0}) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$sock_proto_private(r0, 0x89e8, &(0x7f0000002000-0x80)="2c5d844105af8cd27d05545d57edfaa813e5932fd608ad795c645b23c2fdb74e27c6da7f50de85bd358cf78055f5e416ae733b719112de4fe47d4ebbd50cdd4762949123a8841e8dce59f432972a9cd9e496997b31815156854f8142278eb8fc3c26492654a60b8b73967efb7cf2cff4527da832c08298d9ccc31bc1f1a9591d") mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r1 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000002000)='/selinux/policy\x00', 0x0, 0x0) mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffffff, 0x84, 0x6f, &(0x7f0000003000-0xc)={0x0, 0x90, &(0x7f0000002000-0x90)=[@in={0x2, 0x1, @broadcast=0xffffffff}, @in6={0xa, 0x3, 0x3, @ipv4={[], [0xff, 0xff], @multicast2=0xe0000002}, 0x6}, @in6={0xa, 0x3, 0x7, @mcast1={0xff, 0x1, [], 0x1}, 0x5}, @in6={0xa, 0x2, 0xff, @remote={0xfe, 0x80, [], 0x0, 0xbb}, 0x9}, @in={0x2, 0x3, @multicast2=0xe0000002}, @in6={0xa, 0x1, 0x1, @loopback={0x0, 0x1}, 0x9}]}, &(0x7f0000001000-0x4)=0xc) mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(r1, 0x84, 0x6c, &(0x7f0000002000)={r2, 0x1d, "4a92a38387fb9c5b316ddee823a09ebc912cd05d97334023f76be55356"}, &(0x7f0000001000-0x4)=0x25) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000001000-0xa0)=[{{0x0, 0x0, &(0x7f0000000000+0x6e)=[{&(0x7f0000c92000)=""/242, 0xf2}, {&(0x7f000075a000)=""/135, 0x87}, {&(0x7f000022b000)=""/11, 0xb}, {&(0x7f00002fd000)=""/110, 0x6e}, {&(0x7f0000f08000-0x45)=""/69, 0x45}, {&(0x7f000014e000-0x64)=""/100, 0x64}, {&(0x7f0000000000)=""/232, 0xe8}, {&(0x7f0000001000-0x82)=""/130, 0x82}, {&(0x7f0000001000-0xbe)=""/190, 0xbe}], 0x9, &(0x7f0000001000-0x26)=""/38, 0x26, 0x7}, 0x25}, {{&(0x7f0000f46000)=@alg, 0x58, &(0x7f0000001000-0x28)=[{&(0x7f0000000000)=""/181, 0xb5}, {&(0x7f000002f000)=""/151, 0x97}, {&(0x7f0000b7a000)=""/4096, 0x1000}, {&(0x7f0000662000-0x72)=""/114, 0x72}, {&(0x7f0000001000-0xa3)=""/163, 0xa3}], 0x5, &(0x7f0000000000)=""/227, 0xe3, 0xffff}, 0x2}, {{&(0x7f000016d000-0x58)=@alg, 0x58, &(0x7f0000001000-0x30)=[{&(0x7f0000001000-0xff)=""/255, 0xff}, {&(0x7f00001c3000-0x4f)=""/79, 0x4f}, {&(0x7f0000008000)=""/65, 0x41}, {&(0x7f000017d000)=""/173, 0xad}, {&(0x7f0000631000-0x10)=""/16, 0x10}, {&(0x7f000049a000)=""/251, 0xfb}], 0x6, &(0x7f0000000000)=""/45, 0x2d, 0x7}, 0x6}, {{&(0x7f0000001000-0x10)=@nfc, 0x10, &(0x7f0000000000)=[{&(0x7f00005ec000)=""/106, 0x6a}, {&(0x7f0000000000)=""/213, 0xd5}], 0x2, &(0x7f0000673000)=""/35, 0x23, 0x4}, 0x9}, {{&(0x7f0000ef0000-0x10)=@can={0x0, 0x0}, 0x10, &(0x7f0000ada000-0x8)=[{&(0x7f0000d24000-0x85)=""/133, 0x85}], 0x1, &(0x7f0000001000-0x1000)=""/4096, 0x1000, 0x7ff000}, 0x6}], 0x5, 0x10000, &(0x7f0000001000-0x8)={0x77359400}) r4 = geteuid() setsockopt$inet6_IPV6_IPSEC_POLICY(r0, 0x29, 0x22, &(0x7f0000a4c000)={{{@in=@rand_addr=0xb4, @in=@rand_addr=0x517, 0x3, 0x0, 0x2, 0x9, 0x2, 0x20, 0x80, 0x970a841ad3d2f254, r3, r4}, {0xffffffffffff0001, 0x8, 0x2, 0x6, 0x7f, 0x0, 0x2, 0x7}, {0x9, 0x3, 0x0, 0x100000000}, 0x0, 0xf, 0x2, 0x1, 0x0, 0x2}, {{@in6=@remote={0xfe, 0x80, [], 0x0, 0xbb}, 0x1, 0x2b}, 0xa, @in=@empty, 0x6, 0x4, 0x3, 0xe7f8, 0x10001, 0x9, 0xfff}}, 0xe8) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) keyctl$dh_compute(0x17, &(0x7f00004cb000), &(0x7f0000dc6000-0x6f)=""/111, 0x6f, &(0x7f0000ed7000-0x2c)={&(0x7f00002e7000-0x40)={'cmac(tea-generic)\x00'}}) [ 67.507327] binder: release 11343:11347 transaction 242 out, still active [ 67.514391] binder: undelivered TRANSACTION_COMPLETE [ 67.519559] binder: send failed reply for transaction 242, target dead [ 67.535104] binder: undelivered TRANSACTION_ERROR: 29201 [ 67.592346] binder: 11357:11360 Acquire 1 refcount change on invalid ref 0 ret -22 [ 67.599036] binder: 11358:11364 unknown command 0 [ 67.600213] binder: 11357:11360 unknown command 0 [ 67.605892] binder: 11356:11365 got transaction with invalid handle, 0 [ 67.611212] binder: 11357:11360 ioctl c0306201 2000a000 returned -22 [ 67.617059] binder: 11358:11364 ioctl c0306201 2000a000 returned -22 [ 67.630562] binder: 11356:11365 transaction failed 29201/-22, size 56-8 line 3049 2018/02/10 14:10:09 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000a5000-0x8)) mmap(&(0x7f0000000000/0x19000)=nil, 0x19000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000924000-0xc)='/dev/rfkill\x00', 0x0, 0x0) r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000e54000-0x18)={0xaa}) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000008000-0x20)={{&(0x7f0000000000/0x4000)=nil, 0x4000}, 0x1}) readv(r0, &(0x7f00001f3000-0x10)=[{&(0x7f0000002000-0x4e)=""/1, 0x1}], 0x1) ioctl$RNDADDTOENTCNT(r0, 0x40045201, &(0x7f0000f60000-0x4)) ioctl$RNDADDTOENTCNT(r0, 0x40045201, &(0x7f0000a81000)) mq_timedreceive(r0, &(0x7f0000633000-0x1000)=""/4096, 0x1000, 0x400, &(0x7f0000c5b000)={0x0, 0x1c9c380}) ioctl$UFFDIO_UNREGISTER(r1, 0xc020aa04, &(0x7f0000008000-0x4)={&(0x7f0000000000/0x2000)=nil, 0x2000}) 2018/02/10 14:10:09 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000a000)={0x34e, 0x0, &(0x7f00001e5000-0x8)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000006000-0x54)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000008000-0x30)={0x0, 0x0, &(0x7f0000d06000)=[], 0x0, 0x0, &(0x7f0000176000-0x1)}) 2018/02/10 14:10:09 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000a000)={0x0, 0x0, &(0x7f00001e5000-0x8)=[], 0x0, 0x0, &(0x7f0000006000-0x54)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000-0x30)={0x44, 0x0, &(0x7f0000d06000)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x38, 0x8, &(0x7f000000d000)=[@fda={0x66646185}, @flat={0x73682a85}], &(0x7f0000006000)=[0x20]}}], 0x0, 0x0, &(0x7f0000176000-0x1)}) 2018/02/10 14:10:09 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000a000)={0x34e, 0x0, &(0x7f00001e5000-0x8)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000006000-0x54)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000-0x30)={0x44, 0x0, &(0x7f0000d06000)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x38, 0x0, &(0x7f000000d000)=[@fda={0x66646185}, @flat={0x73682a85}], &(0x7f0000006000)=[]}}], 0x0, 0x0, &(0x7f0000176000-0x1)}) 2018/02/10 14:10:09 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00007d2000+0x1c8)=0x20000524a) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000001000)='/dev/ptmx\x00', 0x2, 0x0) ioctl$KDSKBSENT(r0, 0x4b49, &(0x7f0000500000)="22d8c31eb050d784a315c7bedc0268f0d7e3c9171319d88e2fdd92fcdcd02cdea31deeec40e157c24078fc7f2bef6fd3c83071ade9f0d046a03640f5923b7c9a945b6d190082739dfdf33be744d1c1341bb7f81621f5ef5025574ca3808049efc239ba30") ioctl$TCXONC(r0, 0x540a, 0x0) write(r0, &(0x7f000004a000)="00b972a43426a1259ed9d8d97d255bfdb44a45fd7cf00c73e13e52478d9556723b6ccbdb5fd9d5461b77ce1fc31af15a5a8ebbfbd066e56807abdfad18c45d7d538b22a6db08798a3cfc47fc6cc85dd5a64ce9b7536eebdfeccfee46f00f926ae68a5ca28918951d375584865d034eff2b8db719fa", 0x75) ioctl$TCXONC(r0, 0x540a, 0x7) [ 67.650934] binder: undelivered TRANSACTION_ERROR: 29201 [ 67.677474] binder: release 11358:11369 transaction 246 out, still active [ 67.684494] binder: undelivered TRANSACTION_COMPLETE [ 67.689673] binder: send failed reply for transaction 246, target dead 2018/02/10 14:10:09 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r0, r0, &(0x7f0000049000), 0x3d2) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000008000)={&(0x7f000000f000-0xc)={0x10, 0x34000}, 0xc, &(0x7f0000220000)={&(0x7f00008d6000-0x14)={0x14, 0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, {}, []}, 0x14}, 0x1}, 0x0) r1 = userfaultfd(0x80800) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000ff8000-0x20)={{&(0x7f0000012000/0x2000)=nil, 0x2000}, 0x1}) bpf$MAP_CREATE(0x0, &(0x7f0000fb4000)={0x2, 0x8000000000000004, 0x400, 0x7fd, 0x4, 0xffffffffffffffff}, 0x2c) userfaultfd(0x800) clock_gettime(0x0, &(0x7f0000132000)={0x0, 0x0}) socketpair(0x1d, 0x800, 0x4, &(0x7f0000589000)) r4 = syz_open_dev$mouse(&(0x7f00006eb000)='/dev/input/mouse#\x00', 0xde6e, 0x1) timer_settime(0x0, 0x1, &(0x7f000097e000)={{0x0, r3}, {r2, r3+10000000}}, &(0x7f0000939000)) fanotify_init(0x25, 0x802) r5 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000ef2000-0x1d)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f00002d8000-0xc)={0x0, 0x0}, &(0x7f0000d76000-0x4)=0xc) syz_open_procfs(r6, &(0x7f0000013000)='ns/cgroup\x00') openat$ion(0xffffffffffffff9c, &(0x7f0000dd5000)='/dev/ion\x00', 0x800, 0x0) pipe2(&(0x7f000058c000), 0x4800) setsockopt$inet_IP_XFRM_POLICY(r4, 0x0, 0x11, &(0x7f0000e12000-0xe8)={{{@in6=@mcast1={0xff, 0x1, [], 0x1}, @in=@rand_addr, 0x2, 0xbd, 0xffffffffffffffff, 0x20, 0xa, 0xa0, 0x80, 0xbf, 0x0, r7}, {0x0, 0x8, 0x0, 0x3, 0x6, 0x1fa8, 0x8, 0x20}, {0x1719, 0x7fff, 0x7ff, 0x7ff}, 0x1, 0x7, 0x0, 0x1, 0x1, 0x3}, {{@in=@broadcast=0xffffffff, 0x1, 0x7f}, 0xa, @in=@empty, 0xffffffffffffffff, 0x3, 0x0, 0xffffffffffffffbc, 0x20, 0x6, 0x2}}, 0xe8) openat$selinux_policy(0xffffffffffffff9c, &(0x7f000010e000-0x10)='/selinux/policy\x00', 0x0, 0x0) setsockopt$netlink_NETLINK_TX_RING(r5, 0x10e, 0x7, &(0x7f0000ab4000-0x10)={0x6, 0x7, 0x52, 0xfffffffffffffffc}, 0x10) 2018/02/10 14:10:09 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) setsockopt$inet_int(r0, 0x0, 0xa, &(0x7f000085e000-0x4)=0x4, 0x6c) r1 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000c76000)='/dev/qat_adf_ctl\x00', 0x40000, 0x0) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x1f, &(0x7f000059a000)={@remote, 0x0}, &(0x7f00004a6000-0x4)=0x14) ioctl$sock_inet6_SIOCSIFADDR(r1, 0x8916, &(0x7f0000944000-0x18)={@dev={0xfe, 0x80, [], 0x0, 0x12}, 0x101, r2}) r3 = syz_open_dev$vcsn(&(0x7f00002ee000-0xa)='/dev/vcs#\x00', 0x735b5e4d, 0x141000) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000520000-0xe8)={{{@in=@dev, @in=@multicast2, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@local}, 0x0, @in6=@mcast2}}, &(0x7f0000b26000-0x4)=0xe8) sendmsg$kcm(r3, &(0x7f000087b000-0x1c)={&(0x7f00008ce000)=@ll={0x11, 0x1f, r4, 0x1, 0x4, 0x6, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff]}, 0x14, &(0x7f00004e7000)=[{&(0x7f0000801000-0x80)="80c209b0233aa230f997dc8b1b2670373c6b6edbcfd5264121ace4c57e165b7aa6dbf9ebb650290c5d10355c82263fe28ca58bfcd4ae064f9e9f28097140faa3c0a74e579ea406d6df8c026dee9f8669a9e4dbfe5488f073cfca100a52a7643d79e6bf276ce637ecaa414e706e06646875c90aa7c3942e33f0e20b5a5c6a4130", 0x80}, {&(0x7f0000211000)="e0684d7ee48349136c0d8e6c38786bca24b2a4116a553761f26a4767a0d370b42749a42602ccda52a740023ea61630", 0x2f}, {&(0x7f0000d31000)="490583cf42170a34f7942d42e671e8b2ed02bcc21c6a45498481230f3592091966347975af8d684e5322488c8ba29b17b00cf41d097dfd78217d73d92c038fc1b73f40671e110c2683dfcf1d02b2566b53ff5cabe8f02a991b1a687868e4a5f2001c0a3f01a81c73572bf0a0c6eeabbdd55ed0ed361f5b4315ab2d1c92728e5436b2233870cd54b77f4ba39d3c1613742f633f5970346403fe52127edc2a023b47798002cb9504267914a9ffec25325e60c1af64e1b2f7a198dd5861d23e6160cfebbc0991a1ad607edcf08aefd0ba117d2077c66080fc5b0d01a8a63aecdf7ec3d7fda07dabd6", 0xe7}], 0x3, 0x0, 0x0, 0x800}, 0x4004084) syz_emit_ethernet(0x6e, &(0x7f0000d67000-0xca)={@link_local={0x1, 0x80, 0xc2}, @local={[0xaa, 0xaa, 0xaa, 0xaa], 0xffffffffffffffff, 0xaa}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x60, 0xffffffffffffffff, 0x0, 0x0, 0x1, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @dev={0xac, 0x14, 0x0, 0x13}, {[]}}, @icmp=@dest_unreach={0x3, 0x4, 0x0, 0x0, 0x0, 0x0, {0x11, 0x4, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x8000000000, 0x1, 0x0, @empty, @loopback=0x7f000001, {[@timestamp={0x44, 0xc, 0x0, 0x0, 0x0, [{[]}, {[]}]}, @noop={0x1}, @rr={0x7, 0x13, 0x0, [@broadcast=0xffffffff, @local={0xac, 0x14, 0xffffffffffffffff, 0xaa}, @rand_addr, @empty]}, @lsrr={0x83, 0xf, 0x0, [@rand_addr, @empty, @empty]}]}}}}}}}, &(0x7f0000490000-0xc)={0x0, 0x1, [0x0]}) [ 67.704011] binder: 11376:11378 transaction failed 29189/-22, size 56-8 line 2842 [ 67.716937] binder: 11379:11383 unknown command 0 [ 67.725769] binder: 11375:11384 unknown command 0 [ 67.726884] binder: 11379:11383 ioctl c0306201 2000a000 returned -22 [ 67.732442] binder: 11375:11384 ioctl c0306201 2000a000 returned -22 [ 67.762680] binder: undelivered TRANSACTION_ERROR: 29189 [ 67.792242] binder: release 11379:11388 transaction 251 out, still active [ 67.795615] QAT: Invalid ioctl [ 67.799347] binder: undelivered TRANSACTION_COMPLETE [ 67.807665] binder: send failed reply for transaction 251, target dead [ 67.822949] QAT: Invalid ioctl 2018/02/10 14:10:10 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$evdev(&(0x7f0000dda000-0x12)='/dev/input/event#\x00', 0x0, 0x0) ioctl$EVIOCGRAB(r0, 0x40044590, &(0x7f0000e95000-0x4)) ioctl$TIOCSBRK(0xffffffffffffffff, 0x40044591) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_inet_SIOCGARP(r1, 0x8954, &(0x7f0000ac2000)={{0x2, 0x2, @broadcast=0xffffffff}, {0x306, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff]}, 0x0, {0x2, 0x3, @empty}, @syzn={0x73, 0x79, 0x7a, 0x0}}) request_key(&(0x7f0000102000)='big_key\x00', &(0x7f0000ad3000)={0x73, 0x79, 0x7a, 0x3}, &(0x7f00006cc000-0x40)='deflate\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', 0xffffffffffffffff) 2018/02/10 14:10:10 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x2, 0x78, 0xe2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10001}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mremap(&(0x7f00003fb000/0x400000)=nil, 0x400000, 0x800000, 0x3, &(0x7f00007fb000/0x800000)=nil) r0 = openat$audio(0xffffffffffffff9c, &(0x7f0000aa8000)='/dev/audio\x00', 0x40000, 0x0) ioctl$EVIOCGABS0(r0, 0x80184540, &(0x7f0000850000)=""/86) mincore(&(0x7f0000479000/0x3000)=nil, 0x3000, &(0x7f0000260000)=""/213) 2018/02/10 14:10:10 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000607000)='/selinux/mls\x00', 0x0, 0x0) ioctl$KVM_GET_DEBUGREGS(r0, 0x8080aea1, &(0x7f0000240000-0x80)) sched_setaffinity(0x0, 0x8, &(0x7f00007d2000+0x1c8)=0x20000524a) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000001000)='/dev/ptmx\x00', 0x1, 0x0) ioctl$TCXONC(r1, 0x540a, 0x0) write(r1, &(0x7f000001d000-0x2)="b6", 0x1) setns(r1, 0xc000000) ioctl$TCXONC(r1, 0x540a, 0x1) 2018/02/10 14:10:10 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) keyctl$dh_compute(0x17, &(0x7f00004cb000), &(0x7f0000dc6000-0x6f)=""/111, 0x84, &(0x7f0000ed7000-0x2c)={&(0x7f00002e7000-0x40)={'cmac(tea-generic)\x00'}, 0x0}) r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000117000)='/dev/cuse\x00', 0x0, 0x0) ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffffff, 0xc0106434, &(0x7f0000d82000-0x10)={0x4, 0x0, 0x10000, 0xf21c}) ioctl$DRM_IOCTL_AGP_FREE(r0, 0x40106435, &(0x7f0000709000)={0x89, r1, 0x1, 0x4}) getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(r0, 0x84, 0x6c, &(0x7f00002bd000-0x1008)={0x0, 0x1000, "18df236fb88f62ca8b92b30cc32548733a203146a151b14acaf10bfabc094bc8fffc21464ab43d944f62bcc81713c7e07860a3aa445975f64eedd029c1381c77b5e3c25cf5ccfe9c6aaa07c98d6be084b9d0568311071c30c43b9cb054b3ab94e72bfda6691ef9fedc14518805b25e12d17bc9be7128b46393a2a694d503d82a29b0256d51ff5d37b9aaa7a13c2c47c402a266f002b562e878eae633de8fea5f2822cc1f0704c6f79c7bda498580a8c6b0bc6193141f6de1bd9b34a4ebe7e136e52c0f1d5a1b04bf0ea7b21c1d455098cc219bf0881ac302e874853655650fb55a7fcd308b7c6ac8794825893773b97158179760f908af94781074d8cca5cf28055af2b24a399642b09b299b3999fac29a992609eed1e198fd2c0fab57b9915f4797666891955e610c63122db7b2434ecb7054209e03ebbadb897d264d31f834e6339b12ef9f9c0e9d9b53e9937656660a596649589128300a49922b692b2871b1892eeeb7522b149ba98ef34352577cc294b00fd826fed7c3ea5750f50118b7ac9643a130cc12041b6b3017466698f666713ad26776dc8e8d4ac03b3dca52020a76f2b462cdb53496bcdef2d540e467815123c999d98256081fd001d51b4bd031173f8f9f64cd7c587c688a03b9ac36379080572c6b0ed4e660065aa6abbafb7e672e6d3cc11f71778a4035d1d110e3c6a479f4af208454801a4986a52fca82a054001af4f62fb14deb7a0a637d3b79f5fa2755bacd21f4cf781263615fcf9c620e2f71d79e3daeeb7200dce14050f56b867a89b5c09863b9822bb4fd29799ea887970a79517e1a2f335238c319bd724b0917b29ba0cee83c6176d6ff000d6e462ec91fd8bb5bb3c2be555550b29f6392e2d0cf3f689cf506a6a44bfc8f1a5778e3dbfac315bb4e397fb36e63bce191174f4188faa6c261f2eb95f14f62de4ed928ce2f9f6613463995134ea71e4f0bd260fa04bb7ffd796f326c33a580d4cb927ff78de892d85e6a5aa8d6b3332d1c4cfad6b0b753c8601efe103d8ddbe4d5e75dfed15789a3c87f8d014386ee6fbc9de55731239faa985b5ebe1ec4bb30390693c380f8751821cf5b63cf064df57a3f01e7153a61d7ed4c818f65f145b320a504188170be8c2f9c819430a8b2f79cbefefeb78c9aa0252270a95641f0f5aa7439b60506208811abde0b6327b79ad2b63fe7911229e5f72ba40c1ede9241c3cd3ebb61eb31e37f8466fdb070f9c2a8076d37b8f0ba5358e0d269ac0fe211e7faf94b62659dc9a85918d35bfd40dee5c7cd047afdafd096d7b7a6009f5cf1c8c4b361302897b55ffc46d52968a6c9e8a7407226c1c7961d8fcbc07d79cf900095014eb156e7949823fe26b085fdfd9660428ed0b3e6699b49c2aa9dd7cbead9b28f9b067dca57e3cc4f1656a326d14b47212f6548331830123fc93f0dd8f17a339099baffd8d340543a50935fa922b28a2a5c5c5a7acb2041a05c38ea521e26917e91867908de3069b40c921f9d7bebb0255b44ed7f92728fa2db3adc62ad7603ed6c3b79ab0c17b063a67b2751d4bb4fed2d66268a74092bf565b192f1393b26b65adc8742da33e2a5ae6f9c190c37bef493752e0d26b2f797c95e0f409625b637df0e562d683ecbe1ae4bec5fd77d6d74820122fd01832b84cdd18477df866d5ed87ecb7cc900ca2af069195dcf3dd2db66fcd0f680f2c1731cd42976141016705f4ae11d7b59dce5211130193322e266d18e19f3dd9a3fc74a233f9f54767a3c3c52e66e35a31bfc310e5ab95c0229f31795ad402c49cf614165b98174ab731551cecb5b7a51c6268d715d5ce4c4da2d955539fd524373c16df5143374b53181b745ef32d9367ae9760f6b186e6a20672f49da4169fc2f7af2996d04736248aef7b3ce9047120091e562294c1f4b5b5b1e8fdb234368766e826b36588bda4e136e26db3fac43648fc46cfe876b783c0ecb953d5f2f27b5710ba0b54f3ab13bd6760434bb3cc2348bc7711006dc5523b5ee6ba8f7538baf7537ef3be10a4cb6247a8821ab0fad6137e8f4881e4995c654f0eba7b173f4a4d648cefc5b219c7b8d3d512eb3750458be238cceec1e1c7d4e28500535765c2c459130f342012d1b2ec8362be29c36b3122247631e851c437eb63a02b6050c5ac1fcd16b4b8220b68a23402c62a0288fa48aa90c836a1bebe63c139662790a1d86a30741ed5c79c529deeb3ccd9675429a71f2f311cad5f8c0516b2c59ce22f925874eda56f121f9bb6ead143225354c45d196bf3f4fba84771440e7e7c15951cad1f33a1ac652dcf4151d68ae6498a2c602e114590b1505ab70c8a1a760ede4c0c8afbe1cadfdf7ce95459e1c9099dcc1042b3d303aebd7971b6483c72ecc6510c5a4d4be7ddf428ff16817b40f03ee55f05f410f9d593ae48aa11396b43aa2c7e87be5c25a704b2130772d82e4559a5346e5e80892df910e036c5f54656c9c211c32cc6411d5545c5c7e7e6e73413ddb917e90cbbf6ea29e2fea342d66c7bb80e4a7bf42a4f27b1cfd82b7ccb7cf364a2b162f3a8954fc1c87f336ac54619cac79b3202093818b4b301e3012bc55ef3f97d32174103fe096b7f7df1a68d53d8cbdb19148884411351237da61fdea1e2a34e20837591a1411511ced407bf4968dab8a1834ebc3d0d546df9c61388780df3b2f4f1fdea07f714a4f1abaf2d8590fbc1714890e3c97bcf15ffb7adedbd65bcf34c72d87ce6527176f860719bf13ce5a7230b193839acf4ae9f4cbd92f5e4a72eff0f309d93b611ecc8b5b1c857270c027b8cceaec6ca80b66e1bfda18ca6733e702513b967f17b76ed75da999c7a6f3fb3423b9cdb5081237279c1799f763922d39a9b9348a42c80576d1f923b775cbcc5f9a1776931d27519643dac8fea3756dc608d76b476b07a5332ac15ba57f19277150d704e23a6eb5a7acb1ac1fbf39479f3e3d10cfb49b3653a66ee89b81708b1522a22b6da8cde3da7b501ce860d320cf1764cbc3c86f15eee06e57ab1bfb9f2d8a580fa538517e7e8e690b992137b70e8250d6a90ce8dd41156b560d23e67d1dac98a4ca5e5d871db0303472cb01af29de5e07fde9281db9ca9dd7015ea9aa8ab84e8089d4d42ba1ab3c6504e4651ab2806c17fbae0f32d1b5242af9303ead0ab646e6ce517f877bf0f3bf4b7451d480c3e2ef98dc71ac0e41adbed89216f204b04f3365145c558a67f6855accd2312b6f0e9165d06c96fe56687ca9bd0866ebb688fcc37caadfba85d5e878a7d50cdcfdf4515a1ebf3be74a7e7d8fe61e5b2f2079238c78e3352718805bafec64022f042f6813e6a6cd0a0c194dcd3cf106acb114916d2b3319a4c7e8acc42cff0056d59144c99d93011040430b9dcc0792637409e0e8c14a27e1a5afa4a2d7312bdab6df542c2c2c882ad2ef05b812d457d8a103dc21da2a19effe6b5b95a5f708f12dec793b82553ca186866ec0307d93f7b123703c0f21037fb7b4bb023540b1e1e4d36292daf0c26b1da0d3f2af6f7d4f9d433ced428dab93093ca409355f8ecce957c55718a19a416dc94dce088b665e8fff79ac893c6d27ec1d8419a7c6dd1f8b7eb55a7c84e35ca3270954b53e02e3bff3a860afba6061d785c7c71cadf85af58fc45de248363ad70a475839ce8dd9c6e960fa6585a0fbc26248e5c3cd21ac6bb7f93b43e6bb92d1b14702a2e79925e9d1e571261ece6921a611b160692baf65e59fd43531a9ea9eea9f228ff95f9b6e4b2562f1ef2945eb0841ae1239cd9b3bdf514bf0667e51a2015524bbfea37bb1bbc28e9ae2d334dc7e0fc4f159749616b2d390bd117dbf5ee607dc05310d2a93585a21086530b8f1a26ece94504dab5c7de738ac240fe3ed0e60d7fdd46e3c39f4799be3586e50d42939f429677dff9f74ed48d61fcfc1ff604ac8f0b27c3b658d2123b59fbe4b72a13b19d0b7b545bd96fc63d4a7f637c4c41ee2c35151966d0b08892fa7268f99092beeb9d0f1824fd7ee566fe28b1686027ef705c9b7aea0db5d15dc6ac3272d9655bcaa0e4e50bbb5813d6b1293e2a8803bdbfcb5d2d1fc9e1c0e9898712288570c13d4d31309337a36b5ddbc1c24d29e4fceb9c754e13861a91b7f14eb2ec0866246f79bd55c8fc0a643212cd774c3699828cd6d69ed155f6bc92f258e96d1feb04289bd2ea7aa1acea83568eddf4e294c4bb6f80525aaa71fffc3d6b544a70aaa34dc0688e3bcd822f7b50a7671fbfc403bd627b4c1b53c65a883d306b59392b0370828ae251b8e20a6c76c834140dae24bc9803f1f037b96c873ef0ecd2c5bf5f0c0f9a4a927dec8a379f24045d1e0626c9664af66682dd20c84d826adec7fc653237433366ad09ee37af113442f6cfcdb5d361f8ec68cc430e41b7695522b0cb4569395a005663376b676ab31f07b645d48106cde5035610b7ad93980ff2c9ae3a1dad55d50b1f998927cf4154a92acc152d7b6d2fcdcdbe6703e1ef4a999656b7cb1214971fcbf8c64b54fc23808de9c1584759c46efba0cc9c22799d70c4e5bf6ee1ad4a40e9bafafeab85f481900532923e31779908bf4c603d10f855fdbacb5e1a76b0b497c55306cc1532e462d3a2e3ca1f62ee13a14e6df4f617a3dab5274a3c3efa00688550e0224a8b7e9b76c36aca45fe0de1dbb899aa160bf509fd3a53e1655d1d60b53daf0af6cb43438fb21cd2337028100d109aaaa31e83faff7bce30f0ce34f667e3193bc14bc4d57c42791b16c2ae36b823be942e86e68612542db36be03b4d59b50b3dc75f69df4fd67d3cefa2e278ae81575c11ed22c943515fd5529744c9836b27011fd451d0f5d35f3704268583b2840b90b8e1e75806592435a06a9eb324bc8fc54a4f728916a353360c125cf129bf627dd7c588ec489aa64d43051c72d261e5da4cf1a13e74b11c8c01673c11c3347210d40b7542cd5273c2c1792b04569b1e328a4add52e947309c3dfcdb465fb691c9b81da918d24d5039830b6d5255c40bd5312cb126579c0dd91d84f0ccfb87b9c98f6a6682b402964534f7aaf8752237679ef890c9c55cbab63c1fdf1d5ce2a903556775f691401a9b0df102579b5dc7f1ba62e287a851e71a5c44948f8ea51374950a66c8560edd6b7cdfb4b8a32eebf2a83c250b32aa682fa3a39997d488b5e8109d1eb8db4f60b7df6d9f6cb03db55bb92ff35982a99c563be5747591c0fd91efd7d0b7132d26829db13073cb61a54fd3afa1a51de9cb1d220926e1b17663f91a7cf03dce7fecad366275945c911a258cdf7bdeb0d9a17422566b3d3a7ff58dea3fcb4f68825e62511c86c59afaf3c3657d363167fadde0e28f36e96b6a8cfd8d13e1241aa46945335dc8c40c9b1b8ded389b82ea2a84a9fdf2071e1ee1e67572b1e1a6e5c67dab236e7eabb7fa233fce10fa6bb55630d7ccddf06a34e56f586ff4e65b9513773166f0a7a46063bebe4649da4999750a2a0dfc14b3960952be195e3da7bef29e16045cad19e06ec76df013a5dd8bb0c913697ab180713cc8f1fead461245968bdd8cb1045ed57383acb363d09e7ae821a427f77d9c8d4ad8687a3d2ae2c550ea8d1470ebdc68bb0cbedda4bd4cf98c483d553bf7e89779f5d3c6ba25b4094b9d36fd6d568096bcb42b48744c30143bbcdc5018eb1425a3ed2c02bf98cf2010af041b771feea8518105523c10b122b7c95298e6a04959a68bbca55cd53c8a9c307e4b81326b95fb2fc73cffacf7d76dda7567904ee2736f18f3537614e42d9067d7bf1a74d97004cc237713e06657f2428f125f7041d"}, &(0x7f0000794000)=0x1008) getsockopt$inet_sctp_SCTP_RESET_STREAMS(r0, 0x84, 0x77, &(0x7f0000e90000)={r2, 0x8000, 0x6, [0x2, 0x3, 0xffffffff, 0x80, 0x8, 0x8]}, &(0x7f0000feb000-0x4)=0x14) openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000eb2000-0x11)='/dev/qat_adf_ctl\x00', 0x4000, 0x0) r3 = getpgid(0x0) ptrace$getenv(0x4201, r3, 0x7, &(0x7f0000489000)) 2018/02/10 14:10:10 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000a5000-0x8)) mmap(&(0x7f0000000000/0x19000)=nil, 0x19000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000924000-0xc)='/dev/rfkill\x00', 0x0, 0x0) getsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f000040c000-0x14)={@dev, 0x0}, &(0x7f00001d4000)=0x14) r2 = geteuid() setsockopt$inet6_IPV6_IPSEC_POLICY(r0, 0x29, 0x22, &(0x7f0000f6e000-0xe8)={{{@in6=@mcast1={0xff, 0x1, [], 0x1}, @in6=@mcast1={0xff, 0x1, [], 0x1}, 0x1, 0x0, 0x3, 0x0, 0xa, 0x80, 0xa0, 0xbf, r1, r2}, {0x2, 0x9, 0x4, 0xba, 0x76c, 0x10000, 0x0, 0x8}, {0xaa6, 0x2, 0x4, 0x3}, 0x5, 0x2, 0x0, 0x1, 0x3}, {{@in6=@loopback={0x0, 0x1}, 0x2, 0x3f}, 0x2, @in6=@mcast2={0xff, 0x2, [], 0x1}, 0xffffffffffffffff, 0x1, 0x3, 0x2, 0x7ff, 0x7ff, 0x6}}, 0xe8) r3 = userfaultfd(0x0) ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f0000e54000-0x18)={0xaa}) ioctl$UFFDIO_REGISTER(r3, 0xc020aa00, &(0x7f0000008000-0x20)={{&(0x7f0000000000/0x4000)=nil, 0x4000}, 0x1}) readv(r0, &(0x7f00001f3000-0x10)=[{&(0x7f0000002000-0x4e)=""/1, 0x1}], 0x1) ioctl$RNDADDTOENTCNT(r0, 0x40045201, &(0x7f0000b27000)) ioctl$RNDADDTOENTCNT(r0, 0x40045201, &(0x7f0000a81000)) ioctl$UFFDIO_UNREGISTER(r3, 0xc020aa04, &(0x7f0000008000-0x4)={&(0x7f0000000000/0x2000)=nil, 0x2000}) 2018/02/10 14:10:10 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000a000)={0x34e, 0x0, &(0x7f00001e5000-0x8)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000006000-0x54)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000-0x30)={0x44, 0x0, &(0x7f0000d06000)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x38, 0x8, &(0x7f000000d000)=[@fda={0x66646185}, @flat={0x73682a85}], &(0x7f0000006000)=[0x0]}}], 0x0, 0x0, &(0x7f0000176000-0x1)}) 2018/02/10 14:10:10 executing program 6 (fault-call:2 fault-nth:0): mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000a000)={0x34e, 0x0, &(0x7f00001e5000-0x8)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000006000-0x54)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000008000-0x30)={0x0, 0x0, &(0x7f0000d06000)=[], 0x0, 0x0, &(0x7f0000176000-0x1)}) 2018/02/10 14:10:10 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r0, r0, &(0x7f0000049000), 0x3d2) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000008000)={&(0x7f000000f000-0xc)={0x10, 0x34000}, 0xc, &(0x7f0000220000)={&(0x7f00008d6000-0x14)={0x14, 0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, {}, []}, 0x14}, 0x1}, 0x0) r1 = userfaultfd(0x80800) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000ff8000-0x20)={{&(0x7f0000012000/0x2000)=nil, 0x2000}, 0x1}) bpf$MAP_CREATE(0x0, &(0x7f0000fb4000)={0x2, 0x8000000000000004, 0x400, 0x7fd, 0x4, 0xffffffffffffffff}, 0x2c) userfaultfd(0x800) clock_gettime(0x0, &(0x7f0000132000)={0x0, 0x0}) socketpair(0x1d, 0x800, 0x4, &(0x7f0000589000)) r4 = syz_open_dev$mouse(&(0x7f00006eb000)='/dev/input/mouse#\x00', 0xde6e, 0x1) timer_settime(0x0, 0x1, &(0x7f000097e000)={{0x0, r3}, {r2, r3+10000000}}, &(0x7f0000939000)) fanotify_init(0x25, 0x802) r5 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000ef2000-0x1d)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f00002d8000-0xc)={0x0, 0x0}, &(0x7f0000d76000-0x4)=0xc) syz_open_procfs(r6, &(0x7f0000013000)='ns/cgroup\x00') openat$ion(0xffffffffffffff9c, &(0x7f0000dd5000)='/dev/ion\x00', 0x800, 0x0) pipe2(&(0x7f000058c000), 0x4800) setsockopt$inet_IP_XFRM_POLICY(r4, 0x0, 0x11, &(0x7f0000e12000-0xe8)={{{@in6=@mcast1={0xff, 0x1, [], 0x1}, @in=@rand_addr, 0x2, 0xbd, 0x3, 0x0, 0xa, 0xa0, 0x80, 0xbf, 0x0, r7}, {0x0, 0x8, 0x0, 0x3, 0x6, 0x1fa8, 0x8, 0x20}, {0x1719, 0x7fff, 0x7ff, 0x7ff}, 0x1, 0x7, 0x0, 0x1, 0x1, 0x3}, {{@in=@broadcast=0xffffffff, 0x1, 0x7f}, 0xa, @in=@empty, 0xffffffffffffffff, 0x3, 0x0, 0xffffffffffffffbc, 0x20, 0x6, 0x2}}, 0xe8) openat$selinux_policy(0xffffffffffffff9c, &(0x7f000010e000-0x10)='/selinux/policy\x00', 0x0, 0x0) setsockopt$netlink_NETLINK_TX_RING(r5, 0x10e, 0x7, &(0x7f0000ab4000-0x10)={0x6, 0x7, 0x52, 0xfffffffffffffffc}, 0x10) [ 67.968131] FAULT_INJECTION: forcing a failure. [ 67.968131] name failslab, interval 1, probability 0, space 0, times 0 [ 67.971423] binder: 11411:11413 unknown command 0 [ 67.979460] CPU: 1 PID: 11416 Comm: syz-executor6 Not tainted 4.15.0+ #217 [ 67.987219] binder: 11411:11413 ioctl c0306201 2000a000 returned -22 [ 67.991240] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 67.991245] Call Trace: [ 67.991262] dump_stack+0x194/0x257 [ 67.991282] ? arch_local_irq_restore+0x53/0x53 [ 67.991327] should_fail+0x8c0/0xa40 [ 68.002964] binder: 11411:11422 got transaction with invalid parent offset or type [ 68.007164] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 68.007193] ? lock_release+0xa40/0xa40 [ 68.007229] ? find_held_lock+0x35/0x1d0 [ 68.011577] binder: 11411:11422 transaction failed 29201/-22, size 56-8 line 3080 [ 68.013452] ? trace_event_raw_event_sched_switch+0x810/0x810 [ 68.013462] ? lock_downgrade+0x980/0x980 [ 68.039548] binder: undelivered TRANSACTION_ERROR: 29201 [ 68.042585] ? rcu_note_context_switch+0x710/0x710 [ 68.042600] ? lock_release+0xa40/0xa40 [ 68.042627] should_failslab+0xec/0x120 [ 68.078673] kmem_cache_alloc_trace+0x4b/0x740 [ 68.083232] ? __sched_text_start+0x8/0x8 [ 68.087379] binder_get_thread+0x1cf/0x870 [ 68.091597] ? binder_inc_ref_for_node+0xbc0/0xbc0 [ 68.096514] ? trace_event_raw_event_sched_switch+0x810/0x810 [ 68.102403] binder_ioctl+0x20c/0x1417 [ 68.106271] ? retint_kernel+0x10/0x10 [ 68.110146] ? binder_ioctl_write_read.isra.38+0xcb0/0xcb0 [ 68.115759] ? retint_kernel+0x10/0x10 [ 68.119647] ? __inode_security_revalidate+0x101/0x130 [ 68.124913] ? selinux_file_ioctl+0x444/0x690 [ 68.129392] ? selinux_capable+0x40/0x40 [ 68.133430] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 68.138177] ? retint_kernel+0x10/0x10 [ 68.142057] ? security_file_ioctl+0x7d/0xb0 [ 68.146442] ? security_file_ioctl+0x89/0xb0 [ 68.150837] compat_SyS_ioctl+0x151/0x2a30 [ 68.155050] ? do_fast_syscall_32+0x156/0xfa1 [ 68.159523] ? binder_ioctl_write_read.isra.38+0xcb0/0xcb0 [ 68.165126] ? do_ioctl+0x60/0x60 [ 68.168559] do_fast_syscall_32+0x3ee/0xfa1 [ 68.172873] ? do_int80_syscall_32+0x9d0/0x9d0 [ 68.177434] ? finish_task_switch+0x1e2/0x890 [ 68.181903] ? finish_task_switch+0x1b9/0x890 [ 68.186384] ? syscall_return_slowpath+0x2ac/0x550 [ 68.191296] ? prepare_exit_to_usermode+0x350/0x350 [ 68.196291] ? sysret32_from_system_call+0x5/0x3b [ 68.201120] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 68.205953] entry_SYSENTER_compat+0x54/0x63 [ 68.210338] RIP: 0023:0xf7ff5c79 2018/02/10 14:10:10 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000a000)={0x34e, 0x0, &(0x7f00001e5000-0x8)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000006000-0x54)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000-0x30)={0x44, 0x0, &(0x7f0000d06000)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x38, 0x8, &(0x7f000000d000)=[@fda={0x66646185}, @flat={0x73682a85}], &(0x7f0000006000)=[0x0]}}], 0x0, 0x0, &(0x7f0000176000-0x1)}) 2018/02/10 14:10:10 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) keyctl$dh_compute(0x17, &(0x7f00004cb000), &(0x7f0000dc6000-0x6f)=""/111, 0x6f, &(0x7f0000ed7000-0x2c)={&(0x7f00002e7000-0x40)={'cmac(tea-generic)\x00'}}) r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000702000)='/selinux/enforce\x00', 0x0, 0x0) ioctl$TIOCMGET(r0, 0x5415, &(0x7f00000e0000)) socketpair$inet6(0xa, 0x803, 0x1, &(0x7f0000705000)) 2018/02/10 14:10:10 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00007d2000+0x1c8)=0x20000524a) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000001000)='/dev/ptmx\x00', 0x2, 0x0) ioctl$TCXONC(r0, 0x540a, 0x0) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000258000)='/dev/audio\x00', 0x60c000, 0x0) ioctl$SNDRV_TIMER_IOCTL_TREAD(r1, 0x40045402, &(0x7f0000b87000)=0x1) write(r0, &(0x7f000001d000-0x2)="b6", 0x1) ioctl$TCXONC(r0, 0x540a, 0x1) [ 68.213680] RSP: 002b:00000000f77f109c EFLAGS: 00000286 ORIG_RAX: 0000000000000036 [ 68.221368] RAX: ffffffffffffffda RBX: 0000000000000013 RCX: 00000000c0306201 [ 68.228615] RDX: 000000002000a000 RSI: 0000000000000000 RDI: 0000000000000000 [ 68.235862] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 68.243108] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 [ 68.250354] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 2018/02/10 14:10:10 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000a000)={0x34e, 0x0, &(0x7f00001e5000-0x8)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000006000-0x54)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000-0x30)={0x44, 0x0, &(0x7f0000d06000)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x38, 0x8, &(0x7f000000d000)=[@fda={0x66646185}, @flat={0x73682a85}], &(0x7f0000006000)=[0x0]}}], 0x0, 0x0, &(0x7f0000176000-0x1)}) [ 68.287878] binder: 11431:11433 unknown command 0 [ 68.298527] binder: 11404:11416 ioctl c0306201 2000a000 returned -12 [ 68.301636] binder: 11431:11433 ioctl c0306201 2000a000 returned -22 [ 68.325258] binder: 11431:11439 got transaction with invalid parent offset or type [ 68.333854] binder: 11431:11439 transaction failed 29201/-22, size 56-8 line 3080 [ 68.352627] binder: BINDER_SET_CONTEXT_MGR already set [ 68.358110] binder: 11442:11443 ioctl 40046207 0 returned -16 [ 68.365308] binder: 11442:11443 unknown command 0 [ 68.365474] binder: undelivered TRANSACTION_ERROR: 29201 [ 68.370331] binder: 11442:11443 ioctl c0306201 2000a000 returned -22 2018/02/10 14:10:10 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000a000)={0x34e, 0x0, &(0x7f00001e5000-0x8)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000006000-0x54)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000008000-0x30)={0x0, 0x0, &(0x7f0000d06000)=[], 0x0, 0x0, &(0x7f0000176000-0x1)}) r1 = creat(&(0x7f00008b5000)='./file0\x00', 0x48) getpeername$inet6(r1, &(0x7f0000982000)={0x0, 0xffffffffffffffff, 0x0, @mcast2}, &(0x7f000007a000)=0x1c) 2018/02/10 14:10:10 executing program 4: r0 = dup(0xffffffffffffff9c) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$DRM_IOCTL_AGP_RELEASE(r0, 0x6431) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, &(0x7f0000001000-0x16)={0x0, 0xda6, 0x7, [0x10000, 0xffffffffffffccd3, 0x2, 0x5, 0x3, 0x3, 0x4]}, &(0x7f0000001000-0x4)=0x16) setsockopt$inet_sctp_SCTP_ASSOCINFO(r0, 0x84, 0x1, &(0x7f00001f4000-0x14)={r1, 0x9, 0x9, 0x5e09402f, 0x1, 0x4}, 0x14) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r2 = request_key(&(0x7f0000000000)='big_key\x00', &(0x7f0000002000-0x5)={0x73, 0x79, 0x7a, 0x0}, &(0x7f0000001000-0x1)='\x00', 0xfffffffffffffffb) add_key$user(&(0x7f0000001000-0x5)='user\x00', &(0x7f0000000000)={0x73, 0x79, 0x7a, 0x0}, &(0x7f0000001000)="c896d5c6e275145dc716a5bb1580f1a19a0e192c4d9f667b2c25bb020f9d2dc0b6ea000000c446cc0eafc2ef631b3b894f03ed4f02ccd22ee82f3e6e8bf912bb9ddf5124d0355e1090463c5e2c27f938ec2f0d948ea2fb56f11f8c414ea513fce9a65c7e0757b4b560e0b0efa5ee7f1dee5dabe8cf96828a8f5a80fa1291b83b77c12e63a3389d376f8de7c43498b6bd56c456cbc54c1059a8ffcb026869f930bb1f1e5a0d2bd29820b1b2eb38ca6cfddf309b086353cbe807d41b724906b39c3014a5f60c997656b9e74f66cc31ff14e08f000da8af4e273f38600b208fd9a4be27eb1c88092dd59bdff67f30a559cc3e3873", 0xf3, r2) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r3 = request_key(&(0x7f0000507000)='big_key\x00', &(0x7f00002ac000)={0x73, 0x79, 0x7a, 0x1}, &(0x7f00000d3000)='em0em0mime_typemime_type#wlan1mime_type\x00', 0xffffffffffffffff) keyctl$dh_compute(0x17, &(0x7f00004cb000)={0x0, r3}, &(0x7f0000d55000-0x6f)=""/111, 0x67, &(0x7f0000ed7000-0x2c)={&(0x7f0000380000-0x40)={'cmac(tea-generic)\x00'}, 0x0, 0x146}) socket$inet6_tcp(0xa, 0x1, 0x0) 2018/02/10 14:10:10 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000a5000-0x8)) mmap(&(0x7f0000000000/0x19000)=nil, 0x19000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000e1c000)='/dev/rfkill\x00', 0x10105, 0x0) r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000e54000-0x18)={0xaa}) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000008000-0x20)={{&(0x7f0000000000/0x4000)=nil, 0x4000}, 0x1}) readv(r0, &(0x7f00001f3000-0x10)=[{&(0x7f0000002000-0x4e)=""/1, 0x1}], 0x1) ioctl$RNDADDTOENTCNT(r0, 0x40045201, &(0x7f0000b27000)) ioctl$RNDADDTOENTCNT(r0, 0x40045201, &(0x7f0000a81000)) ioctl$UFFDIO_UNREGISTER(r1, 0xc020aa04, &(0x7f0000008000-0x4)={&(0x7f0000000000/0x2000)=nil, 0x2000}) 2018/02/10 14:10:10 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r0, r0, &(0x7f0000049000), 0x3d2) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000008000)={&(0x7f000000f000-0xc)={0x10, 0x34000}, 0xc, &(0x7f0000220000)={&(0x7f00008d6000-0x14)={0x14, 0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, {}, []}, 0x14}, 0x1}, 0x0) r1 = userfaultfd(0x80800) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000ff8000-0x20)={{&(0x7f0000012000/0x2000)=nil, 0x2000}, 0x1}) bpf$MAP_CREATE(0x0, &(0x7f0000fb4000)={0x2, 0x8000000000000004, 0x400, 0x7fd, 0x4, 0xffffffffffffffff}, 0x2c) userfaultfd(0x800) clock_gettime(0x0, &(0x7f0000132000)={0x0, 0x0}) socketpair(0x1d, 0x800, 0x4, &(0x7f0000589000)) r4 = syz_open_dev$mouse(&(0x7f00006eb000)='/dev/input/mouse#\x00', 0xde6e, 0x1) timer_settime(0x0, 0x1, &(0x7f000097e000)={{0x0, r3}, {r2, r3+10000000}}, &(0x7f0000939000)) fanotify_init(0x25, 0x802) r5 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000ef2000-0x1d)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f00002d8000-0xc)={0x0, 0x0}, &(0x7f0000d76000-0x4)=0xc) syz_open_procfs(r6, &(0x7f0000013000)='ns/cgroup\x00') openat$ion(0xffffffffffffff9c, &(0x7f0000dd5000)='/dev/ion\x00', 0x800, 0x0) pipe2(&(0x7f000058c000), 0x4800) setsockopt$inet_IP_XFRM_POLICY(r4, 0x0, 0x11, &(0x7f0000e12000-0xe8)={{{@in6=@mcast1={0xff, 0x1, [], 0x1}, @in=@rand_addr, 0x2, 0xbd, 0x3, 0x0, 0xa, 0xa0, 0x80, 0xbf, 0x0, r7}, {0x0, 0x8, 0x0, 0x3, 0x6, 0x1fa8, 0x8, 0x20}, {0x1719, 0x7fff, 0x7ff, 0x7ff}, 0x1, 0x7, 0x0, 0x1, 0x1, 0x3}, {{@in=@broadcast=0xffffffff, 0x1, 0x7f}, 0xa, @in=@empty, 0xffffffffffffffff, 0x3, 0x0, 0xffffffffffffffbc, 0x20, 0x6, 0x2}}, 0xe8) openat$selinux_policy(0xffffffffffffff9c, &(0x7f000010e000-0x10)='/selinux/policy\x00', 0x0, 0x0) setsockopt$netlink_NETLINK_TX_RING(r5, 0x10e, 0x7, &(0x7f0000ab4000-0x10)={0x6, 0x7, 0x52, 0xfffffffffffffffc}, 0x10) 2018/02/10 14:10:10 executing program 0: r0 = socket$inet_sctp(0x2, 0x200000003, 0x84) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) recvmsg(r0, &(0x7f0000069000-0x1b)={&(0x7f0000f9e000-0x32)=@pppol2tpin6={0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, @mcast2}}}, 0x32, &(0x7f0000000000)=[{&(0x7f0000ac5000)=""/111, 0x6f}, {&(0x7f000021b000-0x71)=""/113, 0x71}, {&(0x7f0000001000-0xac)=""/172, 0xac}, {&(0x7f0000a78000)=""/120, 0x78}, {&(0x7f0000001000-0x1000)=""/4096, 0x1000}], 0x5, &(0x7f0000001000-0xef)=""/239, 0xef, 0x5}, 0x20) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) setsockopt$inet6_IPV6_ADDRFORM(r1, 0x29, 0x1, &(0x7f0000001000-0x4)=0x2, 0x4) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) 2018/02/10 14:10:10 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000a000)={0x34e, 0x0, &(0x7f00001e5000-0x8)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000006000-0x54)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000-0x30)={0x44, 0x0, &(0x7f0000d06000)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x38, 0x8, &(0x7f000000d000)=[@fda={0x66646185}, @flat={0x73682a85}], &(0x7f0000006000)=[0x0]}}], 0x0, 0x0, &(0x7f0000176000-0x1)}) 2018/02/10 14:10:10 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000a000)={0x34e, 0x0, &(0x7f00001e5000-0x8)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000006000-0x54)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000-0x30)={0x44, 0x0, &(0x7f0000d06000)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x38, 0x8, &(0x7f000000d000)=[@fda={0x66646185}, @flat={0x73682a85}], &(0x7f0000006000)=[0x0]}}], 0x0, 0x0, &(0x7f0000176000-0x1)}) 2018/02/10 14:10:10 executing program 7: pipe2(&(0x7f00001f1000)={0x0, 0x0}, 0x4800) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) accept4$inet(r0, &(0x7f0000de5000-0x10)={0x0, 0xffffffffffffffff, @dev}, &(0x7f0000000000)=0x10, 0x80000) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$vcsn(&(0x7f0000216000-0xa)='/dev/vcs#\x00', 0x3, 0x10200) ioctl$SNDRV_SEQ_IOCTL_UNSUBSCRIBE_PORT(r1, 0x40505331, &(0x7f000040b000)={{0x1, 0x20}, {0x8, 0x5}, 0x1, 0x2, 0xa1}) perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$evdev(&(0x7f0000dda000-0x12)='/dev/input/event#\x00', 0x0, 0x0) ioctl$EVIOCGRAB(r2, 0x40044590, &(0x7f0000e95000-0x4)) ioctl$TIOCSBRK(0xffffffffffffffff, 0x40044591) request_key(&(0x7f0000102000)='big_key\x00', &(0x7f0000ad3000)={0x73, 0x79, 0x7a, 0x3}, &(0x7f00006cc000-0x40)='deflate\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', 0xffffffffffffffff) [ 68.400093] binder: 11442:11443 transaction failed 29189/-22, size 56-8 line 2842 [ 68.420688] binder: undelivered TRANSACTION_ERROR: 29189 [ 68.459698] binder: 11446:11457 Acquire 1 refcount change on invalid ref 0 ret -22 [ 68.460328] binder: 11450:11454 unknown command 0 [ 68.467505] binder: 11446:11457 unknown command 0 [ 68.478101] binder: 11446:11457 ioctl c0306201 2000a000 returned -22 [ 68.488538] binder: 11450:11461 got transaction with invalid parent offset or type [ 68.489819] binder: 11450:11454 ioctl c0306201 2000a000 returned -22 2018/02/10 14:10:10 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000a5000-0x8)) mmap(&(0x7f0000000000/0x19000)=nil, 0x19000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000924000-0xc)='/dev/rfkill\x00', 0x0, 0x0) r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000e54000-0x18)={0xaa}) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000008000-0x20)={{&(0x7f0000000000/0x4000)=nil, 0x4000}, 0x1}) readv(r0, &(0x7f00001f3000-0x10)=[{&(0x7f0000002000-0x4e)=""/1, 0x1}], 0x1) ioctl$RNDADDTOENTCNT(r0, 0x40045201, &(0x7f0000b27000)) ioctl$RNDADDTOENTCNT(r0, 0x40045201, &(0x7f0000a81000)) ioctl$TIOCCONS(r0, 0x541d) ioctl$UFFDIO_UNREGISTER(r1, 0xc020aa04, &(0x7f0000008000-0x4)={&(0x7f0000000000/0x2000)=nil, 0x2000}) 2018/02/10 14:10:10 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000a000)={0x34e, 0x0, &(0x7f00001e5000-0x8)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000006000-0x54)}) munmap(&(0x7f0000fdb000/0x3000)=nil, 0x3000) r1 = syz_open_dev$mouse(&(0x7f0000457000)='/dev/input/mouse#\x00', 0xf0, 0x100) mmap(&(0x7f0000fdb000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$TUNGETIFF(r1, 0x800454d2, &(0x7f0000fdb000)) r2 = syz_open_dev$amidi(&(0x7f0000243000)='/dev/amidi#\x00', 0x8001, 0x800) ioctl$KVM_ASSIGN_PCI_DEVICE(r2, 0x8040ae69, &(0x7f00006f3000)={0x9, 0x2, 0x0, 0x7, 0x2}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000008000-0x30)={0x0, 0x0, &(0x7f0000d06000)=[], 0x0, 0x0, &(0x7f0000176000-0x1)}) [ 68.496946] binder: 11450:11461 transaction failed 29201/-22, size 56-8 line 3080 [ 68.504628] binder: BINDER_SET_CONTEXT_MGR already set [ 68.519665] binder: 11446:11463 unknown command 0 [ 68.525630] binder: 11446:11463 ioctl c0306201 2000a000 returned -22 [ 68.533365] binder: 11451:11458 ioctl 40046207 0 returned -16 [ 68.534426] binder: 11451:11468 unknown command 0 [ 68.545169] binder: 11451:11468 ioctl c0306201 2000a000 returned -22 2018/02/10 14:10:10 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000dca000)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_HEAP_QUERY(r0, 0xc0184908, &(0x7f0000776000-0x18)={0xfffffffffffffffe, 0x0, 0x0, 0xffffffffffffffff}) 2018/02/10 14:10:10 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f000092a000-0x10)='/dev/sequencer2\x00', 0x0, 0x0) ioctl$PIO_UNISCRNMAP(r0, 0x4b6a, &(0x7f0000da5000)="9fe0f02e856302c6aed38fab0500000039120ebb896b7ced4e53fa3fdfa069aae6d56490158a8b243f74e6ece549ed0ad1088c0c3b8305d87d49ed8043831377866967930fed3d3ffb6384917a5ded0453a1f6f2927e0e57c628fb65cd03bc8bab1d7c05a2b538dc6ef79bc11573246fe7e3800a59ff23024f19611b737443e78f5be543a4c8181418af1509faa533c45fecf0440ba27f6466cae64f077939206c3b98c09e90746f9b02aba6dac9272ed0eab947837f3d25f28d7e60681c6bfa29f6b4849fdb2bd00ca57ec038b5f5b01c72c0ab3705caa61e670ddd9e5c3ecd23f3c233f4c177d3e259e1d552b7f6de4eb697cd8f46de256c6054c39ad02262aec5f34b2ac8b2596503427cf33d113e6c1de357cc1c3835dfd52ced91b5cefe756952b53b20cdfd77c1b68d9a0fcaf14780e7f9730400e817677342106287368efda80de1d5d5872aba3bd5155ca6563af932cea267dff98cbb90") ioctl$KDGKBLED(r0, 0x80045104, &(0x7f0000001000-0x1)) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000530000-0x28)={r0, 0x0, 0x32, 0x82, &(0x7f0000e43000-0x32)="60849682bdb48cf419048a12881d9af59954c8c2fbd1a2a19a557a579ef1e9afbeeccaa775f4cb0e2a3acaa39cbb6cc0f4fc", &(0x7f0000614000-0x82)=""/130, 0x5, 0x7}, 0x28) 2018/02/10 14:10:10 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000a000)={0x34e, 0x0, &(0x7f00001e5000-0x8)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000006000-0x54)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000-0x30)={0x44, 0x0, &(0x7f0000d06000)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x38, 0x8, &(0x7f000000d000)=[@fda={0x66646185}, @flat={0x73682a85}], &(0x7f0000006000)=[0x0]}}], 0x0, 0x0, &(0x7f0000176000-0x1)}) [ 68.561126] binder: 11451:11458 got transaction with invalid parent offset or type [ 68.573569] binder: undelivered TRANSACTION_ERROR: 29201 [ 68.579675] binder: 11451:11458 transaction failed 29201/-22, size 56-8 line 3080 [ 68.605465] binder: undelivered TRANSACTION_ERROR: 29201 2018/02/10 14:10:10 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000a000)={0x34e, 0x0, &(0x7f00001e5000-0x8)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000006000-0x54)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000-0x30)={0x44, 0x0, &(0x7f0000d06000)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x38, 0x8, &(0x7f000000d000)=[@fda={0x66646185}, @flat={0x73682a85}], &(0x7f0000006000)=[0x0]}}], 0x0, 0x0, &(0x7f0000176000-0x1)}) [ 68.610348] ion_ioctl: ioctl validate failed [ 68.620515] binder: 11474:11475 unknown command 0 [ 68.629588] binder: 11474:11475 ioctl c0306201 2000a000 returned -22 [ 68.629926] binder: 11476:11478 unknown command 0 [ 68.638683] binder: BINDER_SET_CONTEXT_MGR already set [ 68.646824] binder: 11481:11482 ioctl 40046207 0 returned -16 [ 68.648156] binder: 11476:11478 ioctl c0306201 2000a000 returned -22 2018/02/10 14:10:10 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r0, r0, &(0x7f0000049000), 0x3d2) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000008000)={&(0x7f000000f000-0xc)={0x10, 0x34000}, 0xc, &(0x7f0000220000)={&(0x7f00008d6000-0x14)={0x14, 0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, {}, []}, 0x14}, 0x1}, 0x0) r1 = userfaultfd(0x80800) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000ff8000-0x20)={{&(0x7f0000012000/0x2000)=nil, 0x2000}, 0x1}) bpf$MAP_CREATE(0x0, &(0x7f0000fb4000)={0x2, 0x8000000000000004, 0x400, 0x7fd, 0x4, 0xffffffffffffffff}, 0x2c) userfaultfd(0x800) clock_gettime(0x0, &(0x7f0000132000)={0x0, 0x0}) socketpair(0x1d, 0x800, 0x4, &(0x7f0000589000)) r4 = syz_open_dev$mouse(&(0x7f00006eb000)='/dev/input/mouse#\x00', 0xde6e, 0x1) timer_settime(0x0, 0x1, &(0x7f000097e000)={{0x0, r3}, {r2, r3+10000000}}, &(0x7f0000939000)) fanotify_init(0x25, 0x802) r5 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000ef2000-0x1d)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f00002d8000-0xc)={0x0, 0x0}, &(0x7f0000d76000-0x4)=0xc) syz_open_procfs(r6, &(0x7f0000013000)='ns/cgroup\x00') openat$ion(0xffffffffffffff9c, &(0x7f0000dd5000)='/dev/ion\x00', 0x800, 0x0) pipe2(&(0x7f000058c000), 0x4800) setsockopt$inet_IP_XFRM_POLICY(r4, 0x0, 0x11, &(0x7f0000e12000-0xe8)={{{@in6=@mcast1={0xff, 0x1, [], 0x1}, @in=@rand_addr, 0x2, 0xbd, 0x3, 0x0, 0xa, 0xa0, 0x80, 0xbf, 0x0, r7}, {0x0, 0x8, 0x0, 0x3, 0x6, 0x1fa8, 0x8, 0x20}, {0x1719, 0x7fff, 0x7ff, 0x7ff}, 0x1, 0x7, 0x0, 0x1, 0x1, 0x3}, {{@in=@broadcast=0xffffffff, 0x1, 0x7f}, 0xa, @in=@empty, 0xffffffffffffffff, 0x3, 0x0, 0xffffffffffffffbc, 0x20, 0x6, 0x2}}, 0xe8) openat$selinux_policy(0xffffffffffffff9c, &(0x7f000010e000-0x10)='/selinux/policy\x00', 0x0, 0x0) setsockopt$netlink_NETLINK_TX_RING(r5, 0x10e, 0x7, &(0x7f0000ab4000-0x10)={0x6, 0x7, 0x52, 0xfffffffffffffffc}, 0x10) 2018/02/10 14:10:10 executing program 4 (fault-call:5 fault-nth:0): mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000a000)={0x34e, 0x0, &(0x7f00001e5000-0x8)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000006000-0x54)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000-0x30)={0x44, 0x0, &(0x7f0000d06000)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x38, 0x8, &(0x7f000000d000)=[@fda={0x66646185}, @flat={0x73682a85}], &(0x7f0000006000)=[0x20]}}], 0x0, 0x0, &(0x7f0000176000-0x1)}) [ 68.655498] binder: 11474:11475 got transaction with invalid parent offset or type [ 68.675179] binder: 11481:11488 unknown command 0 [ 68.680241] binder: 11476:11485 unknown command 0 [ 68.683859] binder: 11481:11488 ioctl c0306201 2000a000 returned -22 [ 68.685711] binder: 11476:11485 ioctl c0306201 2000a000 returned -22 [ 68.698714] binder: 11474:11475 transaction failed 29201/-22, size 56-8 line 3080 [ 68.705945] binder: 11481:11492 got transaction with invalid parent offset or type [ 68.714595] binder: 11481:11492 transaction failed 29201/-22, size 56-8 line 3080 [ 68.726945] binder: undelivered TRANSACTION_ERROR: 29201 [ 68.730679] binder: 11495:11497 unknown command 0 [ 68.749125] binder: 11495:11497 ioctl c0306201 2000a000 returned -22 [ 68.762481] FAULT_INJECTION: forcing a failure. [ 68.762481] name failslab, interval 1, probability 0, space 0, times 0 [ 68.762708] binder: undelivered TRANSACTION_ERROR: 29201 [ 68.773898] CPU: 0 PID: 11500 Comm: syz-executor4 Not tainted 4.15.0+ #217 [ 68.786296] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 68.795644] Call Trace: [ 68.798238] dump_stack+0x194/0x257 [ 68.801880] ? arch_local_irq_restore+0x53/0x53 [ 68.806573] should_fail+0x8c0/0xa40 [ 68.810293] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 68.815401] ? perf_trace_lock+0x900/0x900 [ 68.819643] ? print_irqtrace_events+0x270/0x270 [ 68.824417] ? check_noncircular+0x20/0x20 [ 68.828667] ? find_held_lock+0x35/0x1d0 [ 68.832745] ? trace_event_raw_event_sched_switch+0x810/0x810 [ 68.838608] ? lock_downgrade+0x980/0x980 [ 68.842740] ? rcu_note_context_switch+0x710/0x710 [ 68.847649] ? lock_release+0xa40/0xa40 [ 68.851608] ? lock_release+0xa40/0xa40 [ 68.855588] should_failslab+0xec/0x120 [ 68.859551] kmem_cache_alloc_trace+0x4b/0x740 [ 68.859591] binder_get_thread+0x1cf/0x870 [ 68.859612] ? binder_inc_ref_for_node+0xbc0/0xbc0 [ 68.873304] ? trace_event_raw_event_sched_switch+0x810/0x810 [ 68.879172] ? rcu_note_context_switch+0x710/0x710 [ 68.884086] ? __might_sleep+0x95/0x190 [ 68.888058] binder_ioctl+0x20c/0x1417 [ 68.891937] ? binder_ioctl_write_read.isra.38+0xcb0/0xcb0 [ 68.897544] ? trace_event_raw_event_sched_switch+0x810/0x810 [ 68.903408] ? rcu_note_context_switch+0x710/0x710 [ 68.908321] ? __might_sleep+0x95/0x190 [ 68.912273] ? _cond_resched+0x14/0x30 [ 68.916153] ? selinux_file_ioctl+0x444/0x690 [ 68.920633] ? __fget_light+0x2b2/0x3c0 [ 68.924590] ? selinux_capable+0x40/0x40 [ 68.928642] ? __sb_end_write+0xa0/0xd0 [ 68.932602] ? security_file_ioctl+0x7d/0xb0 [ 68.937027] ? security_file_ioctl+0x89/0xb0 [ 68.941425] compat_SyS_ioctl+0x151/0x2a30 [ 68.945641] ? do_fast_syscall_32+0x156/0xfa1 [ 68.950114] ? binder_ioctl_write_read.isra.38+0xcb0/0xcb0 [ 68.955716] ? do_ioctl+0x60/0x60 [ 68.959146] do_fast_syscall_32+0x3ee/0xfa1 [ 68.963452] ? do_int80_syscall_32+0x9d0/0x9d0 [ 68.968010] ? mmdrop+0x18/0x30 [ 68.971274] ? finish_task_switch+0x29b/0x890 [ 68.975749] ? syscall_return_slowpath+0x2ac/0x550 [ 68.980656] ? prepare_exit_to_usermode+0x350/0x350 [ 68.985655] ? sysret32_from_system_call+0x5/0x3b [ 68.990477] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 68.995305] entry_SYSENTER_compat+0x54/0x63 [ 68.999690] RIP: 0023:0xf7f4ec79 [ 69.003032] RSP: 002b:00000000f772909c EFLAGS: 00000286 ORIG_RAX: 0000000000000036 2018/02/10 14:10:11 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f000073e000-0x11)='/selinux/enforce\x00', 0x109000, 0x0) ioctl$KIOCSOUND(r0, 0x4b2f, 0xbe41) r1 = syz_open_dev$sndctrl(&(0x7f0000618000)='/dev/snd/controlC#\x00', 0x8054, 0x0) syz_open_dev$vcsa(&(0x7f0000ba7000-0xb)='/dev/vcsa#\x00', 0xfffffffffffffffc, 0x80000) ioctl$KVM_DIRTY_TLB(r0, 0x400caeaa, &(0x7f0000254000-0xc)={0x7, 0x4}) ioctl$SNDRV_CTL_IOCTL_ELEM_LIST(r1, 0xc0485510, &(0x7f0000ac6000)={0x0, 0x1, 0x0, 0x0, &(0x7f00007b3000)=[{}]}) 2018/02/10 14:10:11 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f000090a000)='/dev/binder#\x00', 0x0, 0x8000000000000800) r1 = syz_open_dev$vcsa(&(0x7f0000524000)='/dev/vcsa#\x00', 0x1, 0x30101) r2 = request_key(&(0x7f0000ec4000-0x5)='user\x00', &(0x7f0000560000)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000dd1000)='/dev/vcsa#\x00', 0xfffffffffffffffd) r3 = add_key(&(0x7f00004ac000)='cifs.spnego\x00', &(0x7f0000f75000-0x5)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000bf4000-0x51)="cb6cb3a9568e4d498ff6deb91f147c408a306251f2e1142c799449445e4c1dab24bec7ef3be10b4b1a372f06a761706026e58419b6f452cf0f51b94623c8ef94a9e12805e4c65021d8fcc138a84e6da9e5", 0x51, 0xfffffffffffffff8) keyctl$link(0x8, r2, r3) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000a000)={0x34e, 0x0, &(0x7f00001e5000-0x8)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000006000-0x54)}) ioctl$KVM_SET_SIGNAL_MASK(r1, 0x4004ae8b, &(0x7f0000574000-0xbf)={0xbb, "040c6a69395de27aac83a9c4201b0097e1d785e93158a12a62be668a078a792345d3e698d37e75442168e59b5aedf8472d11160e60b36c34cfac6bb96670879ef02019029fafbd7b578d5330273c494bae56916d12121d05746fbda82581a1053218e463f28fe8a7944ec4fd6c8ffbe81a145f895f888fd729759d654c9e97c29d808084623760bafa2773fc294f67fb495efc1f8ad66dd36ee3f3ebbe04aa9ceeaefdef5ea276b5dcc6c242e9eb99771f711b3dd1d14a6756b1ea"}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000008000-0x30)={0x0, 0x0, &(0x7f0000d06000)=[], 0x0, 0x0, &(0x7f0000176000-0x1)}) 2018/02/10 14:10:11 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000a000)={0x34e, 0x0, &(0x7f00001e5000-0x8)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000006000-0x54)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000-0x30)={0x44, 0x0, &(0x7f0000d06000)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x38, 0x8, &(0x7f000000d000)=[@fda={0x66646185}, @flat={0x73682a85}], &(0x7f0000006000)=[0x0]}}], 0x0, 0x0, &(0x7f0000176000-0x1)}) 2018/02/10 14:10:11 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000a000)={0x34e, 0x0, &(0x7f00001e5000-0x8)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000006000-0x54)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000-0x30)={0x44, 0x0, &(0x7f0000d06000)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x38, 0x8, &(0x7f000000d000)=[@fda={0x66646185}, @flat={0x73682a85}], &(0x7f0000006000)=[0x0]}}], 0x0, 0x0, &(0x7f0000176000-0x1)}) 2018/02/10 14:10:11 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r0, r0, &(0x7f0000049000), 0x3d2) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000008000)={&(0x7f000000f000-0xc)={0x10, 0x34000}, 0xc, &(0x7f0000220000)={&(0x7f00008d6000-0x14)={0x14, 0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, {}, []}, 0x14}, 0x1}, 0x0) r1 = userfaultfd(0x80800) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000ff8000-0x20)={{&(0x7f0000012000/0x2000)=nil, 0x2000}, 0x1}) bpf$MAP_CREATE(0x0, &(0x7f0000fb4000)={0x2, 0x8000000000000004, 0x400, 0x7fd, 0x4, 0xffffffffffffffff}, 0x2c) userfaultfd(0x800) clock_gettime(0x0, &(0x7f0000132000)={0x0, 0x0}) socketpair(0x1d, 0x800, 0x4, &(0x7f0000589000)) r4 = syz_open_dev$mouse(&(0x7f00006eb000)='/dev/input/mouse#\x00', 0xde6e, 0x1) timer_settime(0x0, 0x1, &(0x7f000097e000)={{0x0, r3}, {r2, r3+10000000}}, &(0x7f0000939000)) fanotify_init(0x25, 0x802) r5 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000ef2000-0x1d)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f00002d8000-0xc)={0x0, 0x0}, &(0x7f0000d76000-0x4)=0xc) syz_open_procfs(r6, &(0x7f0000013000)='ns/cgroup\x00') openat$ion(0xffffffffffffff9c, &(0x7f0000dd5000)='/dev/ion\x00', 0x800, 0x0) pipe2(&(0x7f000058c000), 0x4800) setsockopt$inet_IP_XFRM_POLICY(r4, 0x0, 0x11, &(0x7f0000e12000-0xe8)={{{@in6=@mcast1={0xff, 0x1, [], 0x1}, @in=@rand_addr, 0x2, 0xbd, 0x3, 0x20, 0x0, 0xa0, 0x80, 0xbf, 0x0, r7}, {0x0, 0x8, 0x0, 0x3, 0x6, 0x1fa8, 0x8, 0x20}, {0x1719, 0x7fff, 0x7ff, 0x7ff}, 0x1, 0x7, 0x0, 0x1, 0x1, 0x3}, {{@in=@broadcast=0xffffffff, 0x1, 0x7f}, 0xa, @in=@empty, 0xffffffffffffffff, 0x3, 0x0, 0xffffffffffffffbc, 0x20, 0x6, 0x2}}, 0xe8) openat$selinux_policy(0xffffffffffffff9c, &(0x7f000010e000-0x10)='/selinux/policy\x00', 0x0, 0x0) setsockopt$netlink_NETLINK_TX_RING(r5, 0x10e, 0x7, &(0x7f0000ab4000-0x10)={0x6, 0x7, 0x52, 0xfffffffffffffffc}, 0x10) 2018/02/10 14:10:11 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$evdev(&(0x7f0000dda000-0x12)='/dev/input/event#\x00', 0x0, 0x0) ioctl$EVIOCGRAB(r0, 0x40044590, &(0x7f0000e95000-0x4)) r1 = openat$dsp(0xffffffffffffff9c, &(0x7f0000231000-0x9)='/dev/dsp\x00', 0x8000, 0x0) ioctl$TCSETSF(r1, 0x5404, &(0x7f0000ac0000)={0xbd23, 0xfffffffffffffff8, 0x3, 0x65, 0x80000000, 0x80000001, 0x9, 0x9, 0x3960, 0x3, 0xfffffffffffffffb, 0xffff}) ioctl$TIOCSBRK(0xffffffffffffffff, 0x40044591) request_key(&(0x7f0000102000)='big_key\x00', &(0x7f0000ad3000)={0x73, 0x79, 0x7a, 0x3}, &(0x7f00006cc000-0x40)='deflate\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', 0xffffffffffffffff) 2018/02/10 14:10:11 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000a5000-0x8)) mmap(&(0x7f0000000000/0x19000)=nil, 0x19000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000924000-0xc)='/dev/rfkill\x00', 0x0, 0x0) r1 = userfaultfd(0x80804) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000e54000-0x18)={0xaa}) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000008000-0x20)={{&(0x7f0000000000/0x4000)=nil, 0x4000}, 0x1}) readv(r0, &(0x7f00001f3000-0x10)=[{&(0x7f0000002000-0x4e)=""/1, 0x1}], 0x1) ioctl$RNDADDTOENTCNT(r0, 0x40045201, &(0x7f0000b27000)) ioctl$RNDADDTOENTCNT(r0, 0x40045201, &(0x7f0000a81000)) timer_create(0x7, &(0x7f000004f000)={0x0, 0x18, 0x3, @tid=0xffffffffffffffff}, &(0x7f0000de0000)=0x0) timer_getoverrun(r2) ioctl$UFFDIO_UNREGISTER(r1, 0xc020aa04, &(0x7f0000008000-0x4)={&(0x7f0000000000/0x2000)=nil, 0x2000}) 2018/02/10 14:10:11 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) syz_extract_tcp_res(&(0x7f0000afc000-0x8), 0x9, 0x7) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000a000)={0x34e, 0x0, &(0x7f00001e5000-0x8)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000006000-0x54)}) r1 = syz_open_dev$adsp(&(0x7f000096a000)='/dev/adsp#\x00', 0xfffffffffffffffd, 0x101100) ioctl$SNDRV_CTL_IOCTL_PCM_NEXT_DEVICE(r1, 0x80045530, &(0x7f0000882000-0xb0)=""/176) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000-0x30)={0x44, 0x0, &(0x7f0000d06000)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x38, 0x8, &(0x7f000000d000)=[@fda={0x66646185}, @flat={0x73682a85}], &(0x7f0000006000)=[0x20]}}], 0x0, 0x0, &(0x7f0000176000-0x1)}) [ 69.010718] RAX: ffffffffffffffda RBX: 0000000000000013 RCX: 00000000c0306201 [ 69.017963] RDX: 0000000020007fd0 RSI: 0000000000000000 RDI: 0000000000000000 [ 69.025207] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 69.032451] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 [ 69.039701] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 69.047146] binder: 11495:11500 ioctl c0306201 20007fd0 returned -12 [ 69.104157] binder: 11507:11510 unknown command 0 [ 69.105837] binder: BINDER_SET_CONTEXT_MGR already set [ 69.112064] binder: 11507:11510 ioctl c0306201 2000a000 returned -22 [ 69.121189] binder: BINDER_SET_CONTEXT_MGR already set [ 69.121337] binder: 11509:11514 ioctl 40046207 0 returned -16 [ 69.125940] binder: 11502:11508 ioctl 40046207 0 returned -16 [ 69.129169] binder: 11509:11514 unknown command 0 [ 69.134409] binder: 11507:11517 got transaction with invalid parent offset or type [ 69.145709] binder: 11505:11513 Acquire 1 refcount change on invalid ref 0 ret -22 [ 69.151518] binder: 11502:11518 unknown command 0 [ 69.158956] binder: 11505:11513 unknown command 0 [ 69.159133] binder: 11509:11514 ioctl c0306201 2000a000 returned -22 [ 69.164940] binder: 11502:11518 ioctl c0306201 2000a000 returned -22 [ 69.170128] binder: 11505:11513 ioctl c0306201 2000a000 returned -22 [ 69.180231] binder: 11502:11508 got transaction with invalid parent offset or type 2018/02/10 14:10:11 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f000020f000)='/selinux/commit_pending_bools\x00', 0x1, 0x0) ioctl$TUNSETTXFILTER(r0, 0x400454d1, &(0x7f0000214000-0x10)={0x1, 0x2, [@random="2fd819e9c152", @local={[0xaa, 0xaa, 0xaa, 0xaa], 0x0, 0xaa}]}) sched_setaffinity(0x0, 0x8, &(0x7f00000a5000-0x8)) mmap(&(0x7f0000000000/0x19000)=nil, 0x19000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r1 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000924000-0xc)='/dev/rfkill\x00', 0x0, 0x0) r2 = userfaultfd(0x0) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000e54000-0x18)={0xaa}) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000008000-0x20)={{&(0x7f0000000000/0x4000)=nil, 0x4000}, 0x1}) socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$packet_fanout_data(r1, 0x107, 0x16, &(0x7f00003ad000)={0x5, &(0x7f0000c6c000)=[{0x8, 0x1, 0x7, 0x200}, {0x8, 0x2, 0xfffffffffffff219, 0x6c9}, {0x100, 0x91, 0x7f, 0x2}, {0x6, 0x200, 0x5, 0x8}, {0xc2, 0x9, 0x2b2, 0x3}]}, 0x8) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r0, 0x84, 0x1d, &(0x7f0000218000-0x2c)={0xa, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, &(0x7f0000021000)=0x2c) syz_open_dev$vcsn(&(0x7f000050f000-0xa)='/dev/vcs#\x00', 0x6, 0x200) readv(r1, &(0x7f00001f3000-0x10)=[{&(0x7f0000002000-0x4e)=""/1, 0x1}], 0x1) ioctl$RNDADDTOENTCNT(r1, 0x40045201, &(0x7f0000b27000)) ioctl$RNDADDTOENTCNT(r1, 0x40045201, &(0x7f0000a81000)) ioctl$UFFDIO_UNREGISTER(r2, 0xc020aa04, &(0x7f0000008000-0x4)={&(0x7f0000000000/0x2000)=nil, 0x2000}) 2018/02/10 14:10:11 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000a5000-0x8)) mmap(&(0x7f0000000000/0x19000)=nil, 0x19000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000924000-0xc)='/dev/rfkill\x00', 0x0, 0x0) r1 = userfaultfd(0x80804) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000e54000-0x18)={0xaa}) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000008000-0x20)={{&(0x7f0000000000/0x4000)=nil, 0x4000}, 0x1}) readv(r0, &(0x7f00001f3000-0x10)=[{&(0x7f0000002000-0x4e)=""/1, 0x1}], 0x1) ioctl$RNDADDTOENTCNT(r0, 0x40045201, &(0x7f0000b27000)) ioctl$RNDADDTOENTCNT(r0, 0x40045201, &(0x7f0000a81000)) timer_create(0x7, &(0x7f000004f000)={0x0, 0x18, 0x3, @tid=0xffffffffffffffff}, &(0x7f0000de0000)=0x0) timer_getoverrun(r2) ioctl$UFFDIO_UNREGISTER(r1, 0xc020aa04, &(0x7f0000008000-0x4)={&(0x7f0000000000/0x2000)=nil, 0x2000}) [ 69.201896] binder: 11507:11517 transaction failed 29201/-22, size 56-8 line 3080 [ 69.203374] binder: 11505:11523 Acquire 1 refcount change on invalid ref 0 ret -22 [ 69.214046] binder: 11502:11508 transaction failed 29201/-22, size 56-8 line 3080 [ 69.217351] binder: 11505:11523 unknown command 0 [ 69.230534] binder_alloc: binder_alloc_mmap_handler: 11509 20000000-20002000 already mapped failed -16 2018/02/10 14:10:11 executing program 1: mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000183000-0xe8)={{{@in=@multicast1, @in=@multicast2, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@local}, 0x0, @in=@local}}, &(0x7f0000000000+0x89d)=0xe8) r1 = geteuid() mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) stat(&(0x7f000059a000)='./file0\x00', &(0x7f0000001000-0x44)={0x0, 0x0, 0x0, 0x0, 0x0}) setresuid(r0, r1, r2) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000001000-0xc)='/dev/rfkill\x00', 0x1, 0x0) write$eventfd(r3, &(0x7f00001ff000-0x8)=0x20000000001, 0x8) [ 69.251291] binder: BINDER_SET_CONTEXT_MGR already set [ 69.257984] binder: 11509:11514 ioctl 40046207 0 returned -16 [ 69.258330] binder: undelivered TRANSACTION_ERROR: 29201 [ 69.268649] binder: 11505:11523 ioctl c0306201 2000a000 returned -22 [ 69.269426] binder: send failed reply for transaction 280 to 11509:11514 [ 69.295871] binder: 11509:11514 Acquire 1 refcount change on invalid ref 0 ret -22 2018/02/10 14:10:11 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000a000)={0x34e, 0x0, &(0x7f00001e5000-0x8)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000006000-0x54)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000-0x30)={0x44, 0x0, &(0x7f0000d06000)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x38, 0x8, &(0x7f000000d000)=[@fda={0x66646185}, @flat={0x73682a85}], &(0x7f0000006000)=[0x0]}}], 0x0, 0x0, &(0x7f0000176000-0x1)}) 2018/02/10 14:10:11 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000a5000-0x8)) mmap(&(0x7f0000000000/0x19000)=nil, 0x19000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000924000-0xc)='/dev/rfkill\x00', 0x0, 0x0) r1 = userfaultfd(0x80804) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000e54000-0x18)={0xaa}) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000008000-0x20)={{&(0x7f0000000000/0x4000)=nil, 0x4000}, 0x1}) readv(r0, &(0x7f00001f3000-0x10)=[{&(0x7f0000002000-0x4e)=""/1, 0x1}], 0x1) ioctl$RNDADDTOENTCNT(r0, 0x40045201, &(0x7f0000b27000)) ioctl$RNDADDTOENTCNT(r0, 0x40045201, &(0x7f0000a81000)) timer_create(0x7, &(0x7f000004f000)={0x0, 0x18, 0x3, @tid=0xffffffffffffffff}, &(0x7f0000de0000)=0x0) timer_getoverrun(r2) ioctl$UFFDIO_UNREGISTER(r1, 0xc020aa04, &(0x7f0000008000-0x4)={&(0x7f0000000000/0x2000)=nil, 0x2000}) 2018/02/10 14:10:11 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000a000)={0x8, 0x0, &(0x7f00001e5000-0x8)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000006000-0x54)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000008000-0x30)={0x0, 0x0, &(0x7f0000d06000)=[], 0x0, 0x0, &(0x7f0000176000-0x1)}) [ 69.297812] binder: 11509:11533 transaction failed 29189/-22, size 56-8 line 2842 [ 69.303703] binder: 11509:11514 unknown command 0 [ 69.318266] binder: undelivered TRANSACTION_ERROR: 29201 [ 69.339162] binder: 11536:11537 unknown command 0 [ 69.344942] binder: 11536:11537 ioctl c0306201 2000a000 returned -22 2018/02/10 14:10:11 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r0, r0, &(0x7f0000049000), 0x3d2) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000008000)={&(0x7f000000f000-0xc)={0x10, 0x34000}, 0xc, &(0x7f0000220000)={&(0x7f00008d6000-0x14)={0x14, 0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, {}, []}, 0x14}, 0x1}, 0x0) r1 = userfaultfd(0x80800) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000ff8000-0x20)={{&(0x7f0000012000/0x2000)=nil, 0x2000}, 0x1}) bpf$MAP_CREATE(0x0, &(0x7f0000fb4000)={0x2, 0x8000000000000004, 0x400, 0x7fd, 0x4, 0xffffffffffffffff}, 0x2c) userfaultfd(0x800) clock_gettime(0x0, &(0x7f0000132000)={0x0, 0x0}) socketpair(0x1d, 0x800, 0x4, &(0x7f0000589000)) r4 = syz_open_dev$mouse(&(0x7f00006eb000)='/dev/input/mouse#\x00', 0xde6e, 0x1) timer_settime(0x0, 0x1, &(0x7f000097e000)={{0x0, r3}, {r2, r3+10000000}}, &(0x7f0000939000)) fanotify_init(0x25, 0x802) r5 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000ef2000-0x1d)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f00002d8000-0xc)={0x0, 0x0}, &(0x7f0000d76000-0x4)=0xc) syz_open_procfs(r6, &(0x7f0000013000)='ns/cgroup\x00') openat$ion(0xffffffffffffff9c, &(0x7f0000dd5000)='/dev/ion\x00', 0x800, 0x0) pipe2(&(0x7f000058c000), 0x4800) setsockopt$inet_IP_XFRM_POLICY(r4, 0x0, 0x11, &(0x7f0000e12000-0xe8)={{{@in6=@mcast1={0xff, 0x1, [], 0x1}, @in=@rand_addr, 0x2, 0xbd, 0x3, 0x20, 0x0, 0xa0, 0x80, 0xbf, 0x0, r7}, {0x0, 0x8, 0x0, 0x3, 0x6, 0x1fa8, 0x8, 0x20}, {0x1719, 0x7fff, 0x7ff, 0x7ff}, 0x1, 0x7, 0x0, 0x1, 0x1, 0x3}, {{@in=@broadcast=0xffffffff, 0x1, 0x7f}, 0xa, @in=@empty, 0xffffffffffffffff, 0x3, 0x0, 0xffffffffffffffbc, 0x20, 0x6, 0x2}}, 0xe8) openat$selinux_policy(0xffffffffffffff9c, &(0x7f000010e000-0x10)='/selinux/policy\x00', 0x0, 0x0) setsockopt$netlink_NETLINK_TX_RING(r5, 0x10e, 0x7, &(0x7f0000ab4000-0x10)={0x6, 0x7, 0x52, 0xfffffffffffffffc}, 0x10) 2018/02/10 14:10:11 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000a000)={0x34e, 0x0, &(0x7f00001e5000-0x8)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000006000-0x54)}) pause() ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00001b6000)={0x0, 0x0, &(0x7f0000d06000)=[], 0x0, 0x0, &(0x7f0000176000-0x1)}) [ 69.353791] binder: 11509:11514 ioctl c0306201 2000a000 returned -22 [ 69.367055] binder: undelivered TRANSACTION_ERROR: 29189 [ 69.373116] binder: 11536:11537 got transaction with invalid parent offset or type [ 69.394005] binder: undelivered TRANSACTION_COMPLETE [ 69.399240] binder: undelivered TRANSACTION_ERROR: 29189 [ 69.409686] binder: 11548:11549 unknown command 0 [ 69.414790] binder: 11548:11549 ioctl c0306201 2000a000 returned -22 [ 69.418070] binder: 11536:11537 transaction failed 29201/-22, size 56-8 line 3080 [ 69.432830] binder: undelivered TRANSACTION_ERROR: 29201 2018/02/10 14:10:11 executing program 3: r0 = socket(0x13, 0x0, 0x1) connect$inet6(r0, &(0x7f0000e00000-0x1c)={0xa, 0x0, 0x80000000, @dev={0xfe, 0x80, [], 0x0, 0x11}, 0x1f}, 0x1c) getsockname(r0, &(0x7f0000005000)=@nfc, &(0x7f0000007000-0x4)=0x980186cc5110bc8a) 2018/02/10 14:10:11 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$tun(&(0x7f0000bd4000)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000764000)={@generic="5f62c3e1a1ffd08c7018aab49b1107c2", @ifru_mtu=0x1}) ioctl$TUNSETPERSIST(r0, 0x400454cb, &(0x7f0000cd8000-0x4)) r1 = syz_open_dev$vcsn(&(0x7f0000b23000)='/dev/vcs#\x00', 0xdf, 0x101000) write$fuse(r1, &(0x7f00009c6000-0x28)={0x28, 0x0, 0x0, @fuse_notify_store_out={0x2, 0x4, 0x50}}, 0x28) 2018/02/10 14:10:11 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000a5000-0x8)) mmap(&(0x7f0000000000/0x19000)=nil, 0x19000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000924000-0xc)='/dev/rfkill\x00', 0x0, 0x0) r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000e54000-0x18)={0xaa}) ioctl$KDGKBMETA(r0, 0x4b62, &(0x7f000098c000)) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000008000-0x20)={{&(0x7f0000000000/0x4000)=nil, 0x4000}, 0x1}) readv(r0, &(0x7f00001f3000-0x10)=[{&(0x7f0000002000-0x4e)=""/1, 0x1}], 0x1) ioctl$RNDADDTOENTCNT(r0, 0x40045201, &(0x7f0000b27000)) ioctl$RNDADDTOENTCNT(r0, 0x40045201, &(0x7f0000a81000)) ioctl$UFFDIO_UNREGISTER(r1, 0xc020aa04, &(0x7f0000008000-0x4)={&(0x7f0000000000/0x2000)=nil, 0x2000}) 2018/02/10 14:10:11 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r0, r0, &(0x7f0000049000), 0x3d2) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000008000)={&(0x7f000000f000-0xc)={0x10, 0x34000}, 0xc, &(0x7f0000220000)={&(0x7f00008d6000-0x14)={0x14, 0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, {}, []}, 0x14}, 0x1}, 0x0) r1 = userfaultfd(0x80800) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000ff8000-0x20)={{&(0x7f0000012000/0x2000)=nil, 0x2000}, 0x1}) bpf$MAP_CREATE(0x0, &(0x7f0000fb4000)={0x2, 0x8000000000000004, 0x400, 0x7fd, 0x4, 0xffffffffffffffff}, 0x2c) userfaultfd(0x800) clock_gettime(0x0, &(0x7f0000132000)={0x0, 0x0}) socketpair(0x1d, 0x800, 0x4, &(0x7f0000589000)) r4 = syz_open_dev$mouse(&(0x7f00006eb000)='/dev/input/mouse#\x00', 0xde6e, 0x1) timer_settime(0x0, 0x1, &(0x7f000097e000)={{0x0, r3}, {r2, r3+10000000}}, &(0x7f0000939000)) fanotify_init(0x25, 0x802) r5 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000ef2000-0x1d)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f00002d8000-0xc)={0x0, 0x0}, &(0x7f0000d76000-0x4)=0xc) syz_open_procfs(r6, &(0x7f0000013000)='ns/cgroup\x00') openat$ion(0xffffffffffffff9c, &(0x7f0000dd5000)='/dev/ion\x00', 0x800, 0x0) pipe2(&(0x7f000058c000), 0x4800) setsockopt$inet_IP_XFRM_POLICY(r4, 0x0, 0x11, &(0x7f0000e12000-0xe8)={{{@in6=@mcast1={0xff, 0x1, [], 0x1}, @in=@rand_addr, 0x2, 0xbd, 0x3, 0x20, 0x0, 0xa0, 0x80, 0xbf, 0x0, r7}, {0x0, 0x8, 0x0, 0x3, 0x6, 0x1fa8, 0x8, 0x20}, {0x1719, 0x7fff, 0x7ff, 0x7ff}, 0x1, 0x7, 0x0, 0x1, 0x1, 0x3}, {{@in=@broadcast=0xffffffff, 0x1, 0x7f}, 0xa, @in=@empty, 0xffffffffffffffff, 0x3, 0x0, 0xffffffffffffffbc, 0x20, 0x6, 0x2}}, 0xe8) openat$selinux_policy(0xffffffffffffff9c, &(0x7f000010e000-0x10)='/selinux/policy\x00', 0x0, 0x0) setsockopt$netlink_NETLINK_TX_RING(r5, 0x10e, 0x7, &(0x7f0000ab4000-0x10)={0x6, 0x7, 0x52, 0xfffffffffffffffc}, 0x10) 2018/02/10 14:10:11 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$evdev(&(0x7f0000dda000-0x12)='/dev/input/event#\x00', 0x0, 0x0) ioctl$EVIOCGRAB(r0, 0x40044590, &(0x7f0000e95000-0x4)) r1 = syz_open_dev$dspn(&(0x7f00001e3000)='/dev/dsp#\x00', 0x101, 0x4500) getsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(0xffffffffffffff9c, 0x84, 0x22, &(0x7f000076a000)={0x8, 0x2, 0x1, 0x2, 0x0}, &(0x7f0000292000-0x4)=0x10) setsockopt$inet_sctp6_SCTP_DELAYED_SACK(r1, 0x84, 0x10, &(0x7f00007dd000-0x8)=@assoc_value={r2, 0x72b7}, 0x8) ioctl$TIOCSBRK(0xffffffffffffffff, 0x40044591) request_key(&(0x7f0000102000)='big_key\x00', &(0x7f0000ad3000)={0x73, 0x79, 0x7a, 0x3}, &(0x7f00006cc000-0x40)='deflate\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', 0xffffffffffffffff) 2018/02/10 14:10:11 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000a000)={0x34e, 0x0, &(0x7f00001e5000-0x8)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000006000-0x54)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000008000-0x30)={0x0, 0x0, &(0x7f0000d06000)=[], 0x0, 0x0, &(0x7f0000176000-0x1)}) openat$cuse(0xffffffffffffff9c, &(0x7f0000d66000-0xa)='/dev/cuse\x00', 0x40, 0x0) r1 = openat$mixer(0xffffffffffffff9c, &(0x7f0000834000-0xb)='/dev/mixer\x00', 0x800, 0x0) ioctl$KDSKBLED(r1, 0x4b65, 0x1) syz_open_dev$sg(&(0x7f00006d3000)='/dev/sg#\x00', 0x9, 0x8200) openat$rtc(0xffffffffffffff9c, &(0x7f0000a07000-0x9)='/dev/rtc\x00', 0x84000, 0x0) getsockopt$inet_sctp_SCTP_SOCKOPT_PEELOFF(0xffffffffffffffff, 0x84, 0x66, &(0x7f0000c65000)={0x0, 0x5}, &(0x7f0000ed6000)=0x8) getsockopt$inet_sctp_SCTP_STREAM_SCHEDULER_VALUE(r1, 0x84, 0x7c, &(0x7f0000c12000-0x8)={r2, 0x100000001, 0x8}, &(0x7f0000b8f000-0x4)=0x8) setsockopt$inet_sctp6_SCTP_AUTH_KEY(r1, 0x84, 0x17, &(0x7f00002ff000)={r2, 0x7fffffff, 0xda, "7db516b958fca86d67025ad8be48896c1cf436986ee7c9ead7624920f4a4692b0fd3cccf2a62f6f9054d40b687a951b0a412e23f934d26a3a04329c3856e3bbafb1f8116fcdbbd0f2f971f8960a766e1310a7825a1fadf036aefab2359335637d137217a2e3997587a7e5b9990caaa770b32d6512a51d2ea975e88aad060f425af216b0bfcd98954133295e970233f9053297ec64fe849f63137678055d2720c5fd4a4b5bea3f420873bfc1943aa7134e5c2a132dcd95e65be8c33b0cc53f1f1d1f472366c36c4e6ea1a51008895f0a9d6f912813dadc26ed57e"}, 0xe2) 2018/02/10 14:10:11 executing program 0: mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$amidi(&(0x7f0000000000)='/dev/amidi#\x00', 0x4, 0x200000) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x3, 0x32, 0xffffffffffffffff, 0x0) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(0xffffffffffffff9c, 0x84, 0x6d, &(0x7f0000000000)={0x0, 0x1000, "7b54addea5fd68f55eab9d9cd347cc7e9c84c4e7af7d7c99ddcc1666d6d361dfe1b9bee50c65678743f09017c87adf2de5f1cec2a7229a4db86b3960a997709e794b054b1e86f78f175d6240e2fa5a6f3abe5c3f289db34c55a77961e3f4c6c1ab0a2faf1c1ae403cf82eaedc03ab68aad090e94b4736ae22c7320aa6d83f3241606215abc09e51537f3982c41f8d06dd03f365d2da192e210fb8401d0bc13bf3bc28e5ce772363b01fc04825f6155f70ec7d75162650349a7906c7d57715f4f035ef6a9fe47eac69d9d9222f1902094b7cb15300ed128be5cc214a0947e76e2d7d294e9797f0b0c5d3cc7f49e4de6d066b54b86d59921a30d610f88dd5c0c334c063fcf4a4023e4a36fbfd63a34292925a921d089024f376cf60635f7a702999ed0bdee8ff59667582afa7ddfb0e8a22c809d81ae9de526176a2b2638e77fd91fcf81f3208024cdc45d977df28faa3076878f91018128d91325b1797f557d8642bb12d9350f8e8905648679a47de6d8ef5e864dc2bb635002a8473959d982e6b5959dbe0e31f4b8eab001ae0e315c0d42e3108e66c19ac86f63d6570cd3d12ee1820a6db0f1132413cf0a836a17612a00961d4de256a1e9b9635f38e5d71996073a93e02548d04f0228d4e714b132354db2c702e8b42358afd4063401eedf6d2117295659665984a8ffea8b472479d2e6c8b69a27d5abc7ff07a751d62d8ec2145e4d158f3ab304cd2ade8267f328b9c8035330fd9afffb875872ca4ed4c8acac062ec0ed184cadefc7ba1d1bb605ee3dd1aa9092313f9509ba9c8009df598c063f46016941563e4797013cdf4fb6d0353d9fb0bbb173d3310b2711fa8fe425852465348f6a768684b0c185c14bd31a0b06a3c257b2a86c551bcb5c4d055dc791ad4393b32a42a74192bf10b4380767d8835844e1a97ead232310ab467ecfd558482f2e145e50b125d1a3b85267420cec3ec1320a633e69cb8c30ee7730d90c3530453967c65a716ca4511f729c61c69f15ce4854902bfcc222d2416a07d5493b6f0d830bceca5b4b4700472cd15bafad577556f7eb496a802c01bb475be4b49574249d0c5d11acc3048907b32c249d8aecb0af7a92835a9439a736f3c6432c18bead5278e8609c981a7b645b6e687f78c1373c9116d7a87003674f9b9298ddc1d2ba24109e3e9dd1d1af3bceefafbf4252c51c9a8ae4649f5720df99eb8303d6750ceaf0df951742f1e1614624b809cfa6f5ef37dea1e37d8be5b82dc3e572eac8f532b8ed1901975098aa0d36a889482f2ef23099505a116cb8f7f7331226365a7778c40676430bbba1033af0af465de7da31af3d3763d7d74a220ecfee84c8ff17f74199ec43ce5206d56b5d08c86abb7d08f5ca165c19b4deaaf9f583165c3dd4dd79494815adc4d1e073c714182d4bfd7444a59639be219f0d1afeff3d31b7c525480b0f5c398baf6bd2a985e44bb2c106f4ae47cb0f233c6fdeccc22cd81dcdd5f84ae286826820bbe726fc90dee0c195079c4010709e4e7c523adb8997a11790a3eb9b80a85a8faf7415657fa5786de2fabb653ea4792285685db1c41d8f6855564d8eb18e7ed988d3c1a54b072aa60984f0da1d6fb5bb30360ed06410fd67e308848c91ab38a9016f32b2234494598864f78323bc34d0a28a66c2aec88f30983387d798f213a99847ae044864d60b332a38d9a74e32cc9b921f16346bc21c699b26c3bc14985c0c6ee1e9f98a6bc16eaaea05425f99ae53dac8259a76ae4f3132387158efd9c492e3005d5c99b582b686f8f66b38be6f175f439d6d605d7a12d29557bc0a62daf1745c0bec7bf3e9cf898674dbe96a79279cacb6ba1490ec29cc4f1fb36f6043af0c40936242a66521652347a4a954aa8ac3bd703800ec63cc63d1f78b5871e67b4eadea89e10df70f7cec551bada915d70a58cafaf3ca1679400b6729422e81d6b18dfa3cb0ce3fe2e8daa823eb36b5cd4f16edbe0ab47c1ef1e58c7337eb19179e9e8e4925473af8f9df2cfc9513874594081073f5feb96926a29455f46b6f9f913a2504018eabca2217eb77ef12f24384cab1dabd71c1fc12c04f1c992f9413c04b28e5db61b254483d0a4048f95189d05354d4c1809d795cc3ec9c92f844bb8982526dcaa4a080ca839283c5a8d0bcc6f62794b7112e47bcfd3b0126d9c1aa080e89fa543a8e2a4f0af92e945585e8c162e1d3eb93eb2b6876ca422eef3fe584a57521769299e1f3e3ac38674d0b3da49056f09f1783df6aae38f4697a351e52d8d59d83fd60a872fa0ab6adf77e00794eea1b40a633401a8c488ea65d15e881903c15adb5d10b2887d6774c7f9d60a274b9d2597ea3372dca612a8c0bf29df44ba6cc9ecb4983ba31f6fd1285686c517a2725ea3dd8dde39560d55725c2fb5af987b6ec63e1b3258be139cf17f0d8fc43fe439469e40218b1c97af6c99ac5042a15b905647b45ececddbfd25460ca2191af39e34244bad8d5ceb578f1fbc1bc827698691b080271dfe7a8d1639acf214c311afcfa3cd308a21b84966e40186acb3e8c6ac244597f96a48933f37554c91e42f5bd71a42a5112c60dc7f161f3caab5b6c3eac0195166eb829dcdc431aadaa40ebcfc6c3cb19653b9b122ce0ef3e01ecf0a621cd0ad7611971b2d9929461ef4536fafe0f323ecab7141987e9f25d853a660f2a75bcc78e6832f92084b294374b51a599de9e5a473b46d8902eaaa036d6fc79be9f095b756f0a7f3796b55a6483a6b90298ad55b2bd4e6ef800b6193b030933e24c54c939b00d7f6dfccd5425f47b8002dc21be8db5236750eda265f77faf11d34cccddc0d5b4b1ab96e9dbf2e81f6d81826c2b786015aaec6cff68afdad5811d3b3e9a05d263c800378fc9cdf66c9722842ea50534db1340022b09465132a9a8c55febf3190a9788b2c4e21ca6fbfd2bbf5619ceb33eb9c806369ff2041e566fc6ed685b530e07197b31471e7f1decdc265d59020b4a222197cd9c00170a8f6f468e4eace90043e3e8a7e56596a401d468890713633f4b74849aa2ebe99a7089285e3d38f94c6a9e6faa553f5825f9fa55de3291d19621390509570a58c1e43f7ad2810680a394e3cdd33af7277613fd9d0ab79469d985b555e88d300107a419ab0aa85f696b46edf97a04045744af662267e112c7576a95557d5d913aa130510d05a9950401a204b190161fc9d82db40b7a963eeb61c0a3488a3582bf87ebb7053d9e2275729a1258bd7a90d5c4135afa1fd3fada29898bfc92885183e2cf79d5aab9863e03f30418fe6e078ae59c8dabde10b56e10d3324eb6eff8d5ab5f7871ab43f78d85931a9227c74f2ce7609b299ec23610cc0002da38b4beb7e838f4de973d40abdcaebcf0b919ce1a1405cc434e3069317f6f84fb537223f20067462ee81fac9d9632c0c94db9e5e1a70b15b479710345c13dcc913955b0ab96d2fa906c4debbbae726553b3b398f52788a80a9438bda292cf74d20bd527e7ce98e007756bd1051cb21749b7d8d266fc05b34cead55f7482f22fdf57ff3f6a676e2522e9f54944c177ef47eab5a9e3e03a0fef674ce4dcdc91d1ae51c7ed1b4397cdbe66ef06496b985658a3eeb929788983645bf05c70e46b9bc972f97e9908a760aec35884085a96855850b77ccc04e4ac9a94376eaaa654e0a67ef5edb79bb9e859899fe66a1fbc6a1c2aa9d718422de2e59d24a40c3872ff19fad7a125ad049bd9c3a3949ad9cc3791a405aa2b4f0abd22849d721cbf1db0e7f9006b00c4bdcb2b2f424a74c8082249de70181fef2c269d48b6d2ea575e39f76940bd033716d1021cd4c4124cdab8fed958d4ce9773f858e96f5836ddcf0a32f0b3cba28597cf36594021bee675b81bb8716bcbe9a300690f88ce10509136b2eca2c26dd7862e128922ceabdf2062da359658656361c404557bc7df66fa7df89ff40d6bc71fb5e1716ecd8870c05fa4e949ef632e4035d776fa59dfce20ee3fe6d3f0c0cd92358e0cba59c7b7d16516cd7651c2486ec9c790d520db73efec03b6e1f11efc56f2b144293b704caa0671bd9dbfc6e550c463f0c78a472ac204f451ac695f03fa322084bf9a16a74acbbc938aad663807febbadbe7ebe2364c9ca1af5898dfac8df67dc0adc760fc336af56018a519d5168a93ce5b15a48fa56d838d745c37f689ed2e13f44587d71f161beb86ca464d23f70c553e590124fb5f1b2970fbc078c528f96291a35e49ac0c44cbecedfa851db1e67c371a12e6a710b8edb636b3230d1e888bb256543115a846bd2836979ed3aa8838d678fe8abb29c2fe642ef375ef1305141377552cb4d31ac37ea35f3702a4a192e116057e4926a791031bdfb0e47aa4347007692e66aa518b93aedc681de1f636c2fdcbae7b1bc160de1b8316e91b3bdd91ae1536237d7b85fc4d2580b455afe280618021d595838aab9025db20e2b52f711f6e0811ba8e30ad6e2e9875e8e11e0307e8243133db61123b60d98b6c21331c6d955a9bd198197c18d72a762749e4bb582cbf06ab4a544b8250a85abf248224fd016b216818210ef88f0624d3bf6854c7cca7c8aeb3860dd1aa800ac03145aeebf5d4ae159f65dc25ec7c4afd62c0845da529582b9c4b7bf929d737d0a60b1383aa950b34f7ba6fb539859cd199f5ba67cc47c08c3c528d5bb7f4bef577c489fb46aa1a98bf504b4da622fb7dba0aa7714455cfd3ee477da6fccc2a6848a3bedf7d510004adbe4db1a60fc78563312585007c8985647da261173f594684131170efd1cc1e6536e72451af672e72f84b880dcd05bd7ccc6ca8cf10eedb7c8cbb176d861c242a1270ee742928a8526abd6e017cec1027bd3cba4741e156b486aa8e74fe759e1b407d46c25d75f4698340d39c842ad74fb73b5bee36459a69edabc022dd1612852640a9d75cfe89cbad36a79931ba6682deb6ff3822382d1fb909bf4c795391e76e6c61621a7bb5ac1931911242614fc4e7febbd27a72c8be1097e549e8844d8bb4f085ce4061dbaef120b80350029eb26c16a7abb362bae59e3b423eeb5ddc77c31cd3a8ebfbbb5aa62d9b2041f935c2304c1bb66b5bf4d04bae05caf052149fcb35782c1a7e00d47fcdc1b61471c8f263f500e4b31e5011259789b62624d0429cb439ffeae9d18f5a9c100b9afb9f1cc955da9a40b27c42866fa0b4c2a02070fb6fbbefc1c5807e6da2c085b6acb3b53d2e509f68a3dcecc262268c68173d9bbb6c19226533e78d7774762cf01a46fee95c005dbb68b1d20b215609b001a65d4c0450eca29be58cfa4f2be1f86299ad20b67685084fb3b93cbca4afaafc3897204ce587ae1b193b22b0f1e37dad3f0309a9cd4afd869cf8c886c6ebbe1409693100d5d65891bcbd7968b4945083dea1d747412e28ff865dd3ee222324b81abfb164a5bdd09722133a6607ea079a116275a4b753a3bc3cf10982137fce57889b9e5638880158bec564a9532f131bfe501bb45f4f63fb241bf8036856c149698352192e967184a845cb8d63d176b26122cff86c3ebee061a60945e2ba2633baef58070c0d95be7c76fa07b3f684a68e67fe926c780a3a0e342d3d101185cb5a7202eed45066ee170e0247729315fd8bbb3e2c83587babc80aaef86447f90e7f7de61dbdafc4e9ebba1d933f231f7d7e62b9f4c361db7e08724801aca20e2c9cac2e1f3aafbda0921e76aabe119bbb13f5d3ea84277904dfafe5a135f0591bc87f80407c1ac0f1e010399c135b168563b0948cef0c1be30b9a59399b81aa6318f4e2811eae2"}, &(0x7f0000309000-0x4)=0x1008) setsockopt$inet_sctp6_SCTP_DELAYED_SACK(r0, 0x84, 0x10, &(0x7f0000001000-0x8)=@assoc_value={r1, 0x101}, 0x8) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r2 = socket$inet6(0xa, 0x3, 0x33) connect$inet6(r2, &(0x7f000000c000-0x1c)={0xa, 0xffffffffffffffff, 0x0, @local={0xfe, 0x80, [], 0xffffffffffffffff, 0xaa}, 0x9}, 0x1c) sendmsg(r2, &(0x7f0000003000-0x38)={0x0, 0x0, &(0x7f00002de000-0x40)=[{&(0x7f0000edb000)="19e607a2c8b893a1680168d33c3207b565fefdd0b852efaadc4acf49", 0x1c}, {&(0x7f0000715000)="dab0c3cc59acc8b0bade3de48943b763df225b2b77eeece4d958bc3bb75276da11f85111edefbb1dce30ba3bb7bd1a122b8a28de53d488ef66977ff76f2e9c3d76308b071aa8c68ae6788bc007293270d6721a7baae0164eadc0df1c8f0ba992ccf0a6de998e6fa8864bce1944a5e87fc041897380e60da287bf6a0e0c479c274db0c4f6e31f132d206059edc59cf743c3711e413c5f32f4f18ea6c8c0ef30be86f6ed34ac33820d34394567c3e3cca52d2e2897da10a358037ec376e2d9", 0xbe}, {&(0x7f00002c4000)="61906f0c7bac5e30e7e5190632e194a19545c9a4da2b9b5eeb64450f7d2cf9c831a4d6c06fffa3d3baf6bf3d89547fc841592c033c6aad0eae055935864fb744543890159c6ac930b1bdc5a9d0b48e3462a7847cd556399e769a7ff3d3d5a0ce923042950b4be6355a98f51f99ced42c45d265c29e8d089b141c8d0fd1080ad9de762064cecd8b04e04b33c86d60d9de50fa66d28f3d3fdd8e02831d6f8214df385f01ad3387e2a0b4487c9c5f60ca650f304fc9907683c290d0", 0xba}, {&(0x7f0000c3a000)="880a5a7a5a12a370d7d2814f57feae843fc29ff001e903a78a14289bb154e91aac17740a0199d4ea1a6159f1a0acf121a8ec486f76c5d3e26aadc24271901be9c3dc45f801e0055dfe16f8059c903e45c5e4db69c7a9d9c8812a45d2621fb230e6500a4eef8b0aff903ff1e80062cea6393bbfb486746c86dc34bd5b16a52dec6a12d7c32de2ba874816fa39a18ca2ec1d328634e8b371e4fa089ee35833aba50be5f26901022a47f9b0c0b8bffc58fba125", 0xb2}, {&(0x7f00006d9000)="fe63ba78b40f06a1719ce4d974cec4066144ce1bd1f20dcfd9c32bce20fdae9e162d5e8ff3f1a21d23a537fdc2168d6d7a2466d1bae6fc92dd4056264ce6868b431e5707bf57ae58b2dc53ffec6d98c031be794deae46b827291dbdfe369c0a9236747001d8dcd2e3a8b596a657be7618e67913d5b0b87c7049556f88b59ae5ab307aa6d03836c9c97ff427bb718fc", 0x8f}, {&(0x7f0000a3a000-0x52)="aac131d1a45d44c3529b899f706b0b5d952ce940033ca804ef96e70932b547c73d152591d17223af3c43e019b0c8502f22a78659bcdbe56e41c2baadb2ed9f178a0043d4568444237a1b31617efd2aefed3b", 0x52}, {&(0x7f00008e9000)="a193b09411a1cbdf21a41639c74c3b51ae96432d9e88335ef5d035ebf5202d46fcb0aa76f662b85a79b63e638569b2f610dcb13972150f4a27515741c5142dfcbbe3bc6778cfc8eb2438c4a63152864dbc7a976cc70cf0bee6c58ebc9c61707098bc57316dc19eb74d2759268284f8afb9c28afaa05c45db065dbcec765b5007fc43b2374bae04b37bc98beda60d8b85bf3df4b8273f1d6a155acb8e9ca63cf558a6bfe091fa6750270a62e43702a7309245478e80d332cc8191a20be45aafb8be1d643ef97742ed5bb493db6d7fc5db9905d9998e9446dee27891ff3f3de9e72db1d617cb34122242cfce98a702a92354e507959d175fafe1891a1b2d9733c93d245a218f6095f62f8b7d7a53cf412a16683d895d93cc10b283c4c86aae9d469f9e224e2d2ec82546f63204922e5cedfb822416fcd39675b5905b6c50ef7c89b93ebf6cc0bb2b0984c9defa2ee346b430a3962e4b72d767ce7d6c6f4c3d3779b6bd7cc2b4c1bcb176a5c2e6b83e875faa0f0ee72fd17c166b5d2dfa971f68d1248787915ce52a61acf96b8bc639861e27f9f2504e790c94a66c6ca8114b448847d6cb62334ba6ef25fb575e6bddfc63413e2c4b23b0526f0f7eb8ba971456a71cffdd08bf3e4d7fb665fd247e75368e9b27dd0e6260bf430be882c215f8d9304015ed3b28f625843aee005804d593e173876031cad2de7f25c53c6b30a74424db6ce1183699c6b159a3bbecc08bdbf71cd9aefa91fa6cf28b5c75be7e8f784519ad5047bb13da934dc8a8569addd14c82e37f3bfff67ff747ee7d8cc06d13cb2ebd3dd1c8e973aeffb6d42fc2d5349f03d57020ebbde51af7bfd7e8567c90e748e138a8d01752f80ce4b734bc888ee610faeb1b4be81fb282ac91b707e684831055860549e82bf6ccaac0b364491579aed6c0f9a66b3052b3043a319ff3354202e4616a20166430cd6a139dfb98980102df43926e23098cb5b3b8f4bfdb4d951f99709a0cc167a09668a53a3f8fc40f69a7fa7d64051954dd7252737fce7c33d14e5e29bc66133a0d96d628cfa07e986e35cd147a46613adf057c9dff40caeb883267f12b3222058987aa746ed8d7d76923fb61ec68654843fcaf9f47704399148117a871d3e8c7a71f38e33e446a114bf346dedb02f1bc0cdfc8e89383c5fffe59fa4a6f1118c1c71687248e6a9168b03552dae9289854371ad202c7f69f72c45ef6ff8180b315a6743a2ab797a6a750856a953b9c27047cd1ad22e259ce2e843248184a130d65a9b5b123e563d38006346b82d8df5de186281611a3e1d3cfb76d4281b4d175b41c92fe6914e6a866e69813adddf77e32ad39da5fdb33114fbf7fa1f7532bd5803277997032463bf8a52e80a06b88d8d3fdc4633c5aa761e897f03856638f67c64d48fe18ad06eda42cc49faca2c9fabaa6793fe7741429c66e3997005f203586363764e77afca40c2ab57d8ba27ea1318442424188c57ff4d6472bbba039e81cad40202d147dffdfc1f2907a083017f3af29e14edb1775ab27382e6fd501872baa0c38ccbe276438865e8ac51d4e913d870382b8cbd28e6cd5914e8973b0d9f2f8f306938da2edbb4b725888faed733f721b33b9ba2fddc054a0cd26a9153074cd242747ffb3a65111036d470ec90b555426417290f92e013d4406346b4b8e5d975b58d8e7d880d6a5278e2e3f9aeb6c74f37a54e5a4cdf0481f41e3c42ff08a17656d97e769192149aa9bece073de572dc32ea157b7ca4b4d2b33c988977ea47dbe78c886702110be58eadec293e11bca88799d0ce348f0888e2ebfc306fac724ba173a800d152ca5b1cc062469adeb39ef2b23c3c791c3a59a4f894d091e389a2a7d81d14cd4e99bd0c490c0ba8dc58e00b4a0fc91b0d12d201c4de01c6a248a8552b1ee5ab0e3e0f44ca9b5363c673126a9370c8913ed6aed50b6f73f541ac53178f090a3a9f88fd0f23af2d8f81defa7924d03d13c023d631aca5be2b41a5eaafe71fd254129b39a7fa9289ad23c54950dbacbc5b3a4aa0c4edd59278bd36bdc4bcfdc2161de378f1ef05c04a0c6776a5d1fce864a44349b2710aef2b092e1af1e31ec8c4b1e76b2b57d80eb346c5bc5874ff0b6989e5391c2e500eed9870cdfe714042a37d180b9ad0ca9e57805cd93d01ba9593fd87e01d99fb03748feadc9f18d83b44a2f899b3b0bb64239a701ff19f26e915cd4ab47a92032faeadf62d3605e6afec037f2263bbb1225dc1bfdfd66d72933356bdad427281f2880db0e8c1862a6ea35dd95cccdbe16dad7119ec96dc7c518201f1c77f5accaebbd739e950e2333b0953da2e779f2349971d85d087200b61097803fbb8b9373dbf4a65e0fd5a7cb02b1fef4cddd23fa73d6634440f8da8973d06861e20a55aab0c67c488c61cbe130fd390335d16b2bea6512d6ee9417a26a8e3670851891a136f799b97efdeac2bb4296b78d2421fd213222ae1468d961ca4c9fbf43d85e92b0600191830d86039707aaa2c1d9d1ae0c432dae4d51780d332c741586ee195738431060256bb7f32930e4000c2f183a9ca4bcf1271ed73251a5924eca7eff3ba6cc510c6e96015c88b3a67f46348a93105118a39175b715354a0e6225f0c35290ca59da75c6ed474a43f4c4c4b2e9bb01434b63872a2445eedabd6bc38c91c510a2fcccb504edd5da44c6d1e87e1a1678d6f762c9b9d1ebc5743bd8f171c6fb52d20c02da89444d8af93351044b4c4d01a083a612afd1387bd3de1e111abe40659760e997f1e7343956b05dae8cc08be717f8a3f2c36d54f41d672753ebc9ab80052a444fdf25ba4c631e0763c00b6a9a53e6414bcc01bbffbd7ffad2577f03b13c90cdac8666fea3f3003a3eed01f965edb4969e3dd84bb63cb2b6f09f32f93adfaf0af91c2d9a6f12630434774a1ef8feba7abd443a3e3e6e6580271cde0bea2e856b10590a637e701b440347feeb6f13281694be87b8f4260737422b35786c985ef78ba57ae24d06cac810319aa9cb9697ecaa906f468623c1f59d64622004fff0145515aed9901d6359a7cf42d3ffb8a3fbe6a8727f32aff00e7b08b014005739cac32723d0acfc666113ac83ebd86ecf0a69b1b37782f6d307782c6a74cddcaf10bf7555bb6d5969abecd0309917773529565fb6ff55587228535a57ab485bb58eb115f71eea32bf4fa04620631d586232b74f953552cca2d992f634e65f40b2f616f297036cfdb24dd8f652f3d91581d0c5870fd9ce0c54e3459398b1bfe23641f86a1f0849f03fe7875bcb1c5e4db69d9e10bf9828a682e91dc618811591b73978a706f680d525f2a4491a003d0ddc9ad4e9bad5b01e2f5f1d61daaf4b71a4ab231ac21fbf9ec8c91113da41bb9a46ab4803b3ad0ec11c51b62a89d2ecdbf6bc58618498776b24ce25b69fffc5c0f118322c47007e236c2dd8a60ae9a050c51292e804fa33d82e3642059cc06618fbca3f7a3d581bba5f8b51d6ff14b5314944d056f8fdba76ba98ba61e86cb81840363be4bb44952bc52c387d95413b1443eb2e443491441b2a5ba66d71cf8240bd7f478301bc92250ab0c166427335295b3cbcfb9d1f2f851da724df433587e3e7c5a5e72a13d74b1cc3679636b78a3aff18c2adbc492f7f690370051f7fc8b885280466bf1425b11793d351074b218891057cc3ca0bfb46ade5a92830b2d5fcd20305796306b400cff84a244ccc3cceda89213ae75ec8b1586d4c1e5a3f9c000843e9fb66795b7154b868430c15216ba43fc8769d22bf72c650c8014881d0a756b401929fc307ddeb4ceb03c2892d4a2c01713d90c57099676f75d6917afdc96759d019a0f8213a107062787d0859c410866fba5c8a5fe58270bdec7fcaab4c1ef3d53f9d7f217c6c58fd1d82ec6ba92d954ceabd4b62f9846cfc7a5095f9df0f2993a0c466403429a56457817127bb0a80a76b54adb8f9871d5d45521ae20533c5ed6f722016038c96d38f54111236f4a63afba3986d41f70893982f4e2fc063567778ad11a2a2a7bc5ec7b168da7d46373efb84a947e400b7d9f3b424a484bb485511f91cd89e1f40dbdd0e90f387f2e8f59d7dd003674da7ee9c1726e1bd9fa0103113b56a1d959e01e4cf1a21d24100ae0903af699b59dc1433606a62d708424f870ec5c8425be316e0825e1388e0ce5c078920982ccf9095050300970ae500ea2c1241e39ff985d14f86ddeba1758a7492385f97e90421843dba39a29f6f588a22676a4c7b36389a47be6ca6a20976555ad815ea454a910e9c1c47ad5dc15fc293ea3c6ece265c130664f1e6bef1a111989bf73e6f6a6caa0018e78a22864afbe4c36f671885d8f45c5a084b2b4a041ce66d2d97d19b46f7bcfc0c29526d2f8bf54038c3326d2f8629d96b6272ac929bab0af12dccfd4e2acf9734a898fc8dbb3fb717cf5194c21e1b66ea4effc07843f23128a2f64544201f139674db4c98d020b1551c202bb53d2553a260e1d6614ecd7a4334d42005a3216497d3a7fb46666d1d2860802e2c2e1c7e81f3f3dd85061a930a0c7628050c4793575ae58be548bf0e3e20672419b4e2d140ce7293063ad18bdbf23c0d45a32c8f23def3e55e85da0c94d1eca26c649152dba446de38ce274527dd13ccff39e3c98f13fc560a09f51ddff2d6923595d0264992d95e339d52595bd6d63e9b33a48061ba4d18c1bbb291bc324ee0cde4270971ab9aa9f604576f2355ea8842c474260554691f1f43b9668fa9032999647aa968b657e8b9194941a232479e69aad6bfd34a729c40325f124a25577161a6ac41bef0b319a3f810ed7010566ff108703648f082c5ade7b613482b2e8c19d4743025cc6881869473b91e961329be4d6d738363c4374ddafbdf1ce5dc917ecd55893e1519df3941eb17650d61380820e3402205af3b329700376ba92cb603e21bd886de4dce8183c59011a56e0f13b6cb08b3fe6e13a4374e87f5f887da0f297346b1f520f49368898a752f2bc9b79fc4fcb4b3ad892ec0dded0e6a38f6e3e0bc41dc17f4cbb2129216b60cc266273a99d0be5478d94860b0933dfacf5c0febb9826c032fd78c54f41128a6366f640a9e61ab101bf333196cc2bb9f8c23228a83e0cca75ee075791ccf51d4f395383580c256c577b7aa4c0485af7158a4b1700fc8a5913c14aed8ce5650ba90c31c62be93cce176fe1488bc805588952f634d627881743a86e19455e3aa19c77584d6d0815a7839970d7cd4ac7c500443afe827d9d6f50f56d2f9e4ec0de9e32bbb4e648932d712a69b79f903e6b6a124572487cd8f22c6277f25c828d961ef71d623f6b14c612be69ea2341aac32d0234c38096d6994d5d06171b291bcca198d7e308d0b1a58f1665a0186b2ebf65e58f7d31e46efa89032904853e7fa84923e032b73139cc1a3da137220d1371d31dc1a090cda9f30e77e141aeb8b86790814ff3b7add6160e88e5d676088e31548a2d4f55d7a05f2ef53c25b5e94a0ce6b8b5d065312f4c8fe68e96a97fbc12766292a085cca553023ab54fda65f5b86aff4d756f17082f2aafdd060698a889f9a5ea8446b303f668a6c036cf7dfd53f11d8f3d77468cdeb9359ca9bfae48dad4261d9fe7f3837b161f2b156bd77dec4ef6ded86a7fa2348925089310b2f12645b45d1678f2279e5f0b69fab666a133c26932cc85ad0bd11e7740f3638105408ee08454b531c7db5e3b17a125b52b0c05b8f71baac8cd12dcc23aa5c51cf77985b985bd4bacc2033382aa84618ebbf4d2e6778da14414c9fe3c3c9907fbf90263a96", 0x1000}, {&(0x7f0000dc5000)="ea90255dd8023276a52c4492e612bfd80e448bb663a1e1830e54173e73822bd381547cf6e7f1d6b80ede004299f1112db27c1d139f496cfed8c54f6b1948302ae894b07a7c814d07848e8e64c3d91a1ecd096c0c0490e3592be2bfe091d95d74b1ca3652c4729230be0ffe6847a517405b5abe856f2fb37e6263346377b840102bcb08d3e66a4bb980437a9659c1d6feaf680c3fb5dc6de83769a1defc4e4d8c605d402858885ce9a32777a78ffb5b03f0e4053e5b2bbcf3a96b89e18e40dc44f897c9086419e2291c7d72df16ccad94b64df12d4fbed8a3b4030a7899938282e0849f1c8f495eb85ac316e6bf5eeca432da", 0xf2}], 0x8, &(0x7f0000006000)=[]}, 0x0) 2018/02/10 14:10:11 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00000c0000)='/dev/binder#\x00', 0xffffffffffffffff, 0xfffffffffffffffc) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0) socketpair(0x10, 0x80007, 0x7f, &(0x7f0000cbd000)={0x0, 0x0}) readahead(r1, 0x61c, 0x3) bind$bt_l2cap(r2, &(0x7f0000b2f000)={0x1f, 0x2, {0x0, 0x400, 0x80000001, 0x6, 0x3d82b621, 0x37}, 0x8000, 0x9}, 0xe) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000a000)={0x34e, 0x0, &(0x7f00001e5000-0x8)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000006000-0x54)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000-0x30)={0x44, 0x0, &(0x7f0000d06000)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x38, 0x8, &(0x7f000000d000)=[@fda={0x66646185}, @flat={0x73682a85}], &(0x7f0000006000)=[0x20]}}], 0x0, 0x0, &(0x7f0000176000-0x1)}) r3 = openat$audio(0xffffffffffffff9c, &(0x7f0000c73000-0xb)='/dev/audio\x00', 0x0, 0x0) ioctl$KDGKBDIACR(r3, 0x4b4a, &(0x7f0000486000)) [ 69.471264] binder: 11548:11557 unknown command 0 [ 69.476205] binder: 11548:11557 ioctl c0306201 2000a000 returned -22 [ 69.531862] binder: 11562:11564 Acquire 1 refcount change on invalid ref 0 ret -22 [ 69.539700] binder: 11562:11564 unknown command 0 [ 69.563403] binder: 11562:11564 ioctl c0306201 2000a000 returned -22 2018/02/10 14:10:11 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0x0, 0x800) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000582000-0xb)='/dev/hwrng\x00', 0x193800, 0x0) getsockopt$packet_buf(r1, 0x107, 0x1, &(0x7f0000b79000-0x3b)=""/59, &(0x7f0000510000)=0x3b) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000a000)={0x34e, 0x0, &(0x7f00001e5000-0x8)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000006000-0x54)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000-0x30)={0x44, 0x0, &(0x7f0000d06000)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x38, 0x8, &(0x7f000000d000)=[@fda={0x66646185}, @flat={0x73682a85}], &(0x7f0000006000)=[0x20]}}], 0x0, 0x0, &(0x7f0000176000-0x1)}) 2018/02/10 14:10:11 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket(0x10, 0x803, 0x0) getsockopt$inet_sctp_SCTP_STATUS(r0, 0x84, 0xe, &(0x7f000094b000)={0x0, 0x9, 0x8, 0x1f5, 0x8, 0x80000000, 0x0, 0x6, {0x0, @in={{0x2, 0x3, @broadcast=0xffffffff}}, 0x3, 0x1, 0x55a1a79, 0x82f, 0xfffffffffffffffa}}, &(0x7f0000a28000-0x4)=0xb8) getsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r0, 0x84, 0x1f, &(0x7f00006da000-0x98)={r1, @in6={{0xa, 