EVENTS(r0, 0x4040534e, &(0x7f0000000200)={0x2, @tick, 0x2, {0x3, 0x5}, 0xed, 0x1, 0x5e}) r1 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000140)='/dev/mixer\x00', 0x100, 0x0) ioctl$DRM_IOCTL_ADD_CTX(0xffffffffffffffff, 0xc0086420, &(0x7f0000000180)={0x0}) ioctl$DRM_IOCTL_GET_CTX(r1, 0xc0086423, &(0x7f00000001c0)={r2}) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f000019ffe9)={0xc1}) ioctl$SNDRV_SEQ_IOCTL_UNSUBSCRIBE_PORT(r0, 0x40505331, &(0x7f0000000000)) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r0, 0xc08c5332, &(0x7f0000000080)={0x0, 0x0, 0x0, 'queue0\x00'}) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000fdbff0)='/dev/sequencer2\x00', 0x0, 0x0) setxattr(&(0x7f0000000280)='./file0\x00', &(0x7f00000002c0)=@known='system.posix_acl_access\x00', &(0x7f0000000300)='/dev/snd/seq\x00', 0xd, 0x3) 2018/05/12 22:57:04 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x1c, 0x0, &(0x7f0000000040)=[@request_death={0x400c630e, 0x0, 0xfffffdfd}, @free_buffer={0x40086303}], 0x0, 0x0, &(0x7f0000000080)}) 2018/05/12 22:57:04 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140)}, 0x0) 2018/05/12 22:57:04 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x300000000000000, [0x0, 0x0, 0x252]}) [ 703.697190] binder: 18190:18195 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 703.724283] binder: 18190:18195 BC_FREE_BUFFER u0000000000000000 no match 2018/05/12 22:57:04 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140)}, 0x0) 2018/05/12 22:57:04 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) 2018/05/12 22:57:04 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='dctcp\x00', 0x6) sendto$inet6(r0, &(0x7f00004e8000), 0xf401, 0x20000001, &(0x7f000007f000)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf4010000]}}, 0x1c) 2018/05/12 22:57:04 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x3, 0x9, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) [ 703.750308] binder: 18190:18202 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 703.782279] binder: 18190:18202 BC_FREE_BUFFER u0000000000000000 no match 2018/05/12 22:57:04 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x2c00000000000000, [0x0, 0x0, 0x252]}) 2018/05/12 22:57:04 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x1c, 0x0, &(0x7f0000000040)=[@request_death={0x400c630e, 0x0, 0x200000000000000}, @free_buffer={0x40086303}], 0x0, 0x0, &(0x7f0000000080)}) 2018/05/12 22:57:04 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140)}, 0x0) [ 703.947771] binder: 18227:18229 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 703.989229] binder: 18227:18229 BC_FREE_BUFFER u0000000000000000 no match [ 704.033169] binder: 18227:18239 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 704.041681] binder: 18227:18239 BC_FREE_BUFFER u0000000000000000 no match 2018/05/12 22:57:05 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf000000], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) 2018/05/12 22:57:05 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x20000000000000, 0x9, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:57:05 executing program 5: r0 = socket(0xa, 0x1, 0x0) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x10) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040)='/dev/hwrng\x00', 0x1, 0x0) bpf$BPF_PROG_ATTACH(0x8, &(0x7f00000000c0)={r1, r2, 0xb, 0x1}, 0x10) ioctl(r0, 0x8910, &(0x7f00000001c0)="a526262c8523bf012cf66f") mmap(&(0x7f0000000000/0xd99000)=nil, 0xd99000, 0x0, 0x32, 0xffffffffffffffff, 0x0) ioctl$sock_inet_SIOCSARP(0xffffffffffffffff, 0x40046104, &(0x7f00008da000)={{0x2, 0x0, @multicast2=0xe0000002, [0xfe]}, {}, 0x0, {0x2, 0x0, @dev={0xac, 0x14, 0x14}}, 'ip6tnl0\x00'}) ioctl$sock_inet_SIOCADDRT(r1, 0x890b, &(0x7f0000000100)={0x3f, {0x2, 0x4e24, @loopback=0x7f000001}, {0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0xe}}, {0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0xc}}, 0x8, 0x9, 0x519, 0x9, 0x1, &(0x7f0000000080)='vlan0\x00', 0x6, 0xffff, 0xb889}) 2018/05/12 22:57:05 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='dctcp\x00', 0x6) sendto$inet6(r0, &(0x7f00004e8000), 0xf401, 0x20000001, &(0x7f000007f000)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5000000]}}, 0x1c) 2018/05/12 22:57:05 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140)}, 0x0) 2018/05/12 22:57:05 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x84ffffff, [0x0, 0x0, 0x252]}) 2018/05/12 22:57:05 executing program 3: r0 = syz_open_dev$sndseq(&(0x7f0000783000)='/dev/snd/seq\x00', 0x0, 0x0) read(r0, &(0x7f0000fb6000)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, 'port1\x00', 0xa9824f69d1376637, 0x10800a}) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f000019ffe9)={0xc1}) ioctl$SNDRV_SEQ_IOCTL_UNSUBSCRIBE_PORT(r0, 0x40505331, &(0x7f0000000000)) r1 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000300)='/dev/vsock\x00', 0x2, 0x0) ioctl$KVM_SET_BOOT_CPU_ID(r1, 0xae78, &(0x7f0000000340)=0x1) r2 = syz_open_dev$vcsn(&(0x7f0000000140)='/dev/vcs#\x00', 0x7, 0x0) r3 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000180)='/dev/vsock\x00', 0x400, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000002740)={{{@in6=@mcast2, @in6=@ipv4={[], [], @local}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@dev}, 0x0, @in6=@mcast1}}, &(0x7f0000002840)=0xe8) bpf$PROG_LOAD(0x5, &(0x7f0000002880)={0x9, 0x8, &(0x7f00000001c0)=@raw=[@generic={0x6, 0x9, 0x624e44c3, 0xffffffffffff8001}, @map={0x18, 0x8, 0x1, 0x0, r2}, @map={0x18, 0x9, 0x1, 0x0, r3}, @alu={0x7, 0x2, 0x7, 0x2, 0x7, 0xfffffff0, 0xfffffffffffffffc}], &(0x7f0000000200)='syzkaller\x00', 0x9, 0x46, &(0x7f0000000240)=""/70, 0x0, 0x1, [], r4}, 0x48) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r0, 0xc08c5332, &(0x7f0000000080)={0x0, 0x0, 0x0, 'queue0\x00'}) ioctl$BLKSECTGET(r2, 0x1267, &(0x7f00000002c0)) ioctl$TUNGETFEATURES(r3, 0x800454cf, &(0x7f0000000380)) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000fdbff0)='/dev/sequencer2\x00', 0x0, 0x0) 2018/05/12 22:57:05 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x1c, 0x0, &(0x7f0000000040)=[@request_death={0x400c630e, 0x0, 0x4c000000}, @free_buffer={0x40086303}], 0x0, 0x0, &(0x7f0000000080)}) 2018/05/12 22:57:05 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x400000000000000, 0x9, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:57:05 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140)}, 0x0) 2018/05/12 22:57:05 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x1100, [0x0, 0x0, 0x252]}) 2018/05/12 22:57:05 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) [ 704.799015] binder: 18267:18269 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 704.832544] binder: 18267:18269 BC_FREE_BUFFER u0000000000000000 no match 2018/05/12 22:57:05 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='dctcp\x00', 0x6) sendto$inet6(r0, &(0x7f00004e8000), 0xf401, 0x20000001, &(0x7f000007f000)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18020000]}}, 0x1c) 2018/05/12 22:57:05 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000000c80)='/dev/snd/seq\x00', 0x0, 0x5) ioctl$SNDRV_SEQ_IOCTL_SUBSCRIBE_PORT(r0, 0x40505330, &(0x7f0000ec6fb0)={{0x9}}) [ 704.898787] binder: 18267:18284 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 704.952457] binder: 18267:18284 BC_FREE_BUFFER u0000000000000000 no match [ 705.632974] Unknown ioctl 44664 [ 705.683963] Unknown ioctl -2147199793 [ 705.700604] Unknown ioctl 44664 [ 705.716763] Unknown ioctl -2147199793 2018/05/12 22:57:06 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x2f, [0x0, 0x0, 0x252]}) 2018/05/12 22:57:06 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000000000], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) 2018/05/12 22:57:06 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140)}, 0x0) 2018/05/12 22:57:06 executing program 5: socketpair(0x8000000000001e, 0x5, 0x0, &(0x7f000000dff8)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair(0x8000000000001e, 0x5, 0x0, &(0x7f000000dff8)={0xffffffffffffffff, 0xffffffffffffffff}) close(r3) setsockopt$packet_tx_ring(r2, 0x10f, 0x87, &(0x7f0000265000)=@req={0x3fc}, 0x10) ioctl$DRM_IOCTL_AGP_INFO(r3, 0x80386433, &(0x7f0000000140)=""/4096) bind$unix(r2, &(0x7f0000d77000)=@abs, 0x0) getsockopt$bt_hci(r1, 0x0, 0x3, &(0x7f0000000000)=""/200, &(0x7f0000000100)=0xc8) setsockopt$packet_tx_ring(r0, 0x10f, 0x87, &(0x7f0000265000)=@req={0x3fc}, 0x10) 2018/05/12 22:57:06 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x200000000000000, 0x9, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:57:06 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x1c, 0x0, &(0x7f0000000040)=[@request_death={0x400c630e, 0x0, 0x700}, @free_buffer={0x40086303}], 0x0, 0x0, &(0x7f0000000080)}) 2018/05/12 22:57:06 executing program 3: r0 = syz_open_dev$sndseq(&(0x7f0000783000)='/dev/snd/seq\x00', 0x0, 0x0) read(r0, &(0x7f0000fb6000)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, 'port1\x00', 0xa9824f69d1376637, 0x10800a}) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f000019ffe9)={0xc1}) ioctl$SNDRV_SEQ_IOCTL_UNSUBSCRIBE_PORT(r0, 0x40505331, &(0x7f0000000000)) r1 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000140)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) ioctl$KVM_SMI(r1, 0xaeb7) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r0, 0xc08c5332, &(0x7f0000000080)={0x0, 0x0, 0x0, 'queue1\x00'}) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000fdbff0)='/dev/sequencer2\x00', 0x0, 0x0) 2018/05/12 22:57:06 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='dctcp\x00', 0x6) sendto$inet6(r0, &(0x7f00004e8000), 0xf401, 0x20000001, &(0x7f000007f000)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3e8]}}, 0x1c) 2018/05/12 22:57:06 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0xffffffff00000000, [0x0, 0x0, 0x252]}) 2018/05/12 22:57:06 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140)}, 0x0) [ 705.871865] binder: 18319:18320 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 705.888383] binder: 18319:18320 BC_FREE_BUFFER u0000000000000000 no match [ 705.897645] binder: 18319:18327 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 2018/05/12 22:57:06 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0ffffff], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) 2018/05/12 22:57:06 executing program 5: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="c6295e4eca6c09b612ec6f") r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) getsockopt$inet_sctp6_SCTP_I_WANT_MAPPED_V4_ADDR(r0, 0x84, 0xc, &(0x7f0000000000), &(0x7f0000000080)=0x4) write$rdma_cm(r1, &(0x7f00000021c0)=@create_id={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000002180)={0xffffffff}, 0x111}}, 0x3e8) write$rdma_cm(r1, &(0x7f0000000040)=@listen={0x7, 0x8, 0xfa00, {r2}}, 0x10) close(r1) 2018/05/12 22:57:06 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0xe000000000000, 0x9, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) [ 705.930210] binder: 18319:18327 BC_FREE_BUFFER u0000000000000000 no match 2018/05/12 22:57:06 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x2b, [0x0, 0x0, 0x252]}) 2018/05/12 22:57:06 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x1c, 0x0, &(0x7f0000000040)=[@request_death={0x400c630e, 0x0, 0x1095}, @free_buffer={0x40086303}], 0x0, 0x0, &(0x7f0000000080)}) 2018/05/12 22:57:06 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140)}, 0x0) 2018/05/12 22:57:06 executing program 5: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x1, &(0x7f0000000040)="c626262c8523bf012cf66f") r1 = socket$inet6(0xa, 0x2000000802, 0x3) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r1, 0x29, 0x20, &(0x7f0000f68000)={@loopback={0x0, 0x1}, 0x0, 0x0, 0xff, 0x1}, 0x2b) 2018/05/12 22:57:06 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf0], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) [ 706.097006] binder: 18351:18354 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 706.115970] binder: 18351:18354 BC_FREE_BUFFER u0000000000000000 no match [ 706.167668] binder: 18351:18366 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 706.179692] binder: 18351:18366 BC_FREE_BUFFER u0000000000000000 no match 2018/05/12 22:57:07 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0xfefe0000000000, 0x9, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:57:07 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x100000000000000, [0x0, 0x0, 0x252]}) 2018/05/12 22:57:07 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140)}, 0x0) 2018/05/12 22:57:07 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x34000], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) 2018/05/12 22:57:07 executing program 3: r0 = syz_open_dev$sndseq(&(0x7f0000783000)='/dev/snd/seq\x00', 0x0, 0x0) read(r0, &(0x7f0000fb6000)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, 'port1\x00', 0xa9824f69d1376637, 0x10800a}) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f000019ffe9)={0xc1}) ioctl$SNDRV_SEQ_IOCTL_UNSUBSCRIBE_PORT(r0, 0x40505331, &(0x7f0000000000)) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r0, 0xc08c5332, &(0x7f0000000080)={0x0, 0x0, 0x0, 'queue0\x00'}) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000fdbff0)='/dev/sequencer2\x00', 0x0, 0x0) ioctl$sock_FIOGETOWN(r1, 0x8903, &(0x7f0000000140)=0x0) ptrace$setopts(0x7c01545d96792682, r2, 0x7f, 0x0) 2018/05/12 22:57:07 executing program 5: r0 = syz_open_dev$dmmidi(&(0x7f0000000100)='/dev/dmmidi#\x00', 0xff, 0x600) getsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(0xffffffffffffff9c, 0x84, 0x9, &(0x7f0000000140)={0x0, @in={{0x2, 0x4e21, @loopback=0x7f000001}}, 0x6, 0x1f, 0x800, 0x6f1, 0x1}, &(0x7f0000000200)=0x98) getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r0, 0x84, 0xf, &(0x7f0000000240)={r1, @in={{0x2, 0x4e22, @local={0xac, 0x14, 0x14, 0xaa}}}, 0x80000001, 0x1, 0x7ff, 0x1, 0x3}, &(0x7f0000000300)=0x98) perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00007a0000)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x0, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = syz_open_dev$midi(&(0x7f0000002640)='/dev/midi#\x00', 0x2, 0x200000) accept4$packet(0xffffffffffffff9c, &(0x7f0000002680)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, &(0x7f00000026c0)=0x14, 0x80800) splice(r3, &(0x7f0000000340), r2, &(0x7f0000000380), 0x5, 0x6) ioctl$SG_GET_ACCESS_COUNT(r6, 0x2289, &(0x7f0000000080)) ioctl$sock_inet6_SIOCDIFADDR(r6, 0x8936, &(0x7f0000002700)={@mcast2={0xff, 0x2, [], 0x1}, 0x2d, r7}) sendmsg$unix(r5, &(0x7f0000bba000)={&(0x7f0000c57ff8)=@abs, 