[....] Starting enhanced syslogd: rsyslogd[ 12.926739] audit: type=1400 audit(1517444230.913:4): avc: denied { syslog } for pid=3907 comm="rsyslogd" capability=34 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=capability2 permissive=1 [?25l[?1c7[ ok 8[?25h[?0c. [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. Starting mcstransd: [....] Starting file context maintaining daemon: restorecond[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added '10.128.0.38' (ECDSA) to the list of known hosts. 2018/02/01 00:17:22 fuzzer started 2018/02/01 00:17:22 dialing manager at 10.128.0.26:36295 syzkaller login: [ 25.333079] random: crng init done 2018/02/01 00:17:25 kcov=true, comps=false 2018/02/01 00:17:26 executing program 0: lgetxattr(&(0x7f00007d8000-0x8)='./file0\x00', &(0x7f0000fb3000-0x19)=@known='system.posix_acl_default\x00', &(0x7f0000bc8000-0xe3)=""/227, 0xe3) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000001000-0x8)='./file0\x00', 0x4) r0 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x40082406, &(0x7f0000000000)='/security\x00') r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/load\x00', 0x2, 0x0) r2 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/cache_stats\x00', 0x0, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$EVIOCSABS3F(r0, 0x401845ff, &(0x7f0000002000-0x18)={0x100000001, 0xff, 0x4, 0x4, 0x2, 0x0}) connect$ipx(r2, &(0x7f0000002000-0x10)={0x4, 0xef, 0x31, "ba07f25ef193", 0x4, 0x0}, 0x10) mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) setsockopt$inet6_MRT6_DEL_MFC(r2, 0x29, 0xcd, &(0x7f0000003000-0x5c)={{0xa, 0x0, 0x8, @mcast2={0xff, 0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x1}, 0xfffffffffffffffb}, {0xa, 0x1, 0x1000, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x0}, 0x81, [0x1, 0xeb, 0x91e, 0x4, 0x8, 0xbd3, 0x5e1c, 0x9af]}, 0x5c) mmap(&(0x7f0000003000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$DRM_IOCTL_WAIT_VBLANK(r0, 0xc018643a, &(0x7f0000004000-0xc)={0x24000000, 0xffffffffffffffe1, 0x35}) mmap(&(0x7f0000004000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r3 = openat$selinux_validatetrans(0xffffffffffffff9c, &(0x7f0000004000)='/selinux/validatetrans\x00', 0x1, 0x0) mmap(&(0x7f0000005000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000005000)={0xaa, 0x40, 0x0}) setsockopt$inet_sctp6_SCTP_HMAC_IDENT(r2, 0x84, 0x16, &(0x7f0000005000)={0x2, [0x3, 0x7]}, 0x8) ioctl$DRM_IOCTL_ADD_CTX(r1, 0xc0086420, &(0x7f0000004000-0x6)={0x0, 0x0}) ioctl$DRM_IOCTL_UNLOCK(r0, 0x4008642b, &(0x7f0000002000-0x8)={r4, 0xaa0608cb7c702a73}) mmap(&(0x7f0000006000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) connect$llc(r0, &(0x7f0000006000)={0x1a, 0x1f, 0x4ac, 0x9, 0x5e, 0x0, @random="e661b570c22e", [0x0, 0x0]}, 0x10) ioctl$sock_ipx_SIOCIPXCFGDATA(r0, 0x89e2, &(0x7f0000002000-0x4)={0x0, 0x0}) mmap(&(0x7f0000007000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) getsockopt$packet_int(r3, 0x107, 0x1f, &(0x7f0000000000)=0x0, &(0x7f0000007000)=0x4) setsockopt$inet6_tcp_TCP_MD5SIG(r0, 0x6, 0xe, &(0x7f0000006000-0xa6)={{{{0x2, 0x2, @dev={0xac, 0x14, 0x0, 0x14}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, {{0xa, 0x0, 0x69a28db1, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x1}, 0x7f}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}}, 0x1, 0x6, 0x6, "a0ab74aa8136b41b59f17350cadb20eb77100b26a63729991d27d81203ca70006b53d7f2a4377543c1edcf58f3db7fff5d1ed9761e4d5a87b2d85eee97cab0095b9e729a77b888b838ff5fa79c68e101"}, 0x160) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000002000/0x2000)=nil, 0x2000}, 0x0, 0x0}) setsockopt$l2tp_PPPOL2TP_SO_SENDSEQ(r2, 0x111, 0x3, 0x0, 0x4) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_TIMER(r2, 0xc0605345, &(0x7f0000003000)={0xfffffffffffffffc, 0x1, {0x1, 0x3, 0x4f, 0x1, 0x200}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) 2018/02/01 00:17:26 executing program 7: r0 = dup(0xffffffffffffffff) getsockopt$inet_sctp_SCTP_MAX_BURST(0xffffffffffffffff, 0x84, 0x14, &(0x7f00003db000)=@assoc_value={0x0, 0x0}, &(0x7f00008fb000-0x4)=0x8) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) getsockopt$inet_sctp_SCTP_DEFAULT_SEND_PARAM(r0, 0x84, 0xa, &(0x7f0000ab0000)={0x2, 0x6f5f1240, 0x205, 0x1, 0x2, 0x6, 0x1f, 0xffff, r1}, &(0x7f0000000000)=0x20) ioctl$LOOP_CLR_FD(r0, 0x4c01) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) bind$inet6(r0, &(0x7f0000002000-0x1c)={0xa, 0x0, 0x3ff, @local={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0xaa}, 0xffffffff7fffffff}, 0x1c) r3 = openat$selinux_user(0xffffffffffffff9c, &(0x7f0000001000)='/selinux/user\x00', 0x2, 0x0) time(&(0x7f0000000000)=0x0) sendto$inet6(r0, &(0x7f0000000000)="a649b2e6443bf73800b5c76f6cef93708aadc1395ca0e86e05a20f163b733f561145d223f5a8f0c616b0fa9027b9a5a0e1d723dd7bf7bec563dd1417f6dfd39175bca8fca6e8ac4d69e4d6ec36ab0bf607fe1b96e8ba", 0x56, 0x1, &(0x7f0000001000-0x1c)={0xa, 0x1, 0x401, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x9}, 0x1c) setsockopt$SO_VM_SOCKETS_BUFFER_SIZE(r0, 0x28, 0x0, &(0x7f0000000000)=0x2, 0x8) setsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r0, 0x84, 0xa, &(0x7f0000001000+0xfb5)={0x2, 0x8, 0x4, 0x2, 0xffffffffffffffff, 0x257, 0x8000, 0x2, r2}, 0x20) mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r4 = syz_open_dev$sg(&(0x7f0000002000)='/dev/sg#\x00', 0x700, 0x80) mmap(&(0x7f0000003000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000003000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) getsockopt$inet_sctp_SCTP_MAXSEG(r0, 0x84, 0xd, &(0x7f0000003000)=@assoc_value={r2, 0x7cb2}, &(0x7f0000004000-0x4)=0x8) personality(0x4000000) setsockopt$inet_sctp6_SCTP_HMAC_IDENT(r3, 0x84, 0x16, &(0x7f0000002000)={0x8, [0xb0a2, 0x3, 0x3f, 0x3, 0x6, 0xfffffffffffffff9, 