0x1, 0x8, @loopback={0x0, 0x1}, 0x7fff}}, 0x7fff, 0xc2ed}, &(0x7f0000416000-0x4)=0x98) sendto(r0, &(0x7f0000cff000-0x12)="120000001200e7ff00ffe90009144a000ae9", 0x12, 0x0, 0x0, 0x0) 2018/02/10 14:10:11 executing program 3: r0 = socket(0x40000100018, 0x2001, 0x3) recvfrom$unix(r0, &(0x7f0000008000-0x83)=""/131, 0x83, 0x0, &(0x7f0000007000)=@abs, 0x8) 2018/02/10 14:10:11 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x2, 0x78, 0xe2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndpcmp(&(0x7f0000cee000-0x12)='/dev/snd/pcmC#D#p\x00', 0xb956, 0x400080) ioctl$SNDRV_SEQ_IOCTL_DELETE_QUEUE(r0, 0x408c5333, &(0x7f0000fdf000)={0x7a43, 0x9, 0x8, 'queue1\x00', 0xfff}) r1 = openat$ashmem(0xffffffffffffff9c, &(0x7f00001cb000-0xc)='/dev/ashmem\x00', 0x0, 0x0) lseek(r1, 0x0, 0x0) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f0000002000-0x50)={@mcast1={0xff, 0x1, [], 0x1}, @remote={0xfe, 0x80, [], 0xffffffffffffffff, 0xbb}, @loopback={0x0, 0x1}, 0x0, 0x0, 0x0, 0x0, 0x5}) r2 = openat$sequencer(0xffffffffffffff9c, &(0x7f00000e0000)='/dev/sequencer\x00', 0x0, 0x0) ioctl$sock_SIOCSIFBR(r2, 0x8941, &(0x7f00006c1000)=@get={0x1, &(0x7f0000f25000)=""/101, 0x5}) bpf$PROG_LOAD(0x5, &(0x7f0000abf000)={0x1, 0x5, &(0x7f000074c000)=@framed={{0xffffffb4, 0x0, 0x0, 0x0, 0xe00000000000, 0x6c}, [@ldst={0x4, 0xf, 0x0, 0x4000000000000f, 0x200000000000}], {0x95}}, &(0x7f0000162000)='sydkaller\x00', 0x5, 0xc3, &(0x7f00007d2000-0xc3)=""/195}, 0x48) [ 69.591122] binder: 11562:11574 Acquire 1 refcount change on invalid ref 0 ret -22 [ 69.598956] binder: 11562:11574 unknown command 0 [ 69.607050] binder: 11562:11574 ioctl c0306201 2000a000 returned -22 2018/02/10 14:10:11 executing program 3: mmap(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f000000f000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f000000f000)={0x5, 0x0, 0x0, 0x0, 0x10, 0xffffffffffffffff}, 0x2c) mmap(&(0x7f0000010000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$vcsa(&(0x7f0000010000)='/dev/vcsa#\x00', 0xffff, 0x100) mmap(&(0x7f0000010000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$TCSETAW(r1, 0x5407, &(0x7f0000010000)={0x400, 0x9, 0x7, 0x9, 0x4, 0x4, 0x6, 0x4, 0x7f, 0x4}) dup2(r0, r0) 2018/02/10 14:10:11 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000689000)='/dev/sequencer2\x00', 0x280000, 0x0) getdents(r0, &(0x7f00003bd000)=""/35, 0x23) ioctl$sock_ipx_SIOCGIFADDR(r0, 0x8915, &(0x7f0000d43000-0x20)={"15fe63e3a5a47cf219ed9a82fba90b13", {0x4, 0x3f, 0x7fffffff, "cebd1d730dd4", 0x214d}}) r1 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000a000)={0x34e, 0x0, &(0x7f00001e5000-0x8)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000006000-0x54)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000008000-0x30)={0x0, 0x0, &(0x7f0000d06000)=[], 0x0, 0x0, &(0x7f0000176000-0x1)}) fcntl$F_GET_RW_HINT(r0, 0x40b, &(0x7f0000355000-0x8)) 2018/02/10 14:10:11 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000a5000-0x8)) mmap(&(0x7f0000000000/0x19000)=nil, 0x19000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$rfkill(0xffffffffffffff9c, &(0x7f000041e000-0xc)='/dev/rfkill\x00', 0x40, 0x0) ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f0000e54000-0x18)={0xaa}) ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f0000008000-0x20)={{&(0x7f0000000000/0x4000)=nil, 0x4000}, 0x1}) readv(r0, &(0x7f00001f3000-0x10)=[{&(0x7f0000002000-0x4e)=""/1, 0x1}], 0x1) ioctl$RNDADDTOENTCNT(r0, 0x40045201, &(0x7f0000b27000)) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000488000)={0x0}, &(0x7f0000170000-0x4)=0xc) getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f000004a000-0xe8)={{{@in=@multicast2, @in=@dev, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@broadcast}, 0x0, @in6=@dev}}, &(0x7f0000232000-0x4)=0xe8) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000ea4000-0xc)={0x0, 0x0, 0x0}, &(0x7f0000870000-0x4)=0xc) ioctl$TIOCGPGRP(r0, 0x540f, &(0x7f0000d64000)=0x0) getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f0000c59000)={{{@in6=@mcast1, @in6=@dev, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast1}, 0x0, @in6=@local}}, &(0x7f0000791000)=0xe8) stat(&(0x7f00000fe000)='./file0\x00', &(0x7f00001f6000-0x44)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) sendmmsg$unix(r0, &(0x7f00005bf000-0x38)=[{&(0x7f00005be000)=@file={0x0, './file0\x00'}, 0xa, &(0x7f000025f000-0x10)=[{&(0x7f000058f000-0xf2)="eca92e1c4ff039c3e11248b960d0f1ebde462cc5b27bff2dcb961ab7aa800b71594d71bed1b574c6ab5431dac7ff1acaef2b6d8d506f56aade916f7596cb004dceb6d8a40e9ea615019381f0175b74c6bc1fa131c05cfcde845ac07709184226cbb391b31914f5b80c436aec0476f1d3e17fbe3f8dcd1af9f8583ed4832216f5e0378790e70c9c946aed93b79a7e3bdd697a679666a78b9c460cda8b76f0b2fe6b9564c207fcc4d2b80732f04a663bb92c4ceb34deb6929a7cec7699f067bd8ccb25eee90d3be264f895700036c36a61be110748eb1f0986a7ede396eafec1cd780d3c0116ca2e80fc26d14443d93b196af7", 0xf2}, {&(0x7f000098d000)="b3148fde95163472aa5dc015cbed83e25ab70986", 0x14}], 0x2, &(0x7f0000520000)=[@cred={0x18, 0x1, 0x2, r1, r2, r3}, @cred={0x18, 0x1, 0x2, r4, r5, r6}, @rights={0x20, 0x1, 0x1, [r0, r0, r0, r0, r0]}], 0x50, 0x4000000}, {&(0x7f00004f1000)=@abs={0x0, 0x0, 0x2}, 0x8, &(0x7f0000125000)=[], 0x0, &(0x7f0000999000-0x24)=[@rights={0x10, 0x1, 0x1, [r0]}, @rights={0x14, 0x1, 0x1, [r0, r0]}], 0x24, 0x24000000}], 0x2, 0x0) ioctl$RNDADDTOENTCNT(r0, 0x40045201, &(0x7f0000a81000)) ioctl$UFFDIO_UNREGISTER(0xffffffffffffffff, 0xc020aa04, &(0x7f0000008000-0x4)={&(0x7f0000000000/0x2000)=nil, 0x2000}) 2018/02/10 14:10:11 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r0, r0, &(0x7f0000049000), 0x3d2) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000008000)={&(0x7f000000f000-0xc)={0x10, 0x34000}, 0xc, &(0x7f0000220000)={&(0x7f00008d6000-0x14)={0x14, 0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, {}, []}, 0x14}, 0x1}, 0x0) r1 = userfaultfd(0x80800) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000ff8000-0x20)={{&(0x7f0000012000/0x2000)=nil, 0x2000}, 0x1}) bpf$MAP_CREATE(0x0, &(0x7f0000fb4000)={0x2, 0x8000000000000004, 0x400, 0x7fd, 0x4, 0xffffffffffffffff}, 0x2c) userfaultfd(0x800) clock_gettime(0x0, &(0x7f0000132000)={0x0, 0x0}) socketpair(0x1d, 0x800, 0x4, &(0x7f0000589000)) r4 = syz_open_dev$mouse(&(0x7f00006eb000)='/dev/input/mouse#\x00', 0xde6e, 0x1) timer_settime(0x0, 0x1, &(0x7f000097e000)={{0x0, r3}, {r2, r3+10000000}}, &(0x7f0000939000)) fanotify_init(0x25, 0x802) r5 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000ef2000-0x1d)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f00002d8000-0xc)={0x0, 0x0}, &(0x7f0000d76000-0x4)=0xc) syz_open_procfs(r6, &(0x7f0000013000)='ns/cgroup\x00') openat$ion(0xffffffffffffff9c, &(0x7f0000dd5000)='/dev/ion\x00', 0x800, 0x0) pipe2(&(0x7f000058c000), 0x4800) setsockopt$inet_IP_XFRM_POLICY(r4, 0x0, 0x11, &(0x7f0000e12000-0xe8)={{{@in6=@mcast1={0xff, 0x1, [], 0x1}, @in=@rand_addr, 0x2, 0xbd, 0x3, 0x20, 0xa, 0x0, 0x80, 0xbf, 0x0, r7}, {0x0, 0x8, 0x0, 0x3, 0x6, 0x1fa8, 0x8, 0x20}, {0x1719, 0x7fff, 0x7ff, 0x7ff}, 0x1, 0x7, 0x0, 0x1, 0x1, 0x3}, {{@in=@broadcast=0xffffffff, 0x1, 0x7f}, 0xa, @in=@empty, 0xffffffffffffffff, 0x3, 0x0, 0xffffffffffffffbc, 0x20, 0x6, 0x2}}, 0xe8) openat$selinux_policy(0xffffffffffffff9c, &(0x7f000010e000-0x10)='/selinux/policy\x00', 0x0, 0x0) setsockopt$netlink_NETLINK_TX_RING(r5, 0x10e, 0x7, &(0x7f0000ab4000-0x10)={0x6, 0x7, 0x52, 0xfffffffffffffffc}, 0x10) [ 69.649650] binder: 11584:11587 unknown command 0 [ 69.665006] binder: 11584:11587 ioctl c0306201 2000a000 returned -22 [ 69.710897] binder_alloc: binder_alloc_mmap_handler: 11584 20000000-20002000 already mapped failed -16 [ 69.711338] binder: 11597:11598 Acquire 1 refcount change on invalid ref 0 ret -22 [ 69.728236] binder: 11597:11598 unknown command 0 [ 69.733841] binder: BINDER_SET_CONTEXT_MGR already set [ 69.737622] binder: 11597:11598 ioctl c0306201 2000a000 returned -22 [ 69.746153] binder: 11584:11607 unknown command 0 [ 69.746582] binder: 11584:11587 ioctl 40046207 0 returned -16 [ 69.752072] binder: 11584:11607 ioctl c0306201 2000a000 returned -22 [ 69.774964] binder: 11597:11598 Acquire 1 refcount change on invalid ref 0 ret -22 [ 69.782792] binder: 11597:11598 unknown command 0 [ 69.788083] binder: 11597:11598 ioctl c0306201 2000a000 returned -22 [ 69.794237] binder: release 11584:11593 transaction 289 out, still active [ 69.801596] binder: undelivered TRANSACTION_COMPLETE [ 69.806885] binder: send failed reply for transaction 289, target dead 2018/02/10 14:10:11 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$evdev(&(0x7f0000dda000-0x12)='/dev/input/event#\x00', 0x0, 0x0) ioctl$EVIOCGRAB(r0, 0x40044590, &(0x7f0000e95000-0x4)) ioctl$TIOCSBRK(0xffffffffffffffff, 0x40044591) request_key(&(0x7f0000102000)='big_key\x00', &(0x7f0000ad3000)={0x73, 0x79, 0x7a, 0x3}, &(0x7f00006cc000-0x40)='deflate\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', 0xffffffffffffffff) r1 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000005000)='/dev/rfkill\x00', 0x900, 0x0) bind$inet(r1, &(0x7f0000f0a000-0x10)={0x2, 0x0, @multicast1=0xe0000001}, 0x10) 2018/02/10 14:10:11 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00005dc000-0x30)={0xfffffffffffffe34, 0x0, &(0x7f0000bb9000-0x8)=[@acquire={0x40046305, 0x1000000}], 0x0, 0x0, &(0x7f0000006000-0x54)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000008000-0x30)={0x0, 0x0, &(0x7f0000d06000)=[], 0x0, 0x0, &(0x7f0000176000-0x1)}) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) ioctl$SNDRV_TIMER_IOCTL_STATUS(r1, 0x80585414, &(0x7f000032f000)=""/182) getsockopt$inet_sctp_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000daa000)={0x3, 0x8, 0x8, 0x5, 0x80000000, 0x7f, 0x1, 0x4, 0x0}, &(0x7f0000e1f000-0x4)=0x20) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f000001b000-0xc)={r2, 0xd0, &(0x7f0000c71000)=[@in6={0xa, 0x2, 0x5730, @remote={0xfe, 0x80, [], 0x0, 0xbb}, 0x40}, @in={0x2, 0x3, @rand_addr=0x80000001}, @in={0x2, 0x0, @dev={0xac, 0x14, 0x0, 0x15}}, @in={0x2, 0x3, @local={0xac, 0x14, 0x0, 0xaa}}, @in6={0xa, 0x1, 0x7, @empty, 0x3}, @in={0x2, 0x0, @dev={0xac, 0x14, 0x0, 0xa}}, @in6={0xa, 0x3, 0x7, @empty, 0x2362e37c}, @in6={0xa, 0x3, 0x4, @local={0xfe, 0x80, [], 0x0, 0xaa}, 0x8e7}, @in={0x2, 0x3, @rand_addr=0x401}, @in={0x2, 0x2, @dev={0xac, 0x14, 0x0, 0xa}}]}, &(0x7f00008e5000)=0xc) 2018/02/10 14:10:11 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r0, r0, &(0x7f0000049000), 0x3d2) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000008000)={&(0x7f000000f000-0xc)={0x10, 0x34000}, 0xc, &(0x7f0000220000)={&(0x7f00008d6000-0x14)={0x14, 0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, {}, []}, 0x14}, 0x1}, 0x0) r1 = userfaultfd(0x80800) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000ff8000-0x20)={{&(0x7f0000012000/0x2000)=nil, 0x2000}, 0x1}) bpf$MAP_CREATE(0x0, &(0x7f0000fb4000)={0x2, 0x8000000000000004, 0x400, 0x7fd, 0x4, 0xffffffffffffffff}, 0x2c) userfaultfd(0x800) clock_gettime(0x0, &(0x7f0000132000)={0x0, 0x0}) socketpair(0x1d, 0x800, 0x4, &(0x7f0000589000)) r4 = syz_open_dev$mouse(&(0x7f00006eb000)='/dev/input/mouse#\x00', 0xde6e, 0x1) timer_settime(0x0, 0x1, &(0x7f000097e000)={{0x0, r3}, {r2, r3+10000000}}, &(0x7f0000939000)) fanotify_init(0x25, 0x802) r5 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000ef2000-0x1d)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f00002d8000-0xc)={0x0, 0x0}, &(0x7f0000d76000-0x4)=0xc) syz_open_procfs(r6, &(0x7f0000013000)='ns/cgroup\x00') openat$ion(0xffffffffffffff9c, &(0x7f0000dd5000)='/dev/ion\x00', 0x800, 0x0) pipe2(&(0x7f000058c000), 0x4800) setsockopt$inet_IP_XFRM_POLICY(r4, 0x0, 0x11, &(0x7f0000e12000-0xe8)={{{@in6=@mcast1={0xff, 0x1, [], 0x1}, @in=@rand_addr, 0x2, 0xbd, 0x3, 0x20, 0xa, 0x0, 0x80, 0xbf, 0x0, r7}, {0x0, 0x8, 0x0, 0x3, 0x6, 0x1fa8, 0x8, 0x20}, {0x1719, 0x7fff, 0x7ff, 0x7ff}, 0x1, 0x7, 0x0, 0x1, 0x1, 0x3}, {{@in=@broadcast=0xffffffff, 0x1, 0x7f}, 0xa, @in=@empty, 0xffffffffffffffff, 0x3, 0x0, 0xffffffffffffffbc, 0x20, 0x6, 0x2}}, 0xe8) openat$selinux_policy(0xffffffffffffff9c, &(0x7f000010e000-0x10)='/selinux/policy\x00', 0x0, 0x0) setsockopt$netlink_NETLINK_TX_RING(r5, 0x10e, 0x7, &(0x7f0000ab4000-0x10)={0x6, 0x7, 0x52, 0xfffffffffffffffc}, 0x10) 2018/02/10 14:10:11 executing program 3: perf_event_open(&(0x7f000001d000)={0x3, 0x78, 0xe2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x80000001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000fee000+0xf8e)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000006000)={0x6, 0x4, 0x3f, 0xb}, 0x2c) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f000000f000)={r0, &(0x7f000000a000), &(0x7f0000917000-0x30)=""/48}, 0x17) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000000)={0x0, 0x0}) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffff9c, 0x84, 0x6, &(0x7f000022e000-0x8c)={0x0, @in={{0x2, 0x1, @broadcast=0xffffffff}}}, &(0x7f00001eb000-0x4)=0x8c) getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(r1, 0x84, 0x6c, &(0x7f0000e50000-0x80)={r2, 0x78, "d90d67810739f32fd213e27e35c5c53fb3693f6645f4045be373412cc91097b8dfecd23058f23f2ae67a5fb2c0f2e8ddc88e8320e8de818eb144eff1f7bc3ced10b6bc5c572bfba6ceb859af4ac8ab6d4c06d4f7bdf289a0a57bb8aeb73be5587d941f94f32a44647828b94b8dc72550aebf6094d7e314d9"}, &(0x7f0000439000)=0x80) 2018/02/10 14:10:11 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r0, &(0x7f00004c0000)={0xa, 0x3, 0x0, @ipv4={[], [0xff, 0xff], @empty}}, 0x1c) listen(r0, 0xffff) r1 = socket$inet6_sctp(0xa, 0x4000000000000001, 0x84) sendto$inet6(r1, &(0x7f0000848000-0x1)='X', 0x1, 0x0, &(0x7f0000060000-0x1c)={0xa, 0x3, 0x0, @loopback={0x0, 0x1}}, 0x1c) keyctl$join(0x1, &(0x7f000043f000)={0x73, 0x79, 0x7a, 0x0}) r2 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f000091a000-0xd)='/selinux/mls\x00', 0x0, 0x0) getsockopt$inet_sctp_SCTP_HMAC_IDENT(r2, 0x84, 0x16, &(0x7f0000270000-0x6)={0x1, [0x1f]}, &(0x7f00004d0000)=0x6) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000d6b000)=@syzn={0x73, 0x79, 0x7a, 0x0}, 0x10) write$eventfd(r1, &(0x7f0000db9000), 0x8) 2018/02/10 14:10:11 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000a5000-0x8)) mmap(&(0x7f0000000000/0x19000)=nil, 0x19000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000c18000-0xc)='/dev/rfkill\x00', 0x2000, 0x0) r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000e54000-0x18)={0xaa}) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000008000-0x20)={{&(0x7f0000000000/0x4000)=nil, 0x4000}, 0x1}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000db1000-0x20)={{&(0x7f0000cf7000/0x2000)=nil, 0x2000}, 0x3}) readv(r0, &(0x7f00001f3000-0x10)=[{&(0x7f0000002000-0x4e)=""/1, 0x1}], 0x1) ioctl$RNDADDTOENTCNT(r0, 0x40045201, &(0x7f0000b27000)) ioctl$RNDADDTOENTCNT(r0, 0x40045201, &(0x7f0000a81000)) setsockopt$bt_BT_DEFER_SETUP(r0, 0x112, 0x7, &(0x7f0000cec000)=0xfff, 0x4) ioctl$UFFDIO_UNREGISTER(r1, 0xc020aa04, &(0x7f0000008000-0x4)={&(0x7f0000000000/0x2000)=nil, 0x2000}) 2018/02/10 14:10:11 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000a000)={0x34e, 0x0, &(0x7f00001e5000-0x8)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000006000-0x54)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000-0x30)={0x44, 0x0, &(0x7f0000d06000)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x38, 0x8, &(0x7f000000d000)=[@fda={0x66646185}, @flat={0x73682a85}], &(0x7f0000006000)=[0x20]}}], 0x0, 0x0, &(0x7f0000176000-0x1)}) socket$inet(0x2, 0xa, 0x0) 2018/02/10 14:10:11 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00009f2000)={0x26, 'skcipher\x00', 0x0, 0x0, 'salsa20\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00004f7000)="649c47ad46390d006dc80000009d4d54", 0x10) r1 = dup(r0) bind$pptp(r1, &(0x7f00002d5000)={0x18, 0x2, {0x3, @loopback=0x7f000001}}, 0x20) r2 = accept4$alg(r1, 0x0, 0x0, 0x0) io_setup(0x3, &(0x7f0000cae000-0x4)=0x0) io_submit(r3, 0x1, &(0x7f000049c000-0x18)=[&(0x7f00004dc000-0x40)={0x0, 0x0, 0x0, 0x0, 0x0, r2, &(0x7f0000392000-0x1000)="83", 0x1, 0x0, 0x0, 0x0, 0xffffffffffffffff}]) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r1, 0x84, 0x6e, &(0x7f00009d3000-0x2c)=[@in={0x2, 0x0, @dev={0xac, 0x14, 0x0, 0x10}}, @in6={0xa, 0x1, 0x1417c8f, @empty, 0x2}], 0x2c) 2018/02/10 14:10:12 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000cf9000)='/dev/binder#\x00', 0x0, 0x4) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000181000-0xb)='/dev/hwrng\x00', 0x20a040, 0x0) getsockopt$inet_sctp6_SCTP_I_WANT_MAPPED_V4_ADDR(r1, 0x84, 0xc, &(0x7f0000b96000), &(0x7f0000b3c000-0x4)=0x4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000a000)={0x34e, 0x0, &(0x7f00001e5000-0x8)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000006000-0x54)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000792000)={0x0, 0x0, &(0x7f0000d06000)=[], 0x0, 0x0, &(0x7f0000176000-0x1)}) [ 69.920870] binder: 11622:11626 unknown command 0 [ 69.937265] binder: 11622:11626 ioctl c0306201 2000a000 returned -22 [ 69.955384] binder_alloc: binder_alloc_mmap_handler: 11622 20000000-20002000 already mapped failed -16 2018/02/10 14:10:12 executing program 3: mmap(&(0x7f0000000000/0xfd7000)=nil, 0xfd7000, 0x3, 0x32, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000fd4000)={0x0}) futex(&(0x7f000000d000-0x4)=0x4, 0x80000000000b, 0x4, &(0x7f0000ee0000-0x10)={r0}, &(0x7f0000048000), 0x0) futex(&(0x7f000000d000-0x4), 0xc, 0x1, &(0x7f000000d000), &(0x7f0000048000)=0x7, 0x0) mmap(&(0x7f0000fd7000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000fd7000)=0x0) syz_open_dev$dmmidi(&(0x7f0000b5f000)='/dev/dmmidi#\x00', 0x6, 0x20000) mmap(&(0x7f0000fd8000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r2 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000fd8000)='/selinux/checkreqprot\x00', 0x200040, 0x0) ioctl$TIOCGPGRP(r2, 0x540f, &(0x7f0000913000-0x4)=0x0) mmap(&(0x7f0000fd7000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) rt_tgsigqueueinfo(r1, r3, 0x15, &(0x7f0000fd7000)={0xf, 0x2, 0x8}) 2018/02/10 14:10:12 executing program 0: mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000001000)='/dev/hwrng\x00', 0x400002, 0x0) ioctl$TUNSETTXFILTER(r0, 0x400454d1, &(0x7f0000001000-0xa)={0x1, 0x1, [@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff]]}) r1 = socket$inet6_dccp(0xa, 0x6, 0x0) ioctl$KVM_GET_NR_MMU_PAGES(r0, 0xae45, 0x81) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$VHOST_SET_LOG_FD(r1, 0x4004af07, &(0x7f0000002000-0x4)) getsockopt(r1, 0x2000000000010d, 0x20000000000c, &(0x7f00001b0000-0xab)=""/4, &(0x7f0000000000)=0x4) [ 69.968430] binder: 11636:11639 Acquire 1 refcount change on invalid ref 0 ret -22 [ 69.976356] binder: 11636:11639 unknown command 0 [ 69.982867] binder: 11636:11639 ioctl c0306201 2000a000 returned -22 [ 69.986329] binder: BINDER_SET_CONTEXT_MGR already set [ 69.995350] binder: 11622:11626 ioctl 40046207 0 returned -16 [ 70.002523] binder: 11622:11642 unknown command 0 2018/02/10 14:10:12 executing program 1: mmap(&(0x7f0000000000/0xc000)=nil, 0xc000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndctrl(&(0x7f0000006000)='/dev/snd/controlC#\x00', 0x0, 0x0) mmap(&(0x7f000000c000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) getsockopt$sock_cred(0xffffffffffffff9c, 0x1, 0x11, &(0x7f0000004000-0xc)={0x0}, &(0x7f000000d000-0x4)=0xc) mmap(&(0x7f000000c000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) fcntl$lock(r0, 0x7, &(0x7f000000d000-0x10)={0x3, 0x1, 0x3, 0x3, r1}) ioctl$SNDRV_CTL_IOCTL_PCM_INFO(r0, 0xc1205531, &(0x7f000000c000-0x120)={0x0, 0x0, 0x2a, 0x0, [], [], [], 0x0, 0x0, 0x0, 0x0, "77decac9a434f47ff7d7ee3a45c4271d"}) 2018/02/10 14:10:12 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000a5000-0x8)) mmap(&(0x7f0000000000/0x19000)=nil, 0x19000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000924000-0xc)='/dev/rfkill\x00', 0x0, 0x0) r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000e54000-0x18)={0xaa}) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000008000-0x20)={{&(0x7f0000000000/0x4000)=nil, 0x4000}, 0x1}) readv(r0, &(0x7f00001f3000-0x10)=[{&(0x7f0000002000-0x4e)=""/1, 0x1}], 0x1) ioctl$RNDADDTOENTCNT(r0, 0x40045201, &(0x7f0000b27000)) r2 = openat$dsp(0xffffffffffffff9c, &(0x7f0000689000-0x9)='/dev/dsp\x00', 0x400000, 0x0) ioctl$RNDADDTOENTCNT(r2, 0x40045201, &(0x7f0000c0c000)) userfaultfd(0x800) ioctl$UFFDIO_UNREGISTER(r1, 0xc020aa04, &(0x7f0000008000-0x4)={&(0x7f0000000000/0x2000)=nil, 0x2000}) 2018/02/10 14:10:12 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r0, r0, &(0x7f0000049000), 0x3d2) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000008000)={&(0x7f000000f000-0xc)={0x10, 0x34000}, 0xc, &(0x7f0000220000)={&(0x7f00008d6000-0x14)={0x14, 0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, {}, []}, 0x14}, 0x1}, 0x0) r1 = userfaultfd(0x80800) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000ff8000-0x20)={{&(0x7f0000012000/0x2000)=nil, 0x2000}, 0x1}) bpf$MAP_CREATE(0x0, &(0x7f0000fb4000)={0x2, 0x8000000000000004, 0x400, 0x7fd, 0x4, 0xffffffffffffffff}, 0x2c) userfaultfd(0x800) clock_gettime(0x0, &(0x7f0000132000)={0x0, 0x0}) socketpair(0x1d, 0x800, 0x4, &(0x7f0000589000)) r4 = syz_open_dev$mouse(&(0x7f00006eb000)='/dev/input/mouse#\x00', 0xde6e, 0x1) timer_settime(0x0, 0x1, &(0x7f000097e000)={{0x0, r3}, {r2, r3+10000000}}, &(0x7f0000939000)) fanotify_init(0x25, 0x802) r5 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000ef2000-0x1d)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f00002d8000-0xc)={0x0, 0x0}, &(0x7f0000d76000-0x4)=0xc) syz_open_procfs(r6, &(0x7f0000013000)='ns/cgroup\x00') openat$ion(0xffffffffffffff9c, &(0x7f0000dd5000)='/dev/ion\x00', 0x800, 0x0) pipe2(&(0x7f000058c000), 0x4800) setsockopt$inet_IP_XFRM_POLICY(r4, 0x0, 0x11, &(0x7f0000e12000-0xe8)={{{@in6=@mcast1={0xff, 0x1, [], 0x1}, @in=@rand_addr, 0x2, 0xbd, 0x3, 0x20, 0xa, 0x0, 0x80, 0xbf, 0x0, r7}, {0x0, 0x8, 0x0, 0x3, 0x6, 0x1fa8, 0x8, 0x20}, {0x1719, 0x7fff, 0x7ff, 0x7ff}, 0x1, 0x7, 0x0, 0x1, 0x1, 0x3}, {{@in=@broadcast=0xffffffff, 0x1, 0x7f}, 0xa, @in=@empty, 0xffffffffffffffff, 0x3, 0x0, 0xffffffffffffffbc, 0x20, 0x6, 0x2}}, 0xe8) openat$selinux_policy(0xffffffffffffff9c, &(0x7f000010e000-0x10)='/selinux/policy\x00', 0x0, 0x0) setsockopt$netlink_NETLINK_TX_RING(r5, 0x10e, 0x7, &(0x7f0000ab4000-0x10)={0x6, 0x7, 0x52, 0xfffffffffffffffc}, 0x10) 2018/02/10 14:10:12 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f00008d2000)='/dev/vcs\x00', 0x80, 0x0) ioctl$sock_ipx_SIOCSIFADDR(r1, 0x8916, &(0x7f0000a5e000-0x20)={"b8eb77b49a73733414b692b40780d232", {0x4, 0x8, 0xfff, "684f7a5222ed", 0x80000001}}) getsockopt$inet_sctp6_SCTP_I_WANT_MAPPED_V4_ADDR(r1, 0x84, 0xc, &(0x7f0000995000), &(0x7f0000797000-0x4)=0x4) getsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r1, 0x84, 0x22, &(0x7f000070f000-0x10)={0x101, 0x8, 0x7, 0xffff, 0x0}, &(0x7f0000930000)=0x10) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(r1, 0x84, 0x6, &(0x7f00001fb000-0x8c)={r2, @in6={{0xa, 0x1, 0x70, @local={0xfe, 0x80, [], 0x0, 0xaa}, 0x2}}}, &(0x7f0000b62000)=0x8c) setsockopt$inet_sctp_SCTP_SET_PEER_PRIMARY_ADDR(r1, 0x84, 0x5, &(0x7f0000549000)={r2, @in={{0x2, 0x2, @loopback=0x7f000001}}}, 0x8c) getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(0xffffffffffffffff, 0x84, 0xf, &(0x7f0000fc7000-0xa0)={0x0, @in6={{0xa, 0x0, 0x8, @mcast1={0xff, 0x1, [], 0x1}, 0x100}}, 0x10000, 0x1, 0x293, 0x7, 0x7}, &(0x7f0000e07000)=0xa0) setns(r0, 0x0) setsockopt$inet_sctp_SCTP_AUTH_DELETE_KEY(0xffffffffffffffff, 0x84, 0x19, &(0x7f000057c000-0x6)={r3, 0xd86b}, 0x6) openat$cuse(0xffffffffffffff9c, &(0x7f0000903000)='/dev/cuse\x00', 0x500, 0x0) setsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(r1, 0x84, 0x13, &(0x7f00007b0000-0x4)=0x1, 0x4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000a000)={0x34e, 0x0, &(0x7f00001e5000-0x8)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000006000-0x54)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000008000-0x30)={0x0, 0x0, &(0x7f0000d06000)=[], 0x0, 0x0, &(0x7f0000176000-0x1)}) 2018/02/10 14:10:12 executing program 0: r0 = socket$inet(0x2, 0x80001, 0x0) r1 = syz_open_dev$vcsn(&(0x7f0000eb2000-0xa)='/dev/vcs#\x00', 0x3f, 0x1) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x1, 0x32, 0xffffffffffffffff, 0x0) setsockopt$IPT_SO_SET_REPLACE(r0, 0x100000000000001, 0x2c, &(0x7f00001a4000)=@security={'-ecurity\x00', 0xe, 0x4, 0x260, 0xffffffff, 0x0, 0x0, 0x0, 0xffffffff, 0xffffffff, 0x0, 0x0, 0x0, 0xffffffff, 0x4, &(0x7f0000023000), {[{{@uncond, 0x0, 0x70, 0x98, 0x0, {}, []}, @common=@unspec=@STANDARD={0x28}}, {{@ip={@loopback=0x7f000001, @rand_addr, 0x0, 0x0, @syzn={0x73, 0x79, 0x7a}, @syzn={0x73, 0x79, 0x7a}}, 0x0, 0x70, 0x98, 0x0, {}, []}, @common=@unspec=@NFQUEUE2={0x28, 'NFQUEUE\x00', 0x2}}, {{@ip={@multicast2=0xe0000002, @multicast1=0xe0000001, 0x0, 0x0, @common='syzkaller0\x00', @common='syzkaller0\x00'}, 0x0, 0x70, 0x98, 0x0, {}, []}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}], {{[], 0x0, 0x70, 0x98}, {0x28, '\x00', 0x0, 0x70}}}}, 0x2c0) recvmsg(r0, &(0x7f0000108000-0x1c)={&(0x7f00004c7000-0x3a)=@pppol2tpv3in6={0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, @loopback}}}, 0x3a, &(0x7f0000312000-0x18)=[{&(0x7f0000339000-0x94)=""/148, 0x94}, {&(0x7f0000cb0000-0x74)=""/116, 0x74}, {&(0x7f0000463000-0x9e)=""/158, 0x9e}], 0x3, 0x0, 0x0, 0x8}, 0x1) setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r2, 0x10e, 0x2, &(0x7f0000544000)=0x12, 0x4) getsockname$netrom(r1, &(0x7f0000618000-0x48)=@full, &(0x7f000061a000)=0x81) [ 70.017969] binder_alloc: 11622: binder_alloc_buf, no vma [ 70.018313] binder: 11636:11643 Acquire 1 refcount change on invalid ref 0 ret -22 [ 70.023633] binder: 11622:11635 transaction failed 29189/-3, size 56-8 line 2957 [ 70.031295] binder: 11636:11643 unknown command 0 [ 70.046467] binder: 11622:11642 ioctl c0306201 2000a000 returned -22 [ 70.057785] binder: 11636:11643 ioctl c0306201 2000a000 returned -22 [ 70.095072] binder: undelivered TRANSACTION_ERROR: 29189 [ 70.096221] binder: 11653:11655 unknown command 0 [ 70.109390] binder: release 11622:11635 transaction 293 out, still active [ 70.114801] binder: 11653:11655 ioctl c0306201 2000a000 returned -22 [ 70.116416] binder: undelivered TRANSACTION_COMPLETE [ 70.128108] binder: send failed reply for transaction 293, target dead [ 70.145498] binder: 11653:11655 Acquire 1 refcount change on invalid ref 0 ret -22 [ 70.149090] can_create: 13 callbacks suppressed [ 70.149095] can: request_module (can-proto-4) failed. [ 70.153291] binder: 11653:11655 unknown command 0 [ 70.169098] binder: 11653:11655 ioctl c0306201 2000a000 returned -22 2018/02/10 14:10:12 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000fdf000-0x78)={0x2, 0x78, 0xe3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008ff000-0x10)={&(0x7f0000da9000)={0x2, 0x3, 0x0, 0x9, 0x10, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, [@sadb_x_sa2={0x2, 0x13, 0x2}, @sadb_address={0x5, 0x6, 0x0, 0x0, 0x0, @in6={0xa, 0xffffffffffffffff, 0x0, @empty}}, @sadb_sa={0x2, 0x1, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x2}, @sadb_address={0x5, 0x5, 0x0, 0x0, 0x0, @in6={0xa, 0xffffffffffffffff, 0x0, @mcast1={0xff, 0x1, [], 0x1}}}]}, 0x80}, 0x1}, 0x0) socketpair$inet_sctp(0x2, 0x1, 0x84, &(0x7f00002e8000-0x8)) 2018/02/10 14:10:12 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0) r1 = dup3(r0, 0xffffffffffffff9c, 0x80000) inotify_add_watch(r1, &(0x7f000057b000-0x8)='./file0\x00', 0x605) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000a000)={0x34e, 0x0, &(0x7f00001e5000-0x8)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000006000-0x54)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000-0x30)={0x44, 0x0, &(0x7f0000d06000)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x38, 0x8, &(0x7f000000d000)=[@fda={0x66646185}, @flat={0x73682a85}], &(0x7f0000006000)=[0x20]}}], 0x0, 0x0, &(0x7f0000176000-0x1)}) 2018/02/10 14:10:12 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$evdev(&(0x7f0000dda000-0x12)='/dev/input/event#\x00', 0x0, 0x0) ioctl$EVIOCGRAB(r0, 0x40044590, &(0x7f0000e95000-0x4)) ioctl$TIOCSBRK(0xffffffffffffffff, 0x40044591) r1 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000523000)='/selinux/commit_pending_bools\x00', 0x1, 0x0) ioctl$RNDZAPENTCNT(r1, 0x5204, &(0x7f0000073000)=0x4) r2 = syz_open_dev$sg(&(0x7f00002d6000-0x9)='/dev/sg#\x00', 0xd02, 0x2002) ioctl$DRM_IOCTL_RES_CTX(0xffffffffffffffff, 0xc0086426, &(0x7f0000645000-0x8)={0x9, &(0x7f0000876000)=[{}, {}, {}, {}, {0x0}, {}, {}, {}, {}]}) socket$inet(0x2, 0x1, 0x1) fcntl$getownex(r0, 0x10, &(0x7f0000791000)={0x0, 0x0}) getpgid(r4) ioctl$DRM_IOCTL_UNLOCK(r2, 0x4008642b, &(0x7f0000616000)={r3, 0x21}) openat$selinux_validatetrans(0xffffffffffffff9c, &(0x7f0000351000)='/selinux/validatetrans\x00', 0x1, 0x0) request_key(&(0x7f0000102000)='big_key\x00', &(0x7f0000ad3000)={0x73, 0x79, 0x7a, 0x3}, &(0x7f00006cc000-0x40)='deflate\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', 0xffffffffffffffff) 2018/02/10 14:10:12 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x80002, 0x88) bind$inet6(r0, &(0x7f0000d86000-0x1c)={0xa, 0x3, 0x0, @empty}, 0x1c) r1 = socket$inet6(0xa, 0x80a, 0x1) setsockopt$inet6_udp_int(r1, 0x11, 0xa, &(0x7f000073c000-0x4)=0xfefffffffffffffe, 0x4) sendmsg$inet_sctp(r1, &(0x7f000095a000-0x38)={&(0x7f0000a34000)=@in={0x2, 0x3, @empty}, 0x10, &(0x7f0000f71000)=[{&(0x7f0000f70000-0x65)="470a3747e4d6c6dc7e519c8cfa37b13380c40d870100010000000000a6fa401ca8969a47542c8e2cb000000b0000000000dbf1eedf91d955a9e84c62af9fc4452b9c97c651", 0x45}], 0x1}, 0x0) recvmsg(r0, &(0x7f0000040000)={&(0x7f00001a0000-0x14)=@ll={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @empty}, 0x14, &(0x7f0000e34000)=[{&(0x7f00007a7000)=""/113, 0x71}], 0x1, &(0x7f0000ad8000-0xad)=""/173, 0xad}, 0x0) 2018/02/10 14:10:12 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000a000)={0x34e, 0x0, &(0x7f00001e5000-0x8)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000006000-0x54)}) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000759000-0xc)={0x0}, &(0x7f0000e40000-0x4)=0xc) syncfs(r0) rt_sigqueueinfo(r1, 0x1, &(0x7f0000c4a000-0x10)={0x15, 0x9, 0x6, 0x100000001}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000008000-0x30)={0x0, 0x0, &(0x7f0000d06000)=[], 0x0, 0x0, &(0x7f0000176000-0x1)}) 2018/02/10 14:10:12 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = accept4$alg(0xffffffffffffffff, 0x0, 0x0, 0x80000) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000cd9000-0xc)={0x0}, &(0x7f0000a66000-0x4)=0xc) perf_event_open(&(0x7f0000015000-0x78)={0x1, 0x78, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3fe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff}, r1, 0x0, 0xffffffffffffffff, 0x0) 2018/02/10 14:10:12 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000a5000-0x8)) mmap(&(0x7f0000000000/0x19000)=nil, 0x19000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000924000-0xc)='/dev/rfkill\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r0, 0xc04064a0, &(0x7f0000486000-0x30)={&(0x7f0000e73000-0x14)=[0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f000017e000-0x4)=[0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000040000-0x10)=[0x0, 0x0, 0x0, 0x0], &(0x7f0000936000)=[0x0, 0x0, 0x0, 0x0, 0x0], 0x5, 0x5, 0x4, 0x5}) r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000e54000-0x18)={0xaa}) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000008000-0x20)={{&(0x7f0000000000/0x4000)=nil, 0x4000}, 0x1}) readv(r0, &(0x7f00001f3000-0x10)=[{&(0x7f0000002000-0x4e)=""/1, 0x1}], 0x1) ioctl$RNDADDTOENTCNT(r0, 0x40045201, &(0x7f0000b27000)) ioctl$RNDADDTOENTCNT(r0, 0x40045201, &(0x7f0000a81000)) ioctl$UFFDIO_UNREGISTER(r1, 0xc020aa04, &(0x7f0000008000-0x4)={&(0x7f0000000000/0x2000)=nil, 0x2000}) 2018/02/10 14:10:12 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r0, r0, &(0x7f0000049000), 0x3d2) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000008000)={&(0x7f000000f000-0xc)={0x10, 0x34000}, 0xc, &(0x7f0000220000)={&(0x7f00008d6000-0x14)={0x14, 0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, {}, []}, 0x14}, 0x1}, 0x0) r1 = userfaultfd(0x80800) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000ff8000-0x20)={{&(0x7f0000012000/0x2000)=nil, 0x2000}, 0x1}) bpf$MAP_CREATE(0x0, &(0x7f0000fb4000)={0x2, 0x8000000000000004, 0x400, 0x7fd, 0x4, 0xffffffffffffffff}, 0x2c) userfaultfd(0x800) clock_gettime(0x0, &(0x7f0000132000)={0x0, 0x0}) socketpair(0x1d, 0x800, 0x4, &(0x7f0000589000)) r4 = syz_open_dev$mouse(&(0x7f00006eb000)='/dev/input/mouse#\x00', 0xde6e, 0x1) timer_settime(0x0, 0x1, &(0x7f000097e000)={{0x0, r3}, {r2, r3+10000000}}, &(0x7f0000939000)) fanotify_init(0x25, 0x802) r5 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000ef2000-0x1d)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f00002d8000-0xc)={0x0, 0x0}, &(0x7f0000d76000-0x4)=0xc) syz_open_procfs(r6, &(0x7f0000013000)='ns/cgroup\x00') openat$ion(0xffffffffffffff9c, &(0x7f0000dd5000)='/dev/ion\x00', 0x800, 0x0) pipe2(&(0x7f000058c000), 0x4800) setsockopt$inet_IP_XFRM_POLICY(r4, 0x0, 0x11, &(0x7f0000e12000-0xe8)={{{@in6=@mcast1={0xff, 0x1, [], 0x1}, @in=@rand_addr, 0x2, 0xbd, 0x3, 0x20, 0xa, 0xa0, 0x0, 0xbf, 0x0, r7}, {0x0, 0x8, 0x0, 0x3, 0x6, 0x1fa8, 0x8, 0x20}, {0x1719, 0x7fff, 0x7ff, 0x7ff}, 0x1, 0x7, 0x0, 0x1, 0x1, 0x3}, {{@in=@broadcast=0xffffffff, 0x1, 0x7f}, 0xa, @in=@empty, 0xffffffffffffffff, 0x3, 0x0, 0xffffffffffffffbc, 0x20, 0x6, 0x2}}, 0xe8) openat$selinux_policy(0xffffffffffffff9c, &(0x7f000010e000-0x10)='/selinux/policy\x00', 0x0, 0x0) setsockopt$netlink_NETLINK_TX_RING(r5, 0x10e, 0x7, &(0x7f0000ab4000-0x10)={0x6, 0x7, 0x52, 0xfffffffffffffffc}, 0x10) 2018/02/10 14:10:12 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dmmidi(&(0x7f0000056000)='/dev/dmmidi#\x00', 0x6f600000, 0x0) read$eventfd(r0, &(0x7f0000e8c000-0x8), 0xffffffffffffff77) mprotect(&(0x7f0000339000/0x3000)=nil, 0x3000, 0x6) ioctl$EVIOCGMTSLOTS(r0, 0x8040450a, &(0x7f00006f3000-0x95)=""/149) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f000083c000-0x10)='/dev/sequencer2\x00', 0x4002, 0x0) signalfd(r1, &(0x7f000035a000)={0x3}, 0x8) openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000810000-0x12)='/dev/loop-control\x00', 0x1, 0x0) [ 70.284088] binder: 11675:11680 unknown command 0 [ 70.294967] binder: 11676:11685 unknown command 0 [ 70.304237] binder: 11675:11680 ioctl c0306201 2000a000 returned -22 [ 70.311674] binder: 11676:11685 ioctl c0306201 2000a000 returned -22 [ 70.324414] binder_alloc: binder_alloc_mmap_handler: 11675 20000000-20002000 already mapped failed -16 2018/02/10 14:10:12 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) capset(&(0x7f00002d1000-0x8)={0x19980330}, &(0x7f0000cc0000)) umount2(&(0x7f0000ba0000-0x8)='./file0\x00', 0x8) r0 = openat$audio(0xffffffffffffff9c, &(0x7f0000da1000)='/dev/audio\x00', 0x280, 0x0) connect$l2tp(r0, &(0x7f00000f8000-0x2e)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x1, @rand_addr}, 0x3, 0x3, 0x0, 0x1}}, 0x2e) 2018/02/10 14:10:12 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = fcntl$dupfd(0xffffffffffffff9c, 0x0, 0xffffffffffffffff) setsockopt$inet_sctp6_SCTP_AUTOCLOSE(r0, 0x84, 0x4, &(0x7f00000ae000)=0x5, 0x4) r1 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000a000)={0x34e, 0x0, &(0x7f00001e5000-0x8)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000006000-0x54)}) setsockopt$ALG_SET_AEAD_AUTHSIZE(r0, 0x117, 0x5, 0x0, 0x34) ioctl$ION_IOC_HEAP_QUERY(r0, 0xc0184908, &(0x7f00001a8000-0x18)={0x9, 0x0, 0x1, r0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000008000-0x30)={0x2c, 0x0, &(0x7f0000631000-0x2c)=[@decrefs={0x40046307}, @increfs={0x40046304, 0x4}, @decrefs={0x40046307, 0x3}, @request_death={0x400c630e, 0x1}, @enter_looper={0x630c}], 0x0, 0x0, &(0x7f0000e34000)}) [ 70.334499] binder: 11676:11696 unknown command 0 [ 70.339891] binder: 11676:11696 ioctl c0306201 2000a000 returned -22 [ 70.347845] binder: BINDER_SET_CONTEXT_MGR already set [ 70.353347] binder: 11675:11690 unknown command 0 [ 70.355458] binder: 11675:11680 ioctl 40046207 0 returned -16 [ 70.361812] binder: 11675:11690 ioctl c0306201 2000a000 returned -22 [ 70.376184] can: request_module (can-proto-4) failed. 2018/02/10 14:10:12 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket(0x1e, 0x1, 0x0) bind(r0, &(0x7f0000d81000-0x80)=@rc={0x1f, {0x100000000, 0x2, 0x7, 0x7e525090, 0x7, 0x4}, 0xd115}, 0x3d8) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000816000-0x10)=@generic="51e87eaf4ad29e2205d875a0c81a8f0b", 0xfffffffffffffed6) bind(r0, &(0x7f0000afb000)=@generic={0x1e, "0100000000000000000000004700000000a979f321b30c7bc8790405c7bad62e0a63a632ed4938d36d73fb8f8401a3ff59829a2b0afe7ce43a4b2470a0c5216669ca021f6f65dcf160e7e58f358c0002f0000158d19bcb3151d24acef1f1622ca5bdb9c8ea31000077aeb81c90001d6d7c980400000000f70dc136cb184a"}, 0x80) ioctl$sock_bt_cmtp_CMTPCONNADD(r0, 0x400443c8, &(0x7f0000ce7000)={r0, 0x7db2}) getsockopt$inet6_mtu(r0, 0x29, 0x17, &(0x7f0000751000), &(0x7f00004cb000)=0x4) 2018/02/10 14:10:12 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000a5000-0x8)) mmap(&(0x7f0000000000/0x19000)=nil, 0x19000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000924000-0xc)='/dev/rfkill\x00', 0x0, 0x0) r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000e54000-0x18)={0xaa}) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000008000-0x20)={{&(0x7f0000000000/0x4000)=nil, 0x4000}, 0x1}) readv(r0, &(0x7f00001f3000-0x10)=[{&(0x7f0000002000-0x4e)=""/1, 0x1}], 0x1) ioctl$RNDADDTOENTCNT(r0, 0x40045201, &(0x7f00000a9000)=0x3ffffffffffe) ioctl$RNDADDTOENTCNT(r0, 0x40045201, &(0x7f0000a81000)) ioctl$UFFDIO_UNREGISTER(r1, 0xc020aa04, &(0x7f0000008000-0x4)={&(0x7f0000000000/0x2000)=nil, 0x2000}) 2018/02/10 14:10:12 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000160000)='/dev/binder#\x00', 0x0, 0x10000) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000a000)={0xffffffffffffffa3, 0x0, &(0x7f00007ec000-0x8)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000cee000)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000-0x30)={0x0, 0x0, &(0x7f0000d06000)=[], 0xfffffffffffffce9, 0x0, &(0x7f000030b000)}) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000172000)='task\x00') setsockopt$netlink_NETLINK_LISTEN_ALL_NSID(r1, 0x10e, 0x8, &(0x7f0000c38000)=0x8001, 0x4) fcntl$F_GET_FILE_RW_HINT(r0, 0x40d, &(0x7f00003da000)) 2018/02/10 14:10:12 executing program 0: mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) getsockopt$sock_cred(0xffffffffffffff9c, 0x1, 0x11, &(0x7f0000001000-0xc)={0x0, 0x0, 0x0}, &(0x7f0000da4000-0x4)=0xc) setfsgid(r0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$usbmon(&(0x7f0000002000-0x3)='/dev/usbmon#\x00', 0x0, 0xa0082) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$PIO_SCRNMAP(r1, 0x4b41, &(0x7f0000001000)="25723f77016053c6eb4f79003b5395bc75fbd8d5945d3e3af59d9f008979d8008098ac79671d8e992f29febf6c4619a67c2fe30378847d4b6da7faf6fb9e99b5e050059dea86a1c2518d667b6d080f9686ed37ce4154fbc26e608dfe870810cbb193b6881740d53816b79caf5c749fdcb6a5d1c8b032aaa63679262b1a2f84cb21b3cde8e597beeea8132c") mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r2 = dup(0xffffffffffffffff) ioctl$PPPOEIOCSFWD(r2, 0x4004b100, &(0x7f0000b81000-0x1e)={0x18, 0x0, {0x1, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @common='vlan0\x00'}}) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000a01000)=@security={'security\x00', 0xe, 0x4, 0x4e4, 0xffffffff, 0x300, 0x0, 0x204, 0xffffffff, 0xffffffff, 0x418, 0x418, 0x418, 0xffffffff, 0x4, &(0x7f0000237000-0x40), {[{{@uncond, 0x0, 0x1e0, 0x204, 0x0, {}, [@common=@rt={0x138, 'rt\x00', 0x0, {0x5be, 0x3, 0x2, 0x6, 0x0, 0x7, [@dev={0xfe, 0x80, [], 0x0, 0xb}, @ipv4={[], [0xff, 0xff], @empty}, @mcast1={0xff, 0x1, [], 0x1}, @remote={0xfe, 0x80, [], 0x0, 0xbb}, @mcast1={0xff, 0x1, [], 0x1}, @ipv4={[], [0xff, 0xff], @dev={0xac, 0x14, 0x0, 0xb}}, @dev={0xfe, 0x80, [], 0x0, 0x16}, @mcast2={0xff, 0x2, [], 0x1}, @remote={0xfe, 0x80, [], 0x0, 0xbb}, @ipv4={[], [0xff, 0xff], @dev={0xac, 0x14, 0x0, 0xc}}, @remote={0xfe, 0x80, [], 0x0, 0xbb}, @dev={0xfe, 0x80, [], 0x0, 0x10}, @ipv4={[], [0xff, 0xff], @dev={0xac, 0x14, 0x0, 0x16}}, @dev={0xfe, 0x80, [], 0x0, 0x13}, @loopback={0x0, 0x1}, @dev={0xfe, 0x80, [], 0x0, 0x13}], 0x5}}]}, @common=@unspec=@NFQUEUE0={0x24, 'NFQUEUE\x00', 0x0, {0x2}}}, {{@uncond, 0x0, 0xcc, 0xfc, 0x0, {}, [@common=@ipv6header={0x24, 'ipv6header\x00', 0x0, {0x3c, 0x10}}]}, @common=@inet=@SET2={0x30, 'SET\x00', 0x2, {{0x1, 0x5, 0x20}, {0x6, 0x2, 0xffffffff00000001}, 0x50dc, 0x3}}}, {{@ipv6={@mcast2={0xff, 0x2, [], 0x1}, @remote={0xfe, 0x80, [], 0x0, 0xbb}, [0xffffffff, 0xffffffff, 0xa8968e4647f694cb, 0xff000000], [0xff0000ff, 0xff000000, 0xffffffff, 0xffffff00], @generic="94f6358cb39126cf3396c3e005c73f44", @generic="ccec9c29bb22eee18145c796741e8489", {0xff}, {}, 0x2f, 0xd5ae, 0x1, 0x40}, 0x0, 0xd8, 0x118, 0x0, {}, [@common=@ah={0x30, 'ah\x00', 0x0, {0x0, 0x2, 0x9, 0x29fc, 0x2}}]}, @common=@inet=@TCPOPTSTRIP={0x40, 'TCPOPTSTRIP\x00', 0x0, {[0x1f, 0x3, 0x0, 0x8a33, 0x6, 0x1000, 0x7, 0x10001]}}}], {{[], 0x0, 0xa8, 0xcc}, {0x24, '\x00', 0x0, 0xfffffffffffffffe}}}}, 0x540) r3 = socket(0x20000000000000a, 0x2, 0x0) recvfrom$inet(r2, &(0x7f00004c4000-0x70)=""/112, 0x70, 0x2, &(0x7f0000503000)={0x2, 0x3, @dev={0xac, 0x14, 0x0, 0xc}}, 0x10) perf_event_open(&(0x7f0000fdf000-0x78)={0x2, 0x78, 0xe3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_ipx_SIOCAIPXPRISLT(r1, 0x89e1, &(0x7f0000b91000)=0x2) eventfd2(0x1, 0x1) ioctl$TIOCGPTPEER(r2, 0x5441, 0x1000) setsockopt$inet6_MCAST_JOIN_GROUP(r2, 0x29, 0x2a, &(0x7f0000da8000-0x88)={0x80, {{0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [], 0x1}, 0x1000}}}, 0x88) bind$llc(r3, &(0x7f0000364000-0x10)={0x1a, 0x1e, 0x1, 0x5, 0x3f, 0x5, @dev={[0xaa, 0xaa, 0xaa, 0xaa], 0x0, 0x11}}, 0x10) getsockopt$inet6_mreq(r3, 0x29, 0x8000000018, &(0x7f0000aa1000-0x14)={@remote}, &(0x7f0000768000)=0x14) [ 70.421243] binder: 11712:11713 unknown command 0 [ 70.426665] binder: release 11675:11690 transaction 300 out, still active [ 70.433794] binder: undelivered TRANSACTION_COMPLETE [ 70.438955] binder: send failed reply for transaction 300, target dead 2018/02/10 14:10:12 executing program 1: mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndpcmp(&(0x7f0000001000)='/dev/snd/pcmC#D#p\x00', 0xc, 0x100) mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_NEXT_CLIENT(r0, 0xc0bc5351, &(0x7f0000002000)={0x7ff, 0x3, 'client1\x00', 0x4, "3b9e543a7801d365", "b84ec72a0f7afeec1f37baae157d732568e53901d244620c355cbd47c572757b", 0x9, 0x775}) mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) bind$inet6(r0, &(0x7f0000001000)={0xa, 0x0, 0x9, @mcast2={0xff, 0x2, [], 0x1}, 0x80000000}, 0x1c) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000002000)={0x1, 0x1, &(0x7f0000003000-0x50)=""/80, &(0x7f0000000000)=""/83, &(0x7f0000000000)=""/103, 0x2000}) r1 = socket$inet(0x2, 0x6, 0x0) setsockopt$bt_BT_POWER(r0, 0x112, 0x9, &(0x7f0000003000-0x1), 0x1) ioctl$sock_SIOCGIFINDEX(r1, 0x8927, &(0x7f0000001000-0x28)={@common='vcan0\x00'}) 2018/02/10 14:10:12 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r0, r0, &(0x7f0000049000), 0x3d2) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000008000)={&(0x7f000000f000-0xc)={0x10, 0x34000}, 0xc, &(0x7f0000220000)={&(0x7f00008d6000-0x14)={0x14, 0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, {}, []}, 0x14}, 0x1}, 0x0) r1 = userfaultfd(0x80800) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000ff8000-0x20)={{&(0x7f0000012000/0x2000)=nil, 0x2000}, 0x1}) bpf$MAP_CREATE(0x0, &(0x7f0000fb4000)={0x2, 0x8000000000000004, 0x400, 0x7fd, 0x4, 0xffffffffffffffff}, 0x2c) userfaultfd(0x800) clock_gettime(0x0, &(0x7f0000132000)={0x0, 0x0}) socketpair(0x1d, 0x800, 0x4, &(0x7f0000589000)) r4 = syz_open_dev$mouse(&(0x7f00006eb000)='/dev/input/mouse#\x00', 0xde6e, 0x1) timer_settime(0x0, 0x1, &(0x7f000097e000)={{0x0, r3}, {r2, r3+10000000}}, &(0x7f0000939000)) fanotify_init(0x25, 0x802) r5 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000ef2000-0x1d)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f00002d8000-0xc)={0x0, 0x0}, &(0x7f0000d76000-0x4)=0xc) syz_open_procfs(r6, &(0x7f0000013000)='ns/cgroup\x00') openat$ion(0xffffffffffffff9c, &(0x7f0000dd5000)='/dev/ion\x00', 0x800, 0x0) pipe2(&(0x7f000058c000), 0x4800) setsockopt$inet_IP_XFRM_POLICY(r4, 0x0, 0x11, &(0x7f0000e12000-0xe8)={{{@in6=@mcast1={0xff, 0x1, [], 0x1}, @in=@rand_addr, 0x2, 0xbd, 0x3, 0x20, 0xa, 0xa0, 0x0, 0xbf, 0x0, r7}, {0x0, 0x8, 0x0, 0x3, 0x6, 0x1fa8, 0x8, 0x20}, {0x1719, 0x7fff, 0x7ff, 0x7ff}, 0x1, 0x7, 0x0, 0x1, 0x1, 0x3}, {{@in=@broadcast=0xffffffff, 0x1, 0x7f}, 0xa, @in=@empty, 0xffffffffffffffff, 0x3, 0x0, 0xffffffffffffffbc, 0x20, 0x6, 0x2}}, 0xe8) openat$selinux_policy(0xffffffffffffff9c, &(0x7f000010e000-0x10)='/selinux/policy\x00', 0x0, 0x0) setsockopt$netlink_NETLINK_TX_RING(r5, 0x10e, 0x7, &(0x7f0000ab4000-0x10)={0x6, 0x7, 0x52, 0xfffffffffffffffc}, 0x10) [ 70.471508] binder: 11712:11713 ioctl c0306201 2000a000 returned -22 [ 70.508308] binder: 11712:11729 unknown command 0 [ 70.515667] binder: 11712:11729 ioctl c0306201 2000a000 returned -22 [ 70.548799] can: request_module (can-proto-4) failed. 2018/02/10 14:10:12 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000a5000-0x8)) mmap(&(0x7f0000000000/0x19000)=nil, 0x19000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000924000-0xc)='/dev/rfkill\x00', 0x0, 0x0) r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000e54000-0x18)={0xaa}) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000008000-0x20)={{&(0x7f0000000000/0x4000)=nil, 0x4000}, 0x1}) readv(r0, &(0x7f00001f3000-0x10)=[{&(0x7f0000002000-0x4e)=""/1, 0x1}], 0x1) ioctl$RNDADDTOENTCNT(r0, 0x40045201, &(0x7f00000a9000)=0x3ffffffffffe) ioctl$RNDADDTOENTCNT(r0, 0x40045201, &(0x7f0000a81000)) ioctl$UFFDIO_UNREGISTER(r1, 0xc020aa04, &(0x7f0000008000-0x4)={&(0x7f0000000000/0x2000)=nil, 0x2000}) 2018/02/10 14:10:12 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000001000-0x10)='fdinfo\x00') sendfile(r0, r0, &(0x7f0000230000-0x4), 0x800000000000000) perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$ION_IOC_HEAP_QUERY(r0, 0xc0184908, &(0x7f0000e82000)={0x3, 0x4, 0xa31ef20032d0e396}) getdents(r0, &(0x7f0000efb000-0x4e)=""/78, 0xb3315778b0f8466b) 2018/02/10 14:10:12 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000d86000)='/dev/binder#\x00', 0xffffffffffffffff, 0x800) r1 = accept4(0xffffffffffffff9c, &(0x7f0000dfd000-0x10)=@can, &(0x7f0000e91000-0x4)=0x10, 0x80000) setsockopt$RDS_GET_MR(r1, 0x114, 0x2, &(0x7f0000e8f000-0x20)={{&(0x7f0000faf000-0xf6)=""/246, 0xf6}, &(0x7f0000448000-0x1), 0x14}, 0x20) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000a000)={0x8, 0x0, &(0x7f00001e5000-0x8)=[@acquire={0x40046305, 0x2}], 0x0, 0x0, &(0x7f0000006000-0x54)}) getsockopt$inet6_buf(r1, 0x29, 0xff, &(0x7f00008d8000-0xfc)=""/252, &(0x7f0000e7a000)=0xfc) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000030e000)={0x73, 0x0, &(0x7f0000584000)=[], 0x2, 0x0, &(0x7f00004aa000-0x2)="17ed"}) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000dad000-0x9)='/dev/vcs\x00', 0x0, 0x0) epoll_ctl$EPOLL_CTL_DEL(r2, 0x2, r0) 2018/02/10 14:10:12 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000a000)={0x34e, 0x0, &(0x7f00001e5000-0x8)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000006000-0x54)}) r1 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f000039b000)='/selinux/avc/cache_stats\x00', 0x0, 0x0) getsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f00004f7000+0x3ca)={0x0, 0x7fff, 0x2, 0xb8c7}, &(0x7f0000dae000)=0x10) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f0000ac6000-0xc)={r2, 0x48, &(0x7f0000ee7000-0x48)=[@in6={0xa, 0x3, 0x0, @loopback={0x0, 0x1}, 0x7fff}, @in={0x2, 0x2, @remote={0xac, 0x14, 0x0, 0xbb}}, @in6={0xa, 0x1, 0x7e4f, @remote={0xfe, 0x80, [], 0x0, 0xbb}, 0x4}]}, &(0x7f00001ef000-0x4)=0xc) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000-0x30)={0x44, 0x0, &(0x7f0000d06000)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x38, 0x8, &(0x7f000000d000)=[@fda={0x66646185}, @flat={0x73682a85}], &(0x7f0000006000)=[0x20]}}], 0x0, 0x0, &(0x7f0000176000-0x1)}) getsockopt$inet_sctp6_SCTP_INITMSG(r1, 0x84, 0x2, &(0x7f0000d08000-0x8), &(0x7f0000bec000-0x4)=0x8) 2018/02/10 14:10:12 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$PERF_EVENT_IOC_PERIOD(r0, 0x40082404, &(0x7f0000771000-0x8)=0xff) r2 = openat$autofs(0xffffffffffffff9c, &(0x7f0000639000-0xc)='/dev/autofs\x00', 0x800, 0x0) connect$llc(r2, &(0x7f000075e000)={0x1a, 0x8, 0x2, 0x2f0, 0xfc, 0x4, @dev={[0xaa, 0xaa, 0xaa, 0xaa], 0x0, 0x10}}, 0x10) sendmsg$nl_route(r1, &(0x7f000000a000)={&(0x7f0000014000)={0x10}, 0xc, &(0x7f0000001000)={&(0x7f00003d1000-0x28)=@bridge_getlink={0x20, 0x12, 0x305, 0xffffffffffffffff, 0xffffffffffffffff, {0x7}, []}, 0x20}, 0x1}, 0x0) 2018/02/10 14:10:12 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$evdev(&(0x7f0000f26000-0x12)='/dev/input/event#\x00', 0x1, 0x0) ioctl$EVIOCGRAB(r0, 0x40044590, &(0x7f0000e95000-0x4)) ioctl$TIOCSBRK(0xffffffffffffffff, 0x40044591) socket$inet_udp(0x2, 0x2, 0x0) 2018/02/10 14:10:12 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r0, r0, &(0x7f0000049000), 0x3d2) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000008000)={&(0x7f000000f000-0xc)={0x10, 0x34000}, 0xc, &(0x7f0000220000)={&(0x7f00008d6000-0x14)={0x14, 0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, {}, []}, 0x14}, 0x1}, 0x0) r1 = userfaultfd(0x80800) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000ff8000-0x20)={{&(0x7f0000012000/0x2000)=nil, 0x2000}, 0x1}) bpf$MAP_CREATE(0x0, &(0x7f0000fb4000)={0x2, 0x8000000000000004, 0x400, 0x7fd, 0x4, 0xffffffffffffffff}, 0x2c) userfaultfd(0x800) clock_gettime(0x0, &(0x7f0000132000)={0x0, 0x0}) socketpair(0x1d, 0x800, 0x4, &(0x7f0000589000)) r4 = syz_open_dev$mouse(&(0x7f00006eb000)='/dev/input/mouse#\x00', 0xde6e, 0x1) timer_settime(0x0, 0x1, &(0x7f000097e000)={{0x0, r3}, {r2, r3+10000000}}, &(0x7f0000939000)) fanotify_init(0x25, 0x802) r5 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000ef2000-0x1d)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f00002d8000-0xc)={0x0, 0x0}, &(0x7f0000d76000-0x4)=0xc) syz_open_procfs(r6, &(0x7f0000013000)='ns/cgroup\x00') openat$ion(0xffffffffffffff9c, &(0x7f0000dd5000)='/dev/ion\x00', 0x800, 0x0) pipe2(&(0x7f000058c000), 0x4800) setsockopt$inet_IP_XFRM_POLICY(r4, 0x0, 0x11, &(0x7f0000e12000-0xe8)={{{@in6=@mcast1={0xff, 0x1, [], 0x1}, @in=@rand_addr, 0x2, 0xbd, 0x3, 0x20, 0xa, 0xa0, 0x0, 0xbf, 0x0, r7}, {0x0, 0x8, 0x0, 0x3, 0x6, 0x1fa8, 0x8, 0x20}, {0x1719, 0x7fff, 0x7ff, 0x7ff}, 0x1, 0x7, 0x0, 0x1, 0x1, 0x3}, {{@in=@broadcast=0xffffffff, 0x1, 0x7f}, 0xa, @in=@empty, 0xffffffffffffffff, 0x3, 0x0, 0xffffffffffffffbc, 0x20, 0x6, 0x2}}, 0xe8) openat$selinux_policy(0xffffffffffffff9c, &(0x7f000010e000-0x10)='/selinux/policy\x00', 0x0, 0x0) setsockopt$netlink_NETLINK_TX_RING(r5, 0x10e, 0x7, &(0x7f0000ab4000-0x10)={0x6, 0x7, 0x52, 0xfffffffffffffffc}, 0x10) 2018/02/10 14:10:12 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000a5000-0x8)) mmap(&(0x7f0000000000/0x19000)=nil, 0x19000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000924000-0xc)='/dev/rfkill\x00', 0x0, 0x0) getsockopt$bt_sco_SCO_OPTIONS(r0, 0x11, 0x1, &(0x7f0000af3000)=""/75, &(0x7f0000672000)=0x4b) setsockopt$netrom_NETROM_T2(r0, 0x103, 0x2, &(0x7f00001b3000)=0x101, 0x4) r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000e54000-0x18)={0xaa}) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000008000-0x20)={{&(0x7f0000000000/0x4000)=nil, 0x4000}, 0x1}) readv(r0, &(0x7f00001f3000-0x10)=[{&(0x7f0000387000)=""/1, 0x1}], 0x1) ioctl$RNDADDTOENTCNT(r0, 0x40045201, &(0x7f0000b27000)) ioctl$RNDADDTOENTCNT(r0, 0x40045201, &(0x7f0000a81000)) ioctl$UFFDIO_UNREGISTER(r1, 0xc020aa04, &(0x7f0000008000-0x4)={&(0x7f0000000000/0x2000)=nil, 0x2000}) 2018/02/10 14:10:12 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket(0x1e, 0x1, 0x0) listen(r0, 0x0) setsockopt$packet_tx_ring(r0, 0x10f, 0x87, &(0x7f0000762000)=@req={0x3fc, 0x0, 0x1, 0x1}, 0xfffffffffffffc93) perf_event_open(&(0x7f000001d000)={0x2, 0x78, 0xe3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffb}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket(0x1e, 0x80002, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f00008e1000-0xc), &(0x7f0000b03000-0x4)=0xc) accept4(r0, &(0x7f0000228000)=@can, &(0x7f0000ea9000-0x4)=0x10, 0x0) setsockopt$packet_tx_ring(r1, 0x10f, 0x87, &(0x7f0000265000)=@req={0x3fc, 0x0, 0x1}, 0x10) [ 70.640647] binder: 11748:11752 Acquire 1 refcount change on invalid ref 2 ret -22 [ 70.646846] binder: 11751:11756 unknown command 0 [ 70.653530] binder: 11751:11756 ioctl c0306201 2000a000 returned -22 [ 70.663044] binder: 11748:11752 unknown command 0 [ 70.677214] binder: 11748:11752 ioctl c0306201 2030e000 returned -22 2018/02/10 14:10:12 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000a5000-0x8)) mmap(&(0x7f0000000000/0x19000)=nil, 0x19000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000924000-0xc)='/dev/rfkill\x00', 0x0, 0x0) r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000e54000-0x18)={0xaa}) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000008000-0x20)={{&(0x7f0000000000/0x4000)=nil, 0x4000}, 0x1}) readv(r0, &(0x7f00001f3000-0x10)=[{&(0x7f0000002000-0x4e)=""/1, 0x1}], 0x1) getsockopt$inet_sctp_SCTP_AUTOCLOSE(r0, 0x84, 0x4, &(0x7f0000e6d000), &(0x7f0000a42000-0x4)=0x4) ioctl$RNDADDTOENTCNT(r0, 0x40045201, &(0x7f0000b27000)) ioctl$RNDADDTOENTCNT(r0, 0x40045201, &(0x7f0000a81000)) ioctl$UFFDIO_UNREGISTER(r1, 0xc020aa04, &(0x7f0000008000-0x4)={&(0x7f0000000000/0x2000)=nil, 0x2000}) timer_create(0x7, &(0x7f0000d53000)={0x0, 0x3d, 0x0, @thr={&(0x7f0000e35000)="2e9b5d6ead6059704c4ea71c5d02b99e7cc7052d6ce0ff51ad37077cda00ba95388f7f0d0c8fa79970600085c64d61cc153070884a88d83185e297a49d216fdcb461142e22873b4d5dc2b9eb4be0020d2a3790e2555666e6ece4dda2172c395a3dceb17daef2cd1c0f45671d2639ea62c3c2eabcb7d290f1948988942e32d6e1bfba", &(0x7f0000feb000)="d9bacd6c2dabff3ff9c44083fb2404fff47f121bed60a11611b38aa3b07ac4b4883c5c44585451d7826ecab2d6a6a5e31b03852904249b9503dcd668538b5f8e8efd357e0470cc9f781c84a78e5846de2a66e44c6a7bfe92e7a60c815df83d496bebdb64"}}, &(0x7f000057d000)=0x0) timer_settime(r2, 0x1, &(0x7f0000058000)={{0x77359400}}, &(0x7f0000655000)) [ 70.684581] binder_alloc: binder_alloc_mmap_handler: 11751 20000000-20002000 already mapped failed -16 [ 70.703790] binder: BINDER_SET_CONTEXT_MGR already set [ 70.708715] can: request_module (can-proto-4) failed. [ 70.710088] binder: 11751:11761 unknown command 0 [ 70.716673] binder: 11751:11756 ioctl 40046207 0 returned -16 [ 70.719564] binder: 11748:11765 Acquire 1 refcount change on invalid ref 2 ret -22 [ 70.733350] binder: 11751:11761 ioctl c0306201 2000a000 returned -22 2018/02/10 14:10:12 executing program 3: personality(0x10fffffc) prctl$setmm(0x23, 0x7, &(0x7f00004b4000/0x1000)=nil) mprotect(&(0x7f000036f000/0x4000)=nil, 0x4000, 0x100000d) r0 = pkey_alloc(0x0, 0x3) pkey_mprotect(&(0x7f0000632000/0x3000)=nil, 0x3000, 0x2, r0) r1 = dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) ioctl$KVM_SET_MP_STATE(r1, 0x4004ae99, &(0x7f0000021000)=0x6) ioctl$sock_inet_udp_SIOCOUTQ(r1, 0x5411, &(0x7f0000f82000)) 2018/02/10 14:10:12 executing program 0: iopl(0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x31f, &(0x7f0000edd000)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa]}, [], {@generic={0x8864}}}, &(0x7f0000efe000)={0x0, 0x1, [0x0]}) r0 = ioctl$KVM_CREATE_VCPU(0xffffffffffffff9c, 0xae41, 0x2) ioctl$KVM_ENABLE_CAP_CPU(r0, 0x4068aea3, &(0x7f0000ff8000-0x68)={0x7b, 0x0, [0x87, 0x10001, 0xffffffffffffffff, 0xf32]}) [ 70.747561] binder_alloc: 11751: binder_alloc_buf, no vma [ 70.753244] binder: 11751:11770 transaction failed 29189/-3, size 56-8 line 2957 [ 70.762791] binder: 11748:11771 unknown command 0 [ 70.768714] binder: 11748:11771 ioctl c0306201 2030e000 returned -22 [ 70.789706] binder: undelivered TRANSACTION_ERROR: 29189 2018/02/10 14:10:12 executing program 6: mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000001000-0xd)='/selinux/enforce\x00', 0x2, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(r0, 0x112, 0xa, &(0x7f00002e1000-0x4)=0xca6, 0x4) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000a000)={0x34e, 0x0, &(0x7f00001e5000-0x8)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000006000-0x54)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000008000-0x30)={0x0, 0x0, &(0x7f0000d06000)=[], 0x0, 0x0, &(0x7f0000176000-0x1)}) getsockopt$sock_cred(0xffffffffffffff9c, 0x1, 0x11, &(0x7f0000f8c000-0xc)={0x0, 0x0}, &(0x7f00002bc000)=0xc) getgroups(0x7, &(0x7f000060f000)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0xffffffffffffffff]) fchown(r1, r2, r3) recvmmsg(0xffffffffffffff9c, &(0x7f00009d1000)=[{{&(0x7f00008e5000-0x80)=@generic, 0x80, &(0x7f0000bc1000-0x30)=[{&(0x7f0000215000)=""/108, 0x6c}, {&(0x7f0000e77000-0x1000)=""/4096, 0x1000}, {&(0x7f0000403000-0x1000)=""/4096, 0x1000}, {&(0x7f00008b6000-0xcf)=""/207, 0xcf}, {&(0x7f0000851000)}, {&(0x7f0000534000-0x31)=""/49, 0x31}], 0x6, 0x0, 0x0, 0x8}, 0x9}, {{&(0x7f00005d4000-0x26)=@pppol2tp={0x0, 0x0, {0x0, 0x0, {0x0, 0xffffffffffffffff, @loopback}}}, 0x26, &(0x7f000094b000)=[{&(0x7f0000afb000)=""/95, 0x5f}, {&(0x7f0000994000-0xc7)=""/199, 0xc7}, {&(0x7f00006a8000-0xdc)=""/220, 0xdc}], 0x3, &(0x7f00003f0000-0xed)=""/237, 0xed, 0x8}, 0x7f}, {{&(0x7f0000c06000)=@vsock={0x0, 0x0, 0x0, @any}, 0x10, &(0x7f0000e4b000)=[{&(0x7f0000574000-0x1000)=""/4096, 0x1000}, {&(0x7f0000da3000)=""/234, 0xea}, {&(0x7f00003a8000)=""/181, 0xb5}, {&(0x7f00000f6000)=""/97, 0x61}, {&(0x7f0000ea2000-0x38)=""/56, 0x38}, {&(0x7f0000765000)=""/35, 0x23}, {&(0x7f0000d8a000)=""/40, 0x28}, {&(0x7f00009f5000-0x9d)=""/157, 0x9d}], 0x8, 0x0, 0xffffffffffffff88, 0x7}}, {{&(0x7f0000559000-0x10)=@in={0x0, 0xffffffffffffffff, @empty}, 0x10, &(0x7f0000829000)=[{&(0x7f00002b1000-0x6)=""/6, 0x6}, {&(0x7f0000dbf000)}, {&(0x7f0000d41000)=""/111, 0x6f}, {&(0x7f0000a02000)=""/4096, 0x1000}, {&(0x7f0000e3f000-0x8b)=""/139, 0x8b}], 0x5, &(0x7f0000b4c000-0xde)=""/222, 0xde, 0x400}, 0x6}, {{&(0x7f0000cd0000-0x10)=@ethernet={0x0, @dev}, 0x10, &(0x7f0000e8d000)=[{&(0x7f00005fb000-0x1)=""/1, 0x1}, {&(0x7f000010e000)=""/200, 0xc8}, {&(0x7f0000412000-0x64)=""/100, 0x64}], 0x3, &(0x7f0000aa2000-0xd4)=""/212, 0xd4, 0x4}, 0x7}, {{&(0x7f0000cba000)=@hci, 0x6, &(0x7f000059d000)=[{&(0x7f000026e000-0x1a)=""/26, 0x1a}, {&(0x7f0000e93000-0x6f)=""/111, 0x6f}, {&(0x7f0000c6a000)=""/4096, 0x1000}, {&(0x7f000027c000)=""/38, 0x26}, {&(0x7f0000b6c000)=""/179, 0xaf}, {&(0x7f000021b000)=""/207, 0xcf}, {&(0x7f0000296000-0x77)=""/119, 0x77}, {&(0x7f00002ec000-0x7c)=""/124, 0x7c}, {&(0x7f0000a74000)=""/4096, 0x1000}], 0x9, &(0x7f0000f79000)=""/13, 0xd}, 0x9}, {{0x0, 0x0, &(0x7f0000c86000)=[{&(0x7f0000bfa000-0xfd)=""/253, 0xfd}, {&(0x7f0000e39000-0x9c)=""/156, 0x9c}, {&(0x7f000069b000)=""/6, 0x6}, {&(0x7f0000f46000)}, {&(0x7f0000f9f000-0x43)=""/67, 0x43}], 0x5, 0x0, 0x0, 0x1}, 0x7}, {{&(0x7f0000935000)=@un=@file={0x0, ""/4096}, 0x1002, &(0x7f000033d000-0x18)=[{&(0x7f0000cda000-0xde)=""/222, 0xde}, {&(0x7f0000d44000-0xb9)=""/185, 0xb9}, {&(0x7f00007ce000)=""/166, 0xa6}], 0x3, &(0x7f00003e2000)=""/245, 0xf5, 0x401}, 0x8}], 0x8, 0x40002020, &(0x7f00004ee000)={0x0, 0x1c9c380}) setsockopt$inet6_dccp_int(r4, 0x21, 0x7, &(0x7f0000821000)=0x5, 0x4) 2018/02/10 14:10:12 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r0, r0, &(0x7f0000049000), 0x3d2) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000008000)={&(0x7f000000f000-0xc)={0x10, 0x34000}, 0xc, &(0x7f0000220000)={&(0x7f00008d6000-0x14)={0x14, 0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, {}, []}, 0x14}, 0x1}, 0x0) r1 = userfaultfd(0x80800) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000ff8000-0x20)={{&(0x7f0000012000/0x2000)=nil, 0x2000}, 0x1}) bpf$MAP_CREATE(0x0, &(0x7f0000fb4000)={0x2, 0x8000000000000004, 0x400, 0x7fd, 0x4, 0xffffffffffffffff}, 0x2c) userfaultfd(0x800) clock_gettime(0x0, &(0x7f0000132000)={0x0, 0x0}) socketpair(0x1d, 0x800, 0x4, &(0x7f0000589000)) r4 = syz_open_dev$mouse(&(0x7f00006eb000)='/dev/input/mouse#\x00', 0xde6e, 0x1) timer_settime(0x0, 0x1, &(0x7f000097e000)={{0x0, r3}, {r2, r3+10000000}}, &(0x7f0000939000)) fanotify_init(0x25, 0x802) r5 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000ef2000-0x1d)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f00002d8000-0xc)={0x0, 0x0}, &(0x7f0000d76000-0x4)=0xc) syz_open_procfs(r6, &(0x7f0000013000)='ns/cgroup\x00') openat$ion(0xffffffffffffff9c, &(0x7f0000dd5000)='/dev/ion\x00', 0x800, 0x0) pipe2(&(0x7f000058c000), 0x4800) setsockopt$inet_IP_XFRM_POLICY(r4, 0x0, 0x11, &(0x7f0000e12000-0xe8)={{{@in6=@mcast1={0xff, 0x1, [], 0x1}, @in=@rand_addr, 0x2, 0xbd, 0x3, 0x20, 0xa, 0xa0, 0x80, 0x0, 0x0, r7}, {0x0, 0x8, 0x0, 0x3, 0x6, 0x1fa8, 0x8, 0x20}, {0x1719, 0x7fff, 0x7ff, 0x7ff}, 0x1, 0x7, 0x0, 0x1, 0x1, 0x3}, {{@in=@broadcast=0xffffffff, 0x1, 0x7f}, 0xa, @in=@empty, 0xffffffffffffffff, 0x3, 0x0, 0xffffffffffffffbc, 0x20, 0x6, 0x2}}, 0xe8) openat$selinux_policy(0xffffffffffffff9c, &(0x7f000010e000-0x10)='/selinux/policy\x00', 0x0, 0x0) setsockopt$netlink_NETLINK_TX_RING(r5, 0x10e, 0x7, &(0x7f0000ab4000-0x10)={0x6, 0x7, 0x52, 0xfffffffffffffffc}, 0x10) 2018/02/10 14:10:12 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000a000)={0x34e, 0x0, &(0x7f00001e5000-0x8)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000006000-0x54)}) r1 = openat(0xffffffffffffffff, &(0x7f0000675000)='./file0\x00', 0x0, 0x2) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000b68000)={0x0}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f00007ed000-0x18)={r2}) bind$pptp(r1, &(0x7f0000400000-0x20)={0x18, 0x2, {0x0, @dev={0xac, 0x14, 0x0, 0xc}}}, 0x20) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000-0x30)={0x44, 0x0, &(0x7f0000d06000)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x38, 0x8, &(0x7f000000d000)=[@fda={0x66646185}, @flat={0x73682a85}], &(0x7f0000006000)=[0x20]}}], 0x0, 0x0, &(0x7f0000176000-0x1)}) [ 70.795546] binder: release 11751:11756 transaction 305 out, still active [ 70.802596] binder: undelivered TRANSACTION_COMPLETE [ 70.807782] binder: send failed reply for transaction 305, target dead [ 70.819815] binder: 11781:11782 Acquire 1 refcount change on invalid ref 0 ret -22 [ 70.827758] binder: 11781:11782 unknown command 0 [ 70.830654] binder: 11786:11788 unknown command 0 [ 70.838996] binder: 11786:11788 ioctl c0306201 2000a000 returned -22 2018/02/10 14:10:12 executing program 0: r0 = syz_open_dev$midi(&(0x7f0000582000-0xb)='/dev/midi#\x00', 0x2, 0x40042) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(0xffffffffffffffff, 0x84, 0x6d, &(0x7f0000755000)={0x0, 0x82, "20d1f4274456f44f2d18333b2972b67bb4f0c34566339b617e3f839f0d50324622d2ba245ed161cd5c9c17ff620859716c65af78c2468973f2801406730d06a30121dec7f5ac0813e6d8cf9060259da51fd158f1a08fe81b3dd9b5cf41cd1242927a0c86ce68663414c6fbeb6112ddfab6b4d0807926324813ea6337b1862c006f98"}, &(0x7f0000f19000)=0x8a) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) getsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r0, 0x84, 0x22, &(0x7f0000001000-0x10)={0x7, 0x8208, 0x1, 0x3, r1}, &(0x7f0000f03000)=0x10) mmap(&(0x7f0000000000/0xfdf000)=nil, 0xfdf000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r2, 0x40045431, &(0x7f00003ba000-0x24)) mmap(&(0x7f0000fdf000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r3 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000fe0000-0x15)='/proc/self/net/pfkey\x00', 0xc00, 0x0) mmap(&(0x7f0000fdf000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mprotect(&(0x7f0000eae000/0x3000)=nil, 0x3000, 0x0) epoll_ctl$EPOLL_CTL_MOD(r3, 0x3, r2, &(0x7f0000fdf000)={0x10000010}) syz_open_pts(r2, 0x0) ioctl$TIOCOUTQ(r3, 0x5411, &(0x7f0000797000-0x4)) [ 70.840969] binder: 11781:11782 ioctl c0306201 2000a000 returned -22 [ 70.878561] binder: 11781:11782 unknown command 0 [ 70.881259] binder_alloc: binder_alloc_mmap_handler: 11786 20000000-20002000 already mapped failed -16 [ 70.883777] can: request_module (can-proto-4) failed. [ 70.898129] binder: BINDER_SET_CONTEXT_MGR already set [ 70.898490] binder: 11781:11782 ioctl c0306201 2000a000 returned -22 [ 70.909197] binder: 11786:11788 ioctl 40046207 0 returned -16 [ 70.917254] binder: 11786:11797 unknown command 0 [ 70.923902] binder: 11786:11797 ioctl c0306201 2000a000 returned -22 [ 70.963141] binder: release 11786:11788 transaction 310 out, still active [ 70.970179] binder: undelivered TRANSACTION_COMPLETE [ 70.975343] binder: send failed reply for transaction 310, target dead 2018/02/10 14:10:13 executing program 3: r0 = dup3(0xffffffffffffff9c, 0xffffffffffffffff, 0x80000) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$sock_SIOCINQ(r0, 0x541b, &(0x7f0000000000)) syz_open_dev$urandom(&(0x7f0000001000-0xd)='/dev/urandom\x00', 0x0, 0x4000) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r1 = openat$ashmem(0xffffffffffffff9c, &(0x7f00001cb000-0xc)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_SIZE(r1, 0x40087703, 0x3) mmap(&(0x7f00006ff000/0x3000)=nil, 0x3000, 0x0, 0x12, r1, 0x0) ioctl$sock_kcm_SIOCKCMCLONE(r0, 0x89e2, &(0x7f0000a3f000)={r0}) lseek(r1, 0xfffffffffffffffd, 0x1) 2018/02/10 14:10:13 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$evdev(&(0x7f0000dda000-0x12)='/dev/input/event#\x00', 0x0, 0x0) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000e15000)='/dev/autofs\x00', 0x404200, 0x0) ioctl$VHOST_SET_VRING_NUM(r1, 0x4008af10, &(0x7f00006b5000-0x8)={0x0, 0x7fff}) ioctl$EVIOCGRAB(r0, 0x40044590, &(0x7f0000e95000-0x4)) ioctl$TIOCSBRK(0xffffffffffffffff, 0x40044591) request_key(&(0x7f0000102000)='big_key\x00', &(0x7f0000ad3000)={0x73, 0x79, 0x7a, 0x3}, &(0x7f00006cc000-0x40)='deflate\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', 0xffffffffffffffff) 2018/02/10 14:10:13 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = accept4$vsock_stream(0xffffffffffffff9c, &(0x7f00002ce000-0x10)={0x28, 0x0, 0x2711, @host=0x2}, 0x10, 0x800) setsockopt$sock_int(r0, 0x1, 0x1a, &(0x7f0000526000-0x4)=0xaa41, 0x4) r1 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socketpair$inet_udp(0x2, 0x2, 0x0, &(0x7f0000862000)={0x0, 0x0}) getsockopt$inet_IP_XFRM_POLICY(r2, 0x0, 0x11, &(0x7f0000a48000-0xe8)={{{@in6=@mcast1, @in=@rand_addr}}, {{@in6=@mcast2}, 0x0, @in6=@loopback}}, &(0x7f0000b8d000-0x4)=0xe8) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000a000)={0x34e, 0x0, &(0x7f00001e5000-0x8)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000006000-0x54)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000-0x30)={0x44, 0x0, &(0x7f0000d06000)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x38, 0x8, &(0x7f000000d000)=[@fda={0x66646185}, @flat={0x73682a85}], &(0x7f0000006000)=[0x20]}}], 0x0, 0x0, &(0x7f0000176000-0x1)}) ftruncate(r3, 0x2) 2018/02/10 14:10:13 executing program 1: r0 = syz_open_dev$mice(&(0x7f0000a83000-0x10)='/dev/input/mice\x00', 0x0, 0x404000) connect$ax25(r0, &(0x7f0000e56000)={0x3, {"29113fb289092e"}, 0x10001}, 0x10) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) getsockopt$inet_sctp_SCTP_SOCKOPT_PEELOFF(r0, 0x84, 0x66, &(0x7f0000001000-0x8)={0x0, 0x81}, &(0x7f0000c5a000-0x4)=0x8) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(r0, 0x84, 0xf, &(0x7f0000bea000)={r1, @in6={{0xa, 0x1, 0x4, @dev={0xfe, 0x80, [], 0x0, 0x13}, 0x7}}, 0xfffffffffffffffc, 0xc1b, 0x9, 0x7, 0x4}, &(0x7f000019f000)=0xa0) epoll_pwait(r0, &(0x7f0000000000)=[{}, {}, {}, {}, {}, {}, {}, {}, {}], 0x9, 0x9, &(0x7f0000000000)={0x8}, 0x8) ioctl$sock_ipx_SIOCGIFADDR(r0, 0x8915, &(0x7f0000000000)={"1dda925567ab6ccbe81445070e02e235", {0x4, 0x8, 0x1, "cbb07add7aa2", 0x1}}) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) lstat(&(0x7f0000000000)='./file0\x00', &(0x7f0000002000-0x44)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r4 = getgid() setregid(r3, r4) mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) pwritev(r0, &(0x7f0000003000-0x40)=[{&(0x7f0000002000-0x4e)="d4158e23e6c677798b48d628b05c44ddc012b0b93252dd546c599944d7b1ff93bf514058732f8b395386b2d17bc676d121edd5833a9dca00ddbf224c5191c19c48f61a5f8a35617c770581756673", 0x4e}, {&(0x7f0000002000-0xf7)="b323da43373d9e82013a9aea8d513c310f7097f68e7a6d6077912c7c16d98d3d226d3daf100e259be544adeab353ea6092a1f73fa4df23096f9baa0a64f0d8fa6cdb60237c0bdb97f096c875719954487dde122837d63c5fe071c560eba2e8342bf92fbbf5400a59e97f5c72c712529a043188237ef55f9dbd039d405aa652b8b07b23f946df3a1ba3f6cee518a618b4fc718403f042657cb1d53a1d2f90a0a5f271d0ebf33475a1add83cae00a7296b80d0f6c36daa6c036c6729c9f4c200cff0cb4775780bf9561107a32021a39cb8179fb708c2a261983b54784acdb603e29469c7229e4a8b51d0513769b19542647e1854d8fe55c0", 0xf7}, {&(0x7f0000002000)="c6d966fbcd49177e43c7c1784dab14380ea7d8b2f60139dfa96c2f3d3539f2a8b4d615aa142b987abca5290f20acc6c575186aa07b8120981037c5b953564103d8566036878bac54abd57a098caed31ca3a262039b65d7c7bbb323a1df26caede334fcfea9021a754673e02bfaac83", 0x6f}, {&(0x7f0000003000-0x73)="aabc74caf1209604dc16fd430d90bcc1ae9f8c33078ccddea21eba2fe16a42bbdc34a3f45cdcfc6bbf9374afeb99f9e74b26bb3a099573c1c49f9b74202abac7904b5adc9a8fd62f8aaa24b9f6de154df004f120e0473dc26a18d4f4b1080807ddf2ae7de89aa0730287acfc801fd06769917c", 0x73}, {&(0x7f0000002000)="e8ed2b745433608b2bf08815dc387cb47c7bd29198a0f14d42e899fa06d1ac1dd91ffeb822fee9bf2d7346d55f556c771dbd2b6c27e9c8da2a8f4a6d9279ee43e13cc9f844e80c4945354d7f1f2d8d21f086f2cdb39bf952076b7c5fdfba5d89577bef9e371e37e096970403b2d6203bee602b7478d89b5685ddde9c14653eb55d3cc9b31b2914436c95a09194e3a6eb715877c35db2faf6e0e86b85d917bc7c498901b097f7f04f62a6df31122a953c7a4d281e20ba64af973c571f003774", 0xbf}, {&(0x7f0000001000-0x1000)="e54940e276c65e4ef21145f454328aff8617095ee5c0c007501da5e9bfaee61ceccc4979197f7928701640e5fac508582e9b04c1b98300ecf55d22b64369d06dc4a299d3cdd9ed956d731006a295230a5a05f4d852fcfcdc7b4952d92a8db92ad339c10c711e38ab06a473d4188402e8f27a23cdda8b74e8bee059ab7e7ec1dd4c0fc4a2df79e1980d0ff3112998598797ae47cba0b30c57ecc9ab7e5e7227efa463f6ff776b5c447ab5a0a7b2393a885f65108533aee0af8347799799899a75648320b14d4c8717bd4680957beb962e7167f13ebf57982e1a4e390cb60c1d1f3d39751d9b716208039510dd76cfa0cb0588ed5827d7ee5233dde7a59fc8292045c2c31d684afc141fdab35a15cc2951f6c97d3ce020c878c4398525204edf0d2443ec7d08a1358bf970b4aac5d5ab292a7c880a27b80cac2ffce31f88187f383a98ddc09ded26f448d15a8e75d6dd80595e9c811ff394289e02e7d2cb4130982b84bfbb689e57d8770b1f8163d4b27221b24e0ffc7510588c4ee1353f3059f69afa832babcc39f1d15981ccae062bbd5e6be02c0b70f613439700b3f916c4cedbca0ed3f6913b2134244660fada45b888455444416005564a4c61bd80d237f2ab5e4ed0b2a7f4b50ed8b3f1b556b5069d4d4bfadcdd97f4aa3734c476b8b48f735a743a83f4a5174d48db5bfc3cffebd2d832c82506edc2e8bef29a34f1bf3f0223c0ceeebedbf1040afe2394fff49e981e5e19a346299928851869b85196dd6d1fdec1a976c05a0ca8e0709679c6a26bd73ee35ef10dba64112d30f44fd65cc0216dd86ccd973dbe5a92209ad5419e58f5fd8d58da4545f57f464791fde0c3ca9a4113477d41873ae3f73b045540b7af35e3a57c29a6a7f51df5df3049f19e3e6a2b678e769d806ecc34dbfa478987929ebb3caeacb92e4ff30fc4367e73f060f73fad05f9066386549da2481c211fd3cfa261d0f26eb66a87fd70edb40519f14951c562790c0bfbbe207a4282ba2a6dce2c295c2790b396678431707634011661f02b73be75a4049e485e5cd03f4b3dbb2515ed904c91e1f9c63ace242ca34ec9d8aa34814a68778965a5d36e7a1fa413a9f47cce6e5e387ea197ac2e745821b9cfac662a5ee7e0a91a94544f8008455f5e9d1842a4daa846b4967db49803dbe0f4da54c1fa104f74eea300941bdce5ad7a94af5a20cb1ba5ff31e8c3f586611c1266d854ee6420a8da5b14ba4fd78d47d6223310f505c1bf09178ae36365fb9cb2ec46b1b4a018a9c7bbb5dc731b1bc77452209b22cd7d51ecbcf47a80c420705e592ad5a10100a982859b14fecc4ffd795ea09a22a4666e2668e479b44da4938b0bff27cbe5c18a096144a02626cc3f594e3b73d1985adcf360ab9b795425f0f9d7f69519610d173432379c34926df68dfc9b69d1b93b05514274219e1b154b8f1ca629b281b62859c11414dcb4e8a20d190a39d895b4d847e5770b60257df3e45c9b70847c36ec7057ee613511a66db3ab89fd1f081e146d904c09def462b99ae292be5af22384a2b1d37ca06bdb0ea819e04283e2cf410f2295c0d31dffa57c69538a4c24d519c89431dd628ea4bf36b5ad01ee17e9391293adaa98bcf66b098098f36b02aea130a0915086ce3d397f10dd546b18b145dabb0a8c38343c88a0e120b8d9e027107186913619d9b91efdb6346f1b968046f013827bd7c9669010c1dbe1215c885da92abd2530648287380734a5cfc002b76939ab353f6590f7a6e8c4d9f340658eb8eea835230bf3e12da883afc468551ddb6ab1ab8c958aaca392f5a2cd580dd8a89a5f964072eab8ac5f0f14df1d08b3984775192dcdfe396870931745d354d55389683135cef4a91c40842c241ae4bb1ee1ce22634b739798276affa123a66672ca618c541cb088ce8872de4f3cebe9be70d5ff20ee34b3b8dc9b2babfa6c34e7e39110df7731a99af838c1e885a377b075c3a6368347746b9cdf0be8cec104cd66e32eb2dd1b550921c33cce13486237ad55295462ae3113d4d1d765bb8da0e8db4f25681de2b71d4f3b4083f48627425a4a87bc7af5cb84d50b23d33b3e5ba204ced25265103db244d1d1e7e21c9175340e218a2b0035737fb9e846e76aca721e151e505a2d044ac783e6a67092514bad6928f9447b523a577e24b0c511d7a2767eb077db92030b432c184634c633418c1414e4e40575c3ac87dafaa1a71114dde89c3ff90d5788a4e365b09fb04836ff25e1865bbeee8012d59d8d313118ed557d03b4d042009334913bb8dd29f8a9e7ec00a76a683fa475b1255f056445abd284b1b3089142cdc21574c15fd3b31a5eeef2355c6a15053569bc3e1f7114ce9fd6f8b7ddf1fb20f59afe1306e32f941a6fc1231597b5379be01d2ef198ea140b2af5952f70574bf41654ba34fd9cc37e9b234367c35e2071da8865590d4fbb7338ac16613a2b8131d6fa3abd7551ee50af668f49d11abe4a383cd395844c31068595efc7657f4550d32500f82c45857daa4d528de3cee56a7f5cc6ce8003d8dde38202b36278096fc699ba310b02ea25f25679de6ba3c4e7254e74ce91705effb14578666c3e7df752569bfc58114ac0132702cff1b43f4c7dd7a5152e6836de3449ed7a3cec9704c19a06e34f0c839f000a983e7de59389d65f93c5b5d193087e2c729222159fb48a904267b9fc8d20ecb27fb242fab360da5a481535263d829024c02a06875589618dd622da8ff59dc13a442a7489238af43c22b96d55f9f6a7c4ded39d663daa79305a1adb565bea0b4ae3c9e32834e720c24f2669e47f548e7a9a74115d565832c20d08d1bec47e196e305ed6a6c8613cbec9fcc143b7d17f6244aa9eda3b818706501cf8bcfa8630d9f89df97953172738e18e981520d5a3136b3445001d21aa02504df5c25e2264a0fdf77ee64e15929ad5f98cae07b8f845bb8a1c1ee896b80d31916007a46c203b71799cdfbd37e0983e06c7ca3060de648130d43b7bc332244837677915a0072e8d68cd76431528725f18baf283014f78e52b428929c0a11c9359f9f75da71c62117807e5c1268e8432ea78ceda75bd2bac8d09cb9e96c68afaf85d6b256364177f7e18879a2b27efbf083bc8e573a0760a872b07bdb5c6ac194cb2163de5f64e2e461242dceecfd936be5f8629e09cbe53750cb1eb4a5ce22122da83436e46c4d7058a1693bf1571e27f1ca05d9b77d14b215af69b626050c5ac2b565d2793a277dc60d6761c9fb5f8e8070dc7257bc50868f5456d6a6ce16dde2a5b94bbf8e67b2f936571f7a90f5c5e9cb03696ce7a0138230018250fcd574a4a7bffb61f878f8ca4da6920d38ca3b5de910e29020f03d6f9e230915ce0906a4b4c47dbae31f265feb9a6fa1ff9f2c93b4057f92309e1efe1d6e60aaee3a36b1aa5177658c85751ce07704f0e16eb25c957f60eec95c97db785dd147d2a818bfbc38eed9cbffb9e4149171c6e6ba0296194495aac5191bb6aaf8b5bc52ed20e15be68e67d38b5886dbe9093145972cf1d451ebb1269e0515bb1f7667f1140efbbeda715931b70966fbf12c5a4a4f757481706d39306eedd8ddfa0f54dec93bd0e123d1fd5bbfcc0aa7d81909e82093202244c05ec717515429e80f04cfad0d43f62f7d26f5f8fec91292d8d2cbb08d6c3aaaf2336935b8c8ce9bea4bab7182d1c602e5005fed9d7deeb6155e3d8c9188d024d7e1964312e67e05cf02723a99c71d9183e02faadfd4f4df958ca3d6f29806c22eaee196637651bda51fd7046e78c9a62bb99210160d62fec78a483dc3019225d10bc14537370b69d295d40a74b2c6ec4174a5d0f655d75bcbdacbb3148552b236d511eefcfdabc0c4a41b6a308a3773551883ab95e32aec4b4cd25468c0099c0b75e6263f811967f32b0a8b36bc67aec3a1d23e2e8361dd886ebb2fbb9be956264413fa87a610e56d8509f9c55c26e7b6aeb13850765270bc7e40df4ce86f485dd95e04228c76733473db8cebc483f0a43531bb888581e8d4fc982b8305a68429391c3d59b9d7d7389704edde2590618f6e70d99e5a220a9d4159d3635cd79fca521511f33ce7a4dc1a5a985f46feb2ae02090409204defcfca61f0cb0a939fe93040b62a242bdb8653a371c998414271bd16948f99dd71384615acee298c23130369a592460ee54fc46fcce27ab18d87d974ba1f74dd9d770b600f685dd3a97c6264e3408478d07199e3d267c959d07d19e4383ed8880b72c43347fdf48fa70585a6a299b3518b9739871906132180f1980b5b432ff82e68e489ccd7dc2bd89d9d0e6a1996e143155b06c3df77d4d83fe233cdeeac4782bc444f0c8fdea0bc927bb7ccff0b7f082d1f5b71c098deeda02164b69afe758fb47a1af87ec0167fa1dac346c13394f850d610a72741d027ed5af0259445baf42182d67a526fa60daacfcd6eb26c54315f7c0a95a45470b99d1611e11cab0500aec44afdb8719bbf0165296a6833184ce48f676f34b12a00b6ef393f8f4cc704be521420edf4434375dae2cf5d5e35c7cce3b7987eb43c612362f0f72380fc14338d40f155c2af897f1e1c97908d8aacafe945f9d675ef5799ac0d44b845641e5d1560d66a7e8b788f5eb057be80963d1b49d891c0b79aab509795bcaffcb21915ef775a1aa838f28cc2dd32824e99cab43cef0e7faeb86d4d437df4cfe0e2ad1de11e1b59323a0bad51d130bb8a7d1c26c7ae7f86b741f5d526175db019e7ca550f63c441da24ea538657a437a46668aacef551b4d66eea218418e1ca33012d570bf5dc4300a8066bf15587cba53b18792b7c9bd689575cac5bf81dd504dd00bfa05b478e039cde92eb2a446d932e39747a4126b24c624fe44310a1efea2bed498cbafa64eb455349c31c82f96713ff9bb33fe2568e55d2a1f6b471298f68d30926b72af55653f6c34874e4241b25d82e8e25a04844754d9b882225b7de7d4a7701da00f46a05c897ea623768e410ea6200972a6ebbc10d3595e34ff18c01ce8320e6c6cb4cdaadbeca4d37f2aee201dd75ac69c4cc35c0dc018cecb76fec00d6144c475c435834dfb226be8938c15436f1b385e4a302a725918a00094385efd06a0f9c64065e578b7bc8b11111a57ef3dc2869e7636b16726ee1aad42fd2df4d348bdd2de0bf0c772ffe2288bb7616786dcfc54417d8d7f8afbf34241337e75cc8380c7a7735e9d86428e719441d0a101b121bd05ce13d0007a1b542d322d2b39f72cff6c8bc141ab789e1d584e27cb35a23d24c450322ae39e8a0d8b45b4582622d9251fc8c00926f5566ed7db0b85f03bc5b7f661fe11cd539919f391bc4ac698bee11e40386b2b4e29a58c02b51d9de711eb21e7acca7c119e1842fe8cf3c8621751eb20f46e8186540ae2743dea23ac9657af7ae0e00afc170b8fec3259f2e77022c7455a4eef8992d7a321c8bea1c0e12cd4baae1d0ecf6eef3ed472e79a7d82df4702b91f5d5e938809f809139b90bd053fea1beef113878bdc32acb6e7b2633021065f7e94fa173e97dfa871c2c330b7be64dfc4fe514be137b5893f7968929078e237639c9d07ace912f6ebf0b37bec3cc7d1b1fffc1e901010e621973df53e5f54744c357abd969b94bdda1b8e127a665a2dd9833995414e6a23988b93676d2e44b7f1403b1b45613ccd4710f0e041ba949286c8a8d3a7bba7e7058aa5b4a6f0c44a2dc3729a724bd72904eed903e2a8423f7c9d356d27474bd64de84d8e5f9f771b48fc4541348982f84726c6887f37484a13dac999ed00", 0x1000}, {&(0x7f0000002000)="ecbdeee61568593f58bdec6e1b3b4cecf56a1b1e12d111e40fbe78c838dc41d028cd31432cc43245fd314c7b92f00c246e9b58d5137e925dac4926e03c2207fc71d2eac60893c593b279fc508410ad4fb0f37e131f9662c58e3d57", 0x5b}, {&(0x7f0000002000)="39f5ec41b2dae76a39de6d4df9f95bb1c6dcc0a254917b3c9e9be44810fc8cea7abb52213f896d8a0d2fab680024e31edb6c7411bb9a3b4f280093c8889022d861f0855622a0d8656220f9afd2aa7588e8a8eabcc341ed347d5d79dfb299ca90b888b5193219c8571a68e88b49e8b7ab62ba7403944aa7dec6c8a5780363fc1bd8706e6984eaf5", 0x87}], 0x8, 0x0) mmap(&(0x7f0000003000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) quotactl(0x3, &(0x7f0000002000)='./file0\x00', r2, &(0x7f0000004000-0xf8)="517109303770c80cf5950a1b4c514dbbffb468027232ea7a3635b3f92e0a35a2874961fab771127395661fee2cf21079fcbf3e624a88fcbd3f43f5085e0f8e8fc6579ad39c4020861104e8b85facebb3cbd104aad0239eab55426b81d016f54ecd02a8283a69af05168ecb97b30daf9b5fc0aa565a77b3e0349476dd900ede7ac2b2ef0fc5a893ee5bab8d49efbaa66d10319cf516ea61571ee7d7464efd72d3904f94528ebfe03b394b5452901f55651b21f1234799d682ef4b120718608b221f5fdff5e0676f70cba24d457df44f86ca3115e6e72a78cfade025adeac20ee950c9c56474615c62531ef10f953fca9c4207248a7da12f9a") ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000003000-0x8)={0x0, r0}) mmap(&(0x7f0000004000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000004000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) getsockopt$bt_l2cap_L2CAP_CONNINFO(r0, 0x6, 0x2, &(0x7f0000005000-0x5), &(0x7f0000004000)=0x5) mmap(&(0x7f0000005000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000005000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000005000)={r0, 0x50, &(0x7f0000006000-0x50)={0x0, 0x0}}, 0x10) mmap(&(0x7f0000005000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000006000-0x4)=r5, 0x4) epoll_create(0x1) 2018/02/10 14:10:13 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = mmap$binder(&(0x7f0000c39000/0x2000)=nil, 0x2000, 0x5, 0x8810, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000a000)={0x14, 0x0, &(0x7f0000e3f000-0x14)=[@acquire_done={0x40106309, r1, 0x2}], 0x39, 0x0, &(0x7f00007fe000)="5fd2706ed8cde3485bf72b5c08fd7c5c79a98ac1e623f4e15db6ef7cfc5e0ab85c51f009c94addb5ff8a8be7e45dd2a06f9419e040a7f3545d"}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000008000-0x30)={0x0, 0x0, &(0x7f0000d06000)=[], 0x0, 0x0, &(0x7f0000176000-0x1)}) r2 = open(&(0x7f0000882000-0x8)='./file0\x00', 0x200800, 0x4) ioctl$VHOST_GET_FEATURES(r2, 0x8008af00, &(0x7f0000e16000)) 2018/02/10 14:10:13 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r0, r0, &(0x7f0000049000), 0x3d2) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000008000)={&(0x7f000000f000-0xc)={0x10, 0x34000}, 0xc, &(0x7f0000220000)={&(0x7f00008d6000-0x14)={0x14, 0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, {}, []}, 0x14}, 0x1}, 0x0) r1 = userfaultfd(0x80800) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000ff8000-0x20)={{&(0x7f0000012000/0x2000)=nil, 0x2000}, 0x1}) bpf$MAP_CREATE(0x0, &(0x7f0000fb4000)={0x2, 0x8000000000000004, 0x400, 0x7fd, 0x4, 0xffffffffffffffff}, 0x2c) userfaultfd(0x800) clock_gettime(0x0, &(0x7f0000132000)={0x0, 0x0}) socketpair(0x1d, 0x800, 0x4, &(0x7f0000589000)) r4 = syz_open_dev$mouse(&(0x7f00006eb000)='/dev/input/mouse#\x00', 0xde6e, 0x1) timer_settime(0x0, 0x1, &(0x7f000097e000)={{0x0, r3}, {r2, r3+10000000}}, &(0x7f0000939000)) fanotify_init(0x25, 0x802) r5 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000ef2000-0x1d)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f00002d8000-0xc)={0x0, 0x0}, &(0x7f0000d76000-0x4)=0xc) syz_open_procfs(r6, &(0x7f0000013000)='ns/cgroup\x00') openat$ion(0xffffffffffffff9c, &(0x7f0000dd5000)='/dev/ion\x00', 0x800, 0x0) pipe2(&(0x7f000058c000), 0x4800) setsockopt$inet_IP_XFRM_POLICY(r4, 0x0, 0x11, &(0x7f0000e12000-0xe8)={{{@in6=@mcast1={0xff, 0x1, [], 0x1}, @in=@rand_addr, 0x2, 0xbd, 0x3, 0x20, 0xa, 0xa0, 0x80, 0x0, 0x0, r7}, {0x0, 0x8, 0x0, 0x3, 0x6, 0x1fa8, 0x8, 0x20}, {0x1719, 0x7fff, 0x7ff, 0x7ff}, 0x1, 0x7, 0x0, 0x1, 0x1, 0x3}, {{@in=@broadcast=0xffffffff, 0x1, 0x7f}, 0xa, @in=@empty, 0xffffffffffffffff, 0x3, 0x0, 0xffffffffffffffbc, 0x20, 0x6, 0x2}}, 0xe8) openat$selinux_policy(0xffffffffffffff9c, &(0x7f000010e000-0x10)='/selinux/policy\x00', 0x0, 0x0) setsockopt$netlink_NETLINK_TX_RING(r5, 0x10e, 0x7, &(0x7f0000ab4000-0x10)={0x6, 0x7, 0x52, 0xfffffffffffffffc}, 0x10) 2018/02/10 14:10:13 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000ed2000-0x8)=0x10000000) r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c) ioctl$VHOST_SET_OWNER(r0, 0xaf01, 0x0) mmap(&(0x7f0000000000/0x19000)=nil, 0x19000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r1 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000924000-0xc)='/dev/rfkill\x00', 0x0, 0x0) r2 = userfaultfd(0x0) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000e54000-0x18)={0xaa}) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000008000-0x20)={{&(0x7f0000000000/0x4000)=nil, 0x4000}, 0x1}) readv(r1, &(0x7f00001f3000-0x10)=[{&(0x7f0000002000-0x4e)=""/1, 0x1}], 0x1) setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000450000-0x4)=0x6, 0x4) ioctl$RNDADDTOENTCNT(r1, 0x40045201, &(0x7f0000a81000)) ioctl$UFFDIO_UNREGISTER(r2, 0xc020aa04, &(0x7f0000008000-0x4)={&(0x7f0000000000/0x2000)=nil, 0x2000}) 2018/02/10 14:10:13 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6_icmp(0xa, 0x2, 0x3a) ioctl$sock_inet_SIOCGIFDSTADDR(r1, 0x8917, &(0x7f00003f7000)={@syzn={0x73, 0x79, 0x7a, 0x0}, @ifru_flags=0x1100}) pwrite64(r0, &(0x7f00001a6000)="1ac4c856f62d6b99e91ab5c1b34f0152a5d9fe81da54f8241e0df529908a70d5bd80e4992b65b31543ec8c717a012d56dac57a7903d46a58e0c17a56f32a9336eeb9dabe", 0x44, 0x0) fstatfs(0xffffffffffffffff, &(0x7f0000887000)=""/165) getsockopt$bt_BT_VOICE(r1, 0x112, 0xb, &(0x7f0000813000)=0x9, &(0x7f0000c1b000)=0x2) fallocate(r0, 0x3, 0x80, 0x10001) r2 = open(&(0x7f000058a000)='./file0\x00', 0x8240, 0x41) ioctl$VHOST_VSOCK_SET_RUNNING(r2, 0x4004af61, &(0x7f00008ba000)) getsockopt$inet_pktinfo(r2, 0x0, 0x8, &(0x7f0000550000)={0x0, @dev, @dev}, &(0x7f0000c57000-0x4)=0xc) 2018/02/10 14:10:13 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f000031f000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) close(r0) r1 = socket$inet_sctp(0x2, 0x80003, 0x84) setsockopt$inet_int(r1, 0x0, 0x3, &(0x7f0000f20000)=0x47, 0x4) setsockopt$inet_MCAST_LEAVE_GROUP(r0, 0x0, 0x2d, &(0x7f0000ad2000-0x90)={0x1fe0000000, {{0x2, 0x0, @remote={0xac, 0x14, 0x0, 0xbb}}}}, 0x90) sendto$inet(r0, &(0x7f0000b3e000), 0x0, 0xfffffffffffffffc, &(0x7f000078a000)={0x2, 0xffffffffffffffff, @loopback=0x7f000002}, 0x10) [ 71.101916] binder: 11807:11811 BC_ACQUIRE_DONE uffffffffffffffff no match [ 71.122379] binder: 11806:11816 unknown command 0 [ 71.130733] binder: 11806:11816 ioctl c0306201 2000a000 returned -22 2018/02/10 14:10:13 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ppp\x00', 0x180, 0x0) setsockopt$bt_l2cap_L2CAP_OPTIONS(r0, 0x6, 0x1, &(0x7f0000001000-0xc)={0x8, 0xb86, 0x10000, 0x1, 0x1, 0x1, 0x81}, 0xc) perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000466000-0x48)={0x1, 0x3, &(0x7f00009ff000)=@framed={{0x18}, [], {0x95}}, &(0x7f00002bf000)='syzkaller\x00', 0x4, 0xb7, &(0x7f00006ab000)=""/183}, 0x48) socket$kcm(0x29, 0x2, 0x0) socket$inet_udp(0x2, 0x2, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) setsockopt$inet_tcp_int(r1, 0x6, 0x15, &(0x7f0000c7f000-0x4)=0x4bca, 0x4) connect(r1, &(0x7f0000117000)=@generic={0x0, "e2536246f43039ce3247c3eba6a49dcbc921590dcc42810eec3852f2c62ff52cdb3dc384220dde7def73fb84a58ae6a867f0204fba7c868f1153fc107ecdb4c1d1ec89121321afda10ab1947e5532fcaa6f527e42db1700af409d7e5435559eb2c519f83d83f1df99ee0fd76eb267cf2e995b67f02115f64d5af81910617"}, 0x80) bind$inet(r1, &(0x7f0000307000-0x10)={0x2, 0x1, @loopback=0x7f000001}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000cc2000-0x14)={0x800, 0x8, 0x7, 0x1, 0x2}, 0x14) sendto$inet(r1, &(0x7f00008d8000-0x3)="b0a40a", 0x3, 0x20020007, &(0x7f00009f1000)={0x2, 0x1, @loopback=0x7f000001}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r1, 0x6, 0x1d, &(0x7f0000f8e000)={0xffffffffffffffff, 0x20000000012c6, 0x1000010006, 0x8000400, 0xfffffffffffffffc}, 0x14) shutdown(r1, 0x1) 2018/02/10 14:10:13 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000a5000-0x8)) r0 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000b44000-0x19)='/selinux/avc/cache_stats\x00', 0x0, 0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(r0, 0x29, 0x22, &(0x7f00002ff000)={{{@in6=@mcast1, @in6=@remote}}, {{@in=@loopback}, 0x0, @in=@dev}}, &(0x7f0000480000)=0xe8) mmap(&(0x7f0000000000/0x19000)=nil, 0x19000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r1 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000924000-0xc)='/dev/rfkill\x00', 0x0, 0x0) r2 = userfaultfd(0x0) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000e54000-0x18)={0xaa}) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000008000-0x20)={{&(0x7f0000000000/0x4000)=nil, 0x4000}, 0x1}) readv(r1, &(0x7f00001f3000-0x10)=[{&(0x7f0000002000-0x4e)=""/1, 0x1}], 0x1) ioctl$RNDADDTOENTCNT(r1, 0x40045201, &(0x7f0000b27000)) ioctl$sock_inet_tcp_SIOCOUTQ(r0, 0x5411, &(0x7f0000a88000-0x4)) ioctl$RNDADDTOENTCNT(r1, 0x40045201, &(0x7f0000a81000)) ioctl$UFFDIO_UNREGISTER(r2, 0xc020aa04, &(0x7f0000008000-0x4)={&(0x7f0000000000/0x2000)=nil, 0x2000}) ioctl$KDSKBMODE(r1, 0x4b45, &(0x7f0000f41000-0x4)=0x10000) 2018/02/10 14:10:13 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x0, 0x32, 0xffffffffffffffff, 0x0) mprotect(&(0x7f00002bd000/0x1000)=nil, 0x1000, 0x1) r0 = dup(0xffffffffffffff9c) timerfd_gettime(r0, &(0x7f00003b1000)={{0x0, 0x0}}) write$sndseq(r0, &(0x7f0000539000-0x54)=[{0x5, 0x6, 0x7, 0x551, @time, {}, {0x4, 0x2}, @addr={0x9, 0x8}}, {0x9db3, 0x6, 0xfffffffffffffffd, 0x3, @tick=0x2089, {0x9, 0xc8e0}, {0xfffffffffffffffa, 0xa37}, @raw8={"efe13f61107392f9b39b2896"}}, {0x6, 0x9, 0x9, 0xfc71, @time={0x77359400, r1}, {0xffffffff, 0xa}, {0x7, 0x7}, @queue={0x80000000, {0x8, 0x10000}}}], 0x54) setsockopt$bt_hci_HCI_TIME_STAMP(r0, 0x0, 0x3, &(0x7f0000a74000-0x4), 0xffffffffffffffb2) socket$inet6_dccp(0xa, 0x6, 0x0) getsockopt(r0, 0xffff, 0x0, &(0x7f0000d5d000), &(0x7f00003ae000)=0xbc6ab882157936df) setsockopt$bt_hci_HCI_TIME_STAMP(r0, 0x0, 0x3, &(0x7f00002c4000-0x4)=0xa12f, 0x4) setsockopt$inet_sctp6_SCTP_EVENTS(r0, 0x84, 0xb, &(0x7f00004ae000-0xb)={0x9, 0x8001, 0x1, 0x0, 0x3, 0x6, 0x4, 0x101, 0x9, 0xfffffffffffff9c3, 0x2}, 0xb) [ 71.150709] binder: 11807:11811 BC_ACQUIRE_DONE uffffffffffffffff no match [ 71.183493] binder_alloc: binder_alloc_mmap_handler: 11806 20000000-20002000 already mapped failed -16 [ 71.194643] binder: BINDER_SET_CONTEXT_MGR already set 2018/02/10 14:10:13 executing program 6: r0 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000cc9000-0x18)='/selinux/avc/hash_stats\x00', 0x0, 0x0) connect$pppoe(r0, &(0x7f0000bb0000-0x1e)={0x18, 0x0, {0x4, @random="48f3e4860535", @common='erspan0\x00'}}, 0x1e) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000a000)={0x34e, 0x0, &(0x7f00001e5000-0x8)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000006000-0x54)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000008000-0x30)={0x0, 0x0, &(0x7f0000d06000)=[], 0x0, 0x0, &(0x7f0000176000-0x1)}) [ 71.206219] can: request_module (can-proto-4) failed. [ 71.206868] binder: 11806:11816 ioctl 40046207 0 returned -16 [ 71.234986] binder: 11806:11828 unknown command 0 [ 71.240386] binder: 11806:11828 ioctl c0306201 2000a000 returned -22 [ 71.249792] binder: 11840:11843 unknown command 0 2018/02/10 14:10:13 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x2, 0x78, 0xe2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x24e000)=nil, 0x24e000, 0x3, 0x31, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000039000-0x18)={0xaa}) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f0000cfe000)=0x0) ptrace$PTRACE_SECCOMP_GET_FILTER(0x420c, r1, 0x5, &(0x7f000091d000)=""/4096) ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f0000f38000)={0xaa}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000003000-0x20)={{&(0x7f0000000000/0x3000)=nil, 0x3000}, 0x1}) ioctl$UFFDIO_UNREGISTER(r0, 0xc020aa04, &(0x7f0000262000-0x10)={&(0x7f0000000000/0x3000)=nil, 0x3000}) 2018/02/10 14:10:13 executing program 3: mmap(&(0x7f0000000000/0xfde000)=nil, 0xfde000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000fde000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) sched_getaffinity(0x0, 0x8, &(0x7f0000fde000-0x6)) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000025c000)={0x0, 0x78, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x56c3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x80}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 2018/02/10 14:10:13 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r0, r0, &(0x7f0000049000), 0x3d2) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000008000)={&(0x7f000000f000-0xc)={0x10, 0x34000}, 0xc, &(0x7f0000220000)={&(0x7f00008d6000-0x14)={0x14, 0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, {}, []}, 0x14}, 0x1}, 0x0) r1 = userfaultfd(0x80800) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000ff8000-0x20)={{&(0x7f0000012000/0x2000)=nil, 0x2000}, 0x1}) bpf$MAP_CREATE(0x0, &(0x7f0000fb4000)={0x2, 0x8000000000000004, 0x400, 0x7fd, 0x4, 0xffffffffffffffff}, 0x2c) userfaultfd(0x800) clock_gettime(0x0, &(0x7f0000132000)={0x0, 0x0}) socketpair(0x1d, 0x800, 0x4, &(0x7f0000589000)) r4 = syz_open_dev$mouse(&(0x7f00006eb000)='/dev/input/mouse#\x00', 0xde6e, 0x1) timer_settime(0x0, 0x1, &(0x7f000097e000)={{0x0, r3}, {r2, r3+10000000}}, &(0x7f0000939000)) fanotify_init(0x25, 0x802) r5 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000ef2000-0x1d)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f00002d8000-0xc)={0x0, 0x0}, &(0x7f0000d76000-0x4)=0xc) syz_open_procfs(r6, &(0x7f0000013000)='ns/cgroup\x00') openat$ion(0xffffffffffffff9c, &(0x7f0000dd5000)='/dev/ion\x00', 0x800, 0x0) pipe2(&(0x7f000058c000), 0x4800) setsockopt$inet_IP_XFRM_POLICY(r4, 0x0, 0x11, &(0x7f0000e12000-0xe8)={{{@in6=@mcast1={0xff, 0x1, [], 0x1}, @in=@rand_addr, 0x2, 0xbd, 0x3, 0x20, 0xa, 0xa0, 0x80, 0x0, 0x0, r7}, {0x0, 0x8, 0x0, 0x3, 0x6, 0x1fa8, 0x8, 0x20}, {0x1719, 0x7fff, 0x7ff, 0x7ff}, 0x1, 0x7, 0x0, 0x1, 0x1, 0x3}, {{@in=@broadcast=0xffffffff, 0x1, 0x7f}, 0xa, @in=@empty, 0xffffffffffffffff, 0x3, 0x0, 0xffffffffffffffbc, 0x20, 0x6, 0x2}}, 0xe8) openat$selinux_policy(0xffffffffffffff9c, &(0x7f000010e000-0x10)='/selinux/policy\x00', 0x0, 0x0) setsockopt$netlink_NETLINK_TX_RING(r5, 0x10e, 0x7, &(0x7f0000ab4000-0x10)={0x6, 0x7, 0x52, 0xfffffffffffffffc}, 0x10) 2018/02/10 14:10:13 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$usbmon(&(0x7f00003bd000)='/dev/usbmon#\x00', 0x5, 0x10000) ioctl$sock_inet_SIOCSIFDSTADDR(r0, 0x8918, &(0x7f00000d1000-0x20)={@syzn={0x73, 0x79, 0x7a, 0x0}, @ifru_flags=0x800}) ioctl$ASHMEM_GET_SIZE(r0, 0x7704, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f00002a1000-0x48)={0x80000000001, 0x3, &(0x7f00005e3000-0x18)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x5, 0xc}, [], {0x95}}, &(0x7f0000b17000)="ff50460008dc1e41e351fbfb886a74d373faba31a1f46157576e43895185d0e8f1dac9a8b0bbe647bf111c41e22c2106ad6e2cc70e46d489f11ebf3e971d728248d6cee72c7509c91a318b5f3285d2c9a44f18fd4b3735f9b928b888ce0891f934ce414fb56c15ae42dab9bc4c393908c2", 0xffffffffffff8342, 0x99, &(0x7f0000d70000-0x7f)=""/153}, 0x48) ioctl$EVIOCGABS0(r1, 0x80184540, &(0x7f00009cc000)=""/4096) getsockopt$inet_sctp_SCTP_AUTH_ACTIVE_KEY(r0, 0x84, 0x18, &(0x7f000000d000-0x6)={0x0, 0x11}, &(0x7f00001d7000)=0x6) setsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r0, 0x84, 0x75, &(0x7f0000478000-0x8)={r2, 0x8}, 0x8) ioctl$KVM_CHECK_EXTENSION_VM(r0, 0xae03, 0xfffffffffffffffa) sendto$inet6(r0, &(0x7f000044b000-0x92)="9379f390fe01195ed4c9838b19ed65082ae4f275f752001a95ed3d1b6d86ab765102447c2b88007e5d5aa9b116b8604693bce24e7bc7d2f7bf6ef446713344c07f6298c92b9d783641aae290a1eccb1a360d777b40e8264b3fd15f1460d393986ed4f5b2a42500fe9e0b2aaa7f574d1211e6136f67f625d08ea84aacd158a489a9a55a6082e795f2d89a8731369d76ee0846", 0x92, 0x240000c0, &(0x7f0000cc7000-0x1c)={0xa, 0x3, 0x4, @empty, 0x5}, 0x1c) setsockopt$sock_int(r0, 0x1, 0x1d, &(0x7f0000822000-0x4), 0x4) [ 71.257503] binder_alloc: 11806: binder_alloc_buf, no vma [ 71.263199] binder: 11806:11816 transaction failed 29189/-3, size 56-8 line 2957 [ 71.264296] binder: 11840:11843 ioctl c0306201 2000a000 returned -22 2018/02/10 14:10:13 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = memfd_create(&(0x7f000003e000)='\'', 0x0) r1 = syz_open_dev$sndseq(&(0x7f0000042000)='/dev/snd/seq\x00', 0x0, 0x8000000000102) r2 = dup2(r1, r0) ioctl$EVIOCSABS2F(r0, 0x401845ef, &(0x7f0000db9000-0x18)={0x7ff, 0x0, 0x2d5, 0x1, 0x6, 0xffff00000}) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r2, 0xc08c5332, &(0x7f0000001000)={0x0, 0x0, 0x0, "9ede7a8c5ae95ec8672c93340f643a664f13eeab65c0322901dc6bd36cde2c51f01b7f0b014f9f91eeb7c37c7240f476c8d753d000aa8faf8fb574dbcfa6dc4d"}) write$sndseq(r1, &(0x7f0000002000)=[{0x0, 0x0, 0x0, 0x0, @time={0x77359400}, {}, {}, @ext={0x0, &(0x7f0000ae5000)}}], 0x30) ioctl$SNDRV_SEQ_IOCTL_SET_CLIENT_POOL(r1, 0x4058534c, &(0x7f00006d2000-0x58)={0x9, 0x8, 0x100400, 0x1, 0x5, 0x8000}) r3 = syz_open_dev$sndseq(&(0x7f0000cea000-0xd)='/dev/snd/seq\x00', 0x0, 0x0) r4 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000e26000)='/dev/sequencer2\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_CLIENT(r3, 0x404c534a, &(0x7f0000643000-0x4c)={0x0, 0x0, 0x10001, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdfd]}) dup2(r4, r3) 2018/02/10 14:10:13 executing program 0: mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000001000-0x9)='net/stat\x00') r1 = syz_open_dev$sndpcmc(&(0x7f00003db000)='/dev/snd/pcmC#D#c\x00', 0x1, 0x1) ioctl$VHOST_SET_LOG_FD(r0, 0x4004af07, &(0x7f0000443000)=r1) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) getrusage(0xffffffffffffffff, &(0x7f00003af000)) lstat(&(0x7f000020b000)='./file0\x00', &(0x7f00002d5000-0x44)={0x0, 0x0, 0x0, 0x0, 0x0}) r3 = add_key(&(0x7f00004b7000-0x8)='keyring\x00', &(0x7f0000192000)={0x73, 