0x8, &(0x7f00006c6ff0), 0x0, &(0x7f00009dffb8)=[@rights={0x18, 0x1, 0x1, [r3]}], 0x18}, 0x0) fcntl$getownex(r3, 0x10, &(0x7f0000000040)) recvmsg(r4, &(0x7f00003d6fc8)={&(0x7f0000698000)=@generic, 0x80, &(0x7f000081afd0), 0x106, &(0x7f0000f9fff8)=""/90, 0x5a}, 0x0) 2018/05/12 22:57:07 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='dctcp\x00', 0x6) sendto$inet6(r0, &(0x7f00004e8000), 0xf401, 0x20000001, &(0x7f000007f000)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40020000]}}, 0x1c) 2018/05/12 22:57:07 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x1c, 0x0, &(0x7f0000000040)=[@request_death={0x400c630e, 0x0, 0x400000000000000}, @free_buffer={0x40086303}], 0x0, 0x0, &(0x7f0000000080)}) 2018/05/12 22:57:07 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x800000000000000, [0x0, 0x0, 0x252]}) 2018/05/12 22:57:07 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x7f000000, 0x9, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:57:07 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='dctcp\x00', 0x6) sendto$inet6(r0, &(0x7f00004e8000), 0xf401, 0x20000001, &(0x7f000007f000)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8]}}, 0x1c) 2018/05/12 22:57:07 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140)}, 0x0) [ 706.947057] binder: 18394:18396 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 706.970300] binder: 18394:18396 BC_FREE_BUFFER u0000000000000000 no match 2018/05/12 22:57:07 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) [ 707.058898] binder: 18394:18412 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 2018/05/12 22:57:07 executing program 5: r0 = memfd_create(&(0x7f0000000180)="776c616e30707070302c6c6f776c616e302e70726f6373656c696e75782d707070316b657972696e677365637572dbe49f88568193adb69569747976626f786e657430407070703074727573746564656d31402f0087b3fb5966b72670e56c621e3d766c3b1725a77f51cad780383aedf07c0045c304bb247b6d66a6ca2af29f91faeba295d0c9a4057a42e70b0600a08b2e9ca6bf3f4a2bc60d09573e82559f790137ab3f0911141211b7061c7fc901738a9b6d14da74f6e7440e8f860e37cbafc56136bc610f95663d533db74d77badae4eb8d5fd5e71c7d3953d0647d779cc586ef91fae7059a20877373c1db1a6e35943cf1d5f384f733350b54d2c0e7501a2afb5bde0c6fd9da7451c3c2c796942b457bbbc3317c5a1bf7b2ee63e01456497cce746f911ee0eea9af601d6540885aebd303167f5a853c41b4dc750bcc967b629106a0d9f86a4fb5bd9b9eca45155012b8beb0c5d66218f22ede60acf568dbdc391ba9570f763406f01f67c7794ac09d0151b1be1aa1573a329f7b13acaf2fbba7668dfc06082990d213cf8415a58faf384f75aa8549643b19527c5930ac30dcd623b2020add", 0x0) r1 = syz_open_dev$sndseq(&(0x7f0000042000)='/dev/snd/seq\x00', 0x0, 0x8000000000102) dup2(r1, r0) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r0, 0xc08c5332, &(0x7f00000000c0)={0x0, 0x0, 0x0, "71756575651966e0ca00000000000000000000000000000b00e3001b000000000000000400080000000001000000000000000000000000000000f3feffb20300"}) write$sndseq(r1, &(0x7f00000000c0), 0x24b) r2 = syz_open_dev$sndseq(&(0x7f0000ce9ff3)='/dev/snd/seq\x00', 0x0, 0x0) r3 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer2\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_CLIENT(r2, 0x404c534a, &(0x7f0000642fb4)={0x0, 0x0, 0x10001, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdfd]}) r4 = socket(0xa, 0x1, 0x0) ioctl(r4, 0x8912, &(0x7f0000000000)="0104262c8523bf012cf66f") getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r4, 0x84, 0x7c, &(0x7f0000000080)={0x0, 0x6, 0x6}, &(0x7f0000000340)=0x8) setsockopt$inet_sctp_SCTP_AUTH_DELETE_KEY(r0, 0x84, 0x19, &(0x7f0000000380)={r5, 0xb54}, 0x8) dup2(r3, r2) 2018/05/12 22:57:07 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x1c000000, [0x0, 0x0, 0x252]}) 2018/05/12 22:57:07 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140)}, 0x0) [ 707.115778] binder: 18394:18412 BC_FREE_BUFFER u0000000000000000 no match 2018/05/12 22:57:07 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0xfffffffe, 0x9, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:57:07 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x1c, 0x0, &(0x7f0000000040)=[@request_death={0x400c630e, 0x0, 0x93100000}, @free_buffer={0x40086303}], 0x0, 0x0, &(0x7f0000000080)}) 2018/05/12 22:57:07 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0xffffffffffffffff, [0x0, 0x0, 0x252]}) 2018/05/12 22:57:07 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) 2018/05/12 22:57:07 executing program 5: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000080)='/dev/vcs\x00', 0x4000, 0x0) bind$nfc_llcp(r1, &(0x7f00000000c0)={0x27, 0x1, 0x0, 0x7, 0x200, 0x1f, "1d2cd02f67a36d1e7bdeffa70cd59f92f3d38248f9290edcd6caf64d87cdefff0c8a39b16d4bb574471abb628226476350b408fa72f996658f4a498d269c75", 0x9}, 0x60) ioctl$UFFDIO_COPY(r1, 0xc028aa03, &(0x7f00000001c0)={&(0x7f0000ffd000/0x2000)=nil, 0x2000}) sendmsg$nl_netfilter(r0, &(0x7f0000000180)={&(0x7f0000002540)={0x10}, 0xc, &(0x7f0000000040)={&(0x7f0000000140)=ANY=[@ANYBLOB="140000000018fdff000000000000800000000000"], 0x10}, 0x1}, 0x0) [ 707.285920] binder: 18439:18448 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 707.315011] binder: 18439:18448 BC_FREE_BUFFER u0000000000000000 no match [ 707.334738] binder: 18439:18456 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 707.372244] binder: 18439:18456 BC_FREE_BUFFER u0000000000000000 no match 2018/05/12 22:57:08 executing program 3: r0 = syz_open_dev$sndseq(&(0x7f0000783000)='/dev/snd/seq\x00', 0x0, 0x0) read(r0, &(0x7f0000fb6000)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, 'port1\x00', 0xa9824f69d1376637, 0x10800a}) r1 = openat$null(0xffffffffffffff9c, &(0x7f0000000140)='/dev/null\x00', 0x90c81, 0x0) r2 = openat$mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/mixer\x00', 0x20000, 0x0) renameat2(r1, &(0x7f0000000180)='./file0\x00', r2, &(0x7f0000000200)='./file0\x00', 0x4) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f000019ffe9)={0xc1}) ioctl$SNDRV_SEQ_IOCTL_UNSUBSCRIBE_PORT(r0, 0x40505331, &(0x7f0000000000)) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r0, 0xc08c5332, &(0x7f0000000080)={0x0, 0x0, 0x0, 'queue0\x00'}) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000fdbff0)='/dev/sequencer2\x00', 0x0, 0x0) 2018/05/12 22:57:08 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0xffffff84, [0x0, 0x0, 0x252]}) 2018/05/12 22:57:08 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140)}, 0x0) 2018/05/12 22:57:08 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x900, 0x9, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:57:08 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0ffffff00000000], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) 2018/05/12 22:57:09 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='dctcp\x00', 0x6) sendto$inet6(r0, &(0x7f00004e8000), 0xf401, 0x20000001, &(0x7f000007f000)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800000000000000]}}, 0x1c) 2018/05/12 22:57:09 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf0ffffff00000000], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) 2018/05/12 22:57:09 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140)}, 0x0) 2018/05/12 22:57:09 executing program 3: r0 = syz_open_dev$sndseq(&(0x7f0000783000)='/dev/snd/seq\x00', 0x0, 0x0) read(r0, &(0x7f0000fb6000)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x7c}, 'port1\x00', 0xa9824f69d1376637, 0x10800a, 0x0, 0x0, 0x0, 0x0, 0xffff}) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f000019ffe9)={0xc1}) ioctl$SNDRV_SEQ_IOCTL_UNSUBSCRIBE_PORT(r0, 0x40505331, &(0x7f0000000000)) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r0, 0xc08c5332, &(0x7f0000000080)={0x0, 0x0, 0x0, 'queue0\x00'}) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000fdbff0)='/dev/sequencer2\x00', 0x0, 0x0) 2018/05/12 22:57:09 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x4000000, 0x9, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:57:09 executing program 5: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000e5b000)={0x2, 0x4e20, @multicast1=0xe0000001}, 0x10) getcwd(&(0x7f00000000c0)=""/106, 0x6a) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20}, 0x10) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000eb0fb8)={0x1, 0x3, &(0x7f0000000140)=ANY=[@ANYBLOB="180000000300000000000000000000009500400000000000db0bf51248f0ec44a2bf3b916eb01be6ae76247d38aad8f6605e822d5db971ef991e7726cc1d3134d7a9f6d602fbc6569c47fedeccbafaf56b3156fcb81314a4f043ecee4bbedd947786a16a40bfcfdf96102f544da477e2745e7483e63d486a6d029335403f8e"], &(0x7f00002bf000)='syzkaller\x00', 0x4, 0xb7, &(0x7f00006ab000)=""/183}, 0x48) r2 = socket$kcm(0x29, 0x1000000000000005, 0x0) ioctl$sock_kcm_SIOCKCMATTACH(r2, 0x89e0, &(0x7f000031aff8)={r0, r1}) setsockopt$sock_int(r0, 0x1, 0x7, &(0x7f0000000080), 0x4) 2018/05/12 22:57:09 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x89ffffff, [0x0, 0x0, 0x252]}) 2018/05/12 22:57:09 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x1c, 0x0, &(0x7f0000000040)=[@request_death={0x400c630e, 0x0, 0x3000000}, @free_buffer={0x40086303}], 0x0, 0x0, &(0x7f0000000080)}) 2018/05/12 22:57:09 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x600, [0x0, 0x0, 0x252]}) 2018/05/12 22:57:09 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa908000000000000], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) [ 709.027171] binder: 18505:18508 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 709.058157] binder: 18505:18508 BC_FREE_BUFFER u0000000000000000 no match [ 709.107388] binder: 18505:18515 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 709.187479] binder: 18505:18515 BC_FREE_BUFFER u0000000000000000 no match 2018/05/12 22:57:10 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='dctcp\x00', 0x6) sendto$inet6(r0, &(0x7f00004e8000), 0xf401, 0x20000001, &(0x7f000007f000)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff0f000000000000]}}, 0x1c) 2018/05/12 22:57:10 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x8008, 0x9, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:57:10 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140)}, 0x0) 2018/05/12 22:57:10 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400300], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) 2018/05/12 22:57:10 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x3200, [0x0, 0x0, 0x252]}) 2018/05/12 22:57:10 executing program 5: r0 = socket(0x1e, 0x1, 0xfffffffffffffffc) getsockopt(r0, 0x6, 0x0, &(0x7f0000003fb3), &(0x7f0000000000)) 2018/05/12 22:57:10 executing program 3: r0 = syz_open_dev$sndseq(&(0x7f0000783000)='/dev/snd/seq\x00', 0x0, 0x0) read(r0, &(0x7f0000fb6000)=""/28, 0x1c) open_by_handle_at(r0, &(0x7f0000000200)=ANY=[@ANYBLOB="9620f1c41738bca4e3d874d70b2df3ba665d104986aed04a95718a890245af007fd9516ae907ff3739338cf39edb0d0000000000000000562366ea8b7f73ae5fe1df408190e61a7338b724ab484bf6b6466dec230000000000000000000000000000"], 0x4040) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, 'port1\x00', 0xa9824f69d1376637, 0x10800a}) dup3(r0, r0, 0x80000) personality(0x480000d) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f000019ffe9)={0xc1}) ioctl$SNDRV_SEQ_IOCTL_UNSUBSCRIBE_PORT(r0, 0x40505331, &(0x7f0000000000)={{0x4}, {0x0, 0x3}, 0x2, 0x0, 0x2}) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r0, 0xc08c5332, &(0x7f0000000080)={0x0, 0x0, 0x0, 'queue0\x00'}) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000fdbff0)='/dev/sequencer2\x00', 0x0, 0x0) syz_genetlink_get_family_id$ipvs(&(0x7f00000001c0)='IPVS\x00') 2018/05/12 22:57:10 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x1c, 0x0, &(0x7f0000000040)=[@request_death={0x400c630e, 0x0, 0x2000}, @free_buffer={0x40086303}], 0x0, 0x0, &(0x7f0000000080)}) 2018/05/12 22:57:10 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = syz_open_dev$mouse(&(0x7f0000000000)='/dev/input/mouse#\x00', 0x6, 0xa000) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x1000000000001, 0x7, 0x8400000000003, 0xffffffdf00000005}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000140)={r2, &(0x7f0000000040), &(0x7f0000000100)}, 0x20) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000100)={r2, &(0x7f0000000040), &(0x7f0000000280)=""/231}, 0x18) ioctl$KVM_NMI(r1, 0xae9a) ioctl$DMA_BUF_IOCTL_SYNC(r1, 0x40086200, &(0x7f0000000040)=0x6) connect$netlink(r0, &(0x7f0000cdfff4)=@proc={0x10, 0x0, 0xffffffffffffffff, 0x800}, 0xc) personality(0x410000f) getpeername$netlink(r0, &(0x7f0000195000), &(0x7f000075effc)=0xc) 2018/05/12 22:57:10 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x1c00, [0x0, 0x0, 0x252]}) 2018/05/12 22:57:10 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f000001], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) [ 710.179183] binder: 18536:18539 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 710.219309] binder: 18536:18539 BC_FREE_BUFFER u0000000000000000 no match 2018/05/12 22:57:10 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0xf0ffffff0f0000, 0x9, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:57:10 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140)}, 0x0) 2018/05/12 22:57:10 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='dctcp\x00', 0x6) sendto$inet6(r0, &(0x7f00004e8000), 0xf401, 0x20000001, &(0x7f000007f000)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5000000000000]}}, 0x1c) [ 710.246796] binder: 18536:18557 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 710.298424] binder: 18536:18557 BC_FREE_BUFFER u0000000000000000 no match 2018/05/12 22:57:10 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100007f], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) 2018/05/12 22:57:11 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0xa80300, 0x9, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:57:11 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x29, [0x0, 0x0, 0x252]}) 2018/05/12 22:57:11 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='dctcp\x00', 0x6) sendto$inet6(r0, &(0x7f00004e8000), 0xf401, 0x20000001, &(0x7f000007f000)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa]}}, 0x1c) 2018/05/12 22:57:11 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="fdc3", 0x2}], 0x1, &(0x7f0000000140)}, 0x0) 2018/05/12 22:57:11 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x1c, 0x0, &(0x7f0000000040)=[@request_death={0x400c630e, 0x0, 0x700000000000000}, @free_buffer={0x40086303}], 0x0, 0x0, &(0x7f0000000080)}) 2018/05/12 22:57:11 executing program 5: [ 710.499629] binder: 18596:18599 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 2018/05/12 22:57:11 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x11, [0x0, 0x0, 0x252]}) [ 710.543572] binder: 18596:18599 