0x101, 0x9]}, 0x14) write$sndseq(r4, &(0x7f0000001000-0x60)=[{0x1, 0x9, 0x10, 0x5ef5036a, @time={0x0, 0x0}, {0xfffffffffffffffe, 0x80}, {0x5, 0xfe}, @time=@time={0x77359400, 0x0}}, {0x1, 0x3, 0x8, 0x5, @time={0x77359400, 0x0}, {0x9, 0x6}, {0x80000000, 0x4}, @control={0xfffffffffffffffc, 0x100, 0x4}}], 0x60) mmap(&(0x7f0000004000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$SNDRV_SEQ_IOCTL_SYSTEM_INFO(r4, 0xc0305302, &(0x7f0000004000)={0xffff, 0x4, 0x2, 0x2, 0x4, 0x1000, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) r5 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000001000-0x1d)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) mmap(&(0x7f0000005000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) pivot_root(&(0x7f0000001000-0x8)='./file0\x00', &(0x7f0000006000-0x8)='./file0\x00') mmap(&(0x7f0000006000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000006000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000006000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) pselect6(0x40, &(0x7f0000002000-0x40)={0x7f, 0x40, 0xb0, 0x6a07, 0xa3bd, 0x4, 0x10000000, 0xffff}, &(0x7f0000006000)={0x5, 0x100000001, 0x2, 0x415a, 0x800, 0x6, 0x80000000, 0x0}, &(0x7f0000006000)={0x7fff, 0x10001, 0x7, 0xee8, 0x6, 0x3, 0x7ff, 0x2}, &(0x7f0000005000-0x10)={0x77359400, 0x0}, &(0x7f0000006000)={&(0x7f0000001000)={0x2}, 0x8}) getsockopt$SO_TIMESTAMPING(r5, 0x1, 0x25, &(0x7f0000003000)=0x0, &(0x7f0000004000)=0x4) 2018/02/01 00:17:26 executing program 3: r0 = socket$inet6_icmp(0xa, 0x2, 0x3a) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r1 = accept4$packet(0xffffffffffffff9c, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @random=""/6, [0x0, 0x0]}, &(0x7f0000001000-0x4)=0x14, 0x800) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={@syzn={0x73, 0x79, 0x7a, 0x0, 0x0}, r2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) r3 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x400000, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) getsockopt$inet_dccp_buf(r3, 0x21, 0x0, &(0x7f0000001000)=""/0, &(0x7f0000000000)=0x0) fcntl$F_SET_RW_HINT(r0, 0x40c, &(0x7f0000000000)=0x5) r4 = gettid() mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$TIOCGPGRP(r3, 0x540f, &(0x7f0000002000)=0x0) rt_tgsigqueueinfo(r4, r5, 0x3c, &(0x7f0000000000)={0x1f, 0x3, 0x7, 0x7}) mmap(&(0x7f0000003000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) listxattr(&(0x7f0000004000-0x8)='./file0\x00', &(0x7f0000001000-0x1000)=""/4096, 0x1000) ioctl$LOOP_SET_FD(r3, 0x4c00, r3) mmap(&(0x7f0000004000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) getsockopt$sock_int(r3, 0x1, 0x29, &(0x7f0000005000-0x4)=0x0, &(0x7f0000004000-0x4)=0x4) connect$pppoe(r0, &(0x7f0000002000-0x1e)={0x18, 0x0, {0x4, @empty=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0], @common='sit0\x00'}}, 0x1e) sync() mmap(&(0x7f0000005000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) inotify_add_watch(r1, &(0x7f0000005000)='./file0\x00', 0x20000000) socketpair$inet_udp(0x2, 0x2, 0x0, &(0x7f0000002000-0x8)={0x0, 0x0}) truncate(&(0x7f0000006000-0x8)='./file0\x00', 0x1000) mmap(&(0x7f0000006000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) pread64(r0, &(0x7f0000006000)=""/160, 0xa0, 0x53) mmap(&(0x7f0000007000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000007000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000007000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mount(&(0x7f0000004000)='./file0\x00', &(0x7f0000008000-0xe)='./file0/file0\x00', &(0x7f0000008000-0x5)='affs\x00', 0x0, &(0x7f0000008000-0x11)="31aaa7bc006bae3a1c46bd20fc8fde107d") 2018/02/01 00:17:26 executing program 4: r0 = fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffff9c) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$SNDRV_SEQ_IOCTL_DELETE_QUEUE(r0, 0x408c5333, &(0x7f0000001000-0x8c)={0x2, 0x800, 0x0, 'queue1\x00', 0x10001, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) r1 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000001000-0x10)='/selinux/policy\x00', 0x0, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) fcntl$F_GET_FILE_RW_HINT(r0, 0x40d, &(0x7f0000001000)=0x0) mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000003000-0xe)='net/connector\x00') mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$TIOCMBIS(r2, 0x5416, &(0x7f0000002000)=0x4) mmap(&(0x7f0000003000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$TUNATTACHFILTER(r2, 0x401054d5, &(0x7f0000003000)={0x2, &(0x7f0000002000-0x10)=[{0x0, 0x1, 0x8, 0x9}, {0x7, 0xffffffff, 0x6, 0x4}]}) r3 = fcntl$getown(r1, 0x9) ioctl$TIOCLINUX7(r1, 0x541c, &(0x7f0000004000-0x2)={0x7, 0x1}) fcntl$F_SET_RW_HINT(r0, 0x40c, &(0x7f0000003000)=0x1) ioctl$TIOCLINUX6(r2, 0x541c, &(0x7f0000001000-0x2)={0x6, 0xffffffff00000000}) mmap(&(0x7f0000004000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$LOOP_GET_STATUS(r1, 0x4c03, &(0x7f0000005000-0x98)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/64, ""/32, [0x0, 0x0], 0x0}) mmap(&(0x7f0000005000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000005000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000006000-0xc)={0x0, 0x0, 0x0}, &(0x7f0000003000)=0xc) mmap(&(0x7f0000005000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) stat(&(0x7f0000002000)='./file0\x00', &(0x7f0000006000-0x44)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r6 = getuid() mmap(&(0x7f0000005000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000005000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) stat(&(0x7f0000006000-0x8)='./file0\x00', &(0x7f0000006000-0x44)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) mmap(&(0x7f0000005000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000005000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r8 = geteuid() mmap(&(0x7f0000005000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) fstat(r2, &(0x7f0000002000-0x44)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) mmap(&(0x7f0000005000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000003000-0xc)={0x0, 0x0, 0x0}, &(0x7f0000006000-0x4)=0xc) mmap(&(0x7f0000005000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) sendmsg$netlink(r1, &(0x7f0000003000-0x38)={&(0x7f0000003000)=@proc={0x10, 0x0, 0x1, 0x4001010}, 0xc, &(0x7f0000004000)=[{&(0x7f0000005000)={0x218, 0x20, 0x500, 0x2, 0x2, "", [@nested={0xf0, 0x56, [@generic="2c102032d71b9a7299c59753ef81a5318c57655a0db5dc1f759571d17b1e136105b5cc7aafcddba80609d25faa6c9cf5fefbe476ece134d8b0920e11b74c13dcb0439d4a9e171abdbd8cee5fb04060c4c83b8b4e8022aeb0939280172d58b2f710e007063bade2d56e2bf48d1aa84f816e3d15c57ee7119d74c31aa8af38b5b68da4c58ec2279b34487684bb25816535ed9ae51052b5a1a1c826ce382972da671323c4452cb17f0733fcb082ac28947d23588b289a2832b9e30a5bf871ed187a46490cca9210fa3a8a168a3b0f23224cecda5a05f86d96507b57351ecd1094687254e813fab4e27f0441"]}, @typed={0x10, 0x85, @u64=0x8001}, @generic="78fa0140c1531eddb90263bafc138b0bd94c72909873c5ce20f083c1695f99dc4bc617e6ca3f1a15894a89bdfe2901aa3cade5", @generic="0b76f1998a51f8138ca79b95138e28efeeb1a09a327949c16620dfe92ed9eb8009c98f871d477e5c06e1d7576fef15d51164d360a58f339291f1a695df91dbdc335949d21df9ff963629a65586cbfea397852102a696da9d7d99f52f8cc5520533aac6b542dd99a5a8b9995adc47266461096a682423eba7af3594017737a2f7c8e0ac044220a012851509ad9e15393c536a9cd8bb9109e8ea2db537799e35279311d3187e319a1ee7833463443ef28d10883f75941b925198d03d7d2e428df3ea855789b8353b3c56", @typed={0xc, 0x2a, @u32=0x4}]}, 0x218}, {&(0x7f0000006000-0x5c)={0x5c, 0x1f, 0x4, 0x6, 0x2, "", [@typed={0xc, 0x3, @ipv4=@local={0xac, 0x14, 0x0, 0xaa}}, @typed={0xc, 0x3c, @uid=r4}, @typed={0xc, 0x18, @pid=r3}, @nested={0x1c, 0x3a, [@typed={0xc, 0x6a, @uid=r5}, @typed={0xc, 0x40, @uid=r6}]}, @typed={0xc, 0x6a, @uid=r7}]}, 0x5c}, {&(0x7f0000005000)={0x54, 0x24, 0x4, 0x1, 0x3, "", [@typed={0xc, 0x3f, @pid=r3}, @nested={0x38, 0x30, [@typed={0x10, 0x30, @u64=0x6}, @typed={0x18, 0x51, @ipv6=@remote={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0xbb}}, @typed={0xc, 0x8e, @fd=r2}]}]}, 0x54}, {&(0x7f0000006000-0x210)={0x210, 0x13, 0x20, 0x5, 0x1, "", [@typed={0xc, 0x8c, @uid=r8}, @nested={0x180, 0x3d, [@typed={0x10, 0x8, @u64=0x100000001}, @generic="6db257a2d70bb6f9e92c6002e52138509ed9437cb0ae5aee29e5775b13378ff406aebc21d8c2d4409f8f15f800a197e0204bb58a302776d04492e495f53dba669bf5739287665c0c805dbd70df0a81c91a6d6a394e1f99c4b09a998ccbcac22d246c8bef7a203f20e73fc7e19681c4b6fb", @generic="067440105244e209a2089a479368a6da8cb0032be7a01a6bb8ab29a8a47c813fac8d8b787f1a2ee9805f320566254e5ca2066b5fd8c9d07620c7c3102f1d4a66496fce5b417f8f4b7bdc48a23a53e6aec5f5ac68b67dfbc21bfb741b8f1ac5f68366f8c26ab33f355e85b3d716d94d5822c93dfd85fcefdd8c96dd89ff1803dd92eeb4d270e7fb8d1f906434f42aaad2ee4df686ec4bff43073870202cfebb408d05c1ee7288628796f6f451cfd073626433e2be3268d8046b9c76058821410db9a800526ee21c09e386f821985586f2e1d235a759d4072db5cc823a055ac123500f6270f13cf8d2de9d9860d30c", @typed={0xc, 0x5, @fd=r0}]}, @nested={0x74, 0x50, [@generic="eb80647ced2ded82345b5c90175abfafbe6aac63349265e15ed9be9d2f2127046147337f62dc16ca3f940025cc95799820298abd00de28f7069250fcd7c45c79453db18c394c4cf422146aaddc9303821620f429e55f4f0152ef175bc9bf5b3348f64a2a6c78520d6032a212b7"]}]}, 0x210}], 0x4, &(0x7f0000006000-0x20)=[@cred={0x20, 0x1, 0x2, r3, r9, r10}], 0x20, 0x50}, 0x4000005) 2018/02/01 00:17:26 executing program 5: mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000000)=0x0) ptrace$peek(0x1, r0, &(0x7f0000e69000-0x8)=0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCDELRT(r1, 0x890c, &(0x7f0000001000-0x78)={0xffffffffffffd5b8, {0x2, 0x3, @multicast2=0xe0000002, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, {0x2, 0x1, @loopback=0x7f000001, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, {0x2, 0x3, @local={0xac, 0x14, 0x0, 0xaa}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x1, 0x3, 0x8000, 0x200000000, 0x7, &(0x7f0000001000-0x10)=@generic="5baaff41eb3b933beb67ec835dd39dd7", 0x2, 0x2, 0x9}) r2 = memfd_create(&(0x7f0000001000-0x10)='wlan1bdev[wlan0\x00', 0x2) r3 = openat$keychord(0xffffffffffffff9c, &(0x7f0000000000)='/dev/keychord\x00', 0x410200, 0x0) ioctl(r2, 0x4, &(0x7f0000001000-0x84)="effeb0437c0727b60e3ff3bc25e472b777e7bbd870941f4b9fa938433b7c572cd7c7af1d36e6a925e15750ba19200bef03c75b638c2d5ad774a7cf1db91c7a44709c6a86666077f66433573d052688c6f4ed0f410926a50d6b7b719fea27ba066be3da1922417988e96d4da17103464c288ebc8c03fe268c5ca596db7a1f442a8807d363") exit(0x5) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) getsockopt$inet_sctp_SCTP_DEFAULT_SNDINFO(r3, 0x84, 0x22, &(0x7f0000001000)={0x9, 0x8005, 0x200, 0xffffffff, 0x0}, &(0x7f0000002000-0x4)=0x10) getsockopt$inet_sctp_SCTP_PR_ASSOC_STATUS(r3, 0x84, 0x73, &(0x7f0000001000-0x12)={r4, 0x2, 0x10, 0x4, 0x227a}, &(0x7f0000001000-0x4)=0x18) ioctl$sock_inet_sctp_SIOCINQ(r3, 0x541b, &(0x7f0000001000-0x4)=0x0) mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$TCSETAW(r2, 0x5407, &(0x7f0000003000-0x14)={0x9, 0x4, 0x0, 0x2, 0x4, 0x8, 0x8, 0x0, 0x7, 0x8001}) getsockopt$inet_sctp_SCTP_EVENTS(r3, 0x84, 0xb, &(0x7f0000003000-0xb)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f0000001000)=0xb) mmap(&(0x7f0000003000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) lstat(&(0x7f0000002000)='./file0\x00', &(0x7f0000003000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) lstat(&(0x7f0000002000)='./file0\x00', &(0x7f0000003000-0x44)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) setsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000000)={r0, r5, r6}, 