0x79, 0x7a, 0x0}, 0x0, 0x0, 0xfffffffffffffff9) keyctl$get_persistent(0x16, r2, r3) ioctl$VHOST_SET_VRING_ENDIAN(r1, 0x4008af13, &(0x7f000044f000)={0x2, 0x49}) syz_emit_ethernet(0x46, &(0x7f0000027000)={@local={[0xaa, 0xaa, 0xaa, 0xaa], 0x0, 0xaa}, @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "a0035d", 0x10, 0x21, 0x0, @dev={0xfe, 0x80}, @mcast2={0xff, 0x2, [], 0x1}, {[], @dccp={{0xffffffffffffffff, 0xffffffffffffffff, 0x4, 0x1, 0x0, 0x0, 0xfffffff5, 0x2, 0x0, "f0810e", 0x0, "c6ff9f"}}}}}}}, &(0x7f0000047000-0x10)={0x0, 0x0, []}) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r1, 0x84, 0x1d, &(0x7f0000312000-0x14)={0x4, [0x0, 0x0, 0x0, 0x0]}, &(0x7f00000f5000)=0x14) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f00001dc000)={r4, 0x750}, 0x8) r5 = add_key(&(0x7f00005e2000-0x8)='keyring\x00', &(0x7f000017b000)={0x73, 0x79, 0x7a, 0x0}, 0x0, 0x0, 0xfffffffffffffffb) keyctl$invalidate(0x15, r5) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f000094b000)=0xfffffffffffeffff) 2018/02/10 14:10:13 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000f24000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = mmap$binder(&(0x7f0000b1f000/0x2000)=nil, 0x2000, 0x1, 0x1010, r0, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000c90000)={r1}) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000a000)={0x34e, 0x0, &(0x7f00007cf000)=[], 0xfef4, 0x0, &(0x7f000001f000-0x1)="eb"}) r2 = openat$audio(0xffffffffffffff9c, &(0x7f0000b7d000)='/dev/audio\x00', 0x400000, 0x0) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(r2, 0x10e, 0x1, &(0x7f0000c0f000-0x4)=0x1a, 0x4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000-0x30)={0x44, 0x0, &(0x7f0000d06000)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x38, 0x8, &(0x7f000000d000)=[@fda={0x66646185}, @flat={0x73682a85}], &(0x7f0000006000)=[0x20]}}], 0x0, 0x0, &(0x7f0000176000-0x1)}) 2018/02/10 14:10:13 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$vcsn(&(0x7f0000fc6000)='/dev/vcs#\x00', 0x27d34993, 0x400) ioctl$FIONREAD(r0, 0x541b, &(0x7f0000dc7000)) r1 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000a000)={0x34e, 0x0, &(0x7f00001e5000-0x8)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000006000-0x54)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000008000-0x30)={0x0, 0x0, &(0x7f0000d06000)=[], 0x0, 0x0, &(0x7f0000176000-0x1)}) [ 71.308782] binder: 11840:11848 unknown command 0 [ 71.317214] binder: 11840:11848 ioctl c0306201 2000a000 returned -22 [ 71.324532] binder: undelivered TRANSACTION_ERROR: 29189 [ 71.330382] binder: release 11806:11816 transaction 315 out, still active [ 71.337443] binder: undelivered TRANSACTION_COMPLETE [ 71.342635] binder: send failed reply for transaction 315, target dead 2018/02/10 14:10:13 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2000000000001, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000687000)=0x5c802861, 0x4) setsockopt$inet6_opts(r0, 0x29, 0x36, &(0x7f0000904000-0x8)=@hopopts={0x0, 0x0, [], []}, 0x8) setsockopt$inet6_int(r0, 0x29, 0x5, &(0x7f0000b97000)=0x62890000000, 0x4) bind$inet6(r0, &(0x7f0000e05000)={0xa, 0x0, 0x4d, @loopback={0x0, 0x1}}, 0xfdda) sendto$inet6(r0, &(0x7f00007a9000-0x1), 0x0, 0xfffffefffffffffe, &(0x7f0000f63000-0x1c)={0xa, 0x0, 0x0, @loopback={0x0, 0x1}}, 0x1c) 2018/02/10 14:10:13 executing program 3: r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000000)=0x9) nanosleep(&(0x7f0000d1e000)={0x0, 0x1c9c380}, &(0x7f00005c0000-0x10)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) munlockall() setsockopt$inet_sctp_SCTP_AUTH_KEY(0xffffffffffffffff, 0x84, 0x17, &(0x7f0000548000-0xf6), 0x8) r1 = syz_open_dev$adsp(&(0x7f000021c000-0xb)='/dev/adsp#\x00', 0x147fc317, 0x151380) r2 = socket$llc(0x1a, 0x2, 0x0) lstat(&(0x7f0000184000-0x8)='./file0\x00', &(0x7f0000d35000-0x44)={0x0, 0x0, 0x0, 0x0, 0x0}) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000848000)={{{@in6=@dev, @in=@rand_addr, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@dev}, 0x0, @in6=@loopback}}, &(0x7f0000117000-0x4)=0xe8) lstat(&(0x7f0000197000-0x8)='./file0\x00', &(0x7f000047f000)={0x0, 0x0, 0x0, 0x0, 0x0}) r6 = openat$dsp(0xffffffffffffff9c, &(0x7f0000e77000-0x9)='/dev/dsp\x00', 0x4a00, 0x0) r7 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000ce0000)='/dev/hwrng\x00', 0x400080, 0x0) r8 = accept4$packet(0xffffffffffffff9c, 0x0, &(0x7f0000292000), 0x80800) r9 = socket$inet(0x2, 0x7, 0x2) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffffff, 0x89e2, &(0x7f00006f2000)={0xffffffffffffff9c}) r11 = openat$selinux_member(0xffffffffffffff9c, &(0x7f0000204000)='/selinux/member\x00', 0x2, 0x0) getresuid(&(0x7f0000c9a000-0x1), &(0x7f00003cb000)=0x0, &(0x7f00006dc000)) stat(&(0x7f0000864000-0x8)='./file0\x00', &(0x7f000000b000-0x44)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$netlink(r1, &(0x7f000091d000-0x1c)={&(0x7f00002bd000)=@kern={0x10, 0x0, 0x0, 0xa0000400}, 0xc, &(0x7f000039a000-0x38)=[{&(0x7f0000f92000-0x1c)={0x1c, 0x18, 0x0, 0x6, 0x1, "", [@typed={0xc, 0x4b, @ipv4=@loopback=0x7f000001}]}, 0x1c}, {&(0x7f000087d000-0x1524)={0x1524, 0x39, 0x200, 0x5, 0x3, "", [@typed={0x74, 0x3a, @binary="20bbf1c666f4d888d83a64ae547a27979620bc21946fdc5134c695879a6ab48ece53561dc70f3f1c95345d0482e5f1340b121a461a4045514e2f249081d4c7276a9962009a7d3e39e60b2e57facd092738cd932b17544b7eefb006fce00f1de235f86f6d2a5aaed4e5"}, @generic="0d3e224443466ab01baae5255abe5963281e2be203275dc00b395513613b9427e616fc5634bcc14d59e3e965a9d6f62b6d40e7b398bfbba36ff5d17bac19c60aff06e52897eb98abcb2dd73730490c1240be9cc615f9e64b39c1342ca4df784ae25ace6811b269e8919dd6f777813d5d60c682994d44cc3af42c006861dff7935fd2ff0b64e48e49163a557daae1ae5a6ccb04f1684ad6f4f2089bf7cb056d3beb4a2b5c03dbfdea03ada3369c164e851e3fac0ccc255f4b7ae715a684b35d8c55ede402a167e756c2111e9824af9010e7ce7cd9228c678cd61d40123fb8be6a3a641dbf56b87fe62d7958ccc21879d37ed016171e10a5151d21dbab759b37214bd4a58ef9a05e4f1dce5aa866e46b6fb697b8d1e4b69a9839344be25b6c588b02da948e0a9e8e6dbdc1c2ea5c84e9b8c8922fa01ea8aee7b57545a6448106d35062c4c4d11d6a6508703c6307cdb0646428b921df19bd1cef140769de7d22fbcf723bcc1f15420eaf89bae293f0543b9f840a4da97e0d407f5698b9fad6e36a687a7de4f36ab5b3d3eb165942c7dc4ca5d5e0fd2fe95fec1a313fd1fd0d6f19e25380446154cee5bdd35d7b0ac7136bd650b48d7538f7689d5fd542eb4867eb2a71b96b397a4becddc51fab07b363e8173d61d959da94c5dae25fb1b4ac3672c60a2c5228ac08f757ad7d8f6e5146b18b54cd3e7a487ee6da0501310727c6cd4da668ac38da313a85fa730f720a23d28b006274e250bd265f5debf0ddc3e8ed55a8cbc3e4fefdb5d97f8599117ffcda60c901ff286c9e28ebfcfba8f58bdbe385d2b9676db2d4c63c01f334564b7ee6e26d45fabc418b95bfb74521179ac7bda2876cfd6849cad8c6d43a612838e04b1afa543ef37dd54d47049d1c1d27173b519bda3e0a6acc662369bc4290f00251ab502d15a3ae0e24a9a566c27209d1dc528bfe77e8c7942b1af1696f1a0a20afd77f19963d48a007a7f2ff025b8212f6c6a5b9c540df20890573574dc429a6c7b2ad0b06af06b43f18dd2e808aff46c3bb1749c5bde823aa002f600a936207a23dcafc959cfea0fa00f2a54994dc8d31fbb7b0d11a773382947e3c9d4756ade50df9b335d29725ab229aa0f8c3cf9779bf700204dbc9a680387df5109f6ed4d0bbd281ed504c8bd4d21a91c552d0ea363e7e8958b7a853cca143c8bec16e5e5ab49ce9d77713c8f1e817ad69d08e6cc9bb87fc3f9a1b90a9631a5fab06820a7e555a5950b403e2030d12b695ce81c3e325af895fdd82eb930f09eef9a007e0dfcd803cf9e7b85282db690f00c496c352b37014fe330e141695e5086e90236d36040caddd90a6e3833f215b48ec3d06ef21134b39ac80564f9161d493f2b0bdb17ad0f262444d1fa0df9e2d5123a8930f412f91ff7165ba882b2e377048674cec999b1478af1dd53ddc3f015d17027ce9f6be0f5eea6ae45ecd5e6db010a8476382b045260911dfd1e269c127e6ae41d856c665ecaf1d8303714145a8ab27b8afb721495cde708f8062982fa9bdd6e09adbe824aa9a5843e28250aa00169882768a0cbc03a0368f2dd2a375d0e5873cab011c4822b2a94d4deb5b261f73f460f8ca1dfcde8f5841f0064f0a3c6fef706026211e3d4fb1b8bc8292acc815ca5b24ad26aeb2cb7caad68f0ab2e4857bea66b187e8a9abbb7e8e83cf9e654b427da6c0f86bd040bfa3d4cdda071f0958e110be710916275b7faa5879838380cd8820ea76523fb781cd9e532e7df2bb0aeb0f4d550ffdcc10b443099be0be4125f93f5f6f4534ad7f89632d92f1a9791a439e779813fd404348ef2f46af1c6838b2546810554da68a728b50cd60c932229e0d083b758505299ae54439b685508d76f48562cc14f3645d9ce09fc2d0a7f1ea74c600e60745011b90b0c2a2c20cc4781e65d77ec1a83a5344d428993fdca3ca7e2e3bddd67bd3b923ab0e41bc26926d4aa5b4521bb9d75470e88b53eaef0b6d2068cd22d7a835d97a6dfc5fa9aa43c02b32a70f6f8adb868bd71457fe9800019aa2367e665a1f484c1a58c87353e3d69f029b5e5fbd73ad66a531396ef4b80c382ebc3705ebd16807ee2d860ea214d6366b17c1be190a5e8cbc0e0f520544b1adcf74d52fc1a215dca742281df99ceab890894ef6b61f9390ad189ca4550578adaf736e7843c2961e49350181cce75047ab2575a4a324c788118b8e9c596e27d467b34a01cdfcd903ed24615379efd319ddfb9dbad225c97a83728ada2de49cb82316613e79adec88ca17100b37f3de8410db7995241a3ff7cfb220bac589ad6fdc7435692c8d9821a242d8a9e723074d2e7361e6e85ba49b8d6c35286b686bc3100aa101393ddbc6b12e33ff11a8ba2441b129004837b63c129ca61c7f8ade9b145751a9c8cdbd08db81146e971b768ba65f3a1f9cea4c1bef8f28aefb8f8fd7bb4bbd10080bc198c2cc50ac6255b0d6562a9ac75e2dc16f56f869f6fd1274fc588a55116fd2c6e11e68d6251c61685ed47e26a1ab6b78a4e65a26ad99e4029b3f7833fab235ad165f4b7ee8e7d2ab38a51a44ae37e69664f950540ad9adf80fb8b53b9dff22ce1f02950f0f6ae28e124ab9f302839a9a2d326a171d5d64ff216eecf96acb8669d3166331ccff2723fc27684b0fbe0311191abcc189257a92551c23d9b9d96d0a6f3e7fce89f277dd168031c1dcf39e18e9ef020b0acc85301088a4f867108341e9d544f285b5e25df025dd1f946596dabb6574fedbf0fc1c812528b96e0263c767ffb45fb2e0f8a843739318fae41b11923075c0f0116299a4c78436b6f2560ef829314c4f4168da348b0e6677e85d7ba92416b640b8cf7519a4780242fc37a72e6cb5a21439be3ea6a467f9dfecf65d9ef576676f251efb0b9553e481c0f4b892fcaecd79906f8305379ed7f06e5f9c534798b973a1f30adaf4dd20307fa0ee84917f5ff61eb0e463267a7355a75eae8b2d11e714531b905e8620e9b4a49876426f5a8810b9481d8faabde3af895e1616ecb30886d177d4d36f96e18ed154225a4e1c3d8e7176c23e7b92c87cdda1f61cfbcc1b28f7194c45c9cb338fd9cda2050e505585faa09e0e0c265ecb8ddafec45b5f1e2069529a8106871b9841511fa5d3767f35cfcf802c5c9ebedd89425b97191f6e243c8e6885b7a8fc44887d3cb4d5091fa71418afc718296b1e1197f19b655e59b7b8ac2cea3f2d0f9fb5c3242dd75715c8e872f4b7cacd794b7ab374b9cb12d2219f175952fef611c1adaaff391f0ae4fe8a9caaa26bcf72816b0d0fa722245dc90920463f51f5afe0fb2ff85e1f98451cc852ca60048ea47f5d4010447dfa755d0993ac3ced7c8ce3276e3fcdf404360475bc7a64dcacc295201d3c5d9d950821f4bce45c07ddb896e4367576626b9cef587db079eeb444197568b81baba326173b69857bf3b72fc89facc1f8b10adc860a862b97ffbdcdb62973fad470256eb3e9f9c10dfa05902a52f7ad14288c2b1e478d4ec2e95196da9c526b3a619500a5b062259d503657984b93b29917e7a9619c19a4e8b77985efe3a1662bb6e113eb2d4429376c10907ba15280c6df58e40e9a159c52c85ec175368f7f89a1d63306c405f319df833c7bae421a736e2ac5b21a485bcce616f1f5dcbf3c2faedffaf56123407127a18565d7790638d86e749e31e354d24db86d983e76d91c74d6d9fdec3e6b6ed807d1a1b6056f7cfa1f0faf1b473a51a4e75b79d9850c35435b735c2271c80fb8c12d8389d8b0380c6b0f999078c21bfbdfcd26f6808abd0f1cde3de36257a4570fe4c4ba63ec4a9b0a9a45c720cdacf6670cd7264e38ee0a991f2fa29ae5b1b7e871714ea0b6692ff83627fb07896bcadeb41988690e9ac83113fd961b60bd59cbe0672fbeadb9569e23711c73a0a02f18b3353941b0ad66330fa07ae95f6eb3ea085ebd85a6757c0c660e8bcc52355ecadc1e56a017dc26fd784e603596a2d9e3f703c755345300210b02d5453150b79e61c5be0ada3492dd4f014182cd1375e25b797319731239ce870e0e10eb589a92c097fcc9146c9732262c4a5dce94ff5d58225c62a3b1748a9ec170e0f5363c51524b552abf3a8fcc40aec774993848b6a90823d8be2c3f275afdf8cc1433de2b4298919980d25d693419b9d7b81311aac0c956eedea9565538a690adc25c33fc8e4104caa76a451067a3d9745dba28824a3446661c2cf3419e95ec1cffc25e7a7d918e8afe53ff371a2be4df64904982759850fee0700564206b7a46954f719de455cfe8d9585d7db65fdba2ef94575fe052e2fa3a62b843b91a27a6805e2b80a032d2b759179aeac050084dd94d3aeef42e1504b43f69521bbfdbaff780f46fbe9355329095e900c7bc64fae281860f36ad5971a4f11b3c3eeb1be56a858dfad23f1ad94429f34cb9b453374857692b0e62e97d90f4c47c40c042e6b096f2c1d28eb2dcec4587a79062c663f9d5ba78cd018d6f9e2d65547f5af72240804f39ac86c760086d0b3a1dbb21383d3cd563911a1197d25840d10766fd0daa05cb7e43fe40300a537f2f5325e4fb1c9b63049e45477447a28954c082ea13c601a284fc24b9529b5f88669dc007b42bb8838bfd076a3fc30abe0ed0aba3a7fb5f6f17a96b18dabbf08ce3a204ced1eaec5e56629eb8bc327563f7c37d80a84ee5fb633607a11ae944fbd7725bb50c5838479cf2eed388208810d012bc5791b9a32cee087d97239e7d707c50b2da3c6d514bd4d7ed5103ece6340d71e330059b129a39446fee091e0b242bdcb9d57a531e6f95588fc4c14ec036595b4580a66da622454964020059b7f23ccaa1f5d889897ae9c49ae4e730ec6793aa66a7f8b4b1731b3e8c0b67a4300ab455c0ddc536b662abb31f9f3b72413b92482ccc0c91d8ce95fa8ee326046a8a67fe51c4cba2aa6323a19f61e4e17ede1ef1c405d93158edb650f36f06aed66eca0387f7844b0eb84b8d20fc787eda87e364958d1be809e3c6248fa0ea112073f32889835cba0c0a2fe0ff59f7841246c58932b1912d1de9ec98676960267786cb9a9cf1dd63776846977c6dbd47dc859a6c5f77b4ceb7b2c52e8179d1dc20bf2afcf69bbb210225a186587b7894a3e291e8caf8708bdfee3029a6d52b5b4964ea6c4c851f99f2717b8c276a286cd64ede46045f55d97f9f10c82a471ed9e9abf6a9639359f4a79416745f69b640c3090dfca650ed597ef8387d19cc747c19ec2e4f0e608a793bc0a9c998fdb059c06d49a070a5474ac3b035eacef9e465668ef5479c641463fb03ddf7e40b731ac8e6cb2740387462946b35b2537b4d2968266e80b728ffafebd1bab8dd630d34132bee25faaa38049a4864d1558105e58a14a59e85cecb58bd6d75e03626734352f27b5925972d62868b4d2e202f634b044199eb6e2ece2c91228731dfdbb102b0cb464d84afb7df05fb656a51cf081dcf43225b7314a36c5242b0cc99c03cdb9b2e90d59f9d971b9119cf0c9f33376821868595b69ce25dea3550cfe26307a0bf402768ecf4d4059556a8822d41546d67aec13afb10b88d211c91ff9bb368a6e9babdb201f44cfd20959c940c830734b14059bfd7e2be3ea553d025ce1db85bb1265e117f14fb9c14750519b7a11bbb7eeb490275ebf966ba5909c4ae8f48a49bbfe93bc742d1ba86414d42f9e5652b0c05b06d1c19c1fddc7e2fd0963bab3990fbd0d428b0dcb022070f46c445073e3fc880ae02bfe0ee6645fb847090f347211d5dd16a9160a327526803c45d2addceb9f0cc1df039d7c5", @nested={0x3cc, 0x74, [@generic="5f271948727ba1e58987717acfce4409fac69751888567c94ee3a4b3a7b8e88ffcac5018673f6d83d25c4f8e561a58fc58a325c1face6597b749aee710b84747ca0046d6cdb83842", @generic="8adbc35ac9584c6ddbee25efeb8930f2021a20b2b0df6f40e64b12786c90886614b6b44ebc16", @generic="1cf50f8418ab16432824b8476e9d2dd57c77fafa7801c09c93aa979fadee0e8f022c84e00df2095c324d62cac57905cb21340ccd68315092694dce2136784f9cb5acabb02628351a0156be097240f614fb499c0bb7c526be4bdf35b22a1871ccd0a744749fc7ab8868f1544a0aa49f9b30c97d54f55ad51664fa367ff55ba7044a4d0e3877f3c399e131059153ce43fb5c8069dc2e790898a3ea86f0f74bf8d40050deaf1a9db35fa0ca797c0d950efc22dd066caed9f849512c86b4e7ba1ac5f99d", @generic="244ecae77cb1865edf2e73ef1bfec9e3bc8a48d27ee616735b22ce08ad93e9453a4a6dd85f7311a85d47d2453ff5f8085874155d8e34551d31b2f0b3e4d3b4482bb6f7e95652e5d7a868f2cebc2946ec39329cd8dec09aa458d27ea45fda029b3842e7047f9f6ca44244b711306ed84d75a0ca962d5e1a58e69597cabde8747452eb0d456b421a1e570eec31c230b3e4d7688fdad8397c481893c63aca66556769eb84d0cbf3314e3e8d76e588495f2f1db3f58adedd4eb0c5fda860de59c5f99019bf522c3d", @generic="9df4464332746384f87307fd4ac78f2f4c73cbf3bb1516be75d86dcb9a63a01953081bc496e6ee5966340ea28a5a6b73db0a80936dfab4d0f6561bbcbee6580e0c83c8bdfa91be94de3f96056deb5e238a5b607f1f0fab0ddebda6c3c6453d8da49549a9931d71b6b51a3c1d686dd840aed058ad0844dcac0b1ccd", @generic="026d4a1a302068a51197ba0d114252ab89fd6962c03454e0909a20435420258a9beb2f9f36dda16480c1c21dab5e49f7b8", @generic="dc011bf7094077bbeb49de3d8a98cce1a9422a78fcda66a2c293275869411a2ae24046485efb1a91b39220a71975ed103d35c4", @typed={0xc, 0x29, @u32=0x7509}, @generic="43eda8a2c7b6901edd6dabc2f64a23830d204d7481891853a1f2f3589d989ffacac507bd07854448bc67ff73da3d7dc0b7a37dc47b11e624b05f3835ad9ae1ce2563ed94fe0a0f0bd4fde8635489e75a50523bb442ff1357d0d7f57284812ebf719c96c0baa11ee6dbca5c4e89b4a581a72cb3be913662a5e62858adbb241655e4b59a7603e73cd1ae5e19b71dd4f65d4953fa05eb1c3343b796012fca6061a28ac3c9b08ab870597dbffe379d1ae3f3c13a3799e6beb9374dc9c7e69fcb2f9a7d1e70f25500e56372d2f923507d55d5491f9efb6f3d897fc57cf672a4b3d250f81479ff01"]}, @nested={0xd4, 0x96, [@typed={0xc, 0x69, @fd=r2}, @typed={0x8, 0x91}, @generic="0801885d4d5adcc5e12014e25868ee4f3b6ccb8f764915d1a6d83005277ad3034250d59a4c7e1223bd67ddc5c14d8babd4cc030988ccadf9bf6852618f6cac03b19e5afbb370ea2ec3e2f36d4939878d5a752fdff45a9a034b59f77df535bdbb6326ef0615e9da97df720cfe8c134c429054d8e53e7d6a7c0e4706215824f86e0f05eadef2bc641c58cd87132b1219073a5214f89ffc01b228bfc4a89ff8a7f7af", @typed={0x18, 0x71, @ipv6=@dev={0xfe, 0x80, [], 0x0, 0x17}}]}]}, 0x1524}, {&(0x7f0000905000)={0x108, 0x41, 0x21c, 0x1, 0x3, "", [@typed={0xc, 0x96, @uid=r3}, @typed={0x10, 0x6b, @u64=0xfff}, @typed={0x10, 0xe, @u64=0x2}, @typed={0xc, 0x3b, @u32=0x7}, @typed={0x10, 0x2b, @u64}, @generic="e5ba588a5b1a04d44a96db0df3aa5bc5c3aa8ab4d703148fe244f0b6f54cf42ad1982b36155111a0cc46d35955a57854ea1a90dd96f0ba2c17f1565ad401dbff4732954c8e5be9f19677bffbc5796aab344fd151da0bb9af8abe44b6ca070b65be09eedda3b1bbe1e8ef7e88e5030e0ffaeac6ba4d7fac576e6e7b6555bb7c52274f6fd4f725ac41f26810943eb769c9f2fbef9b34eb595deafd7fb6694711aa89303a2b3a8da15db4abc92052"]}, 0x108}, {&(0x7f00006f1000)={0x20, 0x2c, 0x720, 0x4, 0x0, "", [@nested={0x10, 0x51, [@typed={0xc, 0x5f, @u32=0x3a}]}]}, 0x20}, {&(0x7f0000170000)={0x3690, 0x40, 0x8, 0x2, 0x0, "", [@typed={0x100, 0x1, @binary="ec4fcf23d403749378e290cdcb7d2f7516a977e1cea164118f9c966b3e064f3ab8ab47b9551aa2eb361bae9eed42bf8a0430583eb0583c78cc1e04a3dd5a7561562ed6a244f656bfb6059d847fe0a69541cd6b75914867f2678cee19114ac23d154f04f8b261f50f42e87f71d849f08a970a14ed8ab6e89c0b041c70549c8239835d09c36ad4f57e2f731aa1a8f509bfcaeb5c4681e97220501d29362825ccf764a770dedcd6867aa7f857eafd4ac246bd1ff7e9079ab6398193c2b6d9a3373057466e222c3b9bf4f8bb47d5dad3eab16880355c98fec1796221950863a9425684d05fce3f9d5084c5b7050a3a4c1fa6bf5670db6d4ab8da"}, @generic="68bc2d1b65236d215f447785dab0cfb4626e355e5f98550827dd7531969c824152b15ec9ee781314acd6ecdd50295d3f6a57529c4d0368dcd3e3c42b1fa358f56559568a86182633ef30913344c3c263b292374c54f4f0831499e1fc949cb180229e7bf64e3befb325ce1ba382f73bd785f4", @nested={0x108, 0x91, [@generic="23d1cbc3628e3f3c7ec1dcad18c1cc39aeabd06344aef228b2d8472453486ae6385b8a0cf802ca0b9bc9338edcce78ce0941b4a1f524ea466210dbbfb02eb191345783162fb414c95223dd00d7e43d68f5627bb23561893b3f674058e9e7881aa15029b5513f28a62ebaa784cb6df5e726a314fd19f8e7fac04ec25abedbd23cdd23a1028af1b666b76ae0a1159884467ccd491d32dd7f77f553dcf7dee0a2b80e5a976e46e54bca9c55f206362e188f8204ee439d58bac5393381d95f8a084fda5c0ed6017d9ecb338bd244acd7fb233c26a96b9a3230c5a2a62d99f9f46c329c8c0e7ea9a02f38a3c41358180d7575772d7e4b9fcdf10d", @typed={0xc, 0x88, @uid=r4}]}, @generic="adbeb90f4856887a8c1ba90721ebd5e00aec9e980bd8063fc4d643c1df5af85bc5ecb761ff9566088e21a63df37ab3c95b601f3eacd4671168b7bf80496c11d3d04fb79a0c98482aab2dde65b88dbbf2d2aa5afef3928a00296e3e8d46044fda3d23e6f04ca1302d9f3145567a34350e9f4c4d387485ae53e73bccd106d93e8322c16a0ed7bd6376093279d49b73553071413197b34ad1b18b05f8a77ab0170c52ecdfaf3f959802c177af0ece07df67492220235e22a367408e65b26bb9af8f6599b5985332c30571117fcf1d0151ef7db30700c78eacebf1ce4aa411f8b97f2fa968bc6a200c5ea66fa48356905ef8fe6828915c5ff5b4782cf444f5c80937c90f91a8316aa1c6301e3999fd5bbc65e2e40a0d0438da9d146e183ea4d26bf77f86e2ecd3fa8c2c0ee07ac6b91a327d4fe32a25fbdaa8168af45a9e61c445772beaa05cbd6db0142a2a84f92ef53d75177e41df4de5df6d7ef498c49d1318c7ead475659abcc519dcf7e60d9688b8f1cf610e2c525d7cf0decee2d78ad2b74b3d5361168a9863af2bcb7934c76855f1b8844aa54d3efebc5ff0ba9475ec9d0a81b06ad7c56df2557df8fbdfcd1ec515254ad4d96f8d58f2c09d49ebecf1a8e2f13ad986dbc802447cd813ab2e3803cdc242192c8da70fbae352b337dd7798bf3663fed29d1d80b3211fe6d92716e6fc1c88642df59ea2e5bd3177f45eb39e34f97b06f3c4e8323a614f2818811c7174d1fc3f564ad7973bc0258b6b368a693a0f831442b1c84c32b522e38db6d150b7974c77efe485cb0ef4400dade547c1470a923b213edc6f10dfaf47cab13334fd7e4d03e4ca956d3d1a7f631d51e145eb33d08e8936d55f6c8828fcb9b073f422b3886c803ea1fc8af020b8c6688ee37ddd87c30ec2b9650a11840cd5513e9b13ac5c920debf1a9cc67eb4cc3a0d83c2540701e573e9669a9e93e55722231de6fb5dcaf5d694f6d1bc4bc8541e41df802390b3a217ba0bbf72405f3c42021ff472e3e724e0c8a1cea8048aa19846dbc268e2c50f0eaf01d18ed5d274fab32a8090167fab21c6ece0bb81ac7608a3f2238e9fc37a4c38ea0645d6d4045fb3d1ae7571a9f6416674f72c8c60193d230acd60e879493880edc094c3ff4a86c887ae7ee1783dcd15eb43d0000c6f5866f5180600009e210f0e4727d99c4643d433fc0b0322398813391e73dd4f33c92bb6afe0c0ff5344f6b5c9e5c531861780e4727d03dde92c2107273daa066a08b1b6a73a89675407bcbce0a6a6be672e09a0c326107acbee96acff0ff6c226d9a96b6c6fd4cb9507b9b06d3f6ebe47ab8de4e54a3824f6b3c1d03e79d8102f3863af9c9442a41491a2f694a13aac91bc99d0fc86447388d7ef79099c606dc7e96d86d3d9a9055fde6703a47b5fa7c7182da5e74aad8d29d2fe8ac7c09a7f19c3b493d29ba6c3ec01f0ec44c03b3f9957f4f544783bdd6a7311b816101a6592c37a41f0c2231a07b2d19accb4bdc7130ccd5fd6e1927b4213b98c9c05c0077d1200548b04aede920f95211d55de7d9ed0b6c6c6e08c52eff80b3d6a2a4f58e2217dc78393cb726e780b36df23665ed7458042f3cfa4c65400ce7a61cc3e7be4fece24856aae4808f5a0f432895be2e1c72dcd202c0208659c647dac24b7818cbb9a2e116c59c29ea9b587aaf9f4636d4a0ce933413013083e5e9d920535a08365cfdc98124310c85419b8a8c10993ab2667b5cac52b1ab80eb16b9596acc7031aaad1bec4f2755fa46e401a11dd2dc2dbd31eb199a2d9e41ee8f3ca13201bd1d4abfff9fe5c9301034999196ba5f1a13ce1ab9f30569caa8108d2a880889f5deb378528d53bede5147ec12a566f56b794e37ec4e4b957fad054a032c14f5f6f69d88fc8b9b6a179e1158b1b61d834f2304c80f4917459f058fc85dc9ef2548642d2ea5556b4069f18d20183310e43b8a6031c4d053db1c3c4fd02636b838f9bfa505db3dc38ee0ee4ee8f0f25cb78f2bd767ca376d2ec051ed0e4c43285cb4b48cc35d3302ca02974aaab9575c0fdc560ff8629248e935aa1d2c3fb8839382c98f0acca043093680ee418735746cbc8144a32499bf03c3ce95b40f642c763ac6ced1ee0543c7f1274cb92023c4513e51cbb6df7cf4fce63e6515d4000e3f3f76c373f8e966537d19ddf463338c177c75fb9813a22234346c2e37802f17bd52a04ec7e3fd1e47b3e4d879d73d33d1a5be7cc240b6d58b4b5d49d886d9ab43730151bb7487dea092651d3f91b927916779d0fcfda6646d084786bed5ba5e0f208b6c42f2c9b65605bf145314617de9bac7b48276281341e89b0c0e821ada6911722e7f3ee601f4564955fb9c71122a68c695a373f46577af1b8618a94df3d489b0311f181424564fbaa3ffe4aa2b024abf21f93265f930c9824b204d5d4deb32f43387329e496fd1b65d8b1e761e7108dbcdbf47c7eca9494267945e4a1d33bba8648dfacf7d3f931eded8dca5235b93aca2a1d3af25ca21b76e267c6c9cdd1df7f4adcda5191de68297dfc474474413df4457a80cea97d66202b615b68d954dd973c51a38d42eba7608b8c390c85270b91baa7435afcac89efa91d24209a4034f6b97af90de2b8591414a7aa3ab877031333dd50eb47de281f55ae1c4bbe4aeb138d09ce26f947e3ce01854901a7823eea52635f73380ff154c3fdc1deb72c86e3f0710c9e7f29330881fb3e80f45e35fa91bce897c80a25c945828b0670821064e912f0e5f7d16c17438cfc6d043f78e7840692f59c35cde8201c8d4cf736777edc74f9da6632157a364545e4288759226f757867a65ab208683c1d7af1831aee1a8fd0b55cd97982b5787ba02ad5e93102ec468fe3e91802d2a1c0501d70f2070ffd5d67927626b62287ed87b78342df0563f158e4fc804aed6984808ca0da3ea11f7eb152017c4a389ec89224917927d985ed93b98fd502a181df00702183f8a0ab0b8fda0f114581bb5979448f6ce064b13a48cc56aeaa7164b88e3eafe34a42b263b613196bf76598d6edb375aaa4a4c73be17a401ac7461486c4e6c1971b58923533fe664d78f247d10ef9031443080bde555324fdc080ef85f2b8347351a1ea2ad290ee6bf9c25125041ce81f2024b38937c67c49d804af32dd6f0ce64d06a0a20865f837132976346be8a3a1bf963f062de8efe2e65257e2ec753faa41264de597ad1af011c23f5d40118dec651549c628305e81eb0d4a47a8e8c5d90b22843e8bf4df8358011d547084b963119a265cf0642aaad8cb085cbc3ae6c67b522f588846005258fcd4cb6ba11a6da6231d8e4955e627e5901d409bcdef27b1f7867dc19ceb6db2907bd404b9bafbbe05eb9d5821e58603ad4875174b23fea7bd3f12dc2734701ca6c8b93ccf7ca438b4c3711d2389399758b0f1b032911ce6f648447ecd11a0a6537f211bebe26351c2abed31d07855f68626787b5f2e09ddce0109c10dac4902782b1a3e79cb47a72ef2c562a0b90db1a7deacd34f080bac29e2ea828faa4a4b6d4da0da6f9de748a06623da08675cfb10fb44eb987f87a23092dd75472bf874d190e8e74abb2a4bfe1ed5ad91c2e435a45d35cdc221e2c588062fcdf99c65d567f9b75be861bd5d11c589cac1c2c7b3749e6a4bb70c384f868400c32289a4e11e00ec7533941935f0ca970ed30818ca951a5fbceebbf87825f3d2eb12cf68ed6e1bcd7b61b7102a9e3e0661baa4fe306450dbf175bbb20bbb63432fde48abb88b9ad03caa8df2f41bbe9807c8a77f6d763b5935dda9ab45483384c32e9fd3723621532651abb8e66ce3ec0dfe92145228227f913d7fdb03fcce2bc730f1cde7b1ef9fbcfabc1e6e9ef849c617ac56ba7730b958de5d059a6992a8e88c1cb0634a7ebc5048f9bca06355c454c2aa71806fe41297ac06a94fdae59a124055d04f32e20a3dfeacb29fae0ef820aa44ec79545793a12bce0cdc2618e1769c0dcca696c95152a5e1420789014df64a33646a749ad71658ceaeb40db3cdefc2f8e5f129a8fa52ef68cbce8e8cb1e9b3156ff74900fd61b4edd54f73d6624419d319daf9f25a613acb110db1fc1c0339a4ba6627b5c4b6413ab242bedcc9fb313e0cff5db8d160aae8cd4c220853b75a892166b0e8471b23710945236446ee081af07c324196fa503b4fce62d68cdab95675639f76bd1115796da06ceaa578e96c54a4cdfc27395c392de0ff9a164dacc6f57b303706ead0e963cbada1c460fa87b90d73206d88c57285ca5deabfdc71c5a419244c2efef165d0b2f8a7d491667340c50f80fffe8a0f586bebc8177a9aa64c6675bb5d596bf88a7090b7cff5dce34754a47e860d6c73653bdefb8b922f99bf6485339ca06ab19d7bfa7383dd90848ec1b8257546a440175f2a219dc6471ff3f6fc7e9482c2670afc615bf20915ab8a319831f8481cdf39c35e4973f416fe08be383fb02c932d909913e1ba159faf8a226fdf01ad17fe97d40838979bbe08e1718dc7f4986ce33843d022db7640ff7a4f77ad5d8aaf3ca6fa1fba6319f610e5959681fe75a648a375c235c1afaa1233d37f6cf22ed825a40bee734c502de7acb90599fdace50e34d94442c9f496487f81060063a178c3ed7f8a45a98d0879e53f38dc663b2260c7de0de2adde6c4537da3a777280aaaa5c4d96e4a5c3338ac568f78f123d6e5513553a078f587c688e0e56056858057a671978da7de7a233adbe956dc7646a720ddede87e407aee00d09e34193e5aa1751f0d1cec856780214eeb5cabd114d4d8ff234c443de2c276f36e8f6bc933f74f6b8fb598c9c4df224ee993bd3140629bb6fec3fb01001d3a49f879992661de53529aa51d804490419fecd46e55a7bc6b29587c6186a84a3fa1b2a881ae3f128b1b6d0821c8e8bb0f6c340750f0278847c1ad071fe8ced0ffbef87e0f33940c7466571ee490b5454886b99341333599a6852d8b87e8d9e3ae6fa71e6faa885a25a66e197fa247db7bf20695d2b9712720910d3c123a1a808f62770dfc6b676723f3ab48abd5724e1a8d750e798880a085ac9284c6d9f3f883f93651eb86e669c4602ff40553c1f71d3be355ce04941694614cb4d4b786f6b3120eef2e68ce6f03c6bb99e5455cd42f921561230854b7aca5aa8a6503ec9b8d7146fa5c9371095b96bca5c3ede84789dd4e23640188bb9f59760cb5f598f9556c96d1f394f877b658a5b67d1efa9c14829c31439fd17ab612f9d2e2f7898d7d5d214328d999a8315dcc7159c6f8a789ae689cf1add4b0c151312c29b323a15f29ef538bd2be1a257ca545476058af5ce242f481d9656e1605a472bf3e8bade76f83a9ae13b31f16e609b70442c868fbc74c2667f678bbdf62a99bd1e4b13e80726cdc6d7dac3b97c28db46eb19b29dae8cb96f556cff19e7f170863a677968c52834430660bdae04493c74ac8b86dc41353d52cb9d7cab658a45b944eb848ef2e9cea8fe591d3ee8c05a64da43e2549a79fd452e08fdaede4a4e676cc09b051d2398d892db2f97c8613f5e7983b99f21ce9381d3379c23fae37349a4bb471276e3ea5a9e5582f2d37e61eeb3018d2d53ec273483a3b1954a34024f7f70cfa6cb3b7b56f9e40479ac32ee6574978aadb68bacd143dae72a755a910af3b896f9bf73dd36525a5241c5107c9f6ed9345ef48bcad85cc3559d02340a146477e92f8545cdb1ae2b8b8c0b0abc2f303cecc4cd343f2ff55cf1e486e636b3dac8c0809ad6fcdd5a70803d74c6bcb64b99fc1abb479bdcd9405f4fc44c9ad9c3d", @generic="d366dbca89624458f59dfb9818ebbf1c45e6c47866ffb1600ecf1aaf23ac66dd6b32c37fb514fc70257224fddb2a333bf6c36fa3000db264fbc817e16825cd87c0b49b3fb947b2ce982c50bbe91a243ec7e1b31509ce38a50e0ad9cfda91bf93296ed5bf049c3d226ea33c885c42d1ad0bc30da93dfcec9079ecbbd57126cce4e32ef0dc16aa3fe0103c266a54cc3b8d8214dabec456edec444d94e944e5051c2263166085470a0963fb6dfe9782124de91ba2d4eee1457d935ebdbf8ee6e9b1851ab0417d44ebb276dabdbf40e393159586a07aec5c6ecbba828dba7c914c2a6e176ccc99fd017c", @nested={0xc0, 0x25, [@typed={0xc, 0x6c, @uid=r5}, @generic="100ef5ecdf7d2ac7e7b430f7794afd685d3923c5d32ea0ee94d82c85159869c5d35d788ca72d29929ab9f870f35f19c04309af1aaaa6a8d231ec503ca474f1b037c97d92ffb65257a9f20fabe632e5a08ff6337fa677c10b111920e4af7c39d555a2874755d3e6ff9a8e97ce5296c7ca388b40a4320049f652f23b10ea799620395f14976f7483b880", @typed={0xc, 0x94, @u32=0x9}, @typed={0x10, 0x3c, @u64=0x100}, @typed={0x8, 0x70}]}, @nested={0x2254, 0x1b, [@generic="64b149edd861bc2774f862ea7c97988ff39ad2b5cc3b5046cd4af53ebb34f732f9a1dad732266cb5e43b2ba97a0ba55725258ff9bba5f00df544af8620ce731b5cd2708211cc4a47a6478dd2c5e67f4eb143cf578c88e533da05e2ca6de9b829f5c05b6107f012a77293edeaa74bce84fcd40380ea8195559cf66741c1fb4840cbe525fda871c55f2065a0c6f24439e83d9f4d744c187ad21d2e2133555303dcd0e039a8e2f29ceb5e86847818d245bd4b5384794eed24c105a97e4fa2943f7709ecc813b673df28c4b9995300ed74e642ad01a285e21e30281ff83a191ebf2f50d5b29d0c9843e5ee7a25a7d7a864e07ed9090fbee5710190db1a85e5186bf55c7d20f2fb84b6b543983701841aae88691f87bb13a545a05665d47994bb77a8cb1904268107c9d25ba708ba94a8203c7f8d8a1fbd38438f18fa9cb1f0841509529323277ccdf2d92997199e67654c067a1992ff69fa7ed06156880b16b198f6296f03103a1f9e7aba7a80cf27dcb473ab827ad7f2541b81bede5f87e7a9c7e364b90639d50038069ffd7111988b5051ba6063ac57a75b606725f62c751db5dc724ead42612b96a49a04e3522bce9e01452d195d6db5213cdaf35eb0fe2e6baf831eb1fd05f61b4e539f6277c096f359384cf5772e611988fbf5a5ea90a461669679777f3484987187d21107e60050a4d0e0cbe51db31004f00093468c86259db6d37c915614b857002b6ab15438ae32bf940961972d84ffab968b72126e9344a8a37f9b528319c958d637406a2bdffc9f7f0b782c9f1590e2f9b07978661c2176b4bab0fd955a49ea994476f9763d55a2e94bd630264d7e67ee1f46bc75e2b1b7c3076a602522f3c9c44105a3af408b91fb24cf4c8b666bc5b0b83b031e0eae14865aadfe5e09ffbcea87da928d01ed09f3b2c1dfc50e2d4b4f8391e00ca7ac242ae27479a2ee02a8f5f7bb12f56b671f42a539ca465f70aa7ccf503be4f793c1a08e214e805d93d0c8dd06fbcdb26784869f9b7e9a4bb744bae0247208d7bf3e5e499de8f4c039ed9bbb972ec98d9f05e3eec397ae57b59fa906665beadc21840a88aed7b99e6e8b7579ac19d14470f13a4cca7f7bd5bd017f7a0c4694b0b71e87a8bfd4775649b945ea8b608754d6f2aa45047d70b342e85011505e295b2fd1511c18116f84040b08a18722dc479bfa80c379966f97eb24051f298e656c9ad3c2db475ae6dc91169fefa4606bfd4bd03f7e1b0fa6c678599e3dd6c11a570ca49622a6d6155dc112cd6a4ce4245a8e3c9fa617e541ee22fa599c775ea79654802c1b2f8fd19e38c564edeaf72d1221c6b6294c6ff772505930010e6daaeb95d62352e05968c019ea2a4bf62df057a3163b78807569011b712f4fc5b0c3b116218bbf749cb6a1ebb5b6cc79afc35a9120a20ba1454455285fe4c731b5e4a500edb2254fee2e53f1ba82fb3134f9eb214e9e67f663f8f67861e92678da8481c78fa23852c19ac9285d63f73ba339ede80414ffd720eeff513e5e307a30c2eeeb4f6a29798915e23b14fa58f751afce2c109d3639cb217475059e4f2e0e477afd6e76111a8d4ec798168eb674623d972b2fdd247274dfe68828a2120212f4b0a6ee50dad09e296f1e4f90dea802a017f78bb00e4e45eca640bbc347e2b30045d142f750a3ad408ad8bc3ed095ee9cfd383dcc024b55dc4f0626e5aba960dadecae4cd218a7291eb3c149b36a4bdad367d90fbf29f6bc0d485c9a3664e143b9f6c2970e876df7f68be06f909e252b1b0ba0ad44c9e39abe4ec3a3948ad8557707ebc031684443447fd1e579fd926214bc54293ecf0954e9ffe6d89d337162c8cacc2ddbfb576c18bc6413eef21458deb054d2f3eb6ec0c520ee33d8869447af92c474eb2e8cce128ececfaf65e44bd61f3ce3e2dc128e0ca82e41b60b4e12dd05336984b0ef26990ffea7e4b68ff53b86b38bb419095620bc818919bfc0812f5b6b3d79df8e9cb289fce122d728967caa25134545741526b586f60e13dd25ed0e848a7c820bdc9f0b1495c4b6abffa9b3f510570e613452bafdddc685ffb5b36d1fb18135d32326e66a516890c155e26ae0963e83130380a44da5271f7bf15b9db13b2a1c9b5c981e65333ef4a726fc9db0bcf88ceb8cda16318a271688ae90530e62603dc70d8e3aa5127243fda97783634e64f867cb685a02d1f650c8412b622e89473465956678928b97f00276dcfa3e73a5e351f78ddfdf69004a0e5f6a40c900da3da6d8df707c5b0b6372c9e0c19ce52eff72c210987d0b42bab43eabd4fa6f48d1cf07cd18505df4d95adcc4f1ef19e8faf06e9e2f1e810f626ec801a480e700d022a5f8b682c0fcc3f36f6fbfacab2afbee7e81c67fefe8d5e3577521a0d7aaede6d248d8052c75832eca08ae0867ee19341313ef550988a5ab23af70ab66320fd34dade423e9450cb9d928665af208b883c18ba9609b8189c01c50515fee334875aa05659d4b9fa7497d60c448b2201e7b55b0a3daa9b16a24bb8400cd25b73360f42a65da2e8385f05882242fde97158b9c0de0990fcd1841ab8625d045670c11867f39a3c63c422babb90471edb33df062ddb302c8e08943cc6daf914d0b13db58836e3f60072565195b1aee0ddacdd85527a32410d5d3b8f9c1cc81ce5d6342c741e28de708d52cd8eb0ffe293e4236b8f7a3f0ed91663c13a7911fcb154067092af2330d8323cb3d88668774c26fa0f7c6e6ea6b47911ba302242487c9b7b9f0fd50961f45dd21b966b21583b3cd6be38a7719bb37b3a60bdf3c178d28cd4fdd23029749b008aad6ba62fc6f8f3b56040a2f6d3da9159dd92493a3d4c18745365b789a8362ba104cb685649533b76d9c6f8c6bab6f6ccd267bf54ec5342beb0a60d539af605d69ce7f892124341877b3bf283390b4733ba3b591e5b1047a38b2727841f1a09e7e340676bc1ed87a1f922accdecad5b83377396a3fabfa4e8a988142f641cd97b0306a2e5c99d9f690b56eb4f856768fc4057c697d4e4b91db568fccb5a654d37d307d351ae6c6b52eab1144c47447d126583b1999456d93e7ad219a3f98dd93dd191dd614c5ae6747e4d8fa5b43478173357e516751b2694880784331f5deca6afc64af0943874c89ca996a6bd8da0a0bcd9e61215e6582c5390bdac51e8482907afdbe560078193bde0c319396bc2ed0bc7b3b49fd4fa1e15eba9cf06a019c84fd88d13edec0a005d6fccb5873694601957e675d1f731a99b67464b8d13e8e36d5d4745d3cde784f0ef9c5eeb2550b71094f1aef5324176615a7d30188ad6e4c641a1083ee69883bc45bd303c38b70aace855664ff574e241507c8186e722f25943b821c5fba65a44b3c5bfca7bbf2433441275403dd3aeacb1b48e37bec76d84629ac381463d72dd93728dc82cea67ef3565d7a71f2d83badd4b50b00b6637cdf6cacf74c835e06b5503453201221604ab8af232fe989bfcb53186a6268bcaace406c6f422f8ace60239c5417c997b42cc8f66d56a6ca03cbad175174be06d2f6cd9c8a5fa0ac3bbcdd0cb86674b0a6480c1d896b50ef2266c03f4f26ca775c692302b00c6ce0a9b845a4f837fb1d4f8721ad5908867aa0f33792daae508b0f784783fb00dcef0e142d9e1fe094e49a0601fc01760a1e456211810f9ecb0fd22b6c3b7a6e8e8a1b60450510ba9e4b4770f7cde55575bece974ce666768dabbd6143e9fb98b6c4ea83a1637377db3f45a1898a47508ba570051065fb5cf515c0b2bd624b882c44fe99e35ee997ff182a9de81f5d3c8eac89a051892a7d213cda856a126c52fc027a666ab37fe0b8e9eab6399c48f19b1de68808568620b7d251ca690538fd168a3f2e804b6ed0e23cb21727cdbaaad3fad15e2ce932b8eb36c83161d3ed241bd5751500619ba955d46f0e0056e1e7f388495d471ca595fa51d9b42e10e327d298c40b612b7296a84dbcdaca8a546275a56111fb779ad6f25619b4263af0e04500454a6d936bb4a86c48add978d26083a22819fef2aca473355f87c457fc899f35ec41a3b527bbcdabbc5d66b638ba107fe8c60d357f12471338c052369cb6057b95cb529569dfcc8f312bc890f97eb3507b6ee86a44b20602052a15e6b725c8caa469daff284058762f0fcdacb57f9f925a967cf4d797064b8c44ae7bfdc6c4ca60e583555ca5edcbfb6fdbcf11c3a11017823e7321f20fde8e163855fbf3573f5922e3f4fe3212fb06a2f1cd19062801455a7763c75b47ca72ebb36fe21e7201d41876f96c015f6a3a2e8edc55d00c578359ca1b62520cc2b3cbbaf7a36545fa4da991aa3cb7b76a9c82634140cca192542713cb8deb43530bfd3729dc83fd440594be5f8f546ea682d2aa938197aa48cbf261bf0819bb8b53164a63c8830cbf6f0516b7591155297d6b954dc35d68c19cbc80e2dbf2331a14ef5026c295aaba282e7af56d7a3f96aa6a7dab4f2330a66ecd5e3d43ba5adc0788afc3a1d65db16498fd085ae99690181716276cb1341e2cc5fada9df3402aa18b4b481b43f9bb02afab8daf75d24dcc740293c173858361addbe9dbda419b2d4f49d767d8889ba3c8e5b1fb0d21557017908fb677a8d7447998ef41f347d3adc4053d55455b26ab38b950fbb67362686afb109c70cafba2259191768d3e39efa440eb3f41d286bdee1d4a0c1b4bf788fd5803e93e733c8255f017dae49a192505979c3e5746e0b0d46282ac7018056a33cae1d4a07ede92327df1187a9b36d7e4a687c7ad7d2f6ddc63fd585dfe1a99637d2c5bcc1b561cb611bc4d53733edd9b8c786595e63ccd0de80379843feff4df79b489384b1bdc23a605dc6fd0494ad0956e9b843375f0cc50c9e1fc16a379d0f18224357875cb638b99acce2ee617dc7f12a10bf7205fc07b22966baf0c88184174022bb3d2710fd51aaff6991b0e1ebaaf49c6ef1b4eb44335c9986982c6f5d043462b28f3fa9c233a63f11f368f95fe57a58f324d411f78c12f9a6976e37b60caace4d7b5cd183d80e7f1f1ffa706d6e8e7513b2bd1257aee4754592999cb7352bed061fa08fc613f3c1bf9ca0dc14343f7407ddc5f664afe49eddf90bc26d2b0a266689c3b383829ddf44a9ae12d93ad0046a252e7093be9f277d4d56566c0fc67c3f4f07937f7d65f6520b1d6446b109191c6590fbe604e7404be1fc130dccd4517384a53d0c975eeccd73bed2bf94638867c50a08a73356a3b06531bf564270645dd0f68528b68d3ad7779b9b444ca1530f4e78ae21ad4bb01e79c51bd2a327019cd93ecd0b35714d975b3ebd83f0419bce5ebf0fc054294ef9d33758bc9f9c27a7d5dd8acf186f01464610b76b98219a3dc9d9cf7947e240a91275da5cd6b08e99d6f133bfa16b47fc50b022ec37c0ea6afda5568a5ed06ba3fbe63b9aaa86c6ce4acd9ad1f46c888ff8668e392db3b376c05b2feae5c3c6d7179d1ae4109cb9027c255f8459ce191c18d54b16427f5fd8d03d4e48933e04156a2f5dc3e301dcb42447888aab27720a1b479a651f04e3a4ab2ee8671f3e19b5cb9af3e48544f04de48bf0fc63b230e1de31558dd1b149bf7f91ec65365f606c2417fa81dcde6b7551e931e7b8baff571ee47c28d3bc483654adbdc5fe3c6d1b810dd36e090962097019d9cae68282e30c537de359fd856468a91d4e42cdb44b96a83558cc83c64c8c20f96f1d1a26528d8141aea558df5f06e2a3966e38316c7ee420d08edb79229a7f12881314c42f0a903ccb86e66f019ed3f9e5e8072538c4d2343a2d5a", @generic="0ea3a8355e39fd54ddd2e58e47f4b8833511ce2d8ef221bb68c4926d8f6543b66a1e629125d4ba3f10fd005f688fded68e1ceb975374b08b508c58c111cdda34a2c12757135d2310db9dcc5259158f72379f376e206c05a4b8fed0900d0a02443af5fc5be1feb556a7af2724f94cce12dbef9fe102902aeda09f8198f717d28332156e0216a40a1a36f13552e14990a4c1", @typed={0x8, 0xa}, @generic="2d3a2af58f7839e65484772225c8996bffddb226ce63df206149b7aa700909a5b6b5ad2f9b280a6967cabc54eb8b5694c82dc5c0cb8b844dd8831f09b6af568c0b5a24a80fa9081a286d71e1eac89a49a0bfd3c3333df42662e0f38883483f6cde2e57359f80778255247cc829dbe7a0cef8d183570d34ac997281b6eeca950d052a3d2fd5393173d35db407cd2e1c85e36544d1cee730196dd4b0ed0166d00a4dbe57df4fc561ae3cc319ab7bcb808b2c1ff8c3b7590a4c75475218285f5d0d0893a4f7b0656c32f12c834483cb5e7325dbc022b81553718bbfc4defcc8f37260496dfa1fa90039b6e100f8d0e810d27aa9ad072b0f3978fad5362f956ed72c4c2817f9ea549447d97090d2f4a7c6274f4d7943ab5b132ccbd9c968700a538a686390e208ac9535ae32fb006af09bf50bed140d9bbf4005eb44a827c93c75887c80e7c517e9700075ab3f67400a5d1351099791c491b7db883176d3ea5be17313874256a73f91710abbde78ecebf25dbb21fc0b813628adda21a84215b5fbe110eb12f8d5e58e755b3eca6115f5ac39a373626f9b541d524362382e2968ad2e0df77a0901d9776ce5f3ba20efa039c9f036c57c18149795e86a1d95d20dd92334617e31c00b36dc31048f47d0ab956edb352296186ccd30c55fbce88739357cd6b60094ddf7265171eb2754bdd256105df89ce2abaaf98c9177f2ced3058ad1fad2bc0a2a3cead7444c2e4cbe07a57664bb4984fe8e0c93186a7d9ad439e1bc23ab2e77f90202c254f0d3153682e643294965200df64d34b6462912d3ed22b1640d03b817b5f6313b3d25f2b86efef27803602012c45ec18c63fb3b007ff28a4d7bff270afe770b6000549c9c84c7e150c5ae11b98760f2bac1664f82f591a812685098338c9f9077967694ce6b4ac30ed6acde845a3266f87b4881106c81b794c71c7218a46e45c0b54323f6c3b14eeee1bbad47f5ffd94dd87b3d692f0d17f8476c64fd8f96edb964334671baaea81b06e4d53ef4b8cf4fb3ba7d1166b99a991965f7cf4adfa18e79668a16a4be19e21b88cf7c0d11932522d829ba8edda3ceb4d7eca80c583650aa226e9a5390b6f1f29573643589601f976556ab1b14ae0a08b3f9e96ac1febf9bae016633ad0797e3cee68d4d748e8118cecfdd2af5468c974384c90e2f0315b73ef9fae4bf9d5a11142fc8512df006716cba60909a4b1b90fc4a74a70c38311d35f0e2c6a641d7c6bfaa821d2a42e42968c4a7ef0e2f44e0a8b6be4ebc0e24b5c2d03f1deb9c952775eb5773928ad420be3fd044f4c644f69cc3c7f45aa71138e3898b6e7fd2c12b59e003cf7ff77637892e7fd736c5d5313763edd86609952b5168295b8cc839f552ee9b263d710e62a748fc6c9bbe932efebabacc6a130e1914d073bea05c0dfc88014bec9d2303c7a790f2c4d2cc115c2489a8f37af687e042c7c9f357cdda9331ef0040a141a06e40f57b7477c5186f23567f9a12ba65aede3602418af0e42d9fcc65b69b865d7b84353a9caf84be9778acdeb49fe579a86c8ca2333a523e297aef2fc29ac07b088612fe85b5b96f161c3f6cb229723d35be2bc20607ff066415fbd9803a24a2aeb80a2ac483caec063eb9ad85e07f32b73f9f478d333879aa01b6ac0b8372544ec896bd61ce4faa98e08da14ea5cdc8fa1277adcf376dcaa516af8826b5e70b0d74e3087df8cd4ec05364de7adae0f7cbd325b347b9878b8343f1ea4dca21cbfb7bd35eba039e30898d867a3bb7b50884f676b34630a9953f0c8214ec33638f579a253df4753424296ea1a5ba325dd847ea9d54a412c1adcc0a6b7fa8cdc8cf031dacf6d70b501546f82e7f972d5ba6d3b4b1af291c92cbfd44624b376a616e1f2cf09dbbdb240949256e1644572900c4069bd9f9b6929f4667f4baf048c40852d2271a7fd70806161522fb87f9eb6b9d7620658f3ba7ab058a8074f5134809a38c6a47d6b41208ba5dfe659b7ef9c050b01e3dd8cb1aadbbedcc062113619701871cc93cd4bfd0bd2fcac4dc0e992a9347c37a7dff2961bfc7a8decf3fac3f34b47307481a52fec7ef8a56955ee60441fe56a9afbfd0940e6bd68209bdbf09608f7b14c277fe68343a013fa65beed68ecbbaf0495698c5a674e5f90dc58bd5c7c4c6baa80d759f3103d4776f94459c72e12693bcc737607e0a727125b2a99461756a758b6ae8f3e52ff743e5b262f4206c4707839f444567359355bd083cbd4d1bb01e4ae8b0c1cab7ff2eb54b797a82f0a0ae3d18e920924a705bb4675bf0a754f85facc5c7eec4d00fe734e7d0a54b1a9b1b724db29c370616639dc99959ab93f195dc545416cf5b091b86b078f7e8d98eabd1c7983fa786c3b50122dc754486eabbed5c89b22667cc80a5078d0a048d2950038e13e94aac5e8d5f9d89a1b0a5464830376e3f7dfe335b07417ce1fd5f77790f4821b713c2c90b90ba0195bd4b281b2d79acd7d2c7195b6288ef7748ffd60948fbf0a869eae70cc319b03c9f25891cbf990031a53316339eda8e85e83e7296f115d71ab5e18cfa2c579f521055e9a48c8a16f8b3e3e9ed4b05a974688629b12f12f56b36d719440d077e5d6ff4ca010a22d0ced3edb0ce0c7210c1b4c4cff74ef47defcd4cccec6219dad115a82d9524713d138e33f02b8e1140a2db45a99d726e7393f82f4fb7b5fdb6d3c3f7117226c262f8956686ae90f96f6d0d5d431bb26f20515b31a64086e81e9823d9774986f5d0e264169d070d2a22a07cdf60e47180fcd0191b21bcc86a0fe0dc2ba8a9280c9529fe6da8e6864a082718d00bd684d8e274cafe73296e504b1f6d67a64e2e2150dc151228658a8a7a5245dc8900e6472767c49ecd3a6fc420f0fe65c812dd07cbadd733afc31a5c43448462a0061be8fbbff94e12e5724b19c23a5b46bbb144149f0a40372159135ce05067ff98635d1e24648a66f2aa0b0f0a03e39bec282d7a29a63716c0a0fcdd0c292ae41458a3e87643b8e7bd949847d8857a7e7704c393aff3a2c33c81a7b54cb23c3cea5c5cd2bb1d01a415dd37a6a11846bb34075a6159c3f073356a17f1d7400afe94126b08ca2e29bb43b6cdb6bd89be7b8e036230ea095a605c8c0063a189c487b4616f16622dd571516f681bcaf5743f0da9386ec0a0280356a3990f5bfa78461af7daa9cd3015d045af20a3b4bb0a66e72bd8eeb2cfd319fad9e64734f9fc127815c760f762d8c729876600bfd83097775d70f94dcf911f7341fdce257e28b6cca1f0f1165a36c10e60a4fdf3eacbabd03d8a2878be2ca91926ef2c1622b1d55503d3fb2762d34bc8dc5aa9192c79822c121034f1eb7de5c87b9a835809daece3e718d6e4148d43d9da51397d31b246a4ae59d58daa59ec8697231e2f16f711708ddcdd49907f9cf09320fac5a19ce0c8757354869f07eef01b87ac0e2841f7ea47fdc69730dd35813ce87461cb0a0b09b6e239dcb8def8c8b5c78e6a8158b5ca828151fe37d547c27566d1784ab659ac269e82a5961d000063b00bf70f9e12b17b1dcc67f0f0e0b8535a6dd2520cea6ddd5ad33e33b6c3613e1e8eb112fe2518574b2a49e47614a0e2f77f6b0d7145996ee5a9c50d00e0d554a9067c9e391409f759401368f04de8dd51ddaa5026d2ded9361aef83021c485969cc16c4f5a130a820fef2773255176a720f9a7ec8ff037653af10398a38d55356aceff5b67969733978f990b9b7558d9b8a82bdd2edcaebb3c6ae17c3515e361d95bde0d2b9628da919cedcbc3e5fd1b0e5588b5cb3c2b4a17be789c8a1f503ef014b2da03544269397b81005f998fc2a91b0f2c32e2017c1276ccf479dd57e1af49e8bb01f64ad9e597d949f9b8d60fd9f13e500d0ba8e163145a0fb11c86a2ab284b586a1b508f85aa0a63b33de380952233dcad2190bdc77905864254bcf4531addc51a0fdd9e6240167eff97a2ef5dc17708e8c297a883633a444d2a0a04599082f9525a7088448d69a7f51503e7073fbf1de46be42661ae13c6b47f181ecacd8239741cab882034a045448cb68fc1e87202bddcd0897d2cec6902c2ffeb1a60997914115cbd74a12e801b4c03b5415851f8c2dd7d96d87478aaf2cf9525bc009ab739f8ebbdcc920e4d9d2b203331180898ca2f6ecb522d7fb85d6654efec7070a60b2b696afc9ddbbd5917d4fad082ec4afcc47555a858335f6ce75327f829a8adfa71538eda63bfa12217727b7972650d255cdbd832c03d6812632b07e2db60bf7705e966b60c2c43deba5e964f05420954e16295d7efaa7942b4e65e4187a6535b41917d274a76d8de5623344a6fdb8e85b57e013c2dcdf5fb8af41bd605d7026580fabcc866d09ec07470671bee3bf88414c468b29def49b7fb50049688399038fc1dc0ece0ad21d249a4beebfffe40d051f248bc13701c8b587eaf7ae31864643341933e1b645db310e277e1db37adc2aaffa759d5812c8d7096942d0b4be349525301980f038d898094a300611307d5178c5d6cc4d2301212b1cd04ad6752bbc4b17eba89909509c40d75e9946d00a64280945bf0268f4aae5d3fc9cfee43e194080cd54153ced4b5b10bd013f6d78a993c9ff9cbeff4b715795bd7578f80934e277d65109c014e1f7e395d7b813beba24001253e98a6532ef94eab01df455da75aac0158f00a12d2878f6940a3e9355ccdb3e3f44ef0b62637c28e232add74c08f63990577c7bec18ade1d1465e41e0e626dc1127681bb47172b9f57369603e4a44a12cd01a2779b7be526da64e6c1d9b9e539f266ef768f3e07d9c9b50850bdf06488d2927fb42e47cc70e1fbf1370bdbd4f6786fb177bd154c0864c489f843334434b38d76418157add3ec29204f3d78b4afbbd5c7fc919f6f70829a972470afbc920d1a16bcd8a283a576b0153f8c5e3eaba6e2a36809bf27e6730d7121f2f005458a7041db4e639e981bc8b1116f2ad0815dfc568e69eb7d1c7acb30c06646f92208097d1fd748ba73dfe049b00219799ae4c8e96792ff6ab9de219c57550d3c9f00fbe1ce3829c9d1975cdc19c2fcf2f434b85ce1660a7fb911fe9e6a98eba817a39561083891b144e330403a4098b233d66d9a3ae9c97da98dc3dcea07752869ed66454c09ed6620e1609b87667a7c39bd4644576df9cd6cdd2db0386356d13fa0db3545a9b37867a5483abddebf2c8256d88dfab84a2dd257f4517221b8a43bd7072035f824312a445d48aebcabf5d2240d35719195fe261d8c622c6cfe65a55cdda801a1508b5f6ed37af926b96bc01229957f2b881d76bdeb1458811f8c4a1ff495b45a7190f32e10d02c11aa49dac6a70db261e280a9e3ff12037460c2ef84db75e7231cebde3f82a0585cc3a3bdf4381b8fd1944d57db329c0e7170c4032b89d2bd7518e8ff26eed7dee7e9693cc58036901b67f399bfdb4e6011dfd24458038d02a271ea83bfe979379728d563f7984c8681947908c473d39e51be0dd2cfe7bba9b92326f93ab9bf8f2a089a670293b974355898780026be42d2128bd539b75926deed530e10b6631cf6173ac57ea1816b8d6c31ab9282bd0b4d4258320a2e875f85865732383c026fe48f79b6a268c2775d13c39860ea613d4306beb2d3c684d0ed76bcc88af44e4bd65228680c4c54273fa93a4514672428e98b423e5281ddb3c6f7f8ff62bf1220345615f4b9c17c52c99689f5b7a819135f65df0d583ce89f0a1fc67cc3144e4f8c39107ec54cd81786828d7e78d6a710f80955b0d81ae4f4225549c407f062185cb02c7af", @generic, @generic="f5c0ca800cadeed3ee3ad075b84f3aa000f6260fcad9af2512030be81f6ee1f9e654ee0b9ef7e805add7d74b823df3c0848e90e33d5a7db58f29ba95f5ea913ed051ac701148c66a79b52f451e1ae0f2a2fc4dc40814fd516c09d86a8cf215e96750cbf210bf8ae3ede5aefa9ca0d3eb124dbd2bd0da40f763eaf94596128f33fe4f6151609d51ce9671cf7a4cc54c344a4f8fc71d7b7cf407bf9282de2caaae399f64b2ca192a781d9334181fdeab810ef9d5f2502e8061d9916e08c85fde4ca40e3b42143d8d891fd0bd9f764870", @generic="30056d5cf4537f31a9dae8a250845d3f92530bb4df1de7d5c6d4e797811e1fc41e3cfcdda63d967ea6d8a107c4fcc07bf2c58e337e90a3c6f9b734c5dfd901d7cdcc4226528c7f59abab9cd678443f40e7474610e5de1d60bb6a5a503d9eddde7ef3906a3224e4f15990489c81c93e37b750ca5567bde747c7e66c467821303f3e2a5e8fde5936d2b99847d599198e9fb134c625112296ec41a994b311bd2466e85e6b824de023676a7763b5e76377598af711ecba1d246165b4e02945fec6a9eb59440127f73fbfad66bda24fd3b44dba73f53ea33a47a23524efcc02db90450695812c8c"]}, @generic="ac4ad1f6a1c53a"]}, 0x3690}, {&(0x7f00007dc000)={0x7c, 0x34, 0x1, 0x1, 0x1, "", [@generic="3529f4455ce5154884a9321b8b44da9ec7e081bb99f7e9bf0e1c0c0c84761170d7669eab9a0948e12a2570653761ca9592ca23bf9b8114108653f2eb6c14c8d495dddb40ddbee4ce2d7f347c595e01388443620328349c3dd2df117085", @typed={0xc, 0xe, @pid=r0}]}, 0x7c}, {&(0x7f0000610000-0x24a0)={0x24a0, 0x2a, 0x520, 0x6, 0x2, "", [@nested={0x1a0, 0x8c, [@generic="d84d63cd94064871e882769910b5af7b0d754a2426a2d5611875adf712137186565387fbb8fab2edb456766bf2083cc8518ea14947dff75a9e716715507319fca20b6ba1ad6e05cc809e94", @typed={0xc, 0x3f, @fd=r6}, @typed={0xc, 0x53, @fd=r7}, @typed={0xc, 0x17, @fd=r8}, @generic="c4bae7f463381f4558878f4bf66c5b92c764e1f25c2b622e2e8151565db4ae99e05406547a3a656582c7baf68c03740cde10d6ecc2301fa4c49080202789c3914714d463e298d8a4a645ceaa4f970cd83e40af976ab199fc83cc0d5426fbf466fc6ba98c0f1845aec602722ad9e2263fb2e44861c7b5daf7fdf58cf3536884e20c30b155148ad5910702f188786cec118afa8a3520b4a3a959071eb84c89910ec563a1179397548f9d788c8164a17366064ca219b823918136d7e8991526fc85c9a07429c2dbcf14b9a298a2ec32e228f665ff", @generic="0d9eef74e13a0441195330a1393d8f1b6c8d2cbe3127896b8a49297d4bfa34311cb336d7e76291da71d4392d44266ffe8cc206407b1c13b9fca61d95b089ba9d6f43ebffabe34f78e8d577c885a644cd5332906fde867f51f9"]}, @typed={0xc, 0x42, @pid=r0}, @nested={0x1134, 0x56, [@generic="5786c5355d9a8ff6ff8952fe0f0671da60747356a85a525036eb5d9d06114ba0a232013bd225e139d70c44949f0dc83bf66e3ce64e734e221b41d8255fc33dff2ee11edbb21feff32b6a9af41e810b14f217aad28bba5d687b542a73e1832f9d75e6b9cdc8f2729ab785749214da75c5f04ef9a8bbd8efcf18b3c8d840fc444d33bd3bc9d2e6e1162221d5ee419b0ff6209da42d9415aabc753efa614a66400283844c2010aece13a153e08e8689ceca9cc837d99015aa1be0ec04342d76beca7672d4fb7e965132fb909b5ac3d85b4c8b97d138ffef083a923dcd95d2396be6c89a3df4a9e66e58d96ae59fcd628f020a521a14b9b32a561a5af66f389969b3f8517622fd86275c3e2cc540fbf2aa11e84c8098fa1882835937a897569795bdd0cdcf051e0c3b45ad614e8bcc8762a1fe56e09a1b272c35b31171aa1666c7bec8fae348c55f4a3ae44b607ceaef445e26b8a4af22c7f452d6c3423f9b6350b56389248310cc6af4d32ded26f6ae9084c470db1fca339cfeaacfcb2259174ca09fd275385aa0205096cd8dbfd5358838a19c421ed60298372bacf666f6438c986f8c89b6b78f9fdfdc2ae1a4ba5284f94f0c155ae6734fe6a639a86f2bfe16502e3e3c9de0ddb7c4d4037d866b055f57e09d6f5ac41f0b7af5d660b0136571fe39be7af92e65eedb42eb4b6b85461aa5eb09b391244a1fabe8f4d672cb8c93b68c75dc643e36ff258a4b76a9a51081cc44d3c34b5b2aca4ecc3db887473c6ec724a14827b690c80c3df7a6ec835543790c48b5a47ce691e28a7bb4801b3c65e9214f50eb1910c5b7336067625473cc4a94d6b9f14b8d2f2e43b3880497bfef9be5ecee024ab1bdf4dc28c252450d3eb129d6e0ccdd631da0df30caf438424f33b6c5acae44ab6c740bef646a302153430edbb9c4aca9c33c916ef3ed831335b719bf77f43ec5f6c3a1c6a115e801577faf195f157114f81b34079dc327eaf0fae008dadd4d580e076b1bcbbc49a1c3069f28e7f876cfacd0779cdcbd82af5292151c664140a6352d9bcac5a24b225c919bdeeb0f0ed82164193c4c96d2c5499d29372ac33ff35ec1fec8835cfc9a56307fc34e6d79e952df118f7fa42063daf83f19cf41e1ac5dc6df68977c5fa289f95ff5da4816bfca5b4a0b8c7925ee3b0b144a3d5e8aeb3f6b4c6f1a82e2ab3e703b3c64099f4466df112ad09ffcbd27c59c0bf8b67773ea6e5a08f384f741d0d8e76684e81acc35172b84c019eadbca0e7ef8dcfed919a9cb022dbb967c9ae44d899760c7d670e11f857d997bd1f7df1b3df1237e23f6e4a788f1eadddcc7725b70bd6e99bb3317cc87e4053c7938b6bb08d49d6fe2db09cb48222d9471b86fb46bbb28a510ea57b9d6373d24d4964162d914604199961f429e055cb2f30be7f32e583a3d43d9de61d99231bbe5d8bbcb1e2495a29eaeb8fe8efbe107e957bf98aa3f9110378fd904faa637ae5b13eb856ebb612f4a31ad26e28f15eaa97fbbbb95ae739360ec26529c3f18abe1d0a0c3b7d9ef08ad059b0d46957711bf40942714c7dc61a9aa97276023e2e60e7661cae518a0a3409e69f12b88d476af7e896c985f5654e142c2b6ab13903ac16509f57a308d3b79e3d9730ed270436e2d54d757339d59e56bfc3346b7aed7d3e284059dda827ad79b281580ede0eeee9d4274f1f7e36f0c5225275b10f6829dcc6357475ec0b84a7927f3f44a374b49b7e9df91e8a07ad3ff7ce8fb121666d6c0eb267a176a6d507c5e62a83ba16d4527d9503e93d90ceb5cd3b0b192f2dfc628c201b3a64d78023a9d80277aa719bd3d576be47d3a06b797c9ec052cbe08f2d9529fa1851cde694696451fc56381501e1a8aad55b4d7fef60125c2bf4c989afc12d1d7fcf0b43a9619c21d62e164ce3e623ca1a3e8fee0ce6ab44a932c4ad709debe5e3f8b1b54076c96efe380df8165a6e18e34851a8d937d7b81aa2cf4da8a76c88567a138003e08a11f438fefdd4b5f68eb5478a4fb443e237e9b4b9632aa3868219492284524d648a3613991821152c04202e421bf3e7a3a3f508ddcac1562de80eaae5be3f6c080304f95edc46da54abdcc47da8580905378b563212613c668d86ee77a947ccb7e16b7a99200ba0e75bddbdf40de329ce4df42b67265254217426212fd03cf045ba29c70cfa7388433bf213f09ab1a0624642db6205273f95f3f82ed1ce1c062110e33c130c1618ebd5bc92a2dc8c0ff6d7c5dea38179181f49f0e974d6e1e39a02a1f7140a382ef41291139348d18f8f2544e1ec73c89098061374587ac98cdf9b02b9b15a196a188fdef4fc3aa2e0c663d2792dbf36cea159def63d04b3ab9600a9795d57495450b77f9fb01242791a5e038ee71c07e0e1742da5c25a9965285b9f5ad0bd6c6d14d30fef63bd3dc4c376c86474807e4dc37d9e2a625c02830a5c213c73c5b3581fb3ed63e8f9da5ad6c93c08a5653cd631f7b4a08c1be5ef39f25e9f8d24e7bea1e9b76c7cce590b01135c48f7d7585c0ab504055b7dc06471cd1bf31a410a89a340e25d11e4f28f75f6c981e0d9c0a90cc917fda8a82d20efa6f9c7800d83c528a48e0fcc01c5da85e24259997f0ac8708d5c5367ba92722a8a81ecb305ff1e1c087781a83aa41cfea321dff37696683a2e776893b6e2a981f6dfc68db0593f4eefe9b3dfc1f7684d2256f348deff436420d1aceb90a41732c2ca1a8e2fa0df6986b51c661c64d5f7c1f573030d286661c0867ae36983ee9af07c29cbdaf23bab0ba2bd83cf4134b9c18e53f8414b485308cbc1a4a433f733c1aec65c9adaec56a6c5ffc33b83da4b250ee08a1c7d1fe0763df0e3fcea646ccb023b068a2b2364e74f3ee0305fd82713a717f2b7d87e40cb32d9e0cf1bcd954726f55128ec74602ad346214f55740876d5e9cddba72861a1fbc80b51410a827af0186e27b41554d98d95a600a132586b0d2bd9f149ea42bf8305a913de7dcbf16ceb89a52ff2245e3b40614ad450b02ea5e903155a209232299751d52ae9c7186a2eda670ee9a42c4267f3556744ffd4c241cba4efef33370ebb81fbc81889305e69ff5ef7db1910b3847977909aeef8a16dac0737c0196a6029f357f00ed8a9c9197d3b2c2c7902e419c3b4f90303efe268ad846b8a41ce700b385d5c20dfbc8b4fae11bb63d821fdc80c57950a5b163adc7593598c4625acf2f486d729eae4ae6c47c370ddd75005ee13366604b27059f9571e6b0ca7928d019989957823b67e77d56f24fd5150aa96971e93ef345dabab75df66bff20e5535a223d26fc029a349bf7123c6dc5f15d4c1e5ac27d3ce83958d9afde60d098a09a18bffeb24b70a8a40c1bffbc40a1c0fc3f21edf81184a54b2d2013aa7285396be31af562dcc11b03a1d9efd71749f4b8c5454a0e080aa5af89b100ba2bc29fb10207646fbf99c524f4f7a1893c136dacd47d65e0acb89e7e90a27786875742b3f1be9cb2560d56463ab1553c890fc18649764fea1fa89bc8013a3664ae07b87d0a66e8b09e3a6701906c3aa6a2b725fcd2fb5994326bfc42e9d551f84b9dee958a06ec7dd2530c8fc1662c312fb42131f695cdeebe057a1796039d29e5ddae957a71500f53eaa15c4494a16184a4010d0eace5f39b20a76c920b777f61d224f4acb15c7b0e314083650cbcd66b7fe1871260e1d94df0a3d562c81143d0a4ff9c1ac4a08f2e5f98a1fa8be62cd4c487a49f16416fecbdf0d42193ff0b6f6d3fcceefcfb416b80dab8daf4661558a7e84e613a5b7ccf3a5ef8be13600af6d4caa9cdd6ee71bd0a90872aca074e52051cffbc152deb1f91576439939bcc826c6efee9bc5925f67b7039d18fc5bc693c5d576137ca9e9cb59e879cdcba795e2385dfd8f813c071c1954239efd47929d586edd47fb6e5fcc257214f8f606e178e7044b95483ed9a190af2316787e30483e4860f94b4dc07e82dcc033d68c2d7325356b1f683578a4f9d4ec958ca2e58277aeae40aa28e0e79747aa2fd39bd48845786e2d0b9e0bc4f1b88874848fa9f3e52e96dfc570edebbf999b8fed01f303aaf2af484ff902334b51f0c6fa587442f8533037a10c894cdf40988ab565f55a5dd203ef7987cd7d43a47c67069151618d6b1b52def401c253837ae45f387faac010a8b88365d1704d6550bfa8125fb5421e9038f542a5af7636937092bd7e6f39f35bfbac7785bc835647f384fdb6e4269ae20d6b46aa99cc79d59e43a3742a3a740725699a660b8b93f618cb4d2c353db4a2522061ccb16711ff339a9003bc98689f538ef757fc1e74c19f1189c82843a44c11f3430a539989b95a8ed0e3a4737d645ab460be95e2f677e597af1d199b89dcc00e1a20026189f8800bd793510a58551ccbb40c9757a05e7dda4db756d812a813c64ec4cb891055dd94094978dd4ddf0597a2961ea4abb00e52f00d3516ba6bfc173bd959d4b4b22aa998b65f3c4ffa4538a63b2362a399e2a0cda0357b3eccd23eb339d7e40cc523defcbe73b0c836312a8fd725ca89e446b1b5f06dc33146b6d61844ebbda381e1d3d51cafbf03baea41f828af2995ef51e36009b6e983f4b0029b4354c9c57f87f44bf49ae0f58aa1b1820eb8354a192bffa93df2af1097acdd369e1bfb17753c296aaa78dfca8211394c4265b9e9ceafa87fc0558c8439e22240e07d72620dfb4be9b09f08223011a442bac16726a2b5a65574a989e980d0f4ae3c188e6cc4438d2d81556789195dfc053649568518f5d79e64ebcfd790407b2b7032197ca94474bbb6ae5b23b7e0529ff0656abc36ce5bc45177c13e371a53681128eb74df968a7073327a81d9d4219fe0c33eb14a3edd9f1b2dfdda90a47e298dc27b1cd36d7e7555f5bdd96bc8704a783b906c8149b378e093a257a80ba2086b96bf5619c158b4c99b60628996afd85b803dbe7a8c4a482814f2ef4b6be6cb3507ffc21094c7d8ca6798fd636e47d0188709363c861955bd82060c4859a5b344524bb03e78647f540e1357d91b12aeb6db714bd71d4e892fec8770038753eeebc8ac5d6a516d26ef0a58e87fd669a80d73c3ba6582f902cde729ea2fab585edc873b4cb4f6692a7faf2d810efa6b5ab9c7bc84758f80b962bf0a19db49cfb8c69d5b55c8b385eb5afd545f2b2f37d3279ea6db0bcade4cd3fa52a735ab335cf389ff2416c59f3f78d4f52588fb8b11fe042f535a7735a79a0ebc4751d7ee5192425d2741560660e0258642f75c587ac0d572c98abdbb35dc3e1855fd32173506015be64a1552fcf1cde1716d4fae481710427f546cc155e9e055cc6ea0d279322034efd9242500975454fd34841221eea7bb89b4b162781e359655cfa22181b7fc83ce5a0b82c7c96e5a3c3d62d98cd90eec2ff6f03e54dd273f5a0eaf33579a648f033daaf26b28def0425a457f8c8e155e8bbf4db176edd88e4d988271bd0cc749433269deedadbedca49bd12d671701d15468b49f972d2ebfb53ddc310976a4df21c0aefa3b2242899c3b0486022e80872a0571235640d7818e415d70284099f0b4d657a48edbec2c82b8e9edee2e5aa091d9cd1b03e8f2be75f67da9b72a8c60e396e794c6fd0197d5955ded149af8d7762d28e47b5cb00d26937287d8bcda522c0e0f6961e43751c0364fd207aa70bd82a495e9b474b30c188bb0a7cf6102952205eeed448864623f909030b34c70e18f2eb6b3303e953ee5a1a2ad9ff459c48ef73336b86ddc0f022e3fec99bd485915181d84736b6bc5f237ef7b4513986505e14fa4f7f04", @typed={0x18, 0x83, @ipv6=@mcast1={0xff, 0x1, [], 0x1}}, @generic="e4bbe3110b4847dd76f2077168bde76c5f1bbe0528a4405fd75c94bbf8c6fa3bb24fe319471b952b21fdcdd23f395307688c0508ae7e4e7f0a64f0f282a27b9b28d139ee371cacaede17b6298125099c00164ab057dac14546647df5a7265f5d64c3e1148ca755997658832e79aa31683bd7061d8537ed700e6732790f786072b631f5516a3b1f64e9029a3144f78b10f2845db45bf6763b55de6dc4c4d5c36ee977b79acc591a994d45833d5628969d8851406c2a5c39065ef994b9", @generic="4abb4078ee1c305a9a832d53527a365b4d82641fa2d7e7567135f3ca27902e686220c343574f2ab192ea33a6b0a76314ced2331e", @generic="55607c962b2959ed8561a0869b327c9bf1cc7fc1da4888a6ee51902cfc0530f5c3ff79c2082e"]}, @nested={0x74, 0x7c, [@typed={0x18, 0x3b, @ipv6=@empty}, @typed={0x10, 0x27, @str='nodev-\x00'}, @typed={0xc, 0x27, @fd=r9}, @typed={0x10, 0x67, @u64=0xb02}, @typed={0x10, 0x48, @str='vmnet0&\x00'}, @generic="9a16b4f085e08c1857d52c34a0f935677a5673524391054015"]}, @nested={0x118, 0x57, [@typed={0xc, 0x6d, @u32=0xd4b}, @typed={0x18, 0x12, @ipv6=@loopback={0x0, 0x1}}, @typed={0x10, 0x6d, @u64=0x7}, @generic="28388eb1a4101e4a38ccbdd1fc56bc9b0845362db7b98d9d2da48c793215ea6045d4a4856685c164d1f6358abc339142f8f293d6578e3d9a59894fa780da85ff72df33a85aa989a76644aa0abe6b2c0e4b71fadcabaa57d60475920cefecf574b5d00c0770ac570771f52dfecec6505cf7ef4b0bc17d8032cd205e5ab63f8b4f3224ea49d7b23cf829ffd6f5d7ab6445bfa6cc763aa3de347afef6e88771445c8b80cb0d0a348e650ac18426b30d28f932cabec67a8a3c1dd31a28e568aed4e1b6f452ffb9c0224895026f90447d0ad977a7cfc9cb6e55b172200121a9bb6a96"]}, @nested={0x1004, 0x94, [@generic="dde505b000dc11e0fc4f7c8ca13dd34c7a7c3b178fdfad4d9055040eb013cc4330af7246825889aa44e39a6289855831a7d397870092935629b2146ee893a3dfe2579fdaaf3608428dfc1d208ebdec9082cf4070e76a8f901c2798fa67f6928faea01593ed74a62aefe8d398a6d7c1de2e3812bda744a6bf7c41cb4d2ebd5be7c7ffb91386a21e332ccbb403a631238717317577f8bf0bbd1e3edfdff9582381daf1e169e43cb8868acf72e4b8941bcb56b6b2f3ececadf85ca337a90e2a3dfe6faa8fa037a7a3ce9366480aaf0d773ec99ec8ce6088de67bc4ff70623f5de7153766961f5f2643cfa5239fca49d5b4122755895afe909278f96f49f0dcae4b56af49d8903f5a48e64faf7a538d789512349e6718083f03c861f2534119e013e2d7c1fb8b8da75d909a9ef1ac2a098acd049064772b6f982e0ab5df0d5dcc9ea36e8e8671d5203384a310e74a84e2a25689db1558c31ce95dc0512b39d40c10f486ce574edcdbe0d8e0d5274d93a19dacf7a13f5bc260258ce00071dd1729592db84f4adc5ec7bd47736cf687bd34ad419dcea19595b46a39ab28c18d59d67ad434ac3b770eb53e114ac7c7a3883a8cb02b577e1dbc37060e134591a4bfc3e258ac1e3c13e5ee68aa307fa0dae84bc49ed5ca0035607b4ab3e3fbe507ca53a750c90ee24c54fd4e9293acf2ad4435339289201b8931addad14ac8f3225a4745019cdd99d5555b58062337528190bc0cd3cdc38f91583c0b29898895daff95baf043071dfa44a41b7b6115b43082cc6e7a7db51006fad2d7593cacc38afc51029f14e53e0be1985c24d4f010f63f6ddeb94f2537e5ebc4174f28ae9c2aea3f8070a6e4db1329d12cbe45892b3f0708d3c8c838375549a1a4f63921b0388a57e4a8a41c0964e45d1473c686290a329a43d65720cf5405943a4878ba5b7fc1fb32c2cb9b69950629dd49fb8d21ad6c12eea7c84bbab22ff7b6f09aca7e470cb13566b1749655582ed6049b4ccfff20cdb6c5e9c7e8b06e51e63cc6f5529cb096c8349a67027a6743be076f24365819f2c51a68208e6e4d00df2280819c982f8c42e2a0afce5f54ba0687d879147c6406fca07ccc1c68a034d112399dc8352570a3078cc7d6fa1b8515419e1a2386a2638254dccffd26882b2fe06ae187e38e69e1a5e103c47f3d3ea27c8ccc670d60b07339e49e302c9c841155941ef0ed948ab48df327b5673034aa56eea2f219937f41c51f1dfce3522d998ea0a8ca352f2afbab8ac3c3c50ca7424f853addda421524e939089324d48c8b2f29959386c6c14da254dda294843918dd695ff4d0527441bc9dd0f43cb1ef77adab16c6f5b98d1765662f9a878e10d097d5c21801f8aa5e2d07f0c068b58dbbc6050d29e72879fb6f0524a447881b995999bd8d0fd15de866034c0c982ed18d593030b1802e94c709c693a78d137b2229fa582524c2ac3c6e4a1ebd7a965ac819cd6a1dd440466fa8beb8dff25708df1191ea78b080fa1f78c19cfd37755638f93d7311edda49b44b53cf1c4223c6cdb38d6d8ecc28c1fc6ad5fc9d061d181fed357ffeb154a5b210178e739587e48a348ce6a081a9915e824172c91d934b5e33df747de1bf5e7f94dc2d0831976d990aa454d94d018da56960aacabea7d3f07eec48b5da3b54a439ce771474cd30a1601f3a9bd2e4957a8cc78cc38e589b88418bf58aef1fe2e4f89178f41e0dde9dbd36c655ce0e8d45efadad84d439330719c985fa9269dd4302491155b4c5d9f1725c3e175c716c40429fd488a9dbb2640213f53d4f0b0420b3f17ce112c20c1b78e651ee1da31d3c9f458145c784da7bbce4789f31d5f802fde2e07415a97c6f53669d693ea2071c4970a7693e444d45a616e4772957492eb9efd407547b236d981d73db2be0af642c7be23d5952f2f94e452a05ae487bb4ad0a945be1c0239ff85659fc52c851563edc23f713ca6906b3d2552bd6024ca8eb4a187cd492b88cfc4df30b205531a34c64c953906cb75e03ec2c4857b6e333867d251a07fd4a507d4b4356168aae8e88d80ea3a108ee86458f0028205da9237da48cf403c302e266e47e1f2e6e51a804069e6c464ba76d4e66010b74f8fa38c0a36172817b7b729c4497604ca79eb67c1adc463a3140f92b17ffc4ee2dcf1ea52032691ce2f49fcd6208d59fc35cc0ce84e5a9930239b9c69fad57a79aba72a2bed018d3e85572417efc7a97dc34251aeea359299355327460807491b89d66217e14eef159ed96ef6393f448873faf2205fc7c3635f88c9dd8cef409b0a7a93ab0136f50c4751ce3a67a4ed85a74ea0ecbb81ef24c884d6d62642e3ca927fa04f7ac264e2ca98aa89e4b05acc021c57a78475fe23acba1ca7f5fe0e56a098d071b711b77572a7adb617af86129a34e09830a2b37101d2795ed39f4bacc4cbe96175b942b958323132c2f91c1c1bc2b64e07d9a974f1146b1eb626fde7cddf674311edff3b3d4b201933f4e0d029e63997b6e201a657bea5ee50a61ab914bd884e32f51136ad2b10855a3c2a983984be631e3c0c1a86b461bb2ecf7e582b84562477903b771aff6e08cf57b6634d09a204033b44206ff6f4bd7799ee4652f366e3c44581f0394d79ea287dcf60e08dff5f606becaa3bdefaad490e2ff5cb7f3a0aee70f3e42417172ffc6eca716fd36febc05eae43b4032016c45ac24d06d62ccef3fddb86eabeba40acba2c033b5716abc60ea7a8b624f918d15746ce5fedbb54e8f9bdb159863cf3e4a8bc184de25f8e948ca6e6a4078bff5672930dcde4048adeefbfb5ab0057defd99ccd0c128b9aca0e7f5e949c46f5684805941e6a97758d6d423d4fcc1d84b4f682b500201a5b4d84af3cbb11e89e3ddb8704f04624e0ce85762d54b5f925924b10fc5a2fd4a08386c059f1f12830088dd42052a715f07325e783d49ad23a89d20b56472abc5c00a3cf4f5edeee5ce1987a64506da13d91b2c53fbd799bb3d337c636732bab514a727e896ffcbfff8e6765fab51cadf0385f1391cf337b51b3aa30a64c2d767896487a1167fc181110476e7751999ff5dec4d9c349bd81b10de6dd8868f58851604869611da1204c248f6d5b6da9e6ff7fab5234582241a325716dfbac9520e1a1bac5d1d3a2364c9e32444c793e08e60c58a99ee387341f3a443f73b5b6dd1c00bcd13873982d67e21e1635e4f6277336e05c9bf81f34e5407df4c5c5d3d51fbced4f7cf8f1868ce4a5dbfcbe9d3735cc58fc066725fd5a09264cb0b83e5fa7eae9bc963a8c4be66f96f5ed3908b5ebfc27b255ed1504445f9a4f95ec7e1c066e0dcd36a51b5ccd9cf9a078243daeed7ad097832410e0819c3fa58d02c4071cabb1dd3aaba7d870be44e367824ba08e709b85d96c10f515a35110e9930102efe40920cc0d055f3e3ebb9fb36e918fcdf199fffbb16edc95168bad9357fbb9d0398316e0c2a8f9592a9ccb32b7af63b495c8676d05e54fc2d401856b643dafdcf63e75f5e247dd26441860caa39035cfc8b0e90823551526038ad96b39a02cb4ebe73cd4df25889054e6690fe12873cc4bde754fe45f4c283394ee59fb6660e3d4116ad80e47a0c20ab4eadac4a189139f58b865155cc0c4c7606760dae496207e96b76646dfe5f2b12267198f0886fd96d6d51756300a3bcffc53f1ffb4a38ffa6b7646f2341a7c9c653e6df073e39963b03b0d02b29011b42faeb0a84e98ec721a0d52950caf1e5d133495c337a4c5a221df31e094dd7acbdf313d8756fc341530e587da84410d9377716390b8f17605db9cf566ef4fd9003a01e6de1aed8061b0d95eda9fcbce3d90f00e00f9394b92feb2d45a5e5ccc90f0d34e5e52f0ae271451c759b5e4ce3a3a0c4a88023dd82c19d045396d9990d074cebce82a08cc0842c250f43b76257d62023af4d9a5fb89c5ba768260d69677326ec2056989e404a54f82e104ab70b790e04bf3d265d08f2655b30a5fead63378b0877fe5833ade552a8c074b995ef71bacd0aed3ca92791835aaed7aff1036f0a61cd06c1497aa681f58bf73a7ec49d63248f82727da6047077e5637195afa912af431c593a086b33d33fe994f84b7802c6d4ddf7455356e2074788256b84499d3ecd412ef9fbf6eb819be3c7b3d01b1bc7a364d42f85bd796d29cded8a0a7e30d5de1acbf6f83c3024200c3acecd2b0b236148d0858610933fd6fbb1157fdd31df2d20815e50d70295e7c32df0b117458559a0ee16149bcfdcde85edb882f5b23af4b8ae221e15ce5dd5a88abd84c60282d4e77f7fa66083e73cfd0d08cb12b055a26bea9df8e90a68d2f7bca012342652661791e1fbc6c02557830d77f823d0c448993bf5c0f052c380ad7763eeea4335417a5b54bebb75d4dd12c71ace9d076e680cb98b689b5fd14c0761b53f6a0008745542850761fa7f3b7fbabeb7128202dbf590b0bfbcb2f15b606f9240fd57bffa5cae922f93f184290bf5e06e52ef0f741d40ff2fbfcc467545e7517eaabb352e55b10766694760e49b8683b2955b3bc2ee9cd4d63d21e9906a74b7515e640fdd1d546131fced01504a0d5510c71616a84bd697a727e5bd90a1ed97e7b3268d12a76cdb806eca219f349ad9aea42a1dfbc963306a22f34c842396c6eff90ceb4584cf0f7fd7e424ccc9a61ac125e4706482c0869bb3f5709138b9f0e1da1390653500a4cce3174f0db8c485af20690c379621745340e336c0b5d0f11b99e779456b77beb75ef4a55a5a46846a3bd611b8e1061cd8ebe1851795751ff1eec0b6bb026c7127c443c7f75a70c9286656215f0cf383cf5b5a29908637c537c6164240015298a32418e2965a0dd3c9cb05cebd52905b77813cb2f9e3a1e5512920f9fdb1c76791b2197b1e2436eac1890b883bef9f2bade85ed3581f1a4a2116baeabd356b43d846b5074c02ff2460630ea82c36575ccc64cf2deae44259ce138deaf4a09029ee892e2d45b50d71e184f1f3cf41a067d16cef660467e76af5c96bce82d0f8e9ede38f1c1972aea0451fcfeb05107ac74cb0fc043006977346cc4846b8340846972ff3cc6c424d38ce13ba40b0e694517ccf79fe133ba9759df4a5c2ad25ac350f221cc1bbae6e52e6cdd3dc31f48e95d385bcc94de417ca4b6cbeaaf83861ac7c5cd31d83249d4031a1436222a69f645b312c16bfb3fa83fd4fb8bd38f1eeef4a9080b1ac9dfe2fe8088b5fdb7bf61389f5e8998f0ebdfcbe0c01464818a64f16ed551ac4c1fd6f8258988806b63c3003f08366837fda7654c29280dd7e75a68da8679a5312ddd25da41895df4ee52b008b381167bc944021b7220805dac986efbde9f839dfc4b1abbe220208349fc0e9bbd0a3722c078b1b9cba2049804807d019ccd4028bea9a0050042ebc1ea4ce270fcc20878e2affffa92fad085972acc33ab14c4e3e5ca73a5ce2f1918eccb06d7cec836d5ada35ebf5a1cde71cc214bf47f01932ad145719c812a18c10551658026ea1e551745d4cf3b9196001040d6db7a98892f4ffd8f030dc222db8befd6072cd64563c157f1a4431a998224b6c4872813ace8339aaa3665cef535a65412f2ec641677c8e19c8d081d1cb5339ae717d9b43f3d5932837941eba284f347f3af8736caf39e0ee5d420f538b722863f446b87bc0f34903dcabe3f18cd1024502e8d2f7208ad8159874e6599632e78950186dce6c758f5e0b2685e05a963541082c70e3dcdac516dacbb720b3cf9c31720336eec8a917c8152725f510e8acf6ef2fec25f41cd60bb0ba3ac26428627d"]}, @generic="192287b28a630d525be460b53e1093679c3090972bbb", @typed={0x8, 0x5e}]}, 0x24a0}], 0x7, &(0x7f0000e4a000)=[@rights={0x14, 0x1, 0x1, [r10, r11]}, @cred={0x18, 0x1, 0x2, r0, r12, r13}], 0x2c, 0x8000}, 0x4000804) [ 71.387579] binder: 11862:11866 unknown command 0 [ 71.393899] binder: 11867:11870 unknown command 0 [ 71.399207] binder: 11867:11870 ioctl c0306201 2000a000 returned -22 [ 71.422001] binder: 11862:11866 ioctl c0306201 2000a000 returned -22 [ 71.431215] binder: 11862:11871 got transaction with invalid handle, 0 [ 71.438107] can: request_module (can-proto-4) failed. [ 71.446653] binder: 11862:11871 transaction failed 29201/-22, size 56-8 line 3049 [ 71.450475] binder: 11867:11872 unknown command 0 [ 71.471135] binder: 11867:11872 ioctl c0306201 2000a000 returned -22 [ 71.471513] binder: BINDER_SET_CONTEXT_MGR already set [ 71.490577] binder: 11862:11871 unknown command 0 [ 71.502586] binder: 11862:11866 ioctl 40046207 0 returned -16 [ 71.505546] binder: 11862:11871 ioctl c0306201 2000a000 returned -22 [ 71.519197] binder: undelivered TRANSACTION_ERROR: 29201 2018/02/10 14:10:13 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000a5000-0x8)) mmap(&(0x7f0000000000/0x19000)=nil, 0x19000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000924000-0xc)='/dev/rfkill\x00', 0x0, 0x0) ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f0000e54000-0x18)={0xaa}) ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f0000008000-0x20)={{&(0x7f0000000000/0x4000)=nil, 0x4000}, 0x1}) readv(r0, &(0x7f00001f3000-0x10)=[{&(0x7f0000002000-0x4e)=""/1, 0x1}], 0x1) ioctl$RNDADDTOENTCNT(r0, 0x40045201, &(0x7f0000b27000)) ioctl$RNDADDTOENTCNT(r0, 0x40045201, &(0x7f0000a81000)=0x80000000000000) ioctl$UFFDIO_UNREGISTER(0xffffffffffffffff, 0xc020aa04, &(0x7f0000008000-0x4)={&(0x7f0000000000/0x2000)=nil, 0x2000}) 2018/02/10 14:10:13 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000013000-0x10)=[], 0x0, 0x0) lremovexattr(&(0x7f0000c8a000)='./file0\x00', &(0x7f00001f4000)=@known='security.selinux\x00') r0 = gettid() r1 = syz_open_procfs(r0, &(0x7f0000d07000)='net/netlink\x00') sysinfo(&(0x7f0000262000)=""/214) pread64(r1, &(0x7f0000f82000-0x800)=""/2048, 0x800, 0x2000800) ioctl$EVIOCREVOKE(r1, 0x40044591, &(0x7f000035d000)=0xc9) 2018/02/10 14:10:13 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) pipe(&(0x7f00004d0000-0x8)={0x0, 0x0}) setsockopt$inet_sctp_SCTP_FRAGMENT_INTERLEAVE(r2, 0x84, 0x12, &(0x7f00006ff000)=0xffff, 0x4) getsockopt$bt_BT_RCVMTU(r1, 0x112, 0xd, &(0x7f00003d9000)=0x80, &(0x7f0000251000)=0x2) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000a000)={0x34e, 0x0, &(0x7f00001e5000-0x8)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000006000-0x54)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000008000-0x30)={0x0, 0x0, &(0x7f0000d06000)=[], 0x0, 0x0, &(0x7f0000176000-0x1)}) 2018/02/10 14:10:13 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r0, r0, &(0x7f0000049000), 0x3d2) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000008000)={&(0x7f000000f000-0xc)={0x10, 0x34000}, 0xc, &(0x7f0000220000)={&(0x7f00008d6000-0x14)={0x14, 0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, {}, []}, 0x14}, 0x1}, 0x0) r1 = userfaultfd(0x80800) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000ff8000-0x20)={{&(0x7f0000012000/0x2000)=nil, 0x2000}, 0x1}) bpf$MAP_CREATE(0x0, &(0x7f0000fb4000)={0x2, 0x8000000000000004, 0x400, 0x7fd, 0x4, 0xffffffffffffffff}, 0x2c) userfaultfd(0x800) clock_gettime(0x0, &(0x7f0000132000)={0x0, 0x0}) socketpair(0x1d, 0x800, 0x4, &(0x7f0000589000)) r4 = syz_open_dev$mouse(&(0x7f00006eb000)='/dev/input/mouse#\x00', 0xde6e, 0x1) timer_settime(0x0, 0x1, &(0x7f000097e000)={{0x0, r3}, {r2, r3+10000000}}, &(0x7f0000939000)) fanotify_init(0x25, 0x802) r5 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000ef2000-0x1d)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f00002d8000-0xc)={0x0, 0x0}, &(0x7f0000d76000-0x4)=0xc) syz_open_procfs(r6, &(0x7f0000013000)='ns/cgroup\x00') openat$ion(0xffffffffffffff9c, &(0x7f0000dd5000)='/dev/ion\x00', 0x800, 0x0) pipe2(&(0x7f000058c000), 0x4800) setsockopt$inet_IP_XFRM_POLICY(r4, 0x0, 0x11, &(0x7f0000e12000-0xe8)={{{@in6=@mcast1={0xff, 0x1, [], 0x1}, @in=@rand_addr, 0x2, 0xbd, 0x3, 0x20, 0xa, 0xa0, 0x80, 0xbf}, {0x0, 0x8, 0x0, 0x3, 0x6, 0x1fa8, 0x8, 0x20}, {0x1719, 0x7fff, 0x7ff, 0x7ff}, 0x1, 0x7, 0x0, 0x1, 0x1, 0x3}, {{@in=@broadcast=0xffffffff, 0x1, 0x7f}, 0xa, @in=@empty, 0xffffffffffffffff, 0x3, 0x0, 0xffffffffffffffbc, 0x20, 0x6, 0x2}}, 0xe8) openat$selinux_policy(0xffffffffffffff9c, &(0x7f000010e000-0x10)='/selinux/policy\x00', 0x0, 0x0) setsockopt$netlink_NETLINK_TX_RING(r5, 0x10e, 0x7, &(0x7f0000ab4000-0x10)={0x6, 0x7, 0x52, 0xfffffffffffffffc}, 0x10) 2018/02/10 14:10:13 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0) r1 = openat$mixer(0xffffffffffffff9c, &(0x7f00006f2000-0xb)='/dev/mixer\x00', 0x492c42, 0x0) getsockopt$netlink(r1, 0x10e, 0xe, &(0x7f0000d71000)=""/116, &(0x7f0000c86000)=0x74) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000272000-0x30)={0x0, 0x0, &(0x7f00001e5000-0x8)=[], 0x0, 0x0, &(0x7f0000006000-0x54)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000-0x30)={0x44, 0x0, &(0x7f0000d06000)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x38, 0x8, &(0x7f000000d000)=[@fda={0x66646185}, @flat={0x73682a85}], &(0x7f0000006000)=[0x20]}}], 0x0, 0x0, &(0x7f0000176000-0x1)}) 2018/02/10 14:10:13 executing program 0: mmap(&(0x7f0000000000/0xf6a000)=nil, 0xf6a000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6_sctp(0xa, 0x1, 0x84) sendto$inet(r0, &(0x7f0000ac1000-0x45)="c4", 0x1, 0x0, &(0x7f00006e2000)={0x2, 0xffffffffffffffff, @loopback=0x7f000001}, 0x10) mmap(&(0x7f0000f6a000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) getsockopt$inet_sctp6_SCTP_ADAPTATION_LAYER(r0, 0x84, 0x7, &(0x7f000055e000), &(0x7f0000f6a000+0x5a5)=0x4) setsockopt$inet_sctp6_SCTP_I_WANT_MAPPED_V4_ADDR(r0, 0x84, 0xc, &(0x7f000056f000-0x4), 0x4) r1 = syz_open_dev$admmidi(&(0x7f0000623000-0xe)='/dev/admmidi#\x00', 0x1, 0x40000) ioctl$TIOCGSOFTCAR(r1, 0x5419, &(0x7f00002a7000-0x4)) getsockname$inet6(r0, &(0x7f0000f69000-0x1c)={0x0, 0xffffffffffffffff, 0x0, @dev}, &(0x7f00002f8000-0x4)=0x1c) 2018/02/10 14:10:13 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = inotify_init1(0x0) r1 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f000084e000-0x19)='/selinux/avc/cache_stats\x00', 0x0, 0x0) ioctl$KVM_GET_XSAVE(r1, 0x9000aea4, &(0x7f0000a55000)) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f00005ba000)={0x0}, &(0x7f00006d3000-0x4)=0xc) fcntl$setown(r0, 0x8, r2) fcntl$getownex(r0, 0x10, &(0x7f0000cc2000)={0x0, 0x0}) ptrace$setopts(0x4206, r3, 0x0, 0x0) 2018/02/10 14:10:13 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$evdev(&(0x7f0000cc9000-0x8)='/dev/input/event#\x00', 0x0, 0x200000) ioctl$EVIOCGRAB(r0, 0x40044590, &(0x7f0000e95000-0x4)) ioctl$TIOCSBRK(0xffffffffffffffff, 0x40044591) request_key(&(0x7f0000102000)='big_key\x00', &(0x7f0000ad3000)={0x73, 0x79, 0x7a, 0x3}, &(0x7f00006cc000-0x40)='deflate\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', 0xffffffffffffffff) ioctl$EVIOCGLED(r0, 0x80404519, &(0x7f0000a68000)=""/148) [ 71.667528] ptrace attach of "/root/syz-executor3"[4169] was attempted by "/root/syz-executor3"[11902] [ 71.675136] binder: 11895:11900 unknown command 0 [ 71.683380] binder: 11894:11898 got transaction with invalid handle, 0 2018/02/10 14:10:13 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000a5000-0x8)) mmap(&(0x7f0000000000/0x19000)=nil, 0x19000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000924000-0xc)='/dev/rfkill\x00', 0x0, 0x0) r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000e54000-0x18)={0xaa}) close(r1) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000008000-0x20)={{&(0x7f0000000000/0x4000)=nil, 0x4000}, 0x1}) readv(r0, &(0x7f00001f3000-0x10)=[{&(0x7f0000002000-0x4e)=""/1, 0x1}], 0x1) ioctl$RNDADDTOENTCNT(r0, 0x40045201, &(0x7f0000b27000)) ioctl$RNDADDTOENTCNT(r0, 0x40045201, &(0x7f0000a81000)) ioctl$UFFDIO_UNREGISTER(r1, 0xc020aa04, &(0x7f0000008000-0x4)={&(0x7f0000000000/0x2000)=nil, 0x2000}) readv(r0, &(0x7f0000b28000)=[{&(0x7f0000eda000)=""/153, 0x99}, {&(0x7f00009f5000-0x2d)=""/45, 0x2d}], 0x2) 2018/02/10 14:10:13 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000ca1000-0x1c)={0x1, 0x4, 0x4, 0x9, 0x1, 0xffffffffffffffff}, 0x1c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f00007f5000-0x20)={r0, &(0x7f000082a000-0x1), &(0x7f0000a68000)="a2"}, 0xffffffffffffffef) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000f54000-0x10)={r0, &(0x7f0000d05000)}, 0x10) [ 71.707899] binder: 11895:11900 ioctl c0306201 2000a000 returned -22 [ 71.722481] binder: 11894:11898 transaction failed 29201/-22, size 56-8 line 3049 [ 71.733009] binder_alloc: binder_alloc_mmap_handler: 11894 20000000-20002000 already mapped failed -16 [ 71.742648] can: request_module (can-proto-4) failed. [ 71.753520] binder: 11895:11900 unknown command 0 2018/02/10 14:10:13 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket(0x1c, 0x2, 0x0) bind(r0, &(0x7f000002f000-0x80)=@ax25={0x3, {"310d373fbf64b9"}}, 0x24) ioctl$SIOCGIFHWADDR(r0, 0x8927, &(0x7f0000fde000)={@generic, @ifru_names=@syzn}) 2018/02/10 14:10:13 executing program 1: mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$vcsa(&(0x7f0000001000-0xb)='/dev/vcsa#\x00', 0x6, 0x400000) ioctl$TIOCEXCL(r0, 0x540c) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) setsockopt$packet_buf(r0, 0x107, 0xf, &(0x7f00007ca000)="22baa99c61ab0cc36389a94cbd39bb25951f4424ab8ac15ead34ab5b8002876b52306793af21fcdedd90bbcabc342ef6930b2fcaf7fcbc32b6871e1184444e6a7ce6b69601b35fcd2c5bd57e3ea1eb471256db2ed0793ea369be5154635202ce839f27a06f00f1e89d2887e5a6090f212cad4706d9e9e0e3bbdaad7267e40840058c74ba4d76e107d8f0676ff499df89dd835c3e2615b3cab5dcd462f429c6e1f6f1cd907b12258bcb73bf74c4128a5202d41004d25ebfb59a5a426a0652748c4a30671ceb6b5418550638bbcf4f23b7ec", 0xd1) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f00007b7000-0x9)='/dev/ppp\x00', 0x0, 0x0) ioctl$EVIOCGPROP(r1, 0xc004743e, &(0x7f0000413000-0xf6)=""/246) syz_open_dev$evdev(&(0x7f0000ffb000)='/dev/input/event#\x00', 0x8, 0x0) poll(&(0x7f0000849000)=[{r1}], 0x1, 0x3f) ioctl$EVIOCGREP(r1, 0x4004743c, &(0x7f00001e9000)=""/174) 2018/02/10 14:10:13 executing program 6: mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) getsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, &(0x7f0000000000), &(0x7f0000010000-0x4)=0x4) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000a000)={0x34e, 0x0, &(0x7f00001e5000-0x8)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000006000-0x54)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000008000-0x30)={0x0, 0x0, &(0x7f0000d06000)=[], 0x0, 0x0, &(0x7f0000176000-0x1)}) [ 71.754985] binder: BINDER_SET_CONTEXT_MGR already set [ 71.760951] binder: 11895:11900 ioctl c0306201 2000a000 returned -22 [ 71.766147] binder_alloc: 11894: binder_alloc_buf, no vma [ 71.775935] binder: 11894:11910 transaction failed 29189/-3, size 56-8 line 2957 [ 71.787000] binder: 11894:11898 ioctl 40046207 0 returned -16 [ 71.824603] binder: undelivered TRANSACTION_ERROR: 29189 [ 71.836795] binder: 11923:11924 unknown command 0 [ 71.854280] binder: 11923:11924 ioctl c0306201 2000a000 returned -22 [ 71.860971] binder: undelivered TRANSACTION_ERROR: 29201 [ 71.868285] PPPIOCDETACH file->f_count=2 2018/02/10 14:10:13 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r0, r0, &(0x7f0000049000), 0x3d2) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000008000)={&(0x7f000000f000-0xc)={0x10, 0x34000}, 0xc, &(0x7f0000220000)={&(0x7f00008d6000-0x14)={0x14, 0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, {}, []}, 0x14}, 0x1}, 0x0) r1 = userfaultfd(0x80800) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000ff8000-0x20)={{&(0x7f0000012000/0x2000)=nil, 0x2000}, 0x1}) bpf$MAP_CREATE(0x0, &(0x7f0000fb4000)={0x2, 0x8000000000000004, 0x400, 0x7fd, 0x4, 0xffffffffffffffff}, 0x2c) userfaultfd(0x800) clock_gettime(0x0, &(0x7f0000132000)={0x0, 0x0}) socketpair(0x1d, 0x800, 0x4, &(0x7f0000589000)) r4 = syz_open_dev$mouse(&(0x7f00006eb000)='/dev/input/mouse#\x00', 0xde6e, 0x1) timer_settime(0x0, 0x1, &(0x7f000097e000)={{0x0, r3}, {r2, r3+10000000}}, &(0x7f0000939000)) fanotify_init(0x25, 0x802) r5 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000ef2000-0x1d)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f00002d8000-0xc)={0x0, 0x0}, &(0x7f0000d76000-0x4)=0xc) syz_open_procfs(r6, &(0x7f0000013000)='ns/cgroup\x00') openat$ion(0xffffffffffffff9c, &(0x7f0000dd5000)='/dev/ion\x00', 0x800, 0x0) pipe2(&(0x7f000058c000), 0x4800) setsockopt$inet_IP_XFRM_POLICY(r4, 0x0, 0x11, &(0x7f0000e12000-0xe8)={{{@in6=@mcast1={0xff, 0x1, [], 0x1}, @in=@rand_addr, 0x2, 0xbd, 0x3, 0x20, 0xa, 0xa0, 0x80, 0xbf}, {0x0, 0x8, 0x0, 0x3, 0x6, 0x1fa8, 0x8, 0x20}, {0x1719, 0x7fff, 0x7ff, 0x7ff}, 0x1, 0x7, 0x0, 0x1, 0x1, 0x3}, {{@in=@broadcast=0xffffffff, 0x1, 0x7f}, 0xa, @in=@empty, 0xffffffffffffffff, 0x3, 0x0, 0xffffffffffffffbc, 0x20, 0x6, 0x2}}, 0xe8) openat$selinux_policy(0xffffffffffffff9c, &(0x7f000010e000-0x10)='/selinux/policy\x00', 0x0, 0x0) setsockopt$netlink_NETLINK_TX_RING(r5, 0x10e, 0x7, &(0x7f0000ab4000-0x10)={0x6, 0x7, 0x52, 0xfffffffffffffffc}, 0x10) 2018/02/10 14:10:13 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$evdev(&(0x7f0000dda000-0x12)='/dev/input/event#\x00', 0x0, 0x0) ioctl$EVIOCGRAB(r0, 0x40044590, &(0x7f0000e95000-0x4)) ioctl$TIOCSBRK(0xffffffffffffffff, 0x40044591) request_key(&(0x7f0000102000)='big_key\x00', &(0x7f0000ad3000)={0x73, 0x79, 0x7a, 0x3}, &(0x7f00006cc000-0x40)='deflate\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', 0xffffffffffffffff) 2018/02/10 14:10:13 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dspn(&(0x7f000088d000)='/dev/dsp#\x00', 0xca2, 0x400000) ioctl$SNDRV_CTL_IOCTL_POWER_STATE(r0, 0x800455d1, &(0x7f0000818000)=""/254) sched_setaffinity(0x0, 0x8, &(0x7f00000a5000-0x8)) mmap(&(0x7f0000000000/0x19000)=nil, 0x19000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r1 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000924000-0xc)='/dev/rfkill\x00', 0x0, 0x0) r2 = userfaultfd(0x0) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000e54000-0x18)={0xaa}) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000008000-0x20)={{&(0x7f0000000000/0x4000)=nil, 0x4000}, 0x1}) readv(r1, &(0x7f00001f3000-0x10)=[{&(0x7f0000002000-0x4e)=""/1, 0x1}], 0x1) sendmsg$nl_xfrm(r1, &(0x7f00009a2000)={&(0x7f00009ab000-0xc)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000ab5000)={&(0x7f0000b9c000)=@flushpolicy={0x2d8, 0x1d, 0x100, 0x5, 0x2, "", [@algo_auth={0x110, 0x1, {{'sha512-generic\x00'}, 0x638, "21c79b468109625fe3e76f7333b7d71807d9507737dc4db4dae3ed90eb65f69491914d060ed0a0a144d7260c16ffdd29d6ca16e478a8de28f7dc6daf9205cd8ba659d3d8f74336e7ff5897206176c6206166d1ca70da333877e4fc657f53c60355eae5ab6eaf71d0d4d2799566d519757c06344615048da37698b65c47fef1789a08c3e5aa349e2d75f15215d3d9b7d44bf6c58aa1aaa5e8ba4dce563fe64ccb5ac6550ffc1a4e70e0df139541e3cde36e0dcd89c535019b41ad572314b44268f95c1b6ac9d5cb"}}, @algo_auth={0xbc, 0x1, {{'rmd256\x00'}, 0x3a0, "83ac8e5b24f409e7183d1486e3affdf96d500647806b7399be397d16cec3a2c4ee0f3d483016fa1d6611f40f552a9254f2db443323b5fd46e69e0ec10cb1f1242a86b5ae3aaec7d31da37946abcbcfc2d445f597de4129016cf26df640a236b90e5f241cd1b270c5ca85f473b08c3495dd9da210"}}, @proto={0x8, 0x19, 0xff}, @extra_flags={0x8, 0x18, 0x5}, @replay_esn_val={0x44, 0x17, {0xa, 0x0, 0x3, 0x4, 0x2, 0x200, [0x4, 0xffe0000000000, 0x5, 0x8, 0x0, 0x7d3a, 0x5, 0x3f, 0x10001, 0x4]}}, @replay_val={0x10, 0xa, {0x7, 0x7, 0x5}}, @algo_aead={0x88, 0x12, {{'seqiv(seqiv(gcm_base(ecb-aes-aesni,wp512-generic)))\x00'}, 0x1c8, 0x1a0, "a5e6169559932e33881a831e485cd0e16f218095acbaf7f5bc9a07dea14b8c47831eb6a0f4af8f2d5f3c8fe4090a348a411ff44e25fab29063"}}, @output_mark={0x8, 0x1d, 0x6}, @proto={0x8, 0x19, 0x6c}]}, 0x2d8}, 0x1, 0x0, 0x0, 0x4000}, 0x4051) ioctl$RNDADDTOENTCNT(r1, 0x40045201, &(0x7f0000b27000)) ioctl$RNDADDTOENTCNT(r1, 0x40045201, &(0x7f0000a81000)) ioctl$UFFDIO_UNREGISTER(r2, 0xc020aa04, &(0x7f0000008000-0x4)={&(0x7f0000000000/0x2000)=nil, 0x2000}) socket$inet6_sctp(0xa, 0x5, 0x84) write(r1, &(0x7f000024c000-0x1000)="98039723546ddfd2a00848f4c774caeede9cad4d8cd8ddde16967f6641d1bbfa373a18af2e2e7b4d9108cf000c694421e0f2bab9510bc19d967a4489eb749cf1666e649b18b10d43c85fb8d69b3160e71d87b10a0c4f15aa7c2605b0a473969c3db337d72caa07563679cb9644b2dd8be4007f05e888d7a30e82fa2f2fa065f4a4ad275747c9de727ae2a224b03865a25a074de85fca6d616cffff7f84c7af97e5c50b65411b6969c5916c81730820a5bcff25ebe609b31dd0d6d4464151082603db27b734cf2f50bdd9c23adb3510c61bca0ae058cf8f713f6c123cf55f9fcdfd5811689eb016888a4d406c66915e55ff39a212e585f385e39eb137048d10776d3d29190796cb799136a3e29c5ce03fb88d0c7e3c918166b64f064262177a116e4910470bc655f4acda394454500f042b4d3535153f228ba3bc9a23f2e8ad784595f000a0f01a82aa476c68b4722a4b2c153638b8bc2a53ef932e7babe026f7c55fb1b377ffbd0ceb1e5dbebf0397b36eef23fda2b29f7b07c3ae6074e255ee845f41d44c5897c7a7b952351c7940b291a480575b28325a44e2099fcdc03ee47b149c6421bc91b9842f1386b02a71d13d6feba89cf7af9d5d35c9085f21c34a5bac02351aabef3e3b9255e2a5686a10f5874af952706212994a699929b86eb6ad325f64738702178cc28b5a98c5400fee7deebd2296a5d322922be2b8f3d8e174b6d996c174b253c27383bb4139175196618b4e13b9262f4a79fd041aaba35f53d35b396307e9342b23ed26fbe348795c81d8c44345e1c25505ab89bedd6cd9996fa9f6f499887f8e839d138027edf1444332bcf74e08c2f418611cba9806c24ec3398aa5988fca5b3888f6f075ce049473ac3e8b55ddd3a36b849e907bfeceed879f522b1d003084d7c4bac9b90435e03e1993df0df52e41ec433ea9b96ba721f63f9909686cfabafdb9a5d02ea75c6c2d1ea9b437670de08ae0b8f946c7ae8475471853a44ee61728cc0eba3dada84bdbb2eabdf24efdc135c284830a5d0fbd1ddf91c330e3ddf43b6e19d28e5ac9bdfa1bbf2ee1e96e168c420f22475c26d4fae230d88cff6b648f139febd99995e099a2c0a07492832996bac40c4a5f1a2dbe19bf1e4309e4090cb3d93a2a72bf295eb4b408f27929a03e5fe2869bb145d26de977745acd6b0f9672111b1c336c133c818e7ce71f6b1e40baa1a1919e5a2e6e5d3952c3c79af897fbfd799ad7bf4f5b42751c27ff451a617aeb0d6b873d4ea4bbb805e1498aaddcafd9ef9f7f291c23bdb4914da9a3ec1ffbb6a277314acbd03fba83f98f9f76ae54f7b0d40497bc572ef85533bc5c8de9796485f7266dbb1ee095a87144532b3d499fbb91f9359ea872e9caf22056a9c58941f10f2b31078daffe4255baf5b7146bdefec3bdefb33e753bbaf58b27bffedb3bd91173d6dd5a5f3d7cc09b6d9e2a13f33993199995bfa27e28882a5ca12e9772c0af23f442e3cfbd6b90b3ce157e785f2c775a55a278b86c308055a32e72a6dd91a9e11ff289c3273b0b0906ec2b99f8a8c6aa9fc2c12b0c0e1a2df0fe3b792a05f4fda823edd342032f3be1dfa1fbfcdab8e335bcbabc71f278f21114f69c15a91cfa2b93ab95a57d055b2a68078876ce56e4e3be2668fffde6a39e9059666db75c791899c619b14e19cd382789337bde8f68768dfd8d37088cbb84b8d7cb0e90b796535bf5e2d491e4fe179416df69d954fcbae0675c6bea8644e7beb0dcd91aba60e7bd3dfb9d07ca22a42d6d8053faf5450b7021208e0b3883fce1fb521597696adee5f3d77ea326ef452578a3ac69806de003fc031375e3ce7bf77ee20d3a00429e0fddd7f523766e41856e3d52af6e576fcff4ce8cb0b98d7404d703fb6a8987187281097b9d135d49df9d8c796beb729f1a0d48f209247a20922e3bbb3f04ed7f99a5f203980d86927f11da64039e8ade42c5ad74b796b26478996508463ad311f3d67adab4fc5dfc1ec8cfd6401cdc238a475f9e97f72efc68c8ea0e117f9cb751a89edd59cb52b335026a828aeac88d541a5596996e85eb78e12bd40d7dea97e5eb36dffacf27b41bb3d544a96876e6ae9e6bfefc902a18790e01edd461914a5e9b20624d3411f2c46e8acb7999e47d0b7af28cebb06e0ec3282423ca2c3f10dcb0dba4889bd8f9aa36f203e99b01263614ec2cb260827d2f9edd29a48fed28fee392ac85b937fab9401e9e9e3436e04681c6a2e843cd18060eaf2e62db9f5ffd7ff210e16aaf45886fb602bf27783b56e7bcc370283a1d48bbd9658adfc150f9794bc4b2a492184aa521744f599e823f3c231a8cc26a28c117849b132692ccc1118218046b64c8e3f0f9917fa08f7589ab43aa5b099f8c6fc4a5607f213ccead4e6f9baaa1fd1a2801c092d5bc1f5f787db5acf887bb50eeae2c6f768792ec7a285d58c5d450658c73de058cf0b3a751a15c2958ece13baab8c97f61a39409924443e80458bb93200184d043b9455071c79b1d48f0d3a14b2bdc4128f3b27d43252b40a6b9e89598f6a403b232a3cd0e69e7e330442090d1754483bb7fef5c1c18e87d11b07816930e07b67da04ace905b4f7d32caa1f6aa951a3858ff1bf31d411fce6c0ae7fa868761aa24a7e710801d0efe4965669140db844e6b29065e2e2d6560ea606e6095ec6743e6f7bfc54dfd8dc0a881208a972cb25b7591f7ad5f16314791fa04ef96fe6a34096b9662c08f9d32d292df69a0e7ec631b06b902f69227e0bdb8527f29fb3d114cf2c157dcf64078c024c28f4963bd0097c23bb9046a814eba7e193a62c9132f0e0065d4b1279c14ef7838c8fff17c24406001a77dcb7c1025b5e8ff037a8f099b3ec71e50f1e2dbdf3354235b0b109550e07096f90fa5f4e89ba308a3b6ad662bf180079798bbc5af2ca46177c3cbb1819dc988b84549e1b357f93c44a6baeeeb31669dfa8717e40e3cc9f12595fbdc170feba96ab0bd9cb143bd6664356194d23c7c276e0fce0b7edb19ab22abaa2bd763b8c3c15cc2969a215f10c733df6dea6c503c721b5a18c06cdd9dfe73150bd3d420bea8dfa9127ae07bd9cbb5cb5190ab723e2f26b9198a5e130bfd452ccc0fa9ca93e2b2a07f9c81d768d856e9ab8b94410feab3569708f8d59b3a0361c8f00e42bad028bbf31c523c0c356bd70c5936457bf528850d1024a6da52e6642756a1cd27e53440a07f53401cb9f983fbc5d0d58a53c076d719c54258c3a8da0e2ad80c756dc08d8c7ddc4e7c251c9ee5526f3fe813afbc9d7ba3eb92b7cf2624edbeddfa2ff4f18099009230d455c957a134451b2a146ea1ce9493a4f40d251c927f3af8e23e701b3cc9cfeaf3a9653f955c605d7005ce068c84e408914076898784b9bf4c9a5075c46770b2a2c6af5d5e7b31c62da840f3dbbab230860cb69aedd9c86c545b996cc8398371ab062a93ac1da2b019f75ddbdd1cd7266fe6ed2350ab9f8f804ef4262472589a925ff05074f7ba4bb1f0b1e9e4021218435da454d491f2703c501440f777586b87a14647bfb0d390b75ee863743cddd339e8c74c9e51e3a491266f160815143dd9bc1b6e92ec038db6836612325fbce003a55c9e027ed2cc1d7aa133906c446b5301b92601eb2fe96bad384db13f6c97dfe21c35a78e28445394fd761c95de4d5bcbfe342553938f21cb09e0f9d2c8912250790ab8a3dbc3e6a6249457b793961e8416c15a5a9e8beac5194f4f91ed2bf6033fb51f05f35a6d15fab7a1308c88bf3ea7a27b078b5058075f00a268c8e7766d7830fb2803ea0b7689f44bd4f6f6d741faa2cb5477c3f46c40a7a8922ba806a7e242a398c60d61d7940e1f9a823c5bd07ac05fcdd30d9f4f5973013e1d7b453c8bc8b42cbb7ba773874b0b4313da4b22ca8ec124cd658c9768d5acd51457de9dad1a1bdf6e7b7061716344ef16a889043a57f8108f13cb4b40fa751b20128305892b185c80e640560203940ac79537ec50e833448dbc7f7311aa2c65077e6fb4c9aa3444a6001126a055a0ee4ca203b7ef766bec091d6cd8a20e9bc3703034c0f255d5f27a78c3616c893439ee818ba64c3fda8d2d2e845c7e3e59990f573ef892419a67cf0b4b7752962c9d0d124794e991255eed070929b3765b8dc24457e66394615801bb454988f80035999d3c3fc5196540442efe79185888de79eb04fc5d8d21064d590164887d70787d1e526ce6779e04f537122fdd209204a3137dd25a0144198c1fa8f0c41dda71f0c042f49aea43e6f3e823e7676305bd749ae602bcb868899122c02503310e3047c05d08305a37be908773cd3d4e7f1b15858e76288a0398a00f61bf71656ccdb5b2717356fd22d2a832d7f140e706a7220bf2db40257925b5ca0c94b3092185d18f20b6fb895a08d45e5efa8a14927dc2858aca048dc74f919b44dceeaa23af0049ed4f2e8442d97f31fc29749fe9f019f127e8444fbdac5a4aa825900eaa9e056259f81f942dca503ab984c503d69835edf564ca90204ea3419c06a0cf0b39db1e0f561a88e8f4e723874f2981cbc8c6bceeb6497dbc40032ad5230e700f1c74976f1abeb8e7c092381e1bb3d70e5ea373229121067c925e624d0de67f511f8c62522474d509d06ae52607f06786a259662dba25951247d0fe5faddbb238fcb44bdbe1a4880ddf4d858e00ccacc339d84d683f4ad4f2fecbf15e07db5ce80157715609368858d6a53f5ebb3372a38a49fbeffd3b0b2add4e4fa55f3c4b2b19816e2dbd6a014a478a416274695fdf36dcb02cced01769c88344bfd05ece04a8264b8ac421fd9e57625ce685d663c543c1834f767b47e1c2bfbf87fe2d09a9b08651de78d078944b69dabdbacfbd74b21d741723a254d8d4ca626059d965f1223b38a4e4db367d296c0f193e143b927b6a0fde01abf07a636daa85f3d85dbab94a51623af5230bea6f8787536267091e73b390025c591fb6ccdeb070b2e0751c70eb080b2346656a9a678c0083410c1464e348b5b9d62e0b8cb02eae00f09c204096a6f2d48ad55675cf7877056490b1e8b848396ec68f5a384ee9167d3d2541582ab94fb7e9d8e836de213c286e618b15d443b00a7ba1e4f54d2f23d90de3944b8cef89e77ff21dc672370dc242099fb46871ea76d38bdb6a4b6666a5779026f739b85d2908d6fa50f611fc1eddea192eb4c2b24f24953e66c41c57ea43317bf633f7a6749d1a89f497b1c7e633b0ccbb782d1e9d4a9d4916756e71c4f14245413e2a13acfd5cac32295cea6e6ce3b3a8c502a972a3860ec5b0eb08e938eb93c5575f0d86eec9fa9469d4f992c14ed4ab7239a78ab3d0653518ac18620c060f81cdabb096892370f0856275738879aa096550d29c439408ac376e2cd08e7be732733a633da1ca162e13ff582fcbb963dc2e4df07091cad8814af386e71481044958d307f15587219257699dee8c9bc8b57abcdb55347c364b83eb08bc798dedee68f8b886134c0bca1b55208b60b03dfa7846141efac6c21c251f13bffa3fbdea8f49157383b2d861f94c331369b068745f7903311c07a2ecaffeec5906df418b84bdf83aa7fa3b7dc5804fc98ece7b76e53033b29e7b68d99af6ed13114d323be9369720e792288b78ead7d1a3271ef66d0dfb2a16c5dff1f2f9bab8721509ff338a23a610fae86bab36c26bae7cad1615cdda5568b189ba1c6701023c72d52589ea0a1f1efe393ff3d27bd5d6be238398f04e046f5eedd250df3cdb65aab4e3ae4a2b081a6d0118c5758368620ae5f71175e653b80437c1b3", 0x1000) 2018/02/10 14:10:13 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket(0x40000000015, 0x5, 0x0) getsockopt(r0, 0x100000001, 0x2, &(0x7f000074b000)=""/95, &(0x7f0000f7d000-0x4)=0x5f) 2018/02/10 14:10:13 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000c9d000-0x11)='/selinux/enforce\x00', 0x20000, 0x0) ioctl$TIOCSLCKTRMIOS(r1, 0x5457, &(0x7f0000087000-0x24)) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000a000)={0x34e, 0x0, &(0x7f00001e5000-0x8)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000006000-0x54)}) r2 = gettid() tkill(r2, 0x2a) ptrace$peekuser(0x3, r2, 0x7) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000-0x30)={0x44, 0x0, &(0x7f0000d06000)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x38, 0x8, &(0x7f000000d000)=[@fda={0x66646185}, @flat={0x73682a85}], &(0x7f0000006000)=[0x20]}}], 0x0, 0x0, &(0x7f0000176000-0x1)}) 2018/02/10 14:10:13 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) getsockopt$sock_cred(0xffffffffffffff9c, 0x1, 0x11, &(0x7f00005de000)={0x0}, &(0x7f0000436000)=0xc) r2 = fcntl$getown(r0, 0x9) kcmp(r1, r2, 0x3, r0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000a000)={0x34e, 0x0, &(0x7f00001e5000-0x8)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000006000-0x54)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000008000-0x30)={0x0, 0x0, &(0x7f0000d06000)=[], 0x0, 0x0, &(0x7f0000176000-0x1)}) ioctl$fiemap(r0, 0xc020660b, &(0x7f0000909000)={0x9, 0x1, 0x5, 0x85de, 0x2, [{0x3, 0x4, 0x5, 0x0, 0x0, 0x2004}, {0x200, 0x20, 0x3c, 0x0, 0x0, 0x4}]}) madvise(&(0x7f000020c000/0x1000)=nil, 0x1000, 0xd) munmap(&(0x7f0000c20000/0x4000)=nil, 0x4000) 2018/02/10 14:10:13 executing program 3: mmap(&(0x7f0000000000/0xb4a000)=nil, 0xb4a000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$admmidi(&(0x7f00009c0000)='/dev/admmidi#\x00', 0x5, 0x82000) mmap(&(0x7f0000b4a000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) setsockopt$RDS_FREE_MR(r0, 0x114, 0x3, &(0x7f0000b4b000-0x10)={{0x7, 0x3}}, 0x10) r1 = socket$inet(0x2, 0x2, 0x0) capset(&(0x7f0000000000)={0x19980330}, &(0x7f0000002000-0x18)) setsockopt$inet_opts(r1, 0x0, 0x4, &(0x7f000088f000)="8608006600", 0x5) 2018/02/10 14:10:13 executing program 1: mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$vcsa(&(0x7f0000001000-0xb)='/dev/vcsa#\x00', 0x6, 0x400000) ioctl$TIOCEXCL(r0, 0x540c) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) setsockopt$packet_buf(r0, 0x107, 0xf, &(0x7f00007ca000)="22baa99c61ab0cc36389a94cbd39bb25951f4424ab8ac15ead34ab5b8002876b52306793af21fcdedd90bbcabc342ef6930b2fcaf7fcbc32b6871e1184444e6a7ce6b69601b35fcd2c5bd57e3ea1eb471256db2ed0793ea369be5154635202ce839f27a06f00f1e89d2887e5a6090f212cad4706d9e9e0e3bbdaad7267e40840058c74ba4d76e107d8f0676ff499df89dd835c3e2615b3cab5dcd462f429c6e1f6f1cd907b12258bcb73bf74c4128a5202d41004d25ebfb59a5a426a0652748c4a30671ceb6b5418550638bbcf4f23b7ec", 0xd1) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f00007b7000-0x9)='/dev/ppp\x00', 0x0, 0x0) ioctl$EVIOCGPROP(r1, 0xc004743e, &(0x7f0000413000-0xf6)=""/246) syz_open_dev$evdev(&(0x7f0000ffb000)='/dev/input/event#\x00', 0x8, 0x0) poll(&(0x7f0000849000)=[{r1}], 0x1, 0x3f) ioctl$EVIOCGREP(r1, 0x4004743c, &(0x7f00001e9000)=""/174) [ 71.883369] binder: 11923:11924 Acquire 1 refcount change on invalid ref 0 ret -22 [ 71.891143] binder: 11923:11924 unknown command 0 [ 71.896206] binder: 11923:11924 ioctl c0306201 2000a000 returned -22 2018/02/10 14:10:14 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00009f2000)={0x26, 'skcipher\x00', 0x0, 0x0, 'salsa20\x00'}, 0x58) pipe(&(0x7f00006ec000)={0x0, 0x0}) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f000060d000-0xc)={0x0, @broadcast, @loopback}, &(0x7f0000dc0000-0x4)=0xc) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00004f7000)="649c47ad46390d006dc80000009d4d54", 0x10) r2 = dup(r0) r3 = accept4$alg(r2, 0x0, 0x0, 0x0) io_setup(0x3, &(0x7f0000cae000-0x4)=0x0) io_submit(r4, 0x1, &(0x7f000049c000-0x18)=[&(0x7f00004dc000-0x40)={0x0, 0x0, 0x0, 0x0, 0x0, r3, &(0x7f0000392000-0x1000)="83", 0x1, 0x0, 0x0, 0x0, 0xffffffffffffffff}]) 2018/02/10 14:10:14 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = accept4$inet(0xffffffffffffff9c, &(0x7f0000c76000-0x10)={0x0, 0xffffffffffffffff, @multicast1}, &(0x7f0000404000)=0x10, 0x800) r2 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f000077c000)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) ioctl$LOOP_GET_STATUS(r2, 0x4c03, &(0x7f00005b4000)) ioctl$sock_ifreq(r1, 0x8913, &(0x7f0000153000)={@syzn={0x73, 0x79, 0x7a, 0x0}, @ifru_flags}) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r3 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000e96000)='/selinux/avc/cache_stats\x00', 0x0, 0x0) ioctl$KVM_SET_PIT2(r3, 0x4070aea0, &(0x7f0000de8000)={[{0x10001, 0x3, 0x1f, 0x9, 0x4, 0x7, 0x1f, 0x400, 0x3ff, 0x9, 0xa25, 0x0, 0x400}, {0xb3c, 0x7, 0x98, 0x3f, 0x7fff, 0x2, 0x5, 0x2, 0x10000, 0x1000, 0x400, 0x100000000, 0xda46}, {0x9, 0x81, 0xfff, 0x9, 0x5, 0x3, 0x9, 0x4, 0xfffffffffffeffff, 0x10000, 0x4, 0x9, 0x8}], 0x7}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000a000)={0x34e, 0x0, &(0x7f00001e5000-0x8)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000006000-0x54)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000-0x30)={0x44, 0x0, &(0x7f0000d06000)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x38, 0x8, &(0x7f000000d000)=[@fda={0x66646185}, @flat={0x73682a85}], &(0x7f0000006000)=[0x20]}}], 0x0, 0x0, &(0x7f0000176000-0x1)}) r4 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000323000)='/selinux/commit_pending_bools\x00', 0x1, 0x0) ioctl$DRM_IOCTL_AGP_ALLOC(r2, 0xc0106434, &(0x7f0000321000)={0x80000000, 0x0, 0x1, 0x7}) ioctl$DRM_IOCTL_SG_ALLOC(r2, 0xc0086438, &(0x7f00005cc000-0x8)={0x4, r5}) ioctl$KVM_GET_PIT(r4, 0xc048ae65, &(0x7f000093e000)) [ 71.937680] binder: 11937:11944 unknown command 0 [ 71.940330] binder: 11943:11945 unknown command 0 [ 71.946456] binder: 11937:11944 ioctl c0306201 2000a000 returned -22 [ 71.952899] binder: 11943:11945 ioctl c0306201 2000a000 returned -22 2018/02/10 14:10:14 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mkdir(&(0x7f00009e5000-0x8)='./file0\x00', 0x0) mount(&(0x7f0000213000-0x8)='./file0\x00', &(0x7f000001c000)='./file0\x00', &(0x7f0000e76000-0x7)='mqueue\x00', 0x0, &(0x7f0000479000)) creat(&(0x7f0000dd5000)='./file0/bus\x00', 0x0) mount(&(0x7f0000122000-0x8)='./file0\x00', &(0x7f000081c000-0xc)='./file0/bus\x00', &(0x7f000094c000-0x7)='mqueue\x00', 0x0, &(0x7f0000a67000)) [ 71.983184] can: request_module (can-proto-4) failed. [ 71.999636] binder: 11943:11945 Acquire 1 refcount change on invalid ref 0 ret -22 [ 72.007590] binder: 11943:11945 unknown command 0 [ 72.016671] PPPIOCDETACH file->f_count=2 [ 72.020413] binder: 11956:11958 unknown command 0 [ 72.026161] binder: 11956:11958 ioctl c0306201 2000a000 returned -22 [ 72.036101] binder_alloc: 11956: binder_alloc_buf, no vma [ 72.041807] binder: 11956:11958 transaction failed 29189/-3, size 56-8 line 2957 [ 72.050523] binder: 11943:11945 ioctl c0306201 2000a000 returned -22 [ 72.081349] binder: BINDER_SET_CONTEXT_MGR already set [ 72.086837] binder: 11956:11968 ioctl 40046207 0 returned -16 [ 72.095924] binder: 11956:11958 unknown command 0 [ 