BC_FREE_BUFFER u0000000000000000 no match [ 710.587820] binder: 18596:18607 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 710.627915] binder: 18596:18607 BC_FREE_BUFFER u0000000000000000 no match 2018/05/12 22:57:12 executing program 3: r0 = syz_open_dev$sndseq(&(0x7f0000783000)='/dev/snd/seq\x00', 0x0, 0x0) read(r0, &(0x7f0000fb6000)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, 'port1\x00', 0xa9824f69d1376637, 0x10800a}) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f000019ffe9)={0xc1, @tick, 0x0, {}, 0xf39}) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000001c0)='cpuset.effective_cpus\x00', 0x0, 0x0) ioctl$DRM_IOCTL_RES_CTX(0xffffffffffffff9c, 0xc0106426, &(0x7f0000000240)={0x8, &(0x7f0000000200)=[{0x0}, {}, {}, {}, {}, {}, {}, {}]}) ioctl$DRM_IOCTL_GET_CTX(r1, 0xc0086423, &(0x7f0000000280)={r2, 0x3}) r3 = creat(&(0x7f0000000140)='./file0\x00', 0x0) ioctl$TIOCLINUX5(r3, 0x541c, &(0x7f0000000180)={0x5, 0xa37, 0x4, 0x3, 0x6}) ioctl$SNDRV_SEQ_IOCTL_UNSUBSCRIBE_PORT(r0, 0x40505331, &(0x7f0000000000)) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r0, 0xc08c5332, &(0x7f0000000080)={0x0, 0x0, 0x0, 'queue0\x00'}) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000fdbff0)='/dev/sequencer2\x00', 0x0, 0x0) 2018/05/12 22:57:12 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffc0], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) 2018/05/12 22:57:12 executing program 5: 2018/05/12 22:57:12 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0xe4ffffff00000000, 0x9, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:57:12 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="0ec3", 0x2}], 0x1, &(0x7f0000000140)}, 0x0) 2018/05/12 22:57:12 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x1c, 0x0, &(0x7f0000000040)=[@request_death={0x400c630e, 0x0, 0x500000000000000}, @free_buffer={0x40086303}], 0x0, 0x0, &(0x7f0000000080)}) 2018/05/12 22:57:12 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x400000000000000, [0x0, 0x0, 0x252]}) 2018/05/12 22:57:12 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='dctcp\x00', 0x6) sendto$inet6(r0, &(0x7f00004e8000), 0xf401, 0x20000001, &(0x7f000007f000)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4002000000000000]}}, 0x1c) 2018/05/12 22:57:12 executing program 5: 2018/05/12 22:57:12 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="04c3", 0x2}], 0x1, &(0x7f0000000140)}, 0x0) 2018/05/12 22:57:12 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x8800000, 0x9, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:57:12 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf0ffffff], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) [ 711.482835] binder: 18630:18631 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 711.520889] binder: 18630:18631 BC_FREE_BUFFER u0000000000000000 no match 2018/05/12 22:57:12 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x29000000, [0x0, 0x0, 0x252]}) 2018/05/12 22:57:12 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='dctcp\x00', 0x6) sendto$inet6(r0, &(0x7f00004e8000), 0xf401, 0x20000001, &(0x7f000007f000)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x91ffffff00000000]}}, 0x1c) 2018/05/12 22:57:12 executing program 5: [ 711.581446] binder: 18630:18646 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 2018/05/12 22:57:12 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="02c3", 0x2}], 0x1, &(0x7f0000000140)}, 0x0) [ 711.652982] binder: 18630:18646 BC_FREE_BUFFER u0000000000000000 no match 2018/05/12 22:57:13 executing program 3: r0 = syz_open_dev$sndseq(&(0x7f0000783000)='/dev/snd/seq\x00', 0x0, 0x0) read(r0, &(0x7f0000fb6000)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, 'port1\x00', 0xa9824f69d1376637, 0x10800a}) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f000019ffe9)={0xc1}) r1 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000140)='/proc/self/net/pfkey\x00', 0x30000, 0x0) accept4$inet(r1, &(0x7f0000000180)={0x0, 0x0, @loopback}, &(0x7f00000001c0)=0x10, 0x80800) ioctl$SNDRV_SEQ_IOCTL_UNSUBSCRIBE_PORT(r0, 0x40505331, &(0x7f0000000000)) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r0, 0xc08c5332, &(0x7f0000000080)={0x0, 0x0, 0x0, 'queue0\x00'}) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000fdbff0)='/dev/sequencer2\x00', 0x0, 0x0) 2018/05/12 22:57:13 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x31000000, 0x9, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:57:13 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x300000000000000], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) 2018/05/12 22:57:13 executing program 5: 2018/05/12 22:57:13 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x21, [0x0, 0x0, 0x252]}) 2018/05/12 22:57:13 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x1c, 0x0, &(0x7f0000000040)=[@request_death={0x400c630e, 0x0, 0x48000000}, @free_buffer={0x40086303}], 0x0, 0x0, &(0x7f0000000080)}) 2018/05/12 22:57:13 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='dctcp\x00', 0x6) sendto$inet6(r0, &(0x7f00004e8000), 0xf401, 0x20000001, &(0x7f000007f000)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x700000000000000]}}, 0x1c) 2018/05/12 22:57:13 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="07c3", 0x2}], 0x1, &(0x7f0000000140)}, 0x0) 2018/05/12 22:57:13 executing program 5: 2018/05/12 22:57:13 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x1000000, [0x0, 0x0, 0x252]}) 2018/05/12 22:57:13 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f00000100000000], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) 2018/05/12 22:57:13 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='dctcp\x00', 0x6) sendto$inet6(r0, &(0x7f00004e8000), 0xf401, 0x20000001, &(0x7f000007f000)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf401000000000000]}}, 0x1c) [ 712.500776] binder: 18682:18693 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 712.530601] binder: 18682:18693 BC_FREE_BUFFER u0000000000000000 no match 2018/05/12 22:57:13 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="0ac3", 0x2}], 0x1, &(0x7f0000000140)}, 0x0) 2018/05/12 22:57:13 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0xeffd, 0x9, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) [ 712.567674] binder: 18682:18702 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 2018/05/12 22:57:13 executing program 5: 2018/05/12 22:57:13 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x3, [0x0, 0x0, 0x252]}) [ 712.637971] binder: 18682:18702 BC_FREE_BUFFER u0000000000000000 no match 2018/05/12 22:57:14 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='dctcp\x00', 0x6) sendto$inet6(r0, &(0x7f00004e8000), 0xf401, 0x20000001, &(0x7f000007f000)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000]}}, 0x1c) 2018/05/12 22:57:14 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="18c3", 0x2}], 0x1, &(0x7f0000000140)}, 0x0) 2018/05/12 22:57:14 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa9080000], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) 2018/05/12 22:57:14 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x4000000, [0x0, 0x0, 0x252]}) 2018/05/12 22:57:14 executing program 3: r0 = syz_open_dev$sndseq(&(0x7f0000783000)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, 'port1\x00', 0xa9824f69d1376637, 0x10800a}) ioctl$SNDRV_SEQ_IOCTL_UNSUBSCRIBE_PORT(r0, 0x40505331, &(0x7f0000000000)) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r0, 0xc08c5332, &(0x7f0000000140)={0x0, 0x0, 0x0, 'queue0\x00'}) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000fdbff0)='/dev/sequencer2\x00', 0x0, 0x0) 2018/05/12 22:57:14 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x1c, 0x0, &(0x7f0000000040)=[@request_death={0x400c630e, 0x0, 0x74000000}, @free_buffer={0x40086303}], 0x0, 0x0, &(0x7f0000000080)}) 2018/05/12 22:57:14 executing program 5: 2018/05/12 22:57:14 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0xffffffe4, 0x9, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:57:14 executing program 5: [ 713.564186] binder: 18742:18744 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 713.615168] binder: 18742:18744 BC_FREE_BUFFER u0000000000000000 no match [ 713.665295] binder: 18742:18763 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 2018/05/12 22:57:14 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='dctcp\x00', 0x6) sendto$inet6(r0, &(0x7f00004e8000), 0xf401, 0x20000001, &(0x7f000007f000)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x300]}}, 0x1c) 2018/05/12 22:57:14 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x1a000}], 0x1, &(0x7f0000000140)}, 0x0) 2018/05/12 22:57:14 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x300], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) 2018/05/12 22:57:14 executing program 3: r0 = syz_open_dev$sndseq(&(0x7f0000783000)='/dev/snd/seq\x00', 0x0, 0x0) read(r0, &(0x7f0000fb6000)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x80}, 'port1\x00', 0xa9824f69d1376637, 0x10800a}) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f000019ffe9)={0xc1}) r1 = gettid() ptrace$peekuser(0x3, r1, 0x2) socketpair(0x5, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$EVIOCGLED(r2, 0x80404519, &(0x7f0000000180)=""/245) ioctl$SNDRV_SEQ_IOCTL_UNSUBSCRIBE_PORT(r0, 0x40505331, &(0x7f0000000000)) fstat(r3, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0x0}) ioprio_set$uid(0x3, r4, 0xa8f6) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r0, 0xc08c5332, &(0x7f0000000080)={0x0, 0x0, 0x0, 'queue0\x00'}) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000fdbff0)='/dev/sequencer2\x00', 0x0, 0x0) 2018/05/12 22:57:14 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0xfdffffff, [0x0, 0x0, 0x252]}) 2018/05/12 22:57:14 executing program 5: 2018/05/12 22:57:14 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x1c, 0x0, &(0x7f0000000040)=[@request_death={0x400c630e, 0x0, 0xffffff7f}, @free_buffer={0x40086303}], 0x0, 0x0, &(0x7f0000000080)}) 2018/05/12 22:57:14 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x12, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) [ 713.712446] binder: 18742:18763 BC_FREE_BUFFER u0000000000000000 no match 2018/05/12 22:57:14 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x2c000000, [0x0, 0x0, 0x252]}) 2018/05/12 22:57:14 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf00], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) 2018/05/12 22:57:14 executing program 5: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$netlink(0x10, 0x3, 0x10) sendmsg$IPVS_CMD_GET_CONFIG(r1, &(0x7f0000000080)={&(0x7f0000000380)={0x10}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="ff0f70481a07", @ANYRES16=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\r\x00\x00\x00'], 0x3}, 0x1}, 0x0) sendmsg$nl_generic(r1, &(0x7f0000023000)={&(0x7f0000024000)={0x10}, 0xc, &(0x7f0000000180)={&(0x7f00000000c0)={0x20, 0x40000080000028, 0xaff, 0x0, 0x0, {0x1}, [@nested={0xc, 0x0, [@typed={0x4102, 0x0, @pid}]}]}, 0x20}, 0x1}, 0x0) 2018/05/12 22:57:14 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x7}], 0x1, &(0x7f0000000140)}, 0x0) 2018/05/12 22:57:14 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='dctcp\x00', 0x6) sendto$inet6(r0, &(0x7f00004e8000), 0xf401, 0x20000001, &(0x7f000007f000)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6]}}, 0x1c) [ 713.805795] binder: 18786:18787 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 713.860871] binder: 18786:18787 BC_FREE_BUFFER u0000000000000000 no match [ 713.925996] binder: 18786:18806 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 713.991271] binder: 18786:18806 BC_FREE_BUFFER u0000000000000000 no match 2018/05/12 22:57:15 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0xf, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:57:15 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x33000000, [0x0, 0x0, 0x252]}) 2018/05/12 22:57:15 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffff0], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) 2018/05/12 22:57:15 executing program 5: r0 = syz_open_dev$vcsn(&(0x7f0000000400)='/dev/vcs#\x00', 0x2, 0x400400) ioctl$TCSBRKP(r0, 0x5425, 0x6) r1 = socket(0xa, 0x1, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="c6295e4eca6c09b612ec6f") r2 = socket$packet(0x11, 0x3, 0x300) io_setup(0x20, &(0x7f00000001c0)=0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='memory.events\x00', 0x0, 0x0) setsockopt$IPT_SO_SET_REPLACE(r4, 0x0, 0x40, &(0x7f0000000a00)=@security={'security\x00', 0xe, 0x4, 0x3e0, 0xffffffff, 0x0, 0x0, 0x0, 0xffffffff, 0xffffffff, 0x348, 0x348, 0x348, 0xffffffff, 0x4, &(0x7f00000003c0), {[{{@uncond, 0x0, 0x98, 0xf8}, @common=@SET={0x60, 'SET\x00', 0x0, {{0x1, [0x4, 0x825, 0x5, 0xfffffffffffff001, 0xfffffffffffffffd], 0x62, 0x8, 0x8}, {0x80000001, [0x6, 0x7f, 0x3, 0x75, 0x0, 0x4], 0x9, 0xffff, 0x6}}}}, {{@ip={@multicast2=0xe0000002, @empty, 0xff000000, 0xff000000, 'syz_tun\x00', 'team_slave_0\x00', {0xff}, {}, 0x0, 0x2, 0x8}, 0x0, 0xe0, 0x140, 0x0, {}, [@common=@unspec=@nfacct={0x48, 'nfacct\x00', 0x0, {'syz1\x00', 0x400}}]}, @common=@SET={0x60, 'SET\x00', 0x0, {{0x5, [0x7, 0xd44, 0x0, 0x4, 0x2, 0x10001], 0x9, 0xe7, 0xfffffffffffffffa}, {0xfec, [0x0, 0x7, 0x20000000, 0x10000, 0x400, 0x1], 0x3, 0x1f, 0x3}}}}, {{@uncond, 0x0, 0xe8, 0x110, 0x0, {}, [@common=@socket0={0x20, 'socket\x00'}, @common=@ah={0x30, 'ah\x00', 0x0, {0x4, 0x5, 0x1}}]}, @common=@unspec=@NFQUEUE1={0x28, 'NFQUEUE\x00', 0x1, {0xe66, 0x57}}}], {{[], 0x0, 0x70, 0x98}, {0x28, '\x00', 0x0, 0xfffffffffffffffe}}}}, 0x440) ioctl$EVIOCGABS20(r4, 0x80184560, &(0x7f0000000200)=""/103) r5 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000080)='/dev/vga_arbiter\x00', 0x5c000, 0x0) io_cancel(r3, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x3, r1, &(0x7f0000000040)="995e5d619ba9f700d247643f42e6b5d94ce128b7884a3a68e17f36a9ea8a27608fb86d694f0434", 0x27, 0x7, 0x0, 0x1, r5}, &(0x7f0000000100)) linkat(r5, &(0x7f0000000140)='./file0\x00', r5, &(0x7f0000000180)='./file0\x00', 0x400) ioctl$sock_inet_SIOCSIFFLAGS(r2, 0x8914, &(0x7f00000005c0)={'bridge_slave_0\x00'}) ioctl$KVM_GET_IRQCHIP(r5, 0xc208ae62, &(0x7f00000002c0)=@ioapic) ioctl$sock_inet_SIOCSIFFLAGS(r2, 0x8914, &(0x7f00000009c0)={'bridge_slave_0\x00', 0xc0ffffff}) 2018/05/12 22:57:15 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x901}], 0x1, &(0x7f0000000140)}, 0x0) 2018/05/12 22:57:15 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x1c, 0x0, &(0x7f0000000040)=[@request_death={0x400c630e, 0x0, 0x7}, @free_buffer={0x40086303}], 0x0, 0x0, &(0x7f0000000080)}) 2018/05/12 