0xc) tee(r2, r3, 0x1000, 0x2) mmap(&(0x7f0000004000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$sock_inet6_tcp_SIOCINQ(r2, 0x541b, &(0x7f0000004000)=0x0) ioctl$DRM_IOCTL_RM_MAP(r2, 0x4028641b, &(0x7f0000003000)={&(0x7f0000000000/0x3000)=nil, 0x5c, 0x5, 0x2, &(0x7f0000002000/0x1000)=nil, 0x1}) close(r1) mmap(&(0x7f0000005000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$sock_inet_SIOCGIFBRDADDR(r3, 0x8919, &(0x7f0000006000-0x20)={@common='ifb0\x00', @ifru_flags=0x1}) mmap(&(0x7f0000006000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r1, 0xc04064a0, &(0x7f0000005000)={&(0x7f0000007000-0x4)=[0x0], &(0x7f0000003000)=[0x0], &(0x7f0000006000-0x4)=[0x0], &(0x7f0000001000-0xc)=[0x0, 0x0, 0x0], 0x1, 0x1, 0x1, 0x3, 0x0, 0x0, 0x0, 0x0}) 2018/02/01 00:17:26 executing program 6: r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000d50000-0x9)='/dev/ppp\x00', 0x4000, 0x0) r1 = syz_open_dev$sndtimer(&(0x7f0000fd2000-0xf)='/dev/snd/timer\x00', 0x0, 0x0) ioctl$sock_inet_SIOCSIFNETMASK(r1, 0x891c, &(0x7f0000ca7000-0x20)={@common='ipddp0\x00', @ifru_flags=0x2}) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r0, 0x84, 0x6e, &(0x7f0000001000-0x88)=[@in6={0xa, 0x3, 0xd3, @dev={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0x16}, 0x8}, @in={0x2, 0x3, @local={0xac, 0x14, 0x0, 0xaa}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, @in={0x2, 0x1, @multicast2=0xe0000002, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, @in={0x2, 0x3, @multicast1=0xe0000001, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, @in={0x2, 0x1, @multicast1=0xe0000001, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, @in6={0xa, 0x1, 0x3, @remote={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0xbb}, 0x5}, @in={0x2, 0x2, @multicast1=0xe0000001, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}], 0x88) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) getsockopt$inet_sctp_SCTP_MAX_BURST(r0, 0x84, 0x14, &(0x7f0000001000)=@assoc_value={0x0, 0x0}, &(0x7f0000002000-0x4)=0x8) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r0, 0x84, 0x6, &(0x7f0000002000-0x8c)={r2, @in6={{0xa, 0x2, 0x0, @loopback={0x0, 0x1}, 0x5}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}}, &(0x7f0000001000)=0x8c) mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(r0, 0x84, 0x6, &(0x7f0000002000)={r2, @in6={{0xa, 0x1, 0xffffffff, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], [0xff, 0xff], @local={0xac, 0x14, 0x0, 0xaa}}, 0x1}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}}, &(0x7f0000001000-0x4)=0x8c) mmap(&(0x7f0000003000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(r0, 0x84, 0x6d, &(0x7f0000003000-0x59)={r3, 0x51, "7af84bbfacc9946f2eb88296fda637271fc8ad4c744ea50a70274c8e487b1cbc5c8c3da5b4ced6a46e0e6ee68d178db2f9570584e263deb41446b6f4a2100c6c3d6141d611dc63355c103bcfb5b7b93053"}, &(0x7f0000003000)=0x59) mmap(&(0x7f0000004000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) setsockopt$inet_sctp6_SCTP_RTOINFO(r0, 0x84, 0x0, &(0x7f0000005000-0x10)={r2, 0x7fff, 0x10000, 0x40}, 0x10) mmap(&(0x7f0000005000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$TUNGETIFF(r0, 0x800454d2, &(0x7f0000006000-0x4)=0x2) getsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r0, 0x84, 0x22, &(0x7f0000004000-0x10)={0x7f, 0x200, 0x8000, 0x9, r2}, &(0x7f0000005000)=0x10) mmap(&(0x7f0000006000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) syz_open_dev$tun(&(0x7f0000006000)='/dev/net/tun\x00', 0x0, 0x220000) mmap(&(0x7f0000007000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000007000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000007000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000007000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r5 = add_key(&(0x7f0000007000)='ceph\x00', &(0x7f0000004000)={0x73, 0x79, 0x7a, 0x1, 0x0}, &(0x7f0000007000)="80261d2790a683b7753b5e4893a5367f1f56672bf28df278c816d166aed92233759e4de4ea017c738a69be6a86d0e85b0719663578af23de1c7f2bb83d27930fc3b27d2bbd32e77ffb59e767bf6cb90d296272be22cfee906d562999021c2eab8fe5a23654643bc4a537c5f70227a02f4810fd39c7aff2841222fbc9e2c5e7c6fd5c8d0f67d5e7011c3d4a20b73de11c70398a235b33984d", 0x98, 0xfffffffffffffffb) add_key(&(0x7f0000008000-0x12)='.request_key_auth\x00', &(0x7f0000008000-0x5)={0x73, 0x79, 0x7a, 0x2, 0x0}, &(0x7f0000004000)="61a4b73429cc4c164622d8ba2ff722673881915a692be3d10bd2d35b5887d0e632d07d", 0x23, r5) mmap(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) getsockopt$inet_sctp_SCTP_SOCKOPT_PEELOFF(r0, 0x84, 0x66, &(0x7f0000008000)={r4, 0x3}, &(0x7f0000009000-0x4)=0x8) 2018/02/01 00:17:26 executing program 1: mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) socketpair(0xa, 0x3, 0x3, &(0x7f0000000000)={0x0, 0x0}) setsockopt$inet_mtu(r1, 0x0, 0xa, &(0x7f00009e8000-0x4)=0x0, 0x4) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r2 = accept$inet6(r1, &(0x7f0000001000)={0x0, 0xffffffffffffffff, 0x0, @remote={0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0xffffffffffffffff, 0x0}, 0x0}, &(0x7f0000001000-0x4)=0x1c) setsockopt$inet_sctp_SCTP_RECVNXTINFO(r0, 0x84, 0x21, &(0x7f0000001000-0x4)=0x2, 0x4) mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$sock_inet_udp_SIOCINQ(r0, 0x541b, &(0x7f0000003000-0x4)=0x0) mmap(&(0x7f0000003000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mknod(&(0x7f0000003000+0x531)='./file0\x00', 0x8080, 0x1ff) mmap(&(0x7f0000004000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) renameat2(r1, &(0x7f0000001000-0x8)='./file0\x00', r0, &(0x7f0000004000)='./file0\x00', 0x1) setsockopt$inet_sctp_SCTP_I_WANT_MAPPED_V4_ADDR(r0, 0x84, 0xc, &(0x7f0000001000-0x4)=0x1, 