72.100877] binder_alloc: 11956: binder_alloc_buf, no vma [ 72.106083] binder: 11956:11958 ioctl c0306201 2000a000 returned -22 [ 72.106461] binder: 11956:11968 transaction failed 29189/-3, size 56-8 line 2957 2018/02/10 14:10:14 executing program 1: mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$vcsa(&(0x7f0000001000-0xb)='/dev/vcsa#\x00', 0x6, 0x400000) ioctl$TIOCEXCL(r0, 0x540c) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) setsockopt$packet_buf(r0, 0x107, 0xf, &(0x7f00007ca000)="22baa99c61ab0cc36389a94cbd39bb25951f4424ab8ac15ead34ab5b8002876b52306793af21fcdedd90bbcabc342ef6930b2fcaf7fcbc32b6871e1184444e6a7ce6b69601b35fcd2c5bd57e3ea1eb471256db2ed0793ea369be5154635202ce839f27a06f00f1e89d2887e5a6090f212cad4706d9e9e0e3bbdaad7267e40840058c74ba4d76e107d8f0676ff499df89dd835c3e2615b3cab5dcd462f429c6e1f6f1cd907b12258bcb73bf74c4128a5202d41004d25ebfb59a5a426a0652748c4a30671ceb6b5418550638bbcf4f23b7ec", 0xd1) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f00007b7000-0x9)='/dev/ppp\x00', 0x0, 0x0) ioctl$EVIOCGPROP(r1, 0xc004743e, &(0x7f0000413000-0xf6)=""/246) syz_open_dev$evdev(&(0x7f0000ffb000)='/dev/input/event#\x00', 0x8, 0x0) poll(&(0x7f0000849000)=[{r1}], 0x1, 0x3f) ioctl$EVIOCGREP(r1, 0x4004743c, &(0x7f00001e9000)=""/174) 2018/02/10 14:10:14 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r0, r0, &(0x7f0000049000), 0x3d2) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000008000)={&(0x7f000000f000-0xc)={0x10, 0x34000}, 0xc, &(0x7f0000220000)={&(0x7f00008d6000-0x14)={0x14, 0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, {}, []}, 0x14}, 0x1}, 0x0) r1 = userfaultfd(0x80800) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000ff8000-0x20)={{&(0x7f0000012000/0x2000)=nil, 0x2000}, 0x1}) bpf$MAP_CREATE(0x0, &(0x7f0000fb4000)={0x2, 0x8000000000000004, 0x400, 0x7fd, 0x4, 0xffffffffffffffff}, 0x2c) userfaultfd(0x800) clock_gettime(0x0, &(0x7f0000132000)={0x0, 0x0}) socketpair(0x1d, 0x800, 0x4, &(0x7f0000589000)) r4 = syz_open_dev$mouse(&(0x7f00006eb000)='/dev/input/mouse#\x00', 0xde6e, 0x1) timer_settime(0x0, 0x1, &(0x7f000097e000)={{0x0, r3}, {r2, r3+10000000}}, &(0x7f0000939000)) fanotify_init(0x25, 0x802) r5 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000ef2000-0x1d)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f00002d8000-0xc)={0x0, 0x0}, &(0x7f0000d76000-0x4)=0xc) syz_open_procfs(r6, &(0x7f0000013000)='ns/cgroup\x00') openat$ion(0xffffffffffffff9c, &(0x7f0000dd5000)='/dev/ion\x00', 0x800, 0x0) pipe2(&(0x7f000058c000), 0x4800) setsockopt$inet_IP_XFRM_POLICY(r4, 0x0, 0x11, &(0x7f0000e12000-0xe8)={{{@in6=@mcast1={0xff, 0x1, [], 0x1}, @in=@rand_addr, 0x2, 0xbd, 0x3, 0x20, 0xa, 0xa0, 0x80, 0xbf}, {0x0, 0x8, 0x0, 0x3, 0x6, 0x1fa8, 0x8, 0x20}, {0x1719, 0x7fff, 0x7ff, 0x7ff}, 0x1, 0x7, 0x0, 0x1, 0x1, 0x3}, {{@in=@broadcast=0xffffffff, 0x1, 0x7f}, 0xa, @in=@empty, 0xffffffffffffffff, 0x3, 0x0, 0xffffffffffffffbc, 0x20, 0x6, 0x2}}, 0xe8) openat$selinux_policy(0xffffffffffffff9c, &(0x7f000010e000-0x10)='/selinux/policy\x00', 0x0, 0x0) setsockopt$netlink_NETLINK_TX_RING(r5, 0x10e, 0x7, &(0x7f0000ab4000-0x10)={0x6, 0x7, 0x52, 0xfffffffffffffffc}, 0x10) 2018/02/10 14:10:14 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$mixer(0xffffffffffffff9c, &(0x7f00009fe000-0xb)='/dev/mixer\x00', 0x101041, 0x0) ioctl$KDADDIO(r0, 0x4b34, 0x9) r1 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$KVM_SET_SREGS(r0, 0x4138ae84, &(0x7f0000f49000)={{0x0, 0x100000, 0xf, 0xa0f, 0x80000001, 0x101, 0x5, 0x6, 0x6, 0x3f, 0x40, 0x3f}, {0x0, 0x10f001, 0x4, 0x7f, 0x4, 0x8001, 0x9, 0x4, 0xa4, 0x2, 0x200}, {0x1004, 0x4, 0x0, 0x7, 0x4, 0x6ffc, 0x6, 0x7, 0x100000000, 0x1, 0x0, 0x5}, {0x5000, 0xf000, 0x0, 0x5, 0xec1, 0x0, 0x1, 0x2767, 0x0, 0xf20, 0x7, 0x80000001}, {0x3000, 0x2000, 0x3, 0x100000001, 0xfffffffffffffffd, 0x37d6, 0x1, 0x2, 0xdff2, 0x5, 0x57, 0x9}, {0x2, 0x6000, 0xa, 0x9, 0xffffffff, 0x5, 0xdf, 0x2, 0x43c, 0x101, 0x10001, 0x2}, {0xf000, 0x16000, 0xf, 0x80, 0x0, 0xffffffff, 0x9b, 0xfffffffffffffffd, 0xfa41, 0xfffffffffffffffb, 0x8001, 0x80000000}, {0x1, 0x3001, 0xd, 0x401, 0x7, 0x2, 0x2, 0x0, 0x4, 0xa2aa, 0x6, 0x20}, {0x110002}, {0x6000, 0x103002}, 0x80000000, 0x0, 0x1, 0x0, 0x5, 0xc01, 0x10000, [0x7fff, 0x0, 0x7, 0x7]}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000a000)={0x34e, 0x0, &(0x7f00001e5000-0x8)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000006000-0x54)}) 2018/02/10 14:10:14 executing program 3: mmap(&(0x7f0000000000/0x7000)=nil, 0x7000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$pppoe(0x18, 0x1, 0x0) r1 = dup2(r0, r0) mmap(&(0x7f0000007000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) getsockopt$inet_sctp6_SCTP_PR_STREAM_STATUS(r1, 0x84, 0x74, &(0x7f0000005000)=""/66, &(0x7f0000007000)=0x42) connect$pppoe(r0, &(0x7f0000001000-0x1e)={0x18, 0x0, {0x4, @remote={[0xaa, 0xaa, 0xaa, 0xaa], 0xffffffffffffffff, 0xbb}, @syzn={0x73, 0x79, 0x7a, 0x0}}}, 0x1e) ioctl$PPPOEIOCSFWD(r0, 0x4008b100, &(0x7f0000004000)={0x18, 0x0, {0x4, @remote={[0xaa, 0xaa, 0xaa, 0xaa], 0xffffffffffffffff, 0xbb}, @syzn={0x73, 0x79, 0x7a, 0x0}}}) ioctl$PPPOEIOCDFWD(r0, 0xb101, 0x0) 2018/02/10 14:10:14 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket(0x10, 0x802, 0x40000) sendmsg$nl_route(r0, &(0x7f00001a1000)={&(0x7f0000659000-0xc)={0x10}, 0xc, &(0x7f00006b3000)={&(0x7f0000067000)=@ipv6_deladdr={0x34, 0x15, 0x1, 0xffffffffffffffff, 0xffffffffffffffff, {0xa}, [@IFA_ADDRESS={0x14, 0x1, @mcast2={0xff, 0x2, [], 0x1}}, @IFA_FLAGS={0x8, 0x8}]}, 0x34}, 0x1}, 0x0) 2018/02/10 14:10:14 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000a5000-0x8)) mmap(&(0x7f0000000000/0x19000)=nil, 0x19000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000924000-0xc)='/dev/rfkill\x00', 0x0, 0x0) sync_file_range(r0, 0x0, 0xfff, 0x4) r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000e54000-0x18)={0xaa}) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000008000-0x20)={{&(0x7f0000000000/0x4000)=nil, 0x4000}, 0x1}) readv(r0, &(0x7f00001f3000-0x10)=[{&(0x7f0000002000-0x4e)=""/1, 0x1}], 0x1) ioctl$RNDADDTOENTCNT(r0, 0x40045201, &(0x7f0000b27000)) ioctl$RNDADDTOENTCNT(r0, 0x40045201, &(0x7f0000a81000)) ioctl$UFFDIO_UNREGISTER(r1, 0xc020aa04, &(0x7f0000008000-0x4)={&(0x7f0000000000/0x2000)=nil, 0x2000}) 2018/02/10 14:10:14 executing program 7: mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, &(0x7f0000000000)={0x0, 0x8}, &(0x7f0000001000-0x4)=0x8) setsockopt$inet_sctp6_SCTP_PR_SUPPORTED(r0, 0x84, 0x71, &(0x7f0000001000-0x8)={r1, 0x9}, 0x8) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r0, 0x84, 0x18, &(0x7f0000000000)={r1, 0x2}, &(0x7f0000000000)=0x6) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) execveat(r0, &(0x7f0000fdf000+0xc00)='./file0\x00', &(0x7f0000a30000-0x4)=[&(0x7f000046d000)='selinuxGPL\x00'], &(0x7f00000c6000-0x14)=[&(0x7f00006ef000-0xb)='/dev/audio\x00', &(0x7f00003c0000-0xb)='/dev/audio\x00', &(0x7f0000d8a000)='/dev/audio\x00', &(0x7f0000908000)='/dev/audio\x00', &(0x7f000045b000)='procem0-mime_type}ppp0\x00'], 0x1800) r2 = syz_open_dev$vcsn(&(0x7f0000e8c000-0xa)='/dev/vcs#\x00', 0x9, 0x4080) ioctl$SNDRV_TIMER_IOCTL_PVERSION(r0, 0x80045400, &(0x7f000048d000)) ioctl$PERF_EVENT_IOC_RESET(r2, 0x2403, 0x800) perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$KVM_GET_DIRTY_LOG(r0, 0x4010ae42, &(0x7f000051c000)={0x12711, 0x0, &(0x7f0000711000/0x4000)=nil}) syz_open_dev$evdev(&(0x7f0000dda000-0x12)='/dev/input/event#\x00', 0x0, 0x0) getsockopt$inet_sctp_SCTP_ENABLE_STREAM_RESET(r2, 0x84, 0x76, &(0x7f0000ac4000)={r1, 0x4}, &(0x7f0000fc7000)=0x8) ioctl$EVIOCGRAB(r2, 0x40044590, &(0x7f0000e95000-0x4)) ioctl$TIOCSBRK(0xffffffffffffffff, 0x40044591) request_key(&(0x7f0000102000)='big_key\x00', &(0x7f0000ad3000)={0x73, 0x79, 0x7a, 0x3}, &(0x7f00006cc000-0x40)='deflate\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', 0xffffffffffffffff) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(r0, 0x114, 0xa, &(0x7f0000a44000-0x2)={0x1, "c3"}, 0x2) 2018/02/10 14:10:14 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r0, &(0x7f0000bbe000)={0x40000000}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000a000)={0x34e, 0x0, &(0x7f00001e5000-0x8)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000006000-0x54)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000-0x30)={0x44, 0x0, &(0x7f0000d06000)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x38, 0x8, &(0x7f000000d000)=[@fda={0x66646185}, @flat={0x73682a85, 0xa}], &(0x7f0000006000)=[0x20]}}], 0x0, 0x0, &(0x7f0000176000-0x1)}) [ 72.137006] binder: undelivered TRANSACTION_ERROR: 29189 [ 72.142558] binder: undelivered TRANSACTION_ERROR: 29189 [ 72.171960] binder: 11976:11979 Acquire 1 refcount change on invalid ref 0 ret -22 [ 72.176714] binder: 11981:11985 unknown command 0 2018/02/10 14:10:14 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x2, 0x78, 0xe2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) unshare(0x40000202) r0 = memfd_create(&(0x7f000064c000)="1d00", 0x1) ioctl$sock_SIOCBRDELBR(r0, 0x89a1, &(0x7f0000fad000-0x10)=@common='ip_vti0\x00') ioctl$TIOCSLCKTRMIOS(r0, 0x5457, &(0x7f0000f57000-0x24)) r1 = mq_open(&(0x7f0000000000)='-$\x00', 0x6e93ebbbcc0884f2, 0x0, &(0x7f0000665000-0x40)={0x0, 0x7, 0x2}) r2 = dup2(r1, r1) mq_timedreceive(r2, &(0x7f00006b1000-0x83)=""/131, 0x83, 0x0, &(0x7f00005c4000-0x10)) getresuid(&(0x7f0000ca3000-0x4), &(0x7f0000ac6000-0x4), &(0x7f0000822000)) 2018/02/10 14:10:14 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x1b, &(0x7f00000aa000)={@remote={0xfe, 0x80, [], 0xffffffffffffffff, 0xbb}}, 0x20) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000dfa000-0xe8)={{{@in=@loopback, @in=@remote, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@local}, 0x0, @in6=@mcast1}}, &(0x7f0000608000-0x4)=0xe8) setsockopt$inet6_mreq(r0, 0x29, 0x1c, &(0x7f00004da000-0x14)={@loopback={0x0, 0x1}, r1}, 0x14) socketpair$inet6_tcp(0xa, 0x1, 0x0, &(0x7f00002c5000)={0x0, 0x0}) r4 = fcntl$dupfd(r2, 0x0, r3) ioctl$VT_ACTIVATE(r4, 0x5606, 0x5) 2018/02/10 14:10:14 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000a000)={0x34e, 0x0, &(0x7f00001e5000-0x8)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000006000-0x54)}) close(r0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000008000-0x30)={0x0, 0x0, &(0x7f0000d06000)=[], 0x0, 0x0, &(0x7f0000176000-0x1)}) [ 72.179756] binder: 11976:11979 unknown command 0 [ 72.185979] binder: 11976:11979 ioctl c0306201 2000a000 returned -22 [ 72.189923] binder: 11981:11985 ioctl c0306201 2000a000 returned -22 2018/02/10 14:10:14 executing program 1: mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) r0 = memfd_create(&(0x7f000003b000-0x6)='posix_acl_access{Y\x00', 0x0) pwrite64(r0, &(0x7f000003c000-0x1)='/', 0x1, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x4, 0x11, r0, 0x0) lseek(r0, 0x0, 0x2) sendfile(r0, r0, &(0x7f000003c000), 0x1000) mmap(&(0x7f000029d000/0x4000)=nil, 0x4000, 0x6, 0x10, r0, 0x0) symlink(&(0x7f0000001000)='./file0\x00', &(0x7f0000004000)='./file0\x00') mount(&(0x7f000003d000+0xf5d)='./file0/file0\x00', &(0x7f000001f000-0x8)='./file0\x00', &(0x7f000003e000-0x5)='ext4\x00', 0x0, &(0x7f0000016000-0x5f)) timerfd_settime(r0, 0x1, &(0x7f0000524000)={{0x77359400}}, &(0x7f0000abe000-0x10)) [ 72.230318] binder_alloc: binder_alloc_mmap_handler: 11981 20000000-20002000 already mapped failed -16 [ 72.240388] PPPIOCDETACH file->f_count=2 [ 72.254675] binder: BINDER_SET_CONTEXT_MGR already set [ 72.263500] can: request_module (can-proto-4) failed. [ 72.266893] binder: 11981:11991 unknown command 0 [ 72.273758] binder: 11998:12002 unknown command 0 2018/02/10 14:10:14 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) timer_create(0x1000004, &(0x7f000023a000-0x50)={0x5, 0x0, 0x0, @thr={&(0x7f0000b11000), &(0x7f000075f000-0xd)}}, &(0x7f0000231000)) 2018/02/10 14:10:14 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000a5000-0x8)) mmap(&(0x7f0000000000/0x19000)=nil, 0x19000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000924000-0xc)='/dev/rfkill\x00', 0x0, 0x0) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f000059f000-0x10)={r0, 0x50, &(0x7f00008b5000-0x50)}, 0x10) r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000e54000-0x18)={0xaa}) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000008000-0x20)={{&(0x7f0000000000/0x4000)=nil, 0x4000}, 0x1}) readv(r0, &(0x7f00001f3000-0x10)=[{&(0x7f0000002000-0x4e)=""/1, 0x1}], 0x1) ioctl$RNDADDTOENTCNT(r0, 0x40045201, &(0x7f0000b27000)) unlinkat(r0, &(0x7f00000d2000)='./file0\x00', 0x0) ioctl$RNDADDTOENTCNT(r0, 0x40045201, &(0x7f0000a81000)) ioctl$UFFDIO_UNREGISTER(r1, 0xc020aa04, &(0x7f0000008000-0x4)={&(0x7f0000000000/0x2000)=nil, 0x2000}) 2018/02/10 14:10:14 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000b36000-0x11)='/dev/qat_adf_ctl\x00', 0x8800, 0x0) getsockopt$inet_sctp_SCTP_DEFAULT_PRINFO(0xffffffffffffff9c, 0x84, 0x72, &(0x7f0000f31000-0xc)={0x0, 0xffff}, &(0x7f0000500000)=0xc) setsockopt$inet_sctp6_SCTP_MAX_BURST(r0, 0x84, 0x14, &(0x7f0000456000-0x8)=@assoc_value={r1, 0x2}, 0x8) r2 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f000000a000)={0x34e, 0x0, &(0x7f00001e5000-0x8)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000006000-0x54)}) r3 = syz_open_dev$mice(&(0x7f00007ae000-0x10)='/dev/input/mice\x00', 0x0, 0x80) setsockopt$inet_sctp6_SCTP_ADD_STREAMS(r3, 0x84, 0x79, &(0x7f000030b000)=0xfffffffffffffc01, 0x4) renameat(r0, &(0x7f0000f03000-0x8)='./file0\x00', r0, &(0x7f000060d000)='./file0\x00') ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000008000-0x30)={0x0, 0x0, &(0x7f0000d06000)=[], 0x0, 0x0, &(0x7f0000176000-0x1)}) clock_gettime(0x0, &(0x7f0000e45000)={0x0, 0x0}) msync(&(0x7f0000311000/0xd000)=nil, 0xd000, 0x7) ppoll(&(0x7f00005bf000-0x30)=[{r2, 0x4}, {r2, 0x410}, {r3, 0x2004}, {r3, 0x1f}, {r2, 0x80}, {r2, 0xa0}], 0x6, &(0x7f0000db7000-0x8)={r4, r5+10000000}, &(0x7f0000bf9000-0x8)={0xffffffffffffff7f}, 0x8) 2018/02/10 14:10:14 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r0, r0, &(0x7f0000049000), 0x3d2) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000008000)={&(0x7f000000f000-0xc)={0x10, 0x34000}, 0xc, &(0x7f0000220000)={&(0x7f00008d6000-0x14)={0x14, 0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, {}, []}, 0x14}, 0x1}, 0x0) r1 = userfaultfd(0x80800) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000ff8000-0x20)={{&(0x7f0000012000/0x2000)=nil, 0x2000}, 0x1}) bpf$MAP_CREATE(0x0, &(0x7f0000fb4000)={0x2, 0x8000000000000004, 0x400, 0x7fd, 0x4, 0xffffffffffffffff}, 0x2c) userfaultfd(0x800) clock_gettime(0x0, &(0x7f0000132000)={0x0, 0x0}) socketpair(0x1d, 0x800, 0x4, &(0x7f0000589000)) r4 = syz_open_dev$mouse(&(0x7f00006eb000)='/dev/input/mouse#\x00', 0xde6e, 0x1) timer_settime(0x0, 0x1, &(0x7f000097e000)={{0x0, r3}, {r2, r3+10000000}}, &(0x7f0000939000)) fanotify_init(0x25, 0x802) r5 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000ef2000-0x1d)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f00002d8000-0xc)={0x0, 0x0}, &(0x7f0000d76000-0x4)=0xc) syz_open_procfs(r6, &(0x7f0000013000)='ns/cgroup\x00') openat$ion(0xffffffffffffff9c, &(0x7f0000dd5000)='/dev/ion\x00', 0x800, 0x0) pipe2(&(0x7f000058c000), 0x4800) setsockopt$inet_IP_XFRM_POLICY(r4, 0x0, 0x11, &(0x7f0000e12000-0xe8)={{{@in6=@mcast1={0xff, 0x1, [], 0x1}, @in=@rand_addr, 0x2, 0xbd, 0x3, 0x20, 0xa, 0xa0, 0x80, 0xbf, 0x0, r7}, {0x0, 0x0, 0x0, 0x3, 0x6, 0x1fa8, 0x8, 0x20}, {0x1719, 0x7fff, 0x7ff, 0x7ff}, 0x1, 0x7, 0x0, 0x1, 0x1, 0x3}, {{@in=@broadcast=0xffffffff, 0x1, 0x7f}, 0xa, @in=@empty, 0xffffffffffffffff, 0x3, 0x0, 0xffffffffffffffbc, 0x20, 0x6, 0x2}}, 0xe8) openat$selinux_policy(0xffffffffffffff9c, &(0x7f000010e000-0x10)='/selinux/policy\x00', 0x0, 0x0) setsockopt$netlink_NETLINK_TX_RING(r5, 0x10e, 0x7, &(0x7f0000ab4000-0x10)={0x6, 0x7, 0x52, 0xfffffffffffffffc}, 0x10) [ 72.279246] binder: 11981:11985 ioctl 40046207 0 returned -16 [ 72.285516] binder_alloc: 11981: binder_alloc_buf, no vma [ 72.286789] binder: 11998:12002 ioctl c0306201 2000a000 returned -22 [ 72.291298] binder: 11981:12007 transaction failed 29189/-3, size 56-8 line 2957 [ 72.302102] binder: 11981:11991 ioctl c0306201 2000a000 returned -22 2018/02/10 14:10:14 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) setsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000a27000-0xe8)={{{@in=@rand_addr=0xc0000, @in=@multicast1=0xe0000001, 0x1, 0x1, 0xffffffffffffffff, 0x0, 0x10002, 0x20}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x8000}, {0x1}, 0x0, 0xffffffffffffffff, 0x8000000000000001, 0x0, 0x0, 0x3}, {{@in=@multicast1=0xe0000001, 0xffffffffffffffff, 0x932}, 0x0, @in6=@mcast1={0xff, 0x1, [], 0x1}}}, 0xe8) sendto$inet(0xffffffffffffffff, &(0x7f0000bfb000-0x6b), 0x0, 0x0, &(0x7f00006f9000-0x10)={0x2, 0xffffffffffffffff, @loopback=0x7f000001}, 0x10) r0 = syz_open_dev$mice(&(0x7f0000f9c000-0x10)='/dev/input/mice\x00', 0x0, 0x40c82) setsockopt$inet_icmp_ICMP_FILTER(r0, 0x1, 0x1, &(0x7f000080e000-0x4)={0x4}, 0x4) r1 = syz_open_dev$dmmidi(&(0x7f000082c000-0xd)='/dev/dmmidi#\x00', 0x3, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(r1, 0x112, 0xa, &(0x7f0000d7d000)=0x3ff, 0x4) r2 = fcntl$getown(r0, 0x9) r3 = getpid() kcmp$KCMP_EPOLL_TFD(r2, r3, 0x7, r1, &(0x7f0000fe0000-0xc)={r1, r0, 0x6}) ioctl$SIOCSIFMTU(r1, 0x8922, &(0x7f0000d1f000)={@generic="18a27ed9e410fe46ed9ddc3799cab7ba"}) setsockopt$SO_RDS_TRANSPORT(r1, 0x114, 0x8, &(0x7f00007b1000)=0x1, 0x4) r4 = syz_open_dev$usbmon(&(0x7f0000a9f000-0xd)='/dev/usbmon#\x00', 0x2, 0x400) bind$inet(r4, &(0x7f0000d20000-0x10)={0x2, 0x1, @dev={0xac, 0x14, 0x0, 0x11}}, 0x10) ioctl$sock_bt_cmtp_CMTPGETCONNLIST(r4, 0x800443d2, &(0x7f00000e4000-0x8)={0x8, &(0x7f00009ef000)=[{}, {}, {}, {}, {}, {}, {}, {}]}) 2018/02/10 14:10:14 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000a000)={0xffffffffffffffe3, 0x0, &(0x7f0000445000)=[], 0xb49dcaa9, 0x0, &(0x7f0000006000-0x54)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000-0x30)={0x44, 0x0, &(0x7f0000d06000)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x38, 0x8, &(0x7f000000d000)=[@fda={0x66646185}, @flat={0x73682a85}], &(0x7f0000006000)=[0x20]}}], 0x0, 0x0, &(0x7f0000176000-0x1)}) syz_open_dev$dspn(&(0x7f0000d93000-0xa)='/dev/dsp#\x00', 0x405, 0x80000220200) 2018/02/10 14:10:14 executing program 3: socket$nl_route(0x10, 0x3, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x801, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000f11000-0x4)=0x3f, 0x4) pipe2(&(0x7f0000409000-0x8)={0x0}, 0x80000) ioctl$EVIOCGID(r1, 0x80084502, &(0x7f0000c65000)=""/4096) bind$inet6(r0, &(0x7f0000bcf000-0x1c)={0xa, 0x0, 0x0, @empty}, 0x1c) listen(r0, 0x0) [ 72.359978] binder: 12014:12018 unknown command 0 [ 72.368586] binder: 12014:12018 ioctl c0306201 2000a000 returned -22 [ 72.378990] binder: undelivered TRANSACTION_ERROR: 29189 [ 72.386490] binder: release 11981:11991 transaction 338 out, still active [ 72.393554] binder: undelivered TRANSACTION_COMPLETE [ 72.398725] binder: send failed reply for transaction 338, target dead [ 72.442350] binder: 12014:12018 unknown command 0 2018/02/10 14:10:14 executing program 0: r0 = socket$inet(0x2, 0x3, 0x2) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$vcsa(&(0x7f0000001000-0xb)='/dev/vcsa#\x00', 0x6, 0x1) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) openat$rtc(0xffffffffffffff9c, &(0x7f0000001000)='/dev/rtc\x00', 0x101000, 0x0) ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffff9c, 0xc0106434, &(0x7f00002dc000)={0x9, 0x0, 0x10001, 0x100}) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$DRM_IOCTL_AGP_BIND(r1, 0x40086436, &(0x7f0000001000-0x8)={r2, 0xc6}) setsockopt$inet_sctp6_SCTP_ADD_STREAMS(r1, 0x84, 0x79, &(0x7f0000000000)=0x3, 0x4) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) getrandom(&(0x7f0000001000)=""/165, 0xa5, 0x3) setsockopt$inet_int(r0, 0x0, 0xcf, &(0x7f0000000000), 0xc4) 2018/02/10 14:10:14 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) keyctl$get_keyring_id(0x0, 0x0, 0x0) r0 = add_key$keyring(&(0x7f00002b1000-0x8)='keyring\x00', &(0x7f0000ca7000-0x5)={0x73, 0x79, 0x7a}, 0x0, 0x0, 0xffffffffffffffff) keyctl$search(0xa, r0, &(0x7f0000850000)='asymmetric\x00', &(0x7f00008ad000-0x5)={0x73, 0x79, 0x7a}, 0x0) r1 = syz_open_dev$midi(&(0x7f0000ba6000)='/dev/midi#\x00', 0x6, 0x200) getsockopt$inet_sctp6_SCTP_INITMSG(r1, 0x84, 0x2, &(0x7f0000d06000), &(0x7f0000bd4000-0x4)=0x8) 2018/02/10 14:10:14 executing program 5: syz_extract_tcp_res(&(0x7f00003d1000), 0x548, 0x735) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000a5000-0x8)) mmap(&(0x7f0000000000/0x19000)=nil, 0x19000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000924000-0xc)='/dev/rfkill\x00', 0x0, 0x0) r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000e54000-0x18)={0xaa}) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000008000-0x20)={{&(0x7f0000000000/0x4000)=nil, 0x4000}, 0x1}) ioctl$KVM_SET_FPU(r0, 0x41a0ae8d, &(0x7f0000cc4000)={[], 0x1, 0xfff, 0x1d1, 0x0, 0x3, 0xf000, 0x0, [], 0x9}) readv(r0, &(0x7f00001f3000-0x10)=[{&(0x7f0000002000-0x4e)=""/1, 0x1}], 0x1) ioctl$RNDADDTOENTCNT(r0, 0x40045201, &(0x7f0000b27000)) ioctl$RNDADDTOENTCNT(r0, 0x40045201, &(0x7f0000a81000)) ioctl$UFFDIO_UNREGISTER(r0, 0xc020aa04, &(0x7f00004d1000-0x10)={&(0x7f000081d000/0x3000)=nil, 0x3000}) [ 72.465363] binder: 12014:12018 ioctl c0306201 2000a000 returned -22 [ 72.477270] binder: 12024:12034 got transaction with invalid handle, 0 [ 72.493492] binder: 12024:12034 transaction failed 29201/-22, size 56-8 line 3049 [ 72.547760] binder_alloc: binder_alloc_mmap_handler: 12024 20000000-20002000 already mapped failed -16 [ 72.571135] binder: BINDER_SET_CONTEXT_MGR already set [ 72.577328] binder_alloc: 12024: binder_alloc_buf, no vma [ 72.582432] binder: 12024:12046 ioctl 40046207 0 returned -16 [ 72.582973] binder: 12024:12034 transaction failed 29189/-3, size 56-8 line 2957 [ 72.644758] binder: undelivered TRANSACTION_ERROR: 29189 2018/02/10 14:10:14 executing program 1: r0 = fcntl$dupfd(0xffffffffffffff9c, 0x406, 0xffffffffffffff9c) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) getsockopt$inet6_mreq(r0, 0x29, 0x14, &(0x7f0000001000-0x14)={@empty}, &(0x7f0000fdc000-0x4)=0x14) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r1 = socket$inet(0x2, 0x800200080003, 0x5) connect(r1, &(0x7f0000001000)=@nl=@proc={0x10}, 0xc) 2018/02/10 14:10:14 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r0, r0, &(0x7f0000049000), 0x3d2) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000008000)={&(0x7f000000f000-0xc)={0x10, 0x34000}, 0xc, &(0x7f0000220000)={&(0x7f00008d6000-0x14)={0x14, 0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, {}, []}, 0x14}, 0x1}, 0x0) r1 = userfaultfd(0x80800) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000ff8000-0x20)={{&(0x7f0000012000/0x2000)=nil, 0x2000}, 0x1}) bpf$MAP_CREATE(0x0, &(0x7f0000fb4000)={0x2, 0x8000000000000004, 0x400, 0x7fd, 0x4, 0xffffffffffffffff}, 0x2c) userfaultfd(0x800) clock_gettime(0x0, &(0x7f0000132000)={0x0, 0x0}) socketpair(0x1d, 0x800, 0x4, &(0x7f0000589000)) r4 = syz_open_dev$mouse(&(0x7f00006eb000)='/dev/input/mouse#\x00', 0xde6e, 0x1) timer_settime(0x0, 0x1, &(0x7f000097e000)={{0x0, r3}, {r2, r3+10000000}}, &(0x7f0000939000)) fanotify_init(0x25, 0x802) r5 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000ef2000-0x1d)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f00002d8000-0xc)={0x0, 0x0}, &(0x7f0000d76000-0x4)=0xc) syz_open_procfs(r6, &(0x7f0000013000)='ns/cgroup\x00') openat$ion(0xffffffffffffff9c, &(0x7f0000dd5000)='/dev/ion\x00', 0x800, 0x0) pipe2(&(0x7f000058c000), 0x4800) setsockopt$inet_IP_XFRM_POLICY(r4, 0x0, 0x11, &(0x7f0000e12000-0xe8)={{{@in6=@mcast1={0xff, 0x1, [], 0x1}, @in=@rand_addr, 0x2, 0xbd, 0x3, 0x20, 0xa, 0xa0, 0x80, 0xbf, 0x0, r7}, {0x0, 0x0, 0x0, 0x3, 0x6, 0x1fa8, 0x8, 0x20}, {0x1719, 0x7fff, 0x7ff, 0x7ff}, 0x1, 0x7, 0x0, 0x1, 0x1, 0x3}, {{@in=@broadcast=0xffffffff, 0x1, 0x7f}, 0xa, @in=@empty, 0xffffffffffffffff, 0x3, 0x0, 0xffffffffffffffbc, 0x20, 0x6, 0x2}}, 0xe8) openat$selinux_policy(0xffffffffffffff9c, &(0x7f000010e000-0x10)='/selinux/policy\x00', 0x0, 0x0) setsockopt$netlink_NETLINK_TX_RING(r5, 0x10e, 0x7, &(0x7f0000ab4000-0x10)={0x6, 0x7, 0x52, 0xfffffffffffffffc}, 0x10) 2018/02/10 14:10:14 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000806000-0x6)='.dead\x00', &(0x7f0000d18000-0x5)={0x73, 0x79, 0x7a, 0x0}, &(0x7f00000c1000)="c7961d2e802044a2caf66f84c8a88a7ec6e030fe53f4e6da722aadb7a6fc186d9934d477ca9122714fe9ca0fe687a89623e64df8d3a47b761c5af36515d3fbc76671ee6beeefd26ddd677b410c1c0ea1fe7e1fa76156a5acf907c676091b0f7e690e1b9d4c7f83997277cc577665d395e8187b159469fd69e02b2ecac8f6ffb609ad47cedb981ff30b", 0x89, 0xfffffffffffffffd) r0 = request_key(&(0x7f000082f000)='big_key\x00', &(0x7f000023d000-0x5)={0x73, 0x79, 0x7a, 0x0}, &(0x7f000056f000-0x1)='\x00', 0xfffffffffffffffb) r1 = add_key$keyring(&(0x7f00003f7000)='keyring\x00', &(0x7f000042a000-0x5)={0x73, 0x79, 0x7a, 0x0}, 0x0, 0x0, r0) r2 = add_key$keyring(&(0x7f0000f23000)='keyring\x00', &(0x7f0000b33000)={0x73, 0x79, 0x7a, 0x0}, 0x0, 0x0, 0xfffffffffffffffb) keyctl$link(0x8, r1, r2) 2018/02/10 14:10:14 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) recvmsg$kcm(0xffffffffffffff9c, &(0x7f0000569000)={&(0x7f0000154000)=@pppol2tp={0x0, 0x0, {0x0, 0x0, {0x0, 0xffffffffffffffff, @broadcast}}}, 0x26, &(0x7f00009e6000)=[{&(0x7f00001f1000-0x48)=""/72, 0x48}, {&(0x7f0000643000)=""/23, 0x17}, {&(0x7f0000003000)=""/165, 0xa5}, {&(0x7f00005b9000)=""/4096, 0x1000}, {&(0x7f00001da000-0xd8)=""/216, 0xd8}], 0x5, &(0x7f0000697000-0xf9)=""/249, 0xf9}, 0x20) getsockopt$bt_BT_CHANNEL_POLICY(r0, 0x112, 0xa, &(0x7f0000643000)=0x6, &(0x7f00001ac000)=0x4) r1 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000a000)={0x34e, 0x0, &(0x7f00001e5000-0x8)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000006000-0x54)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000008000-0x30)={0x0, 0x0, &(0x7f0000d06000)=[], 0x0, 0x0, &(0x7f0000176000-0x1)}) 2018/02/10 14:10:14 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000b36000-0x11)='/dev/qat_adf_ctl\x00', 0x8800, 0x0) getsockopt$inet_sctp_SCTP_DEFAULT_PRINFO(0xffffffffffffff9c, 0x84, 0x72, &(0x7f0000f31000-0xc)={0x0, 0xffff}, &(0x7f0000500000)=0xc) setsockopt$inet_sctp6_SCTP_MAX_BURST(r0, 0x84, 0x14, &(0x7f0000456000-0x8)=@assoc_value={r1, 0x2}, 0x8) r2 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f000000a000)={0x34e, 0x0, &(0x7f00001e5000-0x8)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000006000-0x54)}) r3 = syz_open_dev$mice(&(0x7f00007ae000-0x10)='/dev/input/mice\x00', 0x0, 0x80) setsockopt$inet_sctp6_SCTP_ADD_STREAMS(r3, 0x84, 0x79, &(0x7f000030b000)=0xfffffffffffffc01, 0x4) renameat(r0, &(0x7f0000f03000-0x8)='./file0\x00', r0, &(0x7f000060d000)='./file0\x00') ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000008000-0x30)={0x0, 0x0, &(0x7f0000d06000)=[], 0x0, 0x0, &(0x7f0000176000-0x1)}) clock_gettime(0x0, &(0x7f0000e45000)={0x0, 0x0}) msync(&(0x7f0000311000/0xd000)=nil, 0xd000, 0x7) ppoll(&(0x7f00005bf000-0x30)=[{r2, 0x4}, {r2, 0x410}, {r3, 0x2004}, {r3, 0x1f}, {r2, 0x80}, {r2, 0xa0}], 0x6, &(0x7f0000db7000-0x8)={r4, r5+10000000}, &(0x7f0000bf9000-0x8)={0xffffffffffffff7f}, 0x8) 2018/02/10 14:10:14 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000a5000-0x8)) r0 = syz_open_dev$audion(&(0x7f0000876000-0xc)='/dev/audio#\x00', 0x184, 0x111000) r1 = socket$l2tp(0x18, 0x1, 0x1) r2 = dup3(r0, r1, 0x80000) mmap(&(0x7f0000000000/0x19000)=nil, 0x19000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r3 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000924000-0xc)='/dev/rfkill\x00', 0x0, 0x0) r4 = userfaultfd(0x0) ioctl$UFFDIO_API(r4, 0xc018aa3f, &(0x7f0000e54000-0x18)={0xaa}) ioctl$UFFDIO_REGISTER(r4, 0xc020aa00, &(0x7f0000008000-0x20)={{&(0x7f0000000000/0x4000)=nil, 0x4000}, 0x1}) readv(r3, &(0x7f00001f3000-0x10)=[{&(0x7f0000002000-0x4e)=""/1, 0x1}], 0x1) accept4$packet(r2, &(0x7f0000693000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @link_local}, &(0x7f0000bdd000)=0x14, 0x80000) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f000059e000)={@common='ip6_vti0\x00', 0x0}) ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f0000574000-0x28)={'vcan0\x00', r5}) setsockopt$inet_pktinfo(r2, 0x0, 0x8, &(0x7f0000a05000-0xc)={r6, @rand_addr, @multicast2=0xe0000002}, 0xc) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r3, 0xc00c64b5, &(0x7f0000225000-0x8)={&(0x7f0000750000-0x18)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x6}) ioctl$RNDADDTOENTCNT(r3, 0x40045201, &(0x7f0000b27000)) ioctl$RNDADDTOENTCNT(r3, 0x40045201, &(0x7f0000a81000)) ioctl$UFFDIO_UNREGISTER(r4, 0xc020aa04, &(0x7f0000888000-0x10)={&(0x7f000082a000/0x3000)=nil, 0x3000}) 2018/02/10 14:10:14 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000321000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0) socketpair(0xa, 0x1, 0x3, &(0x7f0000ac6000)) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000a000)={0x34e, 0x0, &(0x7f00001e5000-0x8)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000006000-0x54)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000-0x30)={0x44, 0x0, &(0x7f0000d06000)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x38, 0x8, &(0x7f000000d000)=[@fda={0x66646185}, @flat={0x73682a85}], &(0x7f0000006000)=[0x20]}}], 0x0, 0x0, &(0x7f0000176000-0x1)}) 2018/02/10 14:10:14 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$evdev(&(0x7f0000dda000-0x12)='/dev/input/event#\x00', 0x0, 0x0) ioctl$EVIOCGRAB(r0, 0x40044590, &(0x7f0000e95000-0x4)) ioctl$TIOCSBRK(0xffffffffffffffff, 0x40044591) request_key(&(0x7f0000102000)='big_key\x00', &(0x7f0000ad3000)={0x73, 0x79, 0x7a, 0x3}, &(0x7f00006cc000-0x40)='deflate\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', 0xffffffffffffffff) socket$nl_netfilter(0x10, 0x3, 0xc) lstat(&(0x7f00004b3000)='./file0\x00', &(0x7f0000ce7000-0x44)={0x0, 0x0, 0x0, 0x0, 0x0}) r2 = getgid() ioctl$EVIOCSMASK(r0, 0x40104593, &(0x7f0000b88000-0xc)={0x5, 0x57, &(0x7f0000009000-0x57)="e6108e9cc41229220142a6211ca573e7f41175304042c27dca11e914f218eb48301b8794bbbb2ba7ec46721b6911a4e62c2df7f32d15a03afc8a213237dc5f330df5d60eedbfa32dee7b9343b87b3f92af7aaed5a0178d"}) ioctl$sock_bt_hci(r0, 0x800448d4, &(0x7f00001b5000)="375705cdcd416e0069191394d4efefd9cbf26630") fchown(r0, r1, r2) 2018/02/10 14:10:14 executing program 3: mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet_sctp(0x2, 0x5, 0x84) mmap(&(0x7f0000003000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r1 = accept4(r0, &(0x7f0000001000)=@pppoe={0x0, 0x0, {0x0, @link_local, @common}}, &(0x7f0000004000-0x2)=0x1e, 0x800) bind$rds(r1, &(0x7f0000001000-0x10)={0x2, 0x1, @rand_addr=0x15}, 0x10) setsockopt$inet_sctp_SCTP_MAX_BURST(r0, 0x84, 0x14, &(0x7f0000001000-0x8)=@assoc_value, 0x8) ioctl$int_in(r0, 0x5421, &(0x7f0000000000)=0x6) [ 72.755770] binder: 12059:12063 Acquire 1 refcount change on invalid ref 0 ret -22 [ 72.763603] binder: 12059:12063 unknown command 0 [ 72.772286] binder: 12059:12063 ioctl c0306201 2000a000 returned -22 [ 72.781491] binder: 12062:12064 Acquire 1 refcount change on invalid ref 0 ret -22 [ 72.789290] binder: 12062:12064 unknown command 0 [ 72.794758] binder: 12062:12064 ioctl c0306201 2000a000 returned -22 2018/02/10 14:10:14 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$autofs(0xffffffffffffff9c, &(0x7f00000fe000)='/dev/autofs\x00', 0x0, 0x0) ioctl$TIOCMSET(r0, 0x5418, &(0x7f0000321000-0x4)=0x6) r1 = syz_open_dev$dspn(&(0x7f0000007000-0xa)='/dev/dsp#\x00', 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x5, 0x78, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, @perf_bp={&(0x7f0000000000), 0x1}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$int_in(r1, 0x800000c0045009, &(0x7f0000000000)) 2018/02/10 14:10:14 executing program 3: mmap(&(0x7f0000000000/0xaee000)=nil, 0xaee000, 0x3, 0x32, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x32, &(0x7f0000aeb000-0x7b)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @empty, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x24, 0xffffffffffffffff, 0x0, 0x0, 0xffffff89, 0x0, @rand_addr, @multicast1=0xe0000001, {[]}}, @dccp={{0xffffffffffffffff, 0xffffffffffffffff, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, "3f07b9", 0x0, "08c470"}}}}}}, &(0x7f0000adb000-0xc)={0x0, 0x1, [0x0]}) mmap(&(0x7f0000aee000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$vcsa(&(0x7f0000aee000)='/dev/vcsa#\x00', 0x1, 0x400440) mmap(&(0x7f0000aee000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$PPPIOCGMRU(r0, 0x80047453, &(0x7f0000aef000-0x4)) 2018/02/10 14:10:14 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000207000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000a000)={0x34e, 0x0, &(0x7f00001e5000-0x8)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000006000-0x54)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000-0x30)={0x0, 0x0, &(0x7f0000d06000)=[], 0x0, 0x0, &(0x7f0000176000-0x1)}) [ 72.801432] binder: 12058:12075 unknown command 0 [ 72.817217] binder: 12059:12074 unknown command 0 [ 72.822703] binder: 12058:12075 ioctl c0306201 2000a000 returned -22 [ 72.829436] binder: 12059:12074 ioctl c0306201 2000a000 returned -22 [ 72.839337] binder_alloc: binder_alloc_mmap_handler: 12058 20000000-20002000 already mapped failed -16 2018/02/10 14:10:14 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000b36000-0x11)='/dev/qat_adf_ctl\x00', 0x8800, 0x0) getsockopt$inet_sctp_SCTP_DEFAULT_PRINFO(0xffffffffffffff9c, 0x84, 0x72, &(0x7f0000f31000-0xc)={0x0, 0xffff}, &(0x7f0000500000)=0xc) setsockopt$inet_sctp6_SCTP_MAX_BURST(r0, 0x84, 0x14, &(0x7f0000456000-0x8)=@assoc_value={r1, 0x2}, 0x8) r2 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f000000a000)={0x34e, 0x0, &(0x7f00001e5000-0x8)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000006000-0x54)}) r3 = syz_open_dev$mice(&(0x7f00007ae000-0x10)='/dev/input/mice\x00', 0x0, 0x80) setsockopt$inet_sctp6_SCTP_ADD_STREAMS(r3, 0x84, 0x79, &(0x7f000030b000)=0xfffffffffffffc01, 0x4) renameat(r0, &(0x7f0000f03000-0x8)='./file0\x00', r0, &(0x7f000060d000)='./file0\x00') ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000008000-0x30)={0x0, 0x0, &(0x7f0000d06000)=[], 0x0, 0x0, &(0x7f0000176000-0x1)}) clock_gettime(0x0, &(0x7f0000e45000)={0x0, 0x0}) msync(&(0x7f0000311000/0xd000)=nil, 0xd000, 0x7) ppoll(&(0x7f00005bf000-0x30)=[{r2, 0x4}, {r2, 0x410}, {r3, 0x2004}, {r3, 0x1f}, {r2, 0x80}, {r2, 0xa0}], 0x6, &(0x7f0000db7000-0x8)={r4, r5+10000000}, &(0x7f0000bf9000-0x8)={0xffffffffffffff7f}, 0x8) [ 72.865849] binder: BINDER_SET_CONTEXT_MGR already set [ 72.882825] binder: 12058:12087 ioctl 40046207 0 returned -16 [ 72.892057] binder: 12089:12091 unknown command 0 [ 72.893349] binder: 12058:12075 unknown command 0 [ 72.900849] binder_alloc: 12058: binder_alloc_buf, no vma [ 72.907470] binder: 12058:12094 transaction failed 29189/-3, size 56-8 line 2957 2018/02/10 14:10:14 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, &(0x7f0000530000)=@mangle={'mangle\x00', 0x1f, 0x6, 0x414, 0x230, 0x230, 0x94, 0x0, 0x164, 0x380, 0x380, 0x380, 0x380, 0x380, 0x6, &(0x7f00009f1000-0x5a), {[{{@ip={@rand_addr, @dev={0xac, 0x14}, 0x0, 0x0, @generic="fa764045dbdfdd07e1ae990ba62cdeff", @syzn={0x73, 0x79, 0x7a}}, 0x0, 0x70, 0x94, 0x0, {}, []}, @unspec=@CHECKSUM={0x24, 'CHECKSUM\x00', 0x0, {0x1}}}, {{@ip={@broadcast=0xffffffff, @multicast2=0xe0000002, 0x0, 0x0, @syzn={0x73, 0x79, 0x7a}, @syzn={0x73, 0x79, 0x7a}}, 0x0, 0x70, 0xd0, 0x0, {}, []}, @common=@SET={0x60, 'SET\x00'}}, {{@uncond, 0x0, 0x70, 0xcc, 0x0, {}, []}, @common=@CLUSTERIP={0x5c, 'CLUSTERIP\x00', 0x0, {0x0, @remote={[0xaa, 0xaa, 0xaa, 0xaa], 0xffffffffffffffff, 0xbb}}}}, {{@ip={@dev={0xac, 0x14}, @local={0xac, 0x14, 0xffffffffffffffff, 0xaa}, 0x0, 0x0, @syzn={0x73, 0x79, 0x7a}, @syzn={0x73, 0x79, 0x7a}}, 0x0, 0x70, 0xa0, 0x0, {}, []}, @TPROXY={0x30, 'TPROXY\x00', 0x0, {0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}}}}, {{@ip={@multicast1=0xe0000001, @loopback=0x7f000001, 0x0, 0x0, @syzn={0x73, 0x79, 0x7a}, @generic="8c819f574f6db34d382e3526033b3c0d"}, 0x0, 0x70, 0xb0, 0x0, {}, []}, @common=@inet=@LOG={0x40, 'LOG\x00', 0x0, {0x0, 0x0, "b9b84625f22e7cf2ca94a57e2a155bdea0b8b87418b45c8e9be1877ee21e"}}}], {{[], 0x0, 0x70, 0x94}, {0x24, '\x00', 0x0, 0xfffffffffffffffe}}}}, 0x470) ioctl$sock_inet_SIOCDELRT(r0, 0x890c, &(0x7f0000950000)={0x1, {0x2, 0x1, @dev={0xac, 0x14, 0x0, 0xe}}, {0x2, 0x3, @remote={0xac, 0x14, 0x0, 0xbb}}, {0x2, 0x2, @local={0xac, 0x14, 0x0, 0xaa}}, 0x80, 0x800, 0x6, 0x2, 0x3, &(0x7f00006db000-0x10)=@syzn={0x73, 0x79, 0x7a, 0x0}, 0x5, 0xfffffffffffd2128, 0x1ff}) r1 = openat$mixer(0xffffffffffffff9c, &(0x7f0000f7e000-0xb)='/dev/mixer\x00', 0x48000, 0x0) getsockopt$netrom_NETROM_T1(r1, 0x103, 0x1, &(0x7f0000f00000), &(0x7f00008e9000-0x4)=0x4) delete_module(&(0x7f00002ab000)='^&.\\\'\x00', 0x200) 2018/02/10 14:10:15 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) socketpair$inet6_dccp(0xa, 0x6, 0x0, &(0x7f0000d2c000)={0x0, 0x0}) getsockopt$sock_cred(0xffffffffffffff9c, 0x1, 0x11, &(0x7f0000ed4000)={0x0}, &(0x7f00008d4000)=0xc) fcntl$setownex(r0, 0xf, &(0x7f00000e4000-0x8)={0x1, r1}) r2 = socket$kcm(0x29, 0x2, 0x0) sendmsg$kcm(r2, &(0x7f0000e78000)={&(0x7f000036f000-0x32)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0xffffffffffffffff, 0x0, @mcast2={0xff, 0x2, [], 0x1}}}}, 0x32, &(0x7f000063b000)=[{&(0x7f00008c8000-0xf6)="e9", 0x1}], 0x1}, 0x0) sendmsg$kcm(r2, &(0x7f00002a6000-0x38)={&(0x7f0000100000)=@sco={0x1f}, 0x8, &(0x7f00005a1000)=[], 0x0, &(0x7f0000752000-0x2250)=[]}, 0x40010) recvmsg$kcm(r2, &(0x7f0000384000-0x38)={&(0x7f0000a01000-0x3a)=@pppol2tpv3in6={0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, @ipv4={[], [], @remote}}}}, 0x3a, &(0x7f0000b4a000)=[], 0x0, &(0x7f00003ac000-0xc3)=""/195, 0xc3}, 0x0) sendmsg$kcm(r2, &(0x7f000050c000-0x38)={&(0x7f00001ce000)=@nl=@unspec, 0xc, &(0x7f0000689000)=[]}, 0x0) listxattr(&(0x7f00003c3000)='./file0\x00', &(0x7f000035a000)=""/41, 0x29) 2018/02/10 14:10:15 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r0, r0, &(0x7f0000049000), 0x3d2) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000008000)={&(0x7f000000f000-0xc)={0x10, 0x34000}, 0xc, &(0x7f0000220000)={&(0x7f00008d6000-0x14)={0x14, 0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, {}, []}, 0x14}, 0x1}, 0x0) r1 = userfaultfd(0x80800) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000ff8000-0x20)={{&(0x7f0000012000/0x2000)=nil, 0x2000}, 0x1}) bpf$MAP_CREATE(0x0, &(0x7f0000fb4000)={0x2, 0x8000000000000004, 0x400, 0x7fd, 0x4, 0xffffffffffffffff}, 0x2c) userfaultfd(0x800) clock_gettime(0x0, &(0x7f0000132000)={0x0, 0x0}) socketpair(0x1d, 0x800, 0x4, &(0x7f0000589000)) r4 = syz_open_dev$mouse(&(0x7f00006eb000)='/dev/input/mouse#\x00', 0xde6e, 0x1) timer_settime(0x0, 0x1, &(0x7f000097e000)={{0x0, r3}, {r2, r3+10000000}}, &(0x7f0000939000)) fanotify_init(0x25, 0x802) r5 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000ef2000-0x1d)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f00002d8000-0xc)={0x0, 0x0}, &(0x7f0000d76000-0x4)=0xc) syz_open_procfs(r6, &(0x7f0000013000)='ns/cgroup\x00') openat$ion(0xffffffffffffff9c, &(0x7f0000dd5000)='/dev/ion\x00', 0x800, 0x0) pipe2(&(0x7f000058c000), 0x4800) setsockopt$inet_IP_XFRM_POLICY(r4, 0x0, 0x11, &(0x7f0000e12000-0xe8)={{{@in6=@mcast1={0xff, 0x1, [], 0x1}, @in=@rand_addr, 0x2, 0xbd, 0x3, 0x20, 0xa, 0xa0, 0x80, 0xbf, 0x0, r7}, {0x0, 0x0, 0x0, 0x3, 0x6, 0x1fa8, 0x8, 0x20}, {0x1719, 0x7fff, 0x7ff, 0x7ff}, 0x1, 0x7, 0x0, 0x1, 0x1, 0x3}, {{@in=@broadcast=0xffffffff, 0x1, 0x7f}, 0xa, @in=@empty, 0xffffffffffffffff, 0x3, 0x0, 0xffffffffffffffbc, 0x20, 0x6, 0x2}}, 0xe8) openat$selinux_policy(0xffffffffffffff9c, &(0x7f000010e000-0x10)='/selinux/policy\x00', 0x0, 0x0) setsockopt$netlink_NETLINK_TX_RING(r5, 0x10e, 0x7, &(0x7f0000ab4000-0x10)={0x6, 0x7, 0x52, 0xfffffffffffffffc}, 0x10) [ 72.907540] binder: 12058:12075 ioctl c0306201 2000a000 returned -22 [ 72.919810] binder: 12089:12091 ioctl c0306201 2000a000 returned -22 [ 72.933683] binder: 12093:12097 unknown command 0 [ 72.944649] binder: 12093:12097 ioctl c0306201 2000a000 returned -22 [ 72.958281] binder: 12089:12101 unknown command 0 [ 72.959546] Cannot find add_set index 0 as target [ 72.980673] binder: 12089:12101 ioctl c0306201 2000a000 returned -22 [ 72.987998] binder: undelivered TRANSACTION_ERROR: 29189 [ 73.000055] Cannot find add_set index 0 as target [ 73.000464] binder: release 12058:12067 transaction 350 out, still active [ 73.012087] binder: undelivered TRANSACTION_COMPLETE [ 73.017274] binder: send failed reply for transaction 350, target dead 2018/02/10 14:10:15 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000a5000-0x8)) mmap(&(0x7f0000000000/0x19000)=nil, 0x19000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000924000-0xc)='/dev/rfkill\x00', 0x0, 0x0) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f00008ec000-0x8)={0x5, &(0x7f0000b3e000)=[{0x5, 0x6, 0x7, 0x7}, {0x5e, 0x0, 0x7ce0, 0x9}, {0xf, 0x100, 0x5, 0x7fffffff}, {0x0, 0x0, 0x1, 0xfffffffffffffffd}, {0xc74, 0x2, 0x2, 0x80000001}]}, 0x8) r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000e54000-0x18)={0xaa}) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000008000-0x20)={{&(0x7f0000000000/0x4000)=nil, 0x4000}, 0x1}) readv(r0, &(0x7f00001f3000-0x10)=[], 0x0) ioctl$RNDADDTOENTCNT(r0, 0x40045201, &(0x7f0000b27000)) ioctl$RNDADDTOENTCNT(r0, 0x40045201, &(0x7f0000a81000)) ioctl$UFFDIO_UNREGISTER(r1, 0xc020aa04, &(0x7f0000008000-0x4)={&(0x7f0000000000/0x2000)=nil, 0x2000}) 2018/02/10 14:10:15 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000a000)={0x34e, 0x0, &(0x7f00001e5000-0x8)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000006000-0x54)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000008000-0x30)={0x0, 0x0, &(0x7f0000d06000)=[], 0x0, 0x0, &(0x7f0000176000-0x1)}) r1 = fcntl$dupfd(r0, 0x0, r0) getsockopt$inet_sctp6_SCTP_CONTEXT(0xffffffffffffffff, 0x84, 0x11, &(0x7f0000fc1000)={0x0, 0x4b}, &(0x7f0000444000)=0x8) getsockopt$inet_sctp_SCTP_ASSOCINFO(r1, 0x84, 0x1, &(0x7f0000c97000-0x14)={r2, 0x8, 0x7, 0x0, 0x400, 0x3}, &(0x7f00005cb000-0x4)=0x14) 2018/02/10 14:10:15 executing program 4: r0 = socket$packet(0x11, 0x3, 0x300) dup(r0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0xffffffffffffffff, 0x3) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$vcsn(&(0x7f0000a85000)='/dev/vcs#\x00', 0x401, 0x2c0) ioctl$TUNGETIFF(r2, 0x800454d2, &(0x7f0000481000-0x4)=0x7) ioctl$SNDRV_SEQ_IOCTL_RUNNING_MODE(r2, 0xc0105303, &(0x7f000093a000)={0x3f, 0xd2d2, 0x6}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000a000)={0x34e, 0x0, &(0x7f00001e5000-0x8)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000006000-0x54)}) r3 = syz_open_dev$dspn(&(0x7f0000e63000)='/dev/dsp#\x00', 0x6, 0x711000) ioctl$VT_DISALLOCATE(r3, 0x5608) setsockopt$SO_VM_SOCKETS_BUFFER_SIZE(r2, 0x28, 0x0, &(0x7f0000861000-0x8)=0x6, 0x8) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000-0x30)={0x44, 0x0, &(0x7f0000d06000)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x38, 0x8, &(0x7f000000d000)=[@fda={0x66646185}, @flat={0x73682a85}], &(0x7f0000006000)=[0x20]}}], 0x0, 0x0, &(0x7f0000176000-0x1)}) 2018/02/10 14:10:15 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000b36000-0x11)='/dev/qat_adf_ctl\x00', 0x8800, 0x0) getsockopt$inet_sctp_SCTP_DEFAULT_PRINFO(0xffffffffffffff9c, 0x84, 0x72, &(0x7f0000f31000-0xc)={0x0, 0xffff}, &(0x7f0000500000)=0xc) setsockopt$inet_sctp6_SCTP_MAX_BURST(r0, 0x84, 0x14, &(0x7f0000456000-0x8)=@assoc_value={r1, 0x2}, 0x8) r2 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f000000a000)={0x34e, 0x0, &(0x7f00001e5000-0x8)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000006000-0x54)}) r3 = syz_open_dev$mice(&(0x7f00007ae000-0x10)='/dev/input/mice\x00', 0x0, 0x80) setsockopt$inet_sctp6_SCTP_ADD_STREAMS(r3, 0x84, 0x79, &(0x7f000030b000)=0xfffffffffffffc01, 0x4) renameat(r0, &(0x7f0000f03000-0x8)='./file0\x00', r0, &(0x7f000060d000)='./file0\x00') ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000008000-0x30)={0x0, 0x0, &(0x7f0000d06000)=[], 0x0, 0x0, &(0x7f0000176000-0x1)}) clock_gettime(0x0, &(0x7f0000e45000)={0x0, 0x0}) msync(&(0x7f0000311000/0xd000)=nil, 0xd000, 0x7) ppoll(&(0x7f00005bf000-0x30)=[{r2, 0x4}, {r2, 0x410}, {r3, 0x2004}, {r3, 0x1f}, {r2, 0x80}, {r2, 0xa0}], 0x6, &(0x7f0000db7000-0x8)={r4, r5+10000000}, &(0x7f0000bf9000-0x8)={0xffffffffffffff7f}, 0x8) 2018/02/10 14:10:15 executing program 3: mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$EVIOCGBITKEY(r0, 0x80404521, &(0x7f0000000000)=""/70) r1 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000001000-0x11)='/dev/vga_arbiter\x00', 0x111040, 0x0) r2 = syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0xa0000) ioctl$sock_proto_private(r0, 0x89e4, &(0x7f0000001000-0x1000)="f3902b92893bd8ce890e769beb0962940c47a32cacfb1c01bb0cec5a7408deb64e8cd304d5ef37f22a41f01909e602c0d34a06855e54df4c9b0ce0cb94035f59b78e706aa8760204a0c7cb02107eed1a956e0507a42779ff706f4f094c3fabaa154000c56b86403bd9bdec08400662a4a21a6d07af4b556b59d2466ad60e9609a7ffb38ef3f4fbbf170f1106096f13fa564390d3c2142d5ebf39131f50e3fc015cec56565f3cfa5c2636a3ba2f4234bc520bfdf13573f213d345db1cf8c999d3e287fdaa4a1d46456f120fc8e9f901a269b459124d6523ff244e60225b495815704b103453045b2c82dd38fb3bd946830065050e07f63369ba066e3c08f1b73967ae75455808289a9f5c2480476152f871afbc076fa943541a9b35d7d87e492439bc3c26126eddd82416ca46ee65a114fcaac6e8b2e7c1cf4d2caab738ba1d4a1fb43383a183145f04e00f25381ecde66026303e705d2864e7b9d9738c71e8c8be70d9cd147908e1a94113444951a38263affe07848bc3ac598e94b7a260249ff75d126b221f31896efc83b9b9beadb8aa611fcd6d4f2256587352fb9d62b943ab184f9856ab2a71b1601f381d4a757e8bd89cec1aff50b74d0b3e288a34eeb0144a7f905a87511f87cdca40d079a9026943f9d061686a5fe7f154d651648864013e227959d1b232658bf84705ef0d10974fe0bb0c3fdba8052c26f28762086a32fac7d586a4ad1f5170e964db146ecd48a60aa4ba309bd32e2739017348cc8732dc9bcc86c3d48aeec5ed63206f858619d0c3c0fea57d4344c9db3eb9db7cee9ef51d541eb3c09c0fc06ca56fbc181e789731a38c481789e8d511e30c4730c1768bb9b97a482bb1735e54c47def05f50f629d86c8317bc3ed969b884d2707f10f37b4d4f7bb7eeeed4aa89d9ea520f8eafde371c0026bcd964ec818bd181765471accc8447054c21e237663798a7c4eb1b01ff4bfd0ab9ae0016a6c77c9f58bbf8c9e07725b3b2a7439147e2eecd990ca82512fdcaff2aaf2cd37a04f678351021cd1edc55d28826ef9f75e45645fdfa89212e58d8630726b79ab492b02f069fceda53ff7079c02dea9e65635bb1e5a752fecfd4978b881652d8de22d74e75155455054c200750ae63ef022fa74eb353b8beee932a9c2f8d84fe849ad7884f6d2290417c45ad100207cc51718ff5f7d53a304254b511d7aa37dfc759726f580cceedc89acb4e3b7e60d5559455e40a17033932863bd9d464ca8352d43c6143fb24b89aff4a60aa0dab8dc89edee3c049cd61f67bbb88bcc1a9701e158bbef40ac1e8184f4d46170aea67400368aff788c77593c256cd53c7cf89703d562523bbe8b7d346ec7b154dcf446b3bd1b4c583abe932293350794b908f1b7df538cd0eeddee744e0d3961a77587f15efd202db222ea3f3de7b480f6c0f494c0fea70af7f82a6891b7f7e2d28bb1c894a0817c4298dabf3e47beea0e1cd1718b246b33a5f5c046849a98404f2f6e5d5bd67750944f16b2bd2d5f5dfc3a14428683d9ed745e0447bae5dc2884d096ee38ba881b45b2e411579f02d62c476f4c79216a91771b788ac9f9716feb8de1d78a05f43e26d69296ba478711de1f0ec9a211e6727d0b0019eb38478c0c3a0b559dc84d2d0f760c885472e94f69b6f795656adddafaba2b3d1a7b559a8c873d709d71d967d7ddc20ecd0b5e4a45bf898048664b76044531d385511e489ad1bc15f2db57629d5b114665e98a9feb777c93dbc40d5c90ef928add1223f4de61a68f5cff4b77ced14eae77badacfb06f8d440a766267477eea2eb091aad2a46d246d1e3d4d59ba16ede9383c52d8e33df72992892b4008e0a04c1b79723323239bff5e64b536b5f7249cf677448a0d87d0bec5df28796c653cdb0fe5afcd56f39859a6e662827f864491ceeb5748a12f1ac2f029248509eaf1db18f4a2e080129ea508987ce0c16418c203827ad69c786f0f4c71564a84772b54972f526d4fce41083e8d4722fd6cf432c3ae3120dbf483b9ce22bf1f57148ed0e225720acc2ecd1095c4e8317efedf768f38f6f91888fdd49793f1a656b4676ec2b0c244579b19cede8808bca9976e959023976bf1d0ffffdc071a09ae270b05ed6f896558c8016a8218c9a932b0574e4369de3e8bdf43ff4b4b40f8954f564282d82a8875246fc4cf09efeedfa1bb109b86cd27cb3c70f9d071790ce4384a5bb0ea912fcc29f0b444dfe266ff9c033482220d2b3b15da7a52ea34a314a36b72aa2fd8ebff94792fbbe50cdb9b56a579c3c366a68e4a8859574ef05a7aa9eed549c5cd2ad353f8ae6271a6661ee3aa2f23d7deb0fd518429c974cb21d582aa9c5c9bc2ca060bd6cbe6c4c1eb999a29e881f68d4ea86310c88c177abb8002b3af17a0d6b5f072e2bc73563e04d23b25e570e4fc9e523b7b47310056604cf789a96f01a7e186f96087da8cd2187de84b21b64ac2a1646664bbe0c5fb86c7aab15acdd8afa3a5fd259cc829342a80baaf6078d6bef31b4f5d67d55ff2c3645dee72c998036bc6c850e17024b317d6575e244de1226f48ffa4b82b1b80f33310744161b9cf68f8875163d528d31768f57fb0443b8a7ca749bdcc79523b72559126e147a617ec8de2a4377a9e6203756251e22d84ff885a8dd983a51e4c545a8685550b6e960b13b3b8a796a5a8ab71689227119c9eb067cb7d8b378eb2ae47be30c5a9950a02d39851e28d7eab8118f91fa013a126d051d6c99baa0e3d2d51d57639ce31c4e34241bcb7aeef9afa41c594819a6fe878e50a34d2e697dc47eec3173ed912c57cb1f0e083e0aee018c465b98d2bead8435af509acf831d6568fa93de25109b8126fa56ea24927e7f9f2bcdc7508fef88b9729b6f4be87498b3f0e8b9185eae18a22e960f32cbd9071c144d47eaac0911bf3c49de77462cb09cb3dc620d510257a0b61ce834033d7298ba2a50564f924c038f7872d6aef32813e73fb6c1fcea0e244a8b43fe442fc6e22addf694a25e4a2ccd0e2ef83ba96f753cca5d4bb570d75acca51a88d940d2bf5159620dcd995614783ad88180fb18ce4bbc34312a2cb6bd95880c26a19f4b14b4bf3b2e7b7c14617ae13a4cdc222bf24846cc9d0ec8c2664ca058580b7e9d984f64f3afc35d7522eca9a14069f4915a3309add476799bcccddb997448cfefa2b98f33b15b8c3c2ce3519aaf7abcfb59a6e011629eeb4de4f30c1ef70ba1d6ff1b992bfd9de586075806efbbac4e268fba56bf415dfb4e9fd7ae62a4bfc8c1bc764f3fb76828933c69d3191f3821edd684bed437f51a11715544c7873467b49f2175e7d6b97b18ae06f1daf483cb99fd43dfc73de139ccabe5e9450579f1ab23cedd47343dec2bb32a2108a9ed70660cc101fa9024e91ab6b1cb1521436d26c4fb1f0f3b5dec7557551827cc30d88413c6a56f7daab418ee998e782b1ec261a82636c087e9c1f72b59624fa14a58c4a43712c3a59fea34e28bce58d432fc697217667994dcf74e7b33d4eaba3cd0b435f0a4c5ba89340eb05e67231baae4bba7d3657ac7ae61700884968f025f73b46b85b5d9cd11fba975b2017a729a32ce8afba0f15b74fbe05b519cb6bfdaee86e4568f260f09dc29aa132381dea54be242d8f270564fe5799f4324cccc227447adedfa2cd0e3bff3b23a721113fd49be24221d8192d5795fb0d1e0145aa499d0af22ff9af8623a9212f4f1267d63035ab5bb1b20471d79f34f4755252d8a02b59c0c77f5a5e2469e4a592963c482f48c7a4a08ec9699469856f090326b5e0409daa16d1c503db58d2b744d5c3b09b3713e3e26fbaf1ff6b7a8671c65172e36e658e7dd08cd61f7f631b6ad6093c1014aef723da77603ea16f1e0aab6848d9271963c74a22f15b4521b205e6db40b0f90059f62a28343ef5876fb36f8a406c3b2f7640796a4f4551f158080cd30a19a98691ac0e45539265d1456ec4e46a4b62516d1c83df01447523cfbb9e4c23e7886d6494a2ef95c8f0f0653c473fbc346a6254c86c6f6dfdba2477adca9158c1216f12d21bb785d2fece713d5218bd0f8a365044370108e236e42ccf0e72ffc7b88ec384efd28dde841fa29e4acd2bb9983051c6a6c8e426c09caeda9f9d4f64bcf2beb4c2f5dce8583081d62489bf660db11392e40e1a0bac7fd9bb82766d302933b408933d5cb5653842d4f31eff693a0c50df564ece8dc92ad81ac21ef08c95aa5262f1136a99dbb1062bf475e14270e0bf16ccddc5f1e90d8bd05dc09f1a4677ca54ba0000b8b0ba733581a9e9c8f1366bafed05d376cddf20563520776786bd93e249f8066eb806887d0220789664ecf7bee66744f7e08e8d2afc071430e384c7d4b6d1af762b28601e6642192e2ae777b1ef4b82d5b4f6d7d76d01ee07eee798ac75e75585fd426de09eef889407dacb706fecd740695aee89e57bbceaf839f05f59ef50c6e7ecfdf73b0c20e735fdf6b6e5df704f792652dbbb3522e9ddc6bf78cc0ac73cbfb5cffba662c593de9ad26181d131dc237cd7a2e7645e5a484fd2ebab1266af07b99eda002cc00b3b1b63aeb7196106d69588543cc94e341595bd03e4c8256dc2bd9f2b6d9abf1ce65672d2bc5038d47d80449c683da42a0a15814edf36712f7659168ef713a0dfb8f18d9c19bddc598a67fe49f9324521dcd518da6ade043ff15350e7a8a704e6cd143b636e201885d2d3705e863f308c445b0fd23547a6e666ff98399345e13b4a474b12f7a72cf498de2d47f9a7f2122f84dea2d9248a785d23a94762ae6e293665281216c42ca677564b79b3a809321a9986dab6c37e3c11aec9b36d4fc61e3b6556733f5b33c6e9b7a79c435ef3a9549a9299a57ba86040de62991a78698c4b328e2ce83a0782603763998dff23e602f16ded1807a330aa95ba29bba473e89199930aedb3f49d943389ac4c00f47899ffa0528145f8e5257934d2226783e765665c63ccc8eee50a71983ec8bcff7b0fa40a35c799399104fe57682627a3b1db1ea7655cfa411dae501598056544ca136df920d976734291cc3cf167f89b7f2d2cb46e28396cce69c96e1305993499911f772d76d9b9f337d8ff65d46882a16d0471dcaffa388ff3f2d0f6fa325f28b2149b0513f75fdcaf0c13aff0e36fe4489a33cba7ad9b57587d79de68d916f4e7c948710b1d33e4adffd34e9a2b3e6d1e12576d42fbba5fca9fd9c6bb8280aaa2033a0c44efd25fef4ad50ede5d8c1e91cb4b82e428515c5618b6cf9b087f5773e4de03133dbf04c5ce17018916932bc1ce62dcd9f0470c8a981e9fa5778e6c2181f9edf93e7adc89922bc4b96de7297690b58632f195710c7854ef07445160ad24df286d9404ae9bda6d3ea08d50de16e1058c06f9755d0ddca13ecc8482ec01ae0a5377c2a949d74d2a16c5c57080e6761bb13a3b7d49d81a2179bbb52db014ea3098364ea72f8c08f4dcadc5b51af003f2347eafae36747b7567a279928db7ee525112212aafe90a81c70a9a12171940b1b5c3ef50ea44ad550ce135054bb961759eaaabed8caba96422866cc0e309222db79123a306b81d5e5a8dcbb883c92ee58db4e8e1215e63d86d0b9dbecaf1ed1531b370e36b3d1d91cfb5d070bca26f6e25a66fa0ae80ff60187e0931b6bd9cf7f5c840e4365b1048caa99348aec448a8199f582c59bb544b8cef6c95cad177f538492d046493312e6f23ac173cc409295b01da52d6506e116e6770d09d933c51c762741665e5fe74fb3ec47452cf83cf1e94aa2a1ff2c7065ce3406c138595") mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) setsockopt$packet_buf(r1, 0x107, 0x0, &(0x7f0000002000-0x7f)="86c89df63220a3c20cec43e03e9d9317714efd612534b1a12447bd98ac40c4befa38bacdb740b235cbe39b8e452b6eab5e53ae4b543ed9fffea3872c4e65258513608b2c3632e2b6819fbc057db532786ed09ed71779565519bc6abbba0651038150a4914a17dadfb78332c2106d26873b0a9587ed77d5132e5ad29f6bc570", 0x7f) mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) openat$ashmem(0xffffffffffffff9c, &(0x7f0000002000)='/dev/ashmem\x00', 0x80000, 0x0) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000001000-0x8)={0x1, r0}) mmap(&(0x7f0000003000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$sock_inet_SIOCGIFADDR(r2, 0x8915, &(0x7f0000003000)={@syzn={0x73, 0x79, 0x7a, 0x0}, @ifru_addrs={0x2, 0x2, @loopback=0x7f000001}}) getsockopt$inet_sctp_SCTP_MAX_BURST(r1, 0x84, 0x14, &(0x7f0000002000-0x8)=@assoc_value={0x0}, &(0x7f0000003000)=0x8) mmap(&(0x7f0000004000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) setsockopt$inet_sctp_SCTP_AUTH_KEY(r1, 0x84, 0x17, &(0x7f0000005000-0xb0)={r3, 0x3, 0xa8, "08108b0e835237a8ee073ead77e7c84481724064042279db33fcfffd11d1ef36213260a90edbb7b5b81067abd472ac8e957e82b2368047e9d0a825b3e5fee3b59a350cfa8f8ba42d1b17fcf487319f4ab7f69abb9166d3cf8b0f63e84be88a57a5c4863fb342144e8fd60ab02011322c1cb6b1cb71f59d15262a14684c9cce4b9ba0c49ac6a9800afcd8fa5b72332eca1da90707ec7e47055f4af6693070d4f654f5b5ce533f818b"}, 0xb0) mmap(&(0x7f0000005000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000005000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r2, 0x84, 0x75, &(0x7f0000006000-0x8)={r3, 0x4}, &(0x7f0000005000)=0x8) ioctl$EVIOCGKEY(r1, 0x80404518, &(0x7f0000003000-0xae)=""/174) mmap(&(0x7f0000006000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r4 = syz_open_dev$evdev(&(0x7f0000007000-0x12)='/dev/input/event#\x00', 0xff, 0x4140) mmap(&(0x7f0000007000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) poll(&(0x7f0000007000)=[{r4, 0x1000}, {r1, 0x410}, {r2, 0x1}, {r2, 0x2120}, {r4, 0x1000}, {r4, 0x1440}, {r1, 0x10}, {r1, 0xa080}], 0x8, 0x5) getsockopt$inet_sctp6_SCTP_MAX_BURST(r1, 0x84, 0x14, &(0x7f0000002000-0x8)=@assoc_value={0x0}, &(0x7f0000008000-0x4)=0x8) mmap(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) getsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f0000009000-0xa0)={r5, @in={{0x2, 0x0, @remote={0xac, 0x14, 0x0, 0xbb}}}, 0x6, 0x0, 0x100000001, 0x9, 0x81}, &(0x7f0000009000-0x4)=0xa0) timerfd_create(0x1, 0x80000) 2018/02/10 14:10:15 executing program 1: mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$mixer(0xffffffffffffff9c, &(0x7f0000001000-0xb)='/dev/mixer\x00', 0x2000, 0x0) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(0xffffffffffffffff, 0x84, 0x1a, &(0x7f0000000000)={0x0, 0x3e, "c855bf93d45dbb846659488bccfa0932f4ee2ae0aa9cba88e27308d20321ef528e8ea76b374e726d6de3caf19a73e975b6721ffc0dd70ea3190a1013f070"}, &(0x7f0000001000-0x4)=0x46) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$sock_FIOGETOWN(r0, 0x8903, &(0x7f0000002000-0x4)=0x0) perf_event_open(&(0x7f0000000000)={0x2, 0x78, 0x6, 0x40, 0x1e7, 0x9, 0x0, 0x2, 0x21, 0x8, 0x7ff, 0x7, 0xd8b0, 0x2, 0x3, 0x3, 0xff, 0x9, 0xb630, 0x4, 0x6, 0x1000, 0x546, 0x359a, 0x3, 0x4, 0x6, 0x5, 0x9, 0x6, 0xf86, 0x9, 0x4, 0x4800000000, 0x9, 0x3, 0x100000001, 0x9, 0x0, 0x7, 0x2, @perf_bp={&(0x7f0000000000), 0x2}, 0x8000, 0x1ff, 0xe0e6d13, 0x4, 0x2, 0x81, 0x3}, r2, 0xffffffffffffff38, r0, 0x1) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) getsockopt$inet_sctp_SCTP_DELAYED_SACK(r0, 0x84, 0x10, &(0x7f0000a5d000-0x8)=@assoc_value={r1, 0x8001}, &(0x7f0000001000-0x4)=0x8) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r3 = creat(&(0x7f000080e000-0x8)='./file0\x00', 0x76) ioctl$sock_netrom_SIOCGSTAMP(r3, 0x8906, &(0x7f0000be1000-0x4)) r4 = socket(0x2, 0x1, 0x0) setsockopt(r4, 0x6, 0xe, &(0x7f0000902000)="020008000000000000005462fa01a15eaf0d2cf653f13cc379ede4eaf40f4a95bbff850a8263357506b31e58a98399b397e695c0f03d3b3d54436fe71cbcdc6e30ac10369300f6af7d07634832b8a5c0a94c470502e9337b3e7298fc74e81b1058d02f9b14732017e2466a9fc43aea71263335960415800020f9575da602000000001f0000d1b0e6ebcb12c7291871363e97100c4a4c2e9f5c0c14f1659ce8c8bed2e97e60a3649f93ea0c8263f864802ad72fa698807ef14a4a1813e976be1d113b514dbdc05ea1309163d6a4830de8391f2ecab7bbfbcb", 0xd8) getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000e3d000)={0x0}, &(0x7f00000f1000)=0xc) fcntl$lock(r4, 0x6, &(0x7f0000f8b000)={0x3, 0x2, 0xe4, 0x1, r5}) sendmsg$kcm(r4, &(0x7f000043a000-0x1c)={0x0, 0x0, &(0x7f0000e66000)=[{&(0x7f00004f2000-0x13)="9be76af953fdbb6b56716e05364f767a81091c", 0x13}, {&(0x7f00009ae000)="f2bfefb902b396532d197c30199e311e0e", 0x11}, {&(0x7f0000372000-0x1000)="c59cc1dab8375045f26e9cd9886e071c9226a90f80fef8ff21b767b5d8172a70b1fef8c3b62c5d6fdb7a1e5868793d05f9703aee2f39bbd6a4974e938fbf1ca69969bbfa36439f63dc3bb6c8ab2ee0706eed54ddfc2bcd4c0813cd77e50696569fac98bbf93cdf49ff736b7945a6af1fe470a9818ef68bf9f8628ffb65921f99f6c9164716e827421bbae38e8261499b555a06b11b26e787b007bfead27ea393caef8c15fe1a2c8aba3b7a787a0e6d32326d609648d0bd98e209906b0f1d9759c8c9ada48661b542e515e8adc0d4b1f57a083c433e34e40680147b7832f43314be46526e880bd7420ad6d358259c3702d647ad64f238bce4ef1d24499b1e8a7bf13abcec6bd1936ca1ffa1aebafd9ebb12ae39ea629ede5955149b49208f48f1fd76e283bcf266dc0862bdf32a9264a051b9d6e82a2521f74f6458a2b4a6a052b8c42617c2912ee59d868e3f611f3b2fcc24352fb9aa08b1ee2e3e8ad9b0013e302387af20663220c1955dfddf02f202abb8019ef3b50c2e6db660630f0d7960ada6ccd5c47ae9c27db4a44f8bd9c76f3c1357aca1356133b11bdea019731f28c0f3a211fd6fedadfea3aaddf587a195a2def3a92491ba41c79f8864051b6a3dd285a2f864b29cdd6a675ac3038982ecc71ac948a44cf443bde8c2220573a732778c47ed67926d743061af3484605c363b25f86143b92e4299c8a74563acc1e1ffe3e532645160a0e03be71d356a25f57c6114c220ab2e3d021e58e2b08e7ac819c530a31234f1fc42c217c68538905b8ce4e0dcd7baaed2337ad1c32a7909de225ad690676e2af6094124485bb75a36a6e6dea247dc305f03ab19eb6d1b4001cb8effee6709f0fa208a08c6f9e1cd9465d93208ad186654d7284a35150972a401a37bb8cb5125e7a98b0ec9dd4d1272d0e795fb0f80518e5acb48330fa78060d9f80d8df041993d6f68e38acefae48d1515d19e3ccbbcf6c0cb1a8fe48bde41413b99ece603dab9b43319ce0ab53a4fad7b0630eff0ab943ffa62c055222379b6dd62df31cb8e0ffea17745844e0ffc8d7d3d63134e191d7cf04c81b327f32726c73af77b7044e97d13402254d1dff34e60792e0322e942aa71a6f63bccc3eebf2a069a24d5ee1352eacb19b66184f4d056096fd7f63b7111be3a4abab84c4ea2de5369e7aefcb8a806d2f65f627be026d0bfc8c923521a132d8bc066e5334c7062d24973db48d15ea55ad4e80cd652af0578618d4563450fbcd4285541d2ca0a485deffb14f46eb6951c75c87aa9c45ed88ca6deec49744c012dc36f7d9fca37f6fe578d3d65ee14e90aa9524ad74d840e27c637f8f3876cadf3bd3ad03914b19dc4f1056eeb7e8b1dc9f992d78e89fa43d98da2f232486f159629dc8315e7f57a51cbaad8b22949e44aed9a1c92608c0d8a031592fe402bdc4190b9a376d0ef2f8e3bd200fb18c126ce420955bc960619705e8936b10b880678463ebe0eb179f158dde0a00053aa0434aa80beb98b098872aae71819abfb140dd18d5e93fb8117437001456b6cd3c1f2bfaa17ef88739b40972316f09681504c36a321437bc30c03241929c43355fb4bc02a8cdbafae8525f2f4a1184aefb7880a6263d4f018e0a88b967e42a50726825961e59d5eafeb2434aaa9e628e8885847eed159cc1f3468f31408e352b67049897bcab446b115994634bd9c689a2ed478c4924ca2dc84fd8ed027f213117473ec9e07649feee4a572096bc3c3a7d653df03057b8f2c75fba5dfc7dadcd37ede7376eef6e6cf8a76604bfc660df4911759951a7d6b589a9a7a45afcf6da90f66108a9d318ce5c1cecb068ff6bce4dcb6b3cee896fdd1a006576263ef663ea2d582fc780dbc2d802147ce8c34404e0cc48acca33770696b68a3757528174c735a911f9d5a2079be7b56bf1b62e75d2043a6e69d3e1550ae92bb0767ff6eaac272a007821592db3c3a0647026c6ea4fcf2868dee7b9ad9b4204ac8e2b56b34bbd13f6be658a546214f7f81d1f0546442713c12ae343f3d02550ce3a7628f2ebb7eb7a96ab17f9cdefc31166722f7804130b06fae1625a8835f0c227c8ffb0ef402bd859be5fba755e58ad4336d01cfe69dc92e70d26ee74cd4a087fed97a58c34b1b59acc9d967b81cd991283c26dd01424ef116b92edccde2049eb0eb7bf6ff3a6aa46c68027a8061d27238363b1b9ccca1e0c3b1e329aab2d33af20d82d9aed5498a5c719040ab2ea84995ac5f7cd5cbb106126003367e4bcc2080b57e2498fa5ea75f04c47df36f7e3674b654f38d031335966d4a5007f94d57bb34230e2c624dfba334452ec10d1bf1b97288752209b05f16348f84341a1aa647561673d8a67344477984234c5e0763e18eb180418c5e9dfee2d9bd8a9251c4ec3ec31657011b540136a8da7d997822d43de3df7af122d9ede5748b9f03155bdb9a78f3cb025b3c4b5ec4aace7553ae3ac77eb396ff6520598cfddc4fe07b0816d97428523ffeafcbcf825a0c817e4a6d27c202b10b3aecb279e80dd0ac31e2757bf296278bbd18a55c6a44761416c13b1986aacb78fffdf00f4586780e31fa654c48b08e896aa84462a0c8ce1dbc3efdb5b4582d8dd84e05eb9e063c500d70247180dd5a48419ffcf82f8daddf97c8868eaa103bf18f7924cb5c5e186db42d05e15f635a9d8eb06722530b1ed300dc4d7718ffc4df313591a105e534186f7fe11fb02a4aa405296dd2620fa57be8a6db87a422386373177cb7e2ef8bf0d47d8cf9da24dad3acfcf71f5b9738e0516d27d49ce459fde8b9931787566d39a1df2242e7a5521bf9a4ee80c1b1c5a64a18c74a3f75e5518f49b7e53878cb183e3663a5fc3a84d56a4b78ffd31f2ccf624df96b3eb7998f52ade30b0c84b0186425acfc557e8169b4a49e3215c70a02c298056cfb34c7d7fa6c2fca05eda38336925037277bac89fd9be2ecb69a6b03e36567671c2e4d58b7da7bb34aec9c6fa4bb17770e78a448e68518df53572315e236ac4a4e8120a93a58592bd5fd6fb17e47b40185a94ba595fce22646ddbfebdfec6341fcfc30fb7e52624a4bfebdf10df2e9d051c6d50d698da722e1b013dd62042b409b86f6fbab17897009e15b729c695c5aab3d1d960ad31b4035d65e09264834e0ed6727ed094269416f639186370ca14be2c847a7f88bedd8464864892b5a51aab709ae037a10d97d04f5cce04d916fdebd171b5896d7c33c0884d7d27c20c414253dc6e372692e52bc5db17e944f8bbc8195b8b5e354e38be68a1e283b38638fdcd070a342a28a13bdb5ca205d9e337e5fc736221445caf374d363f631705acfeabe7a12aa5727e0c8057ae70bfa3fdc8f6e6d4b0783aafd0e576d1bb912e2da7ac083de3599fe01ed230354f857b29fe1760cddc2dfb4c46f4b118673b9613aac51214aa3860b27adbeecf0e54538acf18b859aa4c2b502131a1b7a2f0ba89e297e53ae5c6e7945291e00214d8676ab1ef6cf379ba810b9fdb7c1f23b22f8066ae72ead102e9e789e4e4313362b2a94444705b59e7064bc4c8d3692638583ba4ba7a778dc8a2cf2bd7b60d4090d7902d501aeb42ce7e33c8daa71b58629181401f57a8f6f128fa62b9474ac4f08199e38001173df6a8889e9f53e02ecbb2327a1db92a16e766b6be254c4bf075d7b4a352eeb694831234bc4835c143825e872f34518c66bcc2b026c3feca22d951656096f93e45e2356fbfff5d5dd3404657d9329fdc0f8ea8fb682be70d141660f3858fb293883d3cb14c8f725c6edfdc4aed3a84e074af1a9b9b212ce4719c3f189b558da1ee68572c1c119c1cf564dac54da3ee33d751f76ffeeaf8ac0354783b716cdc73a34744ecc9c4c33e258f9d0c42d3e9f0990f4d3e5b66d683f3aef247dafb58dc4a9f255e4555e3923ff9a6d27907443840800bbb0ba0a7e44844d56d58021b5100683ac0ea2d158c2d8354d1589cbfd59cbb657ed1de81c0d1ee283c4511e8c85628b52c57c8a9e9af583e8060660ed1ab549abf8ed7b7b760f8e0706f0e8828a2c5c4fb1b346ddef1959083254e331667a21af27409163a9a6a803a58a0e9eaf9e2f083487441268c2f1aa3c94d053064d8c751358b073692cc0c1e7124cdfe014dc767641a0e6ab0aa4f6eb09c89e6cda0de689ca93178264217b24750acb624d14e41e8d150900b87393db472f6b85760d653bc73c00cdc995293cc3488aeac01f1d85565bcb43d21821fd7799acfcd433753bf0a0a12c3a0a98b23b3a1c61e844b84231c7f3dbf99b2ad0ced100304ab51a03a3414f1f6838465fb2150fe747bd02cecbd684ae502ceb7f53d3cf117f7fc9d62ca3f2a5484fe06c0b58039802dc6f55a4deda572f16e9eeab7fcb9db30003f113c09dd5c61f172d4e0c168b8b1a06f885230ddefb924852ad97605e14594e0d2c131ae7fc935cdd3403975e4e5d5e3cd1b146ead3bfbc049b059d0ec12dd534c8fcf06270dc90e33ca5443270d6155f0897b25f254fe863c2a5ed4d577f4759ca0560ee0985ef2b1af432e69dfd58ab0d27a850a74c946e6a8ed1372f7817505e79b83695cfc99d4bdb14c9a8cc0964309d1934d22e13bd66c00883d550d69f43c62d0caae2517af8a0d12fd09f483e3315668f29ffb86c5b8942665291fe6a54ff0f0d9fea25df29a9f0e6b5bc77dc1c6510a56c158d219e96528507bdbcf17d5596baf5d3e3014d1b0e0485ce4c662260864a9f19140eabab61938cd5c126c30d1e1546549498a33844749009e5584f4de49d6f3446a8a192901e8c46cbc0020468922c5268c87362a866e2c168f1de85d6f31c4aa9e5a8315d6315a64a7b24eebe64cd56830e22278aff9914f252be6796e6e559e397432ac0f97c1bce02da840dc1ed2c55d84b442f1aa9a631fba0a8f57a4811b8440f4c5bad084c25983c70d04ef8abf21e7d083d6f6637ad9e9570e17a27400c5d6d9ee162551ddf6115a30645f49416250945a11c604cc618402a7238b0a0cd5a43960cac3cb62913d14b98cbb0a5242e7726eb8f7b37b08b805d00c88033c66d0f942e66f41bf73e181c33d93b95515069298113a42442134d499969d317d15b9bfa18e238fb0a3c06c48cc05538cb4f49c80d49d84517f3edb7e818b070246369a4688e2aaa0c89999e6c4dd6b693f9beb179d7db8f14969787b2b8be17d1bc9b437328e6ab979595d12b1e42fdb7b53eabc95f3f85fcef5aff45ee7bb6442e8dedc53e009c0506125b3c5d06fd8631a35ab64b1482135326e8630954357e036faca34474f8b35e0ebb8ff20ea5efed48a7aaa90a6689f74a825ba30db5af8d241b17ff9c3c6b769a86d25156b8234903b1d052386b7ce8f9c8032b95dcf7d8caf793f89ca8a6901ea0187cbea0cce84f767daaaa9562363a7a9c3f1744148ebc485e1a0892880e04389496984ad01148245ed733fd7f27db325006084e52b71171ac56637bc486da7b55434c2491c9fb6c29e88280393d516d53b6c00ea527d88b2f5fdbd6b06cf3fdc48802d6504e0c5a8a1d4aa18628efa944d86263d7328f10368195988092ec2e41a78ca2181fd7a947f9f63311baf51b1cca38560b62609f3f563401abbffc78148c420f4fe867d2625547e6f55553f6f9ab924da628c334784392e04316588f7b8f5bbdfef26618138505dcea92e3e5aeab3db78b971fa50bc05055e1aee508e729fa90c3d1b5ae1ab0138f8e2add316cb8ab394f6773c3ab4c6e066e576d068af157ebb4431dfa113d9fcda34638141b618d77e4dc34aa2385f7cf2e9ea7", 0x1000}, {&(0x7f0000c1c000-0x63)="9197fab7c452b5311d7ee6b3bcd6a4a73eaf2a86b3f5135f94cbe278449b1e745cfcb28e0da3299304b04db306e41a7ed5600819669fab930b89ea38035be43c1c4dc41aaa968b6231caf3c545bbc94360e33bc07f3942e09f4422837f6eb3b4405b10", 0x63}, {&(0x7f00003be000-0xcd)="db859814be5dfdb419ef8c7ff4006f187e82dc710303a6542a6de9179c4cf49976e590c5fd6773b98ccf608cff546f8ef3bf44cf62264664d93d0c54d2a677da9d0a4839a62d799935d940f9319d717f630e03f1a9f46cc943e9054b454c443cad2bf663e03fbf51bf7aec1b4d1995a086198f72b6326bf3c12a0fc0cf825a9540d00fdf27d6ef24efc03e8635522bb201c80629067d642c83de542eec80c6782103afd54b9a9887acaef95400be2bcca351380a74f9edabf0807cbf1f72fb585dcf0e0e2192f73f538fab2ab5", 0xcd}, {&(0x7f00004a9000)="72a6b002cd4bdeb3c3fb01e1ce85252a4f486f72f964abdf233d1f99676a5e895d8f8cda8c844113f37cb86abbd195298ccec06bc6b2086787566a5e874831c8e4385027f92043d80e002e3ec185d1389c7fa82a7ee059cdc5ed4cb9e8963b6d939b4db57f1317edab2e867d5e383898a6333a58d6740fbfa1ec52396308dfb1d4dcbf4c51437dd3362d4357679a7fd93c48b456cd69823f3a4df10b41b5c2b739733027262322cf3401426ee8977fc521bf5c5a2f28396da1a01298b324bb606a9c25c8553c024644", 0xc9}, {&(0x7f0000520000)="b07444e0921484d28f9fa483ce2eac80092ca9660e6c4d36c75e0de38fe808fe0f09e343c460616f9ccdebc68dc9685ee7c066fad6d6143a65cc4af85890f2c6c02a57e98b8c36776f63aa9229a088d94dbb1559ab0109f31c7031d86e3c184d1d1b600236ca8ab60bf40806dc4d359e4adac4ab421d677941150bb1ea6f0ed4fc37adfeb62688023aaa77b99439c7abbdd59480bcc478", 0x97}, {&(0x7f00008c5000)="507d84db5c80295cdfae99bbd49626ed0e25c181bcb7065ae87ab3e799ea657a992015e8a1f37032da736640cffdc7379d5bd5e977f1dc40ee09813a5299dc87428a82264587b4a0e6e9b3f684afcf89", 0x50}, {&(0x7f0000fb1000-0xdb)="4e274706c0346c348d3f4817ec35bd6df5079715bffe2e7dfc77e1d49f481d9ba21d384d5b586dd7dae4f1c80adcd7776c0de926602cc822e2ac26782f6f218d82c015afb8218b7e5d9c6d20230a396dc6e83ce9fac5d579eb029d230b92bbcde931d44db81015cc9d502a59a1c18b882306aff133adb7ed7071f0043be06985278f5aefe2bb0a33ca147a0234aa05ac58fb57a28270f7246ccb556b9c15d79e6ede5d00837166b5fda5789a62beedd50c1e04f3b52924221e4183eab7e7e265ba0fb5376b32dacfc812df58caf757ab4885c7c6ae2dbc4f2141d0", 0xdb}, {&(0x7f0000823000-0x85)="2cc15ad494aa18ddfdf5755ee0a7221371856a6deadb07178728402a21be94d923025666fdcae32fdd5506cf099a40828261a0dc35442bd67a92817bf5146f42d2c6e466027b02b329bb393b39c8f7d7ebd28f1ac4daad1228d5fc0abf9e8fb0df3d104c844f9857e4ee9460c7eee7af411c70dee05bf91ffdae05d347c699d8620d053e37", 0x85}], 0xa, &(0x7f0000476000)=[{0xc0, 0x10f, 0x9, "71211e590622cbb8328a151b3f697416fa5300d90d39f073696b54bb505157d81e90a1446b9391c61252d12db7bcd6c46f6423e65e62d502f5586aea36fbe1ca5f90cf19233b0ca9eb66ca05fda8459554f7b0bf020405fdc5bc4680c1223ecfd7ceee2d8e6841316ff4c8e42e276fd15ad22b40e7f5657e5e83e2e7e2d6ce549097912f3d0a9d7db6942d49e3b0e5df6c68d7a6c4057d3ebd3602b0ef21d2610a1dec7ac851c55147dd6adc54c4ce2e915014b2"}], 0xc0, 0x800}, 0x40800) setsockopt(r4, 0x40000000000006, 0x20, &(0x7f000061d000)="020008000000002000005462fa01a55eaf0d2cf653f13cc379ede4eaf40f4a95bbff850a8263357506b31e58a98399b397e695c0f03d3b3d54436fe71cbcdc6e30ac10369300f6af7d07634832b8a5c0a94c070000000000000098fc74e81b1058d02f8001732017e2466a9fc43aea71263335960415800000f9575da602000000001f0000d1b0e6ebcb12c7291871363e97100c4a4c2e9f5c0c14f1659ce8c8bed2e97e60a3649f93ea0c8263f864802a602fa698807ef14a4a1813e976be1d00000006bdc05ea1309163d6a4830de8391f2ecab7bbfbcb", 0xd8) ioctl$TUNATTACHFILTER(r3, 0x400854d5, &(0x7f0000f81000-0x8)={0x1, &(0x7f000079d000-0x8)=[{0x5, 0xfffffffffffffff9, 0x1, 0x2}]}) close(r4) 2018/02/10 14:10:15 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0xee, &(0x7f00006df000)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @local={[0xaa, 0xaa, 0xaa, 0xaa], 0xffffffffffffffff, 0xaa}, [], {@ipv6={0x86dd, {0x0, 0x6, 'oCQ', 0xb8, 0x3a, 0x0, @remote={0xfe, 0x80, [], 0xffffffffffffffff, 0xbb}, @mcast2={0xff, 0x2, [], 0x1}, {[], @icmpv6=@pkt_toobig={0x2, 0x0, 0x0, 0x0, {0x0, 0x6, '&>\n', 0x0, 0x2f, 0x0, @empty, @dev={0xfe, 0x80}, [@routing={0x0, 0x10, 0x0, 0x0, 0x0, [@empty, @ipv4={[], [0xff, 0xff], @broadcast=0xffffffff}, @dev={0xfe, 0x80}, @ipv4={[], [0xff, 0xff], @multicast2=0xe0000002}, @remote={0xfe, 0x80, [], 0xffffffffffffffff, 0xbb}, @mcast2={0xff, 0x2, [], 0x1}, @ipv4={[], [0xff, 0xff], @dev={0xac, 0x14}}, @ipv4={[], [0xff, 0xff], @dev={0xac, 0x14}}]}]}}}}}}}, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$evdev(&(0x7f0000dda000-0x12)='/dev/input/event#\x00', 0x0, 0x0) dup(r0) ioctl$EVIOCGRAB(r0, 0x40044590, &(0x7f0000e95000-0x4)=0x80000000) ioctl$TIOCSBRK(0xffffffffffffffff, 0x40044591) request_key(&(0x7f0000102000)='big_key\x00', &(0x7f0000ad3000)={0x73, 0x79, 0x7a, 0x3}, &(0x7f00006cc000-0x40)='deflate\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', 0xffffffffffffffff) 2018/02/10 14:10:15 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r0, r0, &(0x7f0000049000), 0x3d2) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000008000)={&(0x7f000000f000-0xc)={0x10, 0x34000}, 0xc, &(0x7f0000220000)={&(0x7f00008d6000-0x14)={0x14, 0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, {}, []}, 0x14}, 0x1}, 0x0) r1 = userfaultfd(0x80800) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000ff8000-0x20)={{&(0x7f0000012000/0x2000)=nil, 0x2000}, 0x1}) bpf$MAP_CREATE(0x0, &(0x7f0000fb4000)={0x2, 0x8000000000000004, 0x400, 0x7fd, 0x4, 0xffffffffffffffff}, 0x2c) userfaultfd(0x800) clock_gettime(0x0, &(0x7f0000132000)={0x0, 0x0}) socketpair(0x1d, 0x800, 0x4, &(0x7f0000589000)) r4 = syz_open_dev$mouse(&(0x7f00006eb000)='/dev/input/mouse#\x00', 0xde6e, 0x1) timer_settime(0x0, 0x1, &(0x7f000097e000)={{0x0, r3}, {r2, r3+10000000}}, &(0x7f0000939000)) fanotify_init(0x25, 0x802) r5 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000ef2000-0x1d)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f00002d8000-0xc)={0x0, 0x0}, &(0x7f0000d76000-0x4)=0xc) syz_open_procfs(r6, &(0x7f0000013000)='ns/cgroup\x00') openat$ion(0xffffffffffffff9c, &(0x7f0000dd5000)='/dev/ion\x00', 0x800, 0x0) pipe2(&(0x7f000058c000), 0x4800) setsockopt$inet_IP_XFRM_POLICY(r4, 0x0, 0x11, &(0x7f0000e12000-0xe8)={{{@in6=@mcast1={0xff, 0x1, [], 0x1}, @in=@rand_addr, 0x2, 0xbd, 0x3, 0x20, 0xa, 0xa0, 0x80, 0xbf, 0x0, r7}, {0x0, 0x8, 0x0, 0x0, 0x6, 0x1fa8, 0x8, 0x20}, {0x1719, 0x7fff, 0x7ff, 0x7ff}, 0x1, 0x7, 0x0, 0x1, 0x1, 0x3}, {{@in=@broadcast=0xffffffff, 0x1, 0x7f}, 0xa, @in=@empty, 0xffffffffffffffff, 0x3, 0x0, 0xffffffffffffffbc, 0x20, 0x6, 0x2}}, 0xe8) openat$selinux_policy(0xffffffffffffff9c, &(0x7f000010e000-0x10)='/selinux/policy\x00', 0x0, 0x0) setsockopt$netlink_NETLINK_TX_RING(r5, 0x10e, 0x7, &(0x7f0000ab4000-0x10)={0x6, 0x7, 0x52, 0xfffffffffffffffc}, 0x10) [ 73.116838] binder: 12118:12123 Acquire 1 refcount change on invalid ref 0 ret -22 [ 73.124751] binder: 12118:12123 unknown command 0 [ 73.126624] binder: 12121:12126 Acquire 1 refcount change on invalid ref 0 ret -22 [ 73.137522] binder: 12121:12126 unknown command 0 [ 73.149703] binder: 12124:12128 unknown command 0 [ 73.156680] binder: 12124:12128 ioctl c0306201 2000a000 returned -22 [ 73.162562] binder: 12118:12123 ioctl c0306201 2000a000 returned -22 [ 73.171221] binder: 12121:12136 unknown command 0 [ 73.176749] binder: 12121:12136 ioctl c0306201 2000a000 returned -22 [ 73.176865] binder_alloc: 12124: binder_alloc_buf, no vma [ 73.188975] binder: 12124:12128 transaction failed 29189/-3, size 56-8 line 2957 [ 73.197058] binder: 12121:12126 ioctl c0306201 2000a000 returned -22 [ 73.219856] binder: BINDER_SET_CONTEXT_MGR already set [ 73.225418] binder: 12124:12128 ioctl 40046207 0 returned -16 [ 73.243632] binder: 12124:12128 unknown command 0 [ 73.248722] binder: 12124:12128 ioctl c0306201 2000a000 returned -22 [ 73.268239] binder: undelivered TRANSACTION_ERROR: 29189 2018/02/10 14:10:15 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) openat$pfkey(0xffffffffffffff9c, &(0x7f00007fc000-0x15)='/proc/self/net/pfkey\x00', 0x0, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000ce8000)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @random="ec480f7b3581", [{[], {0x8100, 0x5, 0x8, 0x7}}], {@ipv6={0x86dd, {0x0, 0x6, "0405a0", 0x8, 0x33, 0x0, @ipv4={[], [0xff, 0xff], @multicast1=0xe0000001}, @mcast2={0xff, 0x2, [], 0x1}, {[], @udp={0xffffffffffffffff, 0xffffffffffffffff, 0x50}}}}}}, &(0x7f0000d0b000-0x14)={0x0, 0x1, [0x0]}) 2018/02/10 14:10:15 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000b36000-0x11)='/dev/qat_adf_ctl\x00', 0x8800, 0x0) getsockopt$inet_sctp_SCTP_DEFAULT_PRINFO(0xffffffffffffff9c, 0x84, 0x72, &(0x7f0000f31000-0xc)={0x0, 0xffff}, &(0x7f0000500000)=0xc) setsockopt$inet_sctp6_SCTP_MAX_BURST(r0, 0x84, 0x14, &(0x7f0000456000-0x8)=@assoc_value={r1, 0x2}, 0x8) r2 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f000000a000)={0x34e, 0x0, &(0x7f00001e5000-0x8)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000006000-0x54)}) r3 = syz_open_dev$mice(&(0x7f00007ae000-0x10)='/dev/input/mice\x00', 0x0, 0x80) setsockopt$inet_sctp6_SCTP_ADD_STREAMS(r3, 0x84, 0x79, &(0x7f000030b000)=0xfffffffffffffc01, 0x4) renameat(r0, &(0x7f0000f03000-0x8)='./file0\x00', r0, &(0x7f000060d000)='./file0\x00') ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000008000-0x30)={0x0, 0x0, &(0x7f0000d06000)=[], 0x0, 0x0, &(0x7f0000176000-0x1)}) clock_gettime(0x0, &(0x7f0000e45000)={0x0, 0x0}) msync(&(0x7f0000311000/0xd000)=nil, 0xd000, 0x7) ppoll(&(0x7f00005bf000-0x30)=[{r2, 0x4}, {r2, 0x410}, {r3, 0x2004}, {r3, 0x1f}, {r2, 0x80}, {r2, 0xa0}], 0x6, &(0x7f0000db7000-0x8)={r4, r5+10000000}, &(0x7f0000bf9000-0x8)={0xffffffffffffff7f}, 0x8) 2018/02/10 14:10:15 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000a000)={0x34e, 0x0, &(0x7f00001e5000-0x8)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000006000-0x54)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000338000-0x30)={0x0, 0x0, &(0x7f0000d06000)=[], 0x0, 0x0, &(0x7f0000176000-0x1)}) 2018/02/10 14:10:15 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$vcsn(&(0x7f0000fbe000-0xa)='/dev/vcs#\x00', 0x200, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_NEXT_PORT(r0, 0xc0a45352, &(0x7f00005f1000)={{0x21a, 0x8}, 'port1\x00', 0x0, 0x4, 0xffffffffffffffff, 0x6, 0xb1fe, 0x6, 0x1, 0x0, 0x2, 0x8000}) ioctl$KVM_INTERRUPT(r0, 0x4004ae86, &(0x7f0000b24000)=0x6) preadv(r0, &(0x7f0000749000-0x50)=[{&(0x7f0000499000-0x43)=""/67, 0x43}, {&(0x7f0000933000-0x9e)=""/158, 0x9e}, {&(0x7f0000184000)=""/77, 0x4d}, {&(0x7f0000ccd000-0x1d)=""/29, 0x1d}, {&(0x7f0000e3f000)=""/195, 0xc3}, {&(0x7f0000104000-0x1000)=""/4096, 0x1000}, {&(0x7f0000df9000)=""/253, 0xfd}, {&(0x7f00009d1000-0x3e)=""/62, 0x3e}, {&(0x7f000089e000+0xdc0)=""/223, 0xdf}, {&(0x7f00008af000-0x71)=""/113, 0x71}], 0xa, 0x0) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000f56000)={0x0, 0x0, &(0x7f0000f85000-0x10)={&(0x7f0000334000-0x78)={0x2, 0x3, 0x0, 0x9, 0xa, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, [@sadb_address={0x3, 0x6, 0x0, 0x0, 0x0, @in={0x2, 0xffffffffffffffff, @multicast1=0xe0000001}}, @sadb_sa={0x2, 0x1, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x2}, @sadb_address={0x3, 0x5, 0x0, 0x0, 0x0, @in={0x2, 0xffffffffffffffff, @rand_addr}}]}, 0x50}, 0x1}, 0x0) 2018/02/10 14:10:15 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r0, r0, &(0x7f0000049000), 0x3d2) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000008000)={&(0x7f000000f000-0xc)={0x10, 0x34000}, 0xc, &(0x7f0000220000)={&(0x7f00008d6000-0x14)={0x14, 0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, {}, []}, 0x14}, 0x1}, 0x0) r1 = userfaultfd(0x80800) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000ff8000-0x20)={{&(0x7f0000012000/0x2000)=nil, 0x2000}, 0x1}) bpf$MAP_CREATE(0x0, &(0x7f0000fb4000)={0x2, 0x8000000000000004, 0x400, 0x7fd, 0x4, 0xffffffffffffffff}, 0x2c) userfaultfd(0x800) clock_gettime(0x0, &(0x7f0000132000)={0x0, 0x0}) socketpair(0x1d, 0x800, 0x4, &(0x7f0000589000)) r4 = syz_open_dev$mouse(&(0x7f00006eb000)='/dev/input/mouse#\x00', 0xde6e, 0x1) timer_settime(0x0, 0x1, &(0x7f000097e000)={{0x0, r3}, {r2, r3+10000000}}, &(0x7f0000939000)) fanotify_init(0x25, 0x802) r5 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000ef2000-0x1d)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f00002d8000-0xc)={0x0, 0x0}, &(0x7f0000d76000-0x4)=0xc) syz_open_procfs(r6, &(0x7f0000013000)='ns/cgroup\x00') openat$ion(0xffffffffffffff9c, &(0x7f0000dd5000)='/dev/ion\x00', 0x800, 0x0) pipe2(&(0x7f000058c000), 0x4800) setsockopt$inet_IP_XFRM_POLICY(r4, 0x0, 0x11, &(0x7f0000e12000-0xe8)={{{@in6=@mcast1={0xff, 0x1, [], 0x1}, @in=@rand_addr, 0x2, 0xbd, 0x3, 0x20, 0xa, 0xa0, 0x80, 0xbf, 0x0, r7}, {0x0, 0x8, 0x0, 0x0, 0x6, 0x1fa8, 0x8, 0x20}, {0x1719, 0x7fff, 0x7ff, 0x7ff}, 0x1, 0x7, 0x0, 0x1, 0x1, 0x3}, {{@in=@broadcast=0xffffffff, 0x1, 0x7f}, 0xa, @in=@empty, 0xffffffffffffffff, 0x3, 0x0, 0xffffffffffffffbc, 0x20, 0x6, 0x2}}, 0xe8) openat$selinux_policy(0xffffffffffffff9c, &(0x7f000010e000-0x10)='/selinux/policy\x00', 0x0, 0x0) setsockopt$netlink_NETLINK_TX_RING(r5, 0x10e, 0x7, &(0x7f0000ab4000-0x10)={0x6, 0x7, 0x52, 0xfffffffffffffffc}, 0x10) 2018/02/10 14:10:15 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000a5000-0x8)) mmap(&(0x7f0000000000/0x19000)=nil, 0x19000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000924000-0xc)='/dev/rfkill\x00', 0x0, 0x0) r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000e54000-0x18)={0xaa}) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000008000-0x20)={{&(0x7f0000000000/0x4000)=nil, 0x4000}, 0x1}) ioctl$RNDADDTOENTCNT(r0, 0x40045201, &(0x7f00004cf000-0x4)=0x20) readv(r0, &(0x7f00001f3000-0x10)=[{&(0x7f0000002000-0x4e)=""/1, 0x1}], 0x1) ioctl$RNDADDTOENTCNT(r0, 0x40045201, &(0x7f0000b27000)) ioctl$RNDADDTOENTCNT(r0, 0x40045201, &(0x7f0000a81000)) ioctl$UFFDIO_UNREGISTER(r1, 0xc020aa04, &(0x7f0000008000-0x4)={&(0x7f0000000000/0x2000)=nil, 0x2000}) 2018/02/10 14:10:15 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket(0xf, 0x80005, 0x8) accept4$inet(r0, 0x0, &(0x7f000049f000-0x4), 0x80000) perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000dda000-0x12)='/dev/input/event#\x00', 0x0, 0x0) r2 = openat$selinux_status(0xffffffffffffff9c, &(0x7f000046d000-0x10)='/selinux/status\x00', 0x0, 0x0) ioctl$UFFDIO_UNREGISTER(r2, 0x8010aa01, &(0x7f00007b9000)={&(0x7f0000904000/0x4000)=nil, 0x4000}) ioctl$EVIOCGRAB(r1, 0x40044590, &(0x7f0000e95000-0x4)) ioctl$TIOCSBRK(0xffffffffffffffff, 0x40044591) ioctl$EVIOCGABS0(r1, 0x80184540, &(0x7f0000ac2000)=""/193) request_key(&(0x7f0000102000)='big_key\x00', &(0x7f0000ad3000)={0x73, 0x79, 0x7a, 0x3}, &(0x7f00006cc000-0x40)='deflate\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', 0xffffffffffffffff) 2018/02/10 14:10:15 executing program 4: r0 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000b19000)='/selinux/avc/cache_stats\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) setsockopt$RDS_CANCEL_SENT_TO(r0, 0x114, 0x1, &(0x7f0000000000)={0x2, 0x0, @remote={0xac, 0x14, 0x0, 0xbb}}, 0x10) r1 = syz_open_dev$mice(&(0x7f0000365000)='/dev/input/mice\x00', 0x0, 0x2) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$TUNGETIFF(r1, 0x800454d2, &(0x7f0000000000)=0x2) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0) ioctl$sock_bt_hidp_HIDPCONNADD(r1, 0x400448c8, &(0x7f00007d9000-0x48)={r1, r1, 0x6, 0x80000000, &(0x7f0000a84000)="3e123ff223ed3ca244608e9ad8eb665ce9eaaeb1009fc7e2804cba736cddc4357d9479a779b686a6766c983515786dd9ede0fc89b8fb17fc95ce8588b34ce30fbb9cab6d985d898442cc68885afc467d590d44bda38cdbc5c89bfe955d339da8a4cefe5330f6cb5258c888bffcc3e310da86186d59b52ca6150f230b6905da58a873c847160881893e1b7088e143305b944e28e6d496b3b6d7bc7f6c245691cd3cebb1dd0c93dc7fafe249fc426be4487e0bcadebee84ac445", 0xffff, 0x1f, 0x5, 0x1, 0x8, 0xce, 0x3, "41e8eb925b84e43d27ba240c55b45992f027bb24c304ab03ca04d36cb1657dd903feb70c738ef6ea"}) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f000000a000)={0x34e, 0x0, &(0x7f00001e5000-0x8)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000006000-0x54)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000-0x30)={0x44, 0x0, &(0x7f0000d06000)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x38, 0x8, &(0x7f000000d000)=[@fda={0x66646185}, @flat={0x73682a85}], &(0x7f0000006000)=[0x20]}}], 0x0, 0x0, &(0x7f0000176000-0x1)}) [ 73.336871] binder: 12147:12149 Acquire 1 refcount change on invalid ref 0 ret -22 [ 73.344688] binder: 12147:12149 unknown command 0 [ 73.353862] binder: 12145:12148 Acquire 1 refcount change on invalid ref 0 ret -22 [ 73.360262] binder: 12154:12159 unknown command 0 [ 73.361702] binder: 12145:12148 unknown command 0 [ 73.366655] binder: 12147:12149 ioctl c0306201 2000a000 returned -22 [ 73.373474] binder: 12145:12148 ioctl c0306201 2000a000 returned -22 2018/02/10 14:10:15 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000fe2000-0x11)='/selinux/enforce\x00', 0x200001, 0x0) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r0, 0x84, 0x6e, &(0x7f0000438000-0x80)=[@in6={0xa, 0x2, 0x6, @mcast2={0xff, 0x2, [], 0x1}}, @in={0x2, 0x0, @remote={0xac, 0x14, 0x0, 0xbb}}, @in6={0xa, 0x1, 0x8, @ipv4={[], [0xff, 0xff], @local={0xac, 0x14, 0x0, 0xaa}}, 0x4}, @in6={0xa, 0x3, 0x5, @empty, 0x8}, @in6={0xa, 0x3, 0x4, @mcast2={0xff, 0x2, [], 0x1}, 0x21f7b69}], 0x80) getsockopt$inet_sctp6_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000d59000)={0x0, 0x9, 0xa, 0x10061636}, &(0x7f0000bdc000-0x4)=0x10) bpf$BPF_PROG_QUERY(0x10, &(0x7f00005a4000)={r0, 0x0, 0x1, 0x1, &(0x7f00003ed000)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0xa}, 0x20) perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setlease(r0, 0x400, 0x3) bind$netrom(r0, &(0x7f0000021000)=@ax25={0x3, {"0be59c4c3ede75"}, 0x7}, 0x10) getsockopt$inet_sctp6_SCTP_FRAGMENT_INTERLEAVE(r0, 0x84, 0x12, &(0x7f0000f19000), &(0x7f0000074000)=0x4) setsockopt$inet_sctp6_SCTP_DELAYED_SACK(r0, 0x84, 0x10, &(0x7f000033a000)=@assoc_value={r1, 0x20}, 0x8) openat$ashmem(0xffffffffffffff9c, &(0x7f000022b000-0xc)='/dev/ashmem\x00', 0x100, 0x0) r2 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$DRM_IOCTL_RES_CTX(r0, 0xc0086426, &(0x7f00001f8000)={0x5, &(0x7f0000e92000)=[{}, {}, {}, {}, {0x0}]}) getsockopt$bt_sco_SCO_CONNINFO(r0, 0x11, 0x2, &(0x7f0000245000)=""/21, &(0x7f0000c55000-0x4)=0x15) ioctl$DRM_IOCTL_LOCK(r0, 0x4008642a, &(0x7f0000516000)={r3, 0x19}) r4 = socket(0x2, 0x800, 0x8) getsockopt$inet_sctp6_SCTP_HMAC_IDENT(r4, 0x84, 0x16, &(0x7f000086f000-0x4)={0xa6, []}, &(0x7f0000570000-0x4)=0x4) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r0, 0x84, 0x7c, &(0x7f00001fe000-0x8)={r1, 0x1, 0x6}, &(0x7f0000566000)=0x8) openat$rfkill(0xffffffffffffff9c, &(0x7f0000ee7000)='/dev/rfkill\x00', 0x200000, 0x0) getsockname$inet6(r0, &(0x7f000069f000)={0x0, 0xffffffffffffffff, 0x0, @mcast1}, &(0x7f0000530000-0x4)=0x1c) sysinfo(&(0x7f00004f5000)=""/218) setsockopt$inet6_int(r2, 0x29, 0xc8, &(0x7f00008d6000), 0x4) setsockopt$inet6_MRT6_ADD_MIF(r2, 0x29, 0xca, &(0x7f00004ec000)={0x1, 0x0, 0x0, 0x6}, 0xc) setsockopt$inet6_int(r2, 0x29, 0xc9, &(0x7f00003d1000), 0x4) 2018/02/10 14:10:15 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000a000)={0x34e, 0x0, &(0x7f00001e5000-0x8)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000006000-0x54)}) socketpair(0x8, 0x6, 0x1, &(0x7f00008d8000)={0x0, 0x0}) pipe(&(0x7f0000617000)={0x0, 0x0}) epoll_ctl$EPOLL_CTL_DEL(r1, 0x2, r3) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000008000-0x30)={0x0, 0x0, &(0x7f0000d06000)=[], 0x0, 0x0, &(0x7f0000176000-0x1)}) getsockopt$inet_sctp_SCTP_RECVRCVINFO(r2, 0x84, 0x20, &(0x7f000013b000), &(0x7f0000bc8000-0x4)=0x4) [ 73.381141] binder: 12154:12159 ioctl c0306201 2000a000 returned -22 [ 73.398329] binder: 12147:12160 unknown command 0 [ 73.411533] binder: 12147:12160 ioctl c0306201 2000a000 returned -22 2018/02/10 14:10:15 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000b36000-0x11)='/dev/qat_adf_ctl\x00', 0x8800, 0x0) getsockopt$inet_sctp_SCTP_DEFAULT_PRINFO(0xffffffffffffff9c, 0x84, 0x72, &(0x7f0000f31000-0xc)={0x0, 0xffff}, &(0x7f0000500000)=0xc) setsockopt$inet_sctp6_SCTP_MAX_BURST(r0, 0x84, 0x14, &(0x7f0000456000-0x8)=@assoc_value={r1, 0x2}, 0x8) r2 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f000000a000)={0x34e, 0x0, &(0x7f00001e5000-0x8)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000006000-0x54)}) r3 = syz_open_dev$mice(&(0x7f00007ae000-0x10)='/dev/input/mice\x00', 0x0, 0x80) setsockopt$inet_sctp6_SCTP_ADD_STREAMS(r3, 0x84, 0x79, &(0x7f000030b000)=0xfffffffffffffc01, 0x4) renameat(r0, &(0x7f0000f03000-0x8)='./file0\x00', r0, &(0x7f000060d000)='./file0\x00') ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000008000-0x30)={0x0, 0x0, &(0x7f0000d06000)=[], 0x0, 0x0, &(0x7f0000176000-0x1)}) clock_gettime(0x0, &(0x7f0000e45000)={0x0, 0x0}) ppoll(&(0x7f00005bf000-0x30)=[{r2, 0x4}, {r2, 0x410}, {r3, 0x2004}, {r3, 0x1f}, {r2, 0x80}, {r2, 0xa0}], 0x6, &(0x7f0000db7000-0x8)={r4, r5+10000000}, &(0x7f0000bf9000-0x8)={0xffffffffffffff7f}, 0x8) [ 73.436294] binder: 12167:12168 Acquire 1 refcount change on invalid ref 0 ret -22 [ 73.444192] binder: 12167:12168 unknown command 0 [ 73.466446] binder: 12154:12164 unknown command 0 [ 73.466973] binder: 12167:12168 ioctl c0306201 2000a000 returned -22 [ 73.471579] binder: BINDER_SET_CONTEXT_MGR already set 2018/02/10 14:10:15 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r0, r0, &(0x7f0000049000), 0x3d2) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000008000)={&(0x7f000000f000-0xc)={0x10, 0x34000}, 0xc, &(0x7f0000220000)={&(0x7f00008d6000-0x14)={0x14, 0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, {}, []}, 0x14}, 0x1}, 0x0) r1 = userfaultfd(0x80800) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000ff8000-0x20)={{&(0x7f0000012000/0x2000)=nil, 0x2000}, 0x1}) bpf$MAP_CREATE(0x0, &(0x7f0000fb4000)={0x2, 0x8000000000000004, 0x400, 0x7fd, 0x4, 0xffffffffffffffff}, 0x2c) userfaultfd(0x800) clock_gettime(0x0, &(0x7f0000132000)={0x0, 0x0}) socketpair(0x1d, 0x800, 0x4, &(0x7f0000589000)) r4 = syz_open_dev$mouse(&(0x7f00006eb000)='/dev/input/mouse#\x00', 0xde6e, 0x1) timer_settime(0x0, 0x1, &(0x7f000097e000)={{0x0, r3}, {r2, r3+10000000}}, &(0x7f0000939000)) fanotify_init(0x25, 0x802) r5 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000ef2000-0x1d)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f00002d8000-0xc)={0x0, 0x0}, &(0x7f0000d76000-0x4)=0xc) syz_open_procfs(r6, &(0x7f0000013000)='ns/cgroup\x00') openat$ion(0xffffffffffffff9c, &(0x7f0000dd5000)='/dev/ion\x00', 0x800, 0x0) pipe2(&(0x7f000058c000), 0x4800) setsockopt$inet_IP_XFRM_POLICY(r4, 0x0, 0x11, &(0x7f0000e12000-0xe8)={{{@in6=@mcast1={0xff, 0x1, [], 0x1}, @in=@rand_addr, 0x2, 0xbd, 0x3, 0x20, 0xa, 0xa0, 0x80, 0xbf, 0x0, r7}, {0x0, 0x8, 0x0, 0x0, 0x6, 0x1fa8, 0x8, 0x20}, {0x1719, 0x7fff, 0x7ff, 0x7ff}, 0x1, 0x7, 0x0, 0x1, 0x1, 0x3}, {{@in=@broadcast=0xffffffff, 0x1, 0x7f}, 0xa, @in=@empty, 0xffffffffffffffff, 0x3, 0x0, 0xffffffffffffffbc, 0x20, 0x6, 0x2}}, 0xe8) openat$selinux_policy(0xffffffffffffff9c, &(0x7f000010e000-0x10)='/selinux/policy\x00', 0x0, 0x0) setsockopt$netlink_NETLINK_TX_RING(r5, 0x10e, 0x7, &(0x7f0000ab4000-0x10)={0x6, 0x7, 0x52, 0xfffffffffffffffc}, 0x10) [ 73.483387] binder: 12175:12176 unknown command 0 [ 73.491238] binder: 12175:12176 ioctl c0306201 2000a000 returned -22 [ 73.493859] binder: 12154:12164 ioctl c0306201 2000a000 returned -22 [ 73.504736] binder: 12167:12174 Acquire 1 refcount change on invalid ref 0 ret -22 [ 73.510629] binder: 12154:12159 ioctl 40046207 0 returned -16 [ 73.512585] binder: 12167:12174 unknown command 0 [ 73.527724] binder: release 12154:12164 transaction 363 out, still active 2018/02/10 14:10:15 executing program 4: r0 = syz_open_dev$urandom(&(0x7f0000a63000-0xd)='/dev/urandom\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = socket$can_bcm(0x1d, 0x2, 0x2) modify_ldt$write(0x1, &(0x7f0000e44000-0x10)={0x9, 0x0, 0x0, 0x490, 0x1, 0x9, 0x2, 0x81, 0x8, 0x530}, 0x10) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) r3 = dup2(r0, r2) ioctl$DRM_IOCTL_MARK_BUFS(r3, 0x40186417, &(0x7f000045c000-0x18)={0x2, 0x1, 0x1, 0x0, 0x2, 0x40}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000a000)={0x34e, 0x0, &(0x7f00001e5000-0x8)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000006000-0x54)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000-0x30)={0x44, 0x0, &(0x7f0000d06000)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x38, 0x8, &(0x7f000000d000)=[@fda={0x66646185}, @flat={0x73682a85}], &(0x7f0000006000)=[0x20]}}], 0x0, 0x0, &(0x7f0000176000-0x1)}) r4 = openat$sequencer(0xffffffffffffff9c, &(0x7f00005f9000-0xf)='/dev/sequencer\x00', 0x2000, 0x0) syz_open_dev$urandom(&(0x7f0000605000-0xd)='/dev/urandom\x00', 0x0, 0x0) ioctl$LOOP_CLR_FD(r4, 0x4c01) 2018/02/10 14:10:15 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000a5000-0x8)) mmap(&(0x7f0000000000/0x19000)=nil, 0x19000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000924000-0xc)='/dev/rfkill\x00', 0x0, 0x0) r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000e54000-0x18)={0xaa}) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000008000-0x20)={{&(0x7f0000000000/0x4000)=nil, 0x4000}, 0x1}) ioctl$TIOCSSOFTCAR(r0, 0x541a, &(0x7f0000f1b000)=0x80000000) readv(r0, &(0x7f00001f3000-0x10)=[{&(0x7f0000002000-0x4e)=""/1, 0x1}], 0x1) ioctl$RNDADDTOENTCNT(r0, 0x40045201, &(0x7f0000b27000)) ioctl$RNDADDTOENTCNT(r0, 0x40045201, &(0x7f0000a81000)) ioctl$UFFDIO_UNREGISTER(r1, 0xc020aa04, &(0x7f0000008000-0x4)={&(0x7f0000000000/0x2000)=nil, 0x2000}) 2018/02/10 14:10:15 executing program 3: r0 = memfd_create(&(0x7f000033d000-0x1)='\x00', 0x2) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) getsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000000), &(0x7f0000000000)=0x14) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000614000)="74756e08000000000000008000000000", 0x0) pwritev(r1, &(0x7f0000f51000-0x70)=[{&(0x7f00001b3000)="93", 0x1}], 0x1, 0x83003) lseek(r1, 0x0, 0x4) 2018/02/10 14:10:15 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000b36000-0x11)='/dev/qat_adf_ctl\x00', 0x8800, 0x0) getsockopt$inet_sctp_SCTP_DEFAULT_PRINFO(0xffffffffffffff9c, 0x84, 0x72, &(0x7f0000f31000-0xc)={0x0, 0xffff}, &(0x7f0000500000)=0xc) setsockopt$inet_sctp6_SCTP_MAX_BURST(r0, 0x84, 0x14, &(0x7f0000456000-0x8)=@assoc_value={r1, 0x2}, 0x8) r2 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f000000a000)={0x34e, 0x0, &(0x7f00001e5000-0x8)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000006000-0x54)}) r3 = syz_open_dev$mice(&(0x7f00007ae000-0x10)='/dev/input/mice\x00', 0x0, 0x80) setsockopt$inet_sctp6_SCTP_ADD_STREAMS(r3, 0x84, 0x79, &(0x7f000030b000)=0xfffffffffffffc01, 0x4) renameat(r0, &(0x7f0000f03000-0x8)='./file0\x00', r0, &(0x7f000060d000)='./file0\x00') ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000008000-0x30)={0x0, 0x0, &(0x7f0000d06000)=[], 0x0, 0x0, &(0x7f0000176000-0x1)}) ppoll(&(0x7f00005bf000-0x30)=[{r2, 0x4}, {r2, 0x410}, {r3, 0x2004}, {r3, 0x1f}, {r2, 0x80}, {r2, 0xa0}], 0x6, &(0x7f0000db7000-0x8), &(0x7f0000bf9000-0x8)={0xffffffffffffff7f}, 0x8) [ 73.534759] binder: undelivered TRANSACTION_COMPLETE [ 73.539958] binder: send failed reply for transaction 363, target dead [ 73.570469] binder: 12167:12174 ioctl c0306201 2000a000 returned -22 [ 73.577355] binder: 12183:12188 unknown command 0 2018/02/10 14:10:15 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$bt_hci(0x1f, 0x3, 0x1) r1 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000a95000-0x10)='/selinux/policy\x00', 0x0, 0x0) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(0xffffffffffffffff, 0xc00c642e, &(0x7f0000cff000)={0x0, 0x80000, 0xffffffffffffff9c}) r3 = dup2(0xffffffffffffff9c, 0xffffffffffffffff) r4 = openat$vsock(0xffffffffffffff9c, &(0x7f0000b4b000-0x11)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$SNDRV_TIMER_IOCTL_TREAD(r1, 0x40045402, &(0x7f0000e3a000)=0x1) r5 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000cd4000)='/selinux/mls\x00', 0x0, 0x0) r6 = accept4$packet(0xffffffffffffffff, 0x0, &(0x7f0000826000), 0x800) r7 = timerfd_create(0x1, 0x80000) poll(&(0x7f0000c0d000-0x40)=[{r0, 0x510}, {r1, 0x10}, {r2, 0x89}, {r3, 0x100}, {r4, 0x80}, {r5, 0x10}, {r6, 0x1000}, {r7, 0x200}], 0x8, 0x101) socketpair$inet(0x2, 0x801, 0x20000000000, &(0x7f0000105000)={0x0, 0x0}) ioctl$sock_FIOGETOWN(r8, 0x8903, &(0x7f00001b0000)=0x0) sched_setattr(r10, &(0x7f0000368000-0x30)={0x0, 0x7, 0x1, 0x4, 0x6, 0xa5, 0x7b9f6d2f}, 0x0) getsockopt$inet_sctp6_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000cc5000-0x10)={0x0, 0x7a8a, 0x9, 0x7ff}, &(0x7f0000c7e000)=0x10) getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r8, 0x84, 0x1a, &(0x7f0000c54000-0x8)={0x0}, &(0x7f0000d75000-0x4)=0x8) getsockopt$inet_sctp_SCTP_STATUS(r8, 0x84, 0xe, &(0x7f00002f8000)={r11, 0x100000001, 0x2, 0x4, 0x58, 0x7fff, 0xfffffffffffffffd, 0x9, {r12, @in6={{0xa, 0x0, 0x8, @local={0xfe, 0x80, [], 0x0, 0xaa}, 0x400}}, 0xab3d, 0x3f, 0x3c, 0x0, 0x1}}, &(0x7f0000846000)=0xb8) getsockopt$inet_sctp_SCTP_ENABLE_STREAM_RESET(0xffffffffffffffff, 0x84, 0x76, &(0x7f0000ba5000-0x8)={0x0}, &(0x7f0000334000-0x4)=0x8) listen$netrom(r3, 0x37f9) setsockopt$inet_sctp_SCTP_AUTH_ACTIVE_KEY(r9, 0x84, 0x18, &(0x7f0000530000-0x6)={r14, 0x8000}, 0x6) r15 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) getsockopt$inet_sctp_SCTP_DEFAULT_PRINFO(r9, 0x84, 0x72, &(0x7f000047e000)={r13, 0x6, 0x10}, &(0x7f0000e57000-0x4)=0xc) ioctl$BINDER_WRITE_READ(r15, 0xc0306201, &(0x7f000000a000)={0x34e, 0x0, &(0x7f00001e5000-0x8)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000006000-0x54)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000008000-0x30)={0x0, 0x0, &(0x7f0000d06000)=[], 0x0, 0x0, &(0x7f0000176000-0x1)}) sendmsg$inet_sctp(r9, &(0x7f0000742000)={&(0x7f0000f67000)=@in6={0xa, 0x2, 0x7, @remote={0xfe, 0x80, [], 0x0, 0xbb}, 0x3}, 0x1c, &(0x7f0000f6c000-0x8)=[{&(0x7f0000ef6000-0x70)="878d2d754f01f1ee73f4903dcb589fe4cf3fc86830036dfcdd808ccdd0618aba4f342f11124f6c0587c5b253ff556753f1b6c34146a1bf71f875deb54183df20de5e33bcbd62e3a80408e4ab9df06346eb89f013f3bd42d5d9e415137d402d5d46396b7bb38cefe7618f8d553a4fe3cb", 0x70}], 0x1, &(0x7f00005d0000-0x134)=[@sndrcv={0x2c, 