22:57:15 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='dctcp\x00', 0x6) sendto$inet6(r0, &(0x7f00004e8000), 0xf401, 0x20000001, &(0x7f000007f000)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68cc7b6]}}, 0x1c) 2018/05/12 22:57:15 executing program 3: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000982000)='/dev/cuse\x00', 0x2, 0x0) pread64(r1, &(0x7f0000000640)=""/56, 0xb7, 0x0) write$fuse(r1, &(0x7f0000000680)=ANY=[@ANYBLOB="8109000000000000010000000000000007000000c74f5c58bdcdb523905c1da25f66999bd2e255d831f7cc16e9a6ccb41f90c02fa8adb02ec42576d5495172129d637010ab53996a43e344f83eaceb052273f71eb05ada6f9494c0dfc09cd2f45ffb51bb2c704064c0597aabf61741eeb6227be59377fa4529da16df4ac74c8c5a5088a60fb0204f4ca9a51cc39fbad0a86277ce5a4554a7096d79dcd772bd7b3fb429d03e8b5a30a49d41dba18a3b5cb2b3a0bc7058b3805961b392cb708654821b1464fa2e2fe41dcc05049611169565e29dd5414487ebf33d14ce99f9be6417857b9d69200880d446cad5cdc1df5ddca41c80becab77f6e9bf8b0ff456268f3d441c9018973430e38bf8ffef9ca44cf810bf2ce22d1f0b596580e07231357c25ce3911b8f61c9145887f3a2377cbaa888ad03803f4da62800c06c5a2107694986aa211a0fbc371846110610565442333d5f7eda8bdff1a574c807feb5e8ebbd58d78d9ff4c20a07de540658c8dca2d0373169c9b99eb14f09d0c4d6b4a591add580fe875d66960e7c8a737deac1dd6f49903930171a532278c30ba2153320b395ab94f676cb582813f1e9e57abcdf65f4925b477850de334b51ccc1e76c6ac27754cc42cf404f0b148e5a804c44ad5c1076a08c3628a02d66e2667738611c5ff336aac1c062d747de8130463ba44cf73ecab584acc64ffd61b3111484aacdf2e9a16bc8f6a5bf2c92b5d96b49c0fcacaee9e43b058a6f057f60892140eb2072d067c495f3cc1daf2ccfed15cb1a8b412c2e463856c01189ffb983c796bbfec45417fed0cf12c18e99f3a7f879f90489e0977b5db4c7bf15a7b6d825a88ae396ed8f0ed2f27d5b20ae3b18635773b6a1e0e933aa415429a3a2b1375b31f9d46ee720d8367dd92f727fb27d750478cb08821fd27199fbc9071f28de0ce72da52167883c25363a8d4b41291de512a9554766ead5c6a9e44061294a3b165a10eba99c362e725a18dec9c607114680a2c11b19ce2990d7b1243e7ad098ed5278d3155a5cdf8a18fbc127ba1e42cf963ccba9673cff1600181c0c8a76e0428ed3df55f0e15f7af0b9d20cc494dd0c8085b412f11d79c1d4908ce40850668c02b141fbfad16b6d0cdbc1a4100d33293441696182f90b51994d95f0f596a0615617f9ef259532551c37967d757f1204a3e1d4d6c9874f805c8649f3ed5be1ecd9caa99905d1f7d6f8d536b4d1efed5964a2e05e30a4e232f178bc423c76ae3613857104c30b0b68822b95546fd8eba15c1ceaa1178423012f33ec0c9e7d6ec252b2a339e12ed1130f18253835602961e381e663c80428df02134827d3cefe6720b820f53c29f4dca5feea992906ec0c4d8b7ab4633be77e7c2bddb57d6c99be1c01a148797f65380d6225a1283cae0836e3b2032c74af0102db06643ced3ff66442d0c11f3394282af201028747564536202e27cd41c092c5428694f331fea083d551f60100000000000000304dfdc39c7851cd32227298d4ee4138dd7229931d6bec2b21e5d15209000000000000009f21cd7e9cece530b7cf48aa011f4d05ed444c9dcd6e477b13125fb43cad588e97c3aee59e8f40fd55585e57f5bc0f602acb677551fcc2915fc166d10e5702f06241cba95b841c94673bae5dea2ad6b0f6741abb702945b19a23dbe4859781f7a2ea2e01eda9ede6bbc5f04ae0bf44c04e728fb9554560488d3d2cac7e46849f4709eccb369052977e563546ca22da5bf46e63b0313c6a59fd2ea852b9f637a1403bd312e275486c573541328956e1d070bf20d83a6702fb422bf8ec76e6b52089b98937abf5f93e0d6b532a4cc35db05521c9cb5dfbb31aaba40b4d9b05787f4245f06ac50bc24436faa165dec93a503c708eac2a11ad8a939516fb572041c0d0e814546721fcd16b4c2608520cdc706b7f76be60fc67d5ea89dc0d3fde2bce8ba2573dba462f1c0c9ff66805a23a5a3fd9bfa9b70afc4dd816fd6f6428e644a2942dea6f5d4e5bdff5b25c68aeb859085c31f13f8eda39cbfeb823ddfd2f7a91ca4ae343bfaaa237e416c83f67845bc24c8334d2e57fe5bbf17ac13ace18a8632ed0c05d377851c14a8068232d7c9825b80dafd642f8d4c314aba41eb5c43777df0f7b35553e998de93b47cf27b88954e375b540b38858857d6d7693b3b7c4515622e9dc6246040e8b53cbbb744dd5d8a9aec660a0d19f3cf7047d3039cfab3ccfd62d0645793045885988b935c39481e48e6aea2a43cfa75b9bcaa18cd27134ee74bb20da13af659afa53e89617a502a1aa3387fc4926c36c4fae50a851139099a743ff208e2c17701dcf3e3e7eafa3dc98386f27cb057ef7ad27b50266d7d391a6f1cb29a2d03c194fdae18ebc03af8ebf4ecf40b07e755dd1def74a46587ad5dbcede24be910914a9b9432a021cbfdd6818528b3bbdb49798527697f51c1f713122c313e2d53d1a496f7e4a2e4374caa322bc1fc8d713271b8fbf261edfd9f1626934f3d66010717195cef566baab929a80a47a06d9bd68cdc0df511f5a7483e5635f2e9a441e75c74e35d7730637e10f772f3cabd4423a37d2123f1495dfc474e556b33850f6713dcfa00b94c4199f800869709e775feedb137ef1d604d055f771df32979a05e88d2520835c423054c7ae2223d556db5e86703a9eb6a05f8bd85628813a569117979b71ad59a7355a64043fb33b39d122beb9d4b7bec1f494475e43326c0200205c8bf1ef53a247613dd10378b436665215a6fb224e8cecc3e3276fcb111bcb9c6524ebd3bbb1d7f0943bca45f9a91be522e9986ff98dbf161b235f81a7475dabff9ef5b0f135f6de1ae92cc060bbec3b89ae98658ed1d7a1b512800b7aa8ccc583843d777f263c0ae2a1f70e2da25fc8954f92fd6ff785f675de3f4f1d3ebdd3300d2864ade1a7f7b7b748de1455359837021c4e7fd73508a16daea78e6c1ec2a389595e0497e5ed44d0499a3e785aff8ed8394eed744b274e88fb65a1165b8565420ca3281ab55da70a2c609a36ab3a377b2ae8460a3825688a1c17725e20d8d848ae99533da3116928e4e12e2941e588748e4a0e5239f6fa21774e9695c8d5415995770b876b49b9e380c22aab77ee984c40a583fe32898602135e9beafe18c3608791bc1d5eab16281ad060a5fe3c12c8502e96f76b23b9f2d5881a4ab5cd3de74c4b7e34935c5872101a38b56028161e9d6a584e8b4a2a87263f0ad2b5a05b87c5c69dd0e612cf909dd43b166a3c54683d5f96f084533089f0059ea47acf84cff9fc17d8c1c5b69f36b60881d97a951a2ed4ee0fc8697b0dd2d55626a6a41e81cc53d91a7acb2bb3526f7e07b64c4b91f4a2d92b5e8d777fa2943a5162801e6db12ab056a83ffeaf986dd736e551eb1fee9e3ea8bf306381c7942e5b000000"], 0x981) 2018/05/12 22:57:15 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x20000102}], 0x1, &(0x7f0000000140)}, 0x0) [ 714.897985] binder: 18826:18837 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 714.912149] bridge0: port 1(bridge_slave_0) entered disabled state [ 714.939605] CUSE: unknown device info "””ÀßÀœÒô_ûQ»,p@dÀYz«öAî¶"{å“wúE)ÚßJÇLŒZPˆ¦° OL©¥ߺШbwÎZET§ myÜ×r½{?´)Ð>‹Z0¤AÛ¡Š;\²³ ¼pX³€Ya³’Ëp†T‚dú./äÌ–•eâÕAD‡ëó" [ 714.940221] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 714.955204] CUSE: unknown device info "ÀlZ!iI†ª!¼7FVTB3" [ 714.968252] CUSE: unknown device info " ŠvàBŽÓßUðá_zð¹Ò Ä”Ý €…´ñyÁÔŒäPfŒ±AûúÑkm ÛÁ¤ 3)4Aia‚ù Q™M•ðõ– aVùï%•2U7–}u£áÔÖɇO€\†Ióí[áìÙÊ©™Ñ÷ÖøÕ6´ÑïíYd¢à^0¤â2ñx¼B0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x10, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) [ 715.036817] CUSE: unknown device info "””ÀßÀœÒô_ûQ»,p@dÀYz«öAî¶"{å“wúE)ÚßJÇLŒZPˆ¦° OL©¥ߺШbwÎZET§ myÜ×r½{?´)Ð>‹Z0¤AÛ¡Š;\²³ ¼pX³€Ya³’Ëp†T‚dú./äÌ–•eâÕAD‡ëó" [ 715.038104] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 715.052256] CUSE: unknown device info "ÀlZ!iI†ª!¼7FVTB3" 2018/05/12 22:57:15 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x3c000000, [0x0, 0x0, 0x252]}) [ 715.065646] CUSE: unknown device info " ŠvàBŽÓßUðá_zð¹Ò Ä”Ý €…´ñyÁÔŒäPfŒ±AûúÑkm ÛÁ¤ 3)4Aia‚ù Q™M•ðõ– aVùï%•2U7–}u£áÔÖɇO€\†Ióí[áìÙÊ©™Ñ÷ÖøÕ6´ÑïíYd¢à^0¤â2ñx¼B0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x12, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) [ 715.226664] binder: 18826:18864 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 715.244323] bridge0: port 1(bridge_slave_0) entered disabled state [ 715.262585] binder: 18826:18864 BC_FREE_BUFFER u0000000000000000 no match [ 715.272638] bridge0: port 1(bridge_slave_0) entered blocking state [ 715.279126] bridge0: port 1(bridge_slave_0) entered forwarding state 2018/05/12 22:57:16 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x5b2}], 0x1, &(0x7f0000000140)}, 0x0) 2018/05/12 22:57:16 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x31, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:57:16 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x32000000, [0x0, 0x0, 0x252]}) 2018/05/12 22:57:16 executing program 3: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x12, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:57:16 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40030000000000], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) 2018/05/12 22:57:16 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x1c, 0x0, &(0x7f0000000040)=[@request_death={0x400c630e, 0x0, 0x4c00000000000000}, @free_buffer={0x40086303}], 0x0, 0x0, &(0x7f0000000080)}) 2018/05/12 22:57:16 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='dctcp\x00', 0x6) sendto$inet6(r0, &(0x7f00004e8000), 0xf401, 0x20000001, &(0x7f000007f000)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x54]}}, 0x1c) 2018/05/12 22:57:16 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000783000)='/dev/snd/seq\x00', 0x0, 0x0) r1 = socket(0x2, 0x1, 0x0) setsockopt(r1, 0x6, 0xe, &(0x7f0000902000)="020008000000000000005462fa01a15eaf0d2cf653f13cc379ede4eaf40f4a95bbff850a8263357506b31e58a98399b397e695c0f03d3b3d54436fe71cbcdc6e30ac10369300f6af7d07634832b8a5c0a94c470502e9337b3e7298fc74e81b1058d02f9b14732017e2466a9fc43aea71263335960415800020f9575da602000000001f0000d1b0e6ebcb12c7291871363e97100c4a4c2e9f5c0c14f1659ce8c8bed2e97e60a3649f93ea0c8263f864802ad72fa698807ef14a4a1813e976be1d113b514dbdc05ea1309163d6a4830de8391f2ecab7bbfbcb", 0xd8) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt(r1, 0x40000000000006, 0x20, &(0x7f00000000c0)="0200080000000000d9005462fa01a55eaf0d2cf653f13cc379ed80eaf40f4a95bbff850a8263357506b31e58a98399b397e695c0f03d3b3d54436fe71cbcdc6e30ac10369300f6af7d07634832b8a5c0a94c070000000000000098fc74e81b1058d02f8001732017e2466a9fc43aea71263335960415e40000f9695da601fffff9001f0000d1b0e6ebcb12c7291871363e97100c4a4c2e9f5c0c14f1659ce8c8bed2e97e60a3649f93ea0c8263f864802a602fa698807ef14a4a1813e976be1d00000006bdc05ea1309163d6a4830de8391f2ecab7bbfbcb", 0xd8) r2 = dup2(r0, r1) setsockopt$inet_sctp_SCTP_AUTOCLOSE(r2, 0x84, 0x4, &(0x7f0000000000)=0x40, 0x4) [ 715.872415] binder: 18887:18888 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 2018/05/12 22:57:16 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0xfffffdef}], 0x1, &(0x7f0000000140)}, 0x0) 2018/05/12 22:57:16 executing program 3: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x12, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:57:16 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0x7, 0x0, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:57:16 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x8, [0x0, 0x0, 0x252]}) 2018/05/12 22:57:16 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfcffffff00000000], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) [ 715.919779] binder: 18887:18888 BC_FREE_BUFFER u0000000000000000 no match [ 715.938771] binder: 18887:18904 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 2018/05/12 22:57:16 executing program 5: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x0, &(0x7f0000000040)="c626262c8523bf012cf66f") fcntl$lock(r0, 0x7, &(0x7f0000000080)={0x0, 0x0, 0x80000001, 0xfffffffffffffff7}) [ 715.982740] binder: 18887:18904 BC_FREE_BUFFER u0000000000000000 no match 2018/05/12 22:57:16 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0xa}], 0x1, &(0x7f0000000140)}, 0x0) 2018/05/12 22:57:16 executing program 3: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_submit(0x0, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x12, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:57:17 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x3300, [0x0, 0x0, 0x252]}) 2018/05/12 22:57:17 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0x6, 0x0, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:57:17 executing program 5: r0 = socket$netlink(0x10, 0x3, 0xc) writev(r0, &(0x7f0000fb5ff0)=[{&(0x7f0000fb4000)="1f00000002031900000007000000068100022b0509000100010100ff3ffe58", 0x1f}], 0x1) writev(r0, &(0x7f000037d000)=[{&(0x7f0000199fe1)="1f00000002031900000007000000068100ed853b09000100010100ff3ffe58", 0x1f}], 0x1) r1 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer\x00', 0x2, 0x0) setsockopt$inet6_MRT6_ADD_MIF(r1, 0x29, 0xca, &(0x7f0000000080)={0x72e, 0x1, 0x855, 0x7, 0x7}, 0xc) r2 = socket$netlink(0x10, 0x3, 0xc) writev(r2, &(0x7f0000fb5ff0)=[{&(0x7f00000000c0)="1f000000030319000000070000009f2a438f958b068100022b050900010001", 0x1f}], 0x1) ioctl$sock_SIOCGSKNS(r0, 0x894c, &(0x7f0000000000)=0x23a) 2018/05/12 22:57:17 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x1c, 0x0, &(0x7f0000000040)=[@request_death={0x400c630e, 0x0, 0x9510000000000000}, @free_buffer={0x40086303}], 0x0, 0x0, &(0x7f0000000080)}) 2018/05/12 22:57:17 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf0ffffffffffff], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) 2018/05/12 22:57:17 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x11, &(0x7f0000000140)}, 0x0) 2018/05/12 22:57:17 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='dctcp\x00', 0x6) sendto$inet6(r0, &(0x7f00004e8000), 0xf401, 0x20000001, &(0x7f000007f000)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfc]}}, 0x1c) 2018/05/12 22:57:17 executing program 3: io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r0, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x12, 0x1, 0x0, 0xffffffffffffffff, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:57:17 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x3c00, [0x0, 0x0, 0x252]}) 2018/05/12 22:57:17 executing program 3: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x0, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x12, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:57:17 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x32, &(0x7f0000000140)}, 0x0) 2018/05/12 22:57:17 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0x31, 0x0, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:57:17 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffff000], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) [ 716.869326] binder: 18947:18949 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 716.895723] netlink: 11 bytes leftover after parsing attributes in process `syz-executor5'. [ 716.909646] binder: 18947:18949 BC_FREE_BUFFER u0000000000000000 no match [ 716.951849] netlink: 11 bytes leftover after parsing attributes in process `syz-executor5'. 