0x4) mmap(&(0x7f0000005000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) getsockopt$inet_sctp_SCTP_ENABLE_STREAM_RESET(r1, 0x84, 0x76, &(0x7f0000005000)={0x0, 0xff}, &(0x7f0000005000-0x4)=0x8) setsockopt$inet_sctp6_SCTP_RTOINFO(r2, 0x84, 0x0, &(0x7f0000002000-0x10)={r3, 0x0, 0x7f, 0xedf}, 0x10) setsockopt$inet_sctp6_SCTP_RESET_STREAMS(r1, 0x84, 0x77, &(0x7f0000000000)={r3, 0xe3, 0x1, [0x101]}, 0xa) mmap(&(0x7f0000006000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) setsockopt$nfc_llcp_NFC_LLCP_RW(r2, 0x118, 0x0, &(0x7f0000007000-0x4)=0x1, 0x4) mmap(&(0x7f0000007000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) setsockopt$inet_sctp_SCTP_DEFAULT_SNDINFO(r1, 0x84, 0x22, &(0x7f0000007000)={0x200, 0x8, 0x953, 0x1, r3}, 0x10) mmap(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$KDSKBSENT(r0, 0x4b49, &(0x7f0000009000-0xd8)="8c862dd3a16af452d0f6ca52cec143e9d65e92c9b7b8bdf1d8e419a6710de8b791a0e625cffe77ec00b22c631d540644692e714b44d92a1d3d0276dad3836943f8440f5e463d9c86ec2c86551a682cb03086752ef5e1f599c76e3ca9b4fc3bd3bf6be81ce8789c5348b2295fa47cc8a3a829000768697f9e387bb968064af4987758be7ab7947a074d72cdd5ded2454933d6e82f93c699ab1ee94820390cb89196e31344dd11f4d45c39c54fa07f495f75f6bd07d67bff40e3058fc4b9924c9c00a83c999e5c5fa4c0a9c32a9e1a78b2dec7d6cc9e95698d") getsockopt$inet_sctp_SCTP_SOCKOPT_PEELOFF(r0, 0x84, 0x66, &(0x7f0000009000-0x8)={r3, 0x44670635}, &(0x7f0000003000-0x4)=0x8) r4 = getpgrp(0xffffffffffffffff) getpgid(r4) mmap(&(0x7f0000009000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) setsockopt$inet_sctp_SCTP_I_WANT_MAPPED_V4_ADDR(r1, 0x84, 0xc, &(0x7f000000a000-0x4)=0x6, 0x4) socket$inet_tcp(0x2, 0x1, 0x0) mmap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$sock_SIOCADDDLCI(r1, 0x8980, &(0x7f000000a000)={@common='lo\x00', 0x5}) 2018/02/01 00:17:26 executing program 2: r0 = dup3(0xffffffffffffff9c, 0xffffffffffffffff, 0x80000) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) connect$netlink(r0, &(0x7f0000000000)=@unspec={0x0, 0x0, 0x0, 0x0}, 0xc) fcntl$getownex(r0, 0x10, &(0x7f0000000000)={0x0, 0x0}) r1 = socket(0x10, 0x7, 0x0) getsockname$netrom(r0, &(0x7f0000001000-0x10)=@ax25={0x0, {""/7}, 0x0}, &(0x7f0000000000)=0x10) ioctl$FIONREAD(r0, 0x541b, &(0x7f0000000000)=0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) accept$llc(r1, &(0x7f0000001000-0x10)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={[0x0, 0x0, 0x0, 0x0], 0xffffffffffffffff, 0x0}, [0x0, 0x0]}, &(0x7f0000002000-0x4)=0x10) ioctl$SNDRV_SEQ_IOCTL_UNSUBSCRIBE_PORT(r0, 0x40505331, &(0x7f0000001000)={{0x1, 0x3}, {0xfc6, 0x8}, 0x4, 0x5, 0xc3d8, [0x0, 0x0, 0x0], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl(r1, 0x6, &(0x7f0000002000)="") r2 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000003000-0x18)='/selinux/avc/hash_stats\x00', 0x0, 0x0) mmap(&(0x7f0000003000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) splice(r1, &(0x7f0000000000)=0x0, r2, &(0x7f0000003000)=0x0, 0xfffffffffffffffe, 0x7) ioctl$sock_inet6_tcp_SIOCINQ(r1, 0x541b, &(0x7f0000004000-0x4)=0x0) mmap(&(0x7f0000004000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) setsockopt$inet_mtu(r2, 0x0, 0xa, &(0x7f0000004000)=0x6, 0x4) ioctl$sock_inet_SIOCRTMSG(r0, 0x890d, &(0x7f0000005000-0x78)={0x6, {0x2, 0x3, @broadcast=0xffffffff, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, {0x2, 0x2, @remote={0xac, 0x14, 0x0, 0xbb}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, {0x2, 0x0, @empty=0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x80, 0x9, 0x3f, 0x6, 0x0, 0x0, 0x8001, 0x1, 0x100000000}) getsockopt$inet_sctp_SCTP_ASSOCINFO(r0, 0x84, 0x1, &(0x7f0000000000)={0x0, 0x9, 0x40, 0x3, 0x6, 0x101}, &(0x7f0000003000)=0x14) mmap(&(0x7f0000005000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r1, 0x84, 0x7b, &(0x7f0000006000-0x8)={r3, 0x0}, 0x8) mmap(&(0x7f0000006000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) syz_open_dev$loop(&(0x7f0000007000-0xb)='/dev/loop#\x00', 0x3, 0x1) mmap(&(0x7f0000007000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) accept4$inet6(r2, &(0x7f0000008000-0x1c)={0x0, 0xffffffffffffffff, 0x0, @mcast1={0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0}, 0x0}, &(0x7f0000004000)=0x1c, 0x80800) mmap(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f0000008000)={{{@in6=@mcast1={0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0}, @in6=@empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, {0x0, 0x0, 0x0, 0x0}, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, {{@in6=@remote={0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0xffffffffffffffff, 0x0}, 0xffffffffffffffff, 0x0}, 0x0, @in=@local={0x0, 0x0, 0xffffffffffffffff, 0x0}, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, &(0x7f0000008000)=0xe8) mmap(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) stat(&(0x7f0000001000)='./file0\x00', &(0x7f0000009000-0x44)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_fuseblk_mount(&(0x7f0000005000-0x8)='./file0\x00', &(0x7f0000009000-0x8)='./file0\x00', 0x0, r4, r5, 0xfffffffffffffff9, 0x5, 0x100000) [ 28.823547] audit: type=1400 audit(1517444246.803:5): avc: denied { sys_admin } for pid=4120 comm="syz-executor7" capability=21 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 [ 28.851101] IPVS: Creating netns size=2536 id=1 [ 28.861568] audit: type=1400 audit(1517444246.843:6): avc: denied { net_admin } for pid=4123 comm="syz-executor0" capability=12 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 [ 28.888147] IPVS: Creating netns size=2536 id=2 [ 28.923905] IPVS: Creating netns size=2536 id=3 [ 28.950215] IPVS: Creating netns size=2536 id=4 [ 28.989547] IPVS: Creating netns size=2536 id=5 [ 29.029037] IPVS: Creating netns size=2536 id=6 [ 29.094647] IPVS: Creating netns size=2536 id=7 [ 29.141936] IPVS: Creating netns size=2536 id=8 [ 30.927908] audit: type=1400 audit(1517444248.913:7): avc: denied { sys_chroot } for pid=4123 comm="syz-executor0" capability=18 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 2018/02/01 00:17:29 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sg(&(0x7f00006bf000-0x8)='/dev/sg#\x00', 0x3, 0x10002) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000034e000-0x30)={0x4c, 0x0, &(0x7f000042d000)=[@register_looper={0x630b}, @transaction={0x40406300, {0x2, 0x0, 0x2, 0x0, 0x1, 0x0, 0x0, 0x20, 0x18, &(0x7f0000c55000-0x20)=[@fda={0x66646185, 0x0, 0x3, 0x1b}], &(0x7f0000101000)=[0x78, 0x60, 0x38]}}, @register_looper={0x630b}], 0x36, 0x0, &(0x7f0000184000)="8c4760989663c6864a4c59dcddfa62974867f7c570a9139a3f1c8d54e851a4465a1aa51156f883b8469d7d01fdb36e4f8629999c345a"}) ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(0xffffffffffffffff, 0xc08c5114, &(0x7f0000ef3000-0x50)={{0x0, 0x0}, {0x0, 0x0}, 0x0, 0x0, 0x0, [0x0, 0x0, 0x0], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) ioctl$DRM_IOCTL_RES_CTX(r0, 0xc0106426, &(0x7f00002b0000)={0x1, &(0x7f0000ffb000)=[{0x0, 0x0}]}) ioctl$DRM_IOCTL_GET_SAREA_CTX(r0, 0xc010641d, &(0x7f0000b40000)={r1, &(0x7f0000c29000-0x1000)=""/4096}) 2018/02/01 00:17:29 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sg(&(0x7f0000002000)='/dev/sg#\x00', 0x4, 0x0) read(r0, &(0x7f0000eae000-0x58)=""/88, 0xfffffdfd) [ 31.015262] audit: type=1400 audit(1517444248.993:8): avc: denied { dac_override } for pid=5130 comm="syz-executor0" capability=1 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 2018/02/01 00:17:29 executing program 0: mmap(&(0x7f0000000000/0xaa7000)=nil, 0xaa7000, 0x4, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f000090e000+0x6ae)='net/packet\x00') mmap(&(0x7f0000aa7000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) write(r0, &(0x7f0000aa8000-0x1)="9a", 0x1) mmap(&(0x7f0000aa8000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000aa9000-0x50)={@common='irlan0\x00', @ifru_mtu=0xe00}) mmap(&(0x7f0000aa7000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000aa8000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000aa8000)={0x1, 0x0, 0x2, 0x3ff}) ioctl$DRM_IOCTL_SG_FREE(r0, 0x40106439, &(0x7f00006b8000-0x10)={0x4, r1}) mmap(&(0x7f0000aa7000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) getsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f0000aa8000-0xa0)={0x0, @in={{0x2, 0x0, @broadcast=0xffffffff, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x7, 0x7f, 0x58d19e06, 0x9, 0x2}, &(0x7f0000aa7000)=0xa0) mmap(&(0x7f0000aa7000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000aa9000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0x7, &(0x7f0000aa9000)={0x5, 0x101, 0x10001, 0x81}, 0x10) mmap(&(0x7f0000aa7000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000aa9000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) socketpair$inet6_icmp(0xa, 0x2, 0x3a, &(0x7f0000aaa000-0x8)={0x0, 0x0}) getsockopt$inet_sctp_SCTP_AUTH_ACTIVE_KEY(r0, 0x84, 0x18, &(0x7f0000aa7000)={r2, 0xffffffffffffff65}, &(0x7f0000aa7000)=0x6) mmap(&(0x7f0000aaa000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) rmdir(&(0x7f0000aab000-0x8)='./file0\x00') setsockopt$inet6_group_source_req(r0, 0x29, 0x2f, &(0x7f000079d000-0x108)={0x4, {{0xa, 0x0, 0x8, @remote={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0xbb}, 0x6}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, {{0xa, 0x3, 0x7, @remote={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0xbb}, 0x10000}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}}, 0x108) 2018/02/01 00:17:29 executing program 3: mmap(&(0x7f0000000000/0xe7b000)=nil, 0xe7b000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = request_key(&(0x7f0000e7a000)='ceph\x00', &(0x7f000052d000)={0x73, 0x79, 0x7a, 0x3, 0x0}, &(0x7f0000e7a000)='bdev/\x00', 0xffffffffffffffff) r1 = request_key(&(0x7f0000aa3000-0xa)='blacklist\x00', &(0x7f0000e7b000-0x5)={0x73, 0x79, 0x7a, 0x0, 0x0}, &(0x7f0000822000-0x1)='\x00', 0xfffffffffffffffd) keyctl$instantiate(0xc, r0, &(0x7f0000b7e000-0xe9)="c4ba5b9264d1832edcf5879e691845e49b233dae59613165808ecb85cb9a1939a3a0d19cf570aa9764860f1d6051d8d72aba70d578fb690e05ae1b152ed62b6f22efdf718ac9699998f4a9f168d7640d3df86f89f1195dd3e06606c2b21543f8e4b7c277faf2579025fd8024a0dcefdaa6e70f1aefa31d68f33f7027ad775aca699e181032ba5400a0acffb10dafa3509415437a41cc376cef978b0c01ea8160e38a95b7a16abc41e19537a2039a248096176878c744814cafd2966d72adb6047d4a830a14ebec2f9552d7c6e19768ffc19d8c407c862095ba0b5136ca5a0234af2c2a29679c3a8ba9", 0xe9, r1) r2 = memfd_create(&(0x7f0000663000)='GPL*bdevself{GPL-user\'/trustedtrusted%\x00', 0x2) setsockopt$inet_udp_int(r2, 0x11, 0x1, &(0x7f0000000000)=0x0, 0x4) r3 = ioctl$LOOP_CTL_GET_FREE(r2, 0x4c82) ioctl$LOOP_CTL_REMOVE(r2, 0x4c81, r3) r4 = socket$inet6_udp(0xa, 0x2, 0x0) r5 = socket$l2tp(0x18, 0x1, 0x1) accept$ipx(r5, 0x0, &(0x7f00001ef000-0x4)=0x0) connect$l2tp(r5, &(0x7f0000e71000)=@pppol2tpin6={0x18, 0x1, {0x0, r4, 0x3, 0x0, 0x3, 0x0, {0xa, 0x2, 0x3, @remote={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0xbb}, 0x4}}}, 0x32) r6 = socket$l2tp(0x18, 0x1, 0x1) close(r4) dup2(r6, r5) 2018/02/01 00:17:29 executing program 7: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = fanotify_init(0x20, 0x0) r1 = fcntl$getown(r0, 0x9) r2 = syz_open_procfs(r1, &(0x7f00007a2000-0xb)='clear_refs\x00') socketpair$inet6_icmp_raw(0xa, 0x3, 0x3a, &(0x7f000098a000)={0x0, 0x0}) select(0x40, &(0x7f0000ff8000)={0x6, 0x5, 0x10001, 0x1, 0x2, 0x0, 0x8, 0x1ff}, &(0x7f00008af000-0x40)={0xa66, 0x8, 0xdf4, 0x5, 0x1, 0xfffffffffffffffa, 0x3, 0x58f}, &(0x7f0000559000)={0x10000, 0x3, 0x2, 0x1, 0xffffffffffff0001, 0x7ff, 0x1, 0x3}, &(0x7f000073d000)={0x0, 