0x84, 0x1, {0x7, 0x6, 0x8, 0x7fffffff, 0x0, 0x401, 0xfffffffffffffffb, 0x1f, r16}}, @sndinfo={0x1c, 0x84, 0x2, {0x20, 0x1, 0x3ff, 0x8, r14}}, @init={0x14, 0x84, 0x0, {0x9, 0x20, 0x1ff, 0x3}}, @sndinfo={0x1c, 0x84, 0x2, {0x3fc, 0x2, 0x7, 0x1f, r14}}, @init={0x14, 0x84, 0x0, {0x8, 0x4, 0x6fa}}, @sndinfo={0x1c, 0x84, 0x2, {0x1, 0x8000, 0x1, 0x200, r16}}, @init={0x14, 0x84, 0x0, {0x9, 0x1, 0x4, 0xffff}}], 0x134, 0x800}, 0x4000080) 2018/02/10 14:10:15 executing program 1: mmap(&(0x7f0000000000/0xb4c000)=nil, 0xb4c000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x2, 0x0) capset(&(0x7f0000000000)={0x20071026}, &(0x7f0000002000-0x18)) mmap(&(0x7f0000b4c000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000b4c000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) setsockopt$inet_opts(r0, 0x0, 0x2000000004, &(0x7f0000b4d000-0xf)="5e080001040080c1325000000000e5", 0x5c54c4f3) 2018/02/10 14:10:15 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000274000-0x78)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) setrlimit(0x7, &(0x7f000068d000)={0x1, 0xfffffffffffffc01}) r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000d0c000)='/dev/vcs\x00', 0x80000, 0x0) ioctl$SNDRV_TIMER_IOCTL_TREAD(r0, 0x40045402, &(0x7f0000ab1000)) eventfd2(0x0, 0x0) [ 73.615117] binder: 12183:12188 ioctl c0306201 2000a000 returned -22 [ 73.623664] binder: 12195:12197 unknown command 0 [ 73.628981] binder: 12195:12197 ioctl c0306201 2000a000 returned -22 2018/02/10 14:10:15 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = signalfd4(0xffffffffffffffff, &(0x7f0000006000), 0x8, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f000001c000-0xc)) r2 = gettid() rt_sigprocmask(0x0, &(0x7f0000058000-0x8)={0xfffffffffffffffe}, 0x0, 0x8) timer_create(0x3, &(0x7f0000548000-0x58)={0x0, 0x14, 0x4, @tid=r2}, &(0x7f0000044000)) timer_settime(0x0, 0x1, &(0x7f00009c8000)={{}, {0x0, 0x9}}, &(0x7f0000105000)) ptrace$getsig(0x4202, r2, 0x2, &(0x7f00004df000-0x10)) 2018/02/10 14:10:15 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000b36000-0x11)='/dev/qat_adf_ctl\x00', 0x8800, 0x0) getsockopt$inet_sctp_SCTP_DEFAULT_PRINFO(0xffffffffffffff9c, 0x84, 0x72, &(0x7f0000f31000-0xc)={0x0, 0xffff}, &(0x7f0000500000)=0xc) setsockopt$inet_sctp6_SCTP_MAX_BURST(r0, 0x84, 0x14, &(0x7f0000456000-0x8)=@assoc_value={r1, 0x2}, 0x8) r2 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f000000a000)={0x34e, 0x0, &(0x7f00001e5000-0x8)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000006000-0x54)}) r3 = syz_open_dev$mice(&(0x7f00007ae000-0x10)='/dev/input/mice\x00', 0x0, 0x80) setsockopt$inet_sctp6_SCTP_ADD_STREAMS(r3, 0x84, 0x79, &(0x7f000030b000)=0xfffffffffffffc01, 0x4) renameat(r0, &(0x7f0000f03000-0x8)='./file0\x00', r0, &(0x7f000060d000)='./file0\x00') ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000008000-0x30)={0x0, 0x0, &(0x7f0000d06000)=[], 0x0, 0x0, &(0x7f0000176000-0x1)}) ppoll(&(0x7f00005bf000-0x30)=[{r2, 0x4}, {r2, 0x410}, {r3, 0x2004}, {r3, 0x1f}, {r2, 0x80}, {r2, 0xa0}], 0x6, &(0x7f0000db7000-0x8), &(0x7f0000bf9000-0x8)={0xffffffffffffff7f}, 0x8) 2018/02/10 14:10:15 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r0, r0, &(0x7f0000049000), 0x3d2) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000008000)={&(0x7f000000f000-0xc)={0x10, 0x34000}, 0xc, &(0x7f0000220000)={&(0x7f00008d6000-0x14)={0x14, 0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, {}, []}, 0x14}, 0x1}, 0x0) r1 = userfaultfd(0x80800) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000ff8000-0x20)={{&(0x7f0000012000/0x2000)=nil, 0x2000}, 0x1}) bpf$MAP_CREATE(0x0, &(0x7f0000fb4000)={0x2, 0x8000000000000004, 0x400, 0x7fd, 0x4, 0xffffffffffffffff}, 0x2c) userfaultfd(0x800) clock_gettime(0x0, &(0x7f0000132000)={0x0, 0x0}) socketpair(0x1d, 0x800, 0x4, &(0x7f0000589000)) r4 = syz_open_dev$mouse(&(0x7f00006eb000)='/dev/input/mouse#\x00', 0xde6e, 0x1) timer_settime(0x0, 0x1, &(0x7f000097e000)={{0x0, r3}, {r2, r3+10000000}}, &(0x7f0000939000)) fanotify_init(0x25, 0x802) r5 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000ef2000-0x1d)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f00002d8000-0xc)={0x0, 0x0}, &(0x7f0000d76000-0x4)=0xc) syz_open_procfs(r6, &(0x7f0000013000)='ns/cgroup\x00') openat$ion(0xffffffffffffff9c, &(0x7f0000dd5000)='/dev/ion\x00', 0x800, 0x0) pipe2(&(0x7f000058c000), 0x4800) setsockopt$inet_IP_XFRM_POLICY(r4, 0x0, 0x11, &(0x7f0000e12000-0xe8)={{{@in6=@mcast1={0xff, 0x1, [], 0x1}, @in=@rand_addr, 0x2, 0xbd, 0x3, 0x20, 0xa, 0xa0, 0x80, 0xbf, 0x0, r7}, {0x0, 0x8, 0x0, 0x3, 0x0, 0x1fa8, 0x8, 0x20}, {0x1719, 0x7fff, 0x7ff, 0x7ff}, 0x1, 0x7, 0x0, 0x1, 0x1, 0x3}, {{@in=@broadcast=0xffffffff, 0x1, 0x7f}, 0xa, @in=@empty, 0xffffffffffffffff, 0x3, 0x0, 0xffffffffffffffbc, 0x20, 0x6, 0x2}}, 0xe8) openat$selinux_policy(0xffffffffffffff9c, &(0x7f000010e000-0x10)='/selinux/policy\x00', 0x0, 0x0) setsockopt$netlink_NETLINK_TX_RING(r5, 0x10e, 0x7, &(0x7f0000ab4000-0x10)={0x6, 0x7, 0x52, 0xfffffffffffffffc}, 0x10) [ 73.660120] binder: BINDER_SET_CONTEXT_MGR already set [ 73.666486] binder: 12183:12194 ioctl 40046207 0 returned -16 [ 73.675112] binder: 12183:12188 unknown command 0 [ 73.680421] binder: 12183:12188 ioctl c0306201 2000a000 returned -22 [ 73.691606] binder_alloc: 12183: binder_alloc_buf, no vma [ 73.697523] binder: 12183:12194 transaction failed 29189/-3, size 56-8 line 2957 [ 73.736963] binder: undelivered TRANSACTION_ERROR: 29189 [ 73.743783] binder: release 12183:12194 transaction 368 out, still active [ 73.745888] binder: 12217:12219 Acquire 1 refcount change on invalid ref 0 ret -22 [ 73.750756] binder: undelivered TRANSACTION_COMPLETE [ 73.750797] binder: send failed reply for transaction 368, target dead [ 73.758530] binder: 12217:12219 unknown command 0 [ 73.776226] binder: 12217:12219 ioctl c0306201 2000a000 returned -22 [ 73.807846] binder: 12200:12221 Acquire 1 refcount change on invalid ref 0 ret -22 [ 73.815687] binder: 12200:12221 unknown command 0 [ 73.820893] binder: 12200:12221 ioctl c0306201 2000a000 returned -22 2018/02/10 14:10:15 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000a5000-0x8)) mmap(&(0x7f0000000000/0x19000)=nil, 0x19000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000924000-0xc)='/dev/rfkill\x00', 0x0, 0x0) r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000e54000-0x18)={0xaa}) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000008000-0x20)={{&(0x7f0000000000/0x4000)=nil, 0x4000}, 0x1}) readv(r0, &(0x7f00001f3000-0x10)=[{&(0x7f0000002000-0x4e)=""/1, 0x1}], 0x1) ioctl$RNDADDTOENTCNT(r0, 0x40045201, &(0x7f0000b27000)) clone(0x100, &(0x7f00000a0000)="4a0c08ad6f058a972aa4085d6c2d019f065747240ab1fc4a02b06dfbe6fc442efd0e32ff7a0f88357ad2ed2006c729f4129c34b2dce8cf88140f827ff1ec2f557532e35ae56c28d39605b38dc138a5add7c427170f722882974d0185d96cdd51391d2a251de109ccd737aae11ba14ca9e3562bc7d89a56cb64df3a283763e94ec2790acdcd08bcf50ff4207933f74ffdef7da8878288064751baa225d6", &(0x7f0000c4b000), &(0x7f0000e76000), &(0x7f00002ab000-0x1000)="c0add8e8fef0d7c70ac7f23022af8c2c0ea3d74630817a598937d9f637fe263cfd7722b07058ce341d4d168f856a45525d6eb18cb9ac2e52e3824eceed2c9ada2521ef408551d7146d3c48845fa1cf55a928971cde50d915844d353b7e87895a950c54189b0815a8006d7c4a3e5803e1a52b048cad7631660947a7099120599c33aa30ca0a6cb820efe5643dde4984434365f07f6e81553b6d79759bad005082f8eeaa1462b3335e72fb57d81a0b5e22d36044325f7434f7b87ac1edecfeba46fa7b64c801938d5f94b0ea5053f5aeb9a1efd802f35d0e2c9cbb216cde3191b54d492452ab212c5835a86c9866523ef78945078de8ddcd020f2f892c986c7cc60518d22929e0b649c79ffba152a6173085c1babef32f643b4cb134a738b95f6238e88892a72a868b4fa7577d1bbff6fe5d15fc6e6222e72f4c8ea1634723fde6a1085f114ae9456ce39b5e5f927e9952e2d1c9c11b773eeb6dfcc94a77f1a9b4fb796932a341f5303d28781261589000c8831923f415a2e2c2b6912f54ecbf64e0bfe02196dca2f16a8a26d04e6e80cacb0d24e746cb81291c8889b4121228217e4123af7dd79bd79e2271e2a0cd9c08e2903f786efe517d6b7aa8c7dda5a388c6dbbeb15f61143a4f009fcc9ee849bdf767764ac545c28a6dc6b06560dc2b288c8f0fdeca1c5121c9d06dfe55adbaa6c4d0c8163edb77a28b180251048f26d5fd3dd3c9c58d8ba4c63747999ec0ee1313069dac960731f066f1c418825c73ee682fa2d65f3fd8489278790d428e85c3427210bff59078480459752486d7b406f37d8e2f66b120d6acf51624ec4d6a4ea1442d36c9c4e86cd2a6053d3db5cb5900bbb9c8b1f23e49b25f2debf9031eb757d3bf99b31e9b7f68161eaf1187958e77eb348a7cc349c030d8461699993e1dd3914c99cec52f8574b95914fde948a6ecba4da9391de0ee66650ce855e267d249155e010056ec1f24d35eef6a2928321436a8da8184a652ebe8c5e720e18748b3ca676b2791c71e81f70931ecf7857c68283281b77e66b170d2038faee51f6e8d7d0f7d602058bf9a3e6c1bfea630b3956fe42bca723ae99de2f11c5c62b1f935426f323dfa85431f882434975807e88f78cf9f402366c6a15142180e301614de403296336d6c7503b4e5573ed444d20d67c4bce122e8aef071f2db77c4cf3d4cfa0b770d34b430053621ae9068147067746e5616800daf0bce4858e455e6501abb79adf8162e8bfbe70765a5596556a0df6566c33aa9ea27bf933a6f0885f2a3735996ac63f2954ed13b8e3a9780e02532a3968313311321d218ec93963b2a77b57b692077094deb30af83daff96634bb2480242f58629489de6bf48fa29f1b62e5a9df0236668097d1719d3df45670893ebfe47ca8332a8a8c7589f6cc250898c10784d39a88239f98616a1d6069db0b02d8c54fbf7f6e20c210ce99bae1243d4e853291cf0a66446a9cfc200ea77d5f3f3cf935235d444be54c31de016fe5006c395e502aed38c51b6a3f43959a3a3ee1ffdb3858f354671b23a04f87a09a3d67e039858c573c7f3c2f66a9d99cd7b20c4d10499d87b674dcfbf6f7f7c27760520045e487074a1d0e6cab457434e80bd91d8edd15ec00474f449f42a1da8c9b19f5bf73c82ae449ce41912230e797032a3c048cd399f8b65f627dba5e5212453696d5b6b8004ba261056a15ef03ce5317e2d5b5fc1bbad181ca887f8b7ee370a4bfc20dd74ee3f674df747de89a0dceab8d76039e497414f93b0b312fc18f9552dbac4774ff7eb02bdc441e712ae0ad73549962d270ee745e2dcf909a84fb30eb22de3411b1cca40fc8b3612cdc349ecaf69d7d06edb8e292dc9b049489d423d5e1b615b70b6cb4def41bba25c7e2782877a134bb31ea68fe0648813a8e620b36c7f1d0b442974b28cb1e035ab0f7887024875d3426356b8101f581b96cf0feb5202cb8adcf8038c81671876670ba046a46127c40e12c5e4e8f5fbcb6c228eb353c54659466274e9cb321d39fc2a0f8e6e807ee0ea731f36775bdee2615b737ba9b0f4fcfd3fd6ac138690ef154d9592aa80ed691b8bd2027ff4ab88af0af75ede774389ebbca2b47ec101ed4f58ce9d710f36cac89caed3a1bcffcdd02c143681653a53cf33697cddce4733f2224b9cebb0cdf58a70c904ee505a7d118a64864056c19f7b123f97c9bcdc906cf301fc10f422696b63b9b00044865f0384f1a38aa08d3e397759a54301a9f5b151312d3ca6e5e48d195f92a58eae7df3e60a37fbd4b4bbceed182ca6823b8eb159974d3fc17b1502273596bf764c8f47efe460db2b646579a7a9ff87d21f43936cc302bae654005e20b6584f9e482e75b81163db8963d5989b637b87dc2e546e1010aeb0074ad58f8cd32724d02b9742a0008d9206d84353b166e22ce2f978afdc7b384cae49cd78658ca56c83050c178c52b59608c95eddbc5cb9cc344cefd630c88937cb48a249ef3197fd72eb1f9519096df8684bb9790c3893edb3df0e46405eb7f6ca3374f35b985fa4b9732d541676b409471c4df94497da5a90af4ab9f7bbe2b39cb5825b282b5b3f51b5937ea4fe4df831d29758aaca06a848230f00e06faa7aeada71d57ac6ec55f613a60eaaa65ee8001e35db791b1c57e676c12bfebe3f819202dbcab633fa099f8be4de6467497a22029631cc673122f5881a5290db94c9b2fcd24107d1d7c9381c68e1d5a9221d1c42c4b7296ea6990b41a5ad9c3a99deefd517f43e2a44e010f0d73b8ec37c2dce128ffe043f60d80506d7a7ba2702d607da1ba6aa6a770285fe9047bec8ce3a183826c57bf20e0d85f96d18b7d3f717becdd770a2a144aec7ffb81165e31c4e7d258f05bed8fdc91babe849a5a877ed7648362c9942afeecb954069babc0868ebc731b4c907ace535a9897ae9a92134f7b037d9cc4717cf06185f55b1569959f725a13ffedca91d413e05ec4c416f5c2ffb9a33077e6cc2a716f33c1516f10fb53eaaa53ef7a4bb9d2905c95947920fb5f6a9a5a57e096cb164884b9084ff9642317dee094dfcb7e52ff8d8e060783e9d8c6dfaea7d6876a8558b9e4334653456f1364a9aac14d8732eceb91203e5c90300d0de16bc13354788358bb7d4366e92aaa4040c6bd1c71c9fa130d2dc023da9e314b6349affd624944dc68b1b032e3a6d53c24fa9f24922c991fc0ac182b48e1897477cd342ad55b46e252a1baf817a946572d41e2821dd1c6ec8211394239952b51cd8e5fccef5b2ee884a333a7ec6b99ce8937b6f92e843451de4f208b7b2b83f96406e742feb42c016cd9f402afd558df43585134b1bf5ee8f1d3b8d65a2996f907195da1c0860d41ef5ba3ad8a8e874a76c9a6b20a2b65c349acc0dbb422931053d9e9c5d2fca7e1c3f0e51d92b03efee3d7fd99a1bfc1e7f0672379b4cc58da519658d4e6c79ae9cd62d59aa1135e518c5f126b099b8566c0eeeaf500ec8c6b01187010aec193c796071ebe6e738db4af93313faab08b4334af756c9706d755a3707757052007d06981c5725404015e11e66bdf45e3ee6dea21fe5b52b0dae5a9327732a668aaa66a62ddf9ff753d0c0b6226d4deefa610b60c4f99e579288a49d19fe3911b557fc8b9e4162352951b95b39bd01d4cc5aa8b04d094158e16046530a7ef590788b04e5b22c21efd97dba894f7bf929585a78e9c5b6fef7d5c530957a34db4bd3065473398a0a8b329f2e686e5ff5c8f0aa79c66da7b021df150dea1c8937b6e21f17f1a335f88273ddfa0dea83d106b84568c66143488963ddbc35554fdfb27a52cfd6a0cc2ec1ed058b82c382cf8c7166fadd468a88a5ab69ed9732b4cdc68df46c83fffe648fb86d05a8b5429e34f2e296c0f280a1dc91de81c8039fc55e335344b7498e98fbed5c7fa834be5ba04bd85e67115bf4b2ad3aff5f87dc654aeadd2a1308543ca661584906a8ffe6593444bd6a8bf6e29fc731e77dc958b4d5248618e097328b49fb9795106fe01bd8b3e52ad98edbea464ae086545a0fe2962293e5c4b37b44afaca3aff04554a0be217496c56867bb3a8720f98ecbfcd1ad987d8593984731935d489a4ebe9b11f7b99c2867085c235d404e7713653c54a8b679f4ac00ec6e6abec8a9895aae717bfb000409fa5ae7b1c20a1e6981196f13c7ce1307068b419d1658134249a06ad4a10a6f0a63066fc8317d76215ddf8b2f61905bb4171f33701a53d5870252568323c28f3891ba418ec0bdaba344127169b20f21a411cbaca5cc7f1b01a19dbbc17cb35ab7efe5da5e889376e435832ad44ee7af8bc0bb6c2998c600f18538761ea156eb18c25862046d1269d008b2ecff95ada42e5572de1a7b112b1a91c404bc8a57d0103660a2f9be55cf9c85df331b56b97e4630b41b2a5b2cffec114f6d207c013605a969a7515d0637d66470bb2a69881ac3a5075f0e0a48d61cfb18ebcb0ea3de498d369ec41b01e6b34df8adc74eb627c6a96a924daffaaab0d1671121025e2941b542454fca051cb4074f3ee907ffe5b7361b4ac02f7d936ee57b43c76e3fb7d9be0582166347ee8d7625ec3edbf57ea9946e91a1675fe6e58052a77cdada56c95cc8401385283ef1103a0839a33ab3326e893db56bbbca952715192aaf1ad582e75a54108288b47150805036144c89fa841da7c7641415396704109c3b49c5f51649611892855d32a553ff04120ddaea1626e71b7273ba1e13a7e7dee22b6e97aff74e6ff8fcda2eba56223810ce0f1a9ecf5b90563dfd045ae0807ef4b42190a22466c9655b8b86c9779a58fea7143e59e50f08aaa70ddfd64bc9ef6f27f2a6ba87a62640f1c5a074b0ed0f522784757c1980995bb112559468d060ac798fb6a194b1dd2e354f04c0b3fd33b5e823ddbdfaf1f1f37af66108a70e5f5e9dc54d1ef155d1e1290b5e6ab728db45f3d35020f098e05ffd95ac28881da5da035d8606b8ccd2f0df734c22d5fb5df5ce8757b5ca33ffdb2fb2989f81b60439a744ae8c553bffbf8a254caf9628e0f8c222dc0e28f76b6895cafe12ba55f1418357ed01f3e6d845db357219f234712c96fedd1449b97c6b670c5f85fcd722c7a1466ba557b4a8d81d17fe3185119aed04d080625b9c1aee14fd7bcc75189feb6a86fe00782de323cc22338785b5ce66a340e14b0e4efe8f664d11be40953cafeabfd696bce97d1a13781692c24b5f9d1355481898a221386b0b5664796d77672338bad51e123fee2a4d9735c784261a2bbfc06abdbe0d092d2161542ed37a34ebedcc46644c4ff72a515ad2c3d278e878616a547d005f19b84507765683377f233d6087beb4b4e246b1e2a5d64f6b5c02c907f198067bcc9a9044b433f7febc1e103d99fa1afe04f7e3b9e8de6bbd041e5e7ac9d6156a7c53f80bc7f25e9720b09be1e2903f5bb256234123fef830e6bf2dec5c92954d372bc0b6c5c16e0e4b83605aa6555d3fa5a9591d9a8e357a5d7bd4b4f5e30c2064a3b23e134aafc0b5c287b8dab76b1ea3a3854dfc1cac2cec75650a1ca74092f7380689379721f0182c99562bad26e183ec99f264be44a84989d5d6fd7ed75cf1d4328bbe79a12d8b0baa053f67079a1d129ac5ad87b17d46763dd68930ae697cec2ea778b54678db3bbb61e5d186246995b4ebd9ef86d221482a47b1566cf6f6050a28a59cb3419fda1f1bf1faa44151de58bab86465d55f0398b97907580f65f49b454b7536fce5ecb86b9ba27634b11c9f50f7b266ace6dffccd378beb0d79fa59eb61f73dc95bc96b7d") ioctl$RNDADDTOENTCNT(r0, 0x40045201, &(0x7f0000a81000)) ioctl$UFFDIO_UNREGISTER(r1, 0xc020aa04, &(0x7f0000008000-0x4)={&(0x7f0000000000/0x2000)=nil, 0x2000}) 2018/02/10 14:10:15 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) r0 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f00000bf000)='/selinux/checkreqprot\x00', 0x88000, 0x0) stat(&(0x7f00004af000)='./file0\x00', &(0x7f0000f6e000-0x44)={0x0, 0x0, 0x0, 0x0, 0x0}) stat(&(0x7f00002da000)='./file0\x00', &(0x7f0000486000-0x44)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) openat$dir(0xffffffffffffff9c, &(0x7f0000cfa000-0x8)='./file0\x00', 0x8000, 0x10) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r0, 0x84, 0x7c, &(0x7f0000760000-0x8)={0x0, 0x3, 0xfffffffffffffff7}, &(0x7f00002f0000-0x4)=0x8) setsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r0, 0x84, 0x72, &(0x7f0000ec5000-0xc)={r3, 0x9}, 0xc) fchownat(r0, &(0x7f00009a5000)='./file0\x00', r1, r2, 0x1800) mount(&(0x7f00003b3000-0x8)='./file0\x00', &(0x7f0000bc6000)='./file0\x00', &(0x7f00009e7000)='cgroup2\x00', 0x0, &(0x7f0000f9e000)) 2018/02/10 14:10:15 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$mice(&(0x7f00009fa000-0x10)='/dev/input/mice\x00', 0x0, 0x400000) getsockopt$bt_BT_RCVMTU(r0, 0x112, 0xd, &(0x7f0000c23000-0x2)=0x3ff, &(0x7f000027b000-0x4)=0x2) ioctl$KVM_INTERRUPT(r0, 0x4004ae86, &(0x7f0000b46000-0x4)=0x100) r1 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000a000)={0x34e, 0x0, &(0x7f00001e5000-0x8)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000006000-0x54)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000-0x30)={0x44, 0x0, &(0x7f0000d06000)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x38, 0x8, &(0x7f000000d000)=[@fda={0x66646185}, @flat={0x73682a85}], &(0x7f0000006000)=[0x20]}}], 0x0, 0x0, &(0x7f0000176000-0x1)}) 2018/02/10 14:10:15 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x400000000001, 0x0) r1 = syz_open_dev$mice(&(0x7f0000bd1000-0x10)='/dev/input/mice\x00', 0x0, 0x4000) setsockopt$nfc_llcp_NFC_LLCP_RW(r1, 0x118, 0x0, &(0x7f0000fb8000-0x4)=0xc8b5, 0x4) bind$inet6(r0, &(0x7f0000767000-0x1c)={0xa, 0xffffffffffffffff, 0x0, @mcast2={0xff, 0x2, [], 0x1}}, 0x1c) getsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000648000)={@loopback, 0x0}, &(0x7f0000019000-0x4)=0x14) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f000059d000-0x4)=0x18, 0x4) fcntl$getflags(r1, 0x40a) getsockopt$inet_sctp6_SCTP_RTOINFO(r0, 0x84, 0x0, &(0x7f0000d24000)={0x0, 0x1000, 0x6, 0x7a4f}, &(0x7f00009f0000-0x4)=0x10) getsockopt$inet_sctp6_SCTP_DELAYED_SACK(r0, 0x84, 0x10, &(0x7f000098e000)=@sack_info={r3, 0x0, 0x2000000040000}, &(0x7f0000444000)=0xc) ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f0000f1c000-0x50)={@remote={0xfe, 0x80, [], 0x0, 0xbb}, @loopback={0x0, 0x1}, @remote={0xfe, 0x80, [], 0x0, 0xbb}, 0x4, 0xe37, 0xfffffffffffffff7, 0x100, 0x3ff, 0x10000, r2}) 2018/02/10 14:10:15 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000b36000-0x11)='/dev/qat_adf_ctl\x00', 0x8800, 0x0) getsockopt$inet_sctp_SCTP_DEFAULT_PRINFO(0xffffffffffffff9c, 0x84, 0x72, &(0x7f0000f31000-0xc)={0x0, 0xffff}, &(0x7f0000500000)=0xc) setsockopt$inet_sctp6_SCTP_MAX_BURST(r0, 0x84, 0x14, &(0x7f0000456000-0x8)=@assoc_value={r1, 0x2}, 0x8) r2 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f000000a000)={0x34e, 0x0, &(0x7f00001e5000-0x8)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000006000-0x54)}) r3 = syz_open_dev$mice(&(0x7f00007ae000-0x10)='/dev/input/mice\x00', 0x0, 0x80) setsockopt$inet_sctp6_SCTP_ADD_STREAMS(r3, 0x84, 0x79, &(0x7f000030b000)=0xfffffffffffffc01, 0x4) renameat(r0, &(0x7f0000f03000-0x8)='./file0\x00', r0, &(0x7f000060d000)='./file0\x00') ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000008000-0x30)={0x0, 0x0, &(0x7f0000d06000)=[], 0x0, 0x0, &(0x7f0000176000-0x1)}) ppoll(&(0x7f00005bf000-0x30)=[{r2, 0x4}, {r2, 0x410}, {r3, 0x2004}, {r3, 0x1f}, {r2, 0x80}, {r2, 0xa0}], 0x6, &(0x7f0000db7000-0x8), &(0x7f0000bf9000-0x8)={0xffffffffffffff7f}, 0x8) 2018/02/10 14:10:15 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r0, r0, &(0x7f0000049000), 0x3d2) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000008000)={&(0x7f000000f000-0xc)={0x10, 0x34000}, 0xc, &(0x7f0000220000)={&(0x7f00008d6000-0x14)={0x14, 0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, {}, []}, 0x14}, 0x1}, 0x0) r1 = userfaultfd(0x80800) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000ff8000-0x20)={{&(0x7f0000012000/0x2000)=nil, 0x2000}, 0x1}) bpf$MAP_CREATE(0x0, &(0x7f0000fb4000)={0x2, 0x8000000000000004, 0x400, 0x7fd, 0x4, 0xffffffffffffffff}, 0x2c) userfaultfd(0x800) clock_gettime(0x0, &(0x7f0000132000)={0x0, 0x0}) socketpair(0x1d, 0x800, 0x4, &(0x7f0000589000)) r4 = syz_open_dev$mouse(&(0x7f00006eb000)='/dev/input/mouse#\x00', 0xde6e, 0x1) timer_settime(0x0, 0x1, &(0x7f000097e000)={{0x0, r3}, {r2, r3+10000000}}, &(0x7f0000939000)) fanotify_init(0x25, 0x802) r5 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000ef2000-0x1d)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f00002d8000-0xc)={0x0, 0x0}, &(0x7f0000d76000-0x4)=0xc) syz_open_procfs(r6, &(0x7f0000013000)='ns/cgroup\x00') openat$ion(0xffffffffffffff9c, &(0x7f0000dd5000)='/dev/ion\x00', 0x800, 0x0) pipe2(&(0x7f000058c000), 0x4800) setsockopt$inet_IP_XFRM_POLICY(r4, 0x0, 0x11, &(0x7f0000e12000-0xe8)={{{@in6=@mcast1={0xff, 0x1, [], 0x1}, @in=@rand_addr, 0x2, 0xbd, 0x3, 0x20, 0xa, 0xa0, 0x80, 0xbf, 0x0, r7}, {0x0, 0x8, 0x0, 0x3, 0x0, 0x1fa8, 0x8, 0x20}, {0x1719, 0x7fff, 0x7ff, 0x7ff}, 0x1, 0x7, 0x0, 0x1, 0x1, 0x3}, {{@in=@broadcast=0xffffffff, 0x1, 0x7f}, 0xa, @in=@empty, 0xffffffffffffffff, 0x3, 0x0, 0xffffffffffffffbc, 0x20, 0x6, 0x2}}, 0xe8) openat$selinux_policy(0xffffffffffffff9c, &(0x7f000010e000-0x10)='/selinux/policy\x00', 0x0, 0x0) setsockopt$netlink_NETLINK_TX_RING(r5, 0x10e, 0x7, &(0x7f0000ab4000-0x10)={0x6, 0x7, 0x52, 0xfffffffffffffffc}, 0x10) 2018/02/10 14:10:15 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f000069a000-0xd)='/dev/binder#\x00', 0x0, 0x800) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000a000)={0x34e, 0x0, &(0x7f00001e5000-0x8)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000006000-0x54)}) mmap$binder(&(0x7f0000108000/0xb000)=nil, 0xb000, 0x2000000, 0x12, r0, 0x0) mmap$binder(&(0x7f00009f0000/0x3000)=nil, 0x3000, 0x1000000, 0x5050, r0, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f00003e4000)={0x0}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f00005db000)={r1}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000d9f000-0x18)={r2}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000008000-0x30)={0x0, 0x0, &(0x7f0000d06000)=[], 0x0, 0x0, &(0x7f0000176000-0x1)}) 2018/02/10 14:10:15 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f000035f000-0x12)='/dev/snd/midiC#D#\x00', 0x7fff, 0x8080) ioctl$KVM_GET_DEBUGREGS(r1, 0x8080aea1, &(0x7f0000619000-0x80)) r2 = syz_open_dev$evdev(&(0x7f0000395000-0x12)='/dev/input/event#\x00', 0x1fffffc, 0x0) ioctl$EVIOCGRAB(r2, 0x40044590, &(0x7f0000e95000-0x4)) ioctl$TIOCSBRK(0xffffffffffffffff, 0x40044591) fcntl$setpipe(r0, 0x407, 0xfffffffffffeffff) r3 = openat(r1, &(0x7f0000246000-0x8)='./file0\x00', 0x2, 0x0) sendmsg$key(r3, &(0x7f0000f7f000-0x1c)={0x0, 0x0, &(0x7f0000b41000-0x8)={&(0x7f0000d73000)={0x2, 0x8, 0x1, 0x9, 0x18, 0x0, 0x6, 0x3, [@sadb_key={0xf, 0x0, 0x348, 0x0, "a334b42f7630b7960d2977a8fa4b2a67745fd3bf049843e0e333b907b26fac40d8a0cc69f61914072126618aa649ef5a5aea666a60c4bc3cfbf57b0050419649b00755906d3a761ef302c5797f2f2f813eea99f19c70c134cb4b843e0a824c888edb1b50832916f6a4"}, @sadb_x_kmaddress={0x7, 0x19, 0x0, @in={0x2, 0x1, @loopback=0x7f000001}, @in6={0xa, 0x0, 0x1f, @mcast2={0xff, 0x2, [], 0x1}, 0x2d}}]}, 0xc0}, 0x1}, 0x40) request_key(&(0x7f0000102000)='big_key\x00', &(0x7f0000ad3000)={0x73, 0x79, 0x7a, 0x3}, &(0x7f00006cc000-0x40)='deflate\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', 0xffffffffffffffff) [ 73.884878] binder: 12200:12227 Acquire 1 refcount change on invalid ref 0 ret -22 [ 73.892681] binder: 12200:12227 unknown command 0 [ 73.897569] binder: 12200:12227 ioctl c0306201 2000a000 returned -22 [ 73.938377] binder: 12230:12235 unknown command 0 [ 73.939178] binder: 12229:12239 unknown command 0 [ 73.952420] cgroup: cgroup2: unknown option "" [ 73.956834] binder: 12238:12241 Acquire 1 refcount change on invalid ref 0 ret -22 [ 73.957292] binder: 12230:12235 ioctl c0306201 2000a000 returned -22 [ 73.964838] binder: 12238:12241 unknown command 0 [ 73.976458] binder: 12229:12239 ioctl c0306201 2000a000 returned -22 [ 73.987755] binder: 12238:12241 ioctl c0306201 2000a000 returned -22 [ 74.004207] binder: BINDER_SET_CONTEXT_MGR already set [ 74.012994] binder: 12230:12244 ioctl 40046207 0 returned -16 [ 74.017100] binder: 12238:12248 Acquire 1 refcount change on invalid ref 0 ret -22 [ 74.021417] cgroup: cgroup2: unknown option "" [ 74.026736] binder: 12238:12248 unknown command 0 2018/02/10 14:10:16 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000b36000-0x11)='/dev/qat_adf_ctl\x00', 0x8800, 0x0) getsockopt$inet_sctp_SCTP_DEFAULT_PRINFO(0xffffffffffffff9c, 0x84, 0x72, &(0x7f0000f31000-0xc)={0x0, 0xffff}, &(0x7f0000500000)=0xc) setsockopt$inet_sctp6_SCTP_MAX_BURST(r0, 0x84, 0x14, &(0x7f0000456000-0x8)=@assoc_value={r1, 0x2}, 0x8) r2 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f000000a000)={0x34e, 0x0, &(0x7f00001e5000-0x8)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000006000-0x54)}) r3 = syz_open_dev$mice(&(0x7f00007ae000-0x10)='/dev/input/mice\x00', 0x0, 0x80) setsockopt$inet_sctp6_SCTP_ADD_STREAMS(r3, 0x84, 0x79, &(0x7f000030b000)=0xfffffffffffffc01, 0x4) renameat(r0, &(0x7f0000f03000-0x8)='./file0\x00', r0, &(0x7f000060d000)='./file0\x00') clock_gettime(0x0, &(0x7f0000e45000)={0x0, 0x0}) ppoll(&(0x7f00005bf000-0x30)=[{r2, 0x4}, {r2, 0x410}, {r3, 0x2004}, {r3, 0x1f}, {r2, 0x80}, {r2, 0xa0}], 0x6, &(0x7f0000db7000-0x8)={r4, r5+10000000}, &(0x7f0000bf9000-0x8)={0xffffffffffffff7f}, 0x8) 2018/02/10 14:10:16 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) getxattr(&(0x7f0000feb000-0x8)='./file0\x00', &(0x7f0000647000)=@random={'system.', "6f6579f2696e6721"}, &(0x7f0000d4f000-0x58)=""/88, 0x58) keyctl$link(0x8, 0xfffffffffffffffb, 0x0) keyctl$search(0xa, 0x0, &(0x7f000019e000-0xd)='dns_\x00e\\olver\x00', &(0x7f0000e48000)={0x73, 0x79, 0x7a}, 0x0) [ 74.028493] binder: 12230:12235 unknown command 0 [ 74.044344] binder_alloc: 12230: binder_alloc_buf, no vma [ 74.045559] binder: 12230:12235 ioctl c0306201 2000a000 returned -22 [ 74.050050] binder: 12230:12254 transaction failed 29189/-3, size 56-8 line 2957 [ 74.070526] binder: 12238:12248 ioctl c0306201 2000a000 returned -22 [ 74.080996] binder: 12258:12260 unknown command 0 2018/02/10 14:10:16 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = request_key(&(0x7f0000871000-0x6)='.dead\x00', &(0x7f00000d2000-0x5)={0x73, 0x79, 0x7a, 0x0}, &(0x7f0000336000-0x36)='vboxnet1selfvboxnet1self\\mime_type-wlan0\\{$!mime_type\x00', 0xfffffffffffffff9) madvise(&(0x7f0000ec1000/0x1000)=nil, 0x1000, 0x6f) add_key$user(&(0x7f0000687000)='user\x00', &(0x7f00005ec000-0x5)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000f24000)="d2c94eb79a330d6e8cd7e1fce02afdea3f9e663d1aaa3b793c04242920127f30542b2c4efbc7af0855af0ff67eb5a3bef213881503b8e3931f234648f6bc2ce9f6a62591949a86f51749edfe7c5e37c3b50ca74e1994bf8e14ffb485e3406846a5b9d187fa47014c5896911a93c161eb53129dac3e0a3311aea9a72652aef32e58063c0c9af19ff6e5f1cd6144644b23fd221bfc71cb2c70fb77b00f1a7c2e996c799f7f4e741a922bed6d1b1e380809312f73d4c0cd674a2fe7", 0xba, r1) r2 = request_key(&(0x7f00003c8000-0xb)='asymmetric\x00', &(0x7f0000ba6000)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000b8e000)='/dev/binder#\x00', 0xfffffffffffffffc) add_key$user(&(0x7f000024b000-0x5)='user\x00', &(0x7f0000198000-0x5)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000cd5000-0x97)="87e078fa1681d4a655dd4152b2d089f84984c92f6aa9b348f881733edddac8becea65859873dc2d18b1afc513b390fb602aa1912bd62dc4a845ab45d7277390c5b700839d9a6624ae1ab6b1bbcf3da6976a2704fc9b87f51fb39134a32bd9b285e8c1e29822f46ee43dd58e6ae74f0eb42de931c4b4d83b9673e5f21e2d9d761470c5b56ac722e70f2a6c22f39459b2f7d60a2d1391e74", 0x97, r2) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000a000)={0x34e, 0x0, &(0x7f00001e5000-0x8)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000006000-0x54)}) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$sock_kcm_SIOCKCMCLONE(r0, 0x89e2, &(0x7f00004c3000-0x4)={0xffffffffffffff9c}) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r3, 0x6, 0x16, &(0x7f0000450000)=[{0xa, 0x5}, {0x3, 0x7f}, {0xb, 0xa5c}, {0x3, 0xc9}, {0x4, 0x7}, {0x7, 0x4}, {0x6, 0x7ff}, {0x8, 0x1}, {0x8, 0x6}], 0x9) ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, &(0x7f0000e26000)=0x0) ptrace(0x11, r4) r5 = add_key$keyring(&(0x7f0000f2e000-0x8)='keyring\x00', &(0x7f0000e40000-0x5)={0x73, 0x79, 0x7a, 0x3}, 0x0, 0x0, 0xffffffffffffffff) keyctl$clear(0x7, r5) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000008000-0x30)={0x0, 0x0, &(0x7f0000d06000)=[], 0x0, 0x0, &(0x7f0000176000-0x1)}) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) 2018/02/10 14:10:16 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00009a9000)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socket$nl_crypto(0x10, 0x3, 0x15) pipe2(&(0x7f0000d02000-0x8)={0x0, 0x0}, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) dup3(r3, r2, 0x0) ioctl$KVM_SET_SREGS(r2, 0x4138ae84, &(0x7f0000c51000)={{}, {}, {}, {}, {}, {}, {}, {}, {}, {}, 0x0, 0x0, 0x0, 0x540008}) [ 74.087008] binder: 12258:12260 ioctl c0306201 2000a000 returned -22 2018/02/10 14:10:16 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r0, r0, &(0x7f0000049000), 0x3d2) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000008000)={&(0x7f000000f000-0xc)={0x10, 0x34000}, 0xc, &(0x7f0000220000)={&(0x7f00008d6000-0x14)={0x14, 0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, {}, []}, 0x14}, 0x1}, 0x0) r1 = userfaultfd(0x80800) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000ff8000-0x20)={{&(0x7f0000012000/0x2000)=nil, 0x2000}, 0x1}) bpf$MAP_CREATE(0x0, &(0x7f0000fb4000)={0x2, 0x8000000000000004, 0x400, 0x7fd, 0x4, 0xffffffffffffffff}, 0x2c) userfaultfd(0x800) clock_gettime(0x0, &(0x7f0000132000)={0x0, 0x0}) socketpair(0x1d, 0x800, 0x4, &(0x7f0000589000)) r4 = syz_open_dev$mouse(&(0x7f00006eb000)='/dev/input/mouse#\x00', 0xde6e, 0x1) timer_settime(0x0, 0x1, &(0x7f000097e000)={{0x0, r3}, {r2, r3+10000000}}, &(0x7f0000939000)) fanotify_init(0x25, 0x802) r5 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000ef2000-0x1d)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f00002d8000-0xc)={0x0, 0x0}, &(0x7f0000d76000-0x4)=0xc) syz_open_procfs(r6, &(0x7f0000013000)='ns/cgroup\x00') openat$ion(0xffffffffffffff9c, &(0x7f0000dd5000)='/dev/ion\x00', 0x800, 0x0) pipe2(&(0x7f000058c000), 0x4800) setsockopt$inet_IP_XFRM_POLICY(r4, 0x0, 0x11, &(0x7f0000e12000-0xe8)={{{@in6=@mcast1={0xff, 0x1, [], 0x1}, @in=@rand_addr, 0x2, 0xbd, 0x3, 0x20, 0xa, 0xa0, 0x80, 0xbf, 0x0, r7}, {0x0, 0x8, 0x0, 0x3, 0x0, 0x1fa8, 0x8, 0x20}, {0x1719, 0x7fff, 0x7ff, 0x7ff}, 0x1, 0x7, 0x0, 0x1, 0x1, 0x3}, {{@in=@broadcast=0xffffffff, 0x1, 0x7f}, 0xa, @in=@empty, 0xffffffffffffffff, 0x3, 0x0, 0xffffffffffffffbc, 0x20, 0x6, 0x2}}, 0xe8) openat$selinux_policy(0xffffffffffffff9c, &(0x7f000010e000-0x10)='/selinux/policy\x00', 0x0, 0x0) setsockopt$netlink_NETLINK_TX_RING(r5, 0x10e, 0x7, &(0x7f0000ab4000-0x10)={0x6, 0x7, 0x52, 0xfffffffffffffffc}, 0x10) 2018/02/10 14:10:16 executing program 1: r0 = eventfd2(0x9, 0x80000) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000001000)='/dev/vcs\x00', 0x40000, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) stat(&(0x7f0000001000)='./file0\x00', &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0}) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) stat(&(0x7f0000002000-0x8)='./file0\x00', &(0x7f0000001000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) fchownat(r1, &(0x7f0000001000-0x8)='./file0\x00', r2, r3, 0x800) r4 = openat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0xa2000, 0x20) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$TIOCGPGRP(r4, 0x540f, &(0x7f0000001000)) r5 = fcntl$getown(r0, 0x9) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$EVIOCSCLOCKID(r1, 0x400445a0, &(0x7f0000001000)=0x3) r6 = accept4$netrom(r4, &(0x7f0000001000)=@full, &(0x7f0000000000)=0x48, 0x800) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) lseek(r6, 0x0, 0x4) syz_open_dev$vcsn(&(0x7f0000000000)='/dev/vcs#\x00', 0x0, 0x101000) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_ADD(r4, 0xc1105517, &(0x7f0000001000-0x10c)={{0x4, 0x0, 0xc0000000000, 0xfffffffffffffff9, "4f377766c6ce0bf0aac0673ff47beb362a60e8b349fdfb07fac732d09e5e21e09e5b937985d1de6b95240b77", 0x7}, 0x0, 0x0, 0x8001, r5, 0xffffffff, 0x1f, "3c4e9a6be190f1da56497098913cff5d2dc82011c660e2f00a2394c32bff57c24e7776f7249bea3e97fad0907524ee5413523b70511fb3525bf9a21995c4d5d9", &(0x7f0000000000)='@,vboxnet1\x00', 0xb, [], [0xfffffffffffffffa, 0xe6c1, 0xd269, 0x48]}) ioctl$SNDRV_CTL_IOCTL_HWDEP_NEXT_DEVICE(r4, 0xc0045520, &(0x7f0000002000-0x4)=0x3) timerfd_settime(0xffffffffffffffff, 0x0, &(0x7f0000016000-0x10)={{}, {0x77359400}}, &(0x7f0000016000-0x10)) ioctl$VHOST_SET_VRING_BUSYLOOP_TIMEOUT(r0, 0x4008af23, &(0x7f0000001000-0x8)={0x3, 0x3}) 2018/02/10 14:10:16 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000b36000-0x11)='/dev/qat_adf_ctl\x00', 0x8800, 0x0) getsockopt$inet_sctp_SCTP_DEFAULT_PRINFO(0xffffffffffffff9c, 0x84, 0x72, &(0x7f0000f31000-0xc)={0x0, 0xffff}, &(0x7f0000500000)=0xc) setsockopt$inet_sctp6_SCTP_MAX_BURST(r0, 0x84, 0x14, &(0x7f0000456000-0x8)=@assoc_value={r1, 0x2}, 0x8) r2 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f000000a000)={0x34e, 0x0, &(0x7f00001e5000-0x8)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000006000-0x54)}) r3 = syz_open_dev$mice(&(0x7f00007ae000-0x10)='/dev/input/mice\x00', 0x0, 0x80) setsockopt$inet_sctp6_SCTP_ADD_STREAMS(r3, 0x84, 0x79, &(0x7f000030b000)=0xfffffffffffffc01, 0x4) clock_gettime(0x0, &(0x7f0000e45000)={0x0, 0x0}) ppoll(&(0x7f00005bf000-0x30)=[{r2, 0x4}, {r2, 0x410}, {r3, 0x2004}, {r3, 0x1f}, {r2, 0x80}, {r2, 0xa0}], 0x6, &(0x7f0000db7000-0x8)={r4, r5+10000000}, &(0x7f0000bf9000-0x8)={0xffffffffffffff7f}, 0x8) 2018/02/10 14:10:16 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000a5000-0x8)) mmap(&(0x7f0000000000/0x19000)=nil, 0x19000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000924000-0xc)='/dev/rfkill\x00', 0x0, 0x0) r1 = userfaultfd(0x3) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000e54000-0x18)={0xaa}) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000008000-0x20)={{&(0x7f0000000000/0x4000)=nil, 0x4000}, 0x4}) readv(r0, &(0x7f00001f3000-0x10)=[{&(0x7f0000002000-0x4e)=""/1, 0x1}], 0x1) ioctl$RNDADDTOENTCNT(r0, 0x40045201, &(0x7f0000b27000)) ioctl$RNDADDTOENTCNT(r0, 0x40045201, &(0x7f0000a81000)) clock_gettime(0x0, &(0x7f0000eae000-0x8)={0x0, 0x0}) ppoll(&(0x7f0000922000)=[{r1, 0x1003}, {r0, 0x100}, {r0, 0x1}, {r0, 0x24}, {r1, 0x20}, {r0, 0x9440}, {r1, 0x2620}, {r0, 0x6a}, {r1, 0x4000}, {r0, 0x10}], 0xa, &(0x7f0000daa000)={r2, r3+30000000}, &(0x7f0000969000-0x8)={0x7}, 0x8) ioctl$UFFDIO_UNREGISTER(r1, 0xc020aa04, &(0x7f0000008000-0x4)={&(0x7f0000000000/0x2000)=nil, 0x2000}) [ 74.132951] binder: 12264:12265 unknown command 0 [ 74.138123] binder: 12264:12265 ioctl c0306201 2000a000 returned -22 [ 74.145441] binder: undelivered TRANSACTION_ERROR: 29189 [ 74.152040] binder: BINDER_SET_CONTEXT_MGR already set [ 74.159387] binder: release 12230:12235 transaction 375 out, still active [ 74.161894] binder: 12264:12265 ioctl 40046207 0 returned -16 [ 74.166374] binder: undelivered TRANSACTION_COMPLETE 2018/02/10 14:10:16 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000a000)={0x34e, 0x0, &(0x7f00001e5000-0x8)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000006000-0x54)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000-0x30)={0x44, 0x0, &(0x7f0000d06000)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x38, 0x8, &(0x7f000000d000)=[@fda={0x66646185}, @flat={0x73682a85}], &(0x7f0000006000)=[0x20]}}], 0x0, 0x0, &(0x7f0000176000-0x1)}) [ 74.177437] binder: send failed reply for transaction 375, target dead [ 74.184228] binder: 12264:12269 ioctl 89e2 204c2ffc returned -22 [ 74.211434] binder: 12264:12265 unknown command 0 [ 74.216692] binder: 12264:12269 ioctl 89e2 204c2ffc returned -22 2018/02/10 14:10:16 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000008a000)={0x8, 0x0, &(0x7f0000b25000)=[@exit_looper={0x630d}], 0x18e, 0x0, &(0x7f0000ad7000)="3d4814a3ffffff7f00000000d257152ad8ebf9399242580d1c6a8aec43c42096c36a50f6d6cf736922e53ecf0800f8f9be57f4a503bd14f987652c53b797be2569deb883afb341c77d11ce2a27ec46e172ffcfb5a3b5c3c20e6e33b8cd85731e48a97661b30bea0ece08000000f01a0dfc3b5fcb69da883588a5a69786ec4a9958a5046baaae1bd238dedf03d5474bc0a59911d2cf8b23ff946ef2ea4391733e7160c8dced4dabc35eef43228de1e18a996a7ff2bf2af1fffe3637c32a990b3390d1755903215817941c9f6ba6287389551b68fed9d15326aff8798496f83054f3fc975063460eec9c801213bf99013ca0554e1264ca3b9efdc958e91fbde1fd33802747f9f802a48dd319682192aba46e946f0815167e670000000055e3d95a77303ed014faf78e0cc243667a63eacf503a659b83613a053882be93c819600d9cad0bb6a95868c9cefe522589efe7c6f08b2c1c5b4e84f2606cdcdab119b3cded6bdff8d69041d60344444597ce56d5897378de0c6785c3c064"}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000008000-0x30)={0x0, 0x0, &(0x7f0000d06000)=[], 0x0, 0x0, &(0x7f0000176000-0x1)}) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000c31000-0xc)={0x0}, &(0x7f0000c2c000)=0xc) sched_getscheduler(r1) [ 74.228866] binder: 12264:12265 ioctl c0306201 2000a000 returned -22 [ 74.243134] binder: 12274:12275 unknown command 0 [ 74.270228] binder: 12274:12281 transaction failed 29189/-22, size 56-8 line 2842 2018/02/10 14:10:16 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000a5000-0x8)) mmap(&(0x7f0000000000/0x19000)=nil, 0x19000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000924000-0xc)='/dev/rfkill\x00', 0x0, 0x0) r1 = userfaultfd(0x0) clock_gettime(0x0, &(0x7f00008b9000-0x8)={0x0, 0x0}) select(0x40, &(0x7f0000ec3000)={0x5, 0x1, 0x2b, 0x6, 0x3f, 0x7, 0x3f000000000, 0x52}, &(0x7f0000ecb000)={0xfffffffffffffffa, 0xc656, 0x81, 0x800000000000000, 0x7, 0x909, 0x40, 0x9}, &(0x7f0000b02000)={0x1, 0x0, 0xfff, 0x81, 0x8, 0x3, 0x4, 0x7f}, &(0x7f0000e86000-0x8)={r2, r3/1000+30000}) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000e54000-0x18)={0xaa}) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000008000-0x20)={{&(0x7f0000000000/0x4000)=nil, 0x4000}, 0x1}) readv(r0, &(0x7f00001f3000-0x10)=[{&(0x7f0000002000-0x4e)=""/1, 0x1}], 0x1) ioctl$RNDADDTOENTCNT(r0, 0x40045201, &(0x7f0000f85000)=0x200) ioctl$RNDADDTOENTCNT(r0, 0x40045201, &(0x7f0000a81000)) ioctl$KDSKBSENT(r0, 0x4b49, &(0x7f000096e000-0x9a)="5f20a494b85534d34c591eb98126202dd62ad7b0c5960182f4acdd2fbef99350b7b12ee371e1ea7a54d2e770b003fd24cf3ca2ade7ac24b63f871d44e95e3bd38a542c47e6aec08fc952b91466c5cdf9259835698b83e7f113124dd791e4904a0c0b3d28574c4f1e9cd9b57248b49614530223a90c31701675bf92b81c3fdbf7c45c3bfad9168c1e875c00fa629fba2f3af04723e244e4a22243") ioctl$UFFDIO_UNREGISTER(r1, 0xc020aa04, &(0x7f0000008000-0x4)={&(0x7f0000000000/0x2000)=nil, 0x2000}) [ 74.274543] binder: 12274:12275 ioctl c0306201 2000a000 returned -22 [ 74.284215] binder: 12282:12285 unknown command 0 [ 74.293276] binder: 12282:12285 ioctl c0306201 2008a000 returned -22 [ 74.302474] binder: 12276:12283 Acquire 1 refcount change on invalid ref 0 ret -22 [ 74.310291] binder: 12276:12283 unknown command 0 [ 74.324273] binder_alloc: binder_alloc_mmap_handler: 12274 20000000-20002000 already mapped failed -16 2018/02/10 14:10:16 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) writev(0xffffffffffffffff, &(0x7f0000f48000)=[{&(0x7f0000a03000)='`', 0x1}], 0x1) madvise(&(0x7f000092d000/0x400000)=nil, 0x400000, 0x40000000000f) clone(0x0, &(0x7f00005fc000), &(0x7f000044c000), &(0x7f0000837000), &(0x7f0000e11000)) pipe(&(0x7f0000a91000)={0x0}) ioctl$DRM_IOCTL_ADD_MAP(r0, 0xc0186415, &(0x7f00002ca000-0x18)={&(0x7f00002ae000/0x4000)=nil, 0x5, 0x1, 0x20, &(0x7f00008e8000/0x3000)=nil, 0x877f}) 2018/02/10 14:10:16 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000a000)={0x34e, 0x0, &(0x7f00001e5000-0x8)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000006000-0x54)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000008000-0x30)={0x0, 0x0, &(0x7f0000d06000)=[], 0x0, 0x0, &(0x7f0000176000-0x1)}) r1 = syz_open_dev$dmmidi(&(0x7f00008bf000)='/dev/dmmidi#\x00', 0x7, 0x900) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f000061b000-0xc)={0x20000000}) 2018/02/10 14:10:16 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000b36000-0x11)='/dev/qat_adf_ctl\x00', 0x8800, 0x0) getsockopt$inet_sctp_SCTP_DEFAULT_PRINFO(0xffffffffffffff9c, 0x84, 0x72, &(0x7f0000f31000-0xc)={0x0, 0xffff}, &(0x7f0000500000)=0xc) setsockopt$inet_sctp6_SCTP_MAX_BURST(r0, 0x84, 0x14, &(0x7f0000456000-0x8)=@assoc_value={r1, 0x2}, 0x8) r2 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f000000a000)={0x34e, 0x0, &(0x7f00001e5000-0x8)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000006000-0x54)}) r3 = syz_open_dev$mice(&(0x7f00007ae000-0x10)='/dev/input/mice\x00', 0x0, 0x80) clock_gettime(0x0, &(0x7f0000e45000)={0x0, 0x0}) ppoll(&(0x7f00005bf000-0x30)=[{r2, 0x4}, {r2, 0x410}, {r3, 0x2004}, {r3, 0x1f}, {r2, 0x80}, {r2, 0xa0}], 0x6, &(0x7f0000db7000-0x8)={r4, r5+10000000}, &(0x7f0000bf9000-0x8)={0xffffffffffffff7f}, 0x8) 2018/02/10 14:10:16 executing program 1: mmap(&(0x7f0000000000/0xf68000)=nil, 0xf68000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6_sctp(0xa, 0x1, 0x84) r1 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000c8e000)='/dev/rfkill\x00', 0x40001, 0x0) mmap(&(0x7f0000f68000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$TIOCMBIC(r1, 0x5417, &(0x7f0000f68000)=0x6) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000224000-0x2c)=[@in6={0xa, 0x3, 0x0, @empty}], 0x1c) mmap(&(0x7f0000f68000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r2 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000f68000)='/selinux/avc/hash_stats\x00', 0x0, 0x0) connect$bt_rfcomm(r2, &(0x7f00000ec000)={0x1f, {0x1, 0x8, 0x2, 0x1d, 0x7fc0000000, 0xc3f}, 0x6}, 0x9) sendto$inet(r0, &(0x7f0000ac1000-0x45)="c4", 0x1, 0x0, &(0x7f00006e2000)={0x2, 0x3, @loopback=0x7f000001}, 0x10) getsockopt$inet_sctp6_SCTP_PR_STREAM_STATUS(r0, 0x84, 0x74, &(0x7f0000f67000)=""/4096, &(0x7f0000461000-0x4)=0x1000) recvfrom$inet6(r0, &(0x7f0000673000)=""/184, 0xb8, 0x2002, &(0x7f0000bb0000-0x1c)={0xa, 0x2, 0xbe0, @mcast1={0xff, 0x1, [], 0x1}, 0xf7}, 0x1c) mmap(&(0x7f0000f68000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000f69000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000f69000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) getsockopt$SO_COOKIE(r0, 0x1, 0x39, &(0x7f0000f68000), &(0x7f0000f6a000-0x4)=0xf0) dup2(r0, r0) [ 74.334835] binder: 12276:12283 ioctl c0306201 2000a000 returned -22 [ 74.348289] binder: 12274:12275 unknown command 0 [ 74.356807] binder: 12282:12285 unknown command 0 [ 74.361272] binder: 12274:12275 ioctl c0306201 2000a000 returned -22 [ 74.361832] binder: 12282:12285 ioctl c0306201 2008a000 returned -22 [ 74.412164] binder: undelivered TRANSACTION_ERROR: 29189 [ 74.427525] binder: 12304:12309 Acquire 1 refcount change on invalid ref 0 ret -22 [ 74.435324] binder: 12304:12309 unknown command 0 [ 74.440668] binder: 12308:12313 Acquire 1 refcount change on invalid ref 0 ret -22 [ 74.448485] binder: 12308:12313 unknown command 0 [ 74.454104] binder: 12308:12313 ioctl c0306201 2000a000 returned -22 2018/02/10 14:10:16 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$evdev(&(0x7f0000dda000-0x12)='/dev/input/event#\x00', 0x0, 0x0) ioctl$EVIOCGRAB(r0, 0x40044590, &(0x7f0000e95000-0x4)) ioctl$TIOCSBRK(0xffffffffffffffff, 0x40044591) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffff9c, 0x84, 0x9, &(0x7f0000bc1000)={0x0, @in6={{0xa, 0xffffffffffffffff, 0x0, @dev={0xfe, 0x80}}}}, &(0x7f0000e2e000)=0xa0) setsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r1, 0x84, 0x22, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, r2}, 0x10) request_key(&(0x7f0000102000)='big_key\x00', &(0x7f0000ad3000)={0x73, 0x79, 0x7a, 0x3}, &(0x7f00006cc000-0x40)='deflate\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', 0xffffffffffffffff) 2018/02/10 14:10:16 executing program 4: r0 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000003000-0x30)={0x8, 0x0, &(0x7f00001e5000-0x8)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000001000)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000-0x30)={0x44, 0x0, &(0x7f0000d06000)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x38, 0x8, &(0x7f000000d000)=[@fda={0x66646185}, @flat={0x73682a85}], &(0x7f0000006000)=[0x20]}}], 0x0, 0x0, &(0x7f0000176000-0x1)}) 2018/02/10 14:10:16 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r0, r0, &(0x7f0000049000), 0x3d2) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000008000)={&(0x7f000000f000-0xc)={0x10, 0x34000}, 0xc, &(0x7f0000220000)={&(0x7f00008d6000-0x14)={0x14, 0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, {}, []}, 0x14}, 0x1}, 0x0) r1 = userfaultfd(0x80800) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000ff8000-0x20)={{&(0x7f0000012000/0x2000)=nil, 0x2000}, 0x1}) bpf$MAP_CREATE(0x0, &(0x7f0000fb4000)={0x2, 0x8000000000000004, 0x400, 0x7fd, 0x4, 0xffffffffffffffff}, 0x2c) userfaultfd(0x800) clock_gettime(0x0, &(0x7f0000132000)={0x0, 0x0}) socketpair(0x1d, 0x800, 0x4, &(0x7f0000589000)) r4 = syz_open_dev$mouse(&(0x7f00006eb000)='/dev/input/mouse#\x00', 0xde6e, 0x1) timer_settime(0x0, 0x1, &(0x7f000097e000)={{0x0, r3}, {r2, r3+10000000}}, &(0x7f0000939000)) fanotify_init(0x25, 0x802) r5 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000ef2000-0x1d)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f00002d8000-0xc)={0x0, 0x0}, &(0x7f0000d76000-0x4)=0xc) syz_open_procfs(r6, &(0x7f0000013000)='ns/cgroup\x00') openat$ion(0xffffffffffffff9c, &(0x7f0000dd5000)='/dev/ion\x00', 0x800, 0x0) pipe2(&(0x7f000058c000), 0x4800) setsockopt$inet_IP_XFRM_POLICY(r4, 0x0, 0x11, &(0x7f0000e12000-0xe8)={{{@in6=@mcast1={0xff, 0x1, [], 0x1}, @in=@rand_addr, 0x2, 0xbd, 0x3, 0x20, 0xa, 0xa0, 0x80, 0xbf, 0x0, r7}, {0x0, 0x8, 0x0, 0x3, 0x6, 0x0, 0x8, 0x20}, {0x1719, 0x7fff, 0x7ff, 0x7ff}, 0x1, 0x7, 0x0, 0x1, 0x1, 0x3}, {{@in=@broadcast=0xffffffff, 0x1, 0x7f}, 0xa, @in=@empty, 0xffffffffffffffff, 0x3, 0x0, 0xffffffffffffffbc, 0x20, 0x6, 0x2}}, 0xe8) openat$selinux_policy(0xffffffffffffff9c, &(0x7f000010e000-0x10)='/selinux/policy\x00', 0x0, 0x0) setsockopt$netlink_NETLINK_TX_RING(r5, 0x10e, 0x7, &(0x7f0000ab4000-0x10)={0x6, 0x7, 0x52, 0xfffffffffffffffc}, 0x10) 2018/02/10 14:10:16 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00007c5000)={0x8, 0x0, &(0x7f00001e5000-0x8)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f00006b0000)}) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_inet_SIOCDARP(r1, 0x8953, &(0x7f0000681000-0x44)={{0x2, 0x0, @multicast2=0xe0000002}, {0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}}, 0x8, {0x2, 0x0, @dev={0xac, 0x14, 0x0, 0x16}}, @generic="267562c4c9add9613405064acd4091b1"}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000008000-0x30)={0x0, 0x0, &(0x7f0000d06000)=[], 0x0, 0x0, &(0x7f0000176000-0x1)}) 2018/02/10 14:10:16 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket(0x40000000015, 0x5, 0x0) creat(&(0x7f0000b85000-0x8)='./file0\x00', 0x51) connect$netrom(r0, &(0x7f0000bf9000)=@full={{0x3, {"df3fde38f858fe"}}, [{"cb95bb535f2328"}, {"fe24fddc7b5917"}, {"7467c352378946"}, {"7ab7d3ffe49627"}, {"8264f2ea6c77d9"}, {"be7d32768fa33a"}, {"48ac52dd8e6c85"}, {"75002233a53eae"}]}, 0x48) r1 = openat$dsp(0xffffffffffffff9c, &(0x7f000048d000-0x9)='/dev/dsp\x00', 0x20000, 0x0) ioctl$DRM_IOCTL_MARK_BUFS(r1, 0x40186417, &(0x7f0000518000-0x18)={0x100, 0x0, 0x2, 0x7e, 0x1, 0x20}) 2018/02/10 14:10:16 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000a5000-0x8)) mmap(&(0x7f0000000000/0x19000)=nil, 0x19000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000fc0000)='/selinux/checkreqprot\x00', 0x80000, 0x0) ioctl$KVM_SET_LAPIC(r0, 0x4400ae8f, &(0x7f0000433000)={"bd57e3059d4ee3c21b5d989e79d1e843f2fbc862750f0061d825bba0aed0a00793498e1f1a88506082cf8fd2969547814f761d581691ed8e68e6d942df554ebe0de6de7d2fa5bb7eba47fffc4d51538a3d722214d36a60f9fe8911df162ee8d20857a922d85e415ada8bfc97c0861e2d237a053ad4b639f211d4e75e197d6229116e32014e5827adfd968a583693267e9b4c383f93d8e1b07e4e1a41087f14448e1d22da6912a1f14ef539e8a1ad933acd71dc91d5a25674b4d5936416b739b65da4c3559da5b3e363122dde295de34e429847127c6005b40ee6cf668b70cc2e9f0ba82a1b50e3e80d5b3d21b0de567faf5ea76b818aefb873be00b3592c62521e88320c006493a9ea77c5c5c509d0bc89e9c50e3b5b3003841ff96b25833f03e0deecc4b3ca0523998cb9d87e5b2dd5c4c76e6aed13200fce5b5cd619d048d3535c46baa93f3699b290408ac24128cbb28cb10b18c77967c0eccadadf861ca9b6eda6923b152794bafaf690a1c50779fcc29cd1709f2696e255112ceaa69049d54594b23baab38428dd7f8b90393a515628f1f1ddd04537220dd563b166e637a9725646d62059fea3b66eb5a12823a9fce351f527c2315a72741667becb8543ff63725f86827f8633ad69e31bc7e61d273f8e3ea9708d2494660f52ae65009135efbcfe51037e4a9e6c22a2f1e09d14154ecc38f46d09f74fd22937464814bf0a3246997e93d8c64a584e4abf64698baa6bd750a9d91a05f29f0dd918c72c7ac8bb59dc84fbede820c3fbf03082be3adcf66a0b4b0fcb00853947e9126ea350b809ab118d30498e576de252994d39a3d8dbaf8e3235223d2ba740bfa4d758e62395924f59fc8a95c5598a44abc7c90fa57f501ca23b7700ba759aa46041cd9ac28ae2b75ac100a9667228a7c13228e0bff39eab4329381b6b02205ee1def7483834a52096984fff7f210923b505f124aacc872ab1371a5788b59685e389fb2c00a6062953681d0ce66f0cd6eddcf9a8bd049e4715bf74915a1b0b82607ef1f88c5a40dd96d11d8aba1fbe46e6d4e49bdd6e2e50d633b4fc98b8ad2a2105252c313728354b955f57ec88bbcae5d982e131e6c41c3cd4088c9bddbc6402f91bc7306dc075f55cbd7d171f7e3737fc166f1210ced53d89affbcfef298661fdb15e458521865b2ef8d85cc35af7c768ed52af60742c9c7ce9bc4d57203c7efc9f572c0ae7aff3c5df0db4f06c05c87594e1cfe8a4cdaa89ff0eb5bec5b0c7ebcbaaed914303e7a85f118c744d18008e17926131f5cfca7ad0ce04c24841780a067b3c05ae47ea7ac2eaacac8ce2a009aaaad5e93fbde8100010eb4afce9aad1aea711515ec23fd8cbd4517e45374bea03f7ee9d7777c97affff61f79bf77d7e26cfed52b7daf1c9449d6ed9a79cbb9bd047207d4b1eaddc083f97908270adcc0c8d"}) r1 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000924000-0xc)='/dev/rfkill\x00', 0x0, 0x0) r2 = userfaultfd(0x0) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000e54000-0x18)={0xaa}) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000008000-0x20)={{&(0x7f0000000000/0x4000)=nil, 0x4000}, 0x1}) readv(r1, &(0x7f00001f3000-0x10)=[{&(0x7f0000002000-0x4e)=""/1, 0x1}], 0x1) ioctl$RNDADDTOENTCNT(r1, 0x40045201, &(0x7f0000b27000)) ioctl$RNDADDTOENTCNT(r1, 0x40045201, &(0x7f0000a81000)) ioctl$UFFDIO_UNREGISTER(r2, 0xc020aa04, &(0x7f0000008000-0x4)={&(0x7f0000000000/0x2000)=nil, 0x2000}) 2018/02/10 14:10:16 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000b36000-0x11)='/dev/qat_adf_ctl\x00', 0x8800, 0x0) getsockopt$inet_sctp_SCTP_DEFAULT_PRINFO(0xffffffffffffff9c, 0x84, 0x72, &(0x7f0000f31000-0xc)={0x0, 0xffff}, &(0x7f0000500000)=0xc) setsockopt$inet_sctp6_SCTP_MAX_BURST(r0, 0x84, 0x14, &(0x7f0000456000-0x8)=@assoc_value={r1, 0x2}, 0x8) r2 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f000000a000)={0x34e, 0x0, &(0x7f00001e5000-0x8)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000006000-0x54)}) clock_gettime(0x0, &(0x7f0000e45000)={0x0, 0x0}) ppoll(&(0x7f00005bf000-0x30)=[{r2, 0x4}, {r2, 0x410}, {0xffffffffffffffff, 0x2004}, {0xffffffffffffffff, 0x1f}, {r2, 0x80}, {r2, 0xa0}], 0x6, &(0x7f0000db7000-0x8)={r3, r4+10000000}, &(0x7f0000bf9000-0x8)={0xffffffffffffff7f}, 0x8) 2018/02/10 14:10:16 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000f28000-0x10)=[{&(0x7f00005f0000)="29000000200019fff63d0a14000000060200003215f50005000000000d0011000000000200e1000008", 0x29}], 0x1) ioctl$KVM_ASSIGN_DEV_IRQ(r0, 0x4040ae70, &(0x7f0000554000-0x10)={0x5, 0x5, 0x8, 0x100}) [ 74.460638] binder: 12304:12309 ioctl c0306201 2000a000 returned -22 [ 74.477016] binder: 12304:12314 Acquire 1 refcount change on invalid ref 0 ret -22 [ 74.484866] binder: 12304:12314 unknown command 0 [ 74.490412] binder: 12304:12314 ioctl c0306201 2000a000 returned -22 2018/02/10 14:10:16 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000a000)={0x34e, 0x0, &(0x7f00001e5000-0x8)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000006000-0x54)}) openat$dsp(0xffffffffffffff9c, &(0x7f0000aec000)='/dev/dsp\x00', 0x2000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000-0x30)={0x44, 0x0, &(0x7f0000d06000)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x38, 0x8, &(0x7f000000d000)=[@fda={0x66646185}, @flat={0x73682a85}], &(0x7f0000006000)=[0x20]}}], 0x0, 0x0, &(0x7f0000176000-0x1)}) 2018/02/10 14:10:16 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r0, &(0x7f00004c0000)={0xa, 0x3, 0x0, @ipv4={[], [0xff, 0xff], @empty}}, 0x1c) listen(r0, 0x43) r1 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000a25000)='/dev/sequencer\x00', 0x20100, 0x0) ioctl$sock_inet_sctp_SIOCINQ(r1, 0x541b, &(0x7f0000a82000)) ioctl$sock_FIOGETOWN(r0, 0x8903, &(0x7f000031b000)=0x0) stat(&(0x7f0000729000-0x8)='./file0\x00', &(0x7f0000dd4000-0x44)={0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$DRM_IOCTL_GET_CLIENT(r1, 0xc0186405, &(0x7f0000986000-0x20)={0x200, 0x6, r2, 0x3, r3, 0xff, 0x1, 0x81}) r4 = socket$inet6_sctp(0xa, 0x4000000000000001, 0x84) bind$inet6(r4, &(0x7f000036c000-0x1c)={0xa, 0x3, 0x0, @loopback={0x0, 0x1}}, 0x1c) ioctl$KVM_GET_CPUID2(0xffffffffffffffff, 0xc008ae91, &(0x7f0000b5e000-0x30)={0x0, 0x0, []}) [ 74.543108] binder: 12323:12327 Acquire 1 refcount change on invalid ref 0 ret -22 [ 74.560807] binder: 12321:12329 Acquire 1 refcount change on invalid ref 0 ret -22 [ 74.568772] binder: 12321:12329 unknown command 0 2018/02/10 14:10:16 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket(0x200000000010, 0x2, 0x4) write(r0, &(0x7f00003e5000)="2400000024007f000000000900060100000ff6ff010000000000f3000e0008ff1b00ff10", 0x24) 2018/02/10 14:10:16 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000a000)={0x34e, 0x0, &(0x7f00001e5000-0x8)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000006000-0x54)}) r1 = mmap$binder(&(0x7f000073c000/0x3000)=nil, 0x3000, 0x2, 0x50, r0, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000008000-0x30)={0x372, 0x0, &(0x7f0000c21000)=[@free_buffer={0x40086303, r1}, @reply_sg={0x40486312, {{0x4, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x29d, 0xffffffe4, &(0x7f00002dc000)=[@flat={0x73682a85, 0x1, r1, 0x3}, @flat={0x77622a85, 0xa, r1, 0x3}], &(0x7f0000955000-0x30)=[0x0, 0x78, 0x30, 0x0, 0x0, 0x20]}, 0x16}}, @exit_looper={0x630d}, @reply_sg={0x40486312, {{0x2, 0x0, 0x4, 0x0, 0x11, 0x0, 0x0, 0x0, 0x0, &(0x7f0000cf9000)=[@ptr={0x70742a85, 0x0, &(0x7f000040f000-0x1), 0x0, 0x3, 0xd}], &(0x7f0000846000-0x1f)=[0x18, 0x40, 0x38, 0x68]}, 0x80000}}], 0x290, 0x0, &(0x7f0000d79000)}) [ 74.585876] binder: 12323:12337 Acquire 1 refcount change on invalid ref 0 ret -22 [ 74.587405] binder: 12321:12329 ioctl c0306201 2000a000 returned -22 [ 74.631854] binder: 12338:12344 unknown command 0 2018/02/10 14:10:16 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000b36000-0x11)='/dev/qat_adf_ctl\x00', 0x8800, 0x0) getsockopt$inet_sctp_SCTP_DEFAULT_PRINFO(0xffffffffffffff9c, 0x84, 0x72, &(0x7f0000f31000-0xc)={0x0, 0xffff}, &(0x7f0000500000)=0xc) setsockopt$inet_sctp6_SCTP_MAX_BURST(r0, 0x84, 0x14, &(0x7f0000456000-0x8)=@assoc_value={r1, 0x2}, 0x8) r2 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f000000a000)={0x34e, 0x0, &(0x7f00001e5000-0x8)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000006000-0x54)}) clock_gettime(0x0, &(0x7f0000e45000)={0x0, 0x0}) ppoll(&(0x7f00005bf000-0x30)=[{r2, 0x4}, {r2, 0x410}, {0xffffffffffffffff, 0x2004}, {0xffffffffffffffff, 0x1f}, {r2, 0x80}, {r2, 0xa0}], 0x6, &(0x7f0000db7000-0x8)={r3, r4+10000000}, &(0x7f0000bf9000-0x8)={0xffffffffffffff7f}, 0x8) [ 74.640606] binder: 12338:12344 ioctl c0306201 2000a000 returned -22 [ 74.652816] binder: 12347:12350 unknown command 0 [ 74.667492] binder_alloc: binder_alloc_mmap_handler: 12338 20000000-20002000 already mapped failed -16 [ 74.667585] binder: 12347:12350 ioctl c0306201 2000a000 returned -22 2018/02/10 14:10:16 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000a5000-0x8)) mmap(&(0x7f0000000000/0x19000)=nil, 0x19000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000924000-0xc)='/dev/rfkill\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_STATUS(r0, 0xc05c5340, &(0x7f000039e000)={0x3, 0xff, 0x3, {0x77359400}, 0x5, 0x34}) r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000e54000-0x18)={0xaa}) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000008000-0x20)={{&(0x7f0000000000/0x4000)=nil, 0x4000}, 0x1}) readv(r0, &(0x7f00001f3000-0x10)=[{&(0x7f0000002000-0x4e)=""/1, 0x1}], 0x1) getsockopt$inet_sctp6_SCTP_INITMSG(r0, 0x84, 0x2, &(0x7f0000667000-0x8), &(0x7f0000d92000)=0x8) ioctl$RNDADDTOENTCNT(r0, 0x40045201, &(0x7f0000b27000)) ioctl$RNDADDTOENTCNT(r0, 0x40045201, &(0x7f0000a81000)) ioctl$UFFDIO_UNREGISTER(r1, 0xc020aa04, &(0x7f0000008000-0x4)={&(0x7f0000000000/0x2000)=nil, 0x2000}) 2018/02/10 14:10:16 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$key(0xf, 0x3, 0x2) r1 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f000063a000)='/selinux/checkreqprot\x00', 0x48000, 0x0) ioctl$VHOST_SET_LOG_FD(r1, 0x4004af07, &(0x7f0000d50000)=0xffffffffffffffff) ioctl$int_in(r0, 0x5473, &(0x7f0000159000)=0x100000001) sendmsg$key(r0, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008ff000-0x10)={&(0x7f0000334000-0x78)={0x2, 0x3, 0x0, 0x9, 0xc, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, [@sadb_x_sa2={0x2, 0x13, 0x3}, @sadb_address={0x3, 0x6, 0x0, 0x0, 0x0, @in={0x2, 0xffffffffffffffff, @loopback=0x7f000001}}, @sadb_sa={0x2, 0x1}, @sadb_address={0x3, 0x5, 0x0, 0x0, 0x0, @in={0x2, 0xffffffffffffffff, @multicast1=0xe0000001}}]}, 0x60}, 0x1}, 0x0) ioctl$VHOST_GET_FEATURES(r1, 0x8008af00, &(0x7f0000812000)) writev(r1, &(0x7f0000058000)=[{&(0x7f0000fc1000+0x9e9)="6f3cfb9fbf53dcb9ea8f75e1fbf8053686e064411cbaa40989c942488a1f9576dfc3e83b5dedd6352841f363f621abf7d023641344a5adda18b419cbe1fa2d0c688a6d511d996a6a7a1726dc0f46f6ef94548e76b9b72ee74869093f694488d5dd260881bad8370922373421a9d93a94d95f5a1cc0285d9a8514a7a4ad0acef9d34db39e2e0cc0db602aa86549d8284c4238f9638a6fddc272982c12a9f5bcf10062996b8ab91ea2d8091089de6e2b8958d442b67556c8ae76b89f", 0xbb}, {&(0x7f00003f6000-0x4)="ee1ca7f0", 0x4}, {&(0x7f0000394000-0xcd)="37b4b9ebddcd097e214cf70f65dbdd499b711e1d66b725f7adca887f6457dd9cb38287791b00ad8209341e614e42e6f78750373df020557e1cab1b5003a0c5f4aba76028c49587aefb4f7314239707c7ee4ecf7ac657d2c3e4e5ebfcbd22b287e4c422e0a8a91eeeb56176d1672bc1f6b3128feb7bd0894c5fb701ee61a2c3a4b01f0c54f36938caaa160ff67d28b5954892c0304a134c43a404f4af0768d687f6e6badd84502d0cf2e5a309808e1a9b495f926aa8ee5b260ad6d49abbdd956b6f7aba68098d891c7ef3e240f9", 0xcd}, {&(0x7f00007f3000)="ae066b987f210185ac2614f51f7a08686a7fd213e602489495297e3663198e58b56c71606949ae3a4b91dae57a1ba4b145435805ca00dc752dc236ac68ba6c6361528d62e9f56548d37c4862d71bf250b9d423732726e9dd3b7c08a7162f6a", 0x5f}, {&(0x7f000021c000)="6ed1e3d103b614f795e5f21a386771f3bd1d2ba08120", 0x16}, {&(0x7f00004b2000)="71c6d730d93098d05ad0b5960c41160cc5cba8307449d3c3826882e109d149c3fda101c9c9", 0x25}, {&(0x7f000082e000)="b82a7e1860e2f8fe7b8600cba92d9c2e0b9ea189ed6c8f494f92298ba763019e6b5e24ae9a7e19a0948c3006e7ae8ebdf24ff2f51c6cc57dc5bfae1ae2280de4fce3853b47412fb6cfbb3300d3e5ee88b487be8f987ce244d65bab2387e86efa67d5f7a849b4bdb43c7c244fae0849efb6657e3aa850e58e73008dec1e0c6bcbca4a280f9eae68b710883288c7e4334ff23688ef491477fff8e187118bdc3ca0d5277f849007ae9b5bb518d1c7b8d7e0008ef158930df3b35240ae2c45c8c2e74c05e71542b8c297f1cf896c377f5a89a2421e34280bdb9f3c", 0xd9}, {&(0x7f0000ef0000-0x1000)="3fd62874c0b06120114e93e1affa7c90e0c0ac92dfa7b235292b82cd2722135c42e7bf5f7ebc53d03d19a1af4cd3786ddafb1c9f220569981fe91ed1051c76c47e9fced0934d314e9454dfd74024da1b772436732512fd6af9e0f7674f15ecd3aa4be0a4d7d7b93f4d6e27e4ad637c58fa7510beda394ed72cab86590893b8d5d4502b782c6faea5d1d5ae0e26553996dfeb221c6b3f3b09e408c889c0c854a2b850578cec7420632d69dfa00c80d2c215eb5ae4e6716f311810a66bae3c5f9b7eef2d87a1f86a037d818d81fe06056d1c3587387b45adf0b5b506f33539d34c65fdf4f5ae6c61fb7872866627b075da5eeb66826900a49a6d2e095139d31b71cbeb6488bd39d8da511ef842208e772314020cd4dc7a1cc48263dcf5caa55fc4645c080f69fb9a03eefe4ff5f54d0bf098bfef6676ad27177f562cb81e1db64970900f133407f883d0875a128f234717459e92477dfa73a3146b84b808d9f534ec2dbb42b43c1ec235a1106cb023d86f3b2c2de975219bb7e14f38f127fcdc2932b2a08fd63a1b47d5a8328724b1c15503dfefcd0219db3eee2067d799cdb93b354a4a46ca06bd55aa7995f890a777e260aaa0498109e1e6e1f3298dbbefa8dfa711cfdf202eb39fe7e7cbd96c82224e243376ec173a744c4853dd39a486ef7367830b7ee1c4f96ba4f1312b43e3421c3b1b63723056bc468aeb72135346bce0a528368e9208af0c527eb73bda01b74ec1be22ec78064e50da49007f54ab6ab4c3e92a8c586d81cb60dd19f5c7925e37a564eafa67fd088db6413ffd223b15ced8e4c4d67bb865eaaf7126b625559d11d313d32d485c13d3230cdde8ad3d0a87ed6e1353f7df1a84f1a84d34b2846ad5f598bf9bea667148eeb86f388ec37f1b57fb8baca6c9f2d8d083fe84c59f69b7244e52c29540d23b30f47938a39b763ff5d2b0821a34676f92cdf8a8fc74e9315f6bbd7058c770b635a1e1e40d7d7b212e414e78203b492e5409d7d7f13747a355b7cfa9186f05df4b6e40d46c2458f69f4faba25bc6e04521f662038ede1dce5f8aa077be1dcede746d7bf1f49786fb6d93a84fe750baeab06a8b7f932508d1cbff0c1c000139c81cf8ea6577399d363eef46c3e4e20acbd167cbff85591987e94b22a5d1055d378067d04f2e9bdfc335995a9966c9f980003da766ad971574b93e662ed72052d319b8c2608940c768fc389b9067203764f11b4ffd7724611e89fa42f0cd14a49ce8ce9e17d91249ce32fda8289684695f473dad64859ab417da47610159cee1722efd3b1ca17ce9da47346286ca8dc3a3c28a06085bebb2bcdd87192e7c8ed77bdb17860081f1a9d55e1bae71ac778aa658450e9108e6ecb74e5b2bc499bbf32a7d8dfaffd3ce607a56f547a6e333b6da887df665862d7a5bd68e1caebb3604cf6688cefbd148195218aad16a7d7b72795809650b996b7ae6a50edc2a59c8369bdddaf7466e3c05afe39bdf2d4bb3a121b0e8d256e89a88c169b4db5dfe592e521faea0708574cd810af5ca046acb710228b292143271b81adf980c8aef2310836c7350fbac6a78bb9cf0cdf937872ca451d0f39c61408f89261e241397b57011aef29aa3a9e2d92408b4879a5d4fdf047902c365aa384aee331df70f269f1220a1863acf9f9b688cfc9f1dddbabfb890e354b360723e8dbded1b62aae3de60e6afa073b3466572a02af1da110d9713c923284b3885ebc79e6e1db699d71ec0785ec77d9c55880143b2d907d28e8b94c3ad7c11bf9e3d8585c8a8b8dce6b66fe6cf01b59900fc6c6f2e871037e223a6979c5f31ca70ba7979bed51a2932ee32a71b39ee7389158ca827f486fd65a2f78ba4b5b1e97eb6df5b67b244f79c5093ec90f1bc3f7b4091271115573623de9f4f4881b22f4ea2422d0baa6c882138aae56fa4a486abb96c25ad87e7f3dbaa0dc0edf7f2e320b43b44baa90dcefa704f499d3c366bd6fe77cd786de209f5a180427979f120fcc369c3702a5958a0ba865f6b4a51f20189fb7f888eb65ed81f20125d48ece867b50f22cb63cef5fd0c92d148a5b43ca139a78af589acc9ca1b425201fe9eebd8a783fc9b6ce1a825b133fb98c140254bcebaf99c16464c1d417d07b60c2c033709a0db8a14db61a06ffec2c1e999b33c8817ccb92a2f8369aa593171d50a1184b3b84af748b58dc6b99e81ae235fb2bc1a8fd8946d47c6a1bd948aed29cbf65a75ccda0453b91fb958cc74189fb485b7df303650ae59282b532b1b698656426cf69c67b52ec4136c28ad06d8167d837768f55bd7dc15ea0393b202efd5b03df2269f12338ab240bc1245eb9be53e612026641edf99d658819b92ff316f931e055ebfe18253cae16324f4a0f11aea7795ca4474b83a2ec32412bdaf11fe5f8464b9a3db179419a681e8a28c86ae449952df70ac12995c057c29b1e4a23c42167d30c2cea91a9d437e3b2cf0459ca147cdb1cc8bb022073ef804b6adfd5b27ea5d95bdee1694266ceb30621f8df1dccc9e9f969c7ba8f1952059ffe117744a0bf2c94605e81bd51261ca9109d2e5895176f753e33bd159c324d983c2aafa5be49e83b8fef54a061fe46136f3516ac6207e5bb97fb40c2547ab4d1c7af12a5f53c33c64f9de098b40de9a39fa1d1f20573fd965caefc666a63612bf4a6509e1ed3df1e1b330f10648d8353bcd3cdd4839537ecec707b98817e3b39deaa14dcfbd18ff81ccd1239173a8158723f0eeae0f5f9685d1f6d989eec002743d21a34a381ad7f7501f25c250fccef72c54b5850b3dd1de5163fe88f4508fa990847991644e8e232b551f675775cc724f20d8a81814f5fe3a3b8c2393e5ff7ea66a36bc9e0a37743cb6097ba7f97f6422f84f4e28735914457cccf2ff8b0c43bf687ad94381aec162ff499eefa2b22b4887ccb1eb4499533b8f94e49f2da31c930870d062f8faf4ef4f1c7a7e7558d51b84ea20a7b3597d55143c9724606268ec007d6efd2a1e374493906dc5b6aa10dd648add9bdcda091d230d8cf4eb38ccaad02830a50bf8245c12a4532c60d5946e6dc4bc9d07cdc9762077b8a8066dc028f707d3a2ae1f59d21ac0d94270b028b68a55d3869c4835d27b2b4bbcc6d431f1a947311b05fbfe3affbaecf6166e084d549e26c2a10f32cf2c350fc6e4aed1e60104f37731dce312dc153f4407967b4576c2dab18bb2ad02c52c77e9f308cba4beb3f6ae76d3d6808d056d87b7d99f6fc054ae52684fab2d77e5cd9fbab62e752157d3b3e117352cd9957274e82e98c96dac132c22f15ad3fb5b4e1b185497cd85c9e22f1c0667fc552cd763db5a946130aab89d13c486a511575b73832b06d277acd57e3d704793e93aa98354c281f6dedc490c9dc0bbb2ed85268d1eb68b2752ae95cf6422e0f139f820edbf7d419e905979a69d5edb602e6c687805e3983e68c9a85a21c0cbbfc127969d093c611292bd2752fe689e0ede4007858f8d2a19e0eaa996c3004214db066c2a5700ce4f10ca9f71f56bc6ed0165612309d6b86d56358c64b383c263c1337de8fc1f7b0dc34a3d46f6ffa4eacc642d23f8a5811c924680f2b10c7f7e2656a01ffe7b2bbc936dc25645fca5cd5a17f42d892b16c0130a8dc829609fca523935c96eb1e2832ba6631084c069982b628ac30391bf1c42ff1162ba461cb0f362b2c4e78ba3b7a52de2f6241a41a38879bfbd635900ff98ed49c3d488013caf8cff54f2e74eff22c5d549d751b5c360db3a358f9882ea71b71fcbbb5e23bafc8b74c84049fe13f40399da69b85d6f861e984d91db104a0f60bc71a1914e2b7da9eaddd1dafe1c2989715bb49e15e0fb584bf7007229618f00bb527136ac319e4c05be2fa06b8ea4be858570cd1d652168fb576323ab9f77406faa691ac7d9925492c1f89e44263213d393317df9e3db79db8455bc47731597edec6650d2bfaba6a69ed3205b0b7265cc1c3be7dffaaa721367f3306cd504c489c8524337a588470d0a9b92786b5f39cc2ed75c2fcc0062ff19774098e4871f1e94ed68d345ad6ba692597fd736df1db19c156748e2dc6a4ba6ccb330626b9cdb59cafa9bcfa9f601779703c9c054463fb21280b578227c2cb90a215d6f57f578b7610c7d8f59d34f22632862ef9685e442bc16321e164aa68d1cd71684dcd633b6e1d1b4b39c5d8174a8263d40f4c7fdcf3627375f82d81c6d09d7ad75c9fe07aeccfb32fe1ba5dca0ba8269073ed90d58122ce899b6c4da2474bbc7bd3d3a8eeaa751bf575e4256bad4a5c23bf9f1e70d09457bf646facd97a591dcacf0db6ef554fd3cba0a7217e5c0b6ceda303deaeb55045eb1ffb22b362bfe3a3cf51bfb901c7dfcbb01169c6a67c27f7da0a3357f331831380ae96a17e15400cfa0eb9d80b199c0f0ff7e4afb39f34e5c2ec56614939153a0aadb8e9e37da9c697c5f1063a994e66e387c8a4a21f86fc3d02ef220556fc8f5e69d238aa3aec4dccbe10e6912b14b08b258459b6aeda48816ba05fd77caa5a9f1e49653b42345a4efa7e79f88d9c62581c80e8d18c08fbcb1bfcc57d122743d2d5c1be5cda825d62e3d8bd2583864e6ec822d0f5458d7cf3b9e48df0081bf92da55da6b383c6cdabf5da5c9b736e6e4252b8d1a6e73cebbc1d614f7a305c04575f790e796e5efd29bb563889e5771f99f30d89e72a4ad06356137229469dd381355691858ea185edaeb8f5b220236fcfd05705bd6968ddefa7ba16c5d3ae31d23fc6e008e1261f7bd0f4e9f9afbf2c38d9dab63b5257b33e3747ecffdab7d9b6adb02a0b8806663f31cb1cc646550fe46517961bf92e60ecf497c4b4b888f91e04ce37e7a8dce74885af744648c14503df4a8bf1d1c1923159810e6c5427e4b6ab172bddb03d12ca8344ef2654b1053149776efd28b5925c2a043fc07d0bca290cc6fdb404822fb588d1897526cf11d332ed3b2e896697a1d6df09d520db08662183b3730b1c72ec5b455a9ec7e1018652a773d949a2c025fa4a062dfea54fc2fcbb8aaf285f7ab92f48df6c958b85ca3f76c380dd426e49999849ab0d5b6f3d1bc9ee276201a77053d10031dc668f9ddeff6239ac2f25638e844a2870a9cedc1d729e5169e54ca19886648be1d91426079b642a5514e5ae8a51d57e415f138be5a3550f492d26c0e5169d3cc3a66870d82c1c356865a97a1de0706d1c21750b17288a45ffacedc2acbda98c9474390a77db74b40f90a6e18bdd92a5d96c51f39a70c89141eecb90eb318c28085337dc9b5adabb0295f00f10f48e284b8ecba2ea236adca6ff5d684d204ec90ee3ff51f1a1790d3b00cf32a4aae6d071a62d8bb57b97760ad73355c2cd6024f9d1662dfa8b3a624d53adde9cab1cd73912701fdfc7d2b61d93f1ba94643283ca510d5c53d59d06a8241a96a5f4c5e193e95e6b8bedc39e133aa5422256cdcd214bca376ffcbf33a4ef055154d1c1085dc59424eb75b2e60069cb2b4ddb2fbd86eefc1184ef29758e55a16a12d80094d7e62063af0614d289423ea0f4b2dbbaf550e916997f9a7f5a29808cd4573fd3caa727add779a19ae6fe535823039290808bf145522ce5f3bedd9c957cb3838d3ac65678d157d465ea2f1c87e665d7425505a52bce50ac1ae8f51cf2e8d83166efd219e59cc55652b178c531ca2dcac48d5b6330ca703f640b07ec420011e4f751f7f20410398911ea225944d218f13fa1b6b9fcd6317d6937ad089cd6c129b45cde9801451658ea9f601e31137bd171884e53b9973ec50b7bbfe01bced424af9f848a0", 0x1000}, {&(0x7f000098b000)="7e993682f69eca0b5cc8148c71c5d04aadc8c112c2beea839b1ebbb136fca5017cb50a6af6088e95f5bf6cc5f5efc98c09fc56543f91e52d6b1f8dd1f9e51d5090ec0a2e234a6106db05fda6286f214e79bd8394e5dd916649e04e077970c80f199e45dd4991c4a5a35069d39a34dba0c51d1dc7d2c134a4f681ec7e07e5fd90b7f252be14f65564efc5e04458", 0x8d}], 0x9) 2018/02/10 14:10:16 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r0, r0, &(0x7f0000049000), 0x3d2) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000008000)={&(0x7f000000f000-0xc)={0x10, 0x34000}, 0xc, &(0x7f0000220000)={&(0x7f00008d6000-0x14)={0x14, 0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, {}, []}, 0x14}, 0x1}, 0x0) r1 = userfaultfd(0x80800) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000ff8000-0x20)={{&(0x7f0000012000/0x2000)=nil, 0x2000}, 0x1}) bpf$MAP_CREATE(0x0, &(0x7f0000fb4000)={0x2, 0x8000000000000004, 0x400, 0x7fd, 0x4, 0xffffffffffffffff}, 0x2c) userfaultfd(0x800) clock_gettime(0x0, &(0x7f0000132000)={0x0, 0x0}) socketpair(0x1d, 0x800, 0x4, &(0x7f0000589000)) r4 = syz_open_dev$mouse(&(0x7f00006eb000)='/dev/input/mouse#\x00', 0xde6e, 0x1) timer_settime(0x0, 0x1, &(0x7f000097e000)={{0x0, r3}, {r2, r3+10000000}}, &(0x7f0000939000)) fanotify_init(0x25, 0x802) r5 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000ef2000-0x1d)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f00002d8000-0xc)={0x0, 0x0}, &(0x7f0000d76000-0x4)=0xc) syz_open_procfs(r6, &(0x7f0000013000)='ns/cgroup\x00') openat$ion(0xffffffffffffff9c, &(0x7f0000dd5000)='/dev/ion\x00', 0x800, 0x0) pipe2(&(0x7f000058c000), 0x4800) setsockopt$inet_IP_XFRM_POLICY(r4, 0x0, 0x11, &(0x7f0000e12000-0xe8)={{{@in6=@mcast1={0xff, 0x1, [], 0x1}, @in=@rand_addr, 0x2, 0xbd, 0x3, 0x20, 0xa, 0xa0, 0x80, 0xbf, 0x0, r7}, {0x0, 0x8, 0x0, 0x3, 0x6, 0x0, 0x8, 0x20}, {0x1719, 0x7fff, 0x7ff, 0x7ff}, 0x1, 0x7, 0x0, 0x1, 0x1, 0x3}, {{@in=@broadcast=0xffffffff, 0x1, 0x7f}, 0xa, @in=@empty, 0xffffffffffffffff, 0x3, 0x0, 0xffffffffffffffbc, 0x20, 0x6, 0x2}}, 0xe8) openat$selinux_policy(0xffffffffffffff9c, &(0x7f000010e000-0x10)='/selinux/policy\x00', 0x0, 0x0) setsockopt$netlink_NETLINK_TX_RING(r5, 0x10e, 0x7, &(0x7f0000ab4000-0x10)={0x6, 0x7, 0x52, 0xfffffffffffffffc}, 0x10) [ 74.677522] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=36 sclass=netlink_tcpdiag_socket pig=12351 comm=syz-executor1 [ 74.697422] binder: BINDER_SET_CONTEXT_MGR already set [ 74.708550] binder: 12352:12353 unknown command 0 [ 74.713828] binder: 12338:12344 ioctl 40046207 0 returned -16 [ 74.720640] binder: 12352:12353 ioctl c0306201 2000a000 returned -22 [ 74.727658] binder: 12338:12357 unknown command 0 [ 74.736797] binder: 12347:12354 unknown command 0 [ 74.739064] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=36 sclass=netlink_tcpdiag_socket pig=12360 comm=syz-executor1 [ 74.741938] binder_alloc: 12338: binder_alloc_buf, no vma [ 74.759596] binder: 12338:12348 transaction failed 29189/-3, size 56-8 line 2957 [ 74.768645] binder: 12347:12354 ioctl c0306201 2000a000 returned -22 [ 74.781383] binder: 12338:12357 ioctl c0306201 2000a000 returned -22 [ 74.814573] binder: undelivered TRANSACTION_ERROR: 29189 [ 74.820814] binder: release 12338:12348 transaction 386 out, still active [ 74.827839] binder: undelivered TRANSACTION_COMPLETE [ 74.833052] binder: send failed reply for transaction 386, target dead 2018/02/10 14:10:16 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$admmidi(&(0x7f00008e2000-0xe)='/dev/admmidi#\x00', 0x8, 0x60000) getsockopt$inet_sctp6_SCTP_STATUS(0xffffffffffffffff, 0x84, 0xe, &(0x7f0000dca000-0xb8)={0x0, 0x5, 0x0, 0x10000, 0x3c, 0x2, 0x5, 0x24000000, {0x0, @in={{0x2, 0x0, @dev={0xac, 0x14, 0x0, 0x12}}}, 0x101, 0x3, 0x1, 0x80000000}}, &(0x7f0000e27000-0x4)=0xb8) setsockopt$inet_sctp_SCTP_RTOINFO(r0, 0x84, 0x0, &(0x7f00002dd000)={r1, 0x800, 0x20, 0xfff}, 0x10) r2 = syz_open_dev$evdev(&(0x7f0000dda000-0x12)='/dev/input/event#\x00', 0x0, 0x0) ioctl$EVIOCGRAB(r2, 0x40044590, &(0x7f0000e95000-0x4)) ioctl$TIOCSBRK(0xffffffffffffffff, 0x40044591) clock_gettime(0x0, &(0x7f0000734000)={0x0, 0x0}) select(0x40, &(0x7f000051a000-0x40)={0x9, 0x0, 0xfffffffffffffffc, 0x9, 0x3, 0x7f, 0x8, 0x492}, &(0x7f00005f7000)={0x400, 0x4, 0x8, 0x6, 0x2, 0x0, 0xaa6b, 0x5}, &(0x7f000020c000-0x40)={0xffff, 0xbe, 0x7f, 0x6, 0x9, 0x8000, 0x6, 0x8}, &(0x7f00007b3000-0x8)={r3, r4/1000+10000}) request_key(&(0x7f0000102000)='big_key\x00', &(0x7f0000ad3000)={0x73, 0x79, 0x7a, 0x3}, &(0x7f00006cc000-0x40)='deflate\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', 0xffffffffffffffff) 2018/02/10 14:10:16 executing program 1: r0 = accept4$inet(0xffffffffffffffff, &(0x7f00009cb000-0x10)={0x0, 0xffffffffffffffff, @local}, &(0x7f0000323000)=0x10, 0x80000) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) getsockopt$inet_sctp6_SCTP_DELAYED_SACK(0xffffffffffffffff, 0x84, 0x10, &(0x7f0000001000-0xc)=@sack_info={0x0, 0x2, 0x5}, &(0x7f00001c8000)=0xc) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) getsockopt$inet_sctp_SCTP_RESET_STREAMS(r0, 0x84, 0x77, &(0x7f0000000000)={r1, 0x2ee1, 0x1, [0x7]}, &(0x7f0000001000-0x4)=0xa) ioctl$sock_SIOCGPGRP(0xffffffffffffff9c, 0x8904, &(0x7f0000082000)=0x0) r3 = getpgrp(r2) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r4 = syz_open_dev$usbmon(&(0x7f0000000000)='/dev/usbmon#\x00', 0x6, 0x20000) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000001000-0xc), &(0x7f000095d000-0x4)=0xc) getsockopt$inet6_opts(r4, 0x29, 0x39, &(0x7f0000000000)=""/224, &(0x7f0000001000-0x4)=0xe0) r5 = getpgrp(0x0) kcmp(r3, r5, 0x7, 0xffffffffffffffff, 0xffffffffffffffff) 2018/02/10 14:10:16 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x2, 0x78, 0xe2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12, 0x0, @thr={&(0x7f00007b8000), &(0x7f0000436000)}}, &(0x7f0000584000-0x4)) r1 = socket$kcm(0x29, 0x2, 0x0) r2 = socket$inet_icmp(0x2, 0x2, 0x1) getsockopt$inet_IP_IPSEC_POLICY(r2, 0x0, 0x10, &(0x7f0000760000)={{{@in=@remote, @in=@local}}, {{@in6=@empty}, 0x0, @in=@rand_addr}}, &(0x7f000002b000)=0xfffffffffffffeb5) recvmmsg(r1, &(0x7f0000108000)=[{{&(0x7f000075c000)=@ax25, 0x10, &(0x7f00002d3000+0x491)=[], 0x0, &(0x7f0000a38000)=""/221, 0xdd}}], 0x1, 0x0, &(0x7f0000f16000-0x10)={0x77359400}) clock_gettime(0x2, &(0x7f00003bf000)) sendto(r1, &(0x7f0000196000)='8', 0x1, 0x0, &(0x7f0000d2d000-0x58)=@alg={0x26, 'rng\x00', 0x0, 0x0, 'stdrng\x00'}, 0x58) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x0, 0x32, 0xffffffffffffffff, 0x0) tkill(r0, 0x15) r3 = syz_open_dev$mouse(&(0x7f00003d8000)='/dev/input/mouse#\x00', 0xeb, 0x40) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000e29000-0xe8)={{{@in6=@ipv4={[], [], @broadcast}, @in=@loopback, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@dev}, 0x0, @in=@broadcast}}, &(0x7f0000d1f000-0x4)=0xe8) ioctl$sock_inet6_SIOCDIFADDR(r3, 0x8936, &(0x7f000042f000-0x18)={@remote={0xfe, 0x80, [], 0x0, 0xbb}, 0x1000, r4}) 2018/02/10 14:10:16 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000b36000-0x11)='/dev/qat_adf_ctl\x00', 0x8800, 0x0) getsockopt$inet_sctp_SCTP_DEFAULT_PRINFO(0xffffffffffffff9c, 0x84, 0x72, &(0x7f0000f31000-0xc)={0x0, 0xffff}, &(0x7f0000500000)=0xc) setsockopt$inet_sctp6_SCTP_MAX_BURST(r0, 0x84, 0x14, &(0x7f0000456000-0x8)=@assoc_value={r1, 0x2}, 0x8) r2 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f000000a000)={0x34e, 0x0, &(0x7f00001e5000-0x8)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000006000-0x54)}) clock_gettime(0x0, &(0x7f0000e45000)={0x0, 0x0}) ppoll(&(0x7f00005bf000-0x30)=[{r2, 0x4}, {r2, 0x410}, {0xffffffffffffffff, 0x2004}, {0xffffffffffffffff, 0x1f}, {r2, 0x80}, {r2, 0xa0}], 0x6, &(0x7f0000db7000-0x8)={r3, r4+10000000}, &(0x7f0000bf9000-0x8)={0xffffffffffffff7f}, 0x8) 2018/02/10 14:10:16 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f000085f000-0x10)='/selinux/policy\x00', 0x0, 0x0) mq_getsetattr(r0, &(0x7f000025d000)={0x2, 0x8, 0x4, 0x0, 0x3, 0x401, 0x7, 0x3}, &(0x7f0000931000-0x20)) r1 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xff0000)=nil, 0xff0000, 0x3, 0x32, 0xffffffffffffffff, 0x0) setns(r0, 0xc000000) r2 = socket$key(0xf, 0x3, 0x2) r3 = socket$inet6(0xa, 0x3, 0x1) setsockopt$inet6_IPV6_XFRM_POLICY(r3, 0x29, 0x23, &(0x7f0000f92000-0xe8)={{{@in=@multicast2=0xe0000002, @in=@local={0xac, 0x14, 0xffffffffffffffff, 0xaa}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x2}, {}, {}, 0x0, 0xffffffffffffffff, 0x1}, {{@in6=@mcast1={0xff, 0x1, [], 0x1}, 0xffffffffffffffff, 0x6c}, 0x0, @in=@empty}}, 0xe8) connect$inet6(r3, &(0x7f0000f92000)={0xa, 0xffffffffffffffff, 0x0, @ipv4={[], [0xff, 0xff], @loopback=0x7f000001}}, 0x1c) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000a000)={0x34e, 0x0, &(0x7f00001e5000-0x8)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000006000-0x54)}) setitimer(0x1, &(0x7f0000775000)={{0x77359400}}, &(0x7f0000e0d000-0x10)) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000008000-0x30)={0x0, 0x0, &(0x7f0000d06000)=[], 0x0, 0x0, &(0x7f0000176000-0x1)}) ioctl$EVIOCGVERSION(r0, 0x80044501, &(0x7f0000446000-0xe5)=""/229) ioctl$sock_SIOCETHTOOL(r2, 0x8946, &(0x7f00009e1000)={@common='bridge0\x00', &(0x7f0000b38000-0x20)=@ethtool_rxfh_indir={0x39, 0x6, [0x800, 0xfffffffffffffc00, 0x7, 0xff, 0x10000, 0x3]}}) stat(&(0x7f00008cb000)='./file0\x00', &(0x7f000057e000-0x44)={0x0, 0x0, 0x0, 0x0, 0x0}) setuid(r4) 2018/02/10 14:10:16 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r0, r0, &(0x7f0000049000), 0x3d2) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000008000)={&(0x7f000000f000-0xc)={0x10, 0x34000}, 0xc, &(0x7f0000220000)={&(0x7f00008d6000-0x14)={0x14, 0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, {}, []}, 0x14}, 0x1}, 0x0) r1 = userfaultfd(0x80800) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000ff8000-0x20)={{&(0x7f0000012000/0x2000)=nil, 0x2000}, 0x1}) bpf$MAP_CREATE(0x0, &(0x7f0000fb4000)={0x2, 0x8000000000000004, 0x400, 0x7fd, 0x4, 0xffffffffffffffff}, 0x2c) userfaultfd(0x800) clock_gettime(0x0, &(0x7f0000132000)={0x0, 0x0}) socketpair(0x1d, 0x800, 0x4, &(0x7f0000589000)) r4 = syz_open_dev$mouse(&(0x7f00006eb000)='/dev/input/mouse#\x00', 0xde6e, 0x1) timer_settime(0x0, 0x1, &(0x7f000097e000)={{0x0, r3}, {r2, r3+10000000}}, &(0x7f0000939000)) fanotify_init(0x25, 0x802) r5 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000ef2000-0x1d)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f00002d8000-0xc)={0x0, 0x0}, &(0x7f0000d76000-0x4)=0xc) syz_open_procfs(r6, &(0x7f0000013000)='ns/cgroup\x00') openat$ion(0xffffffffffffff9c, &(0x7f0000dd5000)='/dev/ion\x00', 0x800, 0x0) pipe2(&(0x7f000058c000), 0x4800) setsockopt$inet_IP_XFRM_POLICY(r4, 0x0, 0x11, &(0x7f0000e12000-0xe8)={{{@in6=@mcast1={0xff, 0x1, [], 0x1}, @in=@rand_addr, 0x2, 0xbd, 0x3, 0x20, 0xa, 0xa0, 0x80, 0xbf, 0x0, r7}, {0x0, 0x8, 0x0, 0x3, 0x6, 0x0, 0x8, 0x20}, {0x1719, 0x7fff, 0x7ff, 0x7ff}, 0x1, 0x7, 0x0, 0x1, 0x1, 0x3}, {{@in=@broadcast=0xffffffff, 0x1, 0x7f}, 0xa, @in=@empty, 0xffffffffffffffff, 0x3, 0x0, 0xffffffffffffffbc, 0x20, 0x6, 0x2}}, 0xe8) openat$selinux_policy(0xffffffffffffff9c, &(0x7f000010e000-0x10)='/selinux/policy\x00', 0x0, 0x0) setsockopt$netlink_NETLINK_TX_RING(r5, 0x10e, 0x7, &(0x7f0000ab4000-0x10)={0x6, 0x7, 0x52, 0xfffffffffffffffc}, 0x10) 2018/02/10 14:10:16 executing program 4: mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$midi(&(0x7f0000000000)='/dev/midi#\x00', 0x9, 0x101200) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) recvmsg$netrom(r0, &(0x7f0000001000-0x1c)={&(0x7f0000be4000-0x48)=@full={{0x3, {"f8e6bb89db4a11"}, 0x1}, [{"f6ca82f770874d"}, {"328af6dd7df9fc"}, {"67597068ef6f9b"}, {"e56141f2c6a663"}, {"4c7cc46168bbc9"}, {"748971b62de207"}, {"f6b8a809a071e5"}, {"34562753143c5f"}]}, 0x48, &(0x7f0000000000)=[{&(0x7f0000000000)="34c26b251a90af5b72ef8f3ace1955c081458b22277f2a02205919c37af6c0ed34b8de3b55032e31c8f5ba6f06ecbbadfa99bf7a61062b2f", 0x38}, {&(0x7f0000001000-0xcf)="d04f3c0c1cc36b6a16d6b9173dbb66238c0bf4da85e627a6846cfde70fbc2e584775de5aa815f507121eada460ce09ee63f458d9f511d30dcee25316c175e9e4cfff2cac482aa9687d270d9f5e98c6ba8debab4e6f415e0d9c7485f0d588c11ecfa359443fbea6c9b8828b2071826da9c484a3e9858dafb6c3b0110db621b2b35684c06dddc9566707f8b57097106fd426d523c7ef82cd9a5050883462252b61423ee715500e074d11b637d2547216c389a7a4b384f02e61b46c717a46cc1400f38f4689d935534149c026057db58b", 0xcf}, {&(0x7f0000acc000-0xff)="423fc9f013635a1f78f1b03546011092eb8513736de16d2f448e1cbc9fce53ffad3cd275d7dd41eac2d5005cd02dce14fd420576e430cda1f86e4ba7f880290331c385eed5b3a51ccbb2c1e47ab72f05c9ff69d8d2335b603681de5d9075aed354d290721dd58dee3229bfe5870585ecbf18ca6670b57308ea06071db0533aace857ab30f9af903252cb4d142ffb4c3be44889df59a578ae42af2154b32d080354fe53b9ad7f2470de9ba031d5af27bcd4b5212ebe6fdf3f2e03da22b26f69cda62067b6463a2615e2942277e8ee01fb450cf94e2418e4280aef9949d74956ec970d72d47f9f369283d87397bc6f632d8fcf0278f5e81f9575ecaf0aca7687", 0xff}, {&(0x7f0000001000-0x61)="7c4b1de3fbaf8853eae41458b3a8b960ae5d242e5d52f2280ca774addbbe5ff03243d5eb0da255cc1458c5b6db1ed9ed70ef38a26bdea1ceb5dd63b832982dcaf96d2c764cb91bc58ab85dc69ce99f7f850e170c5bed8ffdd077b04b54219157fc", 0x61}, {&(0x7f0000b35000)="58535163e28c330ee5754b0656e3ec99c6d143b27f867f932c6c9be51ac53fd6d76ced60567053c2c207b3c6ceedb9efda1f23d5d2210cee0d4c578d876a710869ca9287b019490665d85b23853fe78a04252e891dcda7c2ef111285a1b517e7aa21df1cb1f84f89e5de53da85ada84eaf63943c713da41995c3a909bab1cc0d69ec308e96ab3ed62b560abfa715f081371c6059e9bb3e86c52907f5d6b627a0068f8be36580678e963916ede22e52cfd55d76b1d497264df809e9e3c04959be94311021f883b428d0162704974702d12bfd71c7dcb6e43dd3465feb3504b76bd130143fb7980c73e2edf0feeae201ef0da97389fb9c8f8dfd03daa48609bd9133910e6262365ec88f73c52c7a0ad70ce427a650111f5ea8e5c2b736c92ce34969f49f57b0c18bf5775d393dde8910e7cf5796f0911af5429875accf9280af9d6a914f299fd18be5c041a7b8c30948ce99de7866dc83a9bb233a664955afffcd1109aa1b4835970e33a5841a6fa8bc3498fe5c8c0409a48083946f852d50fbbc7eaaafd021bac783733b3b574b6ad220c196f534e294fef883aa7b7a9e43b52157e6441c2d9edd6d4434094623d9914a5375f8598a85e71ed4d05f2bcf7750c9b8c35f72f6e190747210ee12eeafe3a396de87fcb905f589a76f4dba886fba998e9b609e57acb85c32bc65f46122b4c23648b8cb50de274cd45e380ee1e5918943f78e87e2ae4449edab60fed3e45bafb94038830f3ef4beb9c1b69a1788ac2cd9f87f6c07ed3e379656b1f0d8340b84171fd20310e25ab9bf71ca65b32a432cad5910f3b72e0495c11d84c3dcee6e3f9b3a090074f3f31d3dbd772373134da122ea425bf20f918e316f41bd2c4248c69e54bc2aa1c7c9c47acf8a9fe0af7e94a1855eb2fc57cb6688365b3d73e640d6dca18082f22da9d4d0cbc9c3c2bd723beb541ea64d2c9b63d0dece00ba85cdba47866f61ead561cc7e56baaafc3ac13c6c3291aa51da0ecdfc28aae5d977c6002c4c00d1b09afa26381c19a8c3babd4c90c66c1ea8f8db20e0b12ef5cf79f1f1b6eef4495a96327e8639b13cab88c2bb51c12c1d4bb76dbd86eb4b1b3c33b567e7baa8631e08fc3d53d68f21482da3f0e0c9623006c467c4d4e0c64de2195ad7294ac05c22eb2a127df642e7f4909fddb52b5e8a9c1c563ca7b06fb548b51950d620e30b8f47bb01999bc10bcc997fa2d0aa9d6c36d3bc839002e9f12d4a1f32c8c93b537b50b87751e8a50ae9108bb2ba3eac6ceb2dbd4021b30d6828f1964deb3776efccf29963dc3406edbe2284aa672bcb1f537e13691677838dcc0b8c0b1a64bafa29f7e7be9e372823afb953dfc4f2a1b79781e3947203712952b86f5a3ac8be96b3f65b92616cadd735d43444abdc1d218b771e6e627373651396db7fe286fa4fb2a6f15fcb5b2ccc38859b48d8fa0b22e7370377b28f80d5163dd215314a1ab6a233d5418de5171b938dfd6d2b472c9f44af7d6e4d41e97dd02bd039ce68c61c36fb4d0f34229a4fbd9cb3e87389e91808da485dcee3eba309a952d6256df7af69c3692b9bdfbe519bd93f5d4864a7c5bad490a8adfa9a95ef284838e2092dadaa2a917544479c017ada76f92a48354240b9884fce03d97e3ef595a2d18d41bc4f45e77cb2ec19c1936b1e43a7fc2a2e1ed0885b8060f8e2dc2c621fe5712b3f13479b50278d9bf7a01aacaff65cbfad0abb86192de0f45465f77ff133801c437f60465d64fda252d9d04d11df987abbed7e5ce3c8bca921be76aa11e62c5e0f4f354cee392c37362385d1c7d3012c487b4d0ac23e995be752063fe2ce485cf5f7480482ce6d397c0fd7793f47c3f46c91b100d26938caf0925a8d29b92b18dd393fd6b58a67eaac388e7760ff3b866f14111c2ec163176ac8ae8e69d768d343ae3b58ce97801f972ccb65a398518a4266d680ef16e7fbfb8550412717f0c8c6ceb611e37f3c1be2c292182902443a347211ef66560b947e1ad5b2a043eba4572e6bcc064511eacd0eded24ace3017ddd9a5828e2d22a16177adbcf4648b08ba75d9d121f6426bc57b5bce32ca82dd6213d0ca2c52107fc941c04c757832b03afdc332d702d2ebde65f1a93a30e0ed07713ca168117166ca436f1e3948568846ad87e23918ceaa68444220123cb14cb28d629e6266bcb90341b091eb2b8efc5640630ca9f966bd0aa1a6e504d47000f377dadd768540978b357f31b4070659a762ed43613e171000c5c69f3905d74ca45457ad3929fecdfd43140d5ae7fa8a39150571e789ee304fef64f66764e38abb7ab2b30b5d175536d4ffe096eeb2082d753c170ed52d028f8982bd6c6e448f0c764b255f2568baeb0e92cbe792c9607030bf212488f15b521bcebd252a2d03ad3276c89be930b4f37760b5f7b8c5df80a142d01e6eec733d3bb60a04590b50c28f06827e1b91d75bedc493b13cf730878da5460f73ef11f9a3b8b977bdae75f1f4861201dadb512ad3fa937bc7719c3c4d58b953542b32f93661b3c6357385a61635e2639910b18695a661058368f160fa29b3c5ef02b35a1ded5f8748eb3b0611c67c3989eeba230220981985f1b47f54bd3841742792705c8390114c81c14726bfd00b1ee838ce776fd7856564e69cd9a046e6656034f08314dbe15b1343058720c7af81e5d583562f47c5afc0d882047e3481799794650d4e3e2859e21f99de750e8147a01d95e916ac77988721c94c4c01afc70f15f37986f3ca22193875824ceee287a05b2400aa37958dfd70b1e98a445f1b09c8e1bedc044d48420746562132e6066ae7f88d7ddd22f521d21f79a1ea01bb367399ed06ee96f5762ca2997d0b9c1b086e2cce5558fd626205a35dc08c5812c4a95f08a54561abde4f76e1d0e7e675f68da9a6f25517513e2efa7fe857d9a505d52de164d92c8860cb0430c45505d66eccf51a6a63d7baf92639ca449d7e0c74cd2014ac5bc8f972f826bbf6264ab2daf2d5e07bbcd968d5c86fce09f8e8dac8517c1097821437b11674fe7802aca31f6476a01400066f586a836994c9c1153ef076293b341b35afb4505de1f5bac11023cae43f02452fb38a828722d64d9857a0e25b8850b14ee42b7621f9862aae940d580787e0dac5ac534e7af33477d0b7ef4b88f6119c7818b9eb639c96a27771409ce09f73f200506f7d826e2f071408f9717b4be94c67842e486a9e000f6a7522812cb8ed815f56e65c62baa1948d765a8afa8c7b832a66103719255b7689c7b720c0be9dfd278b5ff0b9b2ef55d2e933c860b1f7af23a201bd000267726a7d60c3f275151524b8e858aa76d4c8f5e86870add3e120852fea1ac0dc4678595d9ea01aa727223a96af467f74497a75e5d428369442f14ced7bdfa5b16c92f98c4fe623729d057d2811109db13ef2af57798264ff9c48f1ab5e7c49e5cd52afd061f297c154b90cea2e090e952369e153807f4d75514fc7f1fab142572ef535d1261752330eb5163581051667e0ec8be385916de2683cee08b2da6f42a2b55da53a457acfbcc05c519abd6a981e0f390cd74deb1fc8cdd51fea4ef291f076a8329de38727c381d3884e7a956b4ec81f80699c081f83109a98cb68a8509d2934e99a5a34322208819b18f9c25e85778051a876fdc50be53f2fd1b612eb99f5bfbae1c0463ed3ecd0f5c17a5fea0322a9de174ec9e00c0b8c505a82d5b613efd1641537c606d044838bd247db4d34583c02bda7465f09d201890c9117665bbf71028f7b1b8cab93307be8fbc7fc8b1298ceb9314afd9e2666482d42d5f2b715617b4c93ecc7d7564217e428c1e664dac77cf0759ef2894d2c0510eaff34dfd644d42961fb0a4eba248f61c9ba3a4008be864e36afd44845672da97f7d1914830bef5926a56de8d894588c1b6f3803b7f44d1c6481aeebf26f11a1f79e5f52df1f5cd7bc8ded65f78060a27170c9de89ce4815f96cd8d91266feff6f741b96fd5d2cd97023e8fa49bdede7465bddc86de02434235146ce9a203a867c965900fce8c0ee891670b80b36afac542442f3adfdb82b5d0c2f8a3a71ff3e2c1960fa6e98cb604307b7616c6173acbc3d764aa1662bee0fc44189fbaa93c3eb6d37c3bd20f4237d65e35c315e607ac54306bb2ea9a4cbef2c123bcf363139e9fd2e6ff68ff992aca76013c3de4fa0d7b8a9bbadfdcaebfa67cde75d862d32a405075ebd38651d0a1dc515c3e3db4c905f49ae55bb18fd5ff53dfc9ba89f6e067b26cd39950d6d72a94ddac66e793e4631bc0bc3db8571bd2542b6da84f3d4d5013c8bb387553fb325d568f8dc9e1aaf8cc2c93433a0dc2531df3c2ce97b12e4c99ebe145af460672d7a8def47e70416d7540721e0e2be47528c25e8516fc85688fe9325131b6aaff20d072becbaf7f014b4683909c00ed9a8de3d8d2b21fd9ee515b99bdf9b9cb384cfb15dc3bf7ad398682819ef016768638ac8fc042cdb540ddb9f7f8a01862342e64a0b96c28c854af2ae440fc96b204270c99c602f178cb1dcfb7be98b65112d00fe0cc5f8ac98d4015018d4a6475c8cb36b9f1339d2768ecc998c111202b10138116ae958750df13a609bc0f50c646a2798164df06d64f6ba0920574a9318eca1d12c16919b3603063965084e3fb86f4873410f9cbb1339e9d16d3e28185e84fd99f8f2691c95bc6517522f77cbdea6af2394feed8819e36c980d085c02d72f7f9960bc4a44cc1e0aa77c9ba92b103c75bff51cf167822febd81211390864b43b65ba40de8b378e8cb587722f80eb5ede00763c8db2965067938896e07c9cc60ed6beeecd936d68c49e87e4f494088c5de1185cc32eefee2e658546c9718a515dd385e9ec723732d54880a4bf24d86a11816a451c3e23de4aef9705fd528191fa7b004b0c843bcea48af93314e87141b73b6f0c0324c5f8ce70e9e334ea4e14ee1fcc12bff610ecd96d00b80022c6f28a33bcfeac44e244b5f88090e3737248c658f677c8b5b06ab2e8b2c42239c02b2870085d4f7a996572fcc85f9bfae618820b5291b07374bdf496cf372922802c6c5b1f26250e229d1b234fb84d82e8a3bb7307704b7de76292c2532605bcf7152b1b41002b50c0f3ec443c8a081bd45d173c2e6e5a37993e3baeb39883f72ea66b16e9ae15b38d741a3f3cddb2e3a5c1c6d6dc14573d3f58199bc6297205ad7b033abf3900b15c0b26d9f97c455cc2821a4c290060d90643f65045670410c317774625f5b242fb35c6fa5c9c0e6e17e6713c6d253d0d53d74783f85714d6fb60cf88a72148ab6a5088406994d0c86c41f315ff2f86d6bc2e21e85fea4b9d4dd9dceb24f9ee1403eb8c58f8013f2465ad3c96c97e8b328ed5f3fa0749fb03b5e21163b8268e54678d662dd13d293467c02a35350009e84f9bb68ad06fa6f7879983221e8c642602405781a8e239da23b83dd744789b32005cfdb7e344c4b1ec0f3cd1c1f7ddaf74a26bb2199eb91ea899e65731d29c6254c62c524d8bc9c18b1dd1594bca2a6e708210a8eddcb0e17b2b40640852cbab6ff28b6c6fb4a8908955e45bd5ca9d7020abf127a4232c49352d1564f7097ecdd067b2a374a2a7569938420f691a68e308f11c09617f7068c4ff7c31870381e9d188eb4d6d8c1cfaccf5e6e779fbd7d45dbb6ad019d9d3b09d09368d7774b4b5132eee0f255e29d854c9220b71c25e76c5eb94a62e285bd5eeabad61d5106c2646d9340dfdb726188e762fa7dbe6bdae10d8c48a00049c7c95b05e12aec4aaca230c175f61e6259b751ffc9a41", 0x1000}, {&(0x7f0000001000-0x1e)="0b9f6e0559f50b76b95035dd827413dbae5739a80400cdaeecfad5f0bc7d", 0x1e}, {&(0x7f0000000000)="c6b836f9b368324989ad8e19278b1e773cd87949d109eeb5814d36c7c6c2f5b1e885b0d90e2824ebfb3e9e2b6519dfdf16ff310de8875f8a2d60ed488b15db25bd36913344c8ec", 0x47}, {&(0x7f0000abd000)="d3b36d444daadf235e60485765225a3ec1bcabee2e7dbe7cb3b074717ec452012143a0d0a1e5769e0f301565e09cb70e5debc8282b1f6fc2bc93ccc3fcd138162d765631fa8cdf812ca044f5c6782511c13a08e88b6abbec5b6e164b0bd29b64b9bc3cda0e33391fed65f1d3568752675c0dd490a90c253dfeffb39dcd19f31185585cbd", 0x84}], 0x8, 0x0, 0x0, 0x4080}, 0x40000000) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) userfaultfd(0x800) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000a000)={0x34e, 0x0, &(0x7f00001e5000-0x8)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000006000-0x54)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000-0x30)={0x44, 0x0, &(0x7f0000d06000)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x38, 0x8, &(0x7f000000d000)=[@fda={0x66646185}, @flat={0x73682a85}], &(0x7f0000006000)=[0x20]}}], 0x0, 0x0, &(0x7f0000176000-0x1)}) 2018/02/10 14:10:16 executing program 5: mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$DRM_IOCTL_RES_CTX(r0, 0xc0086426, &(0x7f0000002000-0x8)={0x2000000000000152, &(0x7f0000000000)=[{0x0}]}) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$DRM_IOCTL_SET_SAREA_CTX(r0, 0x4008641c, &(0x7f0000001000-0x8)={r1, &(0x7f0000517000-0x1000)=""/4096}) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000a5000-0x8)) mmap(&(0x7f0000000000/0x19000)=nil, 0x19000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r2 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000924000-0xc)='/dev/rfkill\x00', 0x0, 0x0) r3 = userfaultfd(0x0) ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f0000e54000-0x18)={0xaa}) ioctl$UFFDIO_REGISTER(r3, 0xc020aa00, &(0x7f0000008000-0x20)={{&(0x7f0000000000/0x4000)=nil, 0x4000}, 0x1}) readv(r2, &(0x7f00001f3000-0x10)=[{&(0x7f0000002000-0x4e)=""/1, 0x1}], 0x1) ioctl$RNDADDTOENTCNT(r2, 0x40045201, &(0x7f0000b27000)) ioctl$RNDADDTOENTCNT(r2, 0x40045201, &(0x7f0000a81000)) ioctl$UFFDIO_UNREGISTER(r3, 0xc020aa04, &(0x7f0000008000-0x4)={&(0x7f0000000000/0x2000)=nil, 0x2000}) [ 74.908705] binder: 12374:12380 Acquire 1 refcount change on invalid ref 0 ret -22 [ 74.909737] binder: 12377:12378 unknown command 0 [ 74.916513] binder: 12374:12380 unknown command 0 [ 74.920342] binder: 12374:12380 ioctl c0306201 2000a000 returned -22 [ 74.940385] binder: 12377:12378 ioctl c0306201 2000a000 returned -22 [ 74.952463] binder: 12375:12383 unknown command 0 2018/02/10 14:10:17 executing program 1: mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f0000000000)=0x0) r1 = syz_open_dev$dmmidi(&(0x7f0000611000)='/dev/dmmidi#\x00', 0xf0, 0x640) perf_event_open(&(0x7f0000927000)={0x3, 0x78, 0x8a, 0x21, 0x5, 0xffffffff, 0x0, 0x9, 0x8000, 0x2, 0x5, 0x2ba, 0x0, 0x4, 0x2, 0x5, 0x0, 0x4, 0x2, 0x0, 0xff, 0x5, 0x0, 0x3ff, 0x725, 0x7ff, 0x6, 0x3f, 0x6, 0x1, 0x6, 0x3, 0x0, 0x20, 0x4, 0x8, 0xfffffffffffffebf, 0xe238, 0x0, 0x6, 0x5, @perf_bp={&(0x7f0000001000-0x1), 0x1}, 0x4804, 0x8, 0x3, 0x5, 0x3, 0x3ff, 0x1ff}, r0, 0x1f, r1, 0x8) mmap(&(0x7f0000000000/0x5000)=nil, 0x5000, 0x3, 0x32, 0xffffffffffffffff, 0x0) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, &(0x7f0000004000)=@mangle={'mangle\x00', 0x1f, 0x6, 0x438, 0xdc, 0x29c, 0xdc, 0x29c, 0x358, 0x430, 0x430, 0x430, 0x430, 0x430, 0x6, &(0x7f0000000000), {[{{@uncond, 0x0, 0x70, 0x94, 0x0, {}, []}, @ECN={0x24, 'ECN\x00'}}, {{@ip={@rand_addr=0x4, @multicast1=0xe0000001, 0x0, 0x0, @syzn={0x73, 0x79, 0x7a}, @syzn={0x73, 0x79, 0x7a}, {}, {}, 0x0, 0x3}, 0x0, 0xd0, 0x12c, 0x0, {}, [@inet=@rpfilter={0x24, 'rpfilter\x00'}, @common=@unspec=@connlimit={0x3c, 'connlimit\x00', 0x0, {[0x0, 0x0, 0xff, 0xff000000], 0xfffffffffffffffd}}]}, @common=@CLUSTERIP={0x5c, 'CLUSTERIP\x00', 0x0, {0x0, @link_local={0x1, 0x80, 0xc2}, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x33, 0x0, 0x26, 0x0, 0x1, 0x0, 0x0, 0x0, 0x20, 0x1f]}}}, {{@uncond, 0x0, 0x70, 0x94, 0x0, {}, []}, @ECN={0x24, 'ECN\x00', 0x0, {0x1}}}, {{@uncond, 0x0, 0x94, 0xbc, 0x0, {}, [@inet=@rpfilter={0x24, 'rpfilter\x00'}]}, @common=@unspec=@NFQUEUE3={0x28, 'NFQUEUE\x00', 0x3, {0x7}}}, {{@uncond, 0x0, 0x70, 0x94, 0x0, {}, []}, @ECN={0x24, 'ECN\x00'}}], {{[], 0x0, 0x70, 0x94}, {0x24, '\x00', 0x0, 0xfffffffffffffffe}}}}, 0x494) 2018/02/10 14:10:17 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000b36000-0x11)='/dev/qat_adf_ctl\x00', 0x8800, 0x0) getsockopt$inet_sctp_SCTP_DEFAULT_PRINFO(0xffffffffffffff9c, 0x84, 0x72, &(0x7f0000f31000-0xc)={0x0, 0xffff}, &(0x7f0000500000)=0xc) setsockopt$inet_sctp6_SCTP_MAX_BURST(r0, 0x84, 0x14, &(0x7f0000456000-0x8)=@assoc_value={r1, 0x2}, 0x8) r2 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$mice(&(0x7f00007ae000-0x10)='/dev/input/mice\x00', 0x0, 0x80) clock_gettime(0x0, &(0x7f0000e45000)={0x0, 0x0}) ppoll(&(0x7f00005bf000-0x30)=[{r2, 0x4}, {r2, 0x410}, {r3, 0x2004}, {r3, 0x1f}, {r2, 0x80}, {r2, 0xa0}], 0x6, &(0x7f0000db7000-0x8)={r4, r5+10000000}, &(0x7f0000bf9000-0x8)={0xffffffffffffff7f}, 0x8) [ 74.958875] binder: 12375:12383 ioctl c0306201 2000a000 returned -22 [ 74.993051] binder: 12375:12387 unknown command 0 [ 74.996229] binder_alloc: binder_alloc_mmap_handler: 12377 20000000-20002000 already mapped failed -16 2018/02/10 14:10:17 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mkdir(&(0x7f00002a7000)='./file0\x00', 0x0) pipe(&(0x7f00000e2000)={0x0, 0x0}) getsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(0xffffffffffffffff, 0x84, 0x1f, &(0x7f00006ab000-0x98)={0x0, @in={{0x2, 0x3, @multicast1=0xe0000001}}, 0x6, 0xffffffffffff3256}, &(0x7f00009ba000-0x4)=0x98) getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(0xffffffffffffff9c, 0x84, 0xf, &(0x7f0000682000-0xa0)={0x0, @in6={{0xa, 0x2, 0x3f, @mcast2={0xff, 0x2, [], 0x1}, 0x4}}, 0x81, 0xffffffff, 0x401, 0x8, 0x800}, &(0x7f000043e000)=0xa0) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f00001be000)={0x0, 0x80000000, 0x100000001}, &(0x7f0000417000)=0x8) getsockopt$inet_sctp_SCTP_STATUS(0xffffffffffffff9c, 0x84, 0xe, &(0x7f0000d9e000)={0x0, 0x0, 0x5, 0x2, 0x8, 0x81, 0x0, 0x7fffffff, {0x0, @in={{0x2, 0x1, @rand_addr=0x4}}, 0x0, 0x0, 0x5827, 0xffff, 0x61}}, &(0x7f0000613000-0x4)=0xb8) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f00002ab000)={0x4, 0xfffffffffffeffff, 0x201, 0x341f, 0x99000, 0x5, 0x401, 0x6, 0x0}, &(0x7f000004c000)=0x20) getsockopt$inet_sctp6_SCTP_PR_SUPPORTED(0xffffffffffffffff, 0x84, 0x71, &(0x7f00000ef000)={0x0}, &(0x7f0000415000-0x4)=0x8) getsockopt$inet_sctp_SCTP_STATUS(0xffffffffffffffff, 0x84, 0xe, &(0x7f00004c4000)={0x0, 0x8001, 0x81, 0x29c0b5ac, 0xff, 0x3, 0x8, 0x1, {0x0, @in6={{0xa, 0x1, 0xc259, @remote={0xfe, 0x80, [], 0x0, 0xbb}, 0xfff}}, 0x9, 0xb4, 0x1, 0x8}}, &(0x7f0000375000+0x637)=0xb8) setsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(r0, 0x84, 0x13, &(0x7f0000b3c000)=0x9, 0x4) sendmmsg$inet_sctp(r1, &(0x7f0000108000-0xa8)=[{&(0x7f00005e2000)=@in={0x2, 0x1, @broadcast=0xffffffff}, 0x10, &(0x7f0000ac7000)=[{&(0x7f00009d6000-0x54)="2051299d06c394ef9700815ec1801866b1490dbaae8352f290614b8de66b287cd91ea29bb100e04421cd7d5c07a8d6b13973c3b7c90a5ed8ad588c0772e88e9aa7d73105575d5e2c7304d151e1dfa7031a90285c", 