2018/05/12 22:57:17 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0xffffff89, [0x0, 0x0, 0x252]}) 2018/05/12 22:57:17 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f000090cfed)='/dev/snd/controlC#\x00', 0x0, 0x1) ioctl$SNDRV_CTL_IOCTL_PCM_INFO(r0, 0xc1205531, &(0x7f0000000280)={0x0, 0x7, 0x0, 0x0, [], [], [], 0x0, 0x0, 0x0, 0x0, "d01340146ea4e8adc2afa0136a50bbc3"}) [ 716.998256] binder: 18947:18964 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 717.020510] binder: 18947:18964 BC_FREE_BUFFER u0000000000000000 no match 2018/05/12 22:57:17 executing program 3: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0x0, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x12, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:57:18 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0x3, 0x0, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:57:18 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0xffffff84, &(0x7f0000000140)}, 0x0) 2018/05/12 22:57:18 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf000000], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) 2018/05/12 22:57:18 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x1c, 0x0, &(0x7f0000000040)=[@request_death={0x400c630e, 0x0, 0x68000000}, @free_buffer={0x40086303}], 0x0, 0x0, &(0x7f0000000080)}) 2018/05/12 22:57:18 executing program 5: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x4e23, 0x0, @loopback={0x0, 0x1}}, 0x1c) listen(r0, 0x3) r1 = socket$inet6_sctp(0xa, 0x4000000000000001, 0x84) sendto$inet6(r1, &(0x7f0000000280)="beebe3da3b34e3b5aabdaafe9e48", 0x0, 0x40, &(0x7f00000002c0)={0xa, 0x4e24, 0x0, @loopback={0x0, 0x1}, 0x1ff}, 0x10) r2 = accept(r0, 0x0, &(0x7f00000000c0)) getsockopt$inet_sctp_SCTP_SOCKOPT_PEELOFF(r2, 0x84, 0x66, &(0x7f0000000000)={0x0, 0x100}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r1, 0x84, 0x22, &(0x7f0000000100)={0x6, 0x9, 0xd230, 0xffffffff, r3}, 0x10) fsync(r2) r4 = dup2(r2, r0) ioctl$KVM_REINJECT_CONTROL(r4, 0xae71, &(0x7f0000000080)={0x8}) setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x1a, &(0x7f00009b2ff0)={0x1, &(0x7f0000a7dff8)=[{0x6, 0x0, 0x0, 0x400000000000003}]}, 0x10) ioctl$sock_SIOCETHTOOL(r1, 0x8946, &(0x7f00000001c0)={'ip6_vti0\x00', &(0x7f0000000140)=ANY=[@ANYBLOB="3a00000206000000060000000400000009000001010000000800000009000000050000000900007f00000084a61c2003000000090000000700000002000000010100001f000000090000001f000000ffff0000050000000000000000000000000000000000000000"]}) sendmsg$kcm(r2, &(0x7f0000001480)={0x0, 0x0, &(0x7f0000000240)=[{&(0x7f0000000200)='R', 0x1}], 0x1, &(0x7f0000000280)}, 0x8091) shutdown(r1, 0x2000000002) 2018/05/12 22:57:18 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x6, [0x0, 0x0, 0x252]}) 2018/05/12 22:57:18 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='dctcp\x00', 0x6) sendto$inet6(r0, &(0x7f00004e8000), 0xf401, 0x20000001, &(0x7f000007f000)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf5ffffff00000000]}}, 0x1c) 2018/05/12 22:57:18 executing program 3: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(0x0, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x12, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) [ 717.836859] binder: 19006:19008 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 2018/05/12 22:57:18 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x6, &(0x7f0000000140)}, 0x0) 2018/05/12 22:57:18 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x3000000, [0x0, 0x0, 0x252]}) 2018/05/12 22:57:18 executing program 3: openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r0, 0x0, &(0x7f0000000080)) 2018/05/12 22:57:18 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9effffff], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) [ 717.881429] binder: 19006:19008 BC_FREE_BUFFER u0000000000000000 no match 2018/05/12 22:57:18 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0x23, 0x0, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:57:18 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='dctcp\x00', 0x6) sendto$inet6(r0, &(0x7f00004e8000), 0xf401, 0x20000001, &(0x7f000007f000)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5400000000000000]}}, 0x1c) [ 717.936096] binder: 19006:19025 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 2018/05/12 22:57:18 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1000000, &(0x7f0000000140)}, 0x0) [ 717.994150] binder: 19006:19025 BC_FREE_BUFFER u0000000000000000 no match 2018/05/12 22:57:18 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x300, [0x0, 0x0, 0x252]}) 2018/05/12 22:57:18 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0x2, 0x0, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:57:18 executing program 3: openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r0, 0x0, &(0x7f0000000080)) 2018/05/12 22:57:19 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) 2018/05/12 22:57:19 executing program 5: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="c6295e4eca6c09b612ec6f") setsockopt$inet_buf(r0, 0x0, 0x2e, &(0x7f0000000000)="5c93d981acc7555a7c087e2530b90acc7fff47caa50107809601ee3f45d8c22e65cfb4d597a03676289aea91f038d48520cec5222a3ab8d80a3e3431779f21ad452b", 0x42) syz_open_dev$mouse(&(0x7f0000000140)='/dev/input/mouse#\x00', 0xfff, 0x4000) r1 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000640)='/selinux/enforce\x00', 0x20202, 0x0) socketpair$inet6(0xa, 0x4, 0x7, &(0x7f0000000180)) rt_sigprocmask(0x1, &(0x7f0000000080)={0x8}, &(0x7f0000000100), 0x8) write$binfmt_elf32(r1, &(0x7f00000000c0)=ANY=[@ANYBLOB="97"], 0x1) fadvise64(r1, 0x0, 0x0, 0x4) 2018/05/12 22:57:19 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='dctcp\x00', 0x6) sendto$inet6(r0, &(0x7f00004e8000), 0xf401, 0x20000001, &(0x7f000007f000)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb6c78c06]}}, 0x1c) 2018/05/12 22:57:19 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x2b00, [0x0, 0x0, 0x252]}) 2018/05/12 22:57:19 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x1c, 0x0, &(0x7f0000000040)=[@request_death={0x400c630e, 0x0, 0x9410}, @free_buffer={0x40086303}], 0x0, 0x0, &(0x7f0000000080)}) 2018/05/12 22:57:19 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x33, &(0x7f0000000140)}, 0x0) 2018/05/12 22:57:19 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0x4, 0x0, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:57:19 executing program 3: openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r0, 0x0, &(0x7f0000000080)) 2018/05/12 22:57:19 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x33, [0x0, 0x0, 0x252]}) [ 718.956974] binder: 19073:19074 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 2018/05/12 22:57:19 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8a9], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) 2018/05/12 22:57:19 executing program 3: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x12, 0x0, 0x0, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:57:19 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x8, &(0x7f0000000140)}, 0x0) [ 719.001745] binder: 19073:19074 BC_FREE_BUFFER u0000000000000000 no match 2018/05/12 22:57:19 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0x1300, 0x0, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:57:19 executing program 5: r0 = syz_open_dev$sndpcmc(&(0x7f0000002fee)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) setsockopt$bt_l2cap_L2CAP_LM(0xffffffffffffffff, 0x6, 0x3, &(0x7f0000000000)=0x62, 0x4) ioctl(r0, 0x3ff, &(0x7f0000000040)="ba11943fbb0a3e57939ff064a46bc511697dbe1480d8b0828d3a589f3aebd90de10abdbefafd9a696a1b921b3745472e") 2018/05/12 22:57:19 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0xffffffffffffffff, 0x0, 0x252]}) [ 719.080896] binder: 19073:19101 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 719.116304] binder: 19073:19101 BC_FREE_BUFFER u0000000000000000 no match 2018/05/12 22:57:19 executing program 3: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x12, 0x1, 0x0, 0xffffffffffffffff, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:57:20 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf00000000000000], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) 2018/05/12 22:57:20 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x21, &(0x7f0000000140)}, 0x0) 2018/05/12 22:57:20 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0x3700, 0x0, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:57:20 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x1c, 0x0, &(0x7f0000000040)=[@request_death={0x400c630e, 0x0, 0x6c}, @free_buffer={0x40086303}], 0x0, 0x0, &(0x7f0000000080)}) 2018/05/12 22:57:20 executing program 5: r0 = socket(0xa, 0x6, 0x0) ioctl(r0, 0x8912, &(0x7f0000000040)="c626262c8523bf012cf66f") r1 = syz_open_dev$random(&(0x7f0000000000)='/dev/random\x00', 0x0, 0x0) ppoll(&(0x7f0000000080)=[{r1}], 0x1, &(0x7f00000000c0)={0x0, 0x989680}, &(0x7f0000000100), 0x8) ioctl$sock_SIOCADDDLCI(r0, 0x8980, &(0x7f0000000140)={'syz_tun\x00', 0x8}) 2018/05/12 22:57:20 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0x3c, 0x0, 0x252]}) 2018/05/12 22:57:20 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='dctcp\x00', 0x6) sendto$inet6(r0, &(0x7f00004e8000), 0xf401, 0x20000001, &(0x7f000007f000)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe00]}}, 0x1c) 2018/05/12 22:57:20 executing program 3 (fault-call:2 fault-nth:0): r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x12, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) [ 719.920197] FAULT_INJECTION: forcing a failure. [ 719.920197] name failslab, interval 1, probability 0, space 0, times 0 [ 719.931578] CPU: 1 PID: 19129 Comm: syz-executor3 Not tainted 4.17.0-rc4+ #44 [ 719.938872] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 719.948243] Call Trace: [ 719.950864] dump_stack+0x1b9/0x294 [ 719.954288] binder: 19127:19131 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 719.954519] ? dump_stack_print_info.cold.2+0x52/0x52 [ 719.966871] should_fail.cold.4+0xa/0x1a [ 719.970963] ? zap_class+0x720/0x720 [ 719.974722] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 719.974977] binder: 19127:19131 BC_FREE_BUFFER u0000000000000000 no match [ 719.979853] ? graph_lock+0x170/0x170 [ 719.979886] ? find_held_lock+0x36/0x1c0 [ 719.979923] ? check_same_owner+0x320/0x320 [ 719.979936] ? lock_release+0xa10/0xa10 [ 719.979956] ? rcu_note_context_switch+0x710/0x710 [ 719.979972] ? trace_hardirqs_on_caller+0x421/0x5c0 [ 719.979990] __should_failslab+0x124/0x180 [ 719.980030] should_failslab+0x9/0x14 [ 719.980048] kmem_cache_alloc+0x2af/0x760 [ 719.980076] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 720.019753] binder: 19127:19150 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 720.021244] ? _copy_from_user+0xdf/0x150 [ 720.021265] do_io_submit+0x3fd/0x1980 [ 720.021291] ? free_ioctx_users+0x6b0/0x6b0 [ 720.021320] ? __sb_end_write+0xac/0xe0 [ 720.044929] binder: 19127:19150 BC_FREE_BUFFER u0000000000000000 no match [ 720.046676] ? ksys_write+0x1a6/0x250 [ 720.046708] __x64_sys_io_submit+0x75/0xb0 [ 720.046722] ? __x64_sys_io_submit+0x75/0xb0 [ 720.046738] do_syscall_64+0x1b1/0x800 [ 720.046757] ? syscall_slow_exit_work+0x4f0/0x4f0 [ 720.083169] ? syscall_return_slowpath+0x5c0/0x5c0 [ 720.088138] ? syscall_return_slowpath+0x30f/0x5c0 [ 720.093090] ? entry_SYSCALL_64_after_hwframe+0x59/0xbe [ 720.098488] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 720.103364] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 720.108583] RIP: 0033:0x455979 [ 720.111779] RSP: 002b:00007f262d5fbc68 EFLAGS: 00000246 ORIG_RAX: 00000000000000d1 2018/05/12 22:57:20 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0x8, 0x0, 0x252]}) 2018/05/12 22:57:20 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x4, &(0x7f0000000140)}, 0x0) 2018/05/12 22:57:20 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='dctcp\x00', 0x6) sendto$inet6(r0, &(0x7f00004e8000), 0xf401, 0x20000001, &(0x7f000007f000)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5]}}, 0x1c) 2018/05/12 22:57:20 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0x100000000000000, 0x0, 0x252]}) 2018/05/12 22:57:20 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9effffff00000000], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) [ 720.119501] RAX: ffffffffffffffda RBX: 00007f262d5fc6d4 RCX: 0000000000455979 [ 720.126769] RDX: 0000000020000080 RSI: 0000000000000001 RDI: 00007f262d5ab000 [ 720.134040] RBP: 000000000072bea0 R08: 0000000000000000 R09: 0000000000000000 [ 720.141300] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000014 [ 720.148560] R13: 000000000000018e R14: 00000000006f65f0 R15: 0000000000000000 2018/05/12 22:57:21 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1300, &(0x7f0000000140)}, 0x0) 2018/05/12 22:57:21 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0x5, 0x0, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:57:21 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0x1000000, 0x0, 0x252]}) 2018/05/12 22:57:21 executing program 5: r0 = openat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0x9e7ec3953eaa8dab) ioctl$sock_bt(r0, 0x541b, &(0x7f0000000040)="812c343493b68dba66c5a87917fa40d3e49b0add043375f6b53a15c8359533577d8e7b040d176559b198339c2b62af62c8df870565c78fd6175f9f96624f12882f95ab0031fe179af0dd326382d0b469") bpf$OBJ_PIN_MAP(0x6, &(0x7f0000000100)={&(0x7f00000000c0)='./file0\x00', r0}, 0x10) bind$unix(r0, &(0x7f0000000140)=@file={0x1, './file0\x00'}, 0x6e) ioctl$KVM_IRQ_LINE(r0, 0x4008ae61, &(0x7f00000001c0)={0x10000, 0x7}) setxattr(&(0x7f0000000200)='./file0/file0\x00', &(0x7f0000000240)=@random={'os2.', '@\x00'}, &(0x7f0000000280)='GPL!wlan0@:\x00', 0xc, 0x1) getresuid(&(0x7f0000000340), &(0x7f0000000380)=0x0, &(0x7f00000003c0)) lstat(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = syz_fuseblk_mount(&(0x7f00000002c0)='./file0/file0\x00', &(0x7f0000000300)='./file0/file0\x00', 0xa000, r1, r2, 0x9, 0x1, 0x440) ioctl$TCXONC(r0, 0x540a, 0x7f) ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f00000004c0)={0x80, 0x0, 0x1, 0x81}) ioctl$DRM_IOCTL_AGP_BIND(r0, 0x40106436, &(0x7f0000000500)={r4, 0x6}) r5 = semget(0x1, 0x3, 0x8) semctl$GETPID(r5, 0x3, 0xb, &(0x7f0000000540)=""/222) write$binfmt_script(r3, &(0x7f0000000640)={'#! ', './file0/file0', [{0x20, 'eth1cgroup&system+'}, {0x20, '@\x00'}, {0x20, 'GPL!wlan0@:\x00'}, {0x20, 'os2.'}, {0x20, 'systemselfsecurity(vboxnet0.