0x0}) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r2, 0x84, 0x1d, &(0x7f0000d4b000-0x18)={0x5, [0x0, 0x0, 0x0, 0x0, 0x0]}, &(0x7f0000b61000-0x4)=0x18) exit(0x0) writev(r2, &(0x7f0000b97000)=[{&(0x7f0000962000)='5', 0x1}], 0x1) getrusage(0x0, &(0x7f0000c40000)={{0x0, 0x0}, {0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 2018/02/01 00:17:29 executing program 6: socket$inet6_sctp(0xa, 0x0, 0x84) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000012000)='/dev/sequencer2\x00', 0xfffffffffffffffd, 0x0) r1 = request_key(&(0x7f0000878000)='blacklist\x00', &(0x7f0000d0b000)={0x73, 0x79, 0x7a, 0x3, 0x0}, &(0x7f0000fe7000)='/dev/sequencer2\x00', 0xfffffffffffffffa) keyctl$revoke(0x3, r1) ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(r0, 0xc0046d00, &(0x7f00006e7000-0x50)={{0x4000000000000000, 0x0}, {0x7, 0x80000001}, 0x0, 0x1, 0x8000000000000, [0x0, 0x0, 0x0], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) 2018/02/01 00:17:29 executing program 1: mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) fcntl$getownex(0xffffffffffffff9c, 0x10, &(0x7f0000000000)={0x0, 0x0}) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffff9c, 0x29, 0x22, &(0x7f0000001000-0xe8)={{{@in=@loopback=0x0, @in=@multicast2=0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, {0x0, 0x0, 0x0, 0x0}, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, {{@in=@empty=0x0, 0xffffffffffffffff, 0x0}, 0x0, @in=@broadcast=0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, &(0x7f0000001000)=0xe8) quotactl(0x3, &(0x7f0000002000-0x8)='./file0\x00', r1, &(0x7f0000001000-0xa1)="11c2ea02058c94ad8a28dfbb0fa6755d7a8225b6d09a6ab5b56f4863214d08abd70cd34dfef0dbc419b87fdc6fd513365c97913428ea63172cb6f201ca5598ce817610db15e5a8c3b70c1945e9c88b3c22f08cd8a81948e5daa679643537db4655a30ef0552a460da349c7c583f2193410f3dc877a4ab59e8caba25f9b5e3cf9349446e36b347c689ee18256efdc844036986879cc43134bc5895494c005606929") tkill(r0, 0x35) r2 = dup(0xffffffffffffffff) mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) getsockname$ax25(r2, &(0x7f0000003000-0x10)={0x0, {""/7}, 0x0}, &(0x7f0000003000-0x4)=0x10) clone(0x0, &(0x7f00001fc000-0xbf)="", &(0x7f0000cad000-0x4)=0x0, &(0x7f0000be4000-0x4)=0x0, &(0x7f0000ecb000-0x8e)="") r3 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/policy\x00', 0x0, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) setsockopt$inet_sctp6_SCTP_INITMSG(r3, 0x84, 0x2, &(0x7f0000001000)={0x3, 0x0, 0x10000, 0x1}, 0x8) setuid(r1) 2018/02/01 00:17:29 executing program 4: mmap(&(0x7f0000000000/0x8000)=nil, 0x8000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket(0x18, 0x0, 0x1) sendmmsg(r0, &(0x7f0000005000-0x3c)=[{{&(0x7f0000003000)=@l2={0x1f, 0x1f, {0x401, 0xe7, 0xdd4e, 0x8, 0x9, 0xfffffffffffffe01}, 0x8001, 0xfffffffffffff6d3}, 0xffffffffffffffbf, &(0x7f0000005000-0x60)=[{&(0x7f0000002000)="4c5614c00401a0dbf8a669ebdedd102c4f7a79e606457dfdf09e2ec2ed253b", 0x1f}], 0x1000000000000027, &(0x7f0000003000-0x2d0)=[], 0x0, 0x0}, 0x0}], 0x1, 0x0) mmap(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) setsockopt$inet_mreq(r0, 0x0, 0x23, &(0x7f0000003000)={@multicast2=0xe0000002, @empty=0x0}, 0x8) r1 = open(&(0x7f0000008000)='./file0\x00', 0x8000, 0x40) mmap(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) eventfd(0x6) ioctl$DRM_IOCTL_AUTH_MAGIC(r1, 0x40046411, &(0x7f0000008000)=0x3) ioctl$fiemap(0xffffffffffffffff, 0xc020660b, &(0x7f0000002000)={0x0, 0x0, 0x0, 0x0, 0x1, [{0xf03f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}]}) r2 = socket(0x18, 0x0, 0x1) connect(r2, &(0x7f0000002000)=@sco={0x1f, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0}}, 0x26) dup2(r0, r2) 2018/02/01 00:17:29 executing program 5: mmap(&(0x7f0000000000/0xffc000)=nil, 0xffc000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$inet6_opts(r0, 0x29, 0x36, &(0x7f0000de3000-0x1000)=""/4096, &(0x7f0000ffb000-0x4)=0x1000) r1 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f00005b1000-0x19)='/selinux/avc/cache_stats\x00', 0x0, 0x0) mmap(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) ioctl$TUNGETVNETHDRSZ(r1, 0x800454d7, &(0x7f0000139000)=0x0) r2 = getpgid(0x0) sched_getparam(r2, &(0x7f00005e1000)=0x0) getpeername$ipx(r1, &(0x7f0000ffd000-0x10)={0x0, 0x0, 0x0, ""/6, 0x0, 0x0}, &(0x7f0000e4c000)=0x10) r3 = socket(0x1, 0x803, 0xfffffffffffffff7) mmap(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) recvfrom$ipx(r3, &(0x7f0000bb1000)=""/12, 0xc, 0x21, &(0x7f0000ffd000-0x10)={0x4, 0x6, 0x8, "01d04f957bfc", 0xa147a25, 0x0}, 0x10) 2018/02/01 00:17:29 executing program 2: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000122000)='/dev/ppp\x00', 0x0, 0x0) close(r0) getsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(0xffffffffffffffff, 0x84, 0x1f, &(0x7f0000d04000-0x98)={0x0, @in6={{0xa, 0xffffffffffffffff, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x0}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x0, 0x0}, &(0x7f000093a000)=0x98) r1 = syz_open_procfs(0x0, &(0x7f000077b000)='clear_refs\x00') r2 = syz_open_procfs(0x0, &(0x7f0000367000-0xa)='oom_score\x00') sendfile(r1, r2, &(0x7f0000514000)=0x0, 0x18001) [ 31.390598] ================================================================== [ 31.398003] BUG: KASAN: use-after-free in inet_shutdown+0x2d4/0x350 [ 31.404398] Read of size 4 at addr ffff8801cce52200 by task syz-executor3/5233 [ 31.411736] [ 31.413358] CPU: 1 PID: 5233 Comm: syz-executor3 Not tainted 4.9.79-g71f1469 #25 [ 31.420880] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 31.430226] ffff8801d8fd7bc0 ffffffff81d94829 ffffea0007339400 ffff8801cce52200 [ 31.438222] 0000000000000000 ffff8801cce52200 ffff8801d8c02058 ffff8801d8fd7bf8 [ 31.446187] ffffffff8153e083 ffff8801cce52200 0000000000000004 