0x54}, {&(0x7f0000035000-0xe4)="25e120f4948cf9768295d43d5255bb9020ab47e72538bbeaa6a3dbd4c027174c02009656f2d9bae06391ee985b404bbf1417282fd1f4fdb9f31e415ae7782136261b910a0d9542e3e6958a77bfb8fb5cde674f3a808cba9c8d72205d17c3fcf920656757348c9f6ccb31636224a1ff2a5e655720b67a4d231b7812e65800e002b466a7539b3110e2e969ea17c96d69cef1e51c14d0efa458eb1fad7bc5a768f7c06241c19bbaef1cbe0f52db7c37a27a19aa2d7ebeec10f42243e88186e11649e571855d0a5f45670a8fb11cd871801c98379ae2b3e0fb50d0a52bee48f2bf2d529e3b08", 0xe4}], 0x2, 0x0, 0x0, 0x200000c0}, {&(0x7f0000da7000)=@in={0x2, 0x2, @dev={0xac, 0x14, 0x0, 0x10}}, 0x10, &(0x7f0000783000)=[{&(0x7f0000577000)="864be24bb6e7b43e83c6255771516749e0efb8d13b75157dd9d567d802b57b4d97b32b7e2bb98817b5c7428eba6fa820432b1d3dc2a2692bb755b5c0a8fa32fea260fb35f85151fb39fc2857f525a7e60e55d8c7734d6294ac27a516597b1ee51b20be9959f95efa07a260537855023c3cc1b8feb9e86d1607dc3644a94183b36cefd312751421b9b0b94ead4f576f90f214720ce6dd3b1a573eedf01e122ce7b3bc77a30c01f8970d0c9320172efbdd1abdffa91fb80e7bded216207b56bec24cdcd41674616941305849c73cebed329c2b30fba1b0521077fc7c5e450a5e5077a4b48f27344029a7021f0ac3a6a7cc36e2695f84415ae1f2d48bffef", 0xfd}], 0x1, 0x0, 0x0, 0x8000}, {&(0x7f0000649000)=@in6={0xa, 0x0, 0x1, @mcast2={0xff, 0x2, [], 0x1}, 0xffffffff}, 0x1c, &(0x7f0000dd2000)=[{&(0x7f00004a8000-0x1000)="dc7ae322fe9153823c555a9ea753c4e0aa8b2d860a77e247351860c40e534901a3fe43c81a5d23952000959fbb2607a288a13619328958295dcb6a5f1d210977e9ba33df84d86d9cb0a0b74f3c47505e41a156a006c661752db9851154a560e9ce48dbf61c2549ed5144ae61c6f14e6cd81378b126e2f154d0fb99dbe6e0693e596505d2d6fb08965d9df315b31c543f5893b8a15049e9c46a19bc93072df9876e62877d8689300c81dcb07a09307b779c0c39106ff84c285ab96921320cb06e90861f437f159ae6b87ac07a45ed617b59db4ef4cf8fd33da3fae8929ec2824c844161bb53a178b15fbe92836ded362c6d07c41977237b5a9de966601265a8ac77e4490515dbe84e1612aa26ec7d494d20905bdf73cf377e70854819ccf9f2ffe89795808a0a870d2f1b99168bdd3ccbb605ae519d2ffd14ef51804b681380d8fc852882fb7d3f40dd9c4f318475935bde339a22975513e3b22e7a8db7154905da8f3809cc85f11afd456f4c53e25fd092ef8b07145ae8eb577dfb03178799499fd7b6d9ad5bda42a5cb3495033dd58ee63f745aab9d6e56f9f2491abbca76cf5d3dafd85feaa3e22264215ef45aa54f8aaa9f49358542197a97e38db14ddabdfb4f7928e3816e614a14692370df5b08de207933b68bfb7722d3d1fe67360c74a7418e0a6c729cd5353a08f426bed9b047625c1fbafcc030c0da9c65998d698ceb3054a0ed8d97dcc4df1abeaad9a2939aa9817435117c99a1268aa7a34ac253ac7007ff9303f66bbf9a2c4a39d6bd98a7b5cd78eaea8fc967100e6ea18acc85a3bf89af890f4b6199391900828f2d5bc2bc34f8db98777979836c344337b370d5c25699b4ebd84f380ccc21e17bf5f49107164381aecd27335e0a7da09ce402ced5b7a66437f009ecec1cb7291e2a22ebd6f1e8620584380e102a52b70cb4bf49191ff832193a1ff6b14186610b28b770b3deb59fc15fd19ca87575045543739765a1bc6e7e73935d29f9aa7e00bab3d173019f0ad4d53e5ce4ef4f04d91eb56ee3f3502ebe21591415e9851bbb7564075fe2de54553606eff1ce0f221f464812cfdfe2a8eb08410d7155a696150405982540c3993ab6f2962e014ccb5a483219b9ec0089cff7351361a1cf9505c51b2ffb65d78f67409a65a82cca0dbb2342da09702019639cee87fa947b5cd7b73a8d67d800d2046ae94aff992b662a3ca4400cc149d4c3e78e8b24aa58b18c85d40131a1c968ec6948d58126991bd37bde8b2788a14d08bbfc42cc74955adc689a087c2654d5624cdf5a6d3884cbaaf726a81358ed66a14561d45e41afc74b6893f2e33cb64e46fcec4d713ef99cab110247a9bdaa3b90dc5c160bf5c8576325d562236db516576aca10592c113117495a8b874caefbe5177b0a9179f28dd96804f5e23e9eee9d151b4b5e30a450918bd2a2b73842c8f738596a1050c36ac76ed0f2b1181568ea0483d9f0fe06f370d3ff54124d2345079b0006ff52712c2763265393eca28b85471a09e5600805a1796c5cbe06d1492c3c76d56e9c5289e76b6aa536282b1cd9945cc9245f2e08c563a26ae108c68e6ae02fc864be430508bdd64dc181f75b505d88b415cb4da273e03244083034cc5f5729e201cc5f70d86c2293589f738bddd1230d503a161f26620b59912caf6420c4e519746eba14f805bae2dc0c3385de1bbfe5409285e67bbb3e55487cf1a1269634f91a921f75929fa2095dec3e5908b70fbb208895653c66f4ab1ac9d2ed076057b72d10562f5c3a34307c70afb37f1d268c34e331ff4198b11e14db71b728bd0ccc8de592b07849fc86816cd80428c8d401e0855418ae3b0636946d8793dc7d61acd39a7c06ae24a47355b158f81a46f8e4f54f564b4bddd20a47e31b61addf5c2ff26b7bc47b0681cc3f9d5a2680322c68a37dbe72cf2f7e398419d017251ba1cd1ecaf5430dcafcc7aba5a200445c765dcab18a9e4e3bd78f3ac20bc7538671e956e56153688f0f2da9dfc09c0df9bdd10fccd91a931b462b0479b8d627cc581da1cc97edd661ef733192ffb3cf090ee5b2a0d4e4509c45c6a426e0f76c6ca7e38f9943116b4fbc6ff711e4dd0b6f6bb620b4adf3f0702aca92fe3a471504fadb30b5e372ced66f71d16e9f3439e6bac5efb2dc002782e2488969d650f9e1f285cee4ab7c67d58b945bcb2ab7b3140b7d0b87813dc17b90a6442ca769e085dfe0f6a9ddb83e849e2aa34984defea68ebad8e4cc945008af2cbf04ac3d109650895ee8dc30b44fd3b448e5d1b976c82bba6097bb0c504ea938058266515fd99d3cb866e786e1a0222f519a82ba1ba8f592cc25be66170c1f0e15cfeaa99b456376b03cdeb201748f6a7cdc4d900e6d8f56495eeb03ccd4ecce337b29ecd883ce2b6e6255c186fdc07d543095926a84957d7dcfd45c5179cbd17bf8206994fed273a3f6a6dda126ea06479b813155f521bcafdd3bb7f29d94c5a02cde443535526c828024865f13048369058a171838114b1646d50ad4da2f019d81d3c0f81f002f33a9c6d405e165bf54bdefb56cb8c6321753ca2738a62bd3114c6d504ee80e25102bfc13dc6485ee928285b021f040ff698c0e191f322fb8f375378b3e565ebccb2f1428ce84392c9c6fb72c5b3723856d90e71ec9666ee790b99df9768394b9a0f24734554dd42aa5dd878e1a33db7dc10d7f95c1e7d6b79dd82e5e387d55c82d482c6c8abb8075c06dc705f0932959c50787298fd37fd64e973efa706b9d82c2c52367094ea12c6b8da1a91f04eb72a92dd425f1043745972447bbad0c52b4477213e2274e4176761ef864c60b5c9d252e94f41978b524c85262d4b7c6df77a21030a34702cb3ea561c8eb3df30661395c9ab7a2a63f09fc22dbb2e37156b317ad34ac6bc44d61939c35a2ca0704b2cf088d16714aa709e535b45c21139b56cc5b653677f51622e5f52a79c0ba9e2ed9bd1eed84072e17edcdc99ab41bcb71b54cfedcef8fa3002793aa7172f91b4d6ea72f3babb0ccc29573c0b00d4dbcf169190d4ff355fbc9b3ba71510e81009f40212f09afe6f319574d466714f914d1269fc6bd195f12790022b62c05c7382eadf9dc7c753ae840796cabd89b411d8841a2373c796288c7bc1f51b4c39c25fd197dd174b5b387a7aed1df0183bd41a4d991b3b5c6143488e019df6263a29e1eda05d82aee475c564560c894aa29810cd904e09669a9e3310116e37142461c29d68e13fd7833d0ffb9ce4ea16e0c1e75c38e1e21b56324933992b5463679eed382ec0a86263695c959b405c9a19c7ba8a975e62f3d5c51efa56766095143cf4b34071357d40bbab64fc3395fae122621aefe447d00898b981c77e4e2d3c667e2b78b56d2b61f914082fa53a29072284ff7357c341c1170217f84282c69d480d445344045f61f280c16210bc0391da710ca3d350c6e34d5869bdcfd675755f97e5e35b8e6ef491806ef38aef5836384035dc222aa01ae6684af31990710bfc78a1829c001a2e74a19815a19c7375855c6ef61b227c18ade2d843560fa355e3b03b25827759d9ccbd1610e7818e0b96bcb66067263e56fbc1dc40d65b827d3834714612d6f6ae87f32c93f1154dcdfc9deeefaf51d4c1a5f3b8d5b786da65a7fc8a298b40f25eca9bbb7804d6252892e364695ce31d467ad0be75218cbd5fe3aa1d63e69ffa8f3811a41073c1dcf30ba725c64ab5a5a9f495f1717ae7753b574607d49b6e7243f9287bbf729c8532a797f90ec37c196048025dcb79d1daa9425f858844ced7fc41b555634e04a3f052a4c30ab6bb83a0c420d02409acb7ad84b81cee92aba149d4bc2536577b28323c6aeca5c12a87592493f9999a921ee9fb1f2ab8cfdce5bcd70fbf86fe2a655ccb131a42679b4569db1fdd3f3ab284938f896e81f6a610eb5a3357acb9d74f3493061a2781541d5af16ccf4183b7de018e719c54383e79dcdaf368a70e601fa455cc5ea4c9da6d2f3b03c521af4d5f001dce25cbf6eabd0d3c10e0d6c5cfb2ae7fe5959564d7a23597589d597e3b105f1a8083b1fbfbd7831bef36cafe6c2f5560a13a5b6d4d2a88b24823125787e64ec5991016f62248d2a9f032e65b81d84722a38ee9b6a6b4a48d2cb1a703e604242fdfb6b9b725df82ccddad9e2813fba263dcf6d3fb4894ad0b3c0bdbc3d328d0f505e5443033fc3f5c291d03ca048dea1f9fa8013672a449f35683a38484b78ea067d39212fc9c706d3cc3aec3c399416efa82827c11adfcbeff080219b4b7ad5a1f665e56b6fd47fa9c71edeb3e545f149c3d31d2bd996e33b3f127833f5c9ecc78e975a5f058aedb50504a20dbee1641b44dbe8ee849604525e682378f6c1c1d075eeaa4d3f8e1c0c31966ce22c2d45c8cb430ee73035ae0046446d66915965eab0b180cbeb17ef2bd6974dafc36a71bc0e0fae83a52c354e8300d2680d96789e1e74d2263fbb28bdeec24279545e2dcb478bf68daf3fed662c5ea6d35e77043acdd0a3ab9058f3038a4c67d391e9717844913acd46c4a637b52cf2ae573df4c8130dd73f5c7ccbebf5c8f9da0d624881acc3009d5ddf0d54daa97fb4f4fd5201774336fa8b6ad627f06063019c75f169976971e3c5ce472cb084d80ae7ceba0e472d741540dffb214524616bda50a522d1a1d09da67b168dac08b9aa2dbd917317acfdd84076e1a58fa58a2ab6198f9b92eaaa02d598d42d4f9eaec4fc5e9256c6d1d9b6495207004acd4ac9cdc372f2749b675fa4dd3f1ae02441942c6425dbb0ebae70f5e5d8e37b11e2e25adb89c78c29c7c1a09a2dbb20efd2cb8fdb518a825292962073db6cd8f3e7d46253f33e886a1179f9336b650f09b61769563a102807f9a15d8300fb7499baa2fe46765d93231e1ecfe9ce7cd9223018d982917ab46350f746788399a46512b5a3ad48076dcae2aae8e8a14d1c1a40783ffabbd9831c26252b877e108340629c3866288bf013ada245d43da241609ec444de73edd532dccedcf29b2205920617c40d0c897c86e1fd5f1192bbdf026293f9e9a1037714a510609b3ea85ee8a90188ceb78bf32b13281cdfab49dfc7edd5a2a11f0dd5b41a73c9dc6ba0673bdae758124d3b7fee92f4961541f7806c689644a36468585a07d73323870739bfd826da1dade8afcd178706d82017f6f344d7ac47a2185fe689cc4b8d5033bfc3fc91acf3f796656a40162d25c63ad4fb6cdd952323682c33b85107153f9dfb7cebe245af1e065336ee29d70c834640e1004cfb6430260f14ee0935be15a51426d2f4824a3fa08963e6f6247bc6069a76cd204c1c4c677c40f1216510a68f105f9495d66cc603647aa9d56419eeab6f2a14c1143da0f55b93bf3dfa38d8c8eea8342faeb556b77e0fff22938229514ef7405d55b8d51f9654c53e7a2bfc8883d9dc6ff5426b4ec677b202f06eef1951dd9c9dffdbd02fcf29259f93f3069caa43c9894a940ab6764797e04111081b243f45c1b612219568f303d2d39137861be2d743e7e9c5360a28f7ad534ab1330ff26906e46c90c594aca657fde87eafbc801dfaf03be3350309e95e651fbb9fd26e87f8ef3f4abe673e218a68342511071fc539a10716970494935d2e47301fc23d1018476a8bcef102a6e40eafefff5822c45a27852cbc50d6d68fa463793594e6f261d0d4d5c1f31cf9076900e89ffa814a2f733f5ad5d28ebaea54d175b699c677fdec117cee0a5e1c0758651562442acc12078a9a341879b18e27c9b5b1ea1fc10db2402f0b1bcf07459b171bce", 0x1000}, {&(0x7f0000f8f000)="c043ea78fead261b7819a3c4521b6ab11cee6aed9dde8a6e7e7359b47ad5032766c0437ccb6b73d19548fd48080d67bd82e0e9531674d2dd330dad2a570acfc29c9e1b4af163e3664d16897e75d12c88ed3c4baf39584891f30f1bb8f4f2d49cf784f0a8d5c337a9325e77a955c09b1048b8e91d7db33ad0c022dbad55e00b3c7acaacf932b79faa2ca67d70b50adc06706ef10b6cc781b54e6adf9a64", 0x9d}, {&(0x7f0000871000)="9c088aadbd2fc7e6f39cf970a1ca9d8ba3d9a3211cf49639f991779e55c76a3b2b3333262c303abc9b665fdf5396a887088adfc200946e713285", 0x3a}], 0x3, &(0x7f000067f000)=[@sndinfo={0x1c, 0x84, 0x2, {0x9, 0x8000, 0x4, 0x2, r2}}, @sndrcv={0x2c, 0x84, 0x1, {0x3, 0x100, 0x4, 0xfffffffffffff3b6, 0x7fffffff, 0x100000000, 0x6, 0x1f}}, @init={0x14, 0x84, 0x0, {0x2, 0x4, 0x3, 0x4}}, @sndinfo={0x1c, 0x84, 0x2, {0x6, 0x800b, 0x3ff, 0x5, r3}}, @sndinfo={0x1c, 0x84, 0x2, {0x0, 0x8, 0x100000001, 0x9, r4}}, @init={0x14, 0x84, 0x0, {0x100, 0x5, 0x8, 0x8000}}, @sndinfo={0x1c, 0x84, 0x2, {0x6, 0x0, 0x4, 0x8, r5}}, @init={0x14, 0x84, 0x0, {0x7, 0xfffffffffffffffc, 0x1, 0x3f}}], 0x160, 0x4001}, {&(0x7f0000b4b000)=@in={0x2, 0x3, @loopback=0x7f000001}, 0x10, &(0x7f0000e39000)=[{&(0x7f00007f1000)="96eebac6fe26e025e0df872ad041005105410416523b75e44f4bab8fbd069631c79a572ebbd133faf53de9be134072d901fa7015fd6196a3596a32caad045d4587f8beb2916a7c0757d820b8886269c2579b93cb122ed3e4797376115d799bc66ae9cea071794068eb2f98db", 0x6c}], 0x1, &(0x7f0000005000)=[@sndrcv={0x2c, 0x84, 0x1, {0x100, 0x3, 0x204, 0x4, 0x100000001, 0x0, 0x9, 0x5, r6}}, @init={0x14, 0x84, 0x0, {0x7f, 0x8, 0x9, 0x22d}}], 0x58, 0x40000}, {&(0x7f0000b13000)=@in={0x2, 0x1, @loopback=0x7f000001}, 0x10, &(0x7f0000fd4000-0x18)=[{&(0x7f00002ac000-0xec)="cbcc7b55889767efe4b1c2beceb619a2905b67de20b46a3b78fc959485ddf90839fc4a2dbc6d46091ab016f8c1d726bdd477a33c97615c26dac1b43d6abcd206b5c5e65d91840954c3743c28e396b34e3476cf8013662e5e1f43d26f097147749cabb4f9dc6b5b869b9f615bba71e50ed7a6ee4fdf375c25c5678cc425132d838bb049a7ed1e8f47153054e22bc5a5e988a1a743fd1f985571ba8dffd04ab70af638d553f767e8d21b2c5aa91097ff1a31d216d928422c7f9aa8ccd842d3e636a39301d59e60990fc3cdac829f9bc74d9a75f7009d1d5ae22e16268cac6e358a82fe77df62fe37a40fa79191", 0xec}, {&(0x7f00002f9000)="104ab3f3eb0f4dd86f32bea2e1cf7f02587328b3c757032263aa6dc89a81fe95b25f075a2ab173cd7e6daf5e66a0a98aecfd20a20c876cff3e36e5611a924de401439549c7623e7fbf5a72439160095abac8e6e5fcbafe6072c753608b70ff055ff617bdc3d8e38f616bd7f74620e52331957f3a47543ffecbfc3f4b729979ddafcb4b18e140d6e64af118c10816d572fd", 0x91}, {&(0x7f0000bd4000)="1a03504bd76686068485205ea44eb432a080631f8f2f22eb70805f5ad4689c9fad49db468833b47a6192cca066263bcd4b8fa36b068932c5851aa1b64ba182946bc940a8fc83860217a3ff95fe06d544922cabb38c2ed1", 0x57}], 0x3, &(0x7f0000e89000)=[@sndinfo={0x1c, 0x84, 0x2, {0x2, 0x208, 0x80000000, 0x4, r7}}], 0x2c, 0x800}, {&(0x7f000074d000-0x10)=@in={0x2, 0x1, @local={0xac, 0x14, 0x0, 0xaa}}, 0x10, &(0x7f00007b8000-0x10)=[{&(0x7f000054d000)="c7a41bc4b12d1401343b27b304ace1d33afdb5ed8bac95591eee93993935d044802d73b28be9c69c3539d159b1699733d9d12e6547f6558dd8d70b50134d573d7b5be78d7faca88aa54e3022f09ad77b4c015149e975c050d49251da3953ab", 0x5f}, {&(0x7f00006ec000)="9121fbf0eddf0cc83e7fdd8d79ae947e67d84419cf40bb07aa6c3bcc6be3b2e3aea278a7dda947b6427e5762400172c103c6bbe37fb8e5b7", 0x38}], 0x2, &(0x7f0000014000-0x58)=[@init={0x14, 0x84, 0x0, {0x800, 0x100000001, 0x400, 0x2}}, @sndinfo={0x1c, 0x84, 0x2, {0x703, 0x4, 0x8, 0xff, r8}}], 0x58, 0x4000010}], 0x6, 0x1) r9 = accept4(0xffffffffffffff9c, 0x0, &(0x7f0000e45000-0x4), 0x80800) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r9, 0x84, 0x6, &(0x7f0000aba000)={0x0, @in6={{0xa, 0x3, 0x800, @dev={0xfe, 0x80, [], 0x0, 0xf}}}}, &(0x7f0000251000)=0x8c) getsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f00002cb000)={r10, @in={{0x2, 0x3, @multicast2=0xe0000002}}, 0x200001, 0x9, 0x80000, 0x101, 0x40}, &(0x7f000004c000)=0xa0) setsockopt$inet_sctp_SCTP_ENABLE_STREAM_RESET(r9, 0x84, 0x76, &(0x7f000064c000)={r11}, 0x8) mount(&(0x7f000000a000)='./file0\x00', &(0x7f00001a1000)='./file0\x00', &(0x7f000000c000)='ramfs\x00', 0x0, &(0x7f0000807000)) chdir(&(0x7f0000e6a000-0x8)='./file0\x00') umount2(&(0x7f0000b1d000-0x1)='.', 0x0) 2018/02/10 14:10:17 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r0, r0, &(0x7f0000049000), 0x3d2) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000008000)={&(0x7f000000f000-0xc)={0x10, 0x34000}, 0xc, &(0x7f0000220000)={&(0x7f00008d6000-0x14)={0x14, 0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, {}, []}, 0x14}, 0x1}, 0x0) r1 = userfaultfd(0x80800) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000ff8000-0x20)={{&(0x7f0000012000/0x2000)=nil, 0x2000}, 0x1}) bpf$MAP_CREATE(0x0, &(0x7f0000fb4000)={0x2, 0x8000000000000004, 0x400, 0x7fd, 0x4, 0xffffffffffffffff}, 0x2c) userfaultfd(0x800) clock_gettime(0x0, &(0x7f0000132000)={0x0, 0x0}) socketpair(0x1d, 0x800, 0x4, &(0x7f0000589000)) r4 = syz_open_dev$mouse(&(0x7f00006eb000)='/dev/input/mouse#\x00', 0xde6e, 0x1) timer_settime(0x0, 0x1, &(0x7f000097e000)={{0x0, r3}, {r2, r3+10000000}}, &(0x7f0000939000)) fanotify_init(0x25, 0x802) r5 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000ef2000-0x1d)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f00002d8000-0xc)={0x0, 0x0}, &(0x7f0000d76000-0x4)=0xc) syz_open_procfs(r6, &(0x7f0000013000)='ns/cgroup\x00') openat$ion(0xffffffffffffff9c, &(0x7f0000dd5000)='/dev/ion\x00', 0x800, 0x0) pipe2(&(0x7f000058c000), 0x4800) setsockopt$inet_IP_XFRM_POLICY(r4, 0x0, 0x11, &(0x7f0000e12000-0xe8)={{{@in6=@mcast1={0xff, 0x1, [], 0x1}, @in=@rand_addr, 0x2, 0xbd, 0x3, 0x20, 0xa, 0xa0, 0x80, 0xbf, 0x0, r7}, {0x0, 0x8, 0x0, 0x3, 0x6, 0x1fa8, 0x0, 0x20}, {0x1719, 0x7fff, 0x7ff, 0x7ff}, 0x1, 0x7, 0x0, 0x1, 0x1, 0x3}, {{@in=@broadcast=0xffffffff, 0x1, 0x7f}, 0xa, @in=@empty, 0xffffffffffffffff, 0x3, 0x0, 0xffffffffffffffbc, 0x20, 0x6, 0x2}}, 0xe8) openat$selinux_policy(0xffffffffffffff9c, &(0x7f000010e000-0x10)='/selinux/policy\x00', 0x0, 0x0) setsockopt$netlink_NETLINK_TX_RING(r5, 0x10e, 0x7, &(0x7f0000ab4000-0x10)={0x6, 0x7, 0x52, 0xfffffffffffffffc}, 0x10) [ 75.001772] binder: 12375:12387 ioctl c0306201 2000a000 returned -22 [ 75.024097] binder: BINDER_SET_CONTEXT_MGR already set [ 75.037498] binder: 12377:12406 ioctl 40046207 0 returned -16 [ 75.047878] binder: 12377:12378 unknown command 0 [ 75.052897] binder_alloc: 12377: binder_alloc_buf, no vma 2018/02/10 14:10:17 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000a5000-0x8)) mmap(&(0x7f0000000000/0x19000)=nil, 0x19000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000924000-0xc)='/dev/rfkill\x00', 0x0, 0x0) r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000e54000-0x18)={0xaa}) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000008000-0x20)={{&(0x7f0000000000/0x4000)=nil, 0x4000}, 0x1}) r2 = syz_fuseblk_mount(&(0x7f00000e4000)='./file0\x00', &(0x7f000022a000-0x8)='./file0\x00', 0x0, 0xffffffffffffffff, 0x0, 0x9, 0x3f, 0x80000) fcntl$setsig(r2, 0xa, 0x0) readv(r0, &(0x7f00001f3000-0x10)=[{&(0x7f0000002000-0x4e)=""/1, 0x1}], 0x1) ioctl$RNDADDTOENTCNT(r0, 0x40045201, &(0x7f0000b27000)) ioctl$RNDADDTOENTCNT(r0, 0x40045201, &(0x7f0000a81000)) setsockopt$inet_opts(r1, 0x0, 0xd, &(0x7f0000948000)="1409273ce714e28fb1aede56ec94e07d0db8ee92ec6b31baf8efcd3f673899ba72a6c669768ea8b074e05426616d01feb7d88549eb23a6781885c682d055d238c92465728a9f5d2aa55fe6c38bfefa032ae5b0a08f38887ab3e3087cc59ee2b6fddb8861a1b338759ef0b65a965e663c8b87ba0d488c50d94e71afc816ac81b81589d640d9d9dd578e12db86e4eb5b0a134db557458822571ee0a39d479c433b030d3a71a26d580180d36bba8c20e5538db86c05161bb3208c2b43fed54709ab53bc13d0674fe07ac3be59de481236c8c800df11d100a4d9bcafb8b8837950ed468be2f12bf90182e464026d6bfd03b27894400ffc3711f3e3e46b2dc2def8", 0xff) ioctl$UFFDIO_UNREGISTER(r1, 0xc020aa04, &(0x7f0000008000-0x4)={&(0x7f0000000000/0x2000)=nil, 0x2000}) 2018/02/10 14:10:17 executing program 6: r0 = creat(&(0x7f0000eab000)='./file0\x00', 0x1) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) getsockopt$netlink(r0, 0x10e, 0xe, &(0x7f0000001000-0x5c)=""/92, &(0x7f0000000000)=0x5c) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000a000)={0x34e, 0x0, &(0x7f00001e5000-0x8)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000006000-0x54)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000008000-0x30)={0x0, 0x0, &(0x7f0000d06000)=[], 0x0, 0x0, &(0x7f0000176000-0x1)}) ioctl$KVM_ASSIGN_SET_INTX_MASK(r0, 0x4040aea4, &(0x7f0000ddc000-0x14)={0x5, 0x0, 0x3ff, 0x4, 0x789}) 2018/02/10 14:10:17 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000ef6000-0x16)='/selinux/checkreqprot\x00', 0x40000, 0x0) r1 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) getsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f000041b000), &(0x7f0000ab6000-0x4)=0x4) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000a000)={0x34e, 0x0, &(0x7f00001e5000-0x8)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000006000-0x54)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000-0x30)={0x44, 0x0, &(0x7f0000d06000)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x38, 0x8, &(0x7f000000d000)=[@fda={0x66646185}, @flat={0x73682a85}], &(0x7f0000006000)=[0x20]}}], 0x0, 0x0, &(0x7f0000176000-0x1)}) [ 75.058503] binder: 12377:12388 transaction failed 29189/-3, size 56-8 line 2957 [ 75.066348] binder: 12377:12378 ioctl c0306201 2000a000 returned -22 [ 75.092380] binder: undelivered TRANSACTION_ERROR: 29189 [ 75.098746] binder: release 12377:12388 transaction 393 out, still active 2018/02/10 14:10:17 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000b36000-0x11)='/dev/qat_adf_ctl\x00', 0x8800, 0x0) getsockopt$inet_sctp_SCTP_DEFAULT_PRINFO(0xffffffffffffff9c, 0x84, 0x72, &(0x7f0000f31000-0xc)={0x0, 0xffff}, &(0x7f0000500000)=0xc) setsockopt$inet_sctp6_SCTP_MAX_BURST(r0, 0x84, 0x14, &(0x7f0000456000-0x8)=@assoc_value={r1, 0x2}, 0x8) r2 = syz_open_dev$mice(&(0x7f00007ae000-0x10)='/dev/input/mice\x00', 0x0, 0x80) clock_gettime(0x0, &(0x7f0000e45000)={0x0, 0x0}) ppoll(&(0x7f00005bf000-0x30)=[{0xffffffffffffffff, 0x4}, {0xffffffffffffffff, 0x410}, {r2, 0x2004}, {r2, 0x1f}, {0xffffffffffffffff, 0x80}, {0xffffffffffffffff, 0xa0}], 0x6, &(0x7f0000db7000-0x8)={r3, r4+10000000}, &(0x7f0000bf9000-0x8)={0xffffffffffffff7f}, 0x8) [ 75.105844] binder: undelivered TRANSACTION_COMPLETE [ 75.111047] binder: send failed reply for transaction 393, target dead [ 75.119352] binder: 12414:12416 Acquire 1 refcount change on invalid ref 0 ret -22 [ 75.123882] binder: 12417:12418 unknown command 0 [ 75.127122] binder: 12414:12416 unknown command 0 [ 75.129485] binder: 12414:12416 ioctl c0306201 2000a000 returned -22 [ 75.132127] binder: 12417:12418 ioctl c0306201 2000a000 returned -22 [ 75.145954] binder: 12414:12416 unknown command 0 [ 75.183367] binder: 12417:12421 unknown command 0 [ 75.183583] binder: 12414:12416 ioctl c0306201 2000a000 returned -22 [ 75.188369] binder: BINDER_SET_CONTEXT_MGR already set [ 75.200224] binder: 12417:12421 ioctl c0306201 2000a000 returned -22 [ 75.207099] binder: 12417:12418 ioctl 40046207 0 returned -16 [ 75.208562] can_create: 12 callbacks suppressed [ 75.208567] can: request_module (can-proto-4) failed. [ 75.226010] binder: release 12417:12421 transaction 400 out, still active [ 75.233073] binder: undelivered TRANSACTION_COMPLETE [ 75.238253] binder: send failed reply for transaction 400, target dead 2018/02/10 14:10:17 executing program 3: mmap(&(0x7f0000000000/0x12000)=nil, 0x12000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$can_bcm(0x1d, 0x2, 0x2) r1 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0xffffffff, 0x8042) mmap(&(0x7f0000012000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000013000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) listen$netrom(r1, 0x2) setsockopt$inet_sctp6_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f0000006000-0x4)=0x80, 0x156) connect$can_bcm(r0, &(0x7f0000003000-0x10)={0x1d}, 0x10) mmap(&(0x7f0000014000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) sendmsg$key(r0, &(0x7f0000014000)={0x0, 0x0, &(0x7f0000006000-0x10)={&(0x7f0000003000)={0x5, 0x0, 0x0, 0x0, 0x2, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, []}, 0x10}, 0x1}, 0x0) 2018/02/10 14:10:17 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat(0xffffffffffffffff, &(0x7f0000e94000)='./file0\x00', 0x40000, 0x100) inotify_init() getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffff9c, 0x84, 0x77, &(0x7f0000de3000+0x1d1)={0x0, 0x4, 0xa, [0x400, 0x8001, 0x1b6e48b0, 0x0, 0xffffffffffffffff, 0x1, 0x3, 0x2, 0x2, 0x68]}, &(0x7f0000e89000)=0x1c) getsockopt$inet_sctp_SCTP_SOCKOPT_PEELOFF(r0, 0x84, 0x66, &(0x7f000081b000)={r1, 0x6f}, &(0x7f00002ed000)=0x8) perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$evdev(&(0x7f0000dda000-0x12)='/dev/input/event#\x00', 0x0, 0x0) ioctl$EVIOCGRAB(r2, 0x40044590, &(0x7f0000e95000-0x4)) ioctl$TIOCSBRK(0xffffffffffffffff, 0x40044591) request_key(&(0x7f0000102000)='big_key\x00', &(0x7f0000ad3000)={0x73, 0x79, 0x7a, 0x3}, &(0x7f00006cc000-0x40)="6465666c617465000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000000000000", 0xffffffffffffffff) setsockopt$inet_sctp_SCTP_AUTH_ACTIVE_KEY(r0, 0x84, 0x18, &(0x7f0000cca000)={r1, 0xfffffffffffffff9}, 0x6) 2018/02/10 14:10:17 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000a000)={0x34e, 0x0, &(0x7f00001e5000-0x8)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000006000-0x54)}) ioctl$TIOCGPGRP(0xffffffffffffff9c, 0x540f, &(0x7f0000e1b000)=0x0) r2 = syz_open_dev$dmmidi(&(0x7f0000168000-0xd)='/dev/dmmidi#\x00', 0x1, 0x80400) perf_event_open(&(0x7f000069d000-0x78)={0x3, 0x78, 0x8, 0x2, 0x33, 0x4, 0x0, 0x1f, 0x0, 0x9, 0x400, 0x81, 0x0, 0x3, 0xa62e, 0xca08, 0x101, 0x80, 0x3, 0x4, 0x4, 0x100000000, 0x8, 0x7, 0x1, 0x1, 0x2, 0x4, 0x7, 0x8, 0xac09, 0x9, 0x0, 0x4, 0x1000, 0x189, 0xfffffffffffffffd, 0x1, 0x0, 0xfffffffffffffff8, 0x2, @perf_bp={&(0x7f00002d1000-0x1), 0x1}, 0x20039, 0x93, 0x8, 0x4, 0x2, 0x144, 0x9}, r1, 0x8, r2, 0x2) getrlimit(0xf, &(0x7f0000d61000-0x8)) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000008000-0x30)={0x0, 0x0, &(0x7f0000d06000)=[], 0x0, 0x0, &(0x7f0000176000-0x1)}) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000f3d000)={0xffffffffffffffff, 0x50, &(0x7f0000fa1000-0x50)={0x0, 0x0}}, 0x10) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000331000-0x4)=r3, 0x4) 2018/02/10 14:10:17 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000a000)={0x34e, 0x0, &(0x7f00001e5000-0x8)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000006000-0x54)}) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000-0x30)={0x44, 0x0, &(0x7f0000d06000)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x38, 0x8, &(0x7f000000d000)=[@fda={0x66646185}, @flat={0x73682a85}], &(0x7f0000006000)=[0x20]}}], 0x0, 0x0, &(0x7f0000176000-0x1)}) 2018/02/10 14:10:17 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r0, r0, &(0x7f0000049000), 0x3d2) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000008000)={&(0x7f000000f000-0xc)={0x10, 0x34000}, 0xc, &(0x7f0000220000)={&(0x7f00008d6000-0x14)={0x14, 0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, {}, []}, 0x14}, 0x1}, 0x0) r1 = userfaultfd(0x80800) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000ff8000-0x20)={{&(0x7f0000012000/0x2000)=nil, 0x2000}, 0x1}) bpf$MAP_CREATE(0x0, &(0x7f0000fb4000)={0x2, 0x8000000000000004, 0x400, 0x7fd, 0x4, 0xffffffffffffffff}, 0x2c) userfaultfd(0x800) clock_gettime(0x0, &(0x7f0000132000)={0x0, 0x0}) socketpair(0x1d, 0x800, 0x4, &(0x7f0000589000)) r4 = syz_open_dev$mouse(&(0x7f00006eb000)='/dev/input/mouse#\x00', 0xde6e, 0x1) timer_settime(0x0, 0x1, &(0x7f000097e000)={{0x0, r3}, {r2, r3+10000000}}, &(0x7f0000939000)) fanotify_init(0x25, 0x802) r5 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000ef2000-0x1d)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f00002d8000-0xc)={0x0, 0x0}, &(0x7f0000d76000-0x4)=0xc) syz_open_procfs(r6, &(0x7f0000013000)='ns/cgroup\x00') openat$ion(0xffffffffffffff9c, &(0x7f0000dd5000)='/dev/ion\x00', 0x800, 0x0) pipe2(&(0x7f000058c000), 0x4800) setsockopt$inet_IP_XFRM_POLICY(r4, 0x0, 0x11, &(0x7f0000e12000-0xe8)={{{@in6=@mcast1={0xff, 0x1, [], 0x1}, @in=@rand_addr, 0x2, 0xbd, 0x3, 0x20, 0xa, 0xa0, 0x80, 0xbf, 0x0, r7}, {0x0, 0x8, 0x0, 0x3, 0x6, 0x1fa8, 0x0, 0x20}, {0x1719, 0x7fff, 0x7ff, 0x7ff}, 0x1, 0x7, 0x0, 0x1, 0x1, 0x3}, {{@in=@broadcast=0xffffffff, 0x1, 0x7f}, 0xa, @in=@empty, 0xffffffffffffffff, 0x3, 0x0, 0xffffffffffffffbc, 0x20, 0x6, 0x2}}, 0xe8) openat$selinux_policy(0xffffffffffffff9c, &(0x7f000010e000-0x10)='/selinux/policy\x00', 0x0, 0x0) setsockopt$netlink_NETLINK_TX_RING(r5, 0x10e, 0x7, &(0x7f0000ab4000-0x10)={0x6, 0x7, 0x52, 0xfffffffffffffffc}, 0x10) 2018/02/10 14:10:17 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) syz_open_dev$sndctrl(&(0x7f00005d1000-0x13)='/dev/snd/controlC#\x00', 0x58, 0x400000) r0 = perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000002000-0x78)={0x1, 0x78, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000001000-0x1)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000f1f000/0x2000)=nil, 0x2000, 0x0, 0x11, r1, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r1, 0x2405, r0) 2018/02/10 14:10:17 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000b36000-0x11)='/dev/qat_adf_ctl\x00', 0x8800, 0x0) getsockopt$inet_sctp_SCTP_DEFAULT_PRINFO(0xffffffffffffff9c, 0x84, 0x72, &(0x7f0000f31000-0xc)={0x0, 0xffff}, &(0x7f0000500000)=0xc) setsockopt$inet_sctp6_SCTP_MAX_BURST(r0, 0x84, 0x14, &(0x7f0000456000-0x8)=@assoc_value={r1, 0x2}, 0x8) r2 = syz_open_dev$mice(&(0x7f00007ae000-0x10)='/dev/input/mice\x00', 0x0, 0x80) clock_gettime(0x0, &(0x7f0000e45000)={0x0, 0x0}) ppoll(&(0x7f00005bf000-0x30)=[{0xffffffffffffffff, 0x4}, {0xffffffffffffffff, 0x410}, {r2, 0x2004}, {r2, 0x1f}, {0xffffffffffffffff, 0x80}, {0xffffffffffffffff, 0xa0}], 0x6, &(0x7f0000db7000-0x8)={r3, r4+10000000}, &(0x7f0000bf9000-0x8)={0xffffffffffffff7f}, 0x8) 2018/02/10 14:10:17 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) fcntl$getown(0xffffffffffffffff, 0x9) getpgrp(0xffffffffffffffff) r0 = getpgrp(0xffffffffffffffff) sched_setaffinity(r0, 0x8, &(0x7f0000c65000)) mmap(&(0x7f0000000000/0x19000)=nil, 0x19000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r1 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000924000-0xc)='/dev/rfkill\x00', 0x0, 0x0) r2 = userfaultfd(0x0) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000e54000-0x18)={0xaa}) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000008000-0x20)={{&(0x7f0000000000/0x4000)=nil, 0x4000}, 0x1}) readv(r1, &(0x7f00001f3000-0x10)=[{&(0x7f0000002000-0x4e)=""/1, 0x1}], 0x1) ioctl$RNDADDTOENTCNT(r1, 0x40045201, &(0x7f0000b27000)) ioctl$RNDADDTOENTCNT(r1, 0x40045201, &(0x7f0000a81000)) ioctl$UFFDIO_UNREGISTER(r2, 0xc020aa04, &(0x7f0000008000-0x4)={&(0x7f0000000000/0x2000)=nil, 0x2000}) [ 75.563909] binder: 12428:12434 Acquire 1 refcount change on invalid ref 0 ret -22 [ 75.571728] binder: 12428:12434 unknown command 0 [ 75.579627] binder: 12430:12436 unknown command 0 [ 75.585317] binder: 12430:12436 ioctl c0306201 2000a000 returned -22 [ 75.589464] binder: 12428:12434 ioctl c0306201 2000a000 returned -22 [ 75.618854] binder: 12428:12442 unknown command 0 [ 75.629820] binder: BINDER_SET_CONTEXT_MGR already set [ 75.635259] binder: 12428:12442 ioctl c0306201 2000a000 returned -22 [ 75.642796] binder: 12430:12436 ioctl 40046207 0 returned -16 [ 75.649317] binder: 12430:12449 unknown command 0 [ 75.656404] binder: 12430:12449 ioctl c0306201 2000a000 returned -22 [ 75.674897] binder_alloc: binder_alloc_mmap_handler: 12430 20000000-20002000 already mapped failed -16 [ 75.684510] can: request_module (can-proto-4) failed. [ 75.691259] binder_alloc: 12430: binder_alloc_buf, no vma [ 75.697059] binder: 12430:12436 transaction failed 29189/-3, size 56-8 line 2957 [ 75.719867] binder: undelivered TRANSACTION_ERROR: 29189 2018/02/10 14:10:17 executing program 3: mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f0000001000-0x8)='./file0\x00', 0x13a) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) finit_module(r0, &(0x7f0000000000)=')#,\x00', 0x3) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) sendmsg$alg(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000443000-0x40)=[{&(0x7f000096b000-0xa7)="992ba0ed88c9a594959dfac34e62a5bb343d1bd2ba315e6b4db2b62f737b8974f48850cad9e474c8326c94fb203d3c1b3fad7c7cf18ea3af9b713c0312f88a519a9bbb464e626dc0fc9d904317a47e8b28282d445b1295ce07621686374bbbe1c762673d71b284f2104ff3b8592f6b534ce38f6fb9cdc973f8eb1924ccb07a37a4974c42cc4d7707335adf4581facc2cfe0052d2c3f19d3dd350ee7ff03166a73aa812c70b65a0", 0xa7}, {&(0x7f0000001000-0x96)="a5667680bbf1e6f8307d42f65748e4c00021359fb054509464aea5ae5b3b8d6cc5711616a0b53b6e6f99e16b7c6463dd54b7fdb4cc874575a9ce3b61a8d89c43f3e0c9c433b05a45b187431d2a6851bd68cfddb0b2d031781aa10a78e8d4e179f7fa2917623aba8bcea7ee265a429e13b83640f010dee1efd8f8312d8257acb060f99159f11908bc2ba389bf87d183c00181953ed659", 0x96}, {&(0x7f0000001000-0x62)="f12588c51cbfeac050ef1bb7a56fface104d72157238bf0e3714aedc738d363e7c76c13ceedde00844b871f4e601ac1edaa608a3def728ba2dd80c9fad0cf41560a1aa54ca13896763991680220934a69a55d32bf8b7bdc942b60948c5b64bb87fa2", 0x62}, {&(0x7f0000f89000-0x2)="875e", 0x2}, {&(0x7f0000000000)="7b591eaf61e7515f2b63cbe1728fdd166e3faf842bfbe0ce240711f4d45a89fcc3b70b5c2108", 0x26}, {&(0x7f00007f8000-0x72)="e88095a1ef2bd14b0532fc56993ea9547dd530f9b8434bb7989edbcda1da822d2c92aa5591081481a62155e58142afe7537e73cc5b0a13c26b36dda15911f5ddd51b9fe8763096bd94782a901a7d393b2b89315beba8bbdd5da7bdbc803f10f1234abf61dcff6beb343f3cad75431216f692", 0x72}, {&(0x7f0000001000-0xd0)="89bd31b7cc6683ecf1dca4814b04906c0b10c17818f3f44b53e6690ed1f984f133a635b77852d49195824ad85bcade8a6ea229e01b136767aa54fd2e51bb8f879ca5bd4c546524021ee065e38fca31442a98ebcf7743e5f170fb655b5a85531a96298d784fafc9e9c538c656ced236ca4dd6089053a5ac0ef33b9b3f58500e5958d451dc761873bb5454c122d290301e9751de1cd55f32c9c5bb44863f2cfe223985222dbc4079516644e095993f29c12b18348134175b3e1e138adbd3d3fe6bc98ae15606b6e2603ba413d87b00b96f", 0xd0}, {&(0x7f0000000000)="70289693118a0f82589b1221f8557f47173206c371feda29260a64b5faebb19c4a0444a27e8f71e8201c965485fca57c53f3c5e6270a0b28857369a46b3729b2f67ee527ab6772293a2aeaaea92379af58e3042934d6420603260748e05695b109abc6aa9d3f767ce48a665bf2632a61b0513dc124ab5d57b3adb41062c17d3715b5131ed686d4dd5dda7eb6400a238f857bfaa04d6ef3929902c9dbd2176b5857f3825bb91ec802edacddd3f0b400b80ed2841a92e9a7346eb0b004ad9e6566dd7b0dd2d577cb56782a86f1c24a95d99ea2e8d30d80fbd2f7aca1776718f030449f74a60b8ec0bc159847718c0085e15f7b271f90a267f14113aef0f586c2242bbef45510ff9cd53eb8c5cb1e02d6d7dbe3111629b2793a53a4a0441d4eeebdf16cafdcf46ab71e74dda30291c78c8b1f7731d64dd4217afca1c2b7a96b7de72c3a474459f466163c47de9f810d913ba7d35401c694dda2bff7bf62d9393ef6e9940f8e5a8fc1ebc2e084af069cd7d4c2fbcf106aff1b75e7cfbfa5989fd96d74c648d0b1ab2658d883377242198de3ba02a7efc258d1d96dc9e68f77b9231683d1cee1095b3fec168a3570118a90bd2de88904a6927a93e1771a80fcd1d0131f767dd918c03a63c4f54d55c1faf3cb8ae09aed37b8069588bd551fdc92c1d9be9013e43869db80251142cb04df679ffa2d64ac6d615d92f3dfe61d7a1d542a8d6e6e63bbd0fbb8ff9a6b8342d1fcda98e712481632d12c055c4f16aa3ad73609a5a8cc5bb0f2a63975de26674b0b2f3742d2f3bc8a04f6473509bc3712fba4e65d95446128a8f478686a4d99ff7234ca8d76ec57326f67cfab45d842242001633d67658bd516363dd218b8b858815628ef58818c35b8e8f526957e9ab73921d8069e4ea0dbe73c927d2345a23d1c2c6139ad70dbbdd4accb4127a2aa6bcb8362a029525734810b0358788fb2f1697bfa88fb03b84b6243121ed215c6a63b9968f39327441c0e5e1d47d30ce3263380655d37a1847618ed107905af163e3109819efe70730c9664700773962a00214754b93160522bfb7483efed15e37038bf937c891ecb35644a3ed1b3d6d27ad662fd1189014c62056969b09e1922a737da55a5b9e7bfe2894a578c4e1160401476d8f278b64d5782e952dbed453f587b4fceabe9de827d46198f8fa695bcbcf35b1f0e7d26e7c919e90727585fd35c249ef2bee286ebf407ae1f947763da19fbfbe47454901804106adade173506a71672c2d8cc4ceb44542dc699292746274358990addeb22c156e4dd5435cdb01f254867a87d076541d310f3aae1a9af3ba67357b6a2efe735d74102c3ba52c9f1e853100a1656937a36242397cdd9b29e7bfd953804fd265f91f62edced6bacbc93a746ad2de94caacef07147ec47c9a422ec0b288ec0c945e5042e5696eb504d16a519239a3abb921711feb85ffe9f732d66a81d812fb145c846c25951afa7a28df5d87aeaa1c286c6c95fb70560131672c2bbef92f19fc6771107adab2aa32219d306ebd6b01f28d8a8fb95a7f224a7f8757d33575640e00f3af975ac20b310e781c98e7138f7e281198473aa9a31d036bc850507f9b8bd210d0b6eab219eb24f04a18d41b0400aab4ae0b8057f8112d74db595cb89d6f03b9b62cf55603942cb2ab62e4e3e14cab6ce4c48a2cfcc2354efd6dd95d539d5a8a2bc398224cdd03c0ab0bf1b2dc5fe6b15131b7b73ab4a471143688ba38c4b622c4bb9156790ebc054043486a5d90d9b237452228fa9c8e9f5e1f41e08a62056993299ea96b39527848d347ae5f54b50e95ca7e649ddb9c9112d152752861dd52a2fd1ce26a5da0d96593b44c54bc0a3e68e966535d6da22f353101c6f18da73d64365661c9e451ff360b96006fd362be8187a43d52ac56a6e8c374b29dc1a9c5b98e9aa8a625d668bf20652238ca42b4e0bac4c7f9b8973e592528fbd9bfc4cebc9238ccd4269ab8c613fecc7db4207789959800c61b22827f719438e07c3f4fd26cdfd44d7fd61a5f99f734e061d09cb2b0965121d2c9deb38345535082eb4bdf6a4a8752bf0c146aeb86380c94183c837339c5d3dc8cb217e054f3332d66845f42b51821ac1bd09e90fb577e7e07928c574e05b8fd344595ee11fa8672ff27978a91fd3afce11509d5ffb834a79314a4414429ad159087f3a2f24621acd8c53ac17faaf3ac50dd91b436bbaccbd41f9c1fcaa80c520d8a2ce5e396a25ddb6d2c27b0212f1698269a181f9681ae6cbe51e2fad30c0c0312b1cee7a2a4be33a593eaf669422416a8491277206bbf32c9b14f7e749fd8fc30ea87335046854ebeea75d5bf321297f4c607df4524361c6aba2cf83a0e3b42b667cf4308c8d53530e264584232e7b852f13ceca62b7df6cf092cdbf22eccf72ded950f6b32f16570341d72a182305ae667aa96c4c188a473831a13ed94662ad464bb5b21c3deb4e8f36e3553b0f8ccd6caec0b5903edd2149fef9aad294f10f739eb5988c67237cdbf81bd51a9e5afdfa88ac2034731dfe3ec11a78ecf603bee72e32343459f31ced83c738106a0e63b93e555cea6085e2a06e288aa5fa82d65042a7e6f7062fe98db3d6643a6c8574dcd654031378c1012a24e50babdada5e635dbf8aa0897180fe7e09c660c5e844be6096d370759ccd970124f8434dec539799b87af823901e5c6ce21e8c240a261d4aed3981c40c3a79840d9231ce441cd25c7cec0c2db738091108ec21e602a88c20ddfb2ec2b83b6c896a1aafe899e912675ef7a67d543a04d93c572280525b65e52c7382585a6462af8d57c5a296ea40b90a6608496475115cbd6e8042f1ee0f85387c8d5e4464e8e8b6efb7ed37b4c586f24fbc5432db4717fc3e81cff597081211049ea971eea7e55d2df3473b46362edde2286227daf5e26a90a4ddb84a6ca092b3fe75ddbb5421202475d93630e2be8e898ec1c9cbd6cbbfaaa567b78bc05ff81eced77f58af029332f30eb0ded3bef6fd6b436b3a79d443b8ba7aeb2bfcc25943d419bbbbc412c1a498bace687fed84f8ee3d01ef79aefbd433095ac56fdb047346b5658adf591663e3adfcadf47b84585e5e7bdefdf5861f839b50aebd5455e506f3f89c5639be39ade2172ec57b9a074611fd127a1bf0fe3df1521d7b39d965b29aaaef4efcc18654b2436103d91a30dcd643480cbf0b8179ee21e24abead5ca9690f1017e0df5e51356e576a03b6c409e1b2538a2d6cda1d337366c7935055069bc0226d14d71e2a5042d4715909c533b500742f7f107650f8f5a2c0df9b2afab2a9600c962143d6068afe962152aef1eac46cf237775c3402a6a3dfa3741fc76ce212c9d075923e97772b2a76f78486f1545a50cad7add04e0cab6780de2a708842a9fc944d30afbe38d3592ff78d9cc736a83f8c4bd10fa71e88a7d54a6f597320a25ea239a1ceb5e0ab0816c1fc79769ff23db6bd51cf6922d983487f97d1205fa603e20032f95efab40c7ddef56f7773f71b60001efe9627d68e5b4f0b7ce3de94139f14334c2944eab634b3d28943b8065c311a4eaa5fd861acf1129cf5e811bdcd19513d50bd0bf43fc7aaba8961a1192120cc014454defa7847ffe487c21d1edcf4471cc2b71c86ce268af7d35ad6c5fcaa6bf99e7daca7b99ecd8b1d8e196324bdd6d518e7e2355bcb45a3735f27bbbcc904a286c7f49984ce9edf0d364eac54a8262f4a6bb66c2ad1f23074fa472929c50ff761342f803e3c7a962df7e0fb40adf8caf50c9542da4462078d9863378c6724f10d6709a473ebe3f60379838bca60b1c1aa45d70046355ed930223ff76d1d4cde098641a00a003590d4f8ce4ef4d0e8b1607f48f5977a46eadb3c5ad97b479bbbace589f77765c0b30f2a33380adc0498d9cdfea6c412543d487ed258420f73483da7efb3c5bba7fa88efcd975f7394fefba70cccdd304971fa71c70eb25439d5d8a16bc84895acb1ad82fef852e0597ae35c82a375134f46f684d5973accf3850d15d498bfa78c3d917d4a24c1bd30c0abe2dfb080d3cea96261d626222f3e4fc439c92df30927ef0d826f3f9b9c2855d8f41f5f9d3a93a8c1bf89d8d9c1834462bdd27eff7a27f8cc341db53d00e43948a308a1d94701ad4b2d6c107a502348c2eaae5622756f5db937f86fcdaeaafaf797669fc6c59ad4e0c7e575c242bce5c351e9b6a4bb552645123408c7e3af8b7680b16b160284bc8128531e19cc7eb9006d2aaf7576a5b6731de5576dc8774a7ae5b9e2276ef35c7b46d373c455ad133ff755a57b0e82aeb1682030fb7cb142fd1d52f7ca86b8207027e20a4e1dc563671d8090155cc81a915a17caf1b3863333d3557845278a1b292179195952fe58100a3210ffc51ecc29d419e9374f003faf51008acc737a15804a83a755db0bdb2083438ba1936fc492731ea43f746c8f0dd02e09f49ec4b050af9c9060689d6ca9b7ef97a79c1f1b6adede66cd21dd46fb7e44a0a48a72fa53a2f9195fa9f983b7f44bc13fa6d31f3b659090cd51263b2fa5200a216719e2bce1f2b539d15031c2eb31ea6e64a5a70a2f733a1de97106507abd138896ecc9218c3c5dced6da11bfa500f0a79099b2b3622493cc119773c696b005f4d77d324fd65472be91b984b183892dce0a65f6d6fed19dd47616575917f89cdbdae8b2d0f05f8e4e475abac83ebd5df800178c183f76d6db36cf25e3af12180a5b47a356ec3392118c6f3318bdcbccdd06da9a455c5a83f55eebd8250eb0f7235402664afc2d5cf8ab973de69e05c546736e02044de2e21aeada07822c5020bceb046a355a82d1f8794945307998769ea15072334fa8ee71b9e280c92c5a65aaf6e315a03f761832c0a6ea5bd016034831c703779ec7bad6906aa56596a4cc950e503580128bb3bf0ca0eb75f9d21414485727652b218e5161272926e14acf25020c666694084dfba02ed3c423f8bd8eaf8fb8fe3e417a5eb31022b5c847da37a93ee4df20729ee4ef5a5a5e74ecd27a6335376948452220698cb01c172350f268df46bebc7394e0905bdaa942cd9c5731012dc504f92771fed3d13a7aaad45f7dbc99b56b5d8fa35af0cf930d5e888eb012bac03c43a05a89d6e918d2a0f23bd06255e119d01fd9a2712acf7ab42c06a502b3cf6b2c28d8a9ed945a3896d04cfe94de2ae6583000df4d412403bc667d840595c44d2573857fac7d1985f1de9d29bc7993ac6801417012f38afc3c5a2ac8c20ceab928ad6833ff563c5b5be377c346474efa451d96e26b8a29a921455f05d2e3a99fb6cb282c9baebba302c7b2d8f9a8d601bc81f7eeced1e01579f16b451d774545fad56ed9e72a5208c49d4700a9e25af857a1235836c716008a86810bc87a4a70b03ff00a2b89ff7e7f0e3a9446f1195cfd7ef4719a4e9c4d0291b5980fea7532f6917e5197ac546756563243fb22ba0262c7fe4c0f93773b6a5165f82f70fbd9ff2aa13bceb665431252600ce3629115ae0232140d886da2ff6efda0c63953b3b6a495effacb41c7169006ee58d2a32ffa7b703364b5d318958ed0638bac1ea0bd3367cf0530f1371bc7c2c5275c81f8e03600f5b3c53ae452cee477c402d6ed305d5f2c4838023bf360af2d2f0d0818152158ff70e6f44121a157e5c54b9530dd600770e9eeb77acadd306370083e2b71af447171cb27541aa068024a2cf77ff02d3bda6f97fd3b7b23e84f5abdb7bb5d2c9615c342fa690c0dce0f04208122b32d318efd9c5dbacc1f94d240498cd624704b91f6a183d2929357", 0x1000}], 0x8, &(0x7f000065f000-0x1bc)=[@iv={0xd4, 0x117, 0x2, 0xc1, "30e61c2793c1ff767e7d7ff232ad255bcf4d24e505c1fbf960fc7cc07a0f6ec55bbe16a2faa3dd0f906d78e31afb952c2b52168db695444caad737ce6bbfc42a9f90f3f2d6dde685f5c6489635f0c9a40e0f636ec2071b1ed79c576c7943049f2f7decf50c8cfc40187c30618e579e993e4fc0a978d480e799c5993bbfd7dfcb97dad78d9e47cda51ba60d09ffd15717b3b767f905b2e0ff783541edcb4594cb1f8b116d9febc4f032ed60dd4055b20df174e0486236f93555639ff72ff0ef8b51"}, @iv={0xc8, 0x117, 0x2, 0xb8, "c9257cded95f80319d4ecdfa933a96a5ecaa5b4476e069c55f966bff9e554c83d01556531bc73f490f9d1827467f002c2567b5e9e943a14c9ce73fb144859a456b503a92aed9bce13eaeed7bd6a9d8886cb03945bb7853edcb19d7776494ea6ce5afa456f1b79d9f19b1d685c5e54497adc31e277f40ad68ee458595aaab605022fc865da9a8562c3f060d6077a122a88be6c75cb7eb57c6e8cc9c1e0b656696b1bd29d6203a6455b889d67cda99cf52ee3bfdf71a17a6d1"}, @op={0x10, 0x117, 0x3}, @op={0x10, 0x117, 0x3}], 0x1bc, 0x4}, 0x4000000) mmap(&(0x7f0000000000/0x37000)=nil, 0x37000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000017000)={&(0x7f0000003000-0xc)={0x10}, 0xc, &(0x7f000000b000)={&(0x7f0000035000)=@ipv4_newroute={0x24, 0x18, 0x20000000021, 0xffffffffffffffff, 0xffffffffffffffff, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfd, 0x1, 0x4}, [@RTA_GATEWAY={0x8, 0x5, @loopback=0x7f000001}]}, 0x24}, 0x1}, 0x0) 2018/02/10 14:10:17 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000b36000-0x11)='/dev/qat_adf_ctl\x00', 0x8800, 0x0) getsockopt$inet_sctp_SCTP_DEFAULT_PRINFO(0xffffffffffffff9c, 0x84, 0x72, &(0x7f0000f31000-0xc)={0x0, 0xffff}, &(0x7f0000500000)=0xc) setsockopt$inet_sctp6_SCTP_MAX_BURST(r0, 0x84, 0x14, &(0x7f0000456000-0x8)=@assoc_value={r1, 0x2}, 0x8) r2 = syz_open_dev$mice(&(0x7f00007ae000-0x10)='/dev/input/mice\x00', 0x0, 0x80) clock_gettime(0x0, &(0x7f0000e45000)={0x0, 0x0}) ppoll(&(0x7f00005bf000-0x30)=[{0xffffffffffffffff, 0x4}, {0xffffffffffffffff, 0x410}, {r2, 0x2004}, {r2, 0x1f}, {0xffffffffffffffff, 0x80}, {0xffffffffffffffff, 0xa0}], 0x6, &(0x7f0000db7000-0x8)={r3, r4+10000000}, &(0x7f0000bf9000-0x8)={0xffffffffffffff7f}, 0x8) 2018/02/10 14:10:17 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f00005d2000-0xd)='/selinux/mls\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000a000)={0x34e, 0x0, &(0x7f00001e5000-0x8)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000006000-0x54)}) openat$rfkill(0xffffffffffffff9c, &(0x7f0000987000)='/dev/rfkill\x00', 0x4002, 0x0) 2018/02/10 14:10:17 executing program 1: mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000003000-0x1d)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) r0 = openat$autofs(0xffffffffffffff9c, &(0x7f0000001000)='/dev/autofs\x00', 0x800, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x7704, 0x0) r1 = socket$pppoe(0x18, 0x1, 0x0) fcntl$lock(r1, 0x5, &(0x7f0000000000)={0x0, 0x3}) mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$KVM_GET_REGS(r0, 0x8090ae81, &(0x7f0000003000-0x90)) mmap(&(0x7f0000003000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000003000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000003000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000003000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000003000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000003000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000003000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000003000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000003000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000003000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000003000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000003000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000003000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000003000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000003000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000003000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000003000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000003000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) getsockopt$inet_sctp_SCTP_ASSOCINFO(r0, 0x84, 0x1, &(0x7f0000002000-0x14)={0x0, 0x3, 0x6, 0xfffffffffffffffd, 0x9, 0x3}, &(0x7f0000002000)=0x14) mmap(&(0x7f0000003000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) 2018/02/10 14:10:17 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000a5000-0x8)) mmap(&(0x7f0000000000/0x19000)=nil, 0x19000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000924000-0xc)='/dev/rfkill\x00', 0x0, 0x0) r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000e54000-0x18)={0xaa}) ioctl$ION_IOC_HEAP_QUERY(r0, 0xc0184908, &(0x7f00002ec000)={0x3, 0x8, 0x0, r0}) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000008000-0x20)={{&(0x7f0000000000/0x4000)=nil, 0x4000}, 0x1}) readv(r0, &(0x7f00001f3000-0x10)=[{&(0x7f0000002000-0x4e)=""/1, 0x1}], 0x1) ioctl$RNDADDTOENTCNT(r0, 0x40045201, &(0x7f0000b27000)) ioctl$RNDADDTOENTCNT(r0, 0x40045201, &(0x7f0000a81000)) ioctl$UFFDIO_UNREGISTER(r1, 0xc020aa04, &(0x7f0000008000-0x4)={&(0x7f0000000000/0x2000)=nil, 0x2000}) 2018/02/10 14:10:17 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000dda000-0x12)='/dev/input/event#\x00', 0x0, 0x0) ioctl$EVIOCGRAB(r1, 0x40044590, &(0x7f0000e95000-0x4)=0xffffffffffffffff) r2 = dup3(r0, r1, 0x80000) ioctl$TIOCGSOFTCAR(r2, 0x5419, &(0x7f0000da0000-0x4)) ioctl$TIOCSBRK(0xffffffffffffffff, 0x40044591) getsockopt$inet_sctp_SCTP_I_WANT_MAPPED_V4_ADDR(r2, 0x84, 0xc, &(0x7f000088c000), &(0x7f0000fc1000)=0x4) socketpair$inet6_udp(0xa, 0x2, 0x0, &(0x7f0000a50000-0x8)) request_key(&(0x7f0000102000)='big_key\x00', &(0x7f0000ad3000)={0x73, 0x79, 0x7a, 0x3}, &(0x7f00006cc000-0x40)='deflate\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', 0xffffffffffffffff) syz_open_dev$amidi(&(0x7f00008d9000+0x678)='/dev/amidi#\x00', 0x2, 0x40) 2018/02/10 14:10:17 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r0, r0, &(0x7f0000049000), 0x3d2) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000008000)={&(0x7f000000f000-0xc)={0x10, 0x34000}, 0xc, &(0x7f0000220000)={&(0x7f00008d6000-0x14)={0x14, 0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, {}, []}, 0x14}, 0x1}, 0x0) r1 = userfaultfd(0x80800) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000ff8000-0x20)={{&(0x7f0000012000/0x2000)=nil, 0x2000}, 0x1}) bpf$MAP_CREATE(0x0, &(0x7f0000fb4000)={0x2, 0x8000000000000004, 0x400, 0x7fd, 0x4, 0xffffffffffffffff}, 0x2c) userfaultfd(0x800) clock_gettime(0x0, &(0x7f0000132000)={0x0, 0x0}) socketpair(0x1d, 0x800, 0x4, &(0x7f0000589000)) r4 = syz_open_dev$mouse(&(0x7f00006eb000)='/dev/input/mouse#\x00', 0xde6e, 0x1) timer_settime(0x0, 0x1, &(0x7f000097e000)={{0x0, r3}, {r2, r3+10000000}}, &(0x7f0000939000)) fanotify_init(0x25, 0x802) r5 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000ef2000-0x1d)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f00002d8000-0xc)={0x0, 0x0}, &(0x7f0000d76000-0x4)=0xc) syz_open_procfs(r6, &(0x7f0000013000)='ns/cgroup\x00') openat$ion(0xffffffffffffff9c, &(0x7f0000dd5000)='/dev/ion\x00', 0x800, 0x0) pipe2(&(0x7f000058c000), 0x4800) setsockopt$inet_IP_XFRM_POLICY(r4, 0x0, 0x11, &(0x7f0000e12000-0xe8)={{{@in6=@mcast1={0xff, 0x1, [], 0x1}, @in=@rand_addr, 0x2, 0xbd, 0x3, 0x20, 0xa, 0xa0, 0x80, 0xbf, 0x0, r7}, {0x0, 0x8, 0x0, 0x3, 0x6, 0x1fa8, 0x0, 0x20}, {0x1719, 0x7fff, 0x7ff, 0x7ff}, 0x1, 0x7, 0x0, 0x1, 0x1, 0x3}, {{@in=@broadcast=0xffffffff, 0x1, 0x7f}, 0xa, @in=@empty, 0xffffffffffffffff, 0x3, 0x0, 0xffffffffffffffbc, 0x20, 0x6, 0x2}}, 0xe8) openat$selinux_policy(0xffffffffffffff9c, &(0x7f000010e000-0x10)='/selinux/policy\x00', 0x0, 0x0) setsockopt$netlink_NETLINK_TX_RING(r5, 0x10e, 0x7, &(0x7f0000ab4000-0x10)={0x6, 0x7, 0x52, 0xfffffffffffffffc}, 0x10) 2018/02/10 14:10:17 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000a000)={0x8, 0x0, &(0x7f00001e5000-0x8)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000006000-0x54)}) r1 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000ddb000-0x15)='/proc/self/net/pfkey\x00', 0x200, 0x0) setsockopt$inet6_dccp_buf(r1, 0x21, 0x2, &(0x7f00000b8000-0x93)="6557e00d4a5d3147b04f2140df83e6c1c119f122e94bbfcbd8256060494542f920e96e22a070168ae4a8cfbc263f6687e207c888bc45b87a2a0185ae05ee0ef879f73e4999850abf3ba832c38432ec8dac52c7f2ca4f941eb8ab472701e95837dcd3aff917a1eea18e994159c21e9dfb5426d515ae42053bff4545f67973de7c8a33c054249e7e7f6673b5a456d6c59e597f9c", 0x93) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000-0x30)={0x44, 0x0, &(0x7f0000d06000)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x38, 0x8, &(0x7f000000d000)=[@fda={0x66646185}, @flat={0x73682a85}], &(0x7f0000006000)=[0x20]}}], 0x0, 0x0, &(0x7f0000176000-0x1)}) [ 75.725451] binder: release 12430:12436 transaction 404 out, still active [ 75.732418] binder: undelivered TRANSACTION_COMPLETE [ 75.737551] binder: send failed reply for transaction 404, target dead 2018/02/10 14:10:17 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$rtc(0xffffffffffffff9c, &(0x7f000006e000)='/dev/rtc\x00', 0x0, 0x0) ioctl$LOOP_SET_STATUS(r0, 0x4c02, &(0x7f0000890000-0x8c)={0x0, 0x0, 0x0, 0x0, 0x40000000000, 0x5, 0x12, 0x4, "8f9570f3155af3e6be0eb366065f260247b67d31129e07f8bbad45ebb651ccc0d7c76ef10019a5ea028e5cd2e071a2b87bead02679a4e5cf2e164e343f9205d9", "abfea4b0f9f9e4e708683c3eb7e2dea8a39893f73648dac73d4794c9b66a8a5d", [0x8000]}) ioctl$EVIOCGUNIQ(r0, 0x80404508, &(0x7f0000276000-0x45)=""/69) renameat(r0, &(0x7f00008af000+0x98d)='./file0\x00', r0, &(0x7f0000675000)='./file0\x00') ioctl$KVM_CREATE_IRQCHIP(r0, 0xae60) ioctl$ASHMEM_GET_NAME(r0, 0x81007702, &(0x7f00003ca000-0xcd)=""/205) ioctl$LOOP_CLR_FD(r0, 0x7001) socket$nl_netfilter(0x10, 0x3, 0xc) [ 75.788380] binder: 12460:12467 Acquire 1 refcount change on invalid ref 0 ret -22 [ 75.796226] binder: 12460:12467 unknown command 0 [ 75.819075] binder: 12460:12467 ioctl c0306201 2000a000 returned -22 [ 75.822318] binder_alloc: binder_alloc_mmap_handler: 12466 20000000-20002000 already mapped failed -16 2018/02/10 14:10:17 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x3a, &(0x7f00003c4000)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa], 0x0, 0x14}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x2c, 0xffffffffffffffff, 0x0, 0x0, 0x88, 0x0, @empty, @multicast1=0xe0000001, {[]}}, @gre={{0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x880b, 0x8, 0x1, [], "89eb6704e39dfda7"}, {0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x800, []}, {0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x86dd, []}}}}}}, &(0x7f0000f27000-0x14)={0x0, 0x3, [0xec4, 0xcbb, 0x6b9]}) r0 = epoll_create1(0x80000) preadv(r0, &(0x7f0000791000-0x28)=[{&(0x7f0000a4b000-0x3e)=""/62, 0x3e}, {&(0x7f0000ff3000-0x1000)=""/4096, 0x1000}, {&(0x7f0000c72000-0xa3)=""/163, 0xa3}, {&(0x7f00009b8000)=""/4096, 0x1000}, {&(0x7f0000286000)=""/83, 0x53}], 0x5, 0x0) 2018/02/10 14:10:17 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000b36000-0x11)='/dev/qat_adf_ctl\x00', 0x8800, 0x0) getsockopt$inet_sctp_SCTP_DEFAULT_PRINFO(0xffffffffffffff9c, 0x84, 0x72, &(0x7f0000f31000-0xc)={0x0, 0xffff}, &(0x7f0000500000)=0xc) r0 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$mice(&(0x7f00007ae000-0x10)='/dev/input/mice\x00', 0x0, 0x80) clock_gettime(0x0, &(0x7f0000e45000)={0x0, 0x0}) ppoll(&(0x7f00005bf000-0x30)=[{r0, 0x4}, {r0, 0x410}, {r1, 0x2004}, {r1, 0x1f}, {r0, 0x80}, {r0, 0xa0}], 0x6, &(0x7f0000db7000-0x8)={r2, r3+10000000}, &(0x7f0000bf9000-0x8)={0xffffffffffffff7f}, 0x8) 2018/02/10 14:10:17 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000a000)={0x34e, 0x0, &(0x7f00001e5000-0x8)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000006000-0x54)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000008000-0x30)={0x0, 0x0, &(0x7f0000d06000)=[], 0x0, 0x0, &(0x7f0000176000-0x1)}) r1 = memfd_create(&(0x7f000022b000-0x2)=',\x00', 0x2) ioctl$SNDRV_CTL_IOCTL_TLV_WRITE(r1, 0xc008551b, &(0x7f000026b000-0x2)={0x1, 0x8, [0x8, 0x1cc]}) ioctl$SNDRV_SEQ_IOCTL_QUERY_NEXT_CLIENT(r1, 0xc0bc5351, &(0x7f0000f26000-0xbc)={0x6, 0x2, 'client1\x00', 0x1, "644b111654b964f3", "8a6001ed58f1f622bd6a76ab000f3173a3002f188737c995693b3a0b99f00110", 0x0, 0x4}) 2018/02/10 14:10:17 executing program 1: ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffff9c, 0x89e2, &(0x7f000042a000-0x4)={0xffffffffffffff9c}) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) getsockopt$bt_sco_SCO_OPTIONS(r0, 0x11, 0x1, &(0x7f0000001000-0xc3)=""/195, &(0x7f0000e0b000)=0xc3) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$TUNSETQUEUE(0xffffffffffffffff, 0x400454d9, &(0x7f0000002000)={@generic="6b0b9e000000071ea9367a030900", @ifru_settings={0x0, 0x4b, @te1=&(0x7f000000c000-0x10)}}) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000003000-0x9)='/dev/rtc\x00', 0x0, 0x0) epoll_ctl$EPOLL_CTL_MOD(0xffffffffffffffff, 0x3, 0xffffffffffffffff, &(0x7f0000002000)) getsockname(0xffffffffffffffff, &(0x7f0000008000-0x8)=@sco, &(0x7f0000002000-0x4)=0x8) openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000121000-0x18)='/selinux/avc/hash_stats\x00', 0x0, 0x0) readv(r1, &(0x7f000025c000)=[{&(0x7f0000430000)=""/150, 0x96}], 0x1) ioctl$sock_inet_tcp_SIOCATMARK(r1, 0x4028700f, &(0x7f0000002000-0x4)) getsockopt$inet6_buf(r1, 0x29, 0x20, &(0x7f0000586000-0xf7)=""/247, &(0x7f0000aea000-0x4)=0xf7) [ 75.835382] can: request_module (can-proto-4) failed. [ 75.842380] binder: BINDER_SET_CONTEXT_MGR already set [ 75.851716] binder: 12460:12467 unknown command 0 [ 75.860091] binder: 12460:12467 ioctl c0306201 2000a000 returned -22 [ 75.867870] binder: 12466:12469 ioctl 40046207 0 returned -16 2018/02/10 14:10:17 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r0, r0, &(0x7f0000049000), 0x3d2) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000008000)={&(0x7f000000f000-0xc)={0x10, 0x34000}, 0xc, &(0x7f0000220000)={&(0x7f00008d6000-0x14)={0x14, 0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, {}, []}, 0x14}, 0x1}, 0x0) r1 = userfaultfd(0x80800) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000ff8000-0x20)={{&(0x7f0000012000/0x2000)=nil, 0x2000}, 0x1}) bpf$MAP_CREATE(0x0, &(0x7f0000fb4000)={0x2, 0x8000000000000004, 0x400, 0x7fd, 0x4, 0xffffffffffffffff}, 0x2c) userfaultfd(0x800) clock_gettime(0x0, &(0x7f0000132000)={0x0, 0x0}) socketpair(0x1d, 0x800, 0x4, &(0x7f0000589000)) r4 = syz_open_dev$mouse(&(0x7f00006eb000)='/dev/input/mouse#\x00', 0xde6e, 0x1) timer_settime(0x0, 0x1, &(0x7f000097e000)={{0x0, r3}, {r2, r3+10000000}}, &(0x7f0000939000)) fanotify_init(0x25, 0x802) r5 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000ef2000-0x1d)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f00002d8000-0xc)={0x0, 0x0}, &(0x7f0000d76000-0x4)=0xc) syz_open_procfs(r6, &(0x7f0000013000)='ns/cgroup\x00') openat$ion(0xffffffffffffff9c, &(0x7f0000dd5000)='/dev/ion\x00', 0x800, 0x0) pipe2(&(0x7f000058c000), 0x4800) setsockopt$inet_IP_XFRM_POLICY(r4, 0x0, 0x11, &(0x7f0000e12000-0xe8)={{{@in6=@mcast1={0xff, 0x1, [], 0x1}, @in=@rand_addr, 0x2, 0xbd, 0x3, 0x20, 0xa, 0xa0, 0x80, 0xbf, 0x0, r7}, {0x0, 0x8, 0x0, 0x3, 0x6, 0x1fa8, 0x8}, {0x1719, 0x7fff, 0x7ff, 0x7ff}, 0x1, 0x7, 0x0, 0x1, 0x1, 0x3}, {{@in=@broadcast=0xffffffff, 0x1, 0x7f}, 0xa, @in=@empty, 0xffffffffffffffff, 0x3, 0x0, 0xffffffffffffffbc, 0x20, 0x6, 0x2}}, 0xe8) openat$selinux_policy(0xffffffffffffff9c, &(0x7f000010e000-0x10)='/selinux/policy\x00', 0x0, 0x0) setsockopt$netlink_NETLINK_TX_RING(r5, 0x10e, 0x7, &(0x7f0000ab4000-0x10)={0x6, 0x7, 0x52, 0xfffffffffffffffc}, 0x10) [ 75.902242] binder: release 12466:12469 transaction 410 out, still active [ 75.909309] binder: undelivered TRANSACTION_COMPLETE [ 75.914508] binder: send failed reply for transaction 410, target dead [ 75.937802] binder: 12492:12498 Acquire 1 refcount change on invalid ref 0 ret -22 [ 75.945634] binder: 12492:12498 unknown command 0 2018/02/10 14:10:18 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000a16000-0x8)={0x0}) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = syz_open_dev$binder(&(0x7f0000005000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000009000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x10, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) r3 = syz_open_dev$mice(&(0x7f00003ea000-0x10)='/dev/input/mice\x00', 0x0, 0x80000) r4 = ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82) ioctl$LOOP_CTL_ADD(r3, 0x4c80, r4) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005000-0x14)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f0000002000)}) ioctl$BINDER_THREAD_EXIT(r1, 0x40046208, 0x0) 2018/02/10 14:10:18 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000b36000-0x11)='/dev/qat_adf_ctl\x00', 0x8800, 0x0) r0 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$mice(&(0x7f00007ae000-0x10)='/dev/input/mice\x00', 0x0, 0x80) clock_gettime(0x0, &(0x7f0000e45000)={0x0, 0x0}) ppoll(&(0x7f00005bf000-0x30)=[{r0, 0x4}, {r0, 0x410}, {r1, 0x2004}, {r1, 0x1f}, {r0, 0x80}, {r0, 0xa0}], 0x6, &(0x7f0000db7000-0x8)={r2, r3+10000000}, &(0x7f0000bf9000-0x8)={0xffffffffffffff7f}, 0x8) 2018/02/10 14:10:18 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$dsp(0xffffffffffffff9c, &(0x7f000000c000)='/dev/dsp\x00', 0x440000, 0x0) ioctl$DRM_IOCTL_VERSION(r0, 0xc0246400, &(0x7f000007a000-0x24)={0xfffffffffffffff7, 0x0, 0x9, 0x8f, &(0x7f0000ce9000)=""/143, 0xf4, &(0x7f00008c2000)=""/244, 0xe0, &(0x7f0000db6000-0xe0)=""/224}) r1 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = openat(0xffffffffffffffff, &(0x7f0000276000)='./file0\x00', 0x480400, 0x80) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffff9c, 0x84, 0x6f, &(0x7f0000235000)={0x0, 0x94, &(0x7f0000c9f000)=[@in={0x2, 0x1, @dev={0xac, 0x14, 0x0, 0xb}}, @in={0x2, 0x1, @dev={0xac, 0x14, 0x0, 0x14}}, @in6={0xa, 0x2, 0xffff, @mcast2={0xff, 0x2, [], 0x1}, 0x9}, @in={0x2, 0x0, @broadcast=0xffffffff}, @in={0x2, 0x0, @broadcast=0xffffffff}, @in6={0xa, 0x3, 0xffffffffffff8000, @local={0xfe, 0x80, [], 0x0, 0xaa}, 0x83}, @in6={0xa, 0x3, 0x1ff, @local={0xfe, 0x80, [], 0x0, 0xaa}, 0x1}]}, &(0x7f0000f19000)=0xc) ioctl$KDADDIO(r0, 0x4b34, 0x80) setsockopt$inet_sctp6_SCTP_RESET_ASSOC(r2, 0x84, 0x78, &(0x7f00005db000-0x4)=r3, 0x4) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000a000)={0x34e, 0x0, &(0x7f00001e5000-0x8)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000006000-0x54)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000-0x30)={0x44, 0x0, &(0x7f0000d06000)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x38, 0x8, &(0x7f000000d000)=[@fda={0x66646185}, @flat={0x73682a85}], &(0x7f0000006000)=[0x20]}}], 0x0, 0x0, &(0x7f0000176000-0x1)}) 2018/02/10 14:10:18 executing program 1: mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$adsp(&(0x7f0000000000)='/dev/adsp#\x00', 0x7, 0x240) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) getsockopt$inet_sctp_SCTP_DELAYED_SACK(0xffffffffffffff9c, 0x84, 0x10, &(0x7f0000001000-0xc)=@sack_info={0x0, 0x2, 0x5bea1cda}, &(0x7f0000001000-0x4)=0xc) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) getsockopt$inet_sctp_SCTP_LOCAL_AUTH_CHUNKS(r0, 0x84, 0x1b, &(0x7f0000000000)={r1, 0x3, "95f438"}, &(0x7f0000ca2000-0x4)=0xb) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r2 = socket$inet6(0xa, 0x80003, 0xef) setsockopt$inet6_IPV6_ADDRFORM(r2, 0x29, 0x1, &(0x7f000055d000)=0x2, 0x4) 2018/02/10 14:10:18 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x19000)=nil, 0x19000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000924000-0xc)='/dev/rfkill\x00', 0x0, 0x0) r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000e54000-0x18)={0xaa}) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000008000-0x20)={{&(0x7f0000000000/0x4000)=nil, 0x4000}, 0x1}) readv(r0, &(0x7f00001f3000-0x10)=[{&(0x7f0000002000-0x4e)=""/1, 0x1}], 0x1) ioctl$RNDADDTOENTCNT(r0, 0x40045201, &(0x7f0000b27000)) ioctl$RNDADDTOENTCNT(r0, 0x40045201, &(0x7f0000a81000)) ioctl$UFFDIO_UNREGISTER(r1, 0xc020aa04, &(0x7f0000008000-0x4)={&(0x7f0000000000/0x2000)=nil, 0x2000}) r2 = add_key$keyring(&(0x7f0000df4000-0x8)='keyring\x00', &(0x7f0000f92000-0x5)={0x73, 0x79, 0x7a, 0x0}, 0x0, 0x0, 0xfffffffffffffffd) r3 = add_key$keyring(&(0x7f0000b30000)='keyring\x00', &(0x7f00005a3000)={0x73, 0x79, 0x7a, 0x1}, 0x0, 0x0, 0xffffffffffffffff) ioctl$sock_bt_hidp_HIDPCONNADD(r0, 0x400448c8, &(0x7f00005a8000-0x87)={r0, r1, 0x8, 0xff, &(0x7f0000b90000)="635896381030c2d27c8b", 0x120000000, 0x7, 0x7ff, 0x1000, 0x9, 0x100000000, 0x101, "79ccde43cf2595702fc830a983bf2895ac77e67b0dfd7b94da530c342459dcb923bf2682f977065243143957f78bc7145f47f43afa9f345530d4103c9d5bc8150f7888805251f52db5a67ec75d2cd180f19d202b543ef9997d773e61053bd2ea786d6374ba5855"}) keyctl$reject(0x13, r2, 0x100000001, 0x8, r3) 2018/02/10 14:10:18 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$evdev(&(0x7f0000be0000)='/dev/input/event#\x00', 0x0, 0x3ffffffffffe) ioctl$EVIOCGRAB(r0, 0x40044590, &(0x7f0000e95000-0x4)) ioctl$TIOCSBRK(0xffffffffffffffff, 0x40044591) r1 = syz_open_dev$sndmidi(&(0x7f0000426000)='/dev/snd/midiC#D#\x00', 0x8, 0x82000) setsockopt$inet6_udp_int(r1, 0x11, 0x1, &(0x7f0000fae000-0x4)=0xa4, 0x4) r2 = syz_open_dev$amidi(&(0x7f00006ef000-0xc)='/dev/amidi#\x00', 0x7fff, 0x1) ioctl$LOOP_GET_STATUS64(r2, 0x4c05, &(0x7f00000ad000-0xe0)) request_key(&(0x7f0000102000)='big_key\x00', &(0x7f0000ad3000)={0x73, 0x79, 0x7a, 0x3}, &(0x7f00006cc000-0x40)='deflate\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', 0xffffffffffffffff) 2018/02/10 14:10:18 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r0, r0, &(0x7f0000049000), 0x3d2) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000008000)={&(0x7f000000f000-0xc)={0x10, 0x34000}, 0xc, &(0x7f0000220000)={&(0x7f00008d6000-0x14)={0x14, 0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, {}, []}, 0x14}, 0x1}, 0x0) r1 = userfaultfd(0x80800) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000ff8000-0x20)={{&(0x7f0000012000/0x2000)=nil, 0x2000}, 0x1}) bpf$MAP_CREATE(0x0, &(0x7f0000fb4000)={0x2, 0x8000000000000004, 0x400, 0x7fd, 0x4, 0xffffffffffffffff}, 0x2c) userfaultfd(0x800) clock_gettime(0x0, &(0x7f0000132000)={0x0, 0x0}) socketpair(0x1d, 0x800, 0x4, &(0x7f0000589000)) r4 = syz_open_dev$mouse(&(0x7f00006eb000)='/dev/input/mouse#\x00', 0xde6e, 0x1) timer_settime(0x0, 0x1, &(0x7f000097e000)={{0x0, r3}, {r2, r3+10000000}}, &(0x7f0000939000)) fanotify_init(0x25, 0x802) r5 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000ef2000-0x1d)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f00002d8000-0xc)={0x0, 0x0}, &(0x7f0000d76000-0x4)=0xc) syz_open_procfs(r6, &(0x7f0000013000)='ns/cgroup\x00') openat$ion(0xffffffffffffff9c, &(0x7f0000dd5000)='/dev/ion\x00', 0x800, 0x0) pipe2(&(0x7f000058c000), 0x4800) setsockopt$inet_IP_XFRM_POLICY(r4, 0x0, 0x11, &(0x7f0000e12000-0xe8)={{{@in6=@mcast1={0xff, 0x1, [], 0x1}, @in=@rand_addr, 0x2, 0xbd, 0x3, 0x20, 0xa, 0xa0, 0x80, 0xbf, 0x0, r7}, {0x0, 0x8, 0x0, 0x3, 0x6, 0x1fa8, 0x8}, {0x1719, 0x7fff, 0x7ff, 0x7ff}, 0x1, 0x7, 0x0, 0x1, 0x1, 0x3}, {{@in=@broadcast=0xffffffff, 0x1, 0x7f}, 0xa, @in=@empty, 0xffffffffffffffff, 0x3, 0x0, 0xffffffffffffffbc, 0x20, 0x6, 0x2}}, 0xe8) openat$selinux_policy(0xffffffffffffff9c, &(0x7f000010e000-0x10)='/selinux/policy\x00', 0x0, 0x0) setsockopt$netlink_NETLINK_TX_RING(r5, 0x10e, 0x7, &(0x7f0000ab4000-0x10)={0x6, 0x7, 0x52, 0xfffffffffffffffc}, 0x10) 2018/02/10 14:10:18 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000a000)={0x34e, 0x0, &(0x7f00001e5000-0x8)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000006000-0x54)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000-0x30)={0x0, 0x0, &(0x7f0000d06000)=[], 0x0, 0x0, &(0x7f0000911000)}) [ 75.961750] binder: 12492:12498 ioctl c0306201 2000a000 returned -22 [ 75.978735] binder: 12492:12499 Acquire 1 refcount change on invalid ref 0 ret -22 [ 75.984209] can: request_module (can-proto-4) failed. [ 75.986553] binder: 12492:12499 unknown command 0 [ 75.996812] binder: 12492:12499 ioctl c0306201 2000a000 returned -22 2018/02/10 14:10:18 executing program 1: mmap(&(0x7f0000000000/0x2d000)=nil, 0x2d000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000028000-0x9)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) mmap(&(0x7f000002d000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r3 = syz_open_dev$midi(&(0x7f000002e000-0xb)='/dev/midi#\x00', 0xfffffffffffff10d, 0x0) getsockopt$inet_sctp6_SCTP_GET_ASSOC_STATS(0xffffffffffffffff, 0x84, 0x70, &(0x7f0000022000)={0x0, @in6={{0xa, 0x2, 0x2, @local={0xfe, 0x80, [], 0x0, 0xaa}, 0xc0}}, [0x6, 0x2e, 0x1, 0x6, 0x1ff, 0x4, 0x8000, 0x6fade06f, 0x6, 0x0, 0x7, 0x7fffffff, 0x8, 0x7fff, 0x1ff]}, &(0x7f0000017000-0x4)=0x108) mmap(&(0x7f000002e000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) syz_open_dev$sndpcmc(&(0x7f000002e000)='/dev/snd/pcmC#D#c\x00', 0x9, 0x0) mmap(&(0x7f000002d000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f000002d000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) getsockopt$inet_sctp_SCTP_CONTEXT(r3, 0x84, 0x11, &(0x7f000002e000-0x8)={r4, 0x8001}, &(0x7f000002d000)=0x8) ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f000002b000-0x18)={0x1, 0x0, [{0x26a}]}) [ 76.047294] binder: 12510:12515 Acquire 1 refcount change on invalid ref 0 ret -22 [ 76.055148] binder: 12510:12515 unknown command 0 [ 76.075771] binder: 12506:12517 unknown command 0 [ 76.087627] binder: BINDER_SET_CONTEXT_MGR already set 2018/02/10 14:10:18 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$mice(&(0x7f00007ae000-0x10)='/dev/input/mice\x00', 0x0, 0x80) clock_gettime(0x0, &(0x7f0000e45000)={0x0, 0x0}) ppoll(&(0x7f00005bf000-0x30)=[{r0, 0x4}, {r0, 0x410}, {r1, 0x2004}, {r1, 0x1f}, {r0, 0x80}, {r0, 0xa0}], 0x6, &(0x7f0000db7000-0x8)={r2, r3+10000000}, &(0x7f0000bf9000-0x8)={0xffffffffffffff7f}, 0x8) [ 76.093321] binder: 12506:12517 ioctl c0306201 2000a000 returned -22 [ 76.094102] binder: 12507:12512 ioctl 40046207 0 returned -16 [ 76.100870] binder: 12510:12515 ioctl c0306201 2000a000 returned -22 [ 76.118793] binder: undelivered TRANSACTION_COMPLETE [ 76.131084] binder: 12510:12527 unknown command 0 [ 76.136544] binder_alloc: binder_alloc_mmap_handler: 12506 20000000-20002000 already mapped failed -16 2018/02/10 14:10:18 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000a5000-0x8)) mmap(&(0x7f0000000000/0x19000)=nil, 0x19000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000924000-0xc)='/dev/rfkill\x00', 0x0, 0x0) r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000e54000-0x18)={0xaa}) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000008000-0x20)={{&(0x7f0000000000/0x4000)=nil, 0x4000}, 0x1}) readv(r0, &(0x7f00001f3000-0x10)=[{&(0x7f0000002000-0x4e)=""/1, 0x1}], 0x1) getsockopt$packet_int(r0, 0x107, 0x13, &(0x7f000067c000-0x4), &(0x7f000074a000)=0x4) write$selinux_user(r0, &(0x7f000002d000)={'system_u:object_r:ptmx_t:s0', 0x20, 'unconfined_u\x00'}, 0x29) ioctl$RNDADDTOENTCNT(r0, 0x40045201, &(0x7f0000b27000)) ioctl$RNDADDTOENTCNT(r0, 0x40045201, &(0x7f0000a81000)) ioctl$UFFDIO_UNREGISTER(r1, 0xc020aa04, &(0x7f0000008000-0x4)={&(0x7f0000000000/0x2000)=nil, 0x2000}) [ 76.146393] binder: 12510:12527 ioctl c0306201 2000a000 returned -22 [ 76.153361] can: request_module (can-proto-4) failed. [ 76.171106] binder: BINDER_SET_CONTEXT_MGR already set [ 76.187293] binder: 12506:12517 ioctl 40046207 0 returned -16 [ 76.193137] binder: 12506:12536 unknown command 0 2018/02/10 14:10:18 executing program 0: r0 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$mice(&(0x7f00007ae000-0x10)='/dev/input/mice\x00', 0x0, 0x80) clock_gettime(0x0, &(0x7f0000e45000)={0x0, 0x0}) ppoll(&(0x7f00005bf000-0x30)=[{r0, 0x4}, {r0, 0x410}, {r1, 0x2004}, {r1, 0x1f}, {r0, 0x80}, {r0, 0xa0}], 0x6, &(0x7f0000db7000-0x8)={r2, r3+10000000}, &(0x7f0000bf9000-0x8)={0xffffffffffffff7f}, 0x8) 2018/02/10 14:10:18 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000a000)={0x8, 0x0, &(0x7f00001e5000-0x8)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000540000)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000008000-0x30)={0x0, 0x0, &(0x7f0000d06000)=[], 0x0, 0x0, &(0x7f0000176000-0x1)}) open$dir(&(0x7f000050f000+0x23c)='./file0\x00', 0x260080, 0x20) 2018/02/10 14:10:18 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r0, r0, &(0x7f0000049000), 0x3d2) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000008000)={&(0x7f000000f000-0xc)={0x10, 0x34000}, 0xc, &(0x7f0000220000)={&(0x7f00008d6000-0x14)={0x14, 0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, {}, []}, 0x14}, 0x1}, 0x0) r1 = userfaultfd(0x80800) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000ff8000-0x20)={{&(0x7f0000012000/0x2000)=nil, 0x2000}, 0x1}) bpf$MAP_CREATE(0x0, &(0x7f0000fb4000)={0x2, 0x8000000000000004, 0x400, 0x7fd, 0x4, 0xffffffffffffffff}, 0x2c) userfaultfd(0x800) clock_gettime(0x0, &(0x7f0000132000)={0x0, 0x0}) socketpair(0x1d, 0x800, 0x4, &(0x7f0000589000)) r4 = syz_open_dev$mouse(&(0x7f00006eb000)='/dev/input/mouse#\x00', 0xde6e, 0x1) timer_settime(0x0, 0x1, &(0x7f000097e000)={{0x0, r3}, {r2, r3+10000000}}, &(0x7f0000939000)) fanotify_init(0x25, 0x802) r5 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000ef2000-0x1d)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f00002d8000-0xc)={0x0, 0x0}, &(0x7f0000d76000-0x4)=0xc) syz_open_procfs(r6, &(0x7f0000013000)='ns/cgroup\x00') openat$ion(0xffffffffffffff9c, &(0x7f0000dd5000)='/dev/ion\x00', 0x800, 0x0) pipe2(&(0x7f000058c000), 0x4800) setsockopt$inet_IP_XFRM_POLICY(r4, 0x0, 0x11, &(0x7f0000e12000-0xe8)={{{@in6=@mcast1={0xff, 0x1, [], 0x1}, @in=@rand_addr, 0x2, 0xbd, 0x3, 0x20, 0xa, 0xa0, 0x80, 0xbf, 0x0, r7}, {0x0, 0x8, 0x0, 0x3, 0x6, 0x1fa8, 0x8}, {0x1719, 0x7fff, 0x7ff, 0x7ff}, 0x1, 0x7, 0x0, 0x1, 0x1, 0x3}, {{@in=@broadcast=0xffffffff, 0x1, 0x7f}, 0xa, @in=@empty, 0xffffffffffffffff, 0x3, 0x0, 0xffffffffffffffbc, 0x20, 0x6, 0x2}}, 0xe8) openat$selinux_policy(0xffffffffffffff9c, &(0x7f000010e000-0x10)='/selinux/policy\x00', 0x0, 0x0) setsockopt$netlink_NETLINK_TX_RING(r5, 0x10e, 0x7, &(0x7f0000ab4000-0x10)={0x6, 0x7, 0x52, 0xfffffffffffffffc}, 0x10) 2018/02/10 14:10:18 executing program 0: r0 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$mice(&(0x7f00007ae000-0x10)='/dev/input/mice\x00', 0x0, 0x80) clock_gettime(0x0, &(0x7f0000e45000)={0x0, 0x0}) ppoll(&(0x7f00005bf000-0x30)=[{r0, 0x4}, {r0, 0x410}, {r1, 0x2004}, {r1, 0x1f}, {r0, 0x80}, {r0, 0xa0}], 0x6, &(0x7f0000db7000-0x8)={r2, r3+10000000}, &(0x7f0000bf9000-0x8)={0xffffffffffffff7f}, 0x8) [ 76.198612] binder: BINDER_SET_CONTEXT_MGR already set [ 76.199992] binder: 12506:12536 ioctl c0306201 2000a000 returned -22 [ 76.209218] binder: 12507:12512 ioctl 40046207 0 returned -16 [ 76.217942] binder_alloc: 12506: binder_alloc_buf, no vma [ 76.223613] binder: 12507:12520 transaction failed 29189/-3, size 0-0 line 2957 2018/02/10 14:10:18 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$adsp(&(0x7f00001b7000-0xb)='/dev/adsp#\x00', 0x4, 0x410000) ioctl$TIOCGSOFTCAR(r0, 0x5419, &(0x7f0000571000)) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX(r0, 0x84, 0x6e, &(0x7f00007e2000-0x6c)=[@in={0x2, 0x0, @empty}, @in6={0xa, 0x1, 0xffff, @remote={0xfe, 0x80, [], 0x0, 0xbb}, 0x5}, @in={0x2, 0x1, @dev={0xac, 0x14, 0x0, 0x17}}, @in={0x2, 0x0, @dev={0xac, 0x14, 0x0, 0x16}}, @in={0x2, 0x2, @multicast1=0xe0000001}, @in={0x2, 0x0, @multicast2=0xe0000002}], 0x6c) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r1, 0x84, 0x64, &(0x7f0000224000-0x2c)=[@in6={0xa, 0x3, 0x0, @empty}], 0x1c) getsockopt$inet6_IPV6_IPSEC_POLICY(r1, 0x29, 0x22, &(0x7f0000774000)={{{@in=@dev, @in6=@ipv4={[], [], @rand_addr}}}, {{@in6=@empty}, 0x0, @in6=@local}}, &(0x7f0000c68000)=0xe8) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f000082a000)={0x0, 0x10, &(0x7f0000728000-0x68)=[@in={0x2, 0x3, @local={0xac, 0x14, 0x0, 0xaa}}]}, &(0x7f00008b7000)=0x10) ioctl$KVM_S390_INTERRUPT_CPU(r0, 0x4010ae94, &(0x7f000014e000-0x10)={0x3, 0x3, 0xffffffffffffffe0}) setsockopt$inet_sctp6_SCTP_RTOINFO(r1, 0x84, 0x0, &(0x7f00006f9000-0x10)={r2, 0x0, 0x4}, 0x10) 2018/02/10 14:10:18 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000a16000-0x8)={0x0}) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = syz_open_dev$binder(&(0x7f0000005000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000009000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x10, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) r3 = syz_open_dev$mice(&(0x7f00003ea000-0x10)='/dev/input/mice\x00', 0x0, 0x80000) r4 = ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82) ioctl$LOOP_CTL_ADD(r3, 0x4c80, r4) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x14, 0x0, &(0x7f0000005000-0x14)=[@acquire_done={0x40486311}], 0x0, 0x0, &(0x7f0000002000)}) ioctl$BINDER_THREAD_EXIT(r1, 0x40046208, 0x0) 2018/02/10 14:10:18 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f00001f3000-0xd)='/selinux/mls\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000f14000)={0x20, 0x0, &(0x7f0000eac000-0x20)=[@exit_looper={0x630d}, @decrefs={0x40046307, 0x1}, @dead_binder_done={0x40086310, 0x4}, @increfs={0x40046304, 0x3}], 0x18, 0x0, &(0x7f00000c3000-0x18)="e509b8299ffa6dbe4cf247dc9a0a6673714b8077598cf891"}) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f000000a000)={0x34e, 0x0, &(0x7f00001e5000-0x8)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000006000-0x54)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000008000-0x30)={0x44, 0x0, &(0x7f0000d06000)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x38, 0x8, &(0x7f000000d000)=[@fda={0x66646185}, @flat={0x73682a85}], &(0x7f0000006000)=[0x20]}}], 0x0, 0x0, &(0x7f0000176000-0x1)}) [ 76.264354] binder: undelivered TRANSACTION_ERROR: 29189 [ 76.275869] binder: release 12506:12517 transaction 416 out, still active [ 76.283037] binder: undelivered TRANSACTION_COMPLETE [ 76.288316] binder: undelivered transaction 415, process died. [ 76.294320] binder: send failed reply for transaction 416, target dead 2018/02/10 14:10:18 executing program 0: r0 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$mice(&(0x7f00007ae000-0x10)='/dev/input/mice\x00', 0x0, 0x80) clock_gettime(0x0, &(0x7f0000e45000)={0x0, 0x0}) ppoll(&(0x7f00005bf000-0x30)=[{r0, 0x4}, {r0, 0x410}, {r1, 0x2004}, {r1, 0x1f}, {r0, 0x80}, {r0, 0xa0}], 0x6, &(0x7f0000db7000-0x8)={r2, r3+10000000}, &(0x7f0000bf9000-0x8)={0xffffffffffffff7f}, 0x8) [ 76.319332] can: request_module (can-proto-4) failed. 2018/02/10 14:10:18 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000a000)={0x8, 0x0, &(0x7f00001e5000-0x8)=[@decrefs={0x40046307, 0x3}], 0x0, 0x0, &(0x7f0000006000-0x54)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000-0x30)={0x44, 0x0, &(0x7f0000d06000)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x38, 0x8, &(0x7f000000d000)=[@fda={0x66646185}, @flat={0x73682a85}], &(0x7f0000006000)=[0x20]}}], 0x0, 0x0, &(0x7f0000176000-0x1)}) openat$cuse(0xffffffffffffff9c, &(0x7f0000263000-0xa)='/dev/cuse\x00', 0x0, 0x0) 2018/02/10 14:10:18 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x2, 0x78, 0xe2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) pipe2(&(0x7f0000fb1000-0x8)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$evdev(r0, &(0x7f00005d8000-0x60)=[{}], 0xffffffffffffff32) r1 = gettid() timer_create(0x0, &(0x7f0000ec5000)={0x0, 0x12, 0x0, @tid}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r1, 0x1000000000016) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000ef4000)={0x3}) [ 76.341766] binder: 12545:12549 Acquire 1 refcount change on invalid ref 0 ret -22 [ 76.373542] binder_alloc: 12557: binder_alloc_buf, no vma [ 76.379242] binder: 12557:12560 transaction failed 29189/-3, size 0-0 line 2957 [ 76.431704] binder: BINDER_SET_CONTEXT_MGR already set [ 76.444007] binder: 12565:12569 ioctl 40046207 0 returned -16 [ 76.455168] binder: 12565:12572 DecRefs 0 refcount change on invalid ref 3 ret -22 [ 76.469521] binder: undelivered TRANSACTION_ERROR: 29189 [ 76.475132] binder_alloc: 12557: binder_alloc_buf, no vma [ 76.480739] binder: 12565:12569 transaction failed 29189/-3, size 56-8 line 2957 [ 76.500908] binder_alloc: binder_alloc_mmap_handler: 12565 20000000-20002000 already mapped failed -16 2018/02/10 14:10:18 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000a5000-0x8)) mmap(&(0x7f0000000000/0x19000)=nil, 0x19000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000924000-0xc)='/dev/rfkill\x00', 0x0, 0x0) r1 = userfaultfd(0x0) ioctl$TUNSETVNETHDRSZ(r0, 0x400454d8, &(0x7f0000585000)=0x2) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000e54000-0x18)={0xaa}) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000008000-0x20)={{&(0x7f0000000000/0x4000)=nil, 0x4000}, 0x1}) getsockopt$inet_sctp_SCTP_RECVNXTINFO(r0, 0x84, 0x21, &(0x7f0000c77000), &(0x7f0000f3c000)=0x4) readv(r0, &(0x7f00001f3000-0x10)=[{&(0x7f0000002000-0x4e)=""/1, 0x1}], 0x1) ioctl$RNDADDTOENTCNT(r0, 0x40045201, &(0x7f0000cf2000)) ioctl$RNDADDTOENTCNT(r0, 0x40045201, &(0x7f0000a81000)) ioctl$UFFDIO_UNREGISTER(r1, 0xc020aa04, &(0x7f0000008000-0x4)={&(0x7f0000000000/0x2000)=nil, 0x2000}) 2018/02/10 14:10:18 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r0, r0, &(0x7f0000049000), 0x3d2) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000008000)={&(0x7f000000f000-0xc)={0x10, 0x34000}, 0xc, &(0x7f0000220000)={&(0x7f00008d6000-0x14)={0x14, 0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, {}, []}, 0x14}, 0x1}, 0x0) r1 = userfaultfd(0x80800) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000ff8000-0x20)={{&(0x7f0000012000/0x2000)=nil, 0x2000}, 0x1}) bpf$MAP_CREATE(0x0, &(0x7f0000fb4000)={0x2, 0x8000000000000004, 0x400, 0x7fd, 0x4, 0xffffffffffffffff}, 0x2c) userfaultfd(0x800) clock_gettime(0x0, &(0x7f0000132000)={0x0, 0x0}) socketpair(0x1d, 0x800, 0x4, &(0x7f0000589000)) r4 = syz_open_dev$mouse(&(0x7f00006eb000)='/dev/input/mouse#\x00', 0xde6e, 0x1) timer_settime(0x0, 0x1, &(0x7f000097e000)={{0x0, r3}, {r2, r3+10000000}}, &(0x7f0000939000)) fanotify_init(0x25, 0x802) r5 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000ef2000-0x1d)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f00002d8000-0xc)={0x0, 0x0}, &(0x7f0000d76000-0x4)=0xc) syz_open_procfs(r6, &(0x7f0000013000)='ns/cgroup\x00') openat$ion(0xffffffffffffff9c, &(0x7f0000dd5000)='/dev/ion\x00', 0x800, 0x0) pipe2(&(0x7f000058c000), 0x4800) setsockopt$inet_IP_XFRM_POLICY(r4, 0x0, 0x11, &(0x7f0000e12000-0xe8)={{{@in6=@mcast1={0xff, 0x1, [], 0x1}, @in=@rand_addr, 0x2, 0xbd, 0x3, 0x20, 0xa, 0xa0, 0x80, 0xbf, 0x0, r7}, {0x0, 0x8, 0x0, 0x3, 0x6, 0x1fa8, 0x8, 0x20}, {0x0, 0x7fff, 0x7ff, 0x7ff}, 0x1, 0x7, 0x0, 0x1, 0x1, 0x3}, {{@in=@broadcast=0xffffffff, 0x1, 0x7f}, 0xa, @in=@empty, 0xffffffffffffffff, 0x3, 0x0, 0xffffffffffffffbc, 0x20, 0x6, 0x2}}, 0xe8) openat$selinux_policy(0xffffffffffffff9c, &(0x7f000010e000-0x10)='/selinux/policy\x00', 0x0, 0x0) setsockopt$netlink_NETLINK_TX_RING(r5, 0x10e, 0x7, &(0x7f0000ab4000-0x10)={0x6, 0x7, 0x52, 0xfffffffffffffffc}, 0x10) 2018/02/10 14:10:18 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x0, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$mice(&(0x7f00007ae000-0x10)='/dev/input/mice\x00', 0x0, 0x80) clock_gettime(0x0, &(0x7f0000e45000)={0x0, 0x0}) ppoll(&(0x7f00005bf000-0x30)=[{r0, 0x4}, {r0, 0x410}, {r1, 0x2004}, {r1, 0x1f}, {r0, 0x80}, {r0, 0xa0}], 0x6, &(0x7f0000db7000-0x8)={r2, r3+10000000}, &(0x7f0000bf9000-0x8)={0xffffffffffffff7f}, 0x8) 2018/02/10 14:10:18 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000a000)={0x34e, 0x0, &(0x7f00001e5000-0x8)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000006000-0x54)}) r1 = syz_open_dev$usbmon(&(0x7f0000243000-0xd)='/dev/usbmon#\x00', 0x4, 0x400000) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffff9c, 0x8933, &(0x7f0000c34000)={'vcan0\x00', 0x0}) bind$can_raw(r1, &(0x7f0000160000)={0x1d, r2}, 0x10) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000008000-0x30)={0x0, 0x0, &(0x7f0000d06000)=[], 0x0, 0x0, &(0x7f0000176000-0x1)}) 2018/02/10 14:10:18 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sg(&(0x7f0000883000-0x9)='/dev/sg#\x00', 0x80, 0x200000) setsockopt$netrom_NETROM_IDLE(r0, 0x103, 0x7, &(0x7f00005e5000)=0xfffffffffffffffc, 0x4) select(0x40, &(0x7f00003fa000-0x40)={0x8, 0x7f, 0x7fff, 0x7, 0x400, 0x4fed, 0x1000, 0x2}, &(0x7f00004a9000)={0x3, 0x8, 0xfffffffffffff8b2, 0xbf, 0x25ad, 0x9, 0x6, 0x6}, &(0x7f0000832000)={0x100000000, 0xae4f, 0x0, 0x733e, 0x69aa3b4a, 0x2, 0x64e, 0x7}, &(0x7f000088c000)={0x0}) waitid(0x2, 0xffffffffffffffff, &(0x7f0000d62000-0x10), 0x80000002, &(0x7f0000bde000-0x48)={{}, {0x0}}) timerfd_settime(r0, 0x0, &(0x7f0000c65000-0x20)={{r1}, {r2}}, &(0x7f0000e5a000)={{0x0}}) nanosleep(&(0x7f00009d5000-0x10)={r3}, &(0x7f0000bda000-0x10)) futex(&(0x7f000062e000-0x4)=0x7, 0x1, 0x400, &(0x7f0000724000-0x8), &(0x7f0000f09000-0x4)=0x8, 0xfffffffffffffffb) seccomp(0x1, 0x0, &(0x7f0000107000)={0x6, &(0x7f00005bf000)=[{0x40, 0x50ec3740, 0x5, 0x4ef}, {0x8, 0x7, 0x81, 0x7ff}, {0x7ff, 0x0, 0x0, 0x6}, {0x82a, 0x7, 0x0, 0x4}, {0x96, 0x9, 0x80, 0x8}, {0x8, 0x10000, 0x9, 0x100}]}) fsetxattr(r0, &(0x7f0000987000)=@known='security.evm\x00', &(0x7f0000773000)='security\x00', 0x9, 0x3) getsockname$netlink(r0, &(0x7f00002dc000-0xc), &(0x7f0000339000-0x4)=0xc) 2018/02/10 14:10:18 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$evdev(&(0x7f0000dda000-0x12)='/dev/input/event#\x00', 0x0, 0x0) ioctl$EVIOCGRAB(r0, 0x40044590, &(0x7f0000e95000-0x4)) ioctl$TIOCSBRK(0xffffffffffffffff, 0x40044591) r1 = accept4$alg(0xffffffffffffffff, 0x0, 0x0, 0x80000) ioctl$sock_inet_SIOCGIFNETMASK(r1, 0x891b, &(0x7f0000189000-0x20)={@syzn={0x73, 0x79, 0x7a, 0x0}, @ifru_flags}) request_key(&(0x7f0000102000)='big_key\x00', &(0x7f0000ad3000)={0x73, 0x79, 0x7a, 0x3}, &(0x7f00006cc000-0x40)='deflate\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', 0xffffffffffffffff) 2018/02/10 14:10:18 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r0, 0xae60) ioctl$KVM_CREATE_VCPU(r0, 0xae41, 0x1) r1 = ioctl$KVM_CREATE_VCPU(r0, 0xae41, 0x0) ioctl$int_in(r0, 0x5421, &(0x7f0000378000)=0x100000001) ioctl$KVM_SET_IRQCHIP(r0, 0x8208ae63, &(0x7f0000ae5000)=@ioapic={0x2}) r2 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f000069e000)='/selinux/enforce\x00', 0x4000, 0x0) setsockopt$kcm_KCM_RECV_DISABLE(r2, 0x119, 0x1, &(0x7f000019b000-0x4)=0x8, 0x4) ioctl$KVM_RUN(r1, 0xae80, 0x0) 2018/02/10 14:10:18 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000a000)={0x34e, 0x0, &(0x7f00001e5000-0x8)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000006000-0x54)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000-0x30)={0x0, 0x0, &(0x7f0000d06000)=[], 0x0, 0x0, &(0x7f0000176000-0x1)}) [ 76.525983] binder: 12565:12572 DecRefs 0 refcount change on invalid ref 3 ret -22 [ 76.542436] binder_alloc: 12565: binder_alloc_buf, no vma [ 76.548058] binder: 12565:12569 transaction failed 29189/-3, size 56-8 line 2957 [ 76.562649] binder: undelivered TRANSACTION_ERROR: 29189 [ 76.568913] binder: undelivered TRANSACTION_ERROR: 29189 2018/02/10 14:10:18 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x0, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$mice(&(0x7f00007ae000-0x10)='/dev/input/mice\x00', 0x0, 0x80) clock_gettime(0x0, &(0x7f0000e45000)={0x0, 0x0}) ppoll(&(0x7f00005bf000-0x30)=[{r0, 0x4}, {r0, 0x410}, {r1, 0x2004}, {r1, 0x1f}, {r0, 0x80}, {r0, 0xa0}], 0x6, &(0x7f0000db7000-0x8)={r2, r3+10000000}, &(0x7f0000bf9000-0x8)={0xffffffffffffff7f}, 0x8) 2018/02/10 14:10:18 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$TUNSETQUEUE(0xffffffffffffffff, 0x400454d9, &(0x7f0000002000)={@generic="6b0b9e000000071ea9367a030900", @ifru_settings={0x0, 0x10001, @te1=&(0x7f000000c000-0x10)}}) r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000003000-0x9)='/dev/rtc\x00', 0x0, 0x0) epoll_ctl$EPOLL_CTL_MOD(0xffffffffffffffff, 0x3, 0xffffffffffffffff, &(0x7f0000002000)) getsockname(0xffffffffffffffff, &(0x7f0000008000-0x8)=@sco, &(0x7f0000002000-0x4)=0x8) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f00002b5000)={@generic="2b1a71e5b4aaf8a2061597f9713c81d2", @ifru_data=&(0x7f0000d33000)="debc675f6682aefd73fd9fd3dfa0aaa5e31f37822aa019d579c50bd889a3c1de"}) fcntl$dupfd(r0, 0x406, r0) ioctl$sock_inet_tcp_SIOCATMARK(r0, 0x4028700f, &(0x7f0000002000-0x4)) [ 76.583713] binder: 12577:12583 Acquire 1 refcount change on invalid ref 0 ret -22 [ 76.591540] binder: 12577:12583 unknown command 0 [ 76.601529] binder: 12577:12583 ioctl c0306201 2000a000 returned -22 [ 76.604985] binder: 12579:12587 unknown command 0 [ 76.622474] binder: 12579:12587 ioctl c0306201 2000a000 returned -22 2018/02/10 14:10:18 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x0, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$mice(&(0x7f00007ae000-0x10)='/dev/input/mice\x00', 0x0, 0x80) clock_gettime(0x0, &(0x7f0000e45000)={0x0, 0x0}) ppoll(&(0x7f00005bf000-0x30)=[{r0, 0x4}, {r0, 0x410}, {r1, 0x2004}, {r1, 0x1f}, {r0, 0x80}, {r0, 0xa0}], 0x6, &(0x7f0000db7000-0x8)={r2, r3+10000000}, &(0x7f0000bf9000-0x8)={0xffffffffffffff7f}, 0x8) 2018/02/10 14:10:18 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000cc8000)={0x0, 0x0, &(0x7f000080f000-0x10)={&(0x7f0000f98000-0xb0)={0x2, 0x7, 0x0, 0x7, 0x12, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, []}, 0x10}, 0x1}, 0x0) r1 = openat$dsp(0xffffffffffffff9c, &(0x7f0000ed1000)='/dev/dsp\x00', 0x200002, 0x0) ioctl$PERF_EVENT_IOC_ID(r0, 0x80082407, &(0x7f0000500000-0x8)) setsockopt$inet6_MRT6_ADD_MFC(r1, 0x29, 0xcc, &(0x7f0000443000)={{0xa, 0x2, 0x1, @dev={0xfe, 0x80, [], 0x0, 0xe}, 0x2}, {0xa, 0x3, 0x20, @dev={0xfe, 0x80, [], 0x0}}, 0x86}, 0x5c) r2 = socket$inet6(0xa, 0x3, 0x80000000000087) setsockopt$inet6_IPV6_XFRM_POLICY(r2, 0x29, 0x23, &(0x7f0000f8b000)={{{@in6=@dev={0xfe, 0x80}, @in=@dev={0xac, 0x14}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xa}, {}, {}, 0x0, 0xffffffffffffffff, 0x1}, {{@in6=@empty, 0xffffffffffffffff, 0x6c}, 0x0, @in=@loopback=0x7f000001}}, 0xe8) bpf$OBJ_PIN_PROG(0x6, &(0x7f00005aa000-0xc)={&(0x7f0000452000-0x8)='./file0\x00', r1}, 0xc) truncate(&(0x7f000061e000-0x8)='./file0\x00', 0x8) connect$inet6(r2, &(0x7f000088c000-0x1c)={0xa, 0xffffffffffffffff, 0x0, @mcast2={0xff, 0x2, [], 0x1}, 0x9}, 0x1c) setsockopt$RDS_RECVERR(r1, 0x114, 0x5, &(0x7f00006f8000-0x4)=0x1, 0x4) [ 76.640680] binder_alloc: binder_alloc_mmap_handler: 12579 20000000-20002000 already mapped failed -16 [ 76.651069] binder: 12577:12596 unknown command 0 [ 76.656119] binder: 12577:12596 ioctl c0306201 2000a000 returned -22 [ 76.664131] binder: BINDER_SET_CONTEXT_MGR already set [ 76.664264] can: request_module (can-proto-4) failed. [ 76.669507] binder: 12579:12587 ioctl 40046207 0 returned -16 [ 76.670477] binder: 12579:12600 unknown command 0 2018/02/10 14:10:18 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$mice(&(0x7f00007ae000-0x10)='/dev/input/mice\x00', 0x0, 0x80) clock_gettime(0x0, &(0x7f0000e45000)={0x0, 0x0}) ppoll(&(0x7f00005bf000-0x30)=[{r0, 0x4}, {r0, 0x410}, {r1, 0x2004}, {r1, 0x1f}, {r0, 0x80}, {r0, 0xa0}], 0x6, &(0x7f0000db7000-0x8)={r2, r3+10000000}, &(0x7f0000bf9000-0x8)={0xffffffffffffff7f}, 0x8) 2018/02/10 14:10:18 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f00002fd000-0x11)='/selinux/enforce\x00', 0x20000, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0) bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f0000a01000-0x4)=0x100000001, 0x4) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r1, 0x84, 0x6e, &(0x7f0000943000-0x3c)=[@in6={0xa, 0x2, 0x7, @loopback={0x0, 0x1}, 0x1}, @in={0x2, 0x3, @remote={0xac, 0x14, 0x0, 0xbb}}, @in={0x2, 0x0, @local={0xac, 0x14, 0x0, 0xaa}}], 0x3c) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000a000)={0x8, 0x0, &(0x7f00001e5000-0x8)=[@acquire={0x40046305, 0x4}], 0x0, 0x0, &(0x7f0000006000-0x54)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000-0x30)={0x44, 0x0, &(0x7f0000d06000)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x38, 0x8, &(0x7f000000d000)=[@fda={0x66646185}, @flat={0x73682a85}], &(0x7f0000006000)=[0x20]}}], 0x0, 0x0, &(0x7f0000176000-0x1)}) 2018/02/10 14:10:18 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0xffffffffffffffff, 0x2) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000a000)={0x34e, 0x0, &(0x7f00001e5000-0x8)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000006000-0x54)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000008000-0x30)={0x0, 0x0, &(0x7f0000d06000)=[], 0x0, 0x0, &(0x7f0000176000-0x1)}) r1 = creat(&(0x7f000094c000-0x8)='./file0\x00', 0x49) setsockopt$inet6_MCAST_JOIN_GROUP(r1, 0x29, 0x2a, &(0x7f0000c21000-0x88)={0xffff, {{0xa, 0x0, 0x5, @mcast1={0xff, 0x1, [], 0x1}, 0x1}}}, 0x88) 2018/02/10 14:10:18 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r0, 0x84, 0x76, &(0x7f0000445000-0x8)={0x0, 0x7}, 0x8) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000cf7000-0x1c)=[@in6={0xa, 0x3, 0x0, @loopback={0x0, 0x1}}], 0x1c) setsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r0, 0x84, 0x75, &(0x7f0000108000-0x8)={0x0, 0x10040000}, 0x8) connect$inet6(r0, &(0x7f00008c0000)={0xa, 0x3, 0x0, @loopback={0x0, 0x1}}, 0x1c) openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000a39000)='/selinux/checkreqprot\x00', 0x102, 0x0) setsockopt$inet_sctp6_SCTP_RESET_STREAMS(r0, 0x84, 0x77, &(0x7f000081e000)={0x0, 0x400000000000002, 0x0, []}, 0x8) 2018/02/10 14:10:18 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000a5000-0x8)) mmap(&(0x7f0000000000/0x19000)=nil, 0x19000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000924000-0xc)='/dev/rfkill\x00', 0x0, 0x0) r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000e54000-0x18)={0xaa}) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000008000-0x20)={{&(0x7f0000000000/0x4000)=nil, 0x4000}, 0x1}) readv(r0, &(0x7f00001f3000-0x10)=[{&(0x7f0000002000-0x4e)=""/1, 0x1}], 0x1) ioctl$RNDADDTOENTCNT(r0, 0x40045201, &(0x7f0000b27000)) ioctl$RNDADDTOENTCNT(r0, 0x40045201, &(0x7f0000a81000)) ioctl$UFFDIO_UNREGISTER(r1, 0xc020aa04, &(0x7f0000008000-0x4)={&(0x7f0000000000/0x2000)=nil, 0x2000}) openat$selinux_access(0xffffffffffffff9c, &(0x7f00004bb000-0x10)='/selinux/access\x00', 0x2, 0x0) ioctl$LOOP_SET_STATUS(r0, 0x4c02, &(0x7f0000370000-0x8c)={0x0, 0x0, 0x0, 0x0, 0x200, 0x0, 0x6, 0x19, "842619f7239dda84c1cfbf4a4ac4975fcbc354222eb8f2c616822c1f314f5794bc6c205321f42aaa05a38c981ae3e37fbf7610d5e94f4345173dc1255181047b", "57ecb9057cc000bda38f572e19fa8805acb03034d07d8ad1f0f8b72408f8ae10", [0x0, 0x4]}) 2018/02/10 14:10:18 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r0, r0, &(0x7f0000049000), 0x3d2) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000008000)={&(0x7f000000f000-0xc)={0x10, 0x34000}, 0xc, &(0x7f0000220000)={&(0x7f00008d6000-0x14)={0x14, 0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, {}, []}, 0x14}, 0x1}, 0x0) r1 = userfaultfd(0x80800) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000ff8000-0x20)={{&(0x7f0000012000/0x2000)=nil, 0x2000}, 0x1}) bpf$MAP_CREATE(0x0, &(0x7f0000fb4000)={0x2, 0x8000000000000004, 0x400, 0x7fd, 0x4, 0xffffffffffffffff}, 0x2c) userfaultfd(0x800) clock_gettime(0x0, &(0x7f0000132000)={0x0, 0x0}) socketpair(0x1d, 0x800, 0x4, &(0x7f0000589000)) r4 = syz_open_dev$mouse(&(0x7f00006eb000)='/dev/input/mouse#\x00', 0xde6e, 0x1) timer_settime(0x0, 0x1, &(0x7f000097e000)={{0x0, r3}, {r2, r3+10000000}}, &(0x7f0000939000)) fanotify_init(0x25, 0x802) r5 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000ef2000-0x1d)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f00002d8000-0xc)={0x0, 0x0}, &(0x7f0000d76000-0x4)=0xc) syz_open_procfs(r6, &(0x7f0000013000)='ns/cgroup\x00') openat$ion(0xffffffffffffff9c, &(0x7f0000dd5000)='/dev/ion\x00', 0x800, 0x0) pipe2(&(0x7f000058c000), 0x4800) setsockopt$inet_IP_XFRM_POLICY(r4, 0x0, 0x11, &(0x7f0000e12000-0xe8)={{{@in6=@mcast1={0xff, 0x1, [], 0x1}, @in=@rand_addr, 0x2, 0xbd, 0x3, 0x20, 0xa, 0xa0, 0x80, 0xbf, 0x0, r7}, {0x0, 0x8, 0x0, 0x3, 0x6, 0x1fa8, 0x8, 0x20}, {0x0, 0x7fff, 0x7ff, 0x7ff}, 0x1, 0x7, 0x0, 0x1, 0x1, 0x3}, {{@in=@broadcast=0xffffffff, 0x1, 0x7f}, 0xa, @in=@empty, 0xffffffffffffffff, 0x3, 0x0, 0xffffffffffffffbc, 0x20, 0x6, 0x2}}, 0xe8) openat$selinux_policy(0xffffffffffffff9c, &(0x7f000010e000-0x10)='/selinux/policy\x00', 0x0, 0x0) setsockopt$netlink_NETLINK_TX_RING(r5, 0x10e, 0x7, &(0x7f0000ab4000-0x10)={0x6, 0x7, 0x52, 0xfffffffffffffffc}, 0x10) [ 76.691253] binder: 12579:12600 ioctl c0306201 2000a000 returned -22 2018/02/10 14:10:18 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$mice(&(0x7f00007ae000-0x10)='/dev/input/mice\x00', 0x0, 0x80) clock_gettime(0x0, &(0x7f0000e45000)={0x0, 0x0}) ppoll(&(0x7f00005bf000-0x30)=[{r0, 0x4}, {r0, 0x410}, {r1, 0x2004}, {r1, 0x1f}, {r0, 0x80}, {r0, 0xa0}], 0x6, &(0x7f0000db7000-0x8)={r2, r3+10000000}, &(0x7f0000bf9000-0x8)={0xffffffffffffff7f}, 0x8) 2018/02/10 14:10:18 executing program 3: mmap(&(0x7f0000000000/0x9000)=nil, 0x9000, 0x3, 0x32, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0xe, &(0x7f0000008000)={@link_local={0x1, 0x80, 0xc2}, @empty, [], {@generic={0x88ca}}}, &(0x7f0000006000-0x14)={0x0, 0x1, [0x0]}) r0 = getpgrp(0x0) r1 = syz_open_dev$adsp(&(0x7f0000005000)='/dev/adsp#\x00', 0x0, 0x200502) perf_event_open(&(0x7f0000001000)={0x0, 0x78, 0x9, 0x5770, 0x4, 0xfffffffffffffffe, 0x0, 0x2, 0x80, 0xa, 0x83e1, 0x10000, 0x1, 0x2, 0x1, 0x2, 0x8, 0x33, 0x1, 0x1, 0x4, 0x100000001, 0x100, 0x3, 0x0, 0xc90c, 0x6, 0x8001, 0xef0a, 0xf2ed, 0x1, 0x3, 0x5, 0x8, 0x80000001, 0x1, 0xe8f5, 0xffffffff, 0x0, 0x1, 0x1, @perf_bp={&(0x7f0000003000), 0x4}, 0x10848, 0x9, 0xf0f6, 0x7, 0x5, 0x6, 0x1ff}, r0, 0x1, r1, 0x4) [ 76.753773] binder: 12610:12611 Acquire 1 refcount change on invalid ref 4 ret -22 [ 76.753934] binder: 12609:12613 unknown command 0 [ 76.762615] binder: 12610:12611 got transaction with invalid handle, 0 [ 76.768356] binder: 12609:12613 ioctl c0306201 2000a000 returned -22 [ 76.780008] binder: 12610:12611 transaction failed 29201/-22, size 56-8 line 3049 2018/02/10 14:10:18 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$mice(&(0x7f00007ae000-0x10)='/dev/input/mice\x00', 0x0, 0x80) clock_gettime(0x0, &(0x7f0000e45000)={0x0, 0x0}) ppoll(&(0x7f00005bf000-0x30)=[{r0, 0x4}, {r0, 0x410}, {r1, 0x2004}, {r1, 0x1f}, {r0, 0x80}, {r0, 0xa0}], 0x6, &(0x7f0000db7000-0x8)={r2, r3+10000000}, &(0x7f0000bf9000-0x8)={0xffffffffffffff7f}, 0x8) [ 76.804809] binder: 12609:12616 unknown command 0 [ 76.810441] binder: 12609:12616 ioctl c0306201 2000a000 returned -22 [ 76.828566] binder: BINDER_SET_CONTEXT_MGR already set [ 76.844702] binder: 12610:12625 ioctl 40046207 0 returned -16 [ 76.852710] binder: 12610:12611 Acquire 1 refcount change on invalid ref 4 ret -22 [ 76.860872] binder_alloc: 12610: binder_alloc_buf, no vma [ 76.866619] binder: 12610:12633 transaction failed 29189/-3, size 56-8 line 2957 [ 76.873527] can: request_module (can-proto-4) failed. [ 76.893337] binder: undelivered TRANSACTION_ERROR: 29189 [ 76.899532] binder: undelivered TRANSACTION_ERROR: 29201 2018/02/10 14:10:19 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$evdev(&(0x7f0000dda000-0x12)='/dev/input/event#\x00', 0x0, 0x0) ioctl$EVIOCGRAB(r0, 0x40044590, &(0x7f0000e95000-0x4)) ioctl$TIOCSBRK(0xffffffffffffffff, 0x40044591) r1 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f000024b000)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) ioctl$KDGETMODE(r1, 0x4b3b, &(0x7f000027c000)) request_key(&(0x7f0000102000)='big_key\x00', &(0x7f0000ad3000)={0x73, 0x79, 0x7a, 0x3}, &(0x7f00006cc000-0x40)='deflate\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', 0xffffffffffffffff) 2018/02/10 14:10:19 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000161000)='/proc/self/net/pfkey\x00', 0x842, 0x0) ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffffff, 0xc0106434, &(0x7f00002ff000)={0x5, 0x0, 0x10000, 0x6}) ioctl$DRM_IOCTL_SG_FREE(r0, 0x40086439, &(0x7f0000c7b000)={0x64d8, r1}) mknod(&(0x7f0000f80000)='./file0\x00', 0x1040, 0x0) open(&(0x7f0000fc2000)='./file0\x00', 0x141046, 0x0) open$dir(&(0x7f00003e9000-0x8)='./file0\x00', 0x26102, 0x0) 2018/02/10 14:10:19 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000639000)='./file0\x00', 0x0) r0 = creat(&(0x7f0000df1000)='./file0/bus\x00', 0x0) unshare(0x40600) ioctl$TCSETSW(r0, 0x5403, &(0x7f0000539000-0x24)={0x3, 