}GPLvboxnet1'}, {0x20, '@\x00'}], 0xa, "390b5ecac9977cf5a12b2475dde3bb357b5c73a6793bdcbcf61ad0e1d54f6436a688a0e80647ae2844010ac9ff95f75c82a8183fe68bc13db9b45a78db9a64dc8c1a7dbdbc2a90e4f78d31908d2b74d2a9a0294ca6128dafeff6e11891093e621cd593823b72548c180374b86c894ea836c6bbbdcf19636ac237f71a4bce039849ca6a427f91b1fb1d409115f4364f2f12e0456cb56b59637d958dc641a9f16f503492108d2019625bbad0c52004ca22b9fe2cb90b9889cfdd4c2f09431aeadee08b74abecbf63a472d480"}, 0x130) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(r0, 0x84, 0x1d, &(0x7f0000000780)={0x1, [0x0]}, &(0x7f00000007c0)=0x8) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(r0, 0x84, 0x13, &(0x7f0000000800)={r6, 0x7}, &(0x7f0000000840)=0x8) clock_gettime(0x0, &(0x7f0000000880)={0x0, 0x0}) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_STATUS(r0, 0xc05c5340, &(0x7f00000008c0)={0x32b, 0x2, 0x1f, {r8, r9+10000000}, 0x4, 0x6}) getsockopt$inet_sctp_SCTP_GET_ASSOC_STATS(r0, 0x84, 0x70, &(0x7f0000000940)={r6, @in6={{0xa, 0x4e21, 0x1, @mcast2={0xff, 0x2, [], 0x1}, 0x8}}, [0xffff, 0x0, 0x60, 0x8eaf, 0x7fff, 0x1, 0x10001, 0x0, 0x8, 0xee, 0x9, 0xaf, 0x7ff, 0x200, 0x20]}, &(0x7f0000000a40)=0x100) set_thread_area(&(0x7f0000000a80)={0x200, 0x100000, 0xffffffff, 0x6, 0x59b5, 0xfffffffffffffffe, 0x7, 0x3ff, 0x800, 0x2}) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000ac0)='illinois\x00', 0x9) ioctl$sock_inet_SIOCSIFNETMASK(r0, 0x891c, &(0x7f0000000b00)={'dummy0\x00', {0x2, 0x4e22}}) setsockopt$RDS_CONG_MONITOR(r0, 0x114, 0x6, &(0x7f0000000b40), 0x4) setsockopt$inet_sctp_SCTP_AUTH_DEACTIVATE_KEY(r0, 0x84, 0x23, &(0x7f0000000b80)={r7, 0x1}, 0x8) ioctl$SNDRV_TIMER_IOCTL_STOP(r0, 0x54a1) ioctl$GIO_FONTX(r0, 0x4b6b, &(0x7f0000000bc0)=""/127) r10 = syz_open_dev$usbmon(&(0x7f0000000c40)='/dev/usbmon#\x00', 0x8001, 0x80) ioctl$KVM_S390_UCAS_MAP(r10, 0x4018ae50, &(0x7f0000000c80)={0x0, 0x6, 0x1}) bind$unix(r10, &(0x7f0000000cc0)=@abs={0x1, 0x0, 0x4e21}, 0x6e) 2018/05/12 22:57:21 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x1c, 0x0, &(0x7f0000000040)=[@request_death={0x400c630e, 0x0, 0x94100000}, @free_buffer={0x40086303}], 0x0, 0x0, &(0x7f0000000080)}) 2018/05/12 22:57:21 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200000000000000], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) 2018/05/12 22:57:21 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='dctcp\x00', 0x6) sendto$inet6(r0, &(0x7f00004e8000), 0xf401, 0x20000001, &(0x7f000007f000)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf5ffffff]}}, 0x1c) 2018/05/12 22:57:21 executing program 3 (fault-call:2 fault-nth:1): r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x12, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:57:21 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100000000000000], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) [ 721.036523] FAULT_INJECTION: forcing a failure. [ 721.036523] name failslab, interval 1, probability 0, space 0, times 0 [ 721.047927] CPU: 1 PID: 19193 Comm: syz-executor3 Not tainted 4.17.0-rc4+ #44 [ 721.055222] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 721.064591] Call Trace: [ 721.067204] dump_stack+0x1b9/0x294 [ 721.070862] ? dump_stack_print_info.cold.2+0x52/0x52 [ 721.076095] ? reacquire_held_locks+0xbc/0x3e0 [ 721.080702] ? alloc_set_pte+0x1013/0x1600 2018/05/12 22:57:21 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0x2100000000000000, 0x0, 0x252]}) 2018/05/12 22:57:21 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x6c, &(0x7f0000000140)}, 0x0) [ 721.084975] should_fail.cold.4+0xa/0x1a [ 721.089062] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 721.094191] ? lock_downgrade+0x8e0/0x8e0 [ 721.098364] ? graph_lock+0x170/0x170 [ 721.102185] ? rcu_is_watching+0x85/0x140 [ 721.106356] ? rcu_bh_force_quiescent_state+0x20/0x20 [ 721.111569] ? __lock_is_held+0xb5/0x140 [ 721.115661] ? check_same_owner+0x320/0x320 [ 721.120008] ? rcu_note_context_switch+0x710/0x710 [ 721.124961] ? check_noncircular+0x20/0x20 [ 721.129226] __should_failslab+0x124/0x180 [ 721.133488] should_failslab+0x9/0x14 [ 721.137313] kmem_cache_alloc+0x2af/0x760 [ 721.141497] jbd2__journal_start+0x1d3/0xa70 [ 721.145937] ? jbd2_write_access_granted.part.8+0x420/0x420 [ 721.152242] ? rcu_note_context_switch+0x710/0x710 [ 721.157204] ? __might_sleep+0x95/0x190 [ 721.161215] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 721.166794] __ext4_journal_start_sb+0x17a/0x5e0 [ 721.171584] ? ext4_dirty_inode+0x62/0xc0 [ 721.175768] ? ext4_journal_abort_handle.isra.4+0x260/0x260 [ 721.181514] ? __lock_is_held+0xb5/0x140 2018/05/12 22:57:21 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfcffffff], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) 2018/05/12 22:57:21 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0x2b00000000000000, 0x0, 0x252]}) 2018/05/12 22:57:21 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0xffffff88, &(0x7f0000000140)}, 0x0) [ 721.185623] ? ext4_setattr+0x2ac0/0x2ac0 [ 721.189796] ext4_dirty_inode+0x62/0xc0 [ 721.193798] __mark_inode_dirty+0x811/0x1530 [ 721.198233] ? __inode_attach_wb+0x1310/0x1310 [ 721.202866] ? print_usage_bug+0xc0/0xc0 [ 721.206947] ? kasan_check_read+0x11/0x20 [ 721.211123] ? print_usage_bug+0xc0/0xc0 [ 721.215216] ? lock_downgrade+0x8e0/0x8e0 [ 721.219390] ? lock_release+0xa10/0xa10 [ 721.223391] ? mark_held_locks+0xc9/0x160 [ 721.227566] ? current_kernel_time64+0x242/0x2f0 [ 721.232350] ? trace_hardirqs_on_caller+0x421/0x5c0 [ 721.237392] ? __sanitizer_cov_trace_cmp4+0x16/0x20 [ 721.242434] ? current_kernel_time64+0x1f4/0x2f0 [ 721.247218] generic_update_time+0x255/0x420 [ 721.251650] ? put_itimerspec64+0x310/0x310 [ 721.256000] ? dentry_needs_remove_privs.part.24+0x70/0x70 [ 721.261645] ? ext4_file_write_iter+0x299/0x1420 [ 721.266446] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 721.272005] ? mnt_clone_write+0xed/0x130 [ 721.276209] ? dentry_needs_remove_privs.part.24+0x70/0x70 [ 721.281854] file_update_time+0x384/0x640 [ 721.286033] ? current_time+0xc0/0xc0 [ 721.289855] ? __lock_acquire+0x7f5/0x5140 [ 721.294118] ? __sanitizer_cov_trace_cmp8+0x18/0x20 [ 721.299175] ? generic_write_checks+0x37d/0x5b0 [ 721.304043] ? page_endio+0x610/0x610 [ 721.307858] ? down_write_trylock+0xd4/0x150 [ 721.312298] __generic_file_write_iter+0x1dc/0x630 [ 721.317258] ext4_file_write_iter+0x388/0x1420 [ 721.321858] ? __kernel_text_address+0xd/0x40 [ 721.326410] ? ext4_file_mmap+0x410/0x410 [ 721.330582] ? lock_acquire+0x1dc/0x520 [ 721.334572] ? aio_write+0x4ed/0x5e0 [ 721.338309] ? __lock_is_held+0xb5/0x140 [ 721.342398] ? rcu_read_lock_sched_held+0x108/0x120 [ 721.347458] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 721.353016] ? __sb_start_write+0x17f/0x300 [ 721.357364] aio_write+0x37e/0x5e0 [ 721.360933] ? aio_complete+0xff0/0xff0 [ 721.364778] binder: 19179:19180 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 721.365020] ? lock_release+0xa10/0xa10 [ 721.372523] binder: 19179:19180 BC_FREE_BUFFER u0000000000000000 no match [ 721.376122] ? check_same_owner+0x320/0x320 [ 721.376147] ? __might_sleep+0x95/0x190 [ 721.376167] ? __sanitizer_cov_trace_switch+0x53/0x90 [ 721.376186] do_io_submit+0x14cc/0x1980 [ 721.376212] ? free_ioctx_users+0x6b0/0x6b0 [ 721.376240] ? __sb_end_write+0xac/0xe0 [ 721.376259] ? ksys_write+0x1a6/0x250 [ 721.386333] binder: 19179:19220 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 721.388754] ? syscall_slow_exit_work+0x4f0/0x4f0 [ 721.388778] __x64_sys_io_submit+0x75/0xb0 [ 721.388790] ? __x64_sys_io_submit+0x75/0xb0 [ 721.388807] do_syscall_64+0x1b1/0x800 [ 721.388829] ? finish_task_switch+0x1ca/0x810 [ 721.393067] binder: 19179:19220 BC_FREE_BUFFER u0000000000000000 no match [ 721.398018] ? syscall_return_slowpath+0x5c0/0x5c0 [ 721.398036] ? syscall_return_slowpath+0x30f/0x5c0 [ 721.398057] ? entry_SYSCALL_64_after_hwframe+0x59/0xbe [ 721.398077] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 721.398098] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 721.398108] RIP: 0033:0x455979 [ 721.398121] RSP: 002b:00007f262d5fbc68 EFLAGS: 00000246 ORIG_RAX: 00000000000000d1 [ 721.486078] RAX: ffffffffffffffda RBX: 00007f262d5fc6d4 RCX: 0000000000455979 [ 721.493349] RDX: 0000000020000080 RSI: 0000000000000001 RDI: 00007f262d5ab000 [ 721.500617] RBP: 000000000072bea0 R08: 0000000000000000 R09: 0000000000000000 [ 721.507884] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000014 [ 721.515149] R13: 000000000000018e R14: 00000000006f65f0 R15: 0000000000000001 2018/05/12 22:57:22 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0x89ffffff00000000, 0x0, 0x252]}) 2018/05/12 22:57:22 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x3, &(0x7f0000000140)}, 0x0) 2018/05/12 22:57:22 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) 2018/05/12 22:57:22 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x1c, 0x0, &(0x7f0000000040)=[@request_death={0x400c630e, 0x0, 0x6c00}, @free_buffer={0x40086303}], 0x0, 0x0, &(0x7f0000000080)}) 2018/05/12 22:57:22 executing program 5: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000f6bfe8)={0xaa}) r1 = accept$ax25(0xffffffffffffff9c, &(0x7f00000000c0), &(0x7f0000000100)=0x10) getsockopt$sock_buf(r1, 0x1, 0x37, &(0x7f0000000140)=""/70, &(0x7f00000001c0)=0x46) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f000072f000)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1}) sigaltstack(&(0x7f00005fc000/0x2000)=nil, 0x0) r2 = syz_open_dev$sndpcmp(&(0x7f0000000200)='/dev/snd/pcmC#D#p\x00', 0x5, 0x4000) renameat(r2, &(0x7f0000000000)='./file0\x00', r2, &(0x7f0000000280)='./file0\x00') r3 = openat$cgroup_ro(r2, &(0x7f0000000240)='cpuacct.usage_sys\x00', 0x0, 0x0) setsockopt$inet6_tcp_buf(r3, 0x6, 0x1f, &(0x7f0000000040)="e617d6351774a39d5b3fa2f1bff30c953a70b3c396cb128edc555e50d1b7a75dcbac2a96c1e36f0a45fcfb52cc9a0285b5a1bbc83149bbd1772493ff27df3494b38db89834262e52700ce5ed9584eab760c159789321294d7e087d6f7807fe0b31c09fe4b0e68c24fee72d3353d29bdb", 0x70) ioctl$VHOST_SET_VRING_CALL(r2, 0x4008af21, &(0x7f00000002c0)={0x2, r2}) ioctl$UFFDIO_REGISTER(r0, 0xc028aa03, &(0x7f00000a0fe0)={{&(0x7f00005e3000/0x800000)=nil, 0x800000}, 0x200000}) 2018/05/12 22:57:22 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='dctcp\x00', 0x6) sendto$inet6(r0, &(0x7f00004e8000), 0xf401, 0x20000001, &(0x7f000007f000)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2]}}, 0x1c) 2018/05/12 22:57:22 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0xffff8801d0ecc660, 0x0, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:57:22 executing program 3 (fault-call:2 fault-nth:2): r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x12, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) [ 722.019083] FAULT_INJECTION: forcing a failure. [ 722.019083] name failslab, interval 1, probability 0, space 0, times 0 [ 722.030602] CPU: 1 PID: 19243 Comm: syz-executor3 Not tainted 4.17.0-rc4+ #44 [ 722.037933] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 722.047415] Call Trace: [ 722.050031] dump_stack+0x1b9/0x294 [ 722.053683] ? dump_stack_print_info.cold.2+0x52/0x52 [ 722.058897] should_fail.cold.4+0xa/0x1a [ 722.062978] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 722.068091] ? timer_reduce+0x15a0/0x15a0 [ 722.072235] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 722.076996] ? graph_lock+0x170/0x170 [ 722.080798] ? retint_kernel+0x10/0x10 [ 722.084685] ? find_held_lock+0x36/0x1c0 [ 722.088755] ? __lock_is_held+0xb5/0x140 [ 722.092824] ? check_same_owner+0x320/0x320 [ 722.097139] ? find_held_lock+0x36/0x1c0 [ 722.101199] ? rcu_note_context_switch+0x710/0x710 [ 722.106128] __should_failslab+0x124/0x180 [ 722.110378] should_failslab+0x9/0x14 [ 722.114175] kmem_cache_alloc+0x2af/0x760 [ 722.118328] jbd2__journal_start+0x1d3/0xa70 [ 722.122737] ? jbd2_write_access_granted.part.8+0x420/0x420 [ 722.128450] ? rcu_note_context_switch+0x710/0x710 [ 722.133395] ? __might_sleep+0x95/0x190 [ 722.137377] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 722.142942] __ext4_journal_start_sb+0x17a/0x5e0 [ 722.147699] ? print_usage_bug+0xc0/0xc0 [ 722.151756] ? ext4_direct_IO+0xfe0/0x2110 [ 722.155991] ? ext4_journal_abort_handle.isra.4+0x260/0x260 [ 722.161704] ? __lock_is_held+0xb5/0x140 [ 722.165759] ? drbg_ctr_df+0x5e0/0x2080 [ 722.169740] ext4_direct_IO+0xfe0/0x2110 [ 722.173796] ? lock_release+0xa10/0xa10 [ 722.177787] ? ext4_iomap_end+0x800/0x800 [ 722.181953] ? __sanitizer_cov_trace_cmp4+0x16/0x20 [ 722.186970] ? current_kernel_time64+0x1f4/0x2f0 [ 722.191729] ? generic_update_time+0x255/0x420 [ 722.196317] ? put_itimerspec64+0x310/0x310 [ 722.200636] ? dentry_needs_remove_privs.part.24+0x70/0x70 [ 722.206259] ? ext4_file_write_iter+0x299/0x1420 [ 722.211796] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 722.217331] ? mnt_clone_write+0xed/0x130 [ 722.221481] ? __mnt_drop_write_file+0xd/0x70 [ 722.225974] ? file_update_time+0xdc/0x640 [ 722.230218] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 722.235764] ? filemap_check_errors+0xd8/0x110 [ 722.240354] generic_file_direct_write+0x275/0x4b0 [ 722.245305] __generic_file_write_iter+0x2ff/0x630 [ 722.250256] ext4_file_write_iter+0x388/0x1420 [ 722.254834] ? __kernel_text_address+0xd/0x40 [ 722.259333] ? ext4_file_mmap+0x410/0x410 [ 722.263478] ? lock_acquire+0x1dc/0x520 [ 722.267443] ? aio_write+0x4ed/0x5e0 [ 722.271164] ? __lock_is_held+0xb5/0x140 [ 722.275305] ? drbg_ctr_df+0xaa8/0x2080 [ 722.279280] ? rcu_read_lock_sched_held+0x108/0x120 [ 722.284293] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 722.289823] ? __sb_start_write+0x17f/0x300 [ 722.294141] aio_write+0x37e/0x5e0 [ 722.297680] ? aio_complete+0xff0/0xff0 [ 722.301662] ? lock_release+0xa10/0xa10 [ 722.305631] ? check_same_owner+0x320/0x320 [ 722.309951] ? kasan_check_read+0x11/0x20 [ 722.314095] ? __might_sleep+0x95/0x190 [ 722.318066] ? __sanitizer_cov_trace_switch+0x53/0x90 [ 722.323249] do_io_submit+0x14cc/0x1980 [ 722.327240] ? free_ioctx_users+0x6b0/0x6b0 [ 722.331569] ? __sb_end_write+0xac/0xe0 [ 722.335552] ? ksys_write+0x1a6/0x250 [ 722.339360] ? syscall_slow_exit_work+0x4f0/0x4f0 [ 722.344482] __x64_sys_io_submit+0x75/0xb0 [ 722.348729] ? __x64_sys_io_submit+0x75/0xb0 [ 722.353140] do_syscall_64+0x1b1/0x800 [ 722.357031] ? finish_task_switch+0x1ca/0x810 [ 722.361527] ? syscall_return_slowpath+0x5c0/0x5c0 [ 722.366454] ? syscall_return_slowpath+0x30f/0x5c0 [ 722.371398] ? entry_SYSCALL_64_after_hwframe+0x59/0xbe [ 722.376764] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 722.381614] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 722.386795] RIP: 0033:0x455979 [ 722.389983] RSP: 002b:00007f262d5fbc68 EFLAGS: 00000246 ORIG_RAX: 00000000000000d1 [ 722.397804] RAX: ffffffffffffffda RBX: 00007f262d5fc6d4 RCX: 0000000000455979 [ 722.405066] RDX: 0000000020000080 RSI: 0000000000000001 RDI: 00007f262d5ab000 [ 722.412333] RBP: 000000000072bea0 R08: 0000000000000000 R09: 0000000000000000 2018/05/12 22:57:23 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0x6000000, 0x0, 0x252]}) 2018/05/12 22:57:23 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0x12, 0x0, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:57:23 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffff000], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) [ 722.419597] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000014 [ 722.426857] R13: 000000000000018e R14: 00000000006f65f0 R15: 0000000000000002 2018/05/12 22:57:23 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x5, &(0x7f0000000140)}, 