0000000000000000 [ 31.454152] Call Trace: [ 31.456717] [] dump_stack+0xc1/0x128 [ 31.462056] [] print_address_description+0x73/0x280 [ 31.468690] [] kasan_report+0x275/0x360 [ 31.474288] [] ? inet_shutdown+0x2d4/0x350 [ 31.480146] [] ? pppol2tp_recvmsg+0x2b0/0x2b0 [ 31.486261] [] __asan_report_load4_noabort+0x14/0x20 [ 31.492992] [] inet_shutdown+0x2d4/0x350 [ 31.498677] [] ? pppol2tp_recvmsg+0x2b0/0x2b0 [ 31.504792] [] pppol2tp_session_close+0xa0/0xe0 [ 31.511085] [] l2tp_tunnel_closeall+0x21f/0x3a0 [ 31.517380] [] ? udp_v6_flush_pending_frames+0xe0/0xe0 [ 31.524292] [] ? sock_release+0x1e0/0x1e0 [ 31.530064] [] l2tp_udp_encap_destroy+0x87/0xe0 [ 31.536356] [] ? l2tp_tunnel_destruct+0x5a0/0x5a0 [ 31.542825] [] udpv6_destroy_sock+0xb1/0xd0 [ 31.548769] [] sk_common_release+0x6b/0x2f0 [ 31.554708] [] udp_lib_close+0x15/0x20 [ 31.560222] [] inet_release+0xfa/0x1d0 [ 31.565731] [] inet6_release+0x50/0x70 [ 31.571243] [] sock_release+0x8d/0x1e0 [ 31.576751] [] sock_close+0x16/0x20 [ 31.581999] [] __fput+0x28c/0x6e0 [ 31.587073] [] ____fput+0x15/0x20 [ 31.592157] [] task_work_run+0x115/0x190 [ 31.598102] [] exit_to_usermode_loop+0xfc/0x120 [ 31.604398] [] syscall_return_slowpath+0x1a0/0x1e0 [ 31.610954] [] entry_SYSCALL_64_fastpath+0xe6/0xe8 [ 31.617508] [ 31.619105] Allocated by task 5233: [ 31.622706] save_stack_trace+0x16/0x20 [ 31.626654] save_stack+0x43/0xd0 [ 31.630075] kasan_kmalloc+0xad/0xe0 [ 31.633756] kasan_slab_alloc+0x12/0x20 [ 31.637698] kmem_cache_alloc+0xba/0x290 [ 31.641729] sock_alloc_inode+0x1d/0x250 [ 31.645759] alloc_inode+0x65/0x180 [ 31.649361] new_inode_pseudo+0x17/0xe0 [ 31.653305] sock_alloc+0x41/0x270 [ 31.656813] __sock_create+0xa5/0x640 [ 31.660582] SyS_socket+0xf0/0x1b0 [ 31.664098] entry_SYSCALL_64_fastpath+0x29/0xe8 [ 31.668821] [ 31.670419] Freed by task 5247: [ 31.673675] save_stack_trace+0x16/0x20 [ 31.677619] save_stack+0x43/0xd0 [ 31.681046] kasan_slab_free+0x72/0xc0 [ 31.684907] kmem_cache_free+0xc7/0x300 [ 31.688851] sock_destroy_inode+0x56/0x70 [ 31.692967] destroy_inode+0xc3/0x120 [ 31.696740] evict+0x329/0x4f0 [ 31.699905] iput+0x47b/0x900 [ 31.702981] dentry_unlink_inode+0x470/0x570 [ 31.707360] __dentry_kill+0x25b/0x480 [ 31.711219] dput.part.23+0x680/0x7b0 [ 31.714988] dput+0x1f/0x30 [ 31.717890] __fput+0x46a/0x6e0 [ 31.721139] ____fput+0x15/0x20 [ 31.724393] task_work_run+0x115/0x190 [ 31.728252] exit_to_usermode_loop+0xfc/0x120 [ 31.732721] syscall_return_slowpath+0x1a0/0x1e0 [ 31.737461] entry_SYSCALL_64_fastpath+0xe6/0xe8 [ 31.742183] [ 31.743782] The buggy address belongs to the object at ffff8801cce52200 [ 31.743782] which belongs to the cache sock_inode_cache of size 944 [ 31.756862] The buggy address is located 0 bytes inside of [ 31.756862] 944-byte region [ffff8801cce52200, ffff8801cce525b0) [ 31.768541] The buggy address belongs to the page: [ 31.773446] page:ffffea0007339400 count:1 mapcount:0 mapping: (null) index:0x0 compound_mapcount: 0 [ 31.783636] flags: 0x8000000000004080(slab|head) [ 31.788367] page dumped because: kasan: bad access detected [ 31.794054] [ 31.795649] Memory state around the buggy address: [ 31.800568] ffff8801cce52100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fc fc [ 31.807906] ffff8801cce52180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 31.815250] >ffff8801cce52200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 31.822593] ^ [ 31.825937] ffff8801cce52280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 31.833359] ffff8801cce52300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 31.840702] ================================================================== [ 31.848030] Disabling lock debugging due to kernel taint [ 31.855255] Kernel panic - not syncing: panic_on_warn set ... [ 31.855255] [ 31.862635] CPU: 0 PID: 5233 Comm: syz-executor3 Tainted: G B 4.9.79-g71f1469 #25 [ 31.871354] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 31.880682] ffff8801d8fd7b18 ffffffff81d94829 ffffffff8419709f ffff8801d8fd7bf0 [ 31.888648] 0000000000000000 ffff8801cce52200 ffff8801d8c02058 ffff8801d8fd7be0 [ 31.896625] ffffffff8142f531 0000000041b58ab3 ffffffff8418ab10 ffffffff8142f375 [ 31.904588] Call Trace: [ 31.907151] [] dump_stack+0xc1/0x128 [ 31.912487] [] panic+0x1bc/0x3a8 [ 31.917473] [] ? percpu_up_read_preempt_enable.constprop.53+0xd7/0xd7 [ 31.925685] [] ? preempt_schedule+0x25/0x30 [ 31.931635] [] ? ___preempt_schedule+0x16/0x18 [ 31.937838] [] kasan_end_report+0x50/0x50 [ 31.943612] [] kasan_report+0x167/0x360 [ 31.949212] [] ? inet_shutdown+0x2d4/0x350 [ 31.955101] [] ? pppol2tp_recvmsg+0x2b0/0x2b0 [ 31.961224] [] __asan_report_load4_noabort+0x14/0x20 [ 31.967949] [] inet_shutdown+0x2d4/0x350 [ 31.973630] [] ? pppol2tp_recvmsg+0x2b0/0x2b0 [ 31.979849] [] pppol2tp_session_close+0xa0/0xe0 [ 31.986149] [] l2tp_tunnel_closeall+0x21f/0x3a0 [ 31.992445] [] ? udp_v6_flush_pending_frames+0xe0/0xe0 [ 31.999348] [] ? sock_release+0x1e0/0x1e0 [ 32.005125] [] l2tp_udp_encap_destroy+0x87/0xe0 [ 32.011415] [] ? l2tp_tunnel_destruct+0x5a0/0x5a0 [ 32.017881] [] udpv6_destroy_sock+0xb1/0xd0 [ 32.023831] [] sk_common_release+0x6b/0x2f0 [ 32.029770] [] udp_lib_close+0x15/0x20 [ 32.035277] [] inet_release+0xfa/0x1d0 [ 32.040790] [] inet6_release+0x50/0x70 [ 32.046298] [] sock_release+0x8d/0x1e0 [ 32.051814] [] sock_close+0x16/0x20 [ 32.057061] [] __fput+0x28c/0x6e0 [ 32.062138] [] ____fput+0x15/0x20 [ 32.067213] [] task_work_run+0x115/0x190 [ 32.072897] [] exit_to_usermode_loop+0xfc/0x120 [ 32.079184] [] syscall_return_slowpath+0x1a0/0x1e0 [ 32.085736] [] entry_SYSCALL_64_fastpath+0xe6/0xe8 [ 32.092737] Dumping ftrace buffer: [ 32.096251] (ftrace buffer empty) [ 32.099931] Kernel Offset: disabled [ 32.103528] Rebooting in 86400 seconds..