0x3, 0x1, 0x4, 0x1, 0x1d, 0x100, 0x6, 0x3, 0x382, 0x7fff, 0x80000000}) pwritev(r0, &(0x7f0000d81000-0x30)=[], 0x0, 0x0) 2018/02/10 14:10:19 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000a000)={0x34e, 0x0, &(0x7f00001e5000-0x8)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000006000-0x54)}) r1 = syz_open_dev$vcsn(&(0x7f0000111000)='/dev/vcs#\x00', 0x7, 0x100) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(0xffffffffffffffff, 0x84, 0x7b, &(0x7f0000b5e000)={0x0, 0x5}, &(0x7f0000731000)=0x8) setsockopt$inet_sctp6_SCTP_AUTH_DELETE_KEY(r1, 0x84, 0x19, &(0x7f0000c95000-0x6)={r2, 0x6}, 0x6) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000008000-0x30)={0x0, 0x0, &(0x7f0000d06000)=[], 0x0, 0x0, &(0x7f0000176000-0x1)}) 2018/02/10 14:10:19 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$mice(&(0x7f00007ae000-0x10)='/dev/input/mice\x00', 0x0, 0x0) clock_gettime(0x0, &(0x7f0000e45000)={0x0, 0x0}) ppoll(&(0x7f00005bf000-0x30)=[{r0, 0x4}, {r0, 0x410}, {r1, 0x2004}, {r1, 0x1f}, {r0, 0x80}, {r0, 0xa0}], 0x6, &(0x7f0000db7000-0x8)={r2, r3+10000000}, &(0x7f0000bf9000-0x8)={0xffffffffffffff7f}, 0x8) 2018/02/10 14:10:19 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = add_key$user(&(0x7f0000175000-0x5)='user\x00', &(0x7f00000fb000-0x5)={0x73, 0x79, 0x7a, 0x0}, &(0x7f00008d5000)="b65ffd75c55f27d7cda707fbef1e25bfe3e042a737a6d8fae3c67bcb83b96d339735d697a8b9b0bc2efc586be06243b0498c46efcd8cac5fac9086c5fde8bedb10c97d964ddcd9be1570baeba51dfa71b63d9a9e84e2123c93ee28adbe30e36d651697a334381cd8454cd36cec246cb6042c47fa91318f01326d808178d7187b46452ce725e9f1c800cbc51fb7ce2526b7fcdec85778264a5903c340f938f1ed71a9ebe2b0056acfb3fb2f0874d2cfc7d150adfb43ac2198bee99dc47415fd49f17e13b5b2f6ee86bfcda840375732274c1a", 0xd2, 0xfffffffffffffffe) r1 = add_key(&(0x7f00006f2000)='big_key\x00', &(0x7f0000565000)={0x73, 0x79, 0x7a, 0x0}, 0x0, 0x0, 0xfffffffffffffffc) keyctl$instantiate(0xc, r0, &(0x7f0000bc0000)="4919ed638ff3a0e1aaaa68e14333679a86304e91f3636a0a6b09b41facf958730c041f5f93aae5620dba5dc876755a3cabbdaa3d28306c47b4deb5ac81e953486c6f9156a3ff0d5f7a0c561e21d26facafe9a4c26ba22ca9b73371362b591d2a5d5dd11437dd476e15467553e26478b36c54ba10370a75d76c37c31df7038b61302d66301f9996511f537b4fa0c7468cd862c7271ed53f735e0c14cb0eca3dbbeb2f24146b0461f066ef870f1b0a0026199f96a6c551965ee469a67ba5f391dc699beef51b", 0xc5, r1) r2 = syz_open_dev$dspn(&(0x7f00004b6000-0xa)='/dev/dsp#\x00', 0x400000009, 0x2) ioctl$BINDER_THREAD_EXIT(r2, 0x40046208, 0x0) ioctl$int_out(r2, 0x5462, &(0x7f000019f000)) r3 = syz_open_dev$binder(&(0x7f0000d6c000-0xd)='/dev/binder#\x00', 0x0, 0x800) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r3, 0x0) pwrite64(r3, &(0x7f0000a37000-0xd8)="8ce6331d2108fd6f9573e19cc87c7a9def2e04f1f1b1f32cfde2ce57a7c73605cb23e68ebd27782e650defa176411e4475f07541c0122427df1484b5f76c8e8ab29eb0b509f73a68d95cc769df93f2f2f76e17c338efff4e5dc31ff4f6de8c09ceb8981e1dcfacd65019b8828192b32a9111a37b3727f50512030d397759f18be965b292b10ffedaf4c78448ef5239ba1c59f294a67d36baaecfe7e887f50764ad92f522f02e8c0812d5b5bc2ec99afe56a0426630d91ce885907e997ecfbd88cc0c0ff6b57e03997977f7b1517d00738115cdad9b6c3ca3", 0xd8, 0x0) close(r2) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) ioctl$EVIOCGKEYCODE(r2, 0x80084504, &(0x7f00004ae000)=""/100) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f000000a000)={0x34e, 0x0, &(0x7f00001e5000-0x8)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000006000-0x54)}) ioctl$PPPIOCGCHAN(r2, 0x80047437, &(0x7f00003bd000)) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000008000-0x30)={0x44, 0x0, &(0x7f0000d06000)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x38, 0x8, &(0x7f000000d000)=[@fda={0x66646185}, @flat={0x73682a85}], &(0x7f0000006000)=[0x20]}}], 0x0, 0x0, &(0x7f0000176000-0x1)}) ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r2, 0x54a2) syz_open_dev$evdev(&(0x7f0000b41000-0x12)='/dev/input/event#\x00', 0x1, 0x101000) 2018/02/10 14:10:19 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r0, r0, &(0x7f0000049000), 0x3d2) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000008000)={&(0x7f000000f000-0xc)={0x10, 0x34000}, 0xc, &(0x7f0000220000)={&(0x7f00008d6000-0x14)={0x14, 0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, {}, []}, 0x14}, 0x1}, 0x0) r1 = userfaultfd(0x80800) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000ff8000-0x20)={{&(0x7f0000012000/0x2000)=nil, 0x2000}, 0x1}) bpf$MAP_CREATE(0x0, &(0x7f0000fb4000)={0x2, 0x8000000000000004, 0x400, 0x7fd, 0x4, 0xffffffffffffffff}, 0x2c) userfaultfd(0x800) clock_gettime(0x0, &(0x7f0000132000)={0x0, 0x0}) socketpair(0x1d, 0x800, 0x4, &(0x7f0000589000)) r4 = syz_open_dev$mouse(&(0x7f00006eb000)='/dev/input/mouse#\x00', 0xde6e, 0x1) timer_settime(0x0, 0x1, &(0x7f000097e000)={{0x0, r3}, {r2, r3+10000000}}, &(0x7f0000939000)) fanotify_init(0x25, 0x802) r5 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000ef2000-0x1d)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f00002d8000-0xc)={0x0, 0x0}, &(0x7f0000d76000-0x4)=0xc) syz_open_procfs(r6, &(0x7f0000013000)='ns/cgroup\x00') openat$ion(0xffffffffffffff9c, &(0x7f0000dd5000)='/dev/ion\x00', 0x800, 0x0) pipe2(&(0x7f000058c000), 0x4800) setsockopt$inet_IP_XFRM_POLICY(r4, 0x0, 0x11, &(0x7f0000e12000-0xe8)={{{@in6=@mcast1={0xff, 0x1, [], 0x1}, @in=@rand_addr, 0x2, 0xbd, 0x3, 0x20, 0xa, 0xa0, 0x80, 0xbf, 0x0, r7}, {0x0, 0x8, 0x0, 0x3, 0x6, 0x1fa8, 0x8, 0x20}, {0x0, 0x7fff, 0x7ff, 0x7ff}, 0x1, 0x7, 0x0, 0x1, 0x1, 0x3}, {{@in=@broadcast=0xffffffff, 0x1, 0x7f}, 0xa, @in=@empty, 0xffffffffffffffff, 0x3, 0x0, 0xffffffffffffffbc, 0x20, 0x6, 0x2}}, 0xe8) openat$selinux_policy(0xffffffffffffff9c, &(0x7f000010e000-0x10)='/selinux/policy\x00', 0x0, 0x0) setsockopt$netlink_NETLINK_TX_RING(r5, 0x10e, 0x7, &(0x7f0000ab4000-0x10)={0x6, 0x7, 0x52, 0xfffffffffffffffc}, 0x10) 2018/02/10 14:10:19 executing program 5: r0 = syz_open_dev$vcsn(&(0x7f0000c29000-0xa)='/dev/vcs#\x00', 0x3, 0x80000) ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffffff, 0xc0106434, &(0x7f00008a5000)={0x80000000, 0x0, 0x10001, 0x3}) ioctl$DRM_IOCTL_SG_ALLOC(r0, 0xc0086438, &(0x7f0000c31000)={0xffff, r1}) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000a5000-0x8)) mmap(&(0x7f0000000000/0x19000)=nil, 0x19000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r2 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000924000-0xc)='/dev/rfkill\x00', 0x0, 0x0) r3 = userfaultfd(0x0) ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f0000e54000-0x18)={0xaa}) ioctl$UFFDIO_REGISTER(r3, 0xc020aa00, &(0x7f0000008000-0x20)={{&(0x7f0000000000/0x4000)=nil, 0x4000}, 0x1}) readv(r2, &(0x7f00001f3000-0x10)=[{&(0x7f0000002000-0x4e)=""/1, 0x1}], 0x1) ioctl$RNDADDTOENTCNT(r2, 0x40045201, &(0x7f0000b27000)) ioctl$RNDADDTOENTCNT(r2, 0x40045201, &(0x7f0000a81000)) ioctl$UFFDIO_UNREGISTER(r3, 0xc020aa04, &(0x7f0000008000-0x4)={&(0x7f0000000000/0x2000)=nil, 0x2000}) [ 76.974960] binder: 12645:12647 Acquire 1 refcount change on invalid ref 0 ret -22 [ 76.982804] binder: 12645:12647 unknown command 0 [ 77.000059] binder: 12645:12647 ioctl c0306201 2000a000 returned -22 [ 77.009351] binder: 12642:12653 unknown command 0 [ 77.014385] binder: 12642:12653 ioctl c0306201 2000a000 returned -22 2018/02/10 14:10:19 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$mice(&(0x7f00007ae000-0x10)='/dev/input/mice\x00', 0x0, 0x0) clock_gettime(0x0, &(0x7f0000e45000)={0x0, 0x0}) ppoll(&(0x7f00005bf000-0x30)=[{r0, 0x410}, {r1, 0x2004}, {r1, 0x1f}, {r0, 0x80}, {r0, 0xa0}], 0x5, &(0x7f0000db7000-0x8)={r2, r3+10000000}, &(0x7f0000bf9000-0x8)={0xffffffffffffff7f}, 0x8) 2018/02/10 14:10:19 executing program 3: r0 = syz_open_dev$mice(&(0x7f0000601000)='/dev/input/mice\x00', 0x0, 0x80000) ioctl$KVM_GET_MSRS(r0, 0xc008ae88, &(0x7f0000b11000)={0x3, 0x0, [{}, {}, {}]}) lookup_dcookie(0x0, &(0x7f00006ad000-0x13)=""/19, 0x13) r1 = dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) ioctl$KDSIGACCEPT(r1, 0x4b4e, 0x5) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_CLIENT(r1, 0x404c534a, &(0x7f0000001000-0x4c)={0x9}) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$EVIOCGABS2F(r1, 0x8018456f, &(0x7f0000000000)=""/24) getsockopt$inet_sctp_SCTP_PR_SUPPORTED(r1, 0x84, 0x71, &(0x7f0000001000-0x8)={0x0, 0x33196ae2}, &(0x7f0000e17000)=0x8) getsockopt$inet_sctp6_SCTP_ASSOCINFO(r0, 0x84, 0x1, &(0x7f0000000000)={r2, 0x2400000, 0x1, 0x3, 0x3, 0xc4b8}, &(0x7f0000001000-0x4)=0x14) 2018/02/10 14:10:19 executing program 1: mmap(&(0x7f0000000000/0xdfb000)=nil, 0xdfb000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f00005d6000-0xd)={0x2, 0x0, @rand_addr}, 0x10) setsockopt$inet_tcp_int(r0, 0x6, 0x200000000000a, &(0x7f0000df9000-0x4)=0x4, 0xfffffffffffffe91) sendto$inet(r0, &(0x7f0000de2000-0x1), 0x0, 0x20008005, &(0x7f0000db5000-0x10)={0x2, 0x0, @loopback=0x7f000001}, 0x10) mmap(&(0x7f0000dfb000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r1 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000dfb000)='/selinux/avc/cache_stats\x00', 0x0, 0x0) mmap(&(0x7f0000dfb000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) getdents64(r1, &(0x7f0000dfc000-0x1000)=""/4096, 0x1000) setsockopt$sock_int(r0, 0x1, 0x2f, &(0x7f0000df9000), 0x4) sendto$inet(r0, &(0x7f0000b0c000)="11a58fde7649496403db92ed306004b3d3cbfc195485c3b895d864ab91a3aebde4f70a917a91ec9612d004000a7b43a35bb73249ede41bf5c05ab608fb7b74ffd57f6e8e43cf9cb723fc0d8d8cabbbbae3a5fde8ad6f52d667c512596f50b9962aa2193688d872a7eeca57801742d74d39c4b003a5e292e077ed102e7999329aab95a3d96363505f76c86a6d2352dd8025207ae531701f1ce353d6b017eb64000000bc2e9f8b66fe4a8e64f0fc7a0aa55d4103e1d7d5b0dd5750071e9b3a786021678a86fcbb0b9f9364ec0f0310306fef9c21b3b20d8b44423b495299cea2c6f40c377a72534453ad7f5af27b1efb2514ace1f9a68cf205a9ddb8fd954e34bde3612e6e05686cf3b968a14bd3a356f7b8d20214c0f7a388ef5ea8d063c65f2aabff685e69f86b4a0b3697f8bfbfe66796f0489ad2e49bdbc1742941c28c88cb93e1f8ccc3db4782cdf9cbd797ddc8d7b1364da50ad48e081a38622280169eba5c6a3bf9b5f15bdf8a8b6483340a3297c31154905db209195c28f15d10153204fbe0586516c714ddc939e0eb68c73969e81fc6f215b476ddf3fcf1a604603360089dadba2779cfed9027ac163067fc0d7592ac8a013b907372a42b242405241ac1f63f85a52fff2d78b30e87a156b5cfa133dabc259bb027bec5eb8c8eb623e9776a13d3ce972a6769de8a78153f498084a244b0146b77be3d1cba7b02fe8906ed8a88f105c763d1772825b986d52823bf38b6f95eca494fd9c64497874b9f450bec65311493cc108b27611eaa6819305a3730d29368f25f7e816d60884a1e0271c3c786ad36391366ac3b65f04c148974f6973005c5ff73d6f0b3f7e44c65da7c4115c4ee543991e4ad26938384cafffffffc8f7e79aaf1b8ef37f627e3c7168ecda2cf224a491bea6129fcd954b88dbb2d29464931bcd5378041db67ddc70ee856ae09c1b26b9ada008a7d52bf1a160606865a29794f36b2a3811c66e9fe27af8fc8356374e37f3eca244367fb535dde71fae4683710761b89f18820d4f06065450c3d1f76fa26ef28320edf6c36480af14f4444edb40ebb3f8ea264486ec31c40c7f0007a69c24da10db6f60da3e648f16b5fc6b5a5c6217e46c1f3ff354a8b49beb3b46a69dcb4c5d547a7b7ba8fe22da0173f9fe80f4bd47afbec4d2e0d3c91b1a326d8bb9fded873e87f847032af52bd6d129f3ce3f11ea9d0b4250af7eaa2649d9972b9b8dc773c869b3a431eac7f55d6bb92dc29f08d7d8959e2af7571efb7ec88eac4b62850e8f6b60d4a5d06d66875b4bd260a9014a2eb88621f4c6eb3f9ed2190b48acf0358d8b82fb4794535fcb8dd50ba86d23d230a94f07a768142ff3b4c8558dac21726b6279980c238041f26e86c8e3fa83028345999464e3e37d610ab7c15daaffb744a505a3dd9802b3721f29553ee23e1cf376f12cc3fe6b7ac76bd13da44356855be096155e355c9cad31fcdeedc6679c531bc1a2765dc8777108ec5e31d793005e718a9ced77d6505e44f649128a29f5264fecba132f9f5016eaf690751edd64d903b36ceb2b08042c60e9e97f8bc985476e6088a5ebd3743c2358171b30b16d730a5dd49c92fa19cc267e2c1927f200fc3d23a804f0a12b06a6a88a2685051ab28f1721209ada2c14b557a49423795b07040d510bb21ce5d15acedd18cb7cb7a93389ceb934206e4ffb220048a7a82fb3c251d0a31ba5af9eb0c16e29f33f9d0a78f5e6300cf04d17eb5f67711cafa0d4e99eeaf0f8fdbd34170318879a0d12c01891127ba7b677d204268524c5af1d7dc27176826302e34f9d35d2f2eefad5f22f68929d3456c11d5f00d4a8ce8b784bca8088805731eff2d47024c2da68abc2d2c0f7806d7d76cdf489f3bffa75cb826bc0809331d89a3255a498b8150d4ae31d03414ab244939455b6377c2917cb2d8a9f9ebf282657e417860e49ac94f4a838aefd34f28960a78da47933252d8cb2fdb27d413ee54502cd1bf75585468b77b8dca627cab29ef0a5297ee3dcb4c987520804e9a5f45e8241019281bab7e30f4b008bf0edf3b6fb5e8d1c2ab619b2eb84293d636a6a37d716cd8e102b7099676693cb7b01031b57ee93fd22cb18229893fd4d4ef87f1596879ac9f61b2f0c35be34cb6e6f75087ff963c188d43bcb464a95e956e75559eb1f6f2224fb2ca8f0bdc90ae5c2ce712498ee4026b13b8f3137000aa1545a75e5b48e80da30e6dac5529cac1099244e79ad542f45dcfbf16c62b5eb63daee8185c5e79ebfa1ca60880f9e2895f54ab95bbae38ae62200c1e439d73fa63d0bff75935a8ad2ae73b82132e8d4eb4bd55844b2f55c65d5ffa0c65aaf0cc5bc73925d05cf7c1c4383af074feb3a53919d2a3b5bef96115aab966821dbfc4577d19d85911a485c58a5b87cf44d230cfdc255486bb09d5c16f2164397f0fc5f652a171f0269bdcd98291410c010cc377d2690a6032fe5701117adbd0f6b847c9617a9b3d20529024d8d9749b9c49827694d346d3b1bbe434122331986b9f6e84430dfd75d123f3e307d6f5514f3da09b527408bfb6816da54beeefad160e4b095517f3292c2e17fb3bba47527671d0afe7c35d54d25ab307b15d069a05395a9cddd4b519224fe3c689d14827ede6d91ebace2a80afaad3dcd1f8ce20e92012b8934d7ff3ebdd285cc24202a86d70b96674a6af05a3c29065afa4e38b9c34006cb3eb9c87985cfc511a8c261cdeb0c7a3c7a682c40c5b9f1d7d5ef6f97e32d02fdd3f2ded413f4a36c4db899b96c8e40d91c2743cd1d435013e3c3431c82fc5b3345b66cce79fa49f10baa4ef28535eee8c5c1a4b38bace2fb14ec11d34d620b1cc2396dc1fa857ac6ac9f5689b5935f2f25184edd40f8f5c70714f941beae3e1bc9af757edd9d68fb24218e2a02aad4dc0b3c2e5ff94ce547f358f38e52673473fd0e57497978324aee16559e9cdbe5b3a0b96dd69fe5bc97e644487274b6158a0412bd60172bb66f774b8eae7bc1f52ed64d44c553bdc26823e35f18683554e7359802173d1fa86a66104abb1977c3e9fa6970ed7ee483b14b65673a81786fe0ed301f8edb0669fd25bfa0d565e3e93b19b8572c98dbacb103053527a95ee758be002e13df756bbc486def0db079124db72fadc26f0a26b42e21f260f902bb4cd881baae57eff1c3cc15063be17e48208b9a69622adfc03991d204fe0f5ae2528b22c7743f97e0669a1c3c0d0d90f39846fd954d681be0265d14b12285fb1b20bcbaa95915ad51ab8f84094674cbac0071021b261c39a46b0177b98f1662100ef31a3e981236d51e6c1429144a89d46b149301873ef99959f8ab15c12309620d5d548b62ff92233a3f200e0d0a9c2122be615dd91e6a6cd89290d24895540635fead9a56f481ee3fd7890852e271fa7c37b1836a3e1764574960e1ab9fda1d25693cfc33defea84f65c08cce479c66dc16b28d453a1b717fdd9f6ff46b1fa1b6866b4a8c1ad53439c5958403953b3a844b660b28b11d427b392a7c710edbf25725a65e6b94e4c64ae458a8c97c9f7a05a7d8ebf6c76e3afc0204ced97be84986da5403ef31eff1790c039fe00a89976ccab7638d2e217fc64609a41f3a008ed78b25d1a9420b782deef6ce2db0c6d427580087b69c75c1357ed2908c32cffee1c6ddd08510562ab015507a4eb4f54ae5c097cdca34f521f9fa8df7667645a696a472650c1ca9c035e95f34db54722897159c31dc6be5693a5f3871ccbb48a7ead233d03b76875590fa20bae4f37a2011622d0203a3e9d9e198cb075aba26f5e78a8f0b0cd27052527daf0f8e77858dbddec7038c198b868e93ae32f1745d166afed4129460e07af8cb6c3debb6503e87f3cb309e39ed3d682d24adec48ea22702c4d8d48386977a89b73e585f8c2c5fcb0a693cd5028a601b04b833a41ec705735c767c70d316b60aba2da24bd6523533f3180accade90f47e412b393ee1d2456cf8bb430289ddb824350764985c5e35f738f830a378bfa65fd167c7307c13acb912beefa69e499d4a750e820a7af08a7c204ffb64e09fcc921a4e79999757d608880bfd52255bbc16369af4f779edfd9439cfcd17fcc02d5aaa81bac66fa2e551cef55779bd90e8be587ee698575918fced59ec652af26718b3afd1471379132ba0b5143a78f84605b1ef51e49e820a8a8c1639f66bca5afd83602287e982eb125a3a032e4cc5b5be91ab4d8d958fd4dc4cbd310eddc91d89ada4d33fcc963d259e222520281d14e13577906e33665a31afa7cb501cc0c1198d1f755005e82f29bcda62bbf8680bc23d09cac6a8c89709b30c91d27ea148f01ba745346f1ba9ce89cd9b71ff18668a0254c07479762dbb78117c50450506e2a0a606309aa383ec55a49d2569c3a3fef8aad456aa81cb859519765de18a4b92194e8a6a43f1dade801f71eb56699bc021fa48f320f4128d6c153a2ec1fba1c5ca55c5058641692365d311c8902aaf1428d83281aa970af5d98591cd3af30fbb5ee4a1b697491ff6dd727a329feb17b782f254d691f949baf96afa195c62f2c3fd1855a79b25268cef9822e3c6a1b3aa226ec494b070a8774426a5f8877714fe206e569635805208ac7823c8546ec33e4482a85d6fddf86a37a1c60f0a19b5dfe88031b7541af0e93cac8a3bb1ff3e60190b96faedc3b6f63d38f3ee4286fbaa053e8e27ed13b77b2c576d824d777ca53df76d9572e71f74ff180778bf57458b37fe9dbaa6f9927b48b059e5c7fd908ac826aed8f68764285022f4b5cb6b73ef7222ecb0d701c782ed5c16a7c94235fe7c3e0bef9da7310c5f3cda407c5ae7ecfb6b392ad576610b48af17b3fc8a2fd6cd2eee1153cc48a21ba6768a88367a807be008bea547402da4c92c2006c83d74c9d0ef2ca711c54036c8e76ac26c7d22060c9bfc2e67f1d1c6f6bd2f751879295ee21fcf8588c9504cacb02fa3e3fc6e2bed352447a5c2677caba0538960357d6d1706adef5e7d4f6298ed4ecacb7776de15d9bbd672f9991f4bdc4f07401f67cf3a74c0495ea58d0f76a2e6060cecc1d04b93808dc8d61130305740b408359d5552cc23a7b1eff4285d563b4b6b011a4a11372a2bb01cbda724482f95c4487b02c85cc121012b3213041ff6a689072daa4d86a4c125b110f4e2eeed2dd73db0f94ce995896e0b8a9f8f3e9559024251a5b1726b0b3775bac9fabed968d2d4ea31bbdfb2910331d92cb4ff5cc9037cc08cd35f88c4d7b89e46a8cbd05e3c35732b5046b33060dce5372b171daa526a46c3444b331e71f0455fb8b43dc46e2c9f2c4effccf040e56de00000007b16de337f13e7a610feac2f336e75405a530815366e7edfbb429babfd0e68db56892b94621edd9df6ff454ab1dcdb8d39d282fa7932ec7ba5203df2f4196538a1fa040c8014d20ff57fdb8515325a6997b9b71f2094e053f126402a47e628eeb7d8f665fbabe8f1a409ca9c7c5c25baaa0e9945acf27e96f8241a445f7d3352494ba4210b348fa0ec11ea67dead4fc1e5e4f9202931386468882bee59f8d12174198142ef7764d6b930e937e20d018c0cc5a780490356f5521aac74d2c1736e20ae5e0cd8cf6676ac337e8a8976aac75a698e34e72bac561038f228c13b6e974bc21bb79618111db507f3ba314dd2d05fd050d684cf33d8da5f8e5f723a092098ac5b180a6579d543515c2e1d0eb502193aedab526d354b625990c7d5a9f90d86c4e374054f1d14270b603065293e7fa3840de575413b74bfbc4f8c139947ade9a6f48907053f1ae3a95c2", 0x1001, 0xc004, 0x0, 0x0) mmap(&(0x7f0000dfb000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000dfc000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) getsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r1, 0x84, 0x72, &(0x7f00004da000)={0x0, 0x7}, &(0x7f0000dfd000-0x4)=0xc) setsockopt$inet6_tcp_TCP_ULP(r1, 0x6, 0x1f, &(0x7f00002cc000)='tls\x00', 0x4) mmap(&(0x7f0000dfc000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) setsockopt$inet_sctp6_SCTP_CONTEXT(r1, 0x84, 0x11, &(0x7f0000dfc000)={r2, 0x4}, 0x8) r3 = openat$rtc(0xffffffffffffff9c, &(0x7f0000dfb000+0xa37)='/dev/rtc\x00', 0x20000, 0x0) mmap(&(0x7f0000dfb000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$KVM_UNREGISTER_COALESCED_MMIO(r3, 0x4010ae68, &(0x7f0000dfb000)={0x3000, 0x8000}) [ 77.017959] binder: 12645:12654 Acquire 1 refcount change on invalid ref 0 ret -22 [ 77.028720] binder: 12645:12654 unknown command 0 [ 77.036716] binder_alloc: binder_alloc_mmap_handler: 12642 20000000-20002000 already mapped failed -16 [ 77.038656] binder: 12645:12654 ioctl c0306201 2000a000 returned -22 [ 77.062788] binder: BINDER_SET_CONTEXT_MGR already set [ 77.068262] binder: 12642:12660 unknown command 0 2018/02/10 14:10:19 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000a000)={0x34e, 0x0, &(0x7f00001e5000-0x8)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000006000-0x54)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000008000-0x30)={0x0, 0x0, &(0x7f0000d06000)=[], 0x0, 0x0, &(0x7f0000176000-0x1)}) openat$rtc(0xffffffffffffff9c, &(0x7f0000478000-0x9)='/dev/rtc\x00', 0x5e14c03f0e9aff2a, 0x0) [ 77.073308] binder: 12642:12660 ioctl c0306201 2000a000 returned -22 [ 77.080218] binder_alloc: 12642: binder_alloc_buf, no vma [ 77.085848] binder: 12642:12662 transaction failed 29189/-3, size 56-8 line 2957 [ 77.086575] binder: 12642:12653 ioctl 40046207 0 returned -16 2018/02/10 14:10:19 executing program 3: mmap(&(0x7f0000000000/0x2d000)=nil, 0x2d000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x5, 0x0) mmap(&(0x7f000002d000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r1 = openat$dsp(0xffffffffffffff9c, &(0x7f000002e000-0x9)='/dev/dsp\x00', 0x8040, 0x0) r2 = gettid() mmap(&(0x7f000002d000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f000002e000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f000002e000)='/dev/ptmx\x00', 0x40000, 0x0) ioctl$TIOCSPGRP(r1, 0x5410, &(0x7f000002d000)=r2) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000016000-0x8)=@common='vcan0\x00', 0x10) sendmsg(r0, &(0x7f000000b000)={&(0x7f000000c000-0x1c)=@in={0x2, 0xffffffffffffffff, @loopback=0x7f000001}, 0x10, &(0x7f0000017000-0x60)=[{&(0x7f000001e000-0xde)="cb", 0x1}], 0x1, &(0x7f0000023000-0x378)=[]}, 0x19fff) ioctl$KVM_GET_ONE_REG(r1, 0x4010aeab, &(0x7f0000016000-0x10)={0xab, 0xff}) 2018/02/10 14:10:19 executing program 1: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000022000-0x8)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000ef3000)={0x0}, &(0x7f00009c7000-0x4)=0xc) sched_setaffinity(r1, 0xfffffee3, &(0x7f0000ea1000-0x8)=0x20000524a) r2 = syz_open_dev$dspn(&(0x7f0000af7000-0xa)='/dev/dsp#\x00', 0x1, 0x0) readv(r2, &(0x7f0000004000-0x30)=[{&(0x7f0000007000-0xf9)=""/249, 0xf9}], 0x1) readv(r2, &(0x7f0000ddd000-0x10)=[{&(0x7f0000882000-0x6e)=""/110, 0x6e}], 0x1) ioctl$int_in(r2, 0x80000000005001, &(0x7f0000004000-0x8)) 2018/02/10 14:10:19 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000a5000-0x8)) mmap(&(0x7f0000000000/0x19000)=nil, 0x19000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000924000-0xc)='/dev/rfkill\x00', 0x0, 0x0) r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000e54000-0x18)={0xaa}) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000008000-0x20)={{&(0x7f0000000000/0x4000)=nil, 0x4000}, 0x1}) readv(r0, &(0x7f00001f3000-0x10)=[{&(0x7f0000002000-0x4e)=""/1, 0x1}], 0x1) ioctl$RNDADDTOENTCNT(r0, 0x40045201, &(0x7f0000b27000)) ioctl$RNDADDTOENTCNT(r0, 0x40045201, &(0x7f0000a81000)) ioctl$UFFDIO_UNREGISTER(r1, 0xc020aa04, &(0x7f0000008000-0x4)={&(0x7f0000000000/0x2000)=nil, 0x2000}) r2 = add_key$user(&(0x7f00009d0000-0x5)='user\x00', &(0x7f00007fb000)={0x73, 0x79, 0x7a, 0x0}, &(0x7f0000aa8000)="9c14d67c75794734d8ff1a02c9cbb6e0e8a89569f942423347fbb6d25ea00aa7c6a5ec74fa675b61b0b329b16fb387645dc76da48573002593e06725ed1b5be18378654ae2673e78bb4c07d9760ed38b047a204ba20de47fc0cf5814c3476f574951efc88f0700621e530682e397953eb6672a058f5d844cc0e315d44f6b976eba3e463b0c078a66e2561ce753a23c59d7d89ad5c7e29000117db16c3828b85b296c3ea5eb9ed26df94ce4039dce3c86499d69ddd8ca3d292f2399272325248f538a0bd2cd0137cbbe9552dbafdee0d040cf", 0xd2, 0x0) r3 = request_key(&(0x7f0000d13000)='keyring\x00', &(0x7f0000da8000)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000734000)='GPLwlan1.}?\x00', 0xfffffffffffffffa) keyctl$reject(0x13, r2, 0x3, 0x8, r3) 2018/02/10 14:10:19 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$mice(&(0x7f00007ae000-0x10)='/dev/input/mice\x00', 0x0, 0x0) clock_gettime(0x0, &(0x7f0000e45000)={0x0, 0x0}) ppoll(&(0x7f00005bf000-0x30)=[{r1, 0x2004}, {r1, 0x1f}, {r0, 0x80}, {r0, 0xa0}], 0x4, &(0x7f0000db7000-0x8)={r2, r3+10000000}, &(0x7f0000bf9000-0x8)={0xffffffffffffff7f}, 0x8) [ 77.120651] binder: undelivered TRANSACTION_ERROR: 29189 [ 77.150130] can: request_module (can-proto-4) failed. [ 77.163398] binder: release 12642:12653 transaction 436 out, still active [ 77.166571] binder: 12675:12678 Acquire 1 refcount change on invalid ref 0 ret -22 [ 77.170415] binder: undelivered TRANSACTION_COMPLETE [ 77.178116] binder: 12675:12678 unknown command 0 [ 77.183236] binder: send failed reply for transaction 436, target dead [ 77.210286] binder: 12675:12678 ioctl c0306201 2000a000 returned -22 [ 77.228137] binder: 12675:12681 Acquire 1 refcount change on invalid ref 0 ret -22 [ 77.236062] binder: 12675:12681 unknown command 0 [ 77.267922] binder: 12675:12681 ioctl c0306201 2000a000 returned -22 2018/02/10 14:10:19 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$adsp(&(0x7f00008ac000-0xb)='/dev/adsp#\x00', 0x5, 0x0) getsockopt$inet_sctp6_SCTP_STATUS(0xffffffffffffff9c, 0x84, 0xe, &(0x7f0000fe3000)={0x0, 0x8, 0x3, 0x1ff, 0x7fffffff, 0x7fffffff, 0xb5, 0x1, {0x0, @in={{0x2, 0x2, @broadcast=0xffffffff}}, 0x100, 0x3, 0x0, 0x3d1d, 0x1}}, &(0x7f0000045000-0x4)=0xb8) setsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r0, 0x84, 0x75, &(0x7f0000b85000)={r1, 0xffffffff}, 0x8) r2 = syz_open_dev$evdev(&(0x7f0000dda000-0x12)='/dev/input/event#\x00', 0x6, 0x4) ioctl$EVIOCGRAB(r2, 0x40044590, &(0x7f0000e95000-0x4)) ioctl$EVIOCGKEYCODE(r2, 0x80084504, &(0x7f0000680000-0x4f)=""/79) ioctl$TIOCSBRK(0xffffffffffffffff, 0x40044591) r3 = openat$autofs(0xffffffffffffff9c, &(0x7f0000441000-0xc)='/dev/autofs\x00', 0x40, 0x0) ioctl$KVM_SET_ONE_REG(r3, 0x4010aeac, &(0x7f0000824000)={0x2000000000009, 0x6}) openat$ion(0xffffffffffffff9c, &(0x7f000090e000-0x9)='/dev/ion\x00', 0x8000, 0x0) request_key(&(0x7f0000102000)='big_key\x00', &(0x7f0000ad3000)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000530000)=':wlan1\x00', 0xffffffffffffffff) 2018/02/10 14:10:19 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000a5000-0x8)) mmap(&(0x7f0000000000/0x19000)=nil, 0x19000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000924000-0xc)='/dev/rfkill\x00', 0x0, 0x0) r1 = userfaultfd(0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sndctrl(&(0x7f0000001000)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_TLV_WRITE(r2, 0xc008551b, &(0x7f0000601000)={0x6, 0x8, [0x0, 0x0]}) ioctl$UFFDIO_UNREGISTER(r0, 0x8010aa01, &(0x7f0000a28000)={&(0x7f00004ec000/0x3000)=nil, 0x3000}) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000e54000-0x18)={0xaa}) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000008000-0x20)={{&(0x7f0000000000/0x4000)=nil, 0x4000}, 0x1}) readv(r0, &(0x7f0000b61000-0x8)=[{&(0x7f0000002000-0x4e)=""/1, 0x1}], 0x1) ioctl$RNDADDTOENTCNT(r0, 0x40045201, &(0x7f0000b27000)) ioctl$RNDADDTOENTCNT(r0, 0x40045201, &(0x7f0000a81000)) ioctl$UFFDIO_UNREGISTER(r1, 0xc020aa04, &(0x7f0000008000-0x4)={&(0x7f0000000000/0x2000)=nil, 0x2000}) 2018/02/10 14:10:19 executing program 3: mmap(&(0x7f0000000000/0xd25000)=nil, 0xd25000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = dup3(0xffffffffffffff9c, 0xffffffffffffffff, 0x0) fcntl$getown(r0, 0x9) r1 = socket$inet(0x2, 0x3, 0x2) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f000037b000)={@syzn={0x73, 0x79, 0x7a, 0x0}, @ifru_addrs=@nfc={0x27, 0x7f, 0x33, 0x3}}) bind(r0, &(0x7f0000741000)=@hci={0x1f, 0x7ff, 0x3}, 0x6) setsockopt$inet_int(r1, 0x0, 0xd1, &(0x7f0000001000-0x4)=0xfd, 0x4) 2018/02/10 14:10:19 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r0, r0, &(0x7f0000049000), 0x3d2) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000008000)={&(0x7f000000f000-0xc)={0x10, 0x34000}, 0xc, &(0x7f0000220000)={&(0x7f00008d6000-0x14)={0x14, 0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, {}, []}, 0x14}, 0x1}, 0x0) r1 = userfaultfd(0x80800) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000ff8000-0x20)={{&(0x7f0000012000/0x2000)=nil, 0x2000}, 0x1}) bpf$MAP_CREATE(0x0, &(0x7f0000fb4000)={0x2, 0x8000000000000004, 0x400, 0x7fd, 0x4, 0xffffffffffffffff}, 0x2c) userfaultfd(0x800) clock_gettime(0x0, &(0x7f0000132000)={0x0, 0x0}) socketpair(0x1d, 0x800, 0x4, &(0x7f0000589000)) r4 = syz_open_dev$mouse(&(0x7f00006eb000)='/dev/input/mouse#\x00', 0xde6e, 0x1) timer_settime(0x0, 0x1, &(0x7f000097e000)={{0x0, r3}, {r2, r3+10000000}}, &(0x7f0000939000)) fanotify_init(0x25, 0x802) r5 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000ef2000-0x1d)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f00002d8000-0xc)={0x0, 0x0}, &(0x7f0000d76000-0x4)=0xc) syz_open_procfs(r6, &(0x7f0000013000)='ns/cgroup\x00') openat$ion(0xffffffffffffff9c, &(0x7f0000dd5000)='/dev/ion\x00', 0x800, 0x0) pipe2(&(0x7f000058c000), 0x4800) setsockopt$inet_IP_XFRM_POLICY(r4, 0x0, 0x11, &(0x7f0000e12000-0xe8)={{{@in6=@mcast1={0xff, 0x1, [], 0x1}, @in=@rand_addr, 0x2, 0xbd, 0x3, 0x20, 0xa, 0xa0, 0x80, 0xbf, 0x0, r7}, {0x0, 0x8, 0x0, 0x3, 0x6, 0x1fa8, 0x8, 0x20}, {0x1719, 0x0, 0x7ff, 0x7ff}, 0x1, 0x7, 0x0, 0x1, 0x1, 0x3}, {{@in=@broadcast=0xffffffff, 0x1, 0x7f}, 0xa, @in=@empty, 0xffffffffffffffff, 0x3, 0x0, 0xffffffffffffffbc, 0x20, 0x6, 0x2}}, 0xe8) openat$selinux_policy(0xffffffffffffff9c, &(0x7f000010e000-0x10)='/selinux/policy\x00', 0x0, 0x0) setsockopt$netlink_NETLINK_TX_RING(r5, 0x10e, 0x7, &(0x7f0000ab4000-0x10)={0x6, 0x7, 0x52, 0xfffffffffffffffc}, 0x10) 2018/02/10 14:10:19 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$midi(&(0x7f0000134000)='/dev/midi#\x00', 0x1, 0x10d400) ioctl$KVM_CHECK_EXTENSION(r0, 0xae03, 0x8) getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f0000365000-0xe8)={{{@in6=@dev, @in=@rand_addr}}, {{@in6=@remote}, 0x0, @in6=@mcast1}}, &(0x7f0000461000)=0xe8) pkey_alloc(0x0, 0x3) r1 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f00005ae000-0x18)={0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000096a000-0x28)={0x5c, 0x0, &(0x7f0000263000)=[@reply={0x40406301, {0x0, 0x0, 0x4, 0x0, 0x10, 0x0, 0x0, 0x28, 0x8, &(0x7f00005a9000)=[@ptr={0x70742a85, 0x1, &(0x7f00002f0000), 0x1, 0x4, 0x3}], &(0x7f000040a000-0x8)=[0x78]}}, @acquire_done={0x40106309, r2, 0x3}, @register_looper={0x630b}], 0xfb, 0x0, &(0x7f0000e69000-0xfb)="556c12f2714b067da0e02d488a03a0ea3615720b225a8cc69707eb9ccc5f9beb9f0b86514f52251300db3e89c62b75326742121091d0fbbe53abd61b18bdd0f90a23a99b4e73d45df74b50bef29be7bbac91c523025e72b78ecf2dacc142659115ad7d82879660ac58c66784ce140c6506fef027a6b617ae065e09a5a947789ef15e3b414608d15433c97ab1c673cbd4977dedf46afee08acf7eea79b263a9c0544a3524b9cc8ee84aed9b0293832838219a549d0d31bcdd101550c8dec6cb98dee6bdf23903938c1e458f2a08662371e5f50db894ae5225a294343bf017e146935bd52fce88c896f880e034559213e2a4062731b8c12ce70421ff"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000a000)={0x34e, 0x0, &(0x7f00001e5000-0x8)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000006000-0x54)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000-0x30)={0x44, 0x0, &(0x7f0000d06000)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x38, 0x8, &(0x7f000000d000)=[@fda={0x66646185}, @flat={0x73682a85}], &(0x7f0000006000)=[0x20]}}], 0x0, 0x0, &(0x7f0000176000-0x1)}) 2018/02/10 14:10:19 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000a87000-0xb)='/dev/hwrng\x00', 0x4001, 0x0) r2 = getpid() ptrace$pokeuser(0x6, r2, 0x2, 0x2) ioctl$TCSETS(r1, 0x5402, &(0x7f000019f000)={0x5, 0xa0, 0x4, 0xd6, 0x8000, 0x99, 0x8eb, 0x9, 0x1, 0x101, 0x10001, 0x4}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000a000)={0x34e, 0x0, &(0x7f00001e5000-0x8)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000006000-0x54)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000008000-0x30)={0x0, 0x0, &(0x7f0000d06000)=[], 0x0, 0x0, &(0x7f0000176000-0x1)}) 2018/02/10 14:10:19 executing program 1: mmap(&(0x7f0000000000/0xef0000)=nil, 0xef0000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x802, 0x0) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f0000eee000-0x4)=0x7fe, 0x4) sendto$inet(r0, &(0x7f0000dd0000-0x2), 0x0, 0x0, &(0x7f0000515000-0x10)={0x2, 0x0, @empty}, 0x10) setsockopt$inet_int(r0, 0x0, 0x3b, &(0x7f0000eed000-0x4)=0x1000000, 0x1bf) mmap(&(0x7f0000ef0000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$sock_inet_SIOCGIFNETMASK(r0, 0x891b, &(0x7f0000ef1000-0x20)={@common='ip_vti0\x00', @ifru_addrs={0x2, 0x1, @loopback=0x7f000001}}) setsockopt$inet_opts(r0, 0x0, 0x6, &(0x7f0000eec000-0x62)='-', 0x1) recvmsg(r0, &(0x7f0000bd9000)={0x0, 0x0, &(0x7f0000eec000)=[], 0x0, &(0x7f0000ef0000-0x51)=""/81, 0x51}, 0x41002106) 2018/02/10 14:10:19 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$mice(&(0x7f00007ae000-0x10)='/dev/input/mice\x00', 0x0, 0x0) clock_gettime(0x0, &(0x7f0000e45000)={0x0, 0x0}) ppoll(&(0x7f00005bf000-0x30)=[{r1, 0x2004}, {r1, 0x1f}, {r0, 0x80}, {r0, 0xa0}], 0x4, &(0x7f0000db7000-0x8)={r2, r3+10000000}, &(0x7f0000bf9000-0x8)={0xffffffffffffff7f}, 0x8) 2018/02/10 14:10:19 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$vnet(0xffffffffffffff9c, &(0x7f00000e3000)='/dev/vhost-net\x00', 0x2, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) epoll_ctl$EPOLL_CTL_DEL(r1, 0x2, r0) openat$selinux_enforce(0xffffffffffffff9c, &(0x7f00007f3000)='/selinux/enforce\x00', 0x400000, 0x0) ioctl$int_in(r0, 0xaf01, &(0x7f0000198000-0x8)) perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$VHOST_NET_SET_BACKEND(r0, 0xaf02, &(0x7f0000d7c000)={0x0, 0xffffffffffffffff}) 2018/02/10 14:10:19 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000a5000-0x8)) mmap(&(0x7f0000000000/0x19000)=nil, 0x19000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000924000-0xc)='/dev/rfkill\x00', 0x0, 0x0) r1 = userfaultfd(0x200000002) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000e54000-0x18)={0xaa}) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000008000-0x20)={{&(0x7f0000000000/0x4000)=nil, 0x4000}, 0x1}) readv(r0, &(0x7f00001f3000-0x10)=[{&(0x7f0000002000-0x4e)=""/1, 0x1}], 0x1) ioctl$RNDADDTOENTCNT(r0, 0x40045201, &(0x7f0000b27000)) ioctl$RNDADDTOENTCNT(r0, 0x40045201, &(0x7f0000a81000)) ioctl$UFFDIO_UNREGISTER(r1, 0xc020aa04, &(0x7f0000008000-0x4)={&(0x7f0000000000/0x2000)=nil, 0x2000}) 2018/02/10 14:10:19 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$mice(&(0x7f00007ae000-0x10)='/dev/input/mice\x00', 0x0, 0x0) clock_gettime(0x0, &(0x7f0000e45000)={0x0, 0x0}) ppoll(&(0x7f00005bf000-0x30)=[{r1, 0x2004}, {r1, 0x1f}, {r0, 0x80}, {r0, 0xa0}], 0x4, &(0x7f0000db7000-0x8)={r2, r3+10000000}, &(0x7f0000bf9000-0x8)={0xffffffffffffff7f}, 0x8) [ 77.388608] binder: 12700:12704 got reply transaction with no transaction stack [ 77.396182] binder: 12700:12704 transaction failed 29201/-71, size 40-8 line 2757 [ 77.408912] binder: 12700:12704 unknown command 0 [ 77.413996] binder: 12700:12704 ioctl c0306201 2000a000 returned -22 [ 77.417724] binder: 12703:12714 unknown command 0 2018/02/10 14:10:19 executing program 1: mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffffff, 0x89e2, &(0x7f0000002000-0x4)={0xffffffffffffffff}) mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r1 = open(&(0x7f0000002000)='./file0\x00', 0x100, 0x10) r2 = fcntl$getown(r0, 0x9) mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(r1, 0xc1105511, &(0x7f0000001000)={{0x0, 0x3, 0x9, 0x7, "4bcf997ad768c001c0aa408d27c174d775784ffc5cdbbcc976646d621b2d27802002153d38740221b01c3a73", 0x100}, 0x0, 0x0, 0x8001, r2, 0x8, 0x486, "be8aa03f6920de574fe68cdc6e9b779c0ecdf56bdcef65f46eb097f845cdd6998ea075184ea8e221b24d11e215bea6f9a4786c1cf45d137655399c6a66170855", &(0x7f0000003000-0x36)='posix_acl_access+}.{vmnet0selinuxproc:@\'#nodev],user}\x00', 0x36, [], [0xfb29, 0x2f57, 0x4, 0xe70]}) getsockopt$inet_sctp_SCTP_ENABLE_STREAM_RESET(0xffffffffffffffff, 0x84, 0x76, &(0x7f0000001000-0x8)={0x0, 0x3f}, &(0x7f0000001000-0x4)=0x8) getsockopt$inet_sctp_SCTP_PEER_ADDR_THLDS(r0, 0x84, 0x1f, &(0x7f0000001000-0x98)={r3, @in6={{0xa, 0x0, 0x0, @ipv4={[], [0xff, 0xff], @broadcast=0xffffffff}, 0x9}}, 0x3, 0x1}, &(0x7f0000000000)=0x98) r4 = memfd_create(&(0x7f0000001000-0x2)='$\x00', 0x0) mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) write(r4, &(0x7f0000002000)='/', 0x1) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x4, 0x11, r4, 0x0) unlink(&(0x7f0000001000)='./file0\x00') [ 77.440590] binder_alloc: binder_alloc_mmap_handler: 12700 20000000-20002000 already mapped failed -16 [ 77.446035] binder: 12703:12714 ioctl c0306201 2000a000 returned -22 [ 77.462249] binder: BINDER_SET_CONTEXT_MGR already set [ 77.468643] binder: 12700:12704 ioctl 40046207 0 returned -16 [ 77.475091] can: request_module (can-proto-4) failed. 2018/02/10 14:10:19 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000a000)={0x34e, 0x0, &(0x7f00001e5000-0x8)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000006000-0x54)}) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffff9c, 0x89e2, &(0x7f000073f000-0x4)={0xffffffffffffffff}) getsockname(r1, &(0x7f00003b0000-0x14)=@ll={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @dev}, &(0x7f0000587000-0x4)=0x14) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000008000-0x30)={0x0, 0x0, &(0x7f0000d06000)=[], 0x0, 0x0, &(0x7f0000176000-0x1)}) 2018/02/10 14:10:19 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$mice(&(0x7f00007ae000-0x10)='/dev/input/mice\x00', 0x0, 0x0) clock_gettime(0x0, &(0x7f0000e45000)={0x0, 0x0}) ppoll(&(0x7f00005bf000-0x30)=[{0xffffffffffffffff, 0x410}, {r1, 0x2004}, {r1, 0x1f}, {r0, 0x80}, {r0, 0xa0}], 0x5, &(0x7f0000db7000-0x8)={r2, r3+10000000}, &(0x7f0000bf9000-0x8)={0xffffffffffffff7f}, 0x8) [ 77.491972] binder: 12700:12704 got reply transaction with no transaction stack [ 77.491977] binder: 12700:12719 unknown command 0 [ 77.491987] binder: 12700:12719 ioctl c0306201 2000a000 returned -22 [ 77.499547] binder: 12700:12704 transaction failed 29201/-71, size 40-8 line 2757 2018/02/10 14:10:19 executing program 5: munlock(&(0x7f000048e000/0x2000)=nil, 0x2000) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000a5000-0x8)) mmap(&(0x7f0000000000/0x19000)=nil, 0x19000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000924000-0xc)='/dev/rfkill\x00', 0x0, 0x0) r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000e54000-0x18)={0xaa}) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000008000-0x20)={{&(0x7f0000000000/0x4000)=nil, 0x4000}, 0x1}) readv(r0, &(0x7f00001f3000-0x10)=[{&(0x7f0000002000-0x4e)=""/1, 0x1}], 0x1) ioctl$RNDADDTOENTCNT(r0, 0x40045201, &(0x7f00001d8000-0x4)) ioctl$RNDADDTOENTCNT(r0, 0x40045201, &(0x7f0000a81000)) ioctl$UFFDIO_UNREGISTER(r1, 0xc020aa04, &(0x7f0000008000-0x4)={&(0x7f0000000000/0x2000)=nil, 0x2000}) 2018/02/10 14:10:19 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r0, r0, &(0x7f0000049000), 0x3d2) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000008000)={&(0x7f000000f000-0xc)={0x10, 0x34000}, 0xc, &(0x7f0000220000)={&(0x7f00008d6000-0x14)={0x14, 0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, {}, []}, 0x14}, 0x1}, 0x0) r1 = userfaultfd(0x80800) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000ff8000-0x20)={{&(0x7f0000012000/0x2000)=nil, 0x2000}, 0x1}) bpf$MAP_CREATE(0x0, &(0x7f0000fb4000)={0x2, 0x8000000000000004, 0x400, 0x7fd, 0x4, 0xffffffffffffffff}, 0x2c) userfaultfd(0x800) clock_gettime(0x0, &(0x7f0000132000)={0x0, 0x0}) socketpair(0x1d, 0x800, 0x4, &(0x7f0000589000)) r4 = syz_open_dev$mouse(&(0x7f00006eb000)='/dev/input/mouse#\x00', 0xde6e, 0x1) timer_settime(0x0, 0x1, &(0x7f000097e000)={{0x0, r3}, {r2, r3+10000000}}, &(0x7f0000939000)) fanotify_init(0x25, 0x802) r5 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000ef2000-0x1d)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f00002d8000-0xc)={0x0, 0x0}, &(0x7f0000d76000-0x4)=0xc) syz_open_procfs(r6, &(0x7f0000013000)='ns/cgroup\x00') openat$ion(0xffffffffffffff9c, &(0x7f0000dd5000)='/dev/ion\x00', 0x800, 0x0) pipe2(&(0x7f000058c000), 0x4800) setsockopt$inet_IP_XFRM_POLICY(r4, 0x0, 0x11, &(0x7f0000e12000-0xe8)={{{@in6=@mcast1={0xff, 0x1, [], 0x1}, @in=@rand_addr, 0x2, 0xbd, 0x3, 0x20, 0xa, 0xa0, 0x80, 0xbf, 0x0, r7}, {0x0, 0x8, 0x0, 0x3, 0x6, 0x1fa8, 0x8, 0x20}, {0x1719, 0x0, 0x7ff, 0x7ff}, 0x1, 0x7, 0x0, 0x1, 0x1, 0x3}, {{@in=@broadcast=0xffffffff, 0x1, 0x7f}, 0xa, @in=@empty, 0xffffffffffffffff, 0x3, 0x0, 0xffffffffffffffbc, 0x20, 0x6, 0x2}}, 0xe8) openat$selinux_policy(0xffffffffffffff9c, &(0x7f000010e000-0x10)='/selinux/policy\x00', 0x0, 0x0) setsockopt$netlink_NETLINK_TX_RING(r5, 0x10e, 0x7, &(0x7f0000ab4000-0x10)={0x6, 0x7, 0x52, 0xfffffffffffffffc}, 0x10) [ 77.538309] binder: 12733:12735 unknown command 0 [ 77.547276] binder: 12733:12735 ioctl c0306201 2000a000 returned -22 [ 77.579631] binder: release 12700:12704 transaction 443 out, still active [ 77.586695] binder: undelivered TRANSACTION_COMPLETE [ 77.587513] binder: 12733:12740 unknown command 0 [ 77.591858] binder: send failed reply for transaction 443, target dead [ 77.611856] binder: 12733:12740 ioctl c0306201 2000a000 returned -22 2018/02/10 14:10:19 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$evdev(&(0x7f0000dda000-0x12)='/dev/input/event#\x00', 0x0, 0x0) ioctl$EVIOCGRAB(r0, 0x40044590, &(0x7f0000e95000-0x4)) r1 = syz_open_dev$adsp(&(0x7f0000648000)='/dev/adsp#\x00', 0x3, 0x0) fchmodat(r1, &(0x7f0000642000)='./file0\x00', 0x100) ioctl$KVM_GET_LAPIC(r1, 0x8400ae8e, &(0x7f000009b000-0x400)={"1b213995b675c41677f434923c6051abb87d733b71834a78cbdd91bf7d7aa5ab086136431ee033e1bd7ab21c8e3ee46f0af827ea764df8074b873dbf5de83d242c0d45aa87fb3bee7320ff38cb4bd92961f9124127d72e03ff235b7456341ad1043d768f174cf53e2472022693967ee353ab90a4760f942d2739cd9a75979244fcc37baeecec5412cc529b38f4b26a02ece0fae788d52824f14609056393ac3b886e1d36b8c66e35b704dfba157f0b4899a59eacbde6719d08b8faeeb135796d2038d61c7cccdd8ab663100adef4992c02022b6aa74516184d7c6b4bbcd37a430e955fb565f721d6c85c8b14b9790f6afec8da9bbce403e32ef7947faf52a44247fa7c05671ea7d1030f8bdf67222a3cf3704b93163116c1787a875ca11630c952ecf676a3995740046ab9622cba3ff06ddf74b9dbafb1e60a9c998d1fe6f8b82ad68821bf4faec6bafbd4aa8fbf45b843e1acb19908b3bc976069d5a9fe77c9b7edf5dd6dc416b0610b27095ed7453721369965b666e5edef6e3f78362931a016a3bc7ab0cf85b9ff170f854c2090228fd1af4c51f19d2957a82b08f365ecdf38181224a67ad4762ae0224de962d51c00d055c701af64ac12f8e1ffc353a8ab7f5e6b743ba40a2a2a754a5dc3665b4d755b12bbd2fdf62437c5f865962b705344314a3f5cdfd20551a3623ebe9aab2b061630d4a5c35ffd477559de5ca3efb2d131483012d8e3c32bc879f8c8001c3a1efb0395913d48dd227fa0da92cc647366216a86d38f7bf6391330edf00cabba4656fac53e63cd64f1de045f665b032f61f0d7afa288ce1648a63d0589afe94c119408e251be8a3f88f0df2b50c6d261d97d7663275e1e2bb0cbf3a635fbaa30462a286761b73de28ef2cba48404824d985779b745e947a267a18bceb61b993c993e8e32c7a9d6d0403dd66c6d8944bc2fd57c37478ddf114a56e1f654cc8e4dd94b5a3afbd57dd39a865479820333da5a76606d13f6ed881e141e75964137fb560f02e283cfd13164f810bff455ab5811f109fea82610c376d2fdec17012d5d333f19d3148404c34b5ba8c5d16bd5349a244ce89b13f9160126306e5d68eb89576fdd05168375eb7b25b72b2d426e3c72f5187f616fc8fe4132897fcf2cf86676928c11cbeaa7c972a55fedc16a50ba50a50b5fbd603a95c07df2bed975c601f83c8b9493a66cfc0edc25ec582ef131478e9a7001f88f8e4e14d0464e7b03c5d225108d953d1f96a6382894bc66c4fc1c3ca1cc00b8f8424c4754f75fc3f4f02d0d115566f6d0513f002fabb4afd4c313225f4d81766f91cb15e7652cb341889edc86153ffb497772b32c8af5cb96453acf28c7ff1285dfdfc190b350c73a5510f3dc16d3f8e4dcf75e8c559fc8e24d9e1389b3b20888d149737d5cdf84783b2ac13e5aef4650676ba1daf15103e066"}) ioctl$TIOCSBRK(0xffffffffffffffff, 0x40044591) request_key(&(0x7f0000102000)='big_key\x00', &(0x7f0000ad3000)={0x73, 0x79, 0x7a, 0x3}, &(0x7f00006cc000-0x40)='deflate\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', 0xffffffffffffffff) 2018/02/10 14:10:19 executing program 3: mmap(&(0x7f0000000000/0x18000)=nil, 0x18000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000017000-0xa)='/dev/dsp#\x00', 0x1, 0x0) ppoll(&(0x7f0000013000)=[{r0}], 0x1, &(0x7f0000001000)={0x77359400}, &(0x7f0000006000+0xc59), 0x24d) ioctl$int_in(r0, 0x800000c0045006, &(0x7f0000000000)=0x7f) r1 = dup2(r0, r0) ioctl$int_in(r1, 0x5421, &(0x7f000000a000-0x8)=0x1fffffffe0) readv(r0, &(0x7f000000d000-0x10)=[{&(0x7f000000c000-0xef)=""/239, 0xef}], 0x1) mmap(&(0x7f0000018000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000018000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000019000-0xc)={0x0}, &(0x7f0000018000)=0xc) r3 = getpid() mmap(&(0x7f0000018000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000019000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) openat$selinux_user(0xffffffffffffff9c, &(0x7f000001a000-0xe)='/selinux/user\x00', 0x2, 0x0) rt_tgsigqueueinfo(r2, r3, 0x33, &(0x7f0000018000)={0x34, 0x7, 0xb0}) 2018/02/10 14:10:19 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000a5000-0x8)) mmap(&(0x7f0000000000/0x19000)=nil, 0x19000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000924000-0xc)='/dev/rfkill\x00', 0x0, 0x0) r1 = userfaultfd(0x7fe) pipe(&(0x7f0000e03000)) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000e54000-0x18)={0xaa}) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000008000-0x20)={{&(0x7f0000000000/0x4000)=nil, 0x4000}, 0x1}) readv(r0, &(0x7f00001f3000-0x10)=[{&(0x7f0000002000-0x4e)=""/1, 0x1}], 0x1) ioctl$RNDADDTOENTCNT(r0, 0x40045201, &(0x7f0000b27000)=0x1) ioctl$RNDADDTOENTCNT(r0, 0x40045201, &(0x7f0000a81000)) memfd_create(&(0x7f00007f9000-0x1c)="776c616e305d2e652afc706f7369785f61636c5f6163636573732400", 0x0) ioctl$UFFDIO_UNREGISTER(r1, 0xc020aa04, &(0x7f0000008000-0x4)={&(0x7f0000000000/0x2000)=nil, 0x2000}) 2018/02/10 14:10:19 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r0, r0, &(0x7f0000049000), 0x3d2) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000008000)={&(0x7f000000f000-0xc)={0x10, 0x34000}, 0xc, &(0x7f0000220000)={&(0x7f00008d6000-0x14)={0x14, 0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, {}, []}, 0x14}, 0x1}, 0x0) r1 = userfaultfd(0x80800) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000ff8000-0x20)={{&(0x7f0000012000/0x2000)=nil, 0x2000}, 0x1}) bpf$MAP_CREATE(0x0, &(0x7f0000fb4000)={0x2, 0x8000000000000004, 0x400, 0x7fd, 0x4, 0xffffffffffffffff}, 0x2c) userfaultfd(0x800) clock_gettime(0x0, &(0x7f0000132000)={0x0, 0x0}) socketpair(0x1d, 0x800, 0x4, &(0x7f0000589000)) r4 = syz_open_dev$mouse(&(0x7f00006eb000)='/dev/input/mouse#\x00', 0xde6e, 0x1) timer_settime(0x0, 0x1, &(0x7f000097e000)={{0x0, r3}, {r2, r3+10000000}}, &(0x7f0000939000)) fanotify_init(0x25, 0x802) r5 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000ef2000-0x1d)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f00002d8000-0xc)={0x0, 0x0}, &(0x7f0000d76000-0x4)=0xc) syz_open_procfs(r6, &(0x7f0000013000)='ns/cgroup\x00') openat$ion(0xffffffffffffff9c, &(0x7f0000dd5000)='/dev/ion\x00', 0x800, 0x0) pipe2(&(0x7f000058c000), 0x4800) setsockopt$inet_IP_XFRM_POLICY(r4, 0x0, 0x11, &(0x7f0000e12000-0xe8)={{{@in6=@mcast1={0xff, 0x1, [], 0x1}, @in=@rand_addr, 0x2, 0xbd, 0x3, 0x20, 0xa, 0xa0, 0x80, 0xbf, 0x0, r7}, {0x0, 0x8, 0x0, 0x3, 0x6, 0x1fa8, 0x8, 0x20}, {0x1719, 0x0, 0x7ff, 0x7ff}, 0x1, 0x7, 0x0, 0x1, 0x1, 0x3}, {{@in=@broadcast=0xffffffff, 0x1, 0x7f}, 0xa, @in=@empty, 0xffffffffffffffff, 0x3, 0x0, 0xffffffffffffffbc, 0x20, 0x6, 0x2}}, 0xe8) openat$selinux_policy(0xffffffffffffff9c, &(0x7f000010e000-0x10)='/selinux/policy\x00', 0x0, 0x0) setsockopt$netlink_NETLINK_TX_RING(r5, 0x10e, 0x7, &(0x7f0000ab4000-0x10)={0x6, 0x7, 0x52, 0xfffffffffffffffc}, 0x10) 2018/02/10 14:10:19 executing program 1: mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x3, 0x32, 0xffffffffffffffff, 0x0) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000000)={0xffffffffffffffff, &(0x7f0000001000-0x2c), &(0x7f0000000000)="5db897308d6581dc833d35a28422625282d529b64d338990b94bb045c1adf9bac02c0a94d46dab2434f876d57d5871617b801c8ed46db565e52fbf0ef5dd799f773a335cd43197854cf6be5d8ba3ba182c7aaad0349c30bf"}, 0x20) r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_buf(r0, 0x0, 0x40, &(0x7f0000000000), 0x345) r1 = dup3(0xffffffffffffff9c, r0, 0x80000) ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0106434, &(0x7f0000000000)={0x7ff, 0x0, 0x10003}) mmap(&(0x7f0000003000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000004000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000004000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) getsockopt$inet_sctp_SCTP_EVENTS(r1, 0x84, 0xb, &(0x7f0000004000), &(0x7f0000005000-0x4)=0xb) ioctl$DRM_IOCTL_AGP_FREE(r1, 0x40106435, &(0x7f0000003000)={0x5, r2, 0x10000, 0x7fff}) 2018/02/10 14:10:19 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$mice(&(0x7f00001fc000-0x10)='/dev/input/mice\x00', 0x0, 0x100) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000a000)={0x34e, 0x0, &(0x7f00001e5000-0x8)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000006000-0x54)}) remap_file_pages(&(0x7f00004de000/0x1000)=nil, 0x1000, 0x2000001, 0xe490, 0x1100) r2 = syz_open_dev$sndpcmp(&(0x7f0000067000)='/dev/snd/pcmC#D#p\x00', 0x101, 0x100) setsockopt$ARPT_SO_SET_REPLACE(r2, 0x0, 0x60, &(0x7f00008b8000-0x454)={'filter\x00', 0x7, 0x4, 0x408, 0x214, 0x214, 0x104, 0x324, 0x324, 0x324, 0x4, &(0x7f0000649000-0x40), {[{{@arp={@rand_addr=0x6, @loopback=0x7f000001, 0xffffffff, 0x0, @mac=@dev={[0xaa, 0xaa, 0xaa, 0xaa], 0x0, 0xa}, {[0xff, 0xff, 0xff, 0xff, 0xff, 0xff]}, @empty, {[0xff, 0x0, 0xff, 0xff, 0xff, 0xff]}, 0x6, 0x2, 0x3ff, 0x6, 0xfff, 0x5, @syzn={0x73, 0x79, 0x7a, 0x0}, @common='ip6tnl0\x00', {}, {0xff}, 0x0, 0x11}, 0xc0, 0x104}, @unspec=@LED={0x44, 'LED\x00', 0x0, {'syz0\x00', 0x1, 0x400, 0x401}}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@empty, @mac=@empty, @loopback=0x7f000001, @empty, 0x9, 0x1}}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@empty, @mac=@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @broadcast=0xffffffff, @broadcast=0xffffffff, 0x2, 0x1}}}], {{[], 0xc0, 0xe4}, {0x24, '\x00', 0x0, 0xfffffffffffffffe}}}}, 0x454) sendmsg$nl_xfrm(r1, &(0x7f000030f000-0x1c)={&(0x7f00001c8000)={0x10, 0x0, 0x0, 0x424}, 0xc, &(0x7f0000eb4000-0x8)={&(0x7f00004ad000)=@getsadinfo={0x284, 0x23, 0x0, 0x2, 0x3, 0x9, [@migrate={0x190, 0x11, [{@in=@multicast2=0xe0000002, @in6=@mcast1={0xff, 0x1, [], 0x1}, 0x6c, 0x2, 0x0, 0xffffffffffffffff, 0x2, 0x2}, {@in6=@empty, @in6=@empty, 0x3f, 0x1, 0x0, 0x6, 0x0, 0xa}, {@in=@multicast1=0xe0000001, @in6=@ipv4={[], [0xff, 0xff], @dev={0xac, 0x14, 0x0, 0x17}}, 0x0, 0x4, 0x0, 0x0, 0x2, 0xa}, {@in=@rand_addr=0x1000, @in6=@dev={0xfe, 0x80, [], 0x0, 0x13}, 0x7f, 0x4, 0x0, 0x0, 0x2, 0x2}, {@in6=@loopback={0x0, 0x1}, @in=@rand_addr=0x10000, 0x3f, 0x0, 0x0, 0x4, 0x2, 0x2c342c319a9e5bd1}, {@in6=@mcast2={0xff, 0x2, [], 0x1}, @in6=@loopback={0x0, 0x1}, 0x7e, 0x1, 0x0, 0x6, 0xa, 0xa}, {@in6=@local={0xfe, 0x80, [], 0x0, 0xaa}, @in=@multicast1=0xe0000001, 0x6f, 0x1, 0x0, 0xffffffffffffffff, 0x2, 0xa}, {@in=@multicast2=0xe0000002, @in=@remote={0xac, 0x14, 0x0, 0xbb}, 0x33, 0x4, 0x0, 0x0, 0xa, 0x2}, {@in=@multicast2=0xe0000002, @in=@multicast2=0xe0000002, 0xff, 0x6, 0x0, 0xffffffffffffffff, 0xa, 0xa}]}, @tmpl={0x84, 0x5, [{{@in=@empty, 0x3, 0x3f}, 0xa, @in6=@local={0xfe, 0x80, [], 0x0, 0xaa}, 0x4, 0x5, 0x3, 0xfc, 0x4, 0x3, 0xc00000}, {{@in6=@empty, 0x1, 0xff}, 0xa, @in=@empty, 0x5, 0x7, 0x1, 0x7fff, 0x7, 0x2, 0x2e125a8f}]}, @output_mark={0x8, 0x1d, 0x5}, @replay_val={0x10, 0xa, {0x1, 0x7, 0x81}}, @extra_flags={0x8, 0x18, 0xfff}, @replay_esn_val={0x24, 0x17, {0x2, 0x3, 0x2, 0x1, 0x2, 0xa854, [0x7, 0x8]}}, @lastused={0x10, 0xf, 0x8}, @extra_flags={0x8, 0x18, 0x10000}]}, 0x284}, 0x1}, 0x80) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8916, &(0x7f000020d000-0x20)={@common='ipddp0\x00', @ifru_addrs={0x2, 0x3, @local={0xac, 0x14, 0x0, 0xaa}}}) openat$rtc(0xffffffffffffff9c, &(0x7f0000796000-0x9)='/dev/rtc\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000-0x30)={0x44, 0x0, &(0x7f0000d06000)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x38, 0x8, &(0x7f000000d000)=[@fda={0x66646185}, @flat={0x73682a85}], &(0x7f0000006000)=[0x20]}}], 0x0, 0x0, &(0x7f0000176000-0x1)}) ioctl$EVIOCGBITSW(r2, 0x80404525, &(0x7f0000150000-0xde)=""/222) 2018/02/10 14:10:19 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$mice(&(0x7f00007ae000-0x10)='/dev/input/mice\x00', 0x0, 0x0) clock_gettime(0x0, &(0x7f0000e45000)={0x0, 0x0}) ppoll(&(0x7f00005bf000-0x30)=[{0xffffffffffffffff, 0x410}, {r1, 0x2004}, {r1, 0x1f}, {r0, 0x80}, {r0, 0xa0}], 0x5, &(0x7f0000db7000-0x8)={r2, r3+10000000}, &(0x7f0000bf9000-0x8)={0xffffffffffffff7f}, 0x8) 2018/02/10 14:10:19 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000a000)={0x34e, 0x0, &(0x7f00001e5000-0x8)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000006000-0x54)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000008000-0x30)={0x0, 0x0, &(0x7f0000d06000)=[], 0x27c, 0x0, &(0x7f00009c1000-0x1)="1d"}) r1 = socket$inet(0x2, 0x4, 0x0) connect$inet(r1, &(0x7f000016c000-0x10)={0x2, 0x1, @multicast2=0xe0000002}, 0x10) 2018/02/10 14:10:19 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$mice(&(0x7f00007ae000-0x10)='/dev/input/mice\x00', 0x0, 0x0) clock_gettime(0x0, &(0x7f0000e45000)={0x0, 0x0}) ppoll(&(0x7f00005bf000-0x30)=[{0xffffffffffffffff, 0x410}, {r1, 0x2004}, {r1, 0x1f}, {r0, 0x80}, {r0, 0xa0}], 0x5, &(0x7f0000db7000-0x8)={r2, r3+10000000}, &(0x7f0000bf9000-0x8)={0xffffffffffffff7f}, 0x8) [ 77.690266] binder: 12755:12764 Acquire 1 refcount change on invalid ref 0 ret -22 [ 77.698106] binder: 12755:12764 unknown command 0 [ 77.704164] binder: 12754:12758 unknown command 0 [ 77.710164] binder: 12754:12758 ioctl c0306201 2000a000 returned -22 [ 77.715126] binder: 12755:12764 ioctl c0306201 2000a000 returned -22 2018/02/10 14:10:19 executing program 1: mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rfkill\x00', 0x44000, 0x0) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) recvmsg$kcm(0xffffffffffffffff, &(0x7f000061c000)={&(0x7f00008e4000)=@pppol2tpv3={0x0, 0x0, {0x0, 0x0, {0x0, 0xffffffffffffffff, @multicast1}}}, 0x2e, &(0x7f000008c000)=[{&(0x7f0000001000-0x40)=""/64, 0x40}, {&(0x7f000042f000-0x2e)=""/46, 0x2e}], 0x2, &(0x7f0000000000)=""/18, 0x12, 0x1}, 0x10000) fcntl$dupfd(r0, 0x406, r1) mmap(&(0x7f0000000000/0x17000)=nil, 0x17000, 0x3, 0x32, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x32, &(0x7f0000016000-0x1d5)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @dev={[0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x24, 0xffffffffffffffff, 0x0, 0x0, 0x2f, 0x0, @local={0xac, 0x14, 0xffffffffffffffff, 0xaa}, @multicast1=0xe0000001, {[]}}, @gre={{0x0, 0x0, 0x1, 0x0, 0xb, 0x5, 0x0, 0x4, 0x880b, 0x0, 0x0, []}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800, []}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x86dd, []}}}}}}, 0x0) mmap(&(0x7f0000017000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$midi(&(0x7f0000017000)='/dev/midi#\x00', 0x5, 0x400000) accept4$ax25(r2, &(0x7f000000e000), &(0x7f0000014000)=0x10, 0x800) 2018/02/10 14:10:19 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000cd4000-0x8)=0x1) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00009e8000-0x24)) r1 = syz_open_pts(r0, 0x0) readv(r1, &(0x7f0000fd6000)=[{&(0x7f0000314000-0xd7)=""/1, 0x1}], 0x1) r2 = syz_open_dev$vcsa(&(0x7f0000170000)='/dev/vcsa#\x00', 0xffffffff, 0x2000) r3 = syz_open_procfs(0x0, &(0x7f0000c9b000-0x7)='limits\x00') ioctl$ION_IOC_ALLOC(r2, 0xc0184900, &(0x7f0000484000-0x18)={0x40, 0x4, 0x1, r3}) ioctl$TCSETA(r1, 0x5402, &(0x7f0000185000-0x14)) 2018/02/10 14:10:19 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000a5000-0x8)) r0 = socket$inet6(0xa, 0x8000f, 0x3) getsockopt$inet_sctp6_SCTP_PR_SUPPORTED(0xffffffffffffff9c, 0x84, 0x71, &(0x7f0000c52000)={0x0, 0x1ff}, &(0x7f0000b80000)=0x8) setsockopt$inet_sctp6_SCTP_AUTH_DELETE_KEY(r0, 0x84, 0x19, &(0x7f0000f24000)={r1, 0x1f}, 0x6) r2 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000924000-0xc)='/dev/rfkill\x00', 0x0, 0x0) r3 = userfaultfd(0x0) ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f0000e54000-0x18)={0xaa}) ioctl$UFFDIO_REGISTER(r3, 0xc020aa00, &(0x7f0000008000-0x20)={{&(0x7f0000000000/0x4000)=nil, 0x4000}, 0x1}) fcntl$notify(r3, 0x402, 0x1) sendto$inet(r2, &(0x7f0000e60000)="570bc9312675fe12f832af351c59630e68864ae1f1f4e94c464202d0fa3efdaf7c3280b81156fa85da499ece63594c0bf6af38b545871d8a1f84cb4102d17a7f5105a96829ffc383d6f338457d6e078b6cea53f795e0828b2f807125a98e1b304da8460704d5bc", 0x67, 0x4000, &(0x7f0000514000-0x10)={0x2, 0x1, @broadcast=0xffffffff}, 0x10) readv(r2, &(0x7f00001f3000-0x10)=[{&(0x7f0000002000-0x4e)=""/1, 0x1}], 0x1) ioctl$RNDADDTOENTCNT(r2, 0x40045201, &(0x7f0000b27000)) ioctl$RNDADDTOENTCNT(r2, 0x40045201, &(0x7f0000a81000)) ioctl$UFFDIO_UNREGISTER(r3, 0xc020aa04, &(0x7f0000008000-0x4)={&(0x7f0000000000/0x2000)=nil, 0x2000}) [ 77.736452] binder_alloc: binder_alloc_mmap_handler: 12754 20000000-20002000 already mapped failed -16 [ 77.758671] binder: BINDER_SET_CONTEXT_MGR already set [ 77.764368] binder: 12754:12758 ioctl 40046207 0 returned -16 [ 77.774452] binder: 12754:12758 unknown command 0 [ 77.780013] binder: 12754:12758 ioctl c0306201 2000a000 returned -22 2018/02/10 14:10:19 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$admmidi(&(0x7f0000b51000)='/dev/admmidi#\x00', 0xe3c, 0x0) ioctl$SNDRV_SEQ_IOCTL_SUBSCRIBE_PORT(r0, 0x40505330, &(0x7f0000070000)={{0x800, 0x101}, {0x8c, 0x1}, 0x8e5, 0x3, 0x9}) r1 = syz_open_dev$evdev(&(0x7f0000238000-0x12)='/dev/input/event#\x00', 0x2, 0x28001) write$evdev(r1, &(0x7f0000038000-0x18)=[{{}, 0x1, 0x47, 0x2}, {}], 0x20) [ 77.792990] binder: 12755:12781 unknown command 0 [ 77.797469] binder_alloc: 12754: binder_alloc_buf, no vma [ 77.803506] binder: 12754:12771 transaction failed 29189/-3, size 56-8 line 2957 [ 77.812642] binder: 12755:12781 ioctl c0306201 2000a000 returned -22 2018/02/10 14:10:19 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000699000)='/selinux/status\x00', 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00003d9000)='highspeed\x00', 0xa) r1 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000ead000)={0x581, 0x0, &(0x7f00001e5000-0x8)=[], 0x0, 0x0, &(0x7f0000006000-0x54)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000008000-0x30)={0x0, 0x0, &(0x7f0000d06000)=[], 0x0, 0x0, &(0x7f0000176000-0x1)}) 2018/02/10 14:10:19 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000a000)={0x34e, 0x0, &(0x7f00001e5000-0x8)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000006000-0x54)}) r1 = memfd_create(&(0x7f0000b65000)='/dev/binder#\x00', 0x1) r2 = getpgid(0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_ADD(r1, 0xc1105517, &(0x7f0000da3000-0x10c)={{0x8, 0x7, 0xfffffffffffffffe, 0x800, "d57f2d816e39ea9a38cf6d0685282a87ae000dbb477a55cfaa62815d5775aabed3421e1e13bc441483c834d8", 0x2}, 0x0, 0x0, 0x2, r2, 0x1f, 0x1, "feeec7d042dfcd0932d511abfc15ff31ad90db9ecaac0a7062b23a4653565dff36530f4d4e8c41e12292e020e22fe5e9c0025f927e8e57e4f6b02ac0045685e8", &(0x7f000096f000-0xd)='/dev/binder#\x00', 0xd, [], [0x1, 0x2, 0xffffffff, 0x1]}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000-0x30)={0x44, 0x0, &(0x7f0000d06000)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x38, 0x8, &(0x7f000000d000)=[@fda={0x66646185}, @flat={0x73682a85}], &(0x7f0000006000)=[0x20]}}], 0x0, 0x0, &(0x7f0000176000-0x1)}) 2018/02/10 14:10:19 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$mice(&(0x7f00007ae000-0x10)='/dev/input/mice\x00', 0x0, 0x0) clock_gettime(0x0, &(0x7f0000e45000)={0x0, 0x0}) ppoll(&(0x7f00005bf000-0x30)=[{r0}, {r1, 0x2004}, {r1, 0x1f}, {r0, 0x80}, {r0, 0xa0}], 0x5, &(0x7f0000db7000-0x8)={r2, r3+10000000}, &(0x7f0000bf9000-0x8)={0xffffffffffffff7f}, 0x8) [ 77.838246] binder: undelivered TRANSACTION_ERROR: 29189 [ 77.848263] binder: release 12754:12758 transaction 449 out, still active [ 77.855294] binder: undelivered TRANSACTION_COMPLETE [ 77.860450] binder: send failed reply for transaction 449, target dead [ 77.900545] binder: 12796:12800 unknown command 0 [ 77.906743] binder: 12796:12800 ioctl c0306201 2000a000 returned -22 [ 77.919135] binder: 12795:12802 unknown command 0 [ 77.924155] binder: 12795:12802 ioctl c0306201 20ead000 returned -22 [ 77.941659] binder: 12795:12805 unknown command 0 [ 77.942357] binder_alloc: binder_alloc_mmap_handler: 12796 20000000-20002000 already mapped failed -16 [ 77.946670] binder: 12795:12805 ioctl c0306201 20ead000 returned -22 [ 77.962726] binder: BINDER_SET_CONTEXT_MGR already set [ 77.972920] binder: 12796:12808 unknown command 0 [ 77.978141] binder: 12796:12808 ioctl c0306201 2000a000 returned -22 [ 77.979174] binder: 12796:12800 ioctl 40046207 0 returned -16 [ 77.992534] binder_alloc: 12796: binder_alloc_buf, no vma 2018/02/10 14:10:20 executing program 7: r0 = dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r1 = perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3d75, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80}, 0x0, 0x0, r0, 0x0) r2 = syz_open_dev$evdev(&(0x7f0000dda000-0x12)='/dev/input/event#\x00', 0x0, 0x0) r3 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f00006a4000)='/selinux/avc/cache_stats\x00', 0x0, 0x0) ioctl$sock_ipx_SIOCIPXCFGDATA(r3, 0x89e2, &(0x7f00007ca000-0x4)) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r3, 0x84, 0x18, &(0x7f00007f0000-0x6)={0x0, 0xfffffffffffffc01}, &(0x7f000024e000)=0x6) setsockopt$inet_sctp6_SCTP_DELAYED_SACK(r3, 0x84, 0x10, &(0x7f00004ee000-0x8)=@assoc_value={r4, 0x1cc}, 0x8) r5 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000f68000-0x16)='/selinux/checkreqprot\x00', 0x2000, 0x0) getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000c23000-0xc)={0x0}, &(0x7f000023b000)=0xfffffffffffffe02) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) readv(r1, &(0x7f0000000000)=[{&(0x7f0000000000)=""/7, 0x7}, {&(0x7f0000c1c000)=""/131, 0x83}, {&(0x7f0000d5c000-0x51)=""/81, 0x51}, {&(0x7f0000002000-0x46)=""/70, 0x46}, {&(0x7f0000002000-0x1000)=""/4096, 0x1000}, {&(0x7f0000002000-0xcf)=""/207, 0xcf}], 0x367) ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(r5, 0xc1105511, &(0x7f00003fc000-0x10c)={{0xe4, 0x7, 0x101, 0x6a38, "1c5d810b195b4f61c9279832416c9e6c766997c588d4eded7468102c4a242cae4ad6b20defee6213b2ee69e6", 0x6}, 0x0, 0x0, 0x2, r6, 0x1, 0xac, "0d18f87d06b85a9efce5581b04b10c0cb5f881aa41382bfe151b051440ad735e26f942655961859ffcdc706336897f3cf513d1aa6614b8d215d3ac8aaa22001b", &(0x7f0000924000-0x1)='\x00', 0x1, [], [0x2, 0x0, 0xfff, 0x7]}) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_NEXT_DEVICE(r5, 0xc0045540, &(0x7f00007e3000)=0x1) ioctl$sock_FIOSETOWN(r5, 0x8901, &(0x7f00003fe000-0x4)=r6) ioctl$SNDRV_SEQ_IOCTL_GET_PORT_INFO(r1, 0xc0a45322, &(0x7f0000e7b000-0xa8)) ioctl$sock_bt_hidp_HIDPCONNADD(r0, 0x400448c8, &(0x7f0000174000-0x8d)={r3, r0, 0x9, 0x5, &(0x7f00009e1000-0xfd)="a6c35c1131a61f676b011684284242ce304bbecbb83b42ec2af1a4d082c3aa3ff7468cbf40495fb63047df30770e507cb719fd0d49b125cc5c4016bdbd457ce1294b541948f3f1290f9adc9dea6ff7c262704957b2972dff0a07c5c2e1f7a4c90b57d34f5cfc8e971e3b51804ea9f4fab30441a298aa25edfabee520ec9fa458849b7de954ed301cf15e045f619f9302e1f628cb03a3489c70bd4526e9655852668881ee295434a29c86d47ec39b4f202fb10bb343b2f4c5442e96a82b892fa74b5d2df73197efc06318bc672e7d46bd5b640a07a45d1d7f4a7d4c9474e1046bf0f2308b93d3ccc355f9e149395cbc6501b4893cf189b25b9ae441f7fb", 0xd9c, 0x5, 0x1000000000000000, 0x8000, 0x7, 0xffffffffffffff4b, 0x7, "f8e21a352fb6c7846e6115ebe20f41d4fb3b4ad0762bd9f19abfc662bab2c93677f7125a1796b2a7f549c4115a40d3b610fd93ab807b1abe9dd7baa874832ce927a69e7358cc3ab3852a6242581ebab29a98334062b842105a07931d7466c882bec6ebaa683f078ca059044ca7"}) ioctl$int_out(r1, 0x5460, &(0x7f00000bc000)) ioctl$EVIOCGABS20(r2, 0x80184560, &(0x7f00009dd000)=""/106) ioctl$EVIOCGRAB(r2, 0x40044590, &(0x7f0000e95000-0x4)) ioctl$sock_SIOCINQ(r5, 0x541b, &(0x7f0000801000)) ioctl$TIOCSBRK(0xffffffffffffffff, 0x40044591) request_key(&(0x7f0000102000)='big_key\x00', &(0x7f0000ad3000)={0x73, 0x79, 0x7a, 0x3}, &(0x7f00006cc000-0x40)='deflate\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', 0xffffffffffffffff) 2018/02/10 14:10:20 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r0, r0, &(0x7f0000049000), 0x3d2) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000008000)={&(0x7f000000f000-0xc)={0x10, 0x34000}, 0xc, &(0x7f0000220000)={&(0x7f00008d6000-0x14)={0x14, 0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, {}, []}, 0x14}, 0x1}, 0x0) r1 = userfaultfd(0x80800) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000ff8000-0x20)={{&(0x7f0000012000/0x2000)=nil, 0x2000}, 0x1}) bpf$MAP_CREATE(0x0, &(0x7f0000fb4000)={0x2, 0x8000000000000004, 0x400, 0x7fd, 0x4, 0xffffffffffffffff}, 0x2c) userfaultfd(0x800) clock_gettime(0x0, &(0x7f0000132000)={0x0, 0x0}) socketpair(0x1d, 0x800, 0x4, &(0x7f0000589000)) r4 = syz_open_dev$mouse(&(0x7f00006eb000)='/dev/input/mouse#\x00', 0xde6e, 0x1) timer_settime(0x0, 0x1, &(0x7f000097e000)={{0x0, r3}, {r2, r3+10000000}}, &(0x7f0000939000)) fanotify_init(0x25, 0x802) r5 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000ef2000-0x1d)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f00002d8000-0xc)={0x0, 0x0}, &(0x7f0000d76000-0x4)=0xc) syz_open_procfs(r6, &(0x7f0000013000)='ns/cgroup\x00') openat$ion(0xffffffffffffff9c, &(0x7f0000dd5000)='/dev/ion\x00', 0x800, 0x0) pipe2(&(0x7f000058c000), 0x4800) setsockopt$inet_IP_XFRM_POLICY(r4, 0x0, 0x11, &(0x7f0000e12000-0xe8)={{{@in6=@mcast1={0xff, 0x1, [], 0x1}, @in=@rand_addr, 0x2, 0xbd, 0x3, 0x20, 0xa, 0xa0, 0x80, 0xbf, 0x0, r7}, {0x0, 0x8, 0x0, 0x3, 0x6, 0x1fa8, 0x8, 0x20}, {0x1719, 0x7fff, 0x0, 0x7ff}, 0x1, 0x7, 0x0, 0x1, 0x1, 0x3}, {{@in=@broadcast=0xffffffff, 0x1, 0x7f}, 0xa, @in=@empty, 0xffffffffffffffff, 0x3, 0x0, 0xffffffffffffffbc, 0x20, 0x6, 0x2}}, 0xe8) openat$selinux_policy(0xffffffffffffff9c, &(0x7f000010e000-0x10)='/selinux/policy\x00', 0x0, 0x0) setsockopt$netlink_NETLINK_TX_RING(r5, 0x10e, 0x7, &(0x7f0000ab4000-0x10)={0x6, 0x7, 0x52, 0xfffffffffffffffc}, 0x10) 2018/02/10 14:10:20 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$key(0xf, 0x3, 0x2) ioctl$sock_inet_SIOCSIFADDR(r0, 0x8916, &(0x7f00007c8000-0x20)={@common='nr0\x00', @ifru_addrs={0x2, 0x1, @multicast1=0xe0000001}}) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000012000), 0x4) pipe(&(0x7f00001a3000)={0x0, 0x0}) clock_gettime(0x0, &(0x7f0000935000-0x8)={0x0, 0x0}) write$sndseq(r1, &(0x7f00000ec000)=[{0x29, 0x100000001, 0x9235, 0x4, @tick=0x80000000, {0x0, 0x10001}, {0x7, 0x7}, @quote={{0xffff, 0x800}, 0x4, &(0x7f0000f88000-0x1c)={0x9, 0x7fffffff, 0x0, 0xfffffffeffffffff, @tick=0xcc2, {0x1000, 0x7f}, {0x9, 0x2}, @addr={0xfff, 0x69b5}}}}, {0x1ab3ec84, 0x3, 0x3, 0xffffffffffffffff, @tick=0x10001, {0x2, 0xfb13}, {0xc3f6, 0x2}, @connect={{0x101, 0x2}, {0x6, 0x5b0e6363}}}, {0x10001, 0xfffffffffffffffa, 0xd019, 0x100000001, @time={r3, r4+10000000}, {0x81, 0x7cea}, {0x5, 0x9}, @raw8={"f20311aae220d9afd2f708f2"}}, {0x1, 0x7, 0x800, 0x45ed28c5, @tick, {0x0, 0x3f}, {0x6, 0x8}, @quote={{0x80000000, 0x3}, 0x7}}], 0x70) sendmsg$key(r0, &(0x7f0000c29000)={0x0, 0x0, &(0x7f0000b90000)={&(0x7f00007ac000)={0x2, 0x10, 0x0, 0x0, 0x2, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, []}, 0x10}, 0x1}, 0x0) sendmsg$key(r2, &(0x7f00003e3000-0x1c)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000544000-0x4)={0x2, 0xa, 0x400, 0x0, 0x20000000000001ca, 0x0, 0x0, 0xffffffffffffffff, []}, 0x10}, 0x1}, 0x0) openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000cd5000-0x18)='/selinux/avc/hash_stats\x00', 0x0, 0x0) ioctl$RNDZAPENTCNT(r1, 0x5204, &(0x7f000070f000-0x4)=0x8) 2018/02/10 14:10:20 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000a5000-0x8)) mmap(&(0x7f0000000000/0x19000)=nil, 0x19000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000924000-0xc)='/dev/rfkill\x00', 0x0, 0x0) r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000e54000-0x18)={0xaa}) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000008000-0x20)={{&(0x7f0000000000/0x4000)=nil, 0x4000}, 0x1}) readv(r0, &(0x7f00001f3000-0x10)=[{&(0x7f0000002000-0x4e)=""/1, 0x1}], 0x1) ioctl$RNDADDTOENTCNT(r0, 0x40045201, &(0x7f0000b27000)) ioctl$RNDADDTOENTCNT(r0, 0x40045201, &(0x7f0000a81000)) ioctl$UFFDIO_UNREGISTER(r1, 0xc020aa04, &(0x7f0000008000-0x4)={&(0x7f0000000000/0x2000)=nil, 0x2000}) fallocate(r1, 0x2, 0x77, 0x10000) 2018/02/10 14:10:20 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$mice(&(0x7f00007ae000-0x10)='/dev/input/mice\x00', 0x0, 0x0) clock_gettime(0x0, &(0x7f0000e45000)={0x0, 0x0}) ppoll(&(0x7f00005bf000-0x30)=[{r0}, {r1, 0x1f}, {r0, 0x80}, {r0, 0xa0}], 0x4, &(0x7f0000db7000-0x8)={r2, r3+10000000}, &(0x7f0000bf9000-0x8)={0xffffffffffffff7f}, 0x8) 2018/02/10 14:10:20 executing program 6: r0 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000d8f000-0x19)='/selinux/avc/cache_stats\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000a000)={0x34e, 0x0, &(0x7f00001e5000-0x8)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000006000-0x54)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000008000-0x30)={0x0, 0x0, &(0x7f0000d06000)=[], 0x0, 0x0, &(0x7f0000176000-0x1)}) 2018/02/10 14:10:20 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000d75000+0x77c)='/dev/rfkill\x00', 0x0, 0x0) r1 = socket$vsock_stream(0x28, 0x1, 0x0) ioctl$sock_FIOGETOWN(r1, 0x8903, &(0x7f0000c4f000)=0x0) perf_event_open(&(0x7f000025c000)={0x2, 0xfffffe4d, 0x3e2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0xfffffffffffffffc, 0x283e, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x2, 0x0, 0x57ce, 0x0, 0x0, 0x8001000}, r2, 0xffffffffffffffff, r0, 0x0) pselect6(0x40, &(0x7f0000f34000-0x40)={0x3ffffd}, &(0x7f0000768000), &(0x7f0000086000), &(0x7f0000349000), &(0x7f0000f14000)={&(0x7f0000a66000-0x8), 0x8}) stat(&(0x7f0000918000-0x8)='./file0\x00', &(0x7f0000e4b000-0x44)) getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000526000)={{{@in=@rand_addr, @in=@local, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@mcast2}, 0x0, @in=@empty}}, &(0x7f000041d000)=0xe8) r4 = getuid() setresuid(r4, r3, r4) 2018/02/10 14:10:20 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000523000-0x30)={0x8, 0x0, &(0x7f00001e5000-0x8)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000006000-0x54)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000-0x30)={0x44, 0x0, &(0x7f0000d06000)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x38, 0x8, &(0x7f000000d000)=[@fda={0x66646185}, @flat={0x73682a85}], &(0x7f0000006000)=[0x20]}}], 0x0, 0x0, &(0x7f0000176000-0x1)}) [ 77.998245] binder: 12796:12806 transaction failed 29189/-3, size 56-8 line 2957 [ 78.019779] binder: undelivered TRANSACTION_ERROR: 29189 [ 78.025475] binder: release 12796:12800 transaction 455 out, still active [ 78.032468] binder: undelivered TRANSACTION_COMPLETE [ 78.037600] binder: send failed reply for transaction 455, target dead [ 78.083378] binder: 12815:12820 unknown command 0 [ 78.103082] binder_alloc: binder_alloc_mmap_handler: 12816 20000000-20002000 already mapped failed -16 [ 78.108913] binder: 12815:12820 ioctl c0306201 2000a000 returned -22 [ 78.113925] binder: BINDER_SET_CONTEXT_MGR already set 2018/02/10 14:10:20 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) syz_open_dev$mice(&(0x7f00007ae000-0x10)='/dev/input/mice\x00', 0x0, 0x0) clock_gettime(0x0, &(0x7f0000e45000)={0x0, 0x0}) ppoll(&(0x7f00005bf000-0x30)=[{r0}, {r0, 0x80}, {r0, 0xa0}], 0x3, &(0x7f0000db7000-0x8)={r1, r2+10000000}, &(0x7f0000bf9000-0x8)={0xffffffffffffff7f}, 0x8) 2018/02/10 14:10:20 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000a5000-0x8)) mmap(&(0x7f0000000000/0x19000)=nil, 0x19000, 0x3, 0x32, 0xffffffffffffffff, 0x0) prctl$setfpexc(0xc, 0xc0000) r0 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000924000-0xc)='/dev/rfkill\x00', 0x0, 0x0) r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000e54000-0x18)={0xaa}) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000008000-0x20)={{&(0x7f0000000000/0x4000)=nil, 0x4000}, 0x1}) readv(r0, &(0x7f00001f3000-0x10)=[{&(0x7f0000002000-0x4e)=""/1, 0x1}], 0x1) sync() ioctl$RNDADDTOENTCNT(r0, 0x40045201, &(0x7f0000b27000)) ioctl$RNDADDTOENTCNT(r0, 0x40045201, &(0x7f0000a81000)) ioctl$UFFDIO_UNREGISTER(r1, 0xc020aa04, &(0x7f0000008000-0x4)={&(0x7f0000000000/0x2000)=nil, 0x2000}) 2018/02/10 14:10:20 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f00002ef000-0xc)='/dev/autofs\x00', 0x100, 0x0) getsockopt$netrom_NETROM_N2(r1, 0x103, 0x3, &(0x7f000071d000-0x4)=0x3, &(0x7f000005b000)=0x4) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_udp_encap(r2, 0x11, 0x64, &(0x7f0000ff6000)=0x3, 0x4) dup2(r0, r2) ioctl$KVM_INTERRUPT(r1, 0x4004ae86, &(0x7f00004bb000-0x4)=0x8) 2018/02/10 14:10:20 executing program 6: mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000ddb000-0x5)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000cd9000)="b65c4b56f0cf9a1f4aeebc2f42d83870dbbb8b1b3fbb57fbfb6d8b0579226e22b006a3b43119222572f5512a96db866fb6cdbd2626cf781f5538e3676fcd697220cc10e12a9cedd0e596443af10583b4b24a460247c4c7ed879a5ec5a6855d90338b10b28bbea431c19eaeee14b328c7a9abe8e9966fcc09d3c8f9b90999f62e523487c6027091579dadce50357816f71ef37bd98973db5cd4b0ffae266faacb5e5e58a53be05bc4b3", 0xa9, 0x0) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$sndpcmp(&(0x7f0000001000)='/dev/snd/pcmC#D#p\x00', 0x7, 0x8480) ioctl$TCXONC(r1, 0x540a, 0x8) r2 = add_key(&(0x7f0000001000-0x6)='rxrpc\x00', &(0x7f00000e9000)={0x73, 0x79, 0x7a, 0x0}, &(0x7f0000001000-0xfe)="bf8750ca2d375426d36072057b696fa8c70150496e6fd1de3824cdbafd7fe6adbaaf5178d93609327d77a2291cde8635c633c30ec8ce39f29f19915957de26e703b32dc92845a80c4d7cb7fbe3b425765f646a440366ec7e73e1635b2493f6f4a21228b62561fb551a64b1ef96ec53b83cd90cc06b9e4b5d77422deee8f42bed0b6cc6c4d5d38e1df6093c5c3b35e3fa6d83b68c0319df4b325fa4c37f6fe13756484e3ebd948fd799d3b977c90c5daaf8bca82272a74b54c153c2ec9fbdb077a94bdaaf8fba52bd12c22f6d6262f6779ad790029e64c3670998b531d83aed177d9525327b40acb9fa43c70c51a89767040827ef20e5f147238051f64851", 0xfe, 0xfffffffffffffffc) keyctl$link(0x8, r0, r2) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f000000a000)={0x34e, 0x0, &(0x7f00001e5000-0x8)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000006000-0x54)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000008000-0x30)={0x0, 0x0, &(0x7f0000d06000)=[], 0x0, 0x0, &(0x7f0000176000-0x1)}) 2018/02/10 14:10:20 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000a000)={0x34e, 0x0, &(0x7f00001e5000-0x8)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000006000-0x54)}) r1 = syz_open_dev$usbmon(&(0x7f000082c000-0xd)='/dev/usbmon#\x00', 0x2, 0x2) getsockopt$inet_sctp6_SCTP_I_WANT_MAPPED_V4_ADDR(r1, 0x84, 0xc, &(0x7f0000827000-0x4), &(0x7f000034d000)=0x4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000-0x30)={0x44, 0x0, &(0x7f0000d06000)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x38, 0x8, &(0x7f000000d000)=[@fda={0x66646185}, @flat={0x73682a85}], &(0x7f0000006000)=[0x20]}}], 0x0, 0x0, &(0x7f0000176000-0x1)}) 2018/02/10 14:10:20 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = gettid() io_setup(0x1ff, &(0x7f0000ab3000-0x8)=0x0) clock_gettime(0x0, &(0x7f0000500000-0x10)={0x0}) io_getevents(r1, 0x2, 0x2, &(0x7f0000cc8000)=[{}, {}], &(0x7f00001c1000-0x10)={r2}) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12, 0x0, @tid}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) r3 = dup3(0xffffffffffffff9c, 0xffffffffffffffff, 0x80000) setsockopt$inet_opts(r3, 0x0, 0x9, &(0x7f0000972000)="330f4143589d3fdad2ed83882cfd14f9730baf88e67e201e87f8c76be6f5fc71be35985b2f11df791acdc94c33ffa1beef265ccbd42bad5bde7c9e18e6a380de4e0e7f2c1b6f932347984693aee430c66e1d8ac2859e9a804713758baa07c8161048e884cf12e7385eb7cef7d7f6f327ab5d59e9", 0x74) timerfd_settime(r3, 0x1, &(0x7f0000cca000-0x10)={{}, {0x0, 0x989680}}, &(0x7f00005e4000-0x10)) tkill(r0, 0x1000000000016) [ 78.137250] binder: 12816:12821 ioctl 40046207 0 returned -16 [ 78.146072] binder: 12815:12820 unknown command 0 [ 78.158250] binder: 12815:12820 ioctl c0306201 2000a000 returned -22 [ 78.167943] binder: release 12816:12821 transaction 460 out, still active [ 78.174943] binder: undelivered TRANSACTION_COMPLETE [ 78.180101] binder: send failed reply for transaction 460, target dead 2018/02/10 14:10:20 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r0, r0, &(0x7f0000049000), 0x3d2) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000008000)={&(0x7f000000f000-0xc)={0x10, 0x34000}, 0xc, &(0x7f0000220000)={&(0x7f00008d6000-0x14)={0x14, 0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, {}, []}, 0x14}, 0x1}, 0x0) r1 = userfaultfd(0x80800) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000ff8000-0x20)={{&(0x7f0000012000/0x2000)=nil, 0x2000}, 0x1}) bpf$MAP_CREATE(0x0, &(0x7f0000fb4000)={0x2, 0x8000000000000004, 0x400, 0x7fd, 0x4, 0xffffffffffffffff}, 0x2c) userfaultfd(0x800) clock_gettime(0x0, &(0x7f0000132000)={0x0, 0x0}) socketpair(0x1d, 0x800, 0x4, &(0x7f0000589000)) r4 = syz_open_dev$mouse(&(0x7f00006eb000)='/dev/input/mouse#\x00', 0xde6e, 0x1) timer_settime(0x0, 0x1, &(0x7f000097e000)={{0x0, r3}, {r2, r3+10000000}}, &(0x7f0000939000)) fanotify_init(0x25, 0x802) r5 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000ef2000-0x1d)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f00002d8000-0xc)={0x0, 0x0}, &(0x7f0000d76000-0x4)=0xc) syz_open_procfs(r6, &(0x7f0000013000)='ns/cgroup\x00') openat$ion(0xffffffffffffff9c, &(0x7f0000dd5000)='/dev/ion\x00', 0x800, 0x0) pipe2(&(0x7f000058c000), 0x4800) setsockopt$inet_IP_XFRM_POLICY(r4, 0x0, 0x11, &(0x7f0000e12000-0xe8)={{{@in6=@mcast1={0xff, 0x1, [], 0x1}, @in=@rand_addr, 0x2, 0xbd, 0x3, 0x20, 0xa, 0xa0, 0x80, 0xbf, 0x0, r7}, {0x0, 0x8, 0x0, 0x3, 0x6, 0x1fa8, 0x8, 0x20}, {0x1719, 0x7fff, 0x0, 0x7ff}, 0x1, 0x7, 0x0, 0x1, 0x1, 0x3}, {{@in=@broadcast=0xffffffff, 0x1, 0x7f}, 0xa, @in=@empty, 0xffffffffffffffff, 0x3, 0x0, 0xffffffffffffffbc, 0x20, 0x6, 0x2}}, 0xe8) openat$selinux_policy(0xffffffffffffff9c, &(0x7f000010e000-0x10)='/selinux/policy\x00', 0x0, 0x0) setsockopt$netlink_NETLINK_TX_RING(r5, 0x10e, 0x7, &(0x7f0000ab4000-0x10)={0x6, 0x7, 0x52, 0xfffffffffffffffc}, 0x10) 2018/02/10 14:10:20 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) syz_open_dev$mice(&(0x7f00007ae000-0x10)='/dev/input/mice\x00', 0x0, 0x0) clock_gettime(0x0, &(0x7f0000e45000)={0x0, 0x0}) ppoll(&(0x7f00005bf000-0x30)=[{r0}, {r0, 0x80}, {r0, 0xa0}], 0x3, &(0x7f0000db7000-0x8)={r1, r2+10000000}, &(0x7f0000bf9000-0x8)={0xffffffffffffff7f}, 0x8) [ 78.214602] binder: 12839:12842 Acquire 1 refcount change on invalid ref 0 ret -22 [ 78.222450] binder: 12839:12842 unknown command 0 [ 78.228012] binder: 12839:12842 ioctl c0306201 2000a000 returned -22 [ 78.230385] binder: 12844:12846 unknown command 0 [ 78.240485] binder: 12844:12846 ioctl c0306201 2000a000 returned -22 [ 78.271988] binder_alloc: binder_alloc_mmap_handler: 12844 20000000-20002000 already mapped failed -16 [ 78.284993] binder: 12844:12853 unknown command 0 [ 78.285795] binder: 12839:12842 unknown command 0 [ 78.290092] binder: 12844:12853 ioctl c0306201 2000a000 returned -22 [ 78.294989] binder: BINDER_SET_CONTEXT_MGR already set [ 78.306912] binder: 12839:12842 ioctl c0306201 2000a000 returned -22 [ 78.309312] binder: 12844:12846 ioctl 40046207 0 returned -16 [ 78.331560] binder: release 12844:12846 transaction 465 out, still active [ 78.338554] binder: undelivered TRANSACTION_COMPLETE [ 78.343734] binder: send failed reply for transaction 465, target dead 2018/02/10 14:10:20 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$evdev(&(0x7f0000dda000-0x12)='/dev/input/event#\x00', 0x0, 0x0) ioctl$EVIOCGRAB(r0, 0x40044590, &(0x7f0000e95000-0x4)) ioctl$TIOCSBRK(0xffffffffffffffff, 0x40044591) request_key(&(0x7f0000102000)='big_key\x00', &(0x7f0000ad3000)={0x73, 0x79, 0x7a, 0x3}, &(0x7f00006cc000-0x40)='deflate\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', 0xffffffffffffffff) finit_module(r0, &(0x7f0000316000-0x40)='deflate\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', 0x3) 2018/02/10 14:10:20 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00005ea000)='/dev/kvm\x00', 0x1000000000000000, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_LAPIC(r2, 0x4400ae8f, &(0x7f000016d000)={"8a927799b01a029f25061eda96dd379385fc78b28fcbf8eb8455a6fb67a8de46d4d40000a01a47191dc792f414ac8437036bb34b6632c980073c4cdc084a1966c440f15811d016f5b50e90810603f10a2c83eb8c062194269ab67e4bb4b3c5199cadd60d3f6fc72a7eb011b622072532229fbc9d9c4d1e045191ee2b0d584c8fd736ee3e7d73d5267b67a69251b1a8647e90692d30ecfb806326f17f0a7a24aa58b111193c88181907d958cb00807d63dfb58775215937ae2b62b46c6d5816f2fc52eeab0000000000000003252929e628ad2c34a0ef717fb2504d9bd66eabce002faf0512145c072f3087a5566c38fda729442c3ebd62e970a9a3eb242747993601a1a186b8376d39c69c4ce503b2638feeae79436a9708b3bb19f38377382ea7b4c9c2d674b80ef220109f8fa8200de4794547b4da6430ac512116d358949a298812c5d54017aa2fc8b814ecf28c41d4c83474ba93a8ad32b16371b42350bf984abb465228cfd848e54abc383d21d0a3315f1b8599efa1bf10bd30a1371757b13aed4a19db7c777995fd42ad446d9d2755f8552563c7639ce00da8ee3ece9ded52625aa3f0a1d7b76b32536d39eeae158271064ea79bddf1032b6e6ac794f37ec9d0c3bc4923cc7b631c6df64f28d75d99443d6653db3c6b7961190e8f82a233000001002ce4f47168ef93f01aef51c60000000000000006af34b21ed8437a371c0b427cd8c94f3952ee752b758eb5bff60a0c4f4793cd6638a2a23d68cb6e86925599fbc1361b8ce27b41d79027894b6c0003cc97a64088edf383a51eef947915369bdd4fc3cded2663d17515838f8fbba284c5b6ffc5251019eaee59d117d34c73e50fbd33ceb4508cfa4eecb7d6bb11fc4a114a13542dee77b2651783f6a5d9260036ccc70d695105d1ddb56f1ac26584547d8d5cecb3c672068cc7ab31ddc5ae0a253b587d712c6113acdf49fa0100de0f7b3717528e35b7e70733538a8eec8fb17616d2198d02ba4e7690fab7933b676deddb27755d6a8f29c643dfff0e4bd7c2b13b7a57a3120cb2cbb70200339dc0862dafad481a63e7f90d14c54803d8b100e0ad5cae9a0a7b2f329c3b0000000000000002f4b2eebf5bcd42688b08ff0a6575a31f81f01c13c7cb674ff41cb3c7f6896d41e86bda845164825e28b9fb719e695a9eb9710f924aefde1c96bebe4274594038347691a088f9bcaeba90315d3b3cfc24388cc15dffeda1bd610582c5b74fa6c6e789ce440f71871a5e8b85000000005806743e8e075b8624686feb21dbdb9afd74dd0067d82a72c099a2d52a599494388cb56cdb5ef9190980f9128e689e07e98b2ed59e1537fc7de144dc2030374b0f5fcfd8f2ef242803f7bcbc07145f65b8912a4a335b858de8acf080852c49d353a00a5aac3d6a33e0075506a1fd25799f1637b1bafaf09954ef"}) ioctl$KVM_SET_MP_STATE(r2, 0x4004ae99, &(0x7f0000fc2000)=0x3) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_SET_IRQCHIP(r1, 0x8208ae63, &(0x7f0000ae5000)=@ioapic={0x2, 0x0, 0x0, 0x0, 0x0, [{0x0, 0x3}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x5}]}) 2018/02/10 14:10:20 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f000054f000)='/dev/ppp\x00', 0x8000, 0x0) connect$can_bcm(r1, &(0x7f0000d16000-0x10)={0x1d}, 0x10) perf_event_open(&(0x7f000001d000)={0x2, 0x78, 0xe2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x4, 0x4, 0x4, 0x9}, 0x14) close(r2) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000a000)={0x34e, 0x0, &(0x7f00001e5000-0x8)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000006000-0x54)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000008000-0x30)={0xffffffffffffff69, 0x0, &(0x7f0000d06000)=[], 0xd6, 0x0, &(0x7f00001ee000)="99a577028a945bd1b1b1dbd77b6f2507bd394b3568bcd4168976fe7575bb9bf43e4b02d74ab4"}) 2018/02/10 14:10:20 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = mmap$binder(&(0x7f00001dd000/0x1000)=nil, 0x1000, 0x2000001, 0x13, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00006aa000)={0x14, 0x0, &(0x7f0000b85000-0x14)=[@increfs_done={0x40106308, r1, 0x3}], 0x44, 0x0, &(0x7f0000320000)="26051f5295ba43ef11c920e4d96c4e1b082b68ddabe96dea32a3f00207b3d1ef30f9431189fee3845998f3229a0c74c207917800bb145b3a589b77bad14d64a2867dc35a"}) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000a000)={0x34e, 0x0, &(0x7f00001e5000-0x8)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000006000-0x54)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000-0x30)={0x44, 0x0, &(0x7f0000d06000)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x38, 0x8, &(0x7f000000d000)=[@fda={0x66646185}, @flat={0x73682a85}], &(0x7f0000006000)=[0x20]}}], 0x0, 0x0, &(0x7f0000176000-0x1)}) 2018/02/10 14:10:20 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) syz_open_dev$mice(&(0x7f00007ae000-0x10)='/dev/input/mice\x00', 0x0, 0x0) clock_gettime(0x0, &(0x7f0000e45000)={0x0, 0x0}) ppoll(&(0x7f00005bf000-0x30)=[{r0}, {r0, 0x80}, {r0, 0xa0}], 0x3, &(0x7f0000db7000-0x8)={r1, r2+10000000}, &(0x7f0000bf9000-0x8)={0xffffffffffffff7f}, 0x8) 2018/02/10 14:10:20 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r0, r0, &(0x7f0000049000), 0x3d2) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000008000)={&(0x7f000000f000-0xc)={0x10, 0x34000}, 0xc, &(0x7f0000220000)={&(0x7f00008d6000-0x14)={0x14, 0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, {}, []}, 0x14}, 0x1}, 0x0) r1 = userfaultfd(0x80800) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000ff8000-0x20)={{&(0x7f0000012000/0x2000)=nil, 0x2000}, 0x1}) bpf$MAP_CREATE(0x0, &(0x7f0000fb4000)={0x2, 0x8000000000000004, 0x400, 0x7fd, 0x4, 0xffffffffffffffff}, 0x2c) userfaultfd(0x800) clock_gettime(0x0, &(0x7f0000132000)={0x0, 0x0}) socketpair(0x1d, 0x800, 0x4, &(0x7f0000589000)) r4 = syz_open_dev$mouse(&(0x7f00006eb000)='/dev/input/mouse#\x00', 0xde6e, 0x1) timer_settime(0x0, 0x1, &(0x7f000097e000)={{0x0, r3}, {r2, r3+10000000}}, &(0x7f0000939000)) fanotify_init(0x25, 0x802) r5 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000ef2000-0x1d)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f00002d8000-0xc)={0x0, 0x0}, &(0x7f0000d76000-0x4)=0xc) syz_open_procfs(r6, &(0x7f0000013000)='ns/cgroup\x00') openat$ion(0xffffffffffffff9c, &(0x7f0000dd5000)='/dev/ion\x00', 0x800, 0x0) pipe2(&(0x7f000058c000), 0x4800) setsockopt$inet_IP_XFRM_POLICY(r4, 0x0, 0x11, &(0x7f0000e12000-0xe8)={{{@in6=@mcast1={0xff, 0x1, [], 0x1}, @in=@rand_addr, 0x2, 0xbd, 0x3, 0x20, 0xa, 0xa0, 0x80, 0xbf, 0x0, r7}, {0x0, 0x8, 0x0, 0x3, 0x6, 0x1fa8, 0x8, 0x20}, {0x1719, 0x7fff, 0x0, 0x7ff}, 0x1, 0x7, 0x0, 0x1, 0x1, 0x3}, {{@in=@broadcast=0xffffffff, 0x1, 0x7f}, 0xa, @in=@empty, 0xffffffffffffffff, 0x3, 0x0, 0xffffffffffffffbc, 0x20, 0x6, 0x2}}, 0xe8) openat$selinux_policy(0xffffffffffffff9c, &(0x7f000010e000-0x10)='/selinux/policy\x00', 0x0, 0x0) setsockopt$netlink_NETLINK_TX_RING(r5, 0x10e, 0x7, &(0x7f0000ab4000-0x10)={0x6, 0x7, 0x52, 0xfffffffffffffffc}, 0x10) 2018/02/10 14:10:20 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0xfffffdd4, &(0x7f00000a5000-0x8)=0x8000000000) mmap(&(0x7f0000000000/0x19000)=nil, 0x19000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000924000-0xc)='/dev/rfkill\x00', 0x0, 0x0) r1 = userfaultfd(0x0) setsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX_OLD(r0, 0x84, 0x6b, &(0x7f0000878000)=[@in={0x2, 0x3, @loopback=0x7f000001}, @in={0x2, 0x1, @local={0xac, 0x14, 0x0, 0xaa}}, @in={0x2, 0x1, @multicast2=0xe0000002}, @in={0x2, 0x0, @rand_addr=0x9}], 0x40) getsockopt$inet_sctp_SCTP_GET_ASSOC_STATS(r0, 0x84, 0x70, &(0x7f00006e4000)={0x0, @in={{0x2, 0x1, @local={0xac, 0x14, 0x0, 0xaa}}}, [0x3, 0x100, 0x938, 0x0, 0x0, 0x10000, 0x2, 0x1, 0x4, 0xcee, 0x3, 0x2, 0x10000, 0x5, 0x3]}, &(0x7f0000e8a000)=0x108) getsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r0, 0x84, 0x72, &(0x7f0000fea000)={r2, 0x1, 0x20}, &(0x7f000075f000)=0xc) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000e54000-0x18)={0xaa}) getpeername$inet6(r0, &(0x7f0000190000+0x665)={0x0, 0xffffffffffffffff, 0x0, @mcast1}, &(0x7f0000fa1000-0x1)=0x1c) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000008000-0x20)={{&(0x7f0000000000/0x4000)=nil, 0x4000}, 0x1}) readv(r0, &(0x7f00001f3000-0x10)=[{&(0x7f0000002000-0x4e)=""/1, 0x1}], 0x1) bind$vsock_dgram(r0, &(0x7f000075a000)={0x28, 0x0, 0x0, @reserved=0x1}, 0x10) connect$vsock_dgram(r0, &(0x7f0000750000-0x10)={0x28, 0x0, 0x2711, @reserved=0x1}, 0x10) ioctl$RNDADDTOENTCNT(r0, 0x40045201, &(0x7f0000b27000)) setsockopt$inet6_mtu(r0, 0x29, 0x17, &(0x7f00004b8000)=0x7, 0x4) sendto$inet6(r0, &(0x7f00002bd000-0xbd)="7670d44e75473df3421091bb40788c42fd3f0524e57653874e8d3f254ff39f4eb6631481d9f6da4360cca157a1b5a048032b463828da74aa6c79124b83d394fbee386cfbebcd33ac66691deb4392b1f12bc92509f769a8c886dc51ab7c837eb884368b62a771ec43c4f6c6f90ac18e4579bfcd4f8ff2b3b4f2866f66893487fb76392ebec445cc47d15f622fcdfee8af66c0fbc8acc710049a373d75b516388943c64c30818658a62f09484e89e12b35d1f3e4afc63493fb9a9d609db2", 0xbd, 0x0, &(0x7f0000391000-0x1c)={0xa, 0x2, 0x498, @ipv4={[], [0xff, 0xff], @rand_addr=0x7}, 0x1}, 0x1c) getsockopt$inet_sctp_SCTP_INITMSG(r0, 0x84, 0x2, &(0x7f00000f3000-0x8), &(0x7f00003db000)=0x8) sendto$ipx(r0, &(0x7f00005ef000)="ea00476de8ab481ac271f0ce0d39a6d08168b19b60f1391e41859198", 0x1c, 0x4000010, &(0x7f0000f60000)={0x4, 0x627e, 0x5, "691263114819", 0xc7}, 0x10) bind$nfc_llcp(r0, &(0x7f0000559000-0x58)={0x27, 0x2, 0x5, 0x7, 0xfb, 0x0, "06e254ed80570ea5940b2121a66bcc7f99bf9b443a04c1301c279baca89c1883ce187c30253b2486facb6f72a27ac949f3104a5b06440614f287fc50626acc", 0x8}, 0x58) ioctl$RNDADDTOENTCNT(r0, 0x40045201, &(0x7f0000a81000)) ioctl$UFFDIO_UNREGISTER(r1, 0xc020aa04, &(0x7f0000008000-0x4)={&(0x7f0000000000/0x2000)=nil, 0x2000}) 2018/02/10 14:10:20 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000a5000-0x8)) mmap(&(0x7f0000000000/0x19000)=nil, 0x19000, 0x3, 0x32, 0xffffffffffffffff, 0x0) prctl$setfpexc(0xc, 0xc0000) r0 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000924000-0xc)='/dev/rfkill\x00', 0x0, 0x0) r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000e54000-0x18)={0xaa}) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000008000-0x20)={{&(0x7f0000000000/0x4000)=nil, 0x4000}, 0x1}) readv(r0, &(0x7f00001f3000-0x10)=[{&(0x7f0000002000-0x4e)=""/1, 0x1}], 0x1) sync() ioctl$RNDADDTOENTCNT(r0, 0x40045201, &(0x7f0000b27000)) ioctl$RNDADDTOENTCNT(r0, 0x40045201, &(0x7f0000a81000)) ioctl$UFFDIO_UNREGISTER(r1, 0xc020aa04, &(0x7f0000008000-0x4)={&(0x7f0000000000/0x2000)=nil, 0x2000}) 2018/02/10 14:10:20 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$mice(&(0x7f00007ae000-0x10)='/dev/input/mice\x00', 0x0, 0x0) clock_gettime(0x0, &(0x7f0000e45000)={0x0, 0x0}) ppoll(&(0x7f00005bf000-0x30)=[{r0}, {0xffffffffffffffff, 0x1f}, {r0, 0x80}, {r0, 0xa0}], 0x4, &(0x7f0000db7000-0x8)={r2, r3+10000000}, &(0x7f0000bf9000-0x8)={0xffffffffffffff7f}, 0x8) 2018/02/10 14:10:20 executing program 1: eventfd2(0x5, 0x80000) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) unshare(0x4040400) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(&(0x7f00007a4000-0x8)='./file0\x00', &(0x7f00004f6000-0x8)='./file0\x00', &(0x7f00000e1000)='ramfs\x00', 0x8409, &(0x7f0000c82000-0x2)) r0 = openat(0xffffffffffffff9c, &(0x7f0000013000-0x8)='./file0\x00', 0x0, 0x0) fremovexattr(r0, &(0x7f0000a8f000)=@random={'system.