0x0) 2018/05/12 22:57:23 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0x21000000, 0x0, 0x252]}) 2018/05/12 22:57:23 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x2f, &(0x7f0000000140)}, 0x0) 2018/05/12 22:57:23 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0xfdffffff, 0x0, 0x252]}) 2018/05/12 22:57:23 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0xf, 0x0, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:57:23 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6e573a59aa], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) 2018/05/12 22:57:23 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x2, &(0x7f0000000140)}, 0x0) 2018/05/12 22:57:23 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0x9, 0x0, r0, &(0x7f0000000000), 0xfe00}]) [ 722.762711] binder: 19236:19247 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 722.771878] binder: 19236:19247 BC_FREE_BUFFER u0000000000000000 no match [ 722.781659] binder: 19236:19292 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 722.789232] binder: 19236:19292 BC_FREE_BUFFER u0000000000000000 no match 2018/05/12 22:57:23 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0x3000000, 0x0, 0x252]}) 2018/05/12 22:57:23 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa00], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) 2018/05/12 22:57:23 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x7, &(0x7f0000000140)}, 0x0) 2018/05/12 22:57:23 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0x8, 0x0, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:57:23 executing program 3 (fault-call:2 fault-nth:3): r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x12, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:57:23 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x1c, 0x0, &(0x7f0000000040)=[@request_death={0x400c630e, 0x0, 0x9310}, @free_buffer={0x40086303}], 0x0, 0x0, &(0x7f0000000080)}) 2018/05/12 22:57:23 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='dctcp\x00', 0x6) sendto$inet6(r0, &(0x7f00004e8000), 0xf401, 0x20000001, &(0x7f000007f000)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x749521c200000000]}}, 0x1c) 2018/05/12 22:57:23 executing program 5: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r1 = syz_open_dev$sndmidi(&(0x7f0000000080)='/dev/snd/midiC#D#\x00', 0xe489, 0x200) r2 = syz_open_dev$dspn(&(0x7f00000000c0)='/dev/dsp#\x00', 0x5, 0x0) ioctl$sock_kcm_SIOCKCMATTACH(r1, 0x89e0, &(0x7f0000000100)={r0, r2}) setsockopt$inet6_MRT6_ADD_MFC_PROXY(r0, 0x29, 0xd2, &(0x7f00003a4000)={{0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [], 0x1}}, {0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [], 0x1}}}, 0x5c) setsockopt$inet6_MRT6_DEL_MFC(r0, 0x29, 0xcd, &(0x7f0000000140)={{0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [0x2000], 0x1}}, {0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [], 0x1}}}, 0x5c) nanosleep(&(0x7f0000000000)={0x77359400}, &(0x7f0000000040)) [ 722.987950] binder: 19301:19305 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 722.991592] FAULT_INJECTION: forcing a failure. [ 722.991592] name failslab, interval 1, probability 0, space 0, times 0 [ 723.006489] CPU: 1 PID: 19307 Comm: syz-executor3 Not tainted 4.17.0-rc4+ #44 [ 723.013971] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 723.023360] Call Trace: [ 723.025982] dump_stack+0x1b9/0x294 [ 723.029647] ? dump_stack_print_info.cold.2+0x52/0x52 [ 723.034862] ? print_usage_bug+0xc0/0xc0 [ 723.036476] binder: 19301:19305 BC_FREE_BUFFER u0000000000000000 no match [ 723.038971] should_fail.cold.4+0xa/0x1a [ 723.038993] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 723.039011] ? __lock_acquire+0x7f5/0x5140 [ 723.039026] ? perf_trace_lock+0xd6/0x900 [ 723.039043] ? print_usage_bug+0xc0/0xc0 [ 723.039061] ? graph_lock+0x170/0x170 [ 723.039081] ? print_usage_bug+0xc0/0xc0 [ 723.075618] ? debug_check_no_locks_freed+0x310/0x310 [ 723.080844] ? print_usage_bug+0xc0/0xc0 2018/05/12 22:57:23 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='dctcp\x00', 0x6) sendto$inet6(r0, &(0x7f00004e8000), 0xf401, 0x20000001, &(0x7f000007f000)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfec00000]}}, 0x1c) 2018/05/12 22:57:23 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0x3c00, 0x0, 0x252]}) [ 723.084935] ? find_held_lock+0x36/0x1c0 [ 723.089030] ? __lock_is_held+0xb5/0x140 [ 723.093126] ? check_same_owner+0x320/0x320 [ 723.095897] binder: 19301:19318 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 723.097463] ? rcu_note_context_switch+0x710/0x710 [ 723.097478] ? iov_iter_alignment+0x1f7/0xc10 [ 723.097503] __should_failslab+0x124/0x180 [ 723.097523] should_failslab+0x9/0x14 [ 723.097540] kmem_cache_alloc+0x2af/0x760 [ 723.097554] ? print_usage_bug+0xc0/0xc0 [ 723.097570] ? print_usage_bug+0xc0/0xc0 2018/05/12 22:57:23 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0x2b, 0x0, 0x252]}) [ 723.119328] binder: 19301:19318 BC_FREE_BUFFER u0000000000000000 no match [ 723.122125] do_blockdev_direct_IO+0x607/0x9e90 [ 723.122147] ? zap_class+0x720/0x720 [ 723.122162] ? write_end_fn+0xf0/0xf0 [ 723.122177] ? ext4_get_block_trans+0x2d0/0x2d0 [ 723.122204] ? do_direct_IO+0xc300/0xc300 [ 723.162451] ? print_usage_bug+0xc0/0xc0 [ 723.166529] ? debug_check_no_locks_freed+0x310/0x310 [ 723.171734] ? rcu_is_watching+0x85/0x140 [ 723.175919] ? find_held_lock+0x36/0x1c0 [ 723.180014] ? lock_downgrade+0x8e0/0x8e0 [ 723.184366] ? rcu_is_watching+0x85/0x140 [ 723.188554] ? rcu_bh_force_quiescent_state+0x20/0x20 [ 723.193769] ? rcu_bh_force_quiescent_state+0x20/0x20 [ 723.199017] ? is_bpf_text_address+0xd7/0x170 [ 723.203535] ? kernel_text_address+0x79/0xf0 [ 723.207940] ? __unwind_start+0x166/0x330 [ 723.212084] ? __kernel_text_address+0xd/0x40 [ 723.216577] ? unwind_get_return_address+0x61/0xa0 [ 723.221541] ? __save_stack_trace+0x7e/0xd0 [ 723.225884] ? save_stack+0xa9/0xd0 [ 723.229524] ? save_stack+0x43/0xd0 [ 723.233149] ? __kasan_slab_free+0x11a/0x170 [ 723.237639] ? kasan_slab_free+0xe/0x10 [ 723.241606] ? kmem_cache_free+0x86/0x2d0 [ 723.245751] ? jbd2_journal_stop+0x42e/0x15a0 [ 723.250263] ? __ext4_journal_stop+0xde/0x1f0 [ 723.254931] ? ext4_direct_IO+0x130e/0x2110 [ 723.259257] ? generic_file_direct_write+0x275/0x4b0 [ 723.264353] ? __generic_file_write_iter+0x2ff/0x630 [ 723.269447] ? ext4_file_write_iter+0x388/0x1420 [ 723.274196] ? aio_write+0x37e/0x5e0 [ 723.277901] ? do_io_submit+0x14cc/0x1980 [ 723.282039] ? __x64_sys_io_submit+0x75/0xb0 [ 723.286452] ? do_syscall_64+0x1b1/0x800 [ 723.290506] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 723.295877] ? kasan_check_read+0x11/0x20 [ 723.300026] ? do_raw_spin_unlock+0x9e/0x2e0 [ 723.304426] ? do_raw_spin_trylock+0x1b0/0x1b0 [ 723.308999] ? print_usage_bug+0xc0/0xc0 [ 723.313057] ? kasan_check_write+0x14/0x20 [ 723.317285] ? graph_lock+0x170/0x170 [ 723.321076] ? trace_hardirqs_off+0xd/0x10 [ 723.325304] ? _raw_spin_unlock_irqrestore+0x63/0xc0 [ 723.330407] ? debug_check_no_obj_freed+0x2ff/0x584 [ 723.335437] ? __lock_is_held+0xb5/0x140 [ 723.339558] ? bw_calcs+0x4048/0x7650 [ 723.343356] ? jbd2_journal_stop+0x42e/0x15a0 [ 723.347866] ? jbd2_journal_stop+0x42e/0x15a0 [ 723.352363] ? rcu_read_lock_sched_held+0x108/0x120 [ 723.357377] ? kmem_cache_free+0x25c/0x2d0 [ 723.361606] ? jbd2_journal_stop+0x22d/0x15a0 [ 723.366091] ? graph_lock+0x170/0x170 [ 723.369900] ? jbd2_buffer_abort_trigger+0x90/0x90 [ 723.374819] ? find_held_lock+0x36/0x1c0 [ 723.378918] ? up_write+0x72/0x210 [ 723.382455] ? ext4_get_block_trans+0x2d0/0x2d0 [ 723.387116] __blockdev_direct_IO+0x9d/0xc6 [ 723.391470] ? write_end_fn+0xf0/0xf0 [ 723.395262] ? ext4_get_block_trans+0x2d0/0x2d0 [ 723.399926] ext4_direct_IO+0xa91/0x2110 [ 723.403995] ? ext4_iomap_end+0x800/0x800 [ 723.408140] ? trace_hardirqs_on_caller+0x421/0x5c0 [ 723.413158] ? __sanitizer_cov_trace_cmp4+0x16/0x20 [ 723.418172] ? current_kernel_time64+0x1f4/0x2f0 [ 723.422924] ? generic_update_time+0x255/0x420 [ 723.427494] ? put_itimerspec64+0x310/0x310 [ 723.431823] ? dentry_needs_remove_privs.part.24+0x70/0x70 [ 723.437438] ? ext4_file_write_iter+0x299/0x1420 [ 723.442188] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 723.447717] ? mnt_clone_write+0xed/0x130 [ 723.451863] ? __mnt_drop_write_file+0xd/0x70 [ 723.456367] ? file_update_time+0xdc/0x640 [ 723.460601] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 723.466130] ? filemap_check_errors+0xd8/0x110 [ 723.470713] generic_file_direct_write+0x275/0x4b0 [ 723.475642] __generic_file_write_iter+0x2ff/0x630 [ 723.480569] ext4_file_write_iter+0x388/0x1420 [ 723.487611] ? __kernel_text_address+0xd/0x40 [ 723.492108] ? ext4_file_mmap+0x410/0x410 [ 723.496253] ? lock_acquire+0x1dc/0x520 [ 723.500234] ? aio_write+0x4ed/0x5e0 [ 723.503953] ? __lock_is_held+0xb5/0x140 [ 723.508005] ? bw_calcs+0x48d8/0x7650 [ 723.511811] ? rcu_read_lock_sched_held+0x108/0x120 [ 723.516830] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 723.522360] ? __sb_start_write+0x17f/0x300 [ 723.526680] aio_write+0x37e/0x5e0 [ 723.530218] ? aio_complete+0xff0/0xff0 [ 723.534197] ? lock_release+0xa10/0xa10 [ 723.538164] ? check_same_owner+0x320/0x320 [ 723.542483] ? __might_sleep+0x95/0x190 [ 723.547061] ? __sanitizer_cov_trace_switch+0x53/0x90 [ 723.552255] do_io_submit+0x14cc/0x1980 [ 723.556242] ? free_ioctx_users+0x6b0/0x6b0 [ 723.560834] ? __sb_end_write+0xac/0xe0 [ 723.564808] ? ksys_write+0x1a6/0x250 [ 723.568604] ? exit_aio+0x560/0x560 [ 723.572236] __x64_sys_io_submit+0x75/0xb0 [ 723.576469] ? __x64_sys_io_submit+0x75/0xb0 [ 723.580868] do_syscall_64+0x1b1/0x800 [ 723.584761] ? finish_task_switch+0x1ca/0x810 [ 723.589259] ? syscall_return_slowpath+0x5c0/0x5c0 [ 723.594184] ? syscall_return_slowpath+0x30f/0x5c0 [ 723.599118] ? entry_SYSCALL_64_after_hwframe+0x59/0xbe [ 723.604489] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 723.609503] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 723.614684] RIP: 0033:0x455979 [ 723.617864] RSP: 002b:00007f262d5fbc68 EFLAGS: 00000246 ORIG_RAX: 00000000000000d1 [ 723.625578] RAX: ffffffffffffffda RBX: 00007f262d5fc6d4 RCX: 0000000000455979 [ 723.632840] RDX: 0000000020000080 RSI: 0000000000000001 RDI: 00007f262d5ab000 [ 723.641275] RBP: 000000000072bea0 R08: 0000000000000000 R09: 0000000000000000 [ 723.648540] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000014 [ 723.655799] R13: 000000000000018e R14: 00000000006f65f0 R15: 0000000000000003 2018/05/12 22:57:24 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0x88ffffff00000000, 0x0, 0x252]}) 2018/05/12 22:57:24 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140), 0x18000000}, 0x0) 2018/05/12 22:57:24 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0x10, 0x0, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:57:24 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x1c, 0x0, &(0x7f0000000040)=[@request_death={0x400c630e}, @free_buffer={0x630c}], 0x0, 0x0, &(0x7f0000000080)}) 2018/05/12 22:57:24 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='dctcp\x00', 0x6) sendto$inet6(r0, &(0x7f00004e8000), 0xf401, 0x20000001, &(0x7f000007f000)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000]}}, 0x1c) 2018/05/12 22:57:24 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffff7f], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) [ 723.761753] binder: 19333:19335 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 723.769064] binder: 19333:19335 unknown command 0 2018/05/12 22:57:24 executing program 3 (fault-call:2 fault-nth:4): r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x12, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:57:24 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0x1, 0x1000000000000000, r0, &(0x7f0000000000), 0xfe00}]) [ 723.848812] binder: 19333:19335 ioctl c0306201 20000140 returned -22 [ 723.876174] FAULT_INJECTION: forcing a failure. [ 723.876174] name failslab, interval 1, probability 0, space 0, times 0 [ 723.887849] CPU: 1 PID: 19360 Comm: syz-executor3 Not tainted 4.17.0-rc4+ #44 [ 723.895149] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 723.904520] Call Trace: [ 723.907136] dump_stack+0x1b9/0x294 [ 723.910795] ? dump_stack_print_info.cold.2+0x52/0x52 [ 723.916014] ? _raw_spin_unlock_irqrestore+0x74/0xc0 [ 723.921146] should_fail.cold.4+0xa/0x1a [ 723.925232] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 723.930363] ? save_stack+0xa9/0xd0 [ 723.934018] ? kasan_kmalloc+0xc4/0xe0 [ 723.937926] ? kasan_slab_alloc+0x12/0x20 [ 723.942096] ? kmem_cache_alloc+0x12e/0x760 [ 723.946458] ? mempool_alloc_slab+0x44/0x60 [ 723.950800] ? mempool_alloc+0x18b/0x490 [ 723.954884] ? bio_alloc_bioset+0x3a1/0x7f0 [ 723.959221] ? ext4_bio_write_page+0xad5/0x1534 [ 723.963911] ? mpage_submit_page+0x15d/0x270 [ 723.968343] ? mpage_process_page_bufs+0x50c/0x600 [ 723.973293] ? mpage_prepare_extent_to_map+0x8fb/0x1100 [ 723.978677] ? ext4_writepages+0x13ff/0x4030 [ 723.983109] ? do_writepages+0x9a/0x1a0 [ 723.987106] ? __filemap_fdatawrite_range+0x333/0x470 [ 723.992323] ? filemap_write_and_wait_range+0x48/0xd0 [ 723.994318] binder: 19333:19365 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 723.997535] ? generic_file_direct_write+0x201/0x4b0 [ 723.997575] ? __generic_file_write_iter+0x2ff/0x630 [ 724.004743] binder: 19333:19365 unknown command 0 [ 724.009817] ? ext4_file_write_iter+0x388/0x1420 [ 724.009830] ? aio_write+0x37e/0x5e0 [ 724.009840] ? do_io_submit+0x14cc/0x1980 [ 724.009851] ? __x64_sys_io_submit+0x75/0xb0 [ 724.009878] ? graph_lock+0x170/0x170 [ 724.009896] ? print_usage_bug+0xc0/0xc0 [ 724.019867] binder: 19333:19365 ioctl c0306201 20000140 returned -22 [ 724.024632] ? graph_lock+0x170/0x170 [ 724.024645] ? graph_lock+0x170/0x170 [ 724.024665] ? __lock_is_held+0xb5/0x140 [ 724.024690] __should_failslab+0x124/0x180 [ 724.024714] should_failslab+0x9/0x14 [ 724.070906] kmem_cache_alloc+0x47/0x760 [ 724.074959] ? rcu_note_context_switch+0x710/0x710 [ 724.079896] ? rcu_read_lock_sched_held+0x108/0x120 [ 724.084917] ? mempool_free+0x370/0x370 [ 724.088885] mempool_alloc_slab+0x44/0x60 [ 724.093029] mempool_alloc+0x18b/0x490 [ 724.096911] ? remove_element.isra.4+0x1c0/0x1c0 [ 724.101659] ? kasan_check_write+0x14/0x20 [ 724.105907] ? bio_init+0x138/0x250 [ 724.109526] ? bio_add_page+0x3b0/0x3b0 [ 724.113504] ? __sanitizer_cov_trace_switch+0x53/0x90 [ 724.118774] bvec_alloc+0x12a/0x2d0 [ 724.122392] ? __sanitizer_cov_trace_cmp8+0x18/0x20 [ 724.127409] bio_alloc_bioset+0x484/0x7f0 [ 724.131550] ? bvec_alloc+0x2d0/0x2d0 [ 724.135350] ext4_bio_write_page+0xad5/0x1534 [ 724.139846] ? ext4_io_submit_init+0x90/0x90 [ 724.144251] ? __lock_is_held+0xb5/0x140 [ 724.148324] mpage_submit_page+0x15d/0x270 [ 724.152551] mpage_process_page_bufs+0x50c/0x600 [ 724.157303] mpage_prepare_extent_to_map+0x8fb/0x1100 [ 724.162494] ? ext4_block_write_begin+0x1560/0x1560 [ 724.167515] ? __lock_is_held+0xb5/0x140 [ 724.171566] ? __rpc_init_priority_wait_queue+0x78/0x3e0 [ 724.177028] ? rcu_read_lock_sched_held+0x108/0x120 [ 724.182039] ? kmem_cache_alloc+0x5fa/0x760 [ 724.186353] ? tag_pages_for_writeback+0x354/0x460 [ 724.191274] ? blk_start_plug+0xc4/0x360 [ 724.195333] ? kasan_check_write+0x14/0x20 [ 724.199561] ? ext4_init_io_end+0x199/0x210 [ 724.203873] ? ext4_end_io_rsv_work+0x8f0/0x8f0 [ 724.208538] ? __lock_is_held+0xb5/0x140 [ 724.212594] ? radix_tree_tagged+0x11/0x60 [ 724.216822] ext4_writepages+0x13ff/0x4030 [ 724.221074] ? ext4_mark_inode_dirty+0xb20/0xb20 [ 724.225818] ? perf_trace_lock+0xd6/0x900 [ 724.229955] ? perf_trace_lock+0xd6/0x900 [ 724.234095] ? zap_class+0x720/0x720 [ 724.237796] ? zap_class+0x720/0x720 [ 724.241514] ? graph_lock+0x170/0x170 [ 724.245307] ? graph_lock+0x170/0x170 [ 724.249107] ? __sanitizer_cov_trace_cmp8+0x18/0x20 [ 724.254119] ? __mark_inode_dirty+0x499/0x1530 [ 724.258697] ? find_held_lock+0x36/0x1c0 [ 724.262765] ? lock_downgrade+0x8e0/0x8e0 [ 724.266904] ? lock_downgrade+0x8e0/0x8e0 [ 724.271048] ? kasan_check_read+0x11/0x20 [ 724.275198] ? do_raw_spin_unlock+0x9e/0x2e0 [ 724.279598] ? do_raw_spin_trylock+0x1b0/0x1b0 [ 724.284190] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 724.289721] ? wbc_attach_and_unlock_inode+0x643/0x9e0 [ 724.294988] ? ext4_mark_inode_dirty+0xb20/0xb20 [ 724.299741] do_writepages+0x9a/0x1a0 [ 724.303527] ? do_writepages+0x9a/0x1a0 [ 724.307495] __filemap_fdatawrite_range+0x333/0x470 [ 724.312506] ? delete_from_page_cache_batch+0xf70/0xf70 [ 724.317870] ? file_update_time+0xdc/0x640 [ 724.322104] filemap_write_and_wait_range+0x48/0xd0 [ 724.327115] generic_file_direct_write+0x201/0x4b0 [ 724.332047] __generic_file_write_iter+0x2ff/0x630 [ 724.336973] ext4_file_write_iter+0x388/0x1420 [ 724.341542] ? __kernel_text_address+0xd/0x40 [ 724.346042] ? ext4_file_mmap+0x410/0x410 [ 724.350191] ? lock_acquire+0x1dc/0x520 [ 724.354153] ? aio_write+0x4ed/0x5e0 [ 724.357867] ? __lock_is_held+0xb5/0x140 [ 724.361920] ? perf_trace_svc_xprt_event+0x718/0x840 [ 724.367030] ? rcu_read_lock_sched_held+0x108/0x120 [ 724.372052] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 724.377585] ? __sb_start_write+0x17f/0x300 [ 724.381898] aio_write+0x37e/0x5e0 [ 724.385431] ? aio_complete+0xff0/0xff0 [ 724.389415] ? lock_release+0xa10/0xa10 [ 724.393377] ? check_same_owner+0x320/0x320 [ 724.397698] ? __might_sleep+0x95/0x190 [ 724.401664] ? __sanitizer_cov_trace_switch+0x53/0x90 [ 724.406845] do_io_submit+0x14cc/0x1980 [ 724.410823] ? free_ioctx_users+0x6b0/0x6b0 [ 724.415152] ? __sb_end_write+0xac/0xe0 [ 724.419121] ? ksys_write+0x1a6/0x250 [ 724.422926] ? syscall_slow_exit_work+0x4f0/0x4f0 [ 724.427759] __x64_sys_io_submit+0x75/0xb0 [ 724.431978] ? __x64_sys_io_submit+0x75/0xb0 [ 724.436381] do_syscall_64+0x1b1/0x800 [ 724.440259] ? finish_task_switch+0x1ca/0x810 [ 724.444754] ? syscall_return_slowpath+0x5c0/0x5c0 [ 724.449676] ? syscall_return_slowpath+0x30f/0x5c0 [ 724.454598] ? entry_SYSCALL_64_after_hwframe+0x59/0xbe [ 724.459955] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 724.464791] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 724.469967] RIP: 0033:0x455979 [ 724.473146] RSP: 002b:00007f262d5fbc68 EFLAGS: 00000246 ORIG_RAX: 00000000000000d1 [ 724.480846] RAX: ffffffffffffffda RBX: 00007f262d5fc6d4 RCX: 0000000000455979 [ 724.488117] RDX: 0000000020000080 RSI: 0000000000000001 RDI: 00007f262d5ab000 [ 724.495375] RBP: 000000000072bea0 R08: 0000000000000000 R09: 0000000000000000 [ 724.502641] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000014 [ 724.510519] R13: 000000000000018e R14: 00000000006f65f0 R15: 0000000000000004 2018/05/12 22:57:25 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0x11000000, 0x0, 0x252]}) 2018/05/12 22:57:25 executing program 5: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="c6295e4eca6c09b612ec6f") openat$urandom(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/urandom\x00', 0x40000, 0x0) r1 = socket$inet(0x10, 0x0, 0x100000000) r2 = request_key(&(0x7f0000000080)='trusted\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x2}, &(0x7f0000000140)='+\x00', 0xfffffffffffffffd) add_key$keyring(&(0x7f0000000000)='keyring\x00', &(0x7f0000000040)={0x73, 0x79, 0x7a, 0x0}, 0x0, 0x0, r2) sendmsg(r1, &(0x7f000001d000)={0x0, 0x0, &(0x7f0000024000)=[{&(0x7f0000020f88)="24000000100407031dfffd946fa2830020200a0009000300001d85687f0000000400ff7e28000000090a43ba16a0aa1ca10bb356da5d8060000000060000000029ec2400020cd37ed01cc073", 0x4c}], 0x1}, 0x0) 2018/05/12 22:57:25 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='dctcp\x00', 0x6) sendto$inet6(r0, &(0x7f00004e8000), 0xf401, 0x20000001, &(0x7f000007f000)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x749521c2]}}, 0x1c) 2018/05/12 22:57:25 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) 2018/05/12 22:57:25 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140), 0xfeffffff}, 0x0) 2018/05/12 22:57:25 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x1c, 0x0, &(0x7f0000000040)=[@request_death={0x400c630e}, @free_buffer={0x40086310}], 0x0, 0x0, &(0x7f0000000080)}) 2018/05/12 22:57:25 executing program 3 (fault-call:2 fault-nth:5): r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x12, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:57:25 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0x1, 0x31, r0, &(0x7f0000000000), 0xfe00}]) [ 724.583547] FAULT_INJECTION: forcing a failure. [ 724.583547] name failslab, interval 1, probability 0, space 0, times 0 [ 724.595023] CPU: 1 PID: 19372 Comm: syz-executor3 Not tainted 4.17.0-rc4+ #44 [ 724.602314] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 724.611678] Call Trace: [ 724.614287] dump_stack+0x1b9/0x294 [ 724.617932] ? dump_stack_print_info.cold.2+0x52/0x52 [ 724.623146] should_fail.cold.4+0xa/0x1a [ 724.627221] ? kmem_cache_free+0x86/0x2d0 [ 724.631390] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 724.636582] ? __blockdev_direct_IO+0x9d/0xc6 [ 724.641070] ? generic_file_direct_write+0x275/0x4b0 [ 724.646174] ? __generic_file_write_iter+0x2ff/0x630 [ 724.651357] ? ext4_file_write_iter+0x388/0x1420 [ 724.656101] ? aio_write+0x37e/0x5e0 [ 724.659800] ? do_io_submit+0x14cc/0x1980 [ 724.663937] ? __x64_sys_io_submit+0x75/0xb0 [ 724.668333] ? do_syscall_64+0x1b1/0x800 [ 724.672388] ? graph_lock+0x170/0x170 [ 724.676184] ? print_usage_bug+0xc0/0xc0 [ 724.680237] ? kasan_check_write+0x14/0x20 [ 724.684477] ? graph_lock+0x170/0x170 [ 724.688268] ? trace_hardirqs_off+0xd/0x10 [ 724.692492] ? _raw_spin_unlock_irqrestore+0x63/0xc0 [ 724.697588] ? __lock_is_held+0xb5/0x140 [ 724.701652] ? check_same_owner+0x320/0x320 [ 724.705973] ? rcu_note_context_switch+0x710/0x710 [ 724.710903] ? kmem_cache_free+0x25c/0x2d0 [ 724.715143] __should_failslab+0x124/0x180 [ 724.719373] should_failslab+0x9/0x14 [ 724.723162] kmem_cache_alloc+0x2af/0x760 [ 724.727308] jbd2__journal_start+0x1d3/0xa70 [ 724.731710] ? jbd2_write_access_granted.part.8+0x420/0x420 [ 724.737412] ? rcu_note_context_switch+0x710/0x710 [ 724.742338] ? __might_sleep+0x95/0x190 [ 724.746315] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 724.751853] __ext4_journal_start_sb+0x17a/0x5e0 [ 724.756600] ? ext4_get_block_trans+0x228/0x2d0 [ 724.761270] ? ext4_journal_abort_handle.isra.4+0x260/0x260 [ 724.766983] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 724.772523] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 724.778051] ? ext4_meta_trans_blocks+0x25f/0x310 [ 724.782894] ext4_get_block_trans+0x228/0x2d0 [ 724.787384] ? ext4_dio_get_block_overwrite+0x100/0x100 [ 724.792743] ? iov_iter_npages+0xe60/0xe60 [ 724.796973] ext4_dio_get_block_unwritten_async+0x72/0x260 [ 724.802594] do_direct_IO+0x1931/0xc300 [ 724.806606] ? sb_init_dio_done_wq+0xb0/0xb0 [ 724.811016] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 724.816551] ? kernel_poison_pages+0x136/0x220 [ 724.821125] ? kasan_unpoison_shadow+0x35/0x50 [ 724.825702] ? print_usage_bug+0xc0/0xc0 [ 724.829758] ? get_page_from_freelist+0x10ff/0x4f00 [ 724.834788] ? __lock_acquire+0x7f5/0x5140 [ 724.839028] ? __isolate_free_page+0x7c0/0x7c0 [ 724.843620] ? debug_check_no_locks_freed+0x310/0x310 [ 724.848802] ? print_usage_bug+0xc0/0xc0 [ 724.852872] ? print_usage_bug+0xc0/0xc0 [ 724.856930] ? __lock_acquire+0x7f5/0x5140 [ 724.861162] ? __lock_acquire+0x7f5/0x5140 [ 724.865395] ? debug_check_no_locks_freed+0x310/0x310 [ 724.870578] ? graph_lock+0x170/0x170 [ 724.874372] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 724.879913] ? kernel_poison_pages+0x136/0x220 [ 724.884490] ? print_usage_bug+0xc0/0xc0 [ 724.888544] ? kasan_alloc_pages+0x38/0x40 [ 724.892771] ? get_page_from_freelist+0x10ff/0x4f00 [ 724.897785] ? find_held_lock+0x36/0x1c0 [ 724.901858] ? lock_downgrade+0x8e0/0x8e0 [ 724.906015] ? kasan_check_read+0x11/0x20 [ 724.910162] ? rcu_is_watching+0x85/0x140 [ 724.914305] ? rcu_bh_force_quiescent_state+0x20/0x20 [ 724.919486] ? rcu_bh_force_quiescent_state+0x20/0x20 [ 724.924671] ? is_bpf_text_address+0xd7/0x170 [ 724.929160] ? kernel_text_address+0x79/0xf0 [ 724.933561] ? __unwind_start+0x166/0x330 [ 724.937702] ? __kernel_text_address+0xd/0x40 [ 724.942189] ? unwind_get_return_address+0x61/0xa0 [ 724.947108] ? __save_stack_trace+0x7e/0xd0 [ 724.951429] ? save_stack+0xa9/0xd0 [ 724.955047] ? save_stack+0x43/0xd0 [ 724.958665] ? kasan_kmalloc+0xc4/0xe0 [ 724.962540] ? kasan_slab_alloc+0x12/0x20 [ 724.966676] ? kmem_cache_alloc+0x12e/0x760 [ 724.970993] ? do_blockdev_direct_IO+0x607/0x9e90 [ 724.975839] ? __blockdev_direct_IO+0x9d/0xc6 [ 724.980330] ? ext4_direct_IO+0xa91/0x2110 [ 724.984639] ? generic_file_direct_write+0x275/0x4b0 [ 724.989729] ? __generic_file_write_iter+0x2ff/0x630 [ 724.994822] ? ext4_file_write_iter+0x388/0x1420 [ 724.999578] ? aio_write+0x37e/0x5e0 [ 725.003282] ? do_io_submit+0x14cc/0x1980 [ 725.007425] ? __x64_sys_io_submit+0x75/0xb0 [ 725.011842] ? do_syscall_64+0x1b1/0x800 [ 725.015897] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 725.021253] ? print_usage_bug+0xc0/0xc0 [ 725.025338] ? find_held_lock+0x36/0x1c0 [ 725.029387] ? print_usage_bug+0xc0/0xc0 [ 725.033438] ? print_usage_bug+0xc0/0xc0 [ 725.037492] ? graph_lock+0x170/0x170 [ 725.041282] ? __lock_is_held+0xb5/0x140 [ 725.045355] ? blk_start_plug+0xc4/0x360 [ 725.049420] ? blk_lld_busy+0x70/0x70 [ 725.053209] ? iov_iter_npages+0x26f/0xe60 [ 725.057431] ? mark_held_locks+0xc9/0x160 [ 725.061574] ? iov_iter_for_each_range+0xca0/0xca0 [ 725.066490] ? __lockdep_init_map+0x105/0x590 [ 725.070975] ? lockdep_init_map+0x9/0x10 [ 725.075034] do_blockdev_direct_IO+0xbd8/0x9e90 [ 725.079706] ? write_end_fn+0xf0/0xf0 [ 725.083502] ? do_direct_IO+0xc300/0xc300 [ 725.087640] ? print_usage_bug+0xc0/0xc0 [ 725.091687] ? debug_check_no_locks_freed+0x310/0x310 [ 725.096864] ? rcu_is_watching+0x85/0x140 [ 725.101014] ? find_held_lock+0x36/0x1c0 [ 725.105088] ? lock_downgrade+0x8e0/0x8e0 [ 725.109247] ? kasan_check_read+0x11/0x20 [ 725.113384] ? rcu_is_watching+0x85/0x140 [ 725.117525] ? rcu_bh_force_quiescent_state+0x20/0x20 [ 725.122705] ? rcu_bh_force_quiescent_state+0x20/0x20 [ 725.127891] ? is_bpf_text_address+0xd7/0x170 [ 725.132387] ? kernel_text_address+0x79/0xf0 [ 725.136795] ? __unwind_start+0x166/0x330 [ 725.140934] ? __kernel_text_address+0xd/0x40 [ 725.145423] ? unwind_get_return_address+0x61/0xa0 [ 725.150343] ? __save_stack_trace+0x7e/0xd0 [ 725.154672] ? save_stack+0xa9/0xd0 [ 725.158291] ? save_stack+0x43/0xd0 [ 725.161908] ? __kasan_slab_free+0x11a/0x170 [ 725.166313] ? kasan_slab_free+0xe/0x10 [ 725.170277] ? kmem_cache_free+0x86/0x2d0 [ 725.174414] ? jbd2_journal_stop+0x42e/0x15a0 [ 725.178900] ? __ext4_journal_stop+0xde/0x1f0 [ 725.183384] ? ext4_direct_IO+0x130e/0x2110 [ 725.187697] ? generic_file_direct_write+0x275/0x4b0 [ 725.192793] ? __generic_file_write_iter+0x2ff/0x630 [ 725.197888] ? ext4_file_write_iter+0x388/0x1420 [ 725.202631] ? aio_write+0x37e/0x5e0 [ 725.206340] ? do_io_submit+0x14cc/0x1980 [ 725.210482] ? __x64_sys_io_submit+0x75/0xb0 [ 725.214881] ? do_syscall_64+0x1b1/0x800 [ 725.218938] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 725.224467] ? kasan_check_read+0x11/0x20 [ 725.228606] ? do_raw_spin_unlock+0x9e/0x2e0 [ 725.233007] ? do_raw_spin_trylock+0x1b0/0x1b0 [ 725.237863] ? print_usage_bug+0xc0/0xc0 [ 725.241917] ? kasan_check_write+0x14/0x20 [ 725.246147] ? graph_lock+0x170/0x170 [ 725.249938] ? trace_hardirqs_off+0xd/0x10 [ 725.254167] ? _raw_spin_unlock_irqrestore+0x63/0xc0 [ 725.259367] ? debug_check_no_obj_freed+0x2ff/0x584 [ 725.264387] ? __lock_is_held+0xb5/0x140 [ 725.268436] ? try_get_cap_refs+0x838/0xd60 [ 725.272756] ? jbd2_journal_stop+0x42e/0x15a0 [ 725.277245] ? jbd2_journal_stop+0x42e/0x15a0 [ 725.281732] ? rcu_read_lock_sched_held+0x108/0x120 [ 725.286742] ? kmem_cache_free+0x25c/0x2d0 [ 725.290969] ? jbd2_journal_stop+0x22d/0x15a0 [ 725.295462] ? graph_lock+0x170/0x170 [ 725.299272] ? jbd2_buffer_abort_trigger+0x90/0x90 [ 725.304194] ? find_held_lock+0x36/0x1c0 [ 725.308273] ? ext4_get_block_trans+0x2d0/0x2d0 [ 725.312945] ? up_write+0x72/0x210 [ 725.316496] ? ext4_get_block_trans+0x2d0/0x2d0 [ 725.321164] __blockdev_direct_IO+0x9d/0xc6 [ 725.325484] ? write_end_fn+0xf0/0xf0 [ 725.329279] ? ext4_get_block_trans+0x2d0/0x2d0 [ 725.334033] ext4_direct_IO+0xa91/0x2110 [ 725.338099] ? ext4_iomap_end+0x800/0x800 [ 725.342265] ? trace_hardirqs_on_caller+0x421/0x5c0 [ 725.347277] ? __sanitizer_cov_trace_cmp4+0x16/0x20 [ 725.352299] ? current_kernel_time64+0x1f4/0x2f0 [ 725.357054] ? generic_update_time+0x255/0x420 [ 725.361627] ? put_itimerspec64+0x310/0x310 [ 725.365941] ? dentry_needs_remove_privs.part.24+0x70/0x70 [ 725.371568] ? ext4_file_write_iter+0x299/0x1420 [ 725.376315] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 725.381845] ? mnt_clone_write+0xed/0x130 [ 725.385982] ? __mnt_drop_write_file+0xd/0x70 [ 725.390484] ? file_update_time+0xdc/0x640 [ 725.394719] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 725.400518] ? filemap_check_errors+0xd8/0x110 [ 725.405100] generic_file_direct_write+0x275/0x4b0 [ 725.410038] __generic_file_write_iter+0x2ff/0x630 [ 725.414979] ext4_file_write_iter+0x388/0x1420 [ 725.419557] ? __kernel_text_address+0xd/0x40 [ 725.424065] ? ext4_file_mmap+0x410/0x410