\x00', '\\\x00'}) 2018/02/10 14:10:20 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndpcmc(&(0x7f0000b10000)='/dev/snd/pcmC#D#c\x00', 0xff, 0x80) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000533000-0x68)={0x3, 0x0, [{0x1, 0x58, &(0x7f000046f000-0x58)=""/88}, {0x2, 0x62, &(0x7f0000e9a000)=""/98}, {0x10000, 0xf1, &(0x7f000082c000)=""/241}]}) syz_emit_ethernet(0x36, &(0x7f0000d9f000)={@random="a16e8aa67acf", @local={[0xaa, 0xaa, 0xaa, 0xaa], 0xffffffffffffffff, 0xaa}, [], {@ipv4={0x800, {{0x5, 0x4, 0x7, 0x0, 0x28, 0x0, 0x0, 0x80, 0x0, 0x0, @rand_addr, @multicast2=0xe0000002, {[]}}, @udp={0x2, 0xffffffffffffffff, 0x14, 0x0, "5ed018ac366e5aee9ee45247"}}}}}, &(0x7f00003e7000)={0x0, 0x1, [0x0]}) 2018/02/10 14:10:20 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000a000)={0x34e, 0x0, &(0x7f00001e5000-0x8)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000006000-0x54)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000008000-0x30)={0x0, 0x0, &(0x7f0000d06000)=[], 0x0, 0x0, &(0x7f0000176000-0x1)}) r1 = syz_open_dev$mouse(&(0x7f0000ea8000)='/dev/input/mouse#\x00', 0xda6d, 0x4d8500) getsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000f29000)={0x0, @in6={{0xa, 0x2, 0x1, @mcast2={0xff, 0x2, [], 0x1}, 0x7}}, 0x6, 0x1, 0x6, 0x0, 0x30}, &(0x7f00009ca000)=0xa0) setsockopt$inet_sctp6_SCTP_RESET_STREAMS(r1, 0x84, 0x77, &(0x7f0000454000)={r2, 0x7fff, 0x8, [0x2, 0x8000, 0x1000, 0x0, 0x1, 0x3, 0xc8, 0x4a2]}, 0x18) openat$selinux_create(0xffffffffffffff9c, &(0x7f000008b000-0x10)='/selinux/create\x00', 0x2, 0x0) ioctl$KVM_GET_NR_MMU_PAGES(r1, 0xae45, 0x1f) socketpair$inet(0x2, 0x4, 0x1, &(0x7f000053a000)={0x0, 0x0}) getsockopt$SO_COOKIE(r3, 0x1, 0x39, &(0x7f000012f000), &(0x7f00000b6000)=0x8) getsockopt$inet_sctp_SCTP_HMAC_IDENT(r3, 0x84, 0x16, &(0x7f0000b33000)={0x4, [0xfffffffffffffff9, 0x7f72, 0x1, 0x59a9]}, &(0x7f0000dbe000-0x4)=0xc) 2018/02/10 14:10:20 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r0, r0, &(0x7f0000049000), 0x3d2) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000008000)={&(0x7f000000f000-0xc)={0x10, 0x34000}, 0xc, &(0x7f0000220000)={&(0x7f00008d6000-0x14)={0x14, 0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, {}, []}, 0x14}, 0x1}, 0x0) r1 = userfaultfd(0x80800) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000ff8000-0x20)={{&(0x7f0000012000/0x2000)=nil, 0x2000}, 0x1}) bpf$MAP_CREATE(0x0, &(0x7f0000fb4000)={0x2, 0x8000000000000004, 0x400, 0x7fd, 0x4, 0xffffffffffffffff}, 0x2c) userfaultfd(0x800) clock_gettime(0x0, &(0x7f0000132000)={0x0, 0x0}) socketpair(0x1d, 0x800, 0x4, &(0x7f0000589000)) r4 = syz_open_dev$mouse(&(0x7f00006eb000)='/dev/input/mouse#\x00', 0xde6e, 0x1) timer_settime(0x0, 0x1, &(0x7f000097e000)={{0x0, r3}, {r2, r3+10000000}}, &(0x7f0000939000)) fanotify_init(0x25, 0x802) r5 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000ef2000-0x1d)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f00002d8000-0xc)={0x0, 0x0}, &(0x7f0000d76000-0x4)=0xc) syz_open_procfs(r6, &(0x7f0000013000)='ns/cgroup\x00') openat$ion(0xffffffffffffff9c, &(0x7f0000dd5000)='/dev/ion\x00', 0x800, 0x0) pipe2(&(0x7f000058c000), 0x4800) setsockopt$inet_IP_XFRM_POLICY(r4, 0x0, 0x11, &(0x7f0000e12000-0xe8)={{{@in6=@mcast1={0xff, 0x1, [], 0x1}, @in=@rand_addr, 0x2, 0xbd, 0x3, 0x20, 0xa, 0xa0, 0x80, 0xbf, 0x0, r7}, {0x0, 0x8, 0x0, 0x3, 0x6, 0x1fa8, 0x8, 0x20}, {0x1719, 0x7fff, 0x7ff}, 0x1, 0x7, 0x0, 0x1, 0x1, 0x3}, {{@in=@broadcast=0xffffffff, 0x1, 0x7f}, 0xa, @in=@empty, 0xffffffffffffffff, 0x3, 0x0, 0xffffffffffffffbc, 0x20, 0x6, 0x2}}, 0xe8) openat$selinux_policy(0xffffffffffffff9c, &(0x7f000010e000-0x10)='/selinux/policy\x00', 0x0, 0x0) setsockopt$netlink_NETLINK_TX_RING(r5, 0x10e, 0x7, &(0x7f0000ab4000-0x10)={0x6, 0x7, 0x52, 0xfffffffffffffffc}, 0x10) 2018/02/10 14:10:20 executing program 3: r0 = socket$pppoe(0x18, 0x1, 0x0) ioctl$PPPIOCGFLAGS(r0, 0x8004745a, &(0x7f0000e16000)) ioctl$KVM_CHECK_EXTENSION_VM(r0, 0xae03, 0x4) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r1 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000a7b000-0xf)='/dev/sequencer\x00', 0x801, 0x0) write$sndseq(r1, &(0x7f000079e000-0xc0)=[{0x0, 0x0, 0x0, 0x0, @tick, {0x2}, {0x0, 0x6}, @time=@time}, {0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @note={0x81, 0x2, 0x0, 0x0, 0x401}}], 0x60) 2018/02/10 14:10:20 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$mice(&(0x7f00007ae000-0x10)='/dev/input/mice\x00', 0x0, 0x0) clock_gettime(0x0, &(0x7f0000e45000)={0x0, 0x0}) ppoll(&(0x7f00005bf000-0x30)=[{r0}, {0xffffffffffffffff, 0x1f}, {r0, 0x80}, {r0, 0xa0}], 0x4, &(0x7f0000db7000-0x8)={r2, r3+10000000}, &(0x7f0000bf9000-0x8)={0xffffffffffffff7f}, 0x8) 2018/02/10 14:10:20 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) syz_open_dev$sndmidi(&(0x7f0000fe2000)='/dev/snd/midiC#D#\x00', 0x8001, 0x0) r0 = openat$audio(0xffffffffffffff9c, &(0x7f0000bf2000)='/dev/audio\x00', 0x0, 0x0) ioctl$int_in(r0, 0x800000c004500a, &(0x7f0000004000-0x8)=0x7f) close(r0) [ 78.431341] binder: 12867:12871 Acquire 1 refcount change on invalid ref 0 ret -22 [ 78.433247] binder: 12864:12874 BC_INCREFS_DONE u00000000201dd000 no match [ 78.439209] binder: 12867:12871 unknown command 0 [ 78.450776] binder_alloc: binder_alloc_mmap_handler: 12864 20000000-20002000 already mapped failed -16 [ 78.470703] binder: 12867:12871 ioctl c0306201 2000a000 returned -22 [ 78.472979] binder: 12864:12874 unknown command 0 [ 78.496976] binder: 12864:12874 ioctl c0306201 2000a000 returned -22 [ 78.507187] binder: 12867:12880 unknown command 0 [ 78.512535] binder: 12867:12880 ioctl c0306201 2000a000 returned -22 [ 78.536120] binder_alloc: binder_alloc_mmap_handler: 12864 201dd000-201de000 already mapped failed -16 [ 78.553634] binder: 12864:12874 BC_INCREFS_DONE u00000000201dd000 no match [ 78.568755] binder: BINDER_SET_CONTEXT_MGR already set [ 78.576624] binder: 12864:12891 unknown command 0 [ 78.582507] binder: 12864:12886 ioctl 40046207 0 returned -16 [ 78.604299] binder: 12894:12897 unknown command 0 [ 78.609535] binder: 12864:12891 ioctl c0306201 2000a000 returned -22 [ 78.616320] binder: 12894:12897 ioctl c0306201 2000a000 returned -22 [ 78.672241] binder: release 12864:12886 transaction 471 out, still active [ 78.679132] binder: 12894:12905 unknown command 0 [ 78.679297] binder: undelivered TRANSACTION_COMPLETE [ 78.684381] binder: 12894:12905 ioctl c0306201 2000a000 returned -22 [ 78.689321] binder: send failed reply for transaction 471, target dead 2018/02/10 14:10:20 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f00001f2000-0x11)='/dev/qat_adf_ctl\x00', 0x220040, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(r0, 0x8250aea6, &(0x7f0000cb2000-0x9c)=""/156) r1 = perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$evdev(&(0x7f000097e000-0x12)='/dev/input/event#\x00', 0x0, 0x0) ioctl$EVIOCGRAB(r2, 0x40044590, &(0x7f0000e95000-0x4)) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f00007e0000-0x9)='/dev/ppp\x00', 0x800, 0x0) setsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX_OLD(r3, 0x84, 0x6b, &(0x7f000001f000-0x74)=[@in={0x2, 0x1, @remote={0xac, 0x14, 0x0, 0xbb}}, @in6={0xa, 0x0, 0x10001, @ipv4={[], [0xff, 0xff], @multicast1=0xe0000001}, 0x5}, @in6={0xa, 0x2, 0xd43, @ipv4={[], [0xff, 0xff], @broadcast=0xffffffff}, 0xea}, @in={0x2, 0x0, @local={0xac, 0x14, 0x0, 0xaa}}, @in6={0xa, 0x1, 0x80000000, @remote={0xfe, 0x80, [], 0x0, 0xbb}, 0x9b0}], 0x74) ioctl$TIOCSBRK(0xffffffffffffffff, 0x40044591) fsetxattr(r1, &(0x7f000086f000-0x16)=@random={'security.', 'self[)md5sum\x00'}, &(0x7f0000a20000)='lo)\x00', 0x4, 0x0) request_key(&(0x7f0000102000)='big_key\x00', &(0x7f0000ad3000)={0x73, 0x79, 0x7a, 0x3}, &(0x7f00006cc000-0x40)='deflate\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', 0xffffffffffffffff) 2018/02/10 14:10:20 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000a5000-0x8)) mmap(&(0x7f0000000000/0x19000)=nil, 0x19000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000924000-0xc)='/dev/rfkill\x00', 0x0, 0x0) openat$selinux_access(0xffffffffffffff9c, &(0x7f0000a53000)='/selinux/access\x00', 0x2, 0x0) r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000e54000-0x18)={0xaa}) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000008000-0x20)={{&(0x7f0000000000/0x4000)=nil, 0x4000}, 0x1}) readv(r0, &(0x7f00001f3000-0x10)=[{&(0x7f0000002000-0x4e)=""/1, 0x1}], 0x1) setsockopt$inet6_opts(r0, 0x29, 0x3f, &(0x7f00006b7000)=@routing={0x62, 0xa, 0x2, 0x1, 0x0, [@mcast2={0xff, 0x2, [], 0x1}, @local={0xfe, 0x80, [], 0x0, 0xaa}, @local={0xfe, 0x80, [], 0x0, 0xaa}, @mcast1={0xff, 0x1, [], 0x1}, @remote={0xfe, 0x80, [], 0x0, 0xbb}]}, 0x58) ioctl$sock_inet_udp_SIOCINQ(r0, 0x541b, &(0x7f000039d000)) ioctl$RNDADDTOENTCNT(r0, 0x40045201, &(0x7f0000b27000)) ioctl$RNDADDTOENTCNT(r0, 0x40045201, &(0x7f0000a81000)) ioctl$UFFDIO_UNREGISTER(r1, 0xc020aa04, &(0x7f0000008000-0x4)={&(0x7f0000000000/0x2000)=nil, 0x2000}) 2018/02/10 14:10:20 executing program 6: r0 = openat$audio(0xffffffffffffff9c, &(0x7f0000082000)='/dev/audio\x00', 0x200, 0x0) ioctl$SIOCSIFHWADDR(r0, 0x8924, &(0x7f00009c8000)={@syzn={0x73, 0x79, 0x7a, 0x0}, @ifru_ivalue=0x9}) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000a000)={0x34e, 0x0, &(0x7f00001e5000-0x8)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000006000-0x54)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000008000-0x30)={0x0, 0x0, &(0x7f0000d06000)=[], 0x0, 0x0, &(0x7f0000176000-0x1)}) 2018/02/10 14:10:20 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = dup2(r0, r0) ioctl$sock_ipx_SIOCAIPXITFCRT(r1, 0x89e0, &(0x7f0000ac2000-0x4)=0x7) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0) r2 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000025000)='/selinux/checkreqprot\x00', 0x301000, 0x0) ioctl$EVIOCGBITKEY(r2, 0x80404521, &(0x7f000071f000-0xb)=""/11) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$DRM_IOCTL_ADD_CTX(0xffffffffffffffff, 0xc0086420, &(0x7f0000db7000)={0x0}) ioctl$DRM_IOCTL_NEW_CTX(r0, 0x40086425, &(0x7f0000e2d000)={r3, 0x3}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000a000)={0x34e, 0x0, &(0x7f00001e5000-0x8)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000006000-0x54)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000-0x30)={0x44, 0x0, &(0x7f0000d06000)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x38, 0x8, &(0x7f000000d000)=[@fda={0x66646185}, @flat={0x73682a85}], &(0x7f0000006000)=[0x20]}}], 0x0, 0x0, &(0x7f0000176000-0x1)}) 2018/02/10 14:10:20 executing program 3: mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp\x00', 0x2400, 0x0) ioctl$sock_SIOCGSKNS(r0, 0x894c, &(0x7f0000000000)) ioctl$KVM_PPC_ALLOCATE_HTAB(r0, 0xc004aea7, &(0x7f0000b86000-0x4)=0x7) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000bba000)={0x0, 0x78}, 0x0, 0x0, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0xe) ioctl$KVM_GET_TSC_KHZ(r0, 0xaea3) clone(0x0, &(0x7f0000598000-0xe4)="a4", &(0x7f00009ba000-0x4), &(0x7f0000006000-0x4), &(0x7f00003e5000)) mremap(&(0x7f0000c1c000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f000033c000/0x2000)=nil) 2018/02/10 14:10:20 executing program 1: mmap(&(0x7f00006bd000/0x2000)=nil, 0x2000, 0x0, 0x6132, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$evdev(&(0x7f0000062000)='/dev/input/event#\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$EVIOCRMFF(r0, 0x40044581, &(0x7f0000000000)=0x8) 2018/02/10 14:10:20 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r0, r0, &(0x7f0000049000), 0x3d2) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000008000)={&(0x7f000000f000-0xc)={0x10, 0x34000}, 0xc, &(0x7f0000220000)={&(0x7f00008d6000-0x14)={0x14, 0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, {}, []}, 0x14}, 0x1}, 0x0) r1 = userfaultfd(0x80800) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000ff8000-0x20)={{&(0x7f0000012000/0x2000)=nil, 0x2000}, 0x1}) bpf$MAP_CREATE(0x0, &(0x7f0000fb4000)={0x2, 0x8000000000000004, 0x400, 0x7fd, 0x4, 0xffffffffffffffff}, 0x2c) userfaultfd(0x800) clock_gettime(0x0, &(0x7f0000132000)={0x0, 0x0}) socketpair(0x1d, 0x800, 0x4, &(0x7f0000589000)) r4 = syz_open_dev$mouse(&(0x7f00006eb000)='/dev/input/mouse#\x00', 0xde6e, 0x1) timer_settime(0x0, 0x1, &(0x7f000097e000)={{0x0, r3}, {r2, r3+10000000}}, &(0x7f0000939000)) fanotify_init(0x25, 0x802) r5 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000ef2000-0x1d)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f00002d8000-0xc)={0x0, 0x0}, &(0x7f0000d76000-0x4)=0xc) syz_open_procfs(r6, &(0x7f0000013000)='ns/cgroup\x00') openat$ion(0xffffffffffffff9c, &(0x7f0000dd5000)='/dev/ion\x00', 0x800, 0x0) pipe2(&(0x7f000058c000), 0x4800) setsockopt$inet_IP_XFRM_POLICY(r4, 0x0, 0x11, &(0x7f0000e12000-0xe8)={{{@in6=@mcast1={0xff, 0x1, [], 0x1}, @in=@rand_addr, 0x2, 0xbd, 0x3, 0x20, 0xa, 0xa0, 0x80, 0xbf, 0x0, r7}, {0x0, 0x8, 0x0, 0x3, 0x6, 0x1fa8, 0x8, 0x20}, {0x1719, 0x7fff, 0x7ff}, 0x1, 0x7, 0x0, 0x1, 0x1, 0x3}, {{@in=@broadcast=0xffffffff, 0x1, 0x7f}, 0xa, @in=@empty, 0xffffffffffffffff, 0x3, 0x0, 0xffffffffffffffbc, 0x20, 0x6, 0x2}}, 0xe8) openat$selinux_policy(0xffffffffffffff9c, &(0x7f000010e000-0x10)='/selinux/policy\x00', 0x0, 0x0) setsockopt$netlink_NETLINK_TX_RING(r5, 0x10e, 0x7, &(0x7f0000ab4000-0x10)={0x6, 0x7, 0x52, 0xfffffffffffffffc}, 0x10) 2018/02/10 14:10:20 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$mice(&(0x7f00007ae000-0x10)='/dev/input/mice\x00', 0x0, 0x0) clock_gettime(0x0, &(0x7f0000e45000)={0x0, 0x0}) ppoll(&(0x7f00005bf000-0x30)=[{r0}, {0xffffffffffffffff, 0x1f}, {r0, 0x80}, {r0, 0xa0}], 0x4, &(0x7f0000db7000-0x8)={r2, r3+10000000}, &(0x7f0000bf9000-0x8)={0xffffffffffffff7f}, 0x8) 2018/02/10 14:10:20 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$ppp(0xffffffffffffff9c, &(0x7f000087e000)='/dev/ppp\x00', 0x1, 0x0) ioctl$sock_SIOCGIFBR(r0, 0x8940, &(0x7f00001e3000-0x18)=@generic={0x3, 0x7, 0xd295}) r1 = socket$netlink(0x10, 0x3, 0x80013) sendmsg$nl_generic(r1, &(0x7f0000005000-0x38)={&(0x7f0000014000)={0x10}, 0x1d4, &(0x7f0000015000)={&(0x7f0000017000-0x2a0)={0x24, 0x3000002a, 0x443, 0xffffffffffffffff, 0xffffffffffffffff, {}, [@typed={0x1, 0x0, @fd=0xffffffffffffffff}]}, 0x24}, 0x1}, 0x0) 2018/02/10 14:10:20 executing program 1: mmap(&(0x7f0000000000/0x28000)=nil, 0x28000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x80000, 0xfffffffffffffffe) bind$inet6(r0, &(0x7f000000d000)={0xa, 0x0, 0x0, @empty}, 0x1c) connect$inet6(r0, &(0x7f000000d000-0x1c)={0xa, 0x0, 0x0, @empty}, 0x1c) mmap(&(0x7f0000028000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000028000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) sendto$inet6(r0, &(0x7f0000028000)="264dfdce20f4c1911a3dc816669ff8f6bb1d9082ee6e439a95bb50cec775f1af001f67b435d27804d60a6697b2335a4921fd8f64a79b104dd66fe2633c5ec8610e86e1f7b2b06877083541b9facc916d54809fd95f20a1fe81c2bc9a732e18bdec639b9f59ef01b646ed3c21a78197d988e8d1f518f042beccdeaec18548841f021112bd76f478dc5d2c9b9aafb8989ee410159d4111ac6aad0464ea90fc4bf33cf353ac24f1e06f176bdbd88ac488611e938164b87e06d11a06a4de90e10329886420965a90e5d0ad221f1496456dbe643addccdcc8", 0xd6, 0x20040000, &(0x7f0000029000-0x1c)={0xa, 0x2, 0xea5a, @empty, 0x7}, 0x1c) sendmsg(r0, &(0x7f0000013000)={0x0, 0x0, &(0x7f0000003000-0x10)=[], 0x0, &(0x7f000000c000-0x1180)=[]}, 0x0) setsockopt$sock_int(r0, 0x1, 0x28, &(0x7f0000027000)=0x2, 0x4) recvmsg(r0, &(0x7f0000019000-0x38)={&(0x7f000000a000-0x2e)=@pppol2tpv3={0x0, 0x0, {0x0, 0x0, {0x0, 0xffffffffffffffff, @local}}}, 0x2e, &(0x7f0000026000)=[], 0x0, &(0x7f0000022000)=""/12, 0xc}, 0x0) [ 78.821560] binder: 12925:12928 Acquire 1 refcount change on invalid ref 0 ret -22 [ 78.829373] binder: 12925:12928 unknown command 0 [ 78.838461] binder: 12929:12936 ioctl 89e0 20ac1ffc returned -22 [ 78.849129] binder: 12929:12936 ioctl 40086425 20e2d000 returned -22 [ 78.856502] binder: 12925:12928 ioctl c0306201 2000a000 returned -22 [ 78.866956] binder: 12929:12936 unknown command 0 2018/02/10 14:10:20 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x3) sendto$inet(r0, &(0x7f0000db7000-0xd4)="bc00892eab9430af7c6c1c26083d42e2ef05c32b7eb67f12b0d1aa28cb883c3d3b8f45b712a115733fa64fca8d7bf05438290c41df95dea43325d6421730eb98268e5c289c83a2b0911cd4ab16fe9cdd0796cadc5c05d4c008163d666659dd63d3aac69d1fce0a9775d92bcb4fef55392736f5bffd5159e916ae45e079fd06d5d18295c8ff9bfdb2043a09c04bbd44f28330b512206f489d20de8bdd36a655d63e1fc7b2afd344b35453fc5ee60af27ca7890a45e29dcc623fdc9ff517bc7833afaf9ba021dfcb766b841ff38cdeb56e88f876f7", 0xd4, 0x10, &(0x7f0000081000-0x10)={0x2, 0x2, @multicast2=0xe0000002}, 0x10) setsockopt$inet_opts(r0, 0x0, 0x4, &(0x7f0000970000)="8901", 0xfffffffffffffe28) r1 = open(&(0x7f0000498000)='./file0\x00', 0x14000, 0x22) connect$bt_l2cap(r1, &(0x7f0000b24000)={0x1f, 0x8000, {0x9, 0x4, 0x8000, 0x100, 0x1, 0xbb7}, 0xfffffffffffff801}, 0xe) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f000053e000-0x40)={0x100, @time={0x0, 0x989680}, 0x1e, {0x80, 0x8}, 0x8, 0x1}) setsockopt(r1, 0x1, 0x5, &(0x7f0000c50000-0xb9)="0ab7adc6a235977904e940822c9b3a56a105f04fad88dfeb731a0a3dfbf264608e629d57bce567db1ec23fc9c3c190baa7cc30598b81a5a1344028ee55f83a0e73ec464cf97ca70830faa2d794758cef684bf3375e68b63f33115a958aa67d0f4b7539d215268193c1a786461405970f4cd30c875d119fc0743469686141198383a8ab0129e007395c20287e7a595f621cccfb81457393e1c3b93457129ef16331a2129a725c457f10347411b3369a1139623a086d9e9dfc6f", 0xb9) ioctl$sock_SIOCADDDLCI(r0, 0x8980, &(0x7f00005c0000-0x12)={@syzn={0x73, 0x79, 0x7a, 0x0}}) 2018/02/10 14:10:20 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$kcm(0x29, 0x0, 0x0) r1 = syz_open_dev$audion(&(0x7f00002f7000)='/dev/audio#\x00', 0x1, 0x0) ioctl$KDSETLED(r1, 0x4b32, 0x50) sched_setaffinity(0x0, 0x8, &(0x7f0000fa0000)=0xfce9) recvmmsg(r0, &(0x7f0000108000)=[{{&(0x7f000075c000)=@ax25, 0x10, &(0x7f00002d3000+0x491)=[], 0x0, &(0x7f0000a38000)=""/221, 0xdd}}], 0x1, 0x0, &(0x7f0000f16000-0x10)={0x77359400}) sendmsg$kcm(r0, &(0x7f000003f000)={&(0x7f0000b70000-0xe)=@l2={0x1f}, 0xe, &(0x7f0000596000-0x8)=[{&(0x7f0000817000)="ef", 0x1}], 0x1, &(0x7f0000d31000-0x100c)=[]}, 0x0) 2018/02/10 14:10:20 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000a000)={0x8, 0x0, &(0x7f0000389000-0x8)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000006000-0x54)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000008000-0x30)={0x0, 0x0, &(0x7f0000d06000)=[], 0x0, 0x0, &(0x7f0000176000-0x1)}) [ 78.879951] binder: 12929:12936 ioctl c0306201 2000a000 returned -22 [ 78.884193] binder: 12925:12941 unknown command 0 [ 78.899202] binder: 12925:12941 ioctl c0306201 2000a000 returned -22 [ 78.911264] binder: 12929:12936 ioctl 89e0 20ac1ffc returned -22 [ 78.922868] binder: BINDER_SET_CONTEXT_MGR already set 2018/02/10 14:10:21 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$mice(&(0x7f00007ae000-0x10)='/dev/input/mice\x00', 0x0, 0x0) clock_gettime(0x0, &(0x7f0000e45000)={0x0, 0x0}) ppoll(&(0x7f00005bf000-0x30)=[{r0}, {r1}, {r0, 0x80}, {r0, 0xa0}], 0x4, &(0x7f0000db7000-0x8)={r2, r3+10000000}, &(0x7f0000bf9000-0x8)={0xffffffffffffff7f}, 0x8) 2018/02/10 14:10:21 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000a5000-0x8)) mmap(&(0x7f0000000000/0x19000)=nil, 0x19000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000924000-0xc)='/dev/rfkill\x00', 0x0, 0x0) r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000e54000-0x18)={0xaa}) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000008000-0x20)={{&(0x7f0000000000/0x4000)=nil, 0x4000}, 0x1}) readv(r0, &(0x7f00001f3000-0x10)=[{&(0x7f0000002000-0x4e)=""/1, 0x1}], 0x1) ioctl$RNDADDTOENTCNT(r0, 0x40045201, &(0x7f0000b27000)) setsockopt$sock_timeval(r0, 0x1, 0x14, &(0x7f0000a85000)={0x77359400}, 0x8) ioctl$RNDADDTOENTCNT(r0, 0x40045201, &(0x7f0000a81000)) ioctl$UFFDIO_UNREGISTER(r1, 0xc020aa04, &(0x7f0000008000-0x4)={&(0x7f0000000000/0x2000)=nil, 0x2000}) 2018/02/10 14:10:21 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r0, r0, &(0x7f0000049000), 0x3d2) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000008000)={&(0x7f000000f000-0xc)={0x10, 0x34000}, 0xc, &(0x7f0000220000)={&(0x7f00008d6000-0x14)={0x14, 0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, {}, []}, 0x14}, 0x1}, 0x0) r1 = userfaultfd(0x80800) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000ff8000-0x20)={{&(0x7f0000012000/0x2000)=nil, 0x2000}, 0x1}) bpf$MAP_CREATE(0x0, &(0x7f0000fb4000)={0x2, 0x8000000000000004, 0x400, 0x7fd, 0x4, 0xffffffffffffffff}, 0x2c) userfaultfd(0x800) clock_gettime(0x0, &(0x7f0000132000)={0x0, 0x0}) socketpair(0x1d, 0x800, 0x4, &(0x7f0000589000)) r4 = syz_open_dev$mouse(&(0x7f00006eb000)='/dev/input/mouse#\x00', 0xde6e, 0x1) timer_settime(0x0, 0x1, &(0x7f000097e000)={{0x0, r3}, {r2, r3+10000000}}, &(0x7f0000939000)) fanotify_init(0x25, 0x802) r5 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000ef2000-0x1d)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f00002d8000-0xc)={0x0, 0x0}, &(0x7f0000d76000-0x4)=0xc) syz_open_procfs(r6, &(0x7f0000013000)='ns/cgroup\x00') openat$ion(0xffffffffffffff9c, &(0x7f0000dd5000)='/dev/ion\x00', 0x800, 0x0) pipe2(&(0x7f000058c000), 0x4800) setsockopt$inet_IP_XFRM_POLICY(r4, 0x0, 0x11, &(0x7f0000e12000-0xe8)={{{@in6=@mcast1={0xff, 0x1, [], 0x1}, @in=@rand_addr, 0x2, 0xbd, 0x3, 0x20, 0xa, 0xa0, 0x80, 0xbf, 0x0, r7}, {0x0, 0x8, 0x0, 0x3, 0x6, 0x1fa8, 0x8, 0x20}, {0x1719, 0x7fff, 0x7ff}, 0x1, 0x7, 0x0, 0x1, 0x1, 0x3}, {{@in=@broadcast=0xffffffff, 0x1, 0x7f}, 0xa, @in=@empty, 0xffffffffffffffff, 0x3, 0x0, 0xffffffffffffffbc, 0x20, 0x6, 0x2}}, 0xe8) openat$selinux_policy(0xffffffffffffff9c, &(0x7f000010e000-0x10)='/selinux/policy\x00', 0x0, 0x0) setsockopt$netlink_NETLINK_TX_RING(r5, 0x10e, 0x7, &(0x7f0000ab4000-0x10)={0x6, 0x7, 0x52, 0xfffffffffffffffc}, 0x10) [ 78.933453] binder: 12929:12955 unknown command 0 [ 78.938453] binder: 12929:12950 ioctl 40086425 20e2d000 returned -22 [ 78.971121] binder: 12929:12955 ioctl c0306201 2000a000 returned -22 [ 78.980635] binder: 12929:12936 ioctl 40046207 0 returned -16 [ 78.998188] binder: release 12929:12950 transaction 477 out, still active [ 79.005195] binder: undelivered TRANSACTION_COMPLETE [ 79.010407] binder: send failed reply for transaction 477, target dead 2018/02/10 14:10:21 executing program 7: mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$adsp(&(0x7f0000000000)='/dev/adsp#\x00', 0x9, 0x80) ioctl$sock_bt_bnep_BNEPGETCONNINFO(r0, 0x800442d3, &(0x7f0000212000)={0x81, 0x5, 0xd8bd, "dfabff147093", "d689361ec713f5bbced26180d7d35bcd"}) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000dda000-0x12)='/dev/input/event#\x00', 0x0, 0x0) ioctl$EVIOCGRAB(r1, 0x40044590, &(0x7f0000e95000-0x4)) ioctl$TIOCSBRK(0xffffffffffffffff, 0x40044591) request_key(&(0x7f0000102000)='big_key\x00', &(0x7f0000ad3000)={0x73, 0x79, 0x7a, 0x3}, &(0x7f00006cc000-0x40)='deflate\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', 0xffffffffffffffff) 2018/02/10 14:10:21 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$ppp(0xffffffffffffff9c, &(0x7f000056e000)='/dev/ppp\x00', 0x0, 0x0) r1 = syz_open_dev$binder(&(0x7f0000349000-0xd)='/dev/binder#\x00', 0x0, 0x0) recvfrom$inet(r0, &(0x7f0000576000-0x8a)=""/138, 0x8a, 0x100, &(0x7f0000030000-0x10)={0x2, 0x2, @local={0xac, 0x14, 0x0, 0xaa}}, 0x10) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000a000)={0x34e, 0x0, &(0x7f00001e5000-0x8)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000006000-0x54)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008000-0x30)={0x44, 0x0, &(0x7f0000d06000)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x38, 0x8, &(0x7f000000d000)=[@fda={0x66646185}, @flat={0x73682a85}], &(0x7f0000006000)=[0x20]}}], 0x0, 0x0, &(0x7f0000176000-0x1)}) 2018/02/10 14:10:21 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$vcsn(&(0x7f0000d89000)='/dev/vcs#\x00', 0x6, 0x101000) getsockopt$inet_sctp6_SCTP_LOCAL_AUTH_CHUNKS(0xffffffffffffff9c, 0x84, 0x1b, &(0x7f000053d000-0x8d)={0x0, 0x85, "65135688c25926dcd84d118350a8a4d5afab69b75ff8c5ddd77afad3d82b728e529d34c440479899fa75f1cbc1bff99dfdbb564a823bea700505085521443b5e946ec8c148d86db8ae5a4a283204ae41e1ad55af0f00cab8327c8d6932d05a1711958f2e87fa41cc47aa93e969bd96ac286db424db4a7404c8871380a64341a894707c281b"}, &(0x7f0000fbb000)=0x8d) setsockopt$inet_sctp_SCTP_RESET_ASSOC(r1, 0x84, 0x78, &(0x7f000032b000-0x4)=r2, 0x4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000a000)={0x34e, 0x0, &(0x7f00001e5000-0x8)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000006000-0x54)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000008000-0x30)={0x0, 0x0, &(0x7f0000d06000)=[], 0x0, 0x0, &(0x7f0000176000-0x1)}) 2018/02/10 14:10:21 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mlock2(&(0x7f000010f000/0x4000)=nil, 0x4000, 0x1) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f00001ff000-0x1c)={0xa, 0x2, 0x0, @empty}, 0x1c) listen(r0, 0x0) syz_emit_ethernet(0x5e, &(0x7f00004ef000)={@local={[0xaa, 0xaa, 0xaa, 0xaa], 0x0, 0xaa}, @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "7fff00", 0x28, 0x6, 0x0, @empty, @mcast2={0xff, 0x2, [], 0x1}, {[], @tcp={{0xffffffffffffffff, 0x2, 0x42424242, 0x42424242, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, {[@md5sig={0x13, 0x12, "0001001d36fd6313030000000000c0ed"}]}}}}}}}}, 0x0) 2018/02/10 14:10:21 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$mice(&(0x7f00007ae000-0x10)='/dev/input/mice\x00', 0x0, 0x0) clock_gettime(0x0, &(0x7f0000e45000)={0x0, 0x0}) ppoll(&(0x7f00005bf000-0x30)=[{r0}, {r1}, {r0, 0x80}, {r0, 0xa0}], 0x4, &(0x7f0000db7000-0x8)={r2, r3+10000000}, &(0x7f0000bf9000-0x8)={0xffffffffffffff7f}, 0x8) 2018/02/10 14:10:21 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = perf_event_open(&(0x7f0000940000)={0x2, 0x78, 0x379a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) readv(r0, &(0x7f0000e4f000-0x8)=[{&(0x7f00002d7000)=""/147, 0x93}], 0x1) close(r0) 2018/02/10 14:10:21 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r0, r0, &(0x7f0000049000), 0x3d2) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000008000)={&(0x7f000000f000-0xc)={0x10, 0x34000}, 0xc, &(0x7f0000220000)={&(0x7f00008d6000-0x14)={0x14, 0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, {}, []}, 0x14}, 0x1}, 0x0) r1 = userfaultfd(0x80800) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000ff8000-0x20)={{&(0x7f0000012000/0x2000)=nil, 0x2000}, 0x1}) bpf$MAP_CREATE(0x0, &(0x7f0000fb4000)={0x2, 0x8000000000000004, 0x400, 0x7fd, 0x4, 0xffffffffffffffff}, 0x2c) userfaultfd(0x800) clock_gettime(0x0, &(0x7f0000132000)={0x0, 0x0}) socketpair(0x1d, 0x800, 0x4, &(0x7f0000589000)) r4 = syz_open_dev$mouse(&(0x7f00006eb000)='/dev/input/mouse#\x00', 0xde6e, 0x1) timer_settime(0x0, 0x1, &(0x7f000097e000)={{0x0, r3}, {r2, r3+10000000}}, &(0x7f0000939000)) fanotify_init(0x25, 0x802) r5 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000ef2000-0x1d)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f00002d8000-0xc)={0x0, 0x0}, &(0x7f0000d76000-0x4)=0xc) syz_open_procfs(r6, &(0x7f0000013000)='ns/cgroup\x00') openat$ion(0xffffffffffffff9c, &(0x7f0000dd5000)='/dev/ion\x00', 0x800, 0x0) pipe2(&(0x7f000058c000), 0x4800) setsockopt$inet_IP_XFRM_POLICY(r4, 0x0, 0x11, &(0x7f0000e12000-0xe8)={{{@in6=@mcast1={0xff, 0x1, [], 0x1}, @in=@rand_addr, 0x2, 0xbd, 0x3, 0x20, 0xa, 0xa0, 0x80, 0xbf, 0x0, r7}, {0x0, 0x8, 0x0, 0x3, 0x6, 0x1fa8, 0x8, 0x20}, {0x1719, 0x7fff, 0x7ff, 0x7ff}, 0x0, 0x7, 0x0, 0x1, 0x1, 0x3}, {{@in=@broadcast=0xffffffff, 0x1, 0x7f}, 0xa, @in=@empty, 0xffffffffffffffff, 0x3, 0x0, 0xffffffffffffffbc, 0x20, 0x6, 0x2}}, 0xe8) openat$selinux_policy(0xffffffffffffff9c, &(0x7f000010e000-0x10)='/selinux/policy\x00', 0x0, 0x0) setsockopt$netlink_NETLINK_TX_RING(r5, 0x10e, 0x7, &(0x7f0000ab4000-0x10)={0x6, 0x7, 0x52, 0xfffffffffffffffc}, 0x10) 2018/02/10 14:10:21 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000a5000-0x8)) mmap(&(0x7f0000000000/0x19000)=nil, 0x19000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000924000-0xc)='/dev/rfkill\x00', 0x0, 0x0) r1 = userfaultfd(0x80000) ioctl$sock_SIOCGIFCONF(r0, 0x8910, &(0x7f0000f07000)=@buf={0xd4, &(0x7f0000ad4000)="79b4e8bb1a2d0efc0612da4ace4e5ecccff05d799aadd730f3503fcbbc58b778fbfe57f0cf11de80ad77c061b2daefadb373cc1b11fc57b37a22ae28306a6cfac38c720f849a787cdb9d8c447b83ac5ab8ffee7d784cf0448579b409cd730d1b716ff2a4c4c99715efe4257b91d8a48dc54098c8c09d847ef8f90a8d7b3646b996d4babe0e663bb820abee6eedc10d8b5cecde9a969d328d52dce9ac23ac8c54c5df2b97cce9cb9888683cfb2813aa3e095fbe6bf0695fe1da1d32243938180c32ec6eea03a310d55aeb24d553967b222ec5acbf"}) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000e54000-0x18)={0xaa}) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000008000-0x20)={{&(0x7f0000000000/0x4000)=nil, 0x4000}, 0x1}) readv(r0, &(0x7f00001f3000-0x10)=[{&(0x7f0000002000-0x4e)=""/1, 0x1}], 0x1) ioctl$RNDADDTOENTCNT(r0, 0x40045201, &(0x7f0000b27000)) ioctl$RNDADDTOENTCNT(r0, 0x40045201, &(0x7f0000a81000)) ioctl$UFFDIO_UNREGISTER(r1, 0xc020aa04, &(0x7f0000008000-0x4)={&(0x7f0000000000/0x2000)=nil, 0x2000}) 2018/02/10 14:10:21 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00001c1000)='/dev/sequencer2\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(r0, 0x40085112, &(0x7f000021e000-0x50)={{0xff, 0x3}}) bpf$OBJ_GET_PROG(0x7, &(0x7f00007ec000)={&(0x7f00007f7000)='./file0\x00', 0x0, 0x8}, 0x10) [ 79.162475] binder: 12984:12997 unknown command 0 [ 79.162628] binder: 12986:12995 Acquire 1 refcount change on invalid ref 0 ret -22 [ 79.167591] binder: 12984:12997 ioctl c0306201 2000a000 returned -22 [ 79.175163] binder: 12986:12995 unknown command 0 [ 79.177487] binder: 12986:12995 ioctl c0306201 2000a000 returned -22 [ 79.198469] binder: BINDER_SET_CONTEXT_MGR already set [ 79.207719] binder: 12984:13001 unknown command 0 2018/02/10 14:10:21 executing program 3: mmap(&(0x7f0000000000/0xecc000)=nil, 0xecc000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000ecc000-0x20)={@empty, 0x0, 0x1, 0x0, 0x9a2eb7423d24a315}, 0x20) mmap(&(0x7f0000ecc000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) fchmod(r0, 0x40) r1 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000ecc000)='/dev/qat_adf_ctl\x00', 0x0, 0x0) mmap(&(0x7f0000ecc000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) getpeername$netrom(r1, &(0x7f00008d1000-0x48)=@full, &(0x7f0000ecd000-0x4)=0x48) 2018/02/10 14:10:21 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$mice(&(0x7f00007ae000-0x10)='/dev/input/mice\x00', 0x0, 0x0) clock_gettime(0x0, &(0x7f0000e45000)={0x0, 0x0}) ppoll(&(0x7f00005bf000-0x30)=[{r0}, {r1}, {r0, 0x80}, {r0, 0xa0}], 0x4, &(0x7f0000db7000-0x8)={r2, r3+10000000}, &(0x7f0000bf9000-0x8)={0xffffffffffffff7f}, 0x8) [ 79.213152] binder: 12984:13001 ioctl c0306201 2000a000 returned -22 [ 79.224819] binder: 12984:12997 ioctl 40046207 0 returned -16 [ 79.234219] binder: 12986:12995 Acquire 1 refcount change on invalid ref 0 ret -22 [ 79.241985] binder: 12986:12995 unknown command 0 2018/02/10 14:10:21 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r0, r0, &(0x7f0000049000), 0x3d2) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000008000)={&(0x7f000000f000-0xc)={0x10, 0x34000}, 0xc, &(0x7f0000220000)={&(0x7f00008d6000-0x14)={0x14, 0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, {}, []}, 0x14}, 0x1}, 0x0) r1 = userfaultfd(0x80800) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000ff8000-0x20)={{&(0x7f0000012000/0x2000)=nil, 0x2000}, 0x1}) bpf$MAP_CREATE(0x0, &(0x7f0000fb4000)={0x2, 0x8000000000000004, 0x400, 0x7fd, 0x4, 0xffffffffffffffff}, 0x2c) userfaultfd(0x800) clock_gettime(0x0, &(0x7f0000132000)={0x0, 0x0}) socketpair(0x1d, 0x800, 0x4, &(0x7f0000589000)) r4 = syz_open_dev$mouse(&(0x7f00006eb000)='/dev/input/mouse#\x00', 0xde6e, 0x1) timer_settime(0x0, 0x1, &(0x7f000097e000)={{0x0, r3}, {r2, r3+10000000}}, &(0x7f0000939000)) fanotify_init(0x25, 0x802) r5 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000ef2000-0x1d)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f00002d8000-0xc)={0x0, 0x0}, &(0x7f0000d76000-0x4)=0xc) syz_open_procfs(r6, &(0x7f0000013000)='ns/cgroup\x00') openat$ion(0xffffffffffffff9c, &(0x7f0000dd5000)='/dev/ion\x00', 0x800, 0x0) pipe2(&(0x7f000058c000), 0x4800) setsockopt$inet_IP_XFRM_POLICY(r4, 0x0, 0x11, &(0x7f0000e12000-0xe8)={{{@in6=@mcast1={0xff, 0x1, [], 0x1}, @in=@rand_addr, 0x2, 0xbd, 0x3, 0x20, 0xa, 0xa0, 0x80, 0xbf, 0x0, r7}, {0x0, 0x8, 0x0, 0x3, 0x6, 0x1fa8, 0x8, 0x20}, {0x1719, 0x7fff, 0x7ff, 0x7ff}, 0x0, 0x7, 0x0, 0x1, 0x1, 0x3}, {{@in=@broadcast=0xffffffff, 0x1, 0x7f}, 0xa, @in=@empty, 0xffffffffffffffff, 0x3, 0x0, 0xffffffffffffffbc, 0x20, 0x6, 0x2}}, 0xe8) openat$selinux_policy(0xffffffffffffff9c, &(0x7f000010e000-0x10)='/selinux/policy\x00', 0x0, 0x0) setsockopt$netlink_NETLINK_TX_RING(r5, 0x10e, 0x7, &(0x7f0000ab4000-0x10)={0x6, 0x7, 0x52, 0xfffffffffffffffc}, 0x10) 2018/02/10 14:10:21 executing program 4: r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000999000+0xfe5)='/dev/ppp\x00', 0x101000, 0x0) ioctl$KDGETKEYCODE(r0, 0x4b4c, &(0x7f000016d000-0x8)={0xffffffff, 0x1ff}) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000bcf000-0xd)='/dev/binder#\x00', 0x0, 0x800) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r1, 0x0) r2 = bpf$OBJ_GET_PROG(0x7, &(0x7f0000720000-0x10)={&(0x7f0000b09000-0x8)='./file0\x00', 0x0, 0x38e667c4ad63cd79}, 0x10) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r2, 0xc04064a0, &(0x7f000043f000)={&(0x7f000021a000)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f00007b7000-0x8)=[0x0, 0x0], &(0x7f00000e8000)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f00000c2000-0x8)=[0x0, 0x0], 0x7, 0x2, 0x7, 0x2}) r3 = dup2(r1, r2) dup2(r0, r3) recvfrom$ipx(r3, &(0x7f0000104000-0xa7)=""/167, 0xa7, 0x40000100, &(0x7f0000e18000)={0x4, 0x7, 0x100, "116824a96992", 0x20000000000}, 0x10) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000a000)={0x34e, 0x0, &(0x7f00001e5000-0x8)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000006000-0x54)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000-0x30)={0x49, 0x0, &(0x7f0000c85000)=[@transaction={0x40406300, {0x4, 0x0, 0x0, 0x0, 0x8000000000000000, 0x0, 0x0, 0x38, 0x8, &(0x7f0000845000)=[@fda={0x66646185}, @flat={0x73682a85}], &(0x7f0000006000)=[0x20]}}], 0x0, 0x0, &(0x7f0000176000-0x1)}) 2018/02/10 14:10:21 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f000024c000)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_ASSIGN_PCI_DEVICE(0xffffffffffffffff, 0x8040ae69, &(0x7f0000006000-0x14)={0x0, 0x1}) userfaultfd(0x800) socket$nl_route(0x10, 0x3, 0x0) pkey_mprotect(&(0x7f0000004000/0x2000)=nil, 0x2000, 0x5, 0xffffffffffffffff) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000006000-0x20)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000cc0000/0x2000)=nil}) 2018/02/10 14:10:21 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000a5000-0x8)) mmap(&(0x7f0000000000/0x19000)=nil, 0x19000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000924000-0xc)='/dev/rfkill\x00', 0x0, 0x0) io_setup(0x0, &(0x7f0000735000)=0x0) io_cancel(r1, &(0x7f0000f7a000-0x40)={0x0, 0x0, 0x0, 0x8, 0x3, r0, &(0x7f0000aef000-0x3d)="db91708bba27c908412f64ed29d2ad1c981c0037c0cd5e048834c1d09d1d86f58c91eaea32763dd31d4948682b686b6801135f20aa20c1faf68928514dcbc7140bb25d515dfa11db0fd8c5de66d034913a2adb82b65444ad3cf903862a07c6f587f0da21e105f6bb063cb59595aad06b72a76953ae38b1ab01b29c41075575bf38ddd810f300186a6ab7bb174881cc30388034b156be9a04794b43058fec591bfb42cb575066bfc9b006b9021497cb19ec7ac2f791f55e9b595b335128d14477640694b2c8b4c05040d79822dcba", 0xce, 0x5ea, 0x0, 0x0, r0}, &(0x7f000001a000)) r2 = userfaultfd(0x0) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000e54000-0x18)={0xaa}) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000008000-0x20)={{&(0x7f0000000000/0x4000)=nil, 0x4000}, 0x1}) readv(r0, &(0x7f00001f3000-0x10)=[{&(0x7f0000002000-0x4e)=""/1, 0x1}], 0x1) ioctl$RNDADDTOENTCNT(r0, 0x40045201, &(0x7f0000b27000)) ioctl$RNDADDTOENTCNT(r0, 0x40045201, &(0x7f0000a81000)) ioctl$UFFDIO_UNREGISTER(r2, 0xc020aa04, &(0x7f0000008000-0x4)={&(0x7f0000000000/0x2000)=nil, 0x2000}) [ 79.257630] binder: release 12984:12997 transaction 482 out, still active [ 79.264678] binder: undelivered TRANSACTION_COMPLETE [ 79.269869] binder: send failed reply for transaction 482, target dead [ 79.277660] binder: 12986:12995 ioctl c0306201 2000a000 returned -22 2018/02/10 14:10:21 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000a000)={0x34e, 0x0, &(0x7f00001e5000-0x8)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000006000-0x54)}) pipe2(&(0x7f00006dc000-0x8)={0x0, 0x0}, 0x80000) ioctl$EVIOCGUNIQ(r1, 0x80404508, &(0x7f000095d000)=""/224) ioctl$KVM_ASSIGN_DEV_IRQ(r1, 0x4040ae70, &(0x7f0000e52000-0x10)={0x4, 0xa, 0x9, 0x503}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000008000-0x30)={0x0, 0x0, &(0x7f0000d06000)=[], 0x0, 0x0, &(0x7f0000176000-0x1)}) [ 79.306168] binder: 13017:13022 unknown command 0 [ 79.323969] binder: 13017:13022 ioctl c0306201 2000a000 returned -22 [ 79.347110] binder: 13029:13030 Acquire 1 refcount change on invalid ref 0 ret -22 [ 79.354944] binder: 13029:13030 unknown command 0 [ 79.356730] binder_alloc: binder_alloc_mmap_handler: 13017 20000000-20002000 already mapped failed -16 [ 79.375092] binder: BINDER_SET_CONTEXT_MGR already set [ 79.381694] binder: 13017:13027 ioctl 40046207 0 returned -16 [ 79.399652] binder: 13017:13022 unknown command 0 [ 79.403806] binder: 13029:13039 Acquire 1 refcount change on invalid ref 0 ret -22 [ 79.405606] binder: 13017:13022 ioctl c0306201 2000a000 returned -22 [ 79.412312] binder: 13029:13039 unknown command 0 [ 79.419955] binder: 13029:13030 ioctl c0306201 2000a000 returned -22 [ 79.424211] binder: 13029:13039 ioctl c0306201 2000a000 returned -22 2018/02/10 14:10:21 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r0, r0, &(0x7f0000049000), 0x3d2) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000008000)={&(0x7f000000f000-0xc)={0x10, 0x34000}, 0xc, &(0x7f0000220000)={&(0x7f00008d6000-0x14)={0x14, 0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, {}, []}, 0x14}, 0x1}, 0x0) r1 = userfaultfd(0x80800) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000ff8000-0x20)={{&(0x7f0000012000/0x2000)=nil, 0x2000}, 0x1}) bpf$MAP_CREATE(0x0, &(0x7f0000fb4000)={0x2, 0x8000000000000004, 0x400, 0x7fd, 0x4, 0xffffffffffffffff}, 0x2c) userfaultfd(0x800) clock_gettime(0x0, &(0x7f0000132000)={0x0, 0x0}) socketpair(0x1d, 0x800, 0x4, &(0x7f0000589000)) r4 = syz_open_dev$mouse(&(0x7f00006eb000)='/dev/input/mouse#\x00', 0xde6e, 0x1) timer_settime(0x0, 0x1, &(0x7f000097e000)={{0x0, r3}, {r2, r3+10000000}}, &(0x7f0000939000)) fanotify_init(0x25, 0x802) r5 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000ef2000-0x1d)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f00002d8000-0xc)={0x0, 0x0}, &(0x7f0000d76000-0x4)=0xc) syz_open_procfs(r6, &(0x7f0000013000)='ns/cgroup\x00') openat$ion(0xffffffffffffff9c, &(0x7f0000dd5000)='/dev/ion\x00', 0x800, 0x0) pipe2(&(0x7f000058c000), 0x4800) setsockopt$inet_IP_XFRM_POLICY(r4, 0x0, 0x11, &(0x7f0000e12000-0xe8)={{{@in6=@mcast1={0xff, 0x1, [], 0x1}, @in=@rand_addr, 0x2, 0xbd, 0x3, 0x20, 0xa, 0xa0, 0x80, 0xbf, 0x0, r7}, {0x0, 0x8, 0x0, 0x3, 0x6, 0x1fa8, 0x8, 0x20}, {0x1719, 0x7fff, 0x7ff, 0x7ff}, 0x0, 0x7, 0x0, 0x1, 0x1, 0x3}, {{@in=@broadcast=0xffffffff, 0x1, 0x7f}, 0xa, @in=@empty, 0xffffffffffffffff, 0x3, 0x0, 0xffffffffffffffbc, 0x20, 0x6, 0x2}}, 0xe8) openat$selinux_policy(0xffffffffffffff9c, &(0x7f000010e000-0x10)='/selinux/policy\x00', 0x0, 0x0) setsockopt$netlink_NETLINK_TX_RING(r5, 0x10e, 0x7, &(0x7f0000ab4000-0x10)={0x6, 0x7, 0x52, 0xfffffffffffffffc}, 0x10) 2018/02/10 14:10:21 executing program 1: mmap(&(0x7f0000000000/0xaf0000)=nil, 0xaf0000, 0x3, 0x32, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x163, &(0x7f00006a4000)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @dev={[0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x155, 0xffffffffffffffff, 0x0, 0x0, 0x2, 0x0, @rand_addr, @empty, {[]}}, @igmp={0x11, 0x0, 0x0, @loopback=0x7f000001, "000000081e84d84b2db57b8a0af02ad8c4fda114a6e1200fd51c7ac998963739081ac9863e00c3a144b00263209fd5d31366005e0fba973461c1a98f799e3d94a162efc1763146b22c169c07351b62a1c4bae8590f0bc322d3034fe9dd3e4c4584063a0f35b040fd90300fc409fce43787e45d5627492ffb4cfb282d780c688c3b7986dd839b15e48e2b8930f6dc3bb8490fc3ddc4bbed5116722aa50c9c1288a6d28df4e54bdec1095520dbaf24445a8c903788d8c35162f2f2487f67a18c9c6c7ac1af5dff578d40b6e17c1e9d1aef018d594f3d7ebf1668320566590a043c35a726cadbb9b4bf5ee9d028960fbcaa333c4c8ae0471645de6bc77287666c654fed646b547b12bd5915b9da8d3b3bf44c77ed87a8a96dc2a0d555708993cd0a3ade824cfd54fcd9396f47ebd847f818e5f62dc0585ab785a5"}}}}}, &(0x7f00003b5000)={0xffffffffffffffff, 0x1, [0x9df]}) r0 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000573000)='/selinux/policy\x00', 0x0, 0x0) ioctl$sock_bt_bnep_BNEPCONNDEL(r0, 0x400442c9, &(0x7f0000044000-0xa)={0x6, "aef1e5e17812"}) 2018/02/10 14:10:21 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$mice(&(0x7f00007ae000-0x10)='/dev/input/mice\x00', 0x0, 0x0) clock_gettime(0x0, &(0x7f0000e45000)={0x0, 0x0}) ppoll(&(0x7f00005bf000-0x30)=[{r0}, {r1, 0x1f}, {r0, 0xa0}], 0x3, &(0x7f0000db7000-0x8)={r2, r3+10000000}, &(0x7f0000bf9000-0x8)={0xffffffffffffff7f}, 0x8) 2018/02/10 14:10:21 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$int_in(r0, 0x5452, &(0x7f0000337000)=0x9) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000a000)={0x34e, 0x0, &(0x7f00001e5000-0x8)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000006000-0x54)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000-0x30)={0x44, 0x0, &(0x7f0000d06000)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x38, 0x8, &(0x7f000000d000)=[@fda={0x66646185}, @flat={0x73682a85}], &(0x7f0000006000)=[0x20]}}], 0x0, 0x0, &(0x7f0000176000-0x1)}) r1 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000ae7000)='/proc/self/net/pfkey\x00', 0x6840, 0x0) ioctl$KVM_CREATE_DEVICE(r1, 0xc00caee0, &(0x7f0000a63000-0xc)={0xb, r0, 0x1}) bind$ipx(r2, &(0x7f00008ff000-0x10)={0x4, 0x100000000, 0x20, "55ac78c3e1d4"}, 0x10) getsockopt$inet_sctp_SCTP_AUTOCLOSE(r1, 0x84, 0x4, &(0x7f0000753000), &(0x7f00003dc000-0x4)=0x4) fcntl$notify(r0, 0x402, 0x80000026) 2018/02/10 14:10:21 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) getsockopt$inet_sctp6_SCTP_STATUS(0xffffffffffffffff, 0x84, 0xe, &(0x7f00003a2000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, @in6={{0xa, 0xffffffffffffffff, 0x0, @remote={0xfe, 0x80, [], 0xffffffffffffffff, 0xbb}}}}}, &(0x7f0000a3a000-0x4)=0xb8) setsockopt$inet_sctp6_SCTP_MAXSEG(0xffffffffffffffff, 0x84, 0xd, &(0x7f0000fca000-0x8)=@assoc_value={r2}, 0x8) getsockopt(r0, 0x84, 0x40008000000007d, &(0x7f0000fca000-0x8)=""/8, &(0x7f0000fc9000-0x4)=0x8) ioctl$KVM_CREATE_DEVICE(0xffffffffffffffff, 0xc00caee0, &(0x7f0000b08000-0xc)={0x2, r0, 0x1}) setsockopt$inet_sctp_SCTP_AUTH_DELETE_KEY(r3, 0x84, 0x19, &(0x7f00004a9000-0x6)={r2, 0x3}, 0x6) setsockopt$inet_sctp6_SCTP_DELAYED_SACK(r3, 0x84, 0x10, &(0x7f000005d000-0x8)=@assoc_value={r1, 0x6}, 0x8) 2018/02/10 14:10:21 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00009ba000-0xd)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000a000)={0x34e, 0x0, &(0x7f00001e5000-0x8)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000006000-0x54)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000008000-0x30)={0x0, 0x0, &(0x7f0000d06000)=[], 0x0, 0x0, &(0x7f0000176000-0x1)}) 2018/02/10 14:10:21 executing program 7: r0 = syz_open_dev$mice(&(0x7f00006ca000-0x10)='/dev/input/mice\x00', 0x0, 0x2000) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$EVIOCGABS0(r0, 0x80184540, &(0x7f00005ce000-0x1)=""/1) r1 = syz_open_dev$evdev(&(0x7f0000dda000-0x12)='/dev/input/event#\x00', 0x0, 0x0) ioctl$EVIOCGRAB(r1, 0x40044590, &(0x7f0000e95000-0x4)) r2 = socket(0x2, 0xa, 0x6) r3 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000108000)='/dev/vga_arbiter\x00', 0x80000, 0x0) ioctl$VT_WAITACTIVE(r0, 0x5607) ioctl$TIOCSBRK(0xffffffffffffffff, 0x40044591) openat(r3, &(0x7f0000969000)='./file0\x00', 0x1, 0x4) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r3, 0x84, 0x6f, &(0x7f000074c000)={0x0, 0x2c, &(0x7f0000017000)=[@in6={0xa, 0x3, 0xffff, @loopback={0x0, 0x1}, 0xdb}, @in={0x2, 0x1, @multicast1=0xe0000001}]}, &(0x7f000062d000)=0xc) bpf$OBJ_PIN_MAP(0x6, &(0x7f000003a000-0xc)={&(0x7f0000f87000-0x8)='./file0\x00', r3}, 0xc) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(r3, 0x84, 0xf, &(0x7f0000032000-0xa0)={r4, @in={{0x2, 0x2, @rand_addr=0x101}}, 0x4, 0x4, 0x5, 0x6, 0x9}, &(0x7f0000fd5000)=0xa0) request_key(&(0x7f0000102000)='big_key\x00', &(0x7f0000ad3000)={0x73, 0x79, 0x7a, 0x3}, &(0x7f00006cc000-0x40)='deflate\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', 0xffffffffffffffff) setsockopt$inet_dccp_buf(r2, 0x21, 0xd, &(0x7f0000606000)="7b0dd322b12e8e47ef05f9f34ece260be5e5c29d", 0x14) 2018/02/10 14:10:21 executing program 5: mmap(&(0x7f0000000000/0xca9000)=nil, 0xca9000, 0x5, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$midi(&(0x7f0000786000-0xb)='/dev/midi#\x00', 0x7, 0x20000) read$eventfd(r0, &(0x7f0000159000-0x8), 0x8) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_AUTO_ASCONF(r1, 0x84, 0x1e, &(0x7f0000caa000), &(0x7f0000445000-0x4)=0x4) mmap(&(0x7f0000ca9000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f0000caa000-0xc)={0x0, 0x10, &(0x7f00003f2000-0x10)=[@in={0x2, 0x0, @local={0xac, 0x14, 0x0, 0xaa}}]}, &(0x7f0000c7b000-0x4)=0xc) mmap(&(0x7f0000ca9000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000caa000-0x8)={r2, 0x9}, 0x8) mmap(&(0x7f0000caa000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$sock_inet_SIOCSIFDSTADDR(r1, 0x8918, &(0x7f0000cab000-0x20)={@syzn={0x73, 0x79, 0x7a, 0x0}, @ifru_flags=0x400}) 2018/02/10 14:10:21 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$mice(&(0x7f00007ae000-0x10)='/dev/input/mice\x00', 0x0, 0x0) clock_gettime(0x0, &(0x7f0000e45000)={0x0, 0x0}) ppoll(&(0x7f00005bf000-0x30)=[{r0}, {r1, 0x1f}], 0x2, &(0x7f0000db7000-0x8)={r2, r3+10000000}, &(0x7f0000bf9000-0x8)={0xffffffffffffff7f}, 0x8) 2018/02/10 14:10:21 executing program 5: mmap(&(0x7f0000000000/0x28000)=nil, 0x28000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f000000d000)={0xa, 0x0, 0x0, @empty}, 0x1c) connect$inet6(r0, &(0x7f000000d000-0x1c)={0xa, 0x0, 0x0, @empty}, 0x1c) sendmsg(r0, &(0x7f0000013000)={0x0, 0x0, &(0x7f0000003000-0x10)=[], 0x0, &(0x7f000000c000-0x1180)=[]}, 0x0) mmap(&(0x7f0000028000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f0000025000-0xe8)={{{@in6=@empty, @in=@multicast1, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@mcast1}, 0x0, @in6=@remote}}, &(0x7f0000029000-0x4)=0xe8) fstat(r0, &(0x7f000000f000-0x44)={0x0, 0x0, 0x0, 0x0, 0x0}) mmap(&(0x7f0000028000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) dup(r0) setsockopt$inet6_IPV6_IPSEC_POLICY(r0, 0x29, 0x22, &(0x7f0000028000)={{{@in=@multicast1=0xe0000001, @in=@broadcast=0xffffffff, 0x0, 0x2, 0x2, 0xfffffffffffffffa, 0xa, 0x80, 0xa0, 0xff, r1, r2}, {0x8, 0x8, 0x800, 0xd, 0x2, 0x2, 0xfffffffffffff137, 0x6}, {0x2, 0x0, 0x60, 0x9}, 0x3, 0x5, 0x1, 0x0, 0x1, 0x2}, {{@in6=@empty, 0x2, 0x32}, 0xa, @in=@broadcast=0xffffffff, 0x1, 0x1, 0x0, 0x794a714f, 0x400, 0x5}}, 0xe8) setsockopt$sock_int(r0, 0x1, 0x28, &(0x7f0000027000)=0x2, 0x4) recvmsg(r0, &(0x7f0000019000-0x38)={&(0x7f000000a000-0x2e)=@pppol2tpv3={0x0, 0x0, {0x0, 0x0, {0x0, 0xffffffffffffffff, @local}}}, 0x2e, &(0x7f0000026000)=[], 0x0, &(0x7f0000022000)=""/12, 0xc}, 0x0) 2018/02/10 14:10:21 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000d9d000-0xc)={0x0}, &(0x7f0000a71000-0x4)=0xc) r1 = syz_open_procfs(r0, &(0x7f00008fb000-0xe)='attr/fscreate\x00') write$selinux_context(r1, &(0x7f0000569000-0x24)='systemfu:objecT_rrinit_va:_r\x00n_t:s0\x00', 0xfffffffffffffcd1) mkdir(&(0x7f00009a2000-0x8)='./file0\x00', 0x0) [ 79.510800] binder: 13045:13051 unknown command 0 [ 79.515860] binder: 13043:13050 unknown command 0 [ 79.528210] binder: 13043:13050 ioctl c0306201 2000a000 returned -22 [ 79.535169] binder: 13045:13051 ioctl c0306201 2000a000 returned -22 2018/02/10 14:10:21 executing program 5: r0 = syz_open_dev$audion(&(0x7f0000e78000-0xc)='/dev/audio#\x00', 0x29af, 0x2) fcntl$getflags(r0, 0x40b) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) bind$rds(0xffffffffffffffff, &(0x7f00006ca000-0x10)={0x2, 0x2, @remote={0xac, 0x14, 0x0, 0xbb}}, 0x10) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f000031f000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000dee000)='/dev/rtc\x00', 0x0, 0x0) ioctl$LOOP_CLR_FD(r1, 0x7003) fcntl$setlease(r1, 0x400, 0x3) [ 79.581333] binder: 13045:13058 unknown command 0 [ 79.593583] binder_alloc: binder_alloc_mmap_handler: 13043 20000000-20002000 already mapped failed -16 [ 79.603487] binder: 13045:13058 ioctl c0306201 2000a000 returned -22 [ 79.616646] binder: BINDER_SET_CONTEXT_MGR already set 2018/02/10 14:10:21 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$vcsn(&(0x7f0000702000)='/dev/vcs#\x00', 0x7, 0x119080) ioctl$DRM_IOCTL_AUTH_MAGIC(r0, 0x40046411, &(0x7f0000f13000)=0x1f) r1 = socket(0x40000000015, 0x5, 0x9) fcntl$notify(r1, 0x402, 0x4) ioctl$TUNSETPERSIST(r0, 0x400454cb, &(0x7f0000052000-0x4)=0x8) connect$llc(r1, &(0x7f00008e3000-0x10)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @random="2202ce37e7a3"}, 0x10) setsockopt$netlink_NETLINK_CAP_ACK(r0, 0x10e, 0xa, &(0x7f0000cce000)=0xa723, 0x4) r2 = creat(&(0x7f0000a2c000)='./file0\x00', 0x40) ioctl$DRM_IOCTL_AGP_ACQUIRE(r2, 0x6430) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(r1, 0x84, 0x73, &(0x7f0000c91000-0x18)={0x0, 0x6, 0x0, 0x7, 0x3}, &(0x7f0000071000)=0x18) setsockopt$inet_sctp6_SCTP_DELAYED_SACK(r0, 0x84, 0x10, &(0x7f00006a1000-0xc)=@sack_info={r3, 0x40, 0x80000000}, 0xc) 2018/02/10 14:10:21 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$mice(&(0x7f00007ae000-0x10)='/dev/input/mice\x00', 0x0, 0x0) clock_gettime(0x0, &(0x7f0000e45000)={0x0, 0x0}) ppoll(&(0x7f00005bf000-0x30)=[{r0}, {r1, 0x1f}], 0x2, &(0x7f0000db7000-0x8)={0x0, r3+10000000}, &(0x7f0000bf9000-0x8)={0xffffffffffffff7f}, 0x8) [ 79.629368] binder: 13043:13050 ioctl 40046207 0 returned -16 [ 79.649307] binder: 13043:13059 unknown command 0 [ 79.649943] binder_alloc: 13043: binder_alloc_buf, no vma [ 79.658773] kauditd_printk_skb: 10 callbacks suppressed 2018/02/10 14:10:21 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000a000)={0x34e, 0x0, &(0x7f00001e5000-0x8)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000006000-0x54)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000008000-0x30)={0x0, 0x0, &(0x7f0000d06000)=[], 0x0, 0x0, &(0x7f0000176000-0x1)}) recvmsg(r0, &(0x7f00004fe000)={&(0x7f0000cc0000)=@pppol2tp={0x0, 0x0, {0x0, 0x0, {0x0, 0xffffffffffffffff, @local}}}, 0x26, &(0x7f000050a000)=[{&(0x7f0000b81000)=""/5, 0x5}, {&(0x7f0000ef8000)=""/109, 0x6d}, {&(0x7f0000d97000-0xa1)=""/161, 0xa1}, {&(0x7f00007b3000)=""/4096, 0x1000}, {&(0x7f00003fa000-0xf8)=""/248, 0xf8}, {&(0x7f00003be000)=""/253, 0xfd}, {&(0x7f0000cb9000)=""/106, 0x6a}], 0x7, &(0x7f0000c8c000)=""/244, 0xf4, 0x1}, 0x20) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000ef4000+0x3a2)="c6631e958d81c75780ab7154809fb113698d1eac6d0fb9495ff43adfd95384b714626163f448db63451d7ed433b09f19ca6680ab01e2ae28027124e95eaf9f64e7c268db67531094f29ddec639f43e433be2213b99a7c00d92e57d460f84018e0da313acc099edb073b0e2c925dc1bf0b5eab9e8f66e7a45ccc3d12f8dee108d1a99ce5b0dcef08ac69ea353", 0x8c) [ 79.658877] audit: type=1401 audit(1518271821.721:155): op=fscreate invalid_context=73797374656D66753A6F626A6563545F7272696E69745F76613A5F72006E5F743A73300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 [ 79.659842] binder: 13043:13071 transaction failed 29189/-3, size 56-8 line 2957 [ 79.673997] binder: 13043:13059 ioctl c0306201 2000a000 returned -22 2018/02/10 14:10:21 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = gettid() r1 = inotify_init1(0x0) fstat(r1, &(0x7f00009b1000-0x25)) fcntl$setown(r1, 0x8, 0x0) fcntl$getownex(r1, 0x10, &(0x7f0000460000-0x8)={0x0, 0x0}) kcmp(r0, r2, 0x0, 0xffffffffffffffff, 0xffffffffffffffff) [ 79.781228] binder: 13082:13083 unknown command 0 [ 79.786265] binder: 13082:13083 ioctl c0306201 2000a000 returned -22 [ 79.799893] binder: 13082:13087 unknown command 0 [ 79.811714] binder: 13082:13087 ioctl c0306201 2000a000 returned -22 [ 79.854931] binder: undelivered TRANSACTION_ERROR: 29189 [ 79.860670] binder: release 13043:13059 transaction 490 out, still active [ 79.867646] binder: undelivered TRANSACTION_COMPLETE [ 79.872800] binder: send failed reply for transaction 490, target dead 2018/02/10 14:10:22 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r0, r0, &(0x7f0000049000), 0x3d2) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000008000)={&(0x7f000000f000-0xc)={0x10, 0x34000}, 0xc, &(0x7f0000220000)={&(0x7f00008d6000-0x14)={0x14, 0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, {}, []}, 0x14}, 0x1}, 0x0) r1 = userfaultfd(0x80800) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000ff8000-0x20)={{&(0x7f0000012000/0x2000)=nil, 0x2000}, 0x1}) bpf$MAP_CREATE(0x0, &(0x7f0000fb4000)={0x2, 0x8000000000000004, 0x400, 0x7fd, 0x4, 0xffffffffffffffff}, 0x2c) userfaultfd(0x800) clock_gettime(0x0, &(0x7f0000132000)={0x0, 0x0}) socketpair(0x1d, 0x800, 0x4, &(0x7f0000589000)) r4 = syz_open_dev$mouse(&(0x7f00006eb000)='/dev/input/mouse#\x00', 0xde6e, 0x1) timer_settime(0x0, 0x1, &(0x7f000097e000)={{0x0, r3}, {r2, r3+10000000}}, &(0x7f0000939000)) fanotify_init(0x25, 0x802) r5 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000ef2000-0x1d)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f00002d8000-0xc)={0x0, 0x0}, &(0x7f0000d76000-0x4)=0xc) syz_open_procfs(r6, &(0x7f0000013000)='ns/cgroup\x00') openat$ion(0xffffffffffffff9c, &(0x7f0000dd5000)='/dev/ion\x00', 0x800, 0x0) pipe2(&(0x7f000058c000), 0x4800) setsockopt$inet_IP_XFRM_POLICY(r4, 0x0, 0x11, &(0x7f0000e12000-0xe8)={{{@in6=@mcast1={0xff, 0x1, [], 0x1}, @in=@rand_addr, 0x2, 0xbd, 0x3, 0x20, 0xa, 0xa0, 0x80, 0xbf, 0x0, r7}, {0x0, 0x8, 0x0, 0x3, 0x6, 0x1fa8, 0x8, 0x20}, {0x1719, 0x7fff, 0x7ff, 0x7ff}, 0x1, 0xffffffffffffffff, 0x0, 0x1, 0x1, 0x3}, {{@in=@broadcast=0xffffffff, 0x1, 0x7f}, 0xa, @in=@empty, 0xffffffffffffffff, 0x3, 0x0, 0xffffffffffffffbc, 0x20, 0x6, 0x2}}, 0xe8) openat$selinux_policy(0xffffffffffffff9c, &(0x7f000010e000-0x10)='/selinux/policy\x00', 0x0, 0x0) setsockopt$netlink_NETLINK_TX_RING(r5, 0x10e, 0x7, &(0x7f0000ab4000-0x10)={0x6, 0x7, 0x52, 0xfffffffffffffffc}, 0x10) 2018/02/10 14:10:22 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000477000-0xd)='/selinux/mls\x00', 0x0, 0x0) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(0xffffffffffffff9c, 0xc00c642d, &(0x7f0000330000-0x6)={0x0, 0x80000, 0xffffffffffffffff}) ioctl$DRM_IOCTL_GEM_OPEN(0xffffffffffffffff, 0xc010640b, &(0x7f000061f000-0x10)={0x0, 0x0, 0x7fff}) ioctl$DRM_IOCTL_GEM_FLINK(r1, 0xc008640a, &(0x7f00009ed000)={r2, r3}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000a000)={0x34e, 0x0, &(0x7f00001e5000-0x8)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000006000-0x54)}) r4 = openat$rfkill(0xffffffffffffff9c, &(0x7f000076d000-0xc)='/dev/rfkill\x00', 0x240000, 0x0) ioctl$SNDRV_CTL_IOCTL_TLV_READ(r4, 0xc008551a, &(0x7f0000933000)={0xffff000000000000, 0x14, [0xaa28, 0x6, 0x2, 0x5, 0x1e2]}) openat$selinux_mls(0xffffffffffffff9c, &(0x7f000070e000-0xd)='/selinux/mls\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000-0x30)={0x0, 0x0, &(0x7f0000d06000)=[], 0x0, 0x0, &(0x7f0000176000-0x1)}) 2018/02/10 14:10:22 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sg(&(0x7f0000ece000-0x9)='/dev/sg#\x00', 0x9, 0x400) sendmsg$rds(r0, &(0x7f000081b000)={&(0x7f0000607000-0x10)={0x2, 0x1, @multicast1=0xe0000001}, 0x10, &(0x7f0000ca5000)=[{&(0x7f000015f000)=""/89, 0x59}, {&(0x7f000013d000)=""/4096, 0x1000}, {&(0x7f00005e1000-0x29)=""/41, 0x29}, {&(0x7f0000c9c000-0xf2)=""/242, 0xf2}, {&(0x7f000051c000)=""/207, 0xcf}, {&(0x7f00008fe000)=""/4096, 0x1000}], 0x6, &(0x7f0000586000-0x218)=[@mask_fadd={0x58, 0x114, 0x8, {{0x1, 0x9}, &(0x7f000015f000)=0xfffffffffffffffe, &(0x7f0000746000-0x8)=0x8, 0x400, 0x22f, 0x8001, 0x400, 0x38, 0x7}}, @rdma_dest={0x18, 0x114, 0x2, {0x0, 0xfffffffffffffff8}}, @fadd={0x58, 0x114, 0x6, {{0x3ff, 0x9}, &(0x7f00007f2000)=0x5, &(0x7f0000a00000-0x8), 0x0, 0x7, 0x8e3, 0x76ef, 0x1c, 0x7}}, @rdma_dest={0x18, 0x114, 0x2, {0x3ff, 0x2}}, @mask_fadd={0x58, 0x114, 0x8, {{0x3ff}, &(0x7f0000e74000-0x8)=0x6, &(0x7f0000a53000-0x8)=0x5, 0x1, 0xffffffffffffd9ab, 0xfffffffffffffff7, 0xfff, 0x0, 0x7f}}, @rdma_map={0x30, 0x114, 0x3, {{&(0x7f0000d4f000)=""/220, 0xdc}, &(0x7f000069c000), 0xc}}, @fadd={0x58, 0x114, 0x6, {{0x800, 0xffffffff80000000}, &(0x7f0000895000-0x8)=0x1000, &(0x7f000017d000)=0x5, 0x1ff, 0x3, 0x4, 0x8001, 0x0, 0x6}}, @cswp={0x58, 0x114, 0x7, {{0x7fff, 0x6}, &(0x7f0000977000)=0x3ff, &(0x7f0000963000-0x8)=0x9, 0x1da0, 0x101, 0x6, 0x1, 0x50, 0xffffffffffffff8a}}], 0x218, 0x20000000}, 0x20000000) getsockopt$bt_BT_RCVMTU(r0, 0x112, 0xd, &(0x7f0000f8e000)=0x20, &(0x7f0000202000)=0x2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000d29000)={0xffffffffffffffff, 0xffffffffffffffff}) recvmmsg(r1, &(0x7f0000869000-0xa0)=[{{&(0x7f0000374000)=@pppol2tpv3={0x0, 0x0, {0x0, 0x0, {0x0, 0xffffffffffffffff, @broadcast}}}, 0x2e, &(0x7f00009ff000)=[], 0x0, &(0x7f00005f3000-0x1000)=""/4096, 0x1000, 0x4}, 0x1}], 0x80000000000037e, 0x80000010003, &(0x7f0000a69000)={0x0, 0x989680}) 2018/02/10 14:10:22 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$usbmon(&(0x7f0000312000)='/dev/usbmon#\x00', 0x100000001, 0x115101) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r1, 0x40045532, &(0x7f0000258000-0x4)=0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000a000)={0x34e, 0x0, &(0x7f00001e5000-0x8)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000006000-0x54)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000-0x30)={0x44, 0x0, &(0x7f0000d06000)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x38, 0x8, &(0x7f000000d000)=[@fda={0x66646185}, @flat={0x73682a85}], &(0x7f0000006000)=[0x20]}}], 0x0, 0x0, &(0x7f0000176000-0x1)}) 2018/02/10 14:10:22 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f000014c000-0x9)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) utime(&(0x7f0000c4c000)='./file0\x00', &(0x7f0000a98000)={0x8c9}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f00006cf000)={0x10005, 0x0, 0x0, 0x1000, &(0x7f0000a98000/0x1000)=nil}) ioctl$KVM_SMI(r2, 0xaeb7) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_SET_SREGS(r2, 0x4138ae84, &(0x7f0000c9c000-0x138)={{}, {}, {}, {}, {}, {}, {}, {}, {}, {}, 0xfffffffffffffffc, 0x0, 0x0, 0x204018}) ioctl$KVM_SET_XCRS(r2, 0x4188aea7, &(0x7f000052a000)={0x1, 0xd45, [{0x8, 0x0, 0x5cc2}]}) ioctl$KVM_TRANSLATE(r2, 0xc018ae85, &(0x7f0000757000)) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IPT_SO_SET_REPLACE(r3, 0x0, 0x40, &(0x7f0000c4d000)=@filter={'filter\x00', 0xe, 0x4, 0x288, 0xffffffff, 0x120, 0x260, 0x120, 0xffffffff, 0xffffffff, 0x2f8, 0x2f8, 0x2f8, 0xffffffff, 0x4, &(0x7f0000665000), {[{{@ip={@multicast2=0xe0000002, @loopback=0x7f000001, 0x0, 0x0, @generic="7407fe73d2ba932c2471b6eef466dcbf", @syzn={0x73, 0x79, 0x7a}}, 0x0, 0x70, 0x94, 0x0, {}, []}, @REJECT={0x24, 'REJECT\x00'}}, {{@ip={@multicast2=0xe0000002, @rand_addr, 0x0, 0x0, @syzn={0x73, 0x79, 0x7a}, @generic="048eb995e599b5a7148ed84249c62f41"}, 0x0, 0x16, 0xcc, 0x0, {}, []}, @common=@CLUSTERIP={0x5c, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff]}}}, {{@ip={@empty, @local={0xac, 0x14, 0xffffffffffffffff, 0xaa}, 0x0, 0x0, @common='bridge0\x00', @generic="d0314d9334f5146a06e6ca8d9af91dad"}, 0x0, 0x70, 0x94, 0x0, {}, []}, @REJECT={0x24, 'REJECT\x00'}}], {{[], 0x0, 0x70, 0x94}, {0x24, '\x00', 0x0, 0xfffffffffffffffe}}}}, 0x2e4) 2018/02/10 14:10:22 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$evdev(&(0x7f0000dda000-0x12)='/dev/input/event#\x00', 0x0, 0x0) ioctl$EVIOCGRAB(r0, 0x40044590, &(0x7f0000e95000-0x4)) ioctl$TIOCSBRK(0xffffffffffffffff, 0x40044591) request_key(&(0x7f0000102000)='big_key\x00', &(0x7f0000ad3000)={0x73, 0x79, 0x7a, 0x3}, &(0x7f00006cc000-0x40)='deflate\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', 0xffffffffffffffff) ioctl$EVIOCGPROP(r0, 0x80404509, &(0x7f0000f32000)=""/4096) 2018/02/10 14:10:22 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$mice(&(0x7f00007ae000-0x10)='/dev/input/mice\x00', 0x0, 0x0) clock_gettime(0x0, &(0x7f0000e45000)={0x0, 0x0}) ppoll(&(0x7f00005bf000-0x30)=[{r0}, {r1, 0x1f}], 0x2, &(0x7f0000db7000-0x8)={0x0, 0x0}, &(0x7f0000bf9000-0x8)={0xffffffffffffff7f}, 0x8) 2018/02/10 14:10:22 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00001c9000)='/dev/kvm\x00', 0x80100, 0x0) r1 = dup2(r0, r0) ioctl$DRM_IOCTL_RES_CTX(0xffffffffffffff9c, 0xc0086426, &(0x7f0000599000-0x8)={0x1, &(0x7f00000a6000-0x8)=[{0x0}]}) ioctl$DRM_IOCTL_DMA(r1, 0xc0286429, &(0x7f0000374000)={r2, 0x1, &(0x7f0000fcb000-0x4)=[0x1], &(0x7f0000dd6000-0x8)=[0x9c, 0x778e], 0x40, 0x3, 0x73e, &(0x7f00005d2000)=[0x100000001, 0x5, 0x3], &(0x7f0000a38000-0xc)=[0x100, 0x20, 0x3]}) r3 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) fcntl$setflags(r3, 0x2, 0xffffffffffffffff) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f00000ca000)={0x1ff, 0x0, 0x0, 0x1000, &(0x7f0000b80000/0x1000)=nil}) r4 = openat$mixer(0xffffffffffffff9c, &(0x7f0000d2b000-0xb)='/dev/mixer\x00', 0x208000, 0x0) getsockopt$inet_sctp6_SCTP_INITMSG(r4, 0x84, 0x2, &(0x7f000040d000), &(0x7f0000a61000)=0x8) [ 80.015877] binder: 13096:13107 unknown command 0 2018/02/10 14:10:22 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$mice(&(0x7f00007ae000-0x10)='/dev/input/mice\x00', 0x0, 0x0) clock_gettime(0x0, &(0x7f0000e45000)={0x0, 0x0}) ppoll(&(0x7f00005bf000-0x30)=[{r0}, {r1, 0x1f}], 0x2, &(0x7f0000db7000-0x8)={0x0, 0x0}, &(0x7f0000bf9000-0x8)={0xffffffffffffff7f}, 0x8) [ 80.036811] binder: 13096:13107 ioctl c0306201 2000a000 returned -22 [ 80.039178] binder: 13097:13108 unknown command 0 [ 80.052586] binder: 13097:13108 ioctl c0306201 2000a000 returned -22 [ 80.070726] binder: BINDER_SET_CONTEXT_MGR already set [ 80.076129] binder: 13096:13112 unknown command 0 2018/02/10 14:10:22 executing program 5: r0 = getpid() getpriority(0x3, r0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f00002cd000-0x19)='/selinux/avc/cache_stats\x00', 0x0, 0x0) getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(0xffffffffffffff9c, 0x84, 0xf, &(0x7f0000a18000-0xa0)={0x0, @in6={{0xa, 0x2, 0x2, @empty, 0x1}}, 0xad, 0x80, 0x3f, 0x7, 0xfffffffffffffff9}, &(0x7f0000190000-0x4)=0xa0) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffff9c, 0x84, 0x73, &(0x7f0000984000)={0x0, 0x4, 0x30}, &(0x7f0000036000-0x2)=0x18) getsockopt$inet_sctp6_SCTP_STATUS(r1, 0x84, 0xe, &(0x7f0000bc6000-0xb8)={r2, 0x1, 0x3ff, 0x6, 0x2000000000000, 0x9, 0x9, 0x101, {r3, @in={{0x2, 0x2, @remote={0xac, 0x14, 0x0, 0xbb}}}, 0x1, 0xff, 0x3, 0xd0, 0x2}}, &(0x7f00000e4000)=0xb8) migrate_pages(0x0, 0x4, &(0x7f0000a1e000)=0x35ff, &(0x7f0000735000)=0x9) [ 80.086945] binder: 13096:13107 ioctl 40046207 0 returned -16 [ 80.091812] binder: 13096:13112 ioctl c0306201 2000a000 returned -22 [ 80.112614] *** Guest State *** [ 80.116209] CR0: actual=0xffffffff9ffffffc, shadow=0xfffffffffffffffc, gh_mask=fffffffffffffff7 [ 80.125220] CR4: actual=0x0000000000206058, shadow=0x0000000000204018, gh_mask=ffffffffffffe871 2018/02/10 14:10:22 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_getaffinity(0x0, 0x8, &(0x7f0000000000)) r0 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000dcb000)='/dev/qat_adf_ctl\x00', 0x0, 0x0) getsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(0xffffffffffffff9c, 0x84, 0x75, &(0x7f0000ad6000-0x8), &(0x7f00002a2000)=0x8) ioctl$sock_FIOGETOWN(r0, 0x8903, &(0x7f0000102000)=0x0) ptrace$setsig(0x4203, r1, 0x9, &(0x7f0000240000-0x10)={0x11, 0x100000000, 0x100, 0x3f}) ioctl$sock_SIOCGPGRP(r0, 0x8904, &(0x7f000070d000-0x4)=0x0) timer_create(0x3, &(0x7f0000017000-0x58)={0x0, 0x25, 0x1, @tid=r2}, &(0x7f0000500000-0x4)) [ 80.134080] CR3 = 0x0000000000000000 [ 80.137822] RSP = 0x0000000000000000 RIP = 0x0000000000008000 [ 80.143826] RFLAGS=0x00010002 DR7 = 0x0000000000000400 [ 80.149830] Sysenter RSP=0000000000000000 CS:RIP=0000:0000000000000000 [ 80.156530] CS: sel=0x0000, attr=0x10000, limit=0x00000000, base=0x0000000000000000 [ 80.161875] binder: release 13096:13112 transaction 497 out, still active [ 80.164522] DS: sel=0x0000, attr=0x10000, limit=0x00000000, base=0x0000000000000000 [ 80.164547] SS: sel=0x0000, attr=0x10000, limit=0x00000000, base=0x0000000000000000 [ 80.164559] ES: sel=0x0000, attr=0x10000, limit=0x00000000, base=0x0000000000000000 [ 80.171495] binder: undelivered TRANSACTION_COMPLETE [ 80.179461] FS: sel=0x0000, attr=0x10000, limit=0x00000000, base=0x0000000000000000 [ 80.187444] binder: send failed reply for transaction 497, target dead [ 80.195387] GS: sel=0x0000, attr=0x10000, limit=0x00000000, base=0x0000000000000000 [ 80.195396] GDTR: limit=0x00000000, base=0x0000000000000000 [ 80.195407] LDTR: sel=0x0000, attr=0x10000, limit=0x00000000, base=0x0000000000000000 [ 80.216302] QAT: Invalid ioctl [ 80.223134] IDTR: limit=0x00000000, base=0x0000000000000000 [ 80.223148] TR: sel=0x0000, attr=0x10000, limit=0x00000000, base=0x0000000000000000 [ 80.223156] EFER = 0x0000000000000000 PAT = 0x0007040600070406 [ 80.223164] DebugCtl = 0x0000000000000000 DebugExceptions = 0x0000000000000000 [ 80.223171] Interruptibility = 00000008 ActivityState = 00000000 [ 80.223174] *** Host State *** [ 80.223183] RIP = 0xffffffff811c99dc RSP = 0xffff8801b58cf3d8 2018/02/10 14:10:22 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x4, 0x0) setsockopt$inet_opts(r0, 0x0, 0x4, &(0x7f00009f8000)="bdc7bbc008", 0x5) r1 = perf_event_open(&(0x7f0000b68000-0x78)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x7704, 0x0) setsockopt$inet_MCAST_MSFILTER(r0, 0x0, 0x30, &(0x7f0000550000)={0x9, {{0x2, 0xffffffffffffffff, @multicast2=0xe0000002}}, 0x0, 0x1, [{{0x2, 0xffffffffffffffff, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}}}]}, 0x120) connect$bt_sco(r0, &(0x7f0000891000-0x8)={0x1f, {0x1, 0x2, 0x6}}, 0x8) 2018/02/10 14:10:22 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000bee000-0xc)='/dev/rfkill\x00', 0x400000, 0x0) getsockopt$inet_sctp6_SCTP_CONTEXT(0xffffffffffffff9c, 0x84, 0x11, &(0x7f000006e000)={0x0, 0xc9f}, &(0x7f000062f000-0x4)=0x8) getsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r0, 0x84, 0x22, &(0x7f0000870000+0xce1)={0x2, 0x8002, 0x8, 0x3f, r1}, &(0x7f0000533000)=0x10) r2 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f000000a000)={0x34e, 0x0, &(0x7f00001e5000-0x8)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000006000-0x54)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008000-0x30)={0x44, 0x0, &(0x7f0000d06000)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x38, 0x8, &(0x7f000000d000)=[@fda={0x66646185}, @flat={0x73682a85}], &(0x7f0000006000)=[0x20]}}], 0x0, 0x0, &(0x7f0000176000-0x1)}) [ 80.223196] CS=0010 SS=0018 DS=0000 ES=0000 FS=0000 GS=0000 TR=0040 [ 80.223205] FSBase=0000000000000000 GSBase=ffff8801db400000 TRBase=fffffe0000003000 [ 80.232116] QAT: Invalid ioctl [ 80.239167] GDTBase=fffffe0000001000 IDTBase=fffffe0000000000 [ 80.239178] CR0=0000000080050033 CR3=00000001ce84a003 CR4=00000000001626f0 [ 80.239189] Sysenter RSP=fffffe0000002200 CS:RIP=0010:ffffffff85a019f0 [ 80.239198] EFER = 0x0000000000000d01 PAT = 0x0000000000000000 [ 80.239202] *** Control State *** [ 80.239208] PinBased=0000003f CPUBased=b6986dfa SecondaryExec=000000c2 [ 80.239213] EntryControls=0000d1ff ExitControls=0023efff [ 80.239222] ExceptionBitmap=00060042 PFECmask=00000000 PFECmatch=00000000 [ 80.239228] VMEntry: intr_info=80000306 errcode=00000000 ilen=00000000 [ 80.239234] VMExit: intr_info=00000000 errcode=00000000 ilen=00000003 [ 80.239240] reason=80000021 qualification=0000000000000000 [ 80.251528] can_create: 11 callbacks suppressed [ 80.251532] can: request_module (can-proto-4) failed. [ 80.258393] IDTVectoring: info=00000000 errcode=00000000 [ 80.258399] TSC Offset = 0xffffffd294b6d63e [ 80.258406] EPT pointer = 0x00000001c6d1a01e [ 80.286371] binder: 13127:13130 unknown command 0 [ 80.302287] QAT: Invalid ioctl [ 80.315392] binder: 13127:13130 ioctl c0306201 2000a000 returned -22 [ 80.321548] QAT: Invalid ioctl [ 80.336913] binder: BINDER_SET_CONTEXT_MGR already set [ 80.420829] binder: 13097:13116 unknown command 0 [ 80.420939] binder: 13127:13130 unknown command 0 [ 80.432774] binder: 13127:13130 ioctl c0306201 2000a000 returned -22 [ 80.435852] binder_alloc: 13127: binder_alloc_buf, no vma [ 80.444641] binder: 13127:13133 ioctl 40046207 0 returned -16 [ 80.444925] binder: 13127:13145 transaction failed 29189/-3, size 56-8 line 2957 [ 80.450945] binder: 13097:13116 ioctl c0306201 2000a000 returned -22 [ 80.470921] binder: undelivered TRANSACTION_ERROR: 29189 [ 80.476833] binder: release 13127:13133 transaction 501 out, still active [ 80.483838] binder: undelivered TRANSACTION_COMPLETE [ 80.489037] binder: send failed reply for transaction 501, target dead 2018/02/10 14:10:22 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r0, r0, &(0x7f0000049000), 0x3d2) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000008000)={&(0x7f000000f000-0xc)={0x10, 0x34000}, 0xc, &(0x7f0000220000)={&(0x7f00008d6000-0x14)={0x14, 0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, {}, []}, 0x14}, 0x1}, 0x0) r1 = userfaultfd(0x80800) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000ff8000-0x20)={{&(0x7f0000012000/0x2000)=nil, 0x2000}, 0x1}) bpf$MAP_CREATE(0x0, &(0x7f0000fb4000)={0x2, 0x8000000000000004, 0x400, 0x7fd, 0x4, 0xffffffffffffffff}, 0x2c) userfaultfd(0x800) clock_gettime(0x0, &(0x7f0000132000)={0x0, 0x0}) socketpair(0x1d, 0x800, 0x4, &(0x7f0000589000)) r4 = syz_open_dev$mouse(&(0x7f00006eb000)='/dev/input/mouse#\x00', 0xde6e, 0x1) timer_settime(0x0, 0x1, &(0x7f000097e000)={{0x0, r3}, {r2, r3+10000000}}, &(0x7f0000939000)) fanotify_init(0x25, 0x802) r5 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000ef2000-0x1d)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f00002d8000-0xc)={0x0, 0x0}, &(0x7f0000d76000-0x4)=0xc) syz_open_procfs(r6, &(0x7f0000013000)='ns/cgroup\x00') openat$ion(0xffffffffffffff9c, &(0x7f0000dd5000)='/dev/ion\x00', 0x800, 0x0) pipe2(&(0x7f000058c000), 0x4800) setsockopt$inet_IP_XFRM_POLICY(r4, 0x0, 0x11, &(0x7f0000e12000-0xe8)={{{@in6=@mcast1={0xff, 0x1, [], 0x1}, @in=@rand_addr, 0x2, 0xbd, 0x3, 0x20, 0xa, 0xa0, 0x80, 0xbf, 0x0, r7}, {0x0, 0x8, 0x0, 0x3, 0x6, 0x1fa8, 0x8, 0x20}, {0x1719, 0x7fff, 0x7ff, 0x7ff}, 0x1, 0xffffffffffffffff, 0x0, 0x1, 0x1, 0x3}, {{@in=@broadcast=0xffffffff, 0x1, 0x7f}, 0xa, @in=@empty, 0xffffffffffffffff, 0x3, 0x0, 0xffffffffffffffbc, 0x20, 0x6, 0x2}}, 0xe8) openat$selinux_policy(0xffffffffffffff9c, &(0x7f000010e000-0x10)='/selinux/policy\x00', 0x0, 0x0) setsockopt$netlink_NETLINK_TX_RING(r5, 0x10e, 0x7, &(0x7f0000ab4000-0x10)={0x6, 0x7, 0x52, 0xfffffffffffffffc}, 0x10) 2018/02/10 14:10:22 executing program 5: mmap(&(0x7f0000000000/0xa000)=nil, 0xa000, 0x3, 0x32, 0xffffffffffffffff, 0x0) request_key(&(0x7f0000006000-0xb)='asymmetric\x00', &(0x7f0000002000-0x5)={0x73, 0x79, 0x7a}, &(0x7f0000002000-0x12)="3a7472757374656475736572566578ad2800", 0x0) r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000005000-0x8)='syscall\x00') mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f000000b000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f000000b000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) nanosleep(&(0x7f000000b000)={0x0, 0x1c9c380}, &(0x7f000000c000-0x8)) ioctl$KVM_GET_MSR_INDEX_LIST(r0, 0xc004ae02, &(0x7f000000b000-0xc)={0x2, [0x0, 0x0]}) 2018/02/10 14:10:22 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$mice(&(0x7f00007ae000-0x10)='/dev/input/mice\x00', 0x0, 0x0) clock_gettime(0x0, &(0x7f0000e45000)={0x0, 0x0}) ppoll(&(0x7f00005bf000-0x30)=[{r0}, {r1, 0x1f}], 0x2, &(0x7f0000db7000-0x8)={0x0, 0x0}, &(0x7f0000bf9000-0x8)={0xffffffffffffff7f}, 0x8) 2018/02/10 14:10:22 executing program 1: bpf$MAP_CREATE(0x7, &(0x7f0000001000)={0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, 0x2c) 2018/02/10 14:10:22 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000a000)={0x34e, 0x0, &(0x7f00001e5000-0x8)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000006000-0x54)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000008000-0x30)={0x0, 0x0, &(0x7f0000d06000)=[], 0x0, 0x0, &(0x7f0000176000-0x1)}) r1 = syz_open_dev$vcsa(&(0x7f00006b2000)='/dev/vcsa#\x00', 0xa4, 0x101000) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f0000fb8000)={0x2, @tick=0x40, 0x0, {0x81, 0x9}, 0xffff, 0x281c96fadd61933b, 0x3}) 2018/02/10 14:10:22 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000a000)={0x34e, 0x0, &(0x7f00001e5000-0x8)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000006000-0x54)}) tee(r0, r0, 0x1, 0x8) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000-0x30)={0x44, 0x0, &(0x7f0000d06000)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x38, 0x8, &(0x7f000000d000)=[@fda={0x66646185}, @flat={0x73682a85}], &(0x7f0000006000)=[0x20]}}], 0x0, 0x0, &(0x7f0000176000-0x1)}) 2018/02/10 14:10:22 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000dda000-0x12)='/dev/input/event#\x00', 0x0, 0x0) ioctl$EVIOCGRAB(r1, 0x40044590, &(0x7f0000e95000-0x4)) openat$rtc(0xffffffffffffff9c, &(0x7f000028f000-0x9)='/dev/rtc\x00', 0x800, 0x0) syz_open_dev$midi(&(0x7f0000e7f000)='/dev/midi#\x00', 0x7ff, 0x218300) r2 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000ff0000)='/proc/self/net/pfkey\x00', 0x101100, 0x0) ioctl$TIOCSBRK(r2, 0x40044591) fcntl$F_GET_RW_HINT(r1, 0x40b, &(0x7f00007c4000)) ioctl$TIOCMBIS(r1, 0x5416, &(0x7f0000545000)=0x800000000) r3 = syz_open_dev$admmidi(&(0x7f000033e000-0xe)='/dev/admmidi#\x00', 0x9, 0x509000) getsockname$ipx(r3, &(0x7f0000f91000), &(0x7f0000627000-0x4)=0x10) openat$sequencer(0xffffffffffffff9c, &(0x7f0000ea6000-0xf)='/dev/sequencer\x00', 0x0, 0x0) request_key(&(0x7f0000102000)='big_key\x00', &(0x7f0000ad3000)={0x73, 0x79, 0x7a, 0x3}, &(0x7f00006cc000-0x40)='deflate\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', 0xffffffffffffffff) ioctl$TIOCLINUX2(r0, 0x541c, &(0x7f0000c8b000-0xc)={0x2, 0x1, 0xe6, 0x3ff, 0x800, 0x7fff}) 2018/02/10 14:10:22 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000510000)={@loopback}, &(0x7f00007f6000)=0x14) r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f00005d6000-0xd)={0x2, 0x0, @rand_addr}, 0x10) lstat(&(0x7f0000962000)='./file0\x00', &(0x7f0000e2b000)={0x0, 0x0, 0x0, 0x0, 0x0}) setuid(r1) ioctl$TIOCLINUX5(r0, 0x541c, &(0x7f0000c51000)={0x5, 0x7, 0x0, 0x7, 0x10000}) setsockopt$inet_tcp_int(r0, 0x6, 0x200000000000a, &(0x7f0000dee000-0x4)=0x2, 0x4) connect(r0, &(0x7f0000fea000-0x10)=@nfc={0x27, 0x80000000, 0x8, 0x7}, 0x478) r2 = socket$alg(0x26, 0x5, 0x0) socketpair$inet_dccp(0x2, 0x6, 0x0, &(0x7f00000fe000-0x8)={0x0, 0x0}) sendto$inet(r0, &(0x7f0000de2000-0x1)='U', 0x1, 0x20008005, &(0x7f0000db5000-0x10)={0x2, 0x0, @loopback=0x7f000001}, 0x10) mbind(&(0x7f0000d42000/0x2000)=nil, 0x2000, 0x0, &(0x7f0000fa9000-0x8), 0x0, 0x2) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000df0000-0x4), 0x4) r4 = syz_open_dev$usbmon(&(0x7f0000843000-0xd)='/dev/usbmon#\x00', 0x200, 0x440800) clock_gettime(0x0, &(0x7f000058c000)={0x0, 0x0}) clock_gettime(0x0, &(0x7f0000f26000-0x8)={0x0, 0x0}) write$evdev(r4, &(0x7f0000162000-0x50)=[{{0x77359400}, 0x100000000, 0x8, 0x9}, {{r5, r6/1000+10000}, 0x100, 0xf1dc, 0x7b8}, {{0x77359400}, 0x10001, 0x1ff, 0x3ff}, {{r7, r8/1000+30000}, 0x400, 0x2, 0xb400000000000000}, {{}, 0x18, 0x7f, 0x1}], 0x50) umount2(&(0x7f0000386000-0x8)='./file0\x00', 0x0) setsockopt$inet_msfilter(r3, 0x0, 0x29, &(0x7f0000524000)={@multicast2=0xe0000002, @broadcast=0xffffffff, 0x1, 0x5, [@dev={0xac, 0x14, 0x0, 0x13}, @local={0xac, 0x14, 0x0, 0xaa}, @rand_addr=0x4, @multicast2=0xe0000002, @loopback=0x7f000001]}, 0x24) ioctl$TIOCGSID(r2, 0x5429, &(0x7f0000b28000)=0x0) ptrace$getsig(0x4202, r9, 0xfff, &(0x7f000000f000-0x10)) r10 = syz_open_procfs(0xffffffffffffffff, &(0x7f000094b000-0x9)='net/bnep\x00') getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r4, 0x84, 0x6f, &(0x7f0000651000)={0x0, 0x78, &(0x7f00003e0000-0x78)=[@in={0x2, 0x1, @multicast2=0xe0000002}, @in6={0xa, 0x0, 0x1, @mcast2={0xff, 0x2, [], 0x1}, 0xffffffff}, @in6={0xa, 0x2, 0x10001, @local={0xfe, 0x80, [], 0x0, 0xaa}, 0xffffffffffffff81}, @in={0x2, 0x0, @multicast1=0xe0000001}, @in={0x2, 0x0, @broadcast=0xffffffff}, @in={0x2, 0x3, @remote={0xac, 0x14, 0x0, 0xbb}}]}, &(0x7f00005e6000-0x4)=0xc) getsockopt$inet_sctp_SCTP_PR_SUPPORTED(r10, 0x84, 0x71, &(0x7f00005ce000-0x8)={r11, 0x4}, &(0x7f00002c3000-0x4)=0x8) r13 = add_key$user(&(0x7f00005fa000)='user\x00', &(0x7f0000271000-0x5)={0x73, 0x79, 0x7a, 0x3}, &(0x7f00005af000-0x91)="7e23231458c04cfc50404a80db06bba478001a7738702f06a18500c0a92fc01e87b8e64c6256c5bc14d07943c3689f938fe7b79258ed20c676d8bf21fe0c9556cab11e15479398bbb0336f61236612a8d31cef279388836c8cd9159ea47d1dcdddad43b0ce929eaed55e573676a8cf7b8adcf2f114031d337d4f22aa24b25ea5a9c69a8fa43685f1cee7aec5c7196c632e", 0x91, 0xffffffffffffffff) keyctl$describe(0x6, r13, &(0x7f000036a000)=""/54, 0x36) setsockopt$inet_sctp_SCTP_DEFAULT_SEND_PARAM(r10, 0x84, 0xa, &(0x7f000080e000-0x20)={0x9, 0x1, 0x1, 0x200, 0x1, 0x4952, 0x7, 0x2, r12}, 0x20) sendto$inet(r0, &(0x7f0000b0c000)="11a58fde7649496403db92ed306004b3d3cbfc195485c3b895d864ab91a3aebde4f70a917a91ec9612d004000a7b43a35bb73249ede41bf5c05ab608fb7b74ffd57f6e8e43cf9cb723fc0d8d8cabbbbae3a5fde8ad6f52d667c512596f50b9962aa2193688d872a7eeca57801742d74d39c4b003a5e292e077ed102e7999329aab95a3d96363505f76c86a6d2352dd8025207ae531701f1ce353d6b017eb64000000bc2e9f8b66fe4a8e64f0fc7a0aa55d4103e1d7d5b0dd5750071e9b3a786021678a86fcbb0b9f9364ec0f0310306fef9c21b3b20d8b44423b495299cea2c6f40c377a72534453ad7f5af27b1efb2514ace1f9a68cf205a9ddb8fd954e34bde3612e6e05686cf3b968a14bd3a356f7b8d20214c0f7a388ef5ea8d063c65f2aabff685e69f86b4a0b3697f8bfbfe66796f0489ad2e49bdbc1742941c28c88cb93e1f8ccc3db4782cdf9cbd797ddc8d7b1364da50ad48e081a38622280169eba5c6a3bf9b5f15bdf8a8b6483340a3297c31154905db209195c28f15d10153204fbe0586516c714ddc939e0eb68c73969e81fc6f215b476ddf3fcf1a604603360089dadba2779cfed9027ac163067fc0d7592ac8a013b907372a42b242405241ac1f63f85a52fff2d78b30e87a156b5cfa133dabc259bb027bec5eb8c8eb623e9776a13d3ce972a6769de8a78153f498084a244b0146b77be3d1cba7b02fe8906ed8a88f105c763d1772825b986d52823bf38b6f95eca494fd9c64497874b9f450bec65311493cc108b27611eaa6819305a3730d29368f25f7e816d60884a1e0271c3c786ad36391366ac3b65f04c148974f6973005c5ff73d6f0b3f7e44c65da7c4115c4ee543991e4ad26938384cafffffffc8f7e79aaf1b8ef37f627e3c7168ecda2cf224a491bea6129fcd954b88dbb2d29464931bcd5378041db67ddc70ee856ae09c1b26b9ada008a7d52bf1a160606865a29794f36b2a3811c66e9fe27af8fc8356374e37f3eca244367fb535dde71fae4683710761b89f18820d4f06065450c3d1f76fa26ef28320edf6c36480af14f4444edb40ebb3f8ea264486ec31c40c7f0007a69c24da10db6f60da3e648f16b5fc6b5a5c6217e46c1f3ff354a8b49beb3b46a69dcb4c5d547a7b7ba8fe22da0173f9fe80f4bd47afbec4d2e0d3c91b1a326d8bb9fded873e87f847032af52bd6d129f3ce3f11ea9d0b4250af7eaa2649d9972b9b8dc773c869b3a431eac7f55d6bb92dc29f08d7d8959e2af7571efb7ec88eac4b62850e8f6b60d4a5d06d66875b4bd260a9014a2eb88621f4c6eb3f9ed2190b48acf0358d8b82fb4794535fcb8dd50ba86d23d230a94f07a768142ff3b4c8558dac21726b6279980c238041f26e86c8e3fa83028345999464e3e37d610ab7c15daaffb744a505a3dd9802b3721f29553ee23e1cf376f12cc3fe6b7ac76bd13da44356855be096155e355c9cad31fcdeedc6679c531bc1a2765dc8777108ec5e31d793005e718a9ced77d6505e44f649128a29f5264fecba132f9f5016eaf690751edd64d903b36ceb2b08042c60e9e97f8bc985476e6088a5ebd3743c2358171b30b16d730a5dd49c92fa19cc267e2c1927f200fc3d23a804f0a12b06a6a88a2685051ab28f1721209ada2c14b557a49423795b07040d510bb21ce5d15acedd18cb7cb7a93389ceb934206e4ffb220048a7a82fb3c251d0a31ba5af9eb0c16e29f33f9d0a78f5e6300cf04d17eb5f67711cafa0d4e99eeaf0f8fdbd34170318879a0d12c01891127ba7b677d204268524c5af1d7dc27176826302e34f9d35d2f2eefad5f22f68929d3456c11d5f00d4a8ce8b784bca8088805731eff2d47024c2da68abc2d2c0f7806d7d76cdf489f3bffa75cb826bc0809331d89a3255a498b8150d4ae31d03414ab244939455b6377c2917cb2d8a9f9ebf282657e417860e49ac94f4a838aefd34f28960a78da47933252d8cb2fdb27d413ee54502cd1bf75585468b77b8dca627cab29ef0a5297ee3dcb4c987520804e9a5f45e8241019281bab7e30f4b008bf0edf3b6fb5e8d1c2ab619b2eb84293d636a6a37d716cd8e102b7099676693cb7b01031b57ee93fd22cb18229893fd4d4ef87f1596879ac9f61b2f0c35be34cb6e6f75087ff963c188d43bcb464a95e956e75559eb1f6f2224fb2ca8f0bdc90ae5c2ce712498ee4026b13b8f3137000aa1545a75e5b48e80da30e6dac5529cac1099244e79ad542f45dcfbf16c62b5eb63daee8185c5e79ebfa1ca60880f9e2895f54ab95bbae38ae62200c1e439d73fa63d0bff75935a8ad2ae73b82132e8d4eb4bd55844b2f55c65d5ffa0c65aaf0cc5bc73925d05cf7c1c4383af074feb3a53919d2a3b5bef96115aab966821dbfc4577d19d85911a485c58a5b87cf44d230cfdc255486bb09d5c16f2164397f0fc5f652a171f0269bdcd98291410c010cc377d2690a6032fe5701117adbd0f6b847c9617a9b3d20529024d8d9749b9c49827694d346d3b1bbe434122331986b9f6e84430dfd75d123f3e307d6f5514f3da09b527408bfb6816da54beeefad160e4b095517f3292c2e17fb3bba47527671d0afe7c35d54d25ab307b15d069a05395a9cddd4b519224fe3c689d14827ede6d91ebace2a80afaad3dcd1f8ce20e92012b8934d7ff3ebdd285cc24202a86d70b96674a6af05a3c29065afa4e38b9c34006cb3eb9c87985cfc511a8c261cdeb0c7a3c7a682c40c5b9f1d7d5ef6f97e32d02fdd3f2ded413f4a36c4db899b96c8e40d91c2743cd1d435013e3c3431c82fc5b3345b66cce79fa49f10baa4ef28535eee8c5c1a4b38bace2fb14ec11d34d620b1cc2396dc1fa857ac6ac9f5689b5935f2f25184edd40f8f5c70714f941beae3e1bc9af757edd9d68fb24218e2a02aad4dc0b3c2e5ff94ce547f358f38e52673473fd0e57497978324aee16559e9cdbe5b3a0b96dd69fe5bc97e644487274b6158a0412bd60172bb66f774b8eae7bc1f52ed64d44c553bdc26823e35f18683554e7359802173d1fa86a66104abb1977c3e9fa6970ed7ee483b14b65673a81786fe0ed301f8edb0669fd25bfa0d565e3e93b19b8572c98dbacb103053527a95ee758be002e13df756bbc486def0db079124db72fadc26f0a26b42e21f260f902bb4cd881baae57eff1c3cc15063be17e48208b9a69622adfc03991d204fe0f5ae2528b22c7743f97e0669a1c3c0d0d90f39846fd954d681be0265d14b12285fb1b20bcbaa95915ad51ab8f84094674cbac0071021b261c39a46b0177b98f1662100ef31a3e981236d51e6c1429144a89d46b149301873ef99959f8ab15c12309620d5d548b62ff92233a3f200e0d0a9c2122be615dd91e6a6cd89290d24895540635fead9a56f481ee3fd7890852e271fa7c37b1836a3e1764574960e1ab9fda1d25693cfc33defea84f65c08cce479c66dc16b28d453a1b717fdd9f6ff46b1fa1b6866b4a8c1ad53439c5958403953b3a844b660b28b11d427b392a7c710edbf25725a65e6b94e4c64ae458a8c97c9f7a05a7d8ebf6c76e3afc0204ced97be84986da5403ef31eff1790c039fe00a89976ccab7638d2e217fc64609a41f3a008ed78b25d1a9420b782deef6ce2db0c6d427580087b69c75c1357ed2908c32cffee1c6ddd08510562ab015507a4eb4f54ae5c097cdca34f521f9fa8df7667645a696a472650c1ca9c035e95f34db54722897159c31dc6be5693a5f3871ccbb48a7ead233d03b76875590fa20bae4f37a2011622d0203a3e9d9e198cb075aba26f5e78a8f0b0cd27052527daf0f8e77858dbddec7038c198b868e93ae32f1745d166afed4129460e07af8cb6c3debb6503e87f3cb309e39ed3d682d24adec48ea22702c4d8d48386977a89b73e585f8c2c5fcb0a693cd5028a601b04b833a41ec705735c767c70d316b60aba2da24bd6523533f3180accade90f47e412b393ee1d2456cf8bb430289ddb824350764985c5e35f738f830a378bfa65fd167c7307c13acb912beefa69e499d4a750e820a7af08a7c204ffb64e09fcc921a4e79999757d608880bfd52255bbc16369af4f779edfd9439cfcd17fcc02d5aaa81bac66fa2e551cef55779bd90e8be587ee698575918fced59ec652af26718b3afd1471379132ba0b5143a78f84605b1ef51e49e820a8a8c1639f66bca5afd83602287e982eb125a3a032e4cc5b5be91ab4d8d958fd4dc4cbd310eddc91d89ada4d33fcc963d259e222520281d14e13577906e33665a31afa7cb501cc0c1198d1f755005e82f29bcda62bbf8680bc23d09cac6a8c89709b30c91d27ea148f01ba745346f1ba9ce89cd9b71ff18668a0254c07479762dbb78117c50450506e2a0a606309aa383ec55a49d2569c3a3fef8aad456aa81cb859519765de18a4b92194e8a6a43f1dade801f71eb56699bc021fa48f320f4128d6c153a2ec1fba1c5ca55c5058641692365d311c8902aaf1428d83281aa970af5d98591cd3af30fbb5ee4a1b697491ff6dd727a329feb17b782f254d691f949baf96afa195c62f2c3fd1855a79b25268cef9822e3c6a1b3aa226ec494b070a8774426a5f8877714fe206e569635805208ac7823c8546ec33e4482a85d6fddf86a37a1c60f0a19b5dfe88031b7541af0e93cac8a3bb1ff3e60190b96faedc3b6f63d38f3ee4286fbaa053e8e27ed13b77b2c576d824d777ca53df76d9572e71f74ff180778bf57458b37fe9dbaa6f9927b48b059e5c7fd908ac826aed8f68764285022f4b5cb6b73ef7222ecb0d701c782ed5c16a7c94235fe7c3e0bef9da7310c5f3cda407c5ae7ecfb6b392ad576610b48af17b3fc8a2fd6cd2eee1153cc48a21ba6768a88367a807be008bea547402da4c92c2006c83d74c9d0ef2ca711c54036c8e76ac26c7d22060c9bfc2e67f1d1c6f6bd2f751879295ee21fcf8588c9504cacb02fa3e3fc6e2bed352447a5c2677caba0538960357d6d1706adef5e7d4f6298ed4ecacb7776de15d9bbd672f9991f4bdc4f07401f67cf3a74c0495ea58d0f76a2e6060cecc1d04b93808dc8d61130305740b408359d5552cc23a7b1eff4285d563b4b6b011a4a11372a2bb01cbda724482f95c4487b02c85cc121012b3213041ff6a689072daa4d86a4c125b110f4e2eeed2dd73db0f94ce995896e0b8a9f8f3e9559024251a5b1726b0b3775bac9fabed968d2d4ea31bbdfb2910331d92cb4ff5cc9037cc08cd35f88c4d7b89e46a8cbd05e3c35732b5046b33060dce5372b171daa526a46c3444b331e71f0455fb8b43dc46e2c9f2c4effccf040e56de00000007b16de337f13e7a610feac2f336e75405a530815366e7edfbb429babfd0e68db56892b94621edd9df6ff454ab1dcdb8d39d282fa7932ec7ba5203df2f4196538a1fa040c8014d20ff57fdb8515325a6997b9b71f2094e053f126402a47e628eeb7d8f665fbabe8f1a409ca9c7c5c25baaa0e9945acf27e96f8241a445f7d3352494ba4210b348fa0ec11ea67dead4fc1e5e4f9202931386468882bee59f8d12174198142ef7764d6b930e937e20d018c0cc5a780490356f5521aac74d2c1736e20ae5e0cd8cf6676ac337e8a8976aac75a698e34e72bac561038f228c13b6e974bc21bb79618111db507f3ba314dd2d05fd050d684cf33d8da5f8e5f723a092098ac5b180a6579d543515c2e1d0eb502193aedab526d354b625990c7d5a9f90d86c4e374054f1d14270b603065293e7fa3840de575413b74bfbc4f8c139947ade9a6f48907053f1ae3a95c2", 0x1001, 0xc004, 0x0, 0x3e0) recvmsg(r0, &(0x7f0000df7000-0x38)={&(0x7f0000df7000-0x80)=@generic, 0x80, &(0x7f0000df5000)=[{&(0x7f0000df6000-0x92)=""/146, 0x92}, {&(0x7f0000df7000-0x8c)=""/140, 0x8c}, {&(0x7f0000df6000-0xe8)=""/232, 0xe8}, {&(0x7f000040a000-0x5e)=""/94, 0x5e}, {&(0x7f00007a8000-0xe7)=""/231, 0xe7}, {&(0x7f0000d77000-0xa9)=""/169, 0xa9}, {&(0x7f00009e3000)=""/230, 0xe6}, {&(0x7f0000923000)=""/37, 0x25}, {&(0x7f0000555000-0x31)=""/49, 0x31}], 0x9, &(0x7f0000c28000-0x7)=""/7, 0xffffff89, 0x8000}, 0x40000100) [ 80.576434] binder: 13156:13160 unknown command 0 [ 80.583337] binder: 13154:13162 unknown command 0 [ 80.593673] binder: 13156:13160 ioctl c0306201 2000a000 returned -22 [ 80.600548] binder: 13154:13162 ioctl c0306201 2000a000 returned -22 [ 80.613932] binder_alloc: binder_alloc_mmap_handler: 13156 20000000-20002000 already mapped failed -16 [ 80.616704] binder: 13154:13168 unknown command 0 [ 80.626552] binder: BINDER_SET_CONTEXT_MGR already set [ 80.633828] binder: 13156:13167 unknown command 0 [ 80.634408] binder: 13154:13168 ioctl c0306201 2000a000 returned -22 [ 80.639154] can: request_module (can-proto-4) failed. [ 80.650717] binder: 13156:13167 ioctl c0306201 2000a000 returned -22 [ 80.661096] binder: 13156:13160 ioctl 40046207 0 returned -16 [ 80.663216] binder_alloc: 13156: binder_alloc_buf, no vma [ 80.672800] binder: 13156:13176 transaction failed 29189/-3, size 56-8 line 2957 [ 80.697605] binder: undelivered TRANSACTION_ERROR: 29189 [ 80.703439] binder: release 13156:13160 transaction 508 out, still active [ 80.710439] binder: undelivered TRANSACTION_COMPLETE [ 80.715607] binder: send failed reply for transaction 508, target dead 2018/02/10 14:10:22 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x2, 0x0) bind$inet(r0, &(0x7f0000eed000)={0x2, 0x1, @empty}, 0x10) sendto$inet(r0, &(0x7f0000ef9000), 0x0, 0x0, &(0x7f000015a000)={0x2, 0x1, @empty}, 0x10) recvmsg(r0, &(0x7f000050d000)={0x0, 0x0, &(0x7f00000f7000)=[], 0x0, &(0x7f0000766000-0x51)}, 0x43) 2018/02/10 14:10:22 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$mice(&(0x7f00007ae000-0x10)='/dev/input/mice\x00', 0x0, 0x0) clock_gettime(0x0, &(0x7f0000e45000)={0x0, 0x0}) ppoll(&(0x7f00005bf000-0x30)=[{r0}, {r1, 0x1f}], 0x2, &(0x7f0000db7000-0x8)={0x0, r2+10000000}, &(0x7f0000bf9000-0x8), 0x8) 2018/02/10 14:10:22 executing program 6: r0 = syz_open_dev$sndpcmc(&(0x7f0000ac2000-0x12)='/dev/snd/pcmC#D#c\x00', 0x8, 0x600) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000285000-0x18)) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000a000)={0x0, 0x0, &(0x7f0000368000-0x14)=[], 0x1, 0x0, &(0x7f0000334000-0x1)="ed"}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000008000-0x30)={0x0, 0x0, &(0x7f0000d06000)=[], 0x0, 0x0, &(0x7f0000176000-0x1)}) 2018/02/10 14:10:22 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$selinux_access(0xffffffffffffff9c, &(0x7f0000007000)='/selinux/access\x00', 0x2, 0x0) r1 = openat$selinux_relabel(0xffffffffffffff9c, &(0x7f0000008000)='/selinux/relabel\x00', 0x2, 0x0) r2 = dup3(r1, r0, 0x0) writev(r2, &(0x7f00007cb000)=[{&(0x7f0000d71000-0x2)="4ac4", 0x2}], 0x1) write$fuse(r2, &(0x7f0000cd8000-0x20)={0x18, 0x40000000000, 0x100009, @fuse_bmap_out={0x3}}, 0xfffffdeb) 2018/02/10 14:10:22 executing program 4: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) syz_open_dev$audion(&(0x7f00006b3000)='/dev/audio#\x00', 0x3ff, 0x40000) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000a000)={0x34e, 0x0, &(0x7f00001e5000-0x8)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000006000-0x54)}) openat$rtc(0xffffffffffffff9c, &(0x7f00005a1000)='/dev/rtc\x00', 0x10000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000-0x30)={0x44, 0x0, &(0x7f0000d06000)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x38, 0x8, &(0x7f000000d000)=[@fda={0x66646185}, @flat={0x73682a85}], &(0x7f0000006000)=[0x20]}}], 0x0, 0x0, &(0x7f0000176000-0x1)}) 2018/02/10 14:10:22 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r0, r0, &(0x7f0000049000), 0x3d2) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000008000)={&(0x7f000000f000-0xc)={0x10, 0x34000}, 0xc, &(0x7f0000220000)={&(0x7f00008d6000-0x14)={0x14, 0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, {}, []}, 0x14}, 0x1}, 0x0) r1 = userfaultfd(0x80800) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000ff8000-0x20)={{&(0x7f0000012000/0x2000)=nil, 0x2000}, 0x1}) bpf$MAP_CREATE(0x0, &(0x7f0000fb4000)={0x2, 0x8000000000000004, 0x400, 0x7fd, 0x4, 0xffffffffffffffff}, 0x2c) userfaultfd(0x800) clock_gettime(0x0, &(0x7f0000132000)={0x0, 0x0}) socketpair(0x1d, 0x800, 0x4, &(0x7f0000589000)) r4 = syz_open_dev$mouse(&(0x7f00006eb000)='/dev/input/mouse#\x00', 0xde6e, 0x1) timer_settime(0x0, 0x1, &(0x7f000097e000)={{0x0, r3}, {r2, r3+10000000}}, &(0x7f0000939000)) fanotify_init(0x25, 0x802) r5 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000ef2000-0x1d)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f00002d8000-0xc)={0x0, 0x0}, &(0x7f0000d76000-0x4)=0xc) syz_open_procfs(r6, &(0x7f0000013000)='ns/cgroup\x00') openat$ion(0xffffffffffffff9c, &(0x7f0000dd5000)='/dev/ion\x00', 0x800, 0x0) pipe2(&(0x7f000058c000), 0x4800) setsockopt$inet_IP_XFRM_POLICY(r4, 0x0, 0x11, &(0x7f0000e12000-0xe8)={{{@in6=@mcast1={0xff, 0x1, [], 0x1}, @in=@rand_addr, 0x2, 0xbd, 0x3, 0x20, 0xa, 0xa0, 0x80, 0xbf, 0x0, r7}, {0x0, 0x8, 0x0, 0x3, 0x6, 0x1fa8, 0x8, 0x20}, {0x1719, 0x7fff, 0x7ff, 0x7ff}, 0x1, 0xffffffffffffffff, 0x0, 0x1, 0x1, 0x3}, {{@in=@broadcast=0xffffffff, 0x1, 0x7f}, 0xa, @in=@empty, 0xffffffffffffffff, 0x3, 0x0, 0xffffffffffffffbc, 0x20, 0x6, 0x2}}, 0xe8) openat$selinux_policy(0xffffffffffffff9c, &(0x7f000010e000-0x10)='/selinux/policy\x00', 0x0, 0x0) setsockopt$netlink_NETLINK_TX_RING(r5, 0x10e, 0x7, &(0x7f0000ab4000-0x10)={0x6, 0x7, 0x52, 0xfffffffffffffffc}, 0x10) 2018/02/10 14:10:22 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000dda000-0x12)='/dev/input/event#\x00', 0x0, 0x0) dup3(r0, r0, 0x80000) ioctl$EVIOCGRAB(r1, 0x40044590, &(0x7f0000e95000-0x4)) ioctl$TIOCSBRK(0xffffffffffffffff, 0x40044591) request_key(&(0x7f0000102000)='big_key\x00', &(0x7f0000ad3000)={0x73, 0x79, 0x7a, 0x3}, &(0x7f00006cc000-0x40)='deflate\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', 0xffffffffffffffff) 2018/02/10 14:10:22 executing program 3: mmap(&(0x7f0000000000/0xf87000)=nil, 0xf87000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000f87000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000f87000)='/dev/ppp\x00', 0x4000, 0x0) mmap(&(0x7f0000f87000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) getsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000bda000-0x14), &(0x7f0000f87000)=0x14) setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0xffffffffffffffff, 0x0, @empty, 0x4}, {0xa, 0xffffffffffffffff, 0x0, @mcast1={0xff, 0x1, [], 0x1}}}, 0xab) bpf$PROG_LOAD(0x5, &(0x7f0000f83000-0x48)={0x1, 0x5, &(0x7f0000002000)=@framed={{0x18}, [@jmp={0xf, 0x7fffffff, 0xb}], {0x95}}, &(0x7f0000004000-0xa)='syzkaller\x00', 0x3, 0xc3, &(0x7f0000f84000)=""/195}, 0x48) 2018/02/10 14:10:22 executing program 0: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$mice(&(0x7f00007ae000-0x10)='/dev/input/mice\x00', 0x0, 0x0) clock_gettime(0x0, &(0x7f0000e45000)={0x0, 0x0}) ppoll(&(0x7f00005bf000-0x30)=[{r0}, {r1, 0x1f}], 0x2, &(0x7f0000db7000-0x8)={0x0, r2+10000000}, &(0x7f0000bf9000-0x8), 0x8) 2018/02/10 14:10:22 executing program 5 (fault-call:4 fault-nth:0): mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$mice(&(0x7f00007ae000-0x10)='/dev/input/mice\x00', 0x0, 0x0) clock_gettime(0x0, &(0x7f0000e45000)={0x0, 0x0}) ppoll(&(0x7f00005bf000-0x30)=[{r0}, {r1, 0x1f}], 0x2, &(0x7f0000db7000-0x8)={0x0, r2+10000000}, &(0x7f0000bf9000-0x8), 0x8) 2018/02/10 14:10:22 executing program 1: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$mice(&(0x7f0000016000-0x10)='/dev/input/mice\x00', 0x0, 0x0) openat$rtc(0xffffffffffffff9c, &(0x7f00002ec000-0x9)='/dev/rtc\x00', 0x0, 0x0) creat(&(0x7f0000993000)='./file0\x00', 0x0) unshare(0xa012c00) ioctl$EVIOCSABS3F(r0, 0x401845ff, &(0x7f00009eb000-0x18)={0xeaf, 0x1, 0x9, 0x4, 0xffffffffffffbc27, 0x9}) pselect6(0x40, &(0x7f00000ac000-0x40)={0x3ffffd}, &(0x7f0000768000), &(0x7f00007fc000-0x40), &(0x7f0000349000)={0x0, 0x989680}, &(0x7f0000f14000)={&(0x7f00001da000), 0x8}) 2018/02/10 14:10:22 executing program 3: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f00003f4000-0x1d)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) ioctl$KVM_NMI(r0, 0xae9a) perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$can_bcm(0x1d, 0x2, 0x2) ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f000037e000)={'vcan0\x00', 0x0}) connect$can_bcm(r1, &(0x7f0000002000-0x10)={0x1d, r2}, 0x10) sendmsg$can_raw(r1, &(0x7f0000002000-0x38)={&(0x7f0000013000)={0x1d}, 0x5, &(0x7f0000018000-0x10)={&(0x7f0000007000)=@canfd={{0x1}, 0x0, 0x0, 0x0, 0x0, "0327e18b2b0100000000000000f9030008990039966a7d5cb2bd00000000000000000007496e6866856b76b50100000000efffffff050000000118fa1efd9b0b"}, 0x48}, 0x1}, 0x0) [ 80.795047] binder: 13187:13193 unknown command 0 [ 80.801096] binder: 13187:13193 ioctl c0306201 2000a000 returned -22 [ 80.844777] can: request_module (can-proto-4) failed. [ 80.849604] binder_alloc: binder_alloc_mmap_handler: 13187 20000000-20002000 already mapped failed -16 [ 80.868754] FAULT_INJECTION: forcing a failure. [ 80.868754] name failslab, interval 1, probability 0, space 0, times 0 [ 80.872533] binder: BINDER_SET_CONTEXT_MGR already set [ 80.880111] CPU: 0 PID: 13207 Comm: syz-executor5 Not tainted 4.15.0+ #217 [ 80.885534] binder: 13187:13212 ioctl 40046207 0 returned -16 [ 80.892287] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 80.892291] Call Trace: [ 80.892308] dump_stack+0x194/0x257 [ 80.892327] ? arch_local_irq_restore+0x53/0x53 [ 80.892339] ? __unlock_page_memcg+0x72/0x100 [ 80.892373] should_fail+0x8c0/0xa40 [ 80.892389] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 80.901313] binder: 13187:13193 unknown command 0 [ 80.907601] ? perf_trace_lock+0x900/0x900 [ 80.907633] ? find_held_lock+0x35/0x1d0 [ 80.944770] ? trace_event_raw_event_sched_switch+0x810/0x810 [ 80.950636] ? lock_downgrade+0x980/0x980 [ 80.954774] ? rcu_note_context_switch+0x710/0x710 [ 80.959686] ? lock_release+0xa40/0xa40 [ 80.963676] should_failslab+0xec/0x120 [ 80.967635] kmem_cache_alloc_trace+0x4b/0x740 [ 80.972232] binder_get_thread+0x1cf/0x870 [ 80.976458] ? binder_inc_ref_for_node+0xbc0/0xbc0 [ 80.981371] ? get_monotonic_coarse64+0x470/0x470 [ 80.986202] ? __might_fault+0x110/0x1d0 [ 80.990257] ? __fget_light+0x2b2/0x3c0 [ 80.994216] ? fget_raw+0x20/0x20 [ 80.997648] ? set_normalized_timespec64+0x5a/0xb0 [ 81.002578] binder_poll+0x8c/0x390 [ 81.006188] ? __might_sleep+0x95/0x190 [ 81.010145] ? binder_get_thread+0x870/0x870 [ 81.014564] do_sys_poll+0x716/0x1050 [ 81.018373] ? binder_get_thread+0x870/0x870 [ 81.022773] ? compat_core_sys_select+0x9e0/0x9e0 [ 81.027605] ? debug_check_no_locks_freed+0x3c0/0x3c0 [ 81.032795] ? perf_trace_lock+0x900/0x900 [ 81.037065] ? perf_trace_lock_acquire+0xe3/0x980 [ 81.041911] ? perf_trace_lock+0x900/0x900 [ 81.046142] ? poll_initwait+0x180/0x180 [ 81.050221] ? pvclock_read_flags+0x160/0x160 [ 81.054710] ? find_held_lock+0x35/0x1d0 [ 81.058771] ? __might_fault+0x110/0x1d0 [ 81.062815] ? lock_downgrade+0x980/0x980 [ 81.066953] ? lock_release+0xa40/0xa40 [ 81.070913] ? nsec_to_clock_t+0x30/0x30 [ 81.074980] ? __set_current_blocked+0xd4/0x110 [ 81.079642] ? sigprocmask+0xe7/0x300 [ 81.083431] ? sigsuspend+0x240/0x240 [ 81.087213] ? kasan_check_write+0x14/0x20 [ 81.091428] ? _copy_from_user+0x99/0x110 [ 81.095575] compat_SyS_ppoll+0x1e8/0x450 [ 81.099701] ? compat_SyS_ppoll+0x1e8/0x450 [ 81.104015] ? compat_SyS_pselect6+0x630/0x630 [ 81.108587] ? __sb_end_write+0xa0/0xd0 [ 81.112554] ? fput+0xd2/0x140 [ 81.115731] ? SyS_write+0x184/0x220 [ 81.119436] ? SyS_read+0x220/0x220 [ 81.123053] ? do_fast_syscall_32+0x156/0xfa1 [ 81.127539] ? compat_SyS_pselect6+0x630/0x630 [ 81.132104] do_fast_syscall_32+0x3ee/0xfa1 [ 81.136426] ? do_int80_syscall_32+0x9d0/0x9d0 [ 81.140989] ? finish_task_switch+0x1e2/0x890 [ 81.145467] ? finish_task_switch+0x1b9/0x890 [ 81.149956] ? syscall_return_slowpath+0x2ac/0x550 [ 81.154870] ? prepare_exit_to_usermode+0x350/0x350 [ 81.159874] ? sysret32_from_system_call+0x5/0x3b [ 81.164714] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 81.169554] entry_SYSENTER_compat+0x54/0x63 [ 81.173941] RIP: 0023:0xf7f9ac79 [ 81.177284] RSP: 002b:00000000f779609c EFLAGS: 00000286 ORIG_RAX: 0000000000000135 [ 81.184976] RAX: ffffffffffffffda RBX: 00000000205befd0 RCX: 0000000000000002 [ 81.192224] RDX: 0000000020db6ff8 RSI: 0000000020bf8ff8 RDI: 0000000000000008 [ 81.199471] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 81.206718] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 [ 81.213966] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 81.221415] kasan: CONFIG_KASAN_INLINE enabled [ 81.226083] kasan: GPF could be caused by NULL-ptr deref or user memory access [ 81.233499] general protection fault: 0000 [#1] SMP KASAN [ 81.239028] Dumping ftrace buffer: [ 81.242555] (ftrace buffer empty) 2018/02/10 14:10:23 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f00001ab000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000fae000)={0xfe71, 0x0, &(0x7f0000cfd000)=[], 0x35c, 0x0, &(0x7f000050c000)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000008000-0x30)={0x0, 0x0, &(0x7f0000d06000)=[], 0x0, 0x0, &(0x7f0000176000-0x1)}) [ 81.246254] Modules linked in: [ 81.249445] CPU: 0 PID: 13207 Comm: syz-executor5 Not tainted 4.15.0+ #217 [ 81.256443] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 81.265792] RIP: 0010:binder_poll+0xa0/0x390 [ 81.270178] RSP: 0018:ffff8801d4cdf608 EFLAGS: 00010246 [ 81.275521] RAX: dffffc0000000000 RBX: 0000000000000000 RCX: ffffffff841d6520 [ 81.282767] RDX: 0000000000000000 RSI: ffffc9000415b000 RDI: 0000000000000286 [ 81.290021] RBP: ffff8801d4cdf6b0 R08: 0000000000000000 R09: 0000000000000000 [ 81.297269] R10: 0000000000000000 R11: 0000000000000000 R12: 1ffff1003a99bec5 [ 81.304514] R13: ffff8801d4cdf960 R14: ffff8801c14eaac0 R15: ffff8801d4cdf688 [ 81.311761] FS: 0000000000000000(0000) GS:ffff8801db400000(0063) knlGS:00000000f7796b40 [ 81.319961] CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033 [ 81.325820] CR2: 0000000008090251 CR3: 00000001c6d97002 CR4: 00000000001606f0 [ 81.333067] Call Trace: [ 81.335641] ? __might_sleep+0x95/0x190 [ 81.339597] ? binder_get_thread+0x870/0x870 [ 81.344007] do_sys_poll+0x716/0x1050 [ 81.347807] ? binder_get_thread+0x870/0x870 [ 81.352203] ? compat_core_sys_select+0x9e0/0x9e0 [ 81.357035] ? debug_check_no_locks_freed+0x3c0/0x3c0 [ 81.362218] ? perf_trace_lock+0x900/0x900 [ 81.366468] ? perf_trace_lock_acquire+0xe3/0x980 [ 81.371307] ? perf_trace_lock+0x900/0x900 [ 81.375529] ? poll_initwait+0x180/0x180 [ 81.379600] ? pvclock_read_flags+0x160/0x160 [ 81.384081] ? find_held_lock+0x35/0x1d0 [ 81.388139] ? __might_fault+0x110/0x1d0 [ 81.392183] ? lock_downgrade+0x980/0x980 [ 81.396314] ? lock_release+0xa40/0xa40 [ 81.400270] ? nsec_to_clock_t+0x30/0x30 [ 81.404326] ? __set_current_blocked+0xd4/0x110 [ 81.408976] ? sigprocmask+0xe7/0x300 [ 81.412758] ? sigsuspend+0x240/0x240 [ 81.416541] ? kasan_check_write+0x14/0x20 [ 81.420758] ? _copy_from_user+0x99/0x110 [ 81.424898] compat_SyS_ppoll+0x1e8/0x450 [ 81.429025] ? compat_SyS_ppoll+0x1e8/0x450 [ 81.433332] ? compat_SyS_pselect6+0x630/0x630 [ 81.437895] ? __sb_end_write+0xa0/0xd0 [ 81.441856] ? fput+0xd2/0x140 [ 81.445031] ? SyS_write+0x184/0x220 [ 81.448729] ? SyS_read+0x220/0x220 [ 81.452339] ? do_fast_syscall_32+0x156/0xfa1 [ 81.456820] ? compat_SyS_pselect6+0x630/0x630 [ 81.461383] do_fast_syscall_32+0x3ee/0xfa1 [ 81.465698] ? do_int80_syscall_32+0x9d0/0x9d0 [ 81.470258] ? finish_task_switch+0x1e2/0x890 [ 81.474727] ? finish_task_switch+0x1b9/0x890 [ 81.479210] ? syscall_return_slowpath+0x2ac/0x550 [ 81.484121] ? prepare_exit_to_usermode+0x350/0x350 [ 81.489120] ? sysret32_from_system_call+0x5/0x3b [ 81.493949] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 81.498783] entry_SYSENTER_compat+0x54/0x63 [ 81.503166] RIP: 0023:0xf7f9ac79 [ 81.506508] RSP: 002b:00000000f779609c EFLAGS: 00000286 ORIG_RAX: 0000000000000135 [ 81.514194] RAX: ffffffffffffffda RBX: 00000000205befd0 RCX: 0000000000000002 [ 81.521442] RDX: 0000000020db6ff8 RSI: 0000000020bf8ff8 RDI: 0000000000000008 [ 81.528690] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 81.535934] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 [ 81.543179] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 81.550456] Code: 03 80 3c 18 00 0f 85 3c 02 00 00 49 8b be 90 01 00 00 e8 04 f7 ff ff 48 89 c2 48 89 c3 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 <80> 3c 02 00 0f 85 ca 02 00 00 48 8b 3b be 2b 11 00 00 e8 29 89 [ 81.569714] RIP: binder_poll+0xa0/0x390 RSP: ffff8801d4cdf608 [ 81.575676] ---[ end trace 081b07c8cf03d6a7 ]--- [ 81.580452] Kernel panic - not syncing: Fatal exception [ 81.580892] binder: 13187:13193 ioctl c0306201 2000a000 returned -22 [ 81.586211] Dumping ftrace buffer: [ 81.586215] (ftrace buffer empty) [ 81.586219] Kernel Offset: disabled [ 81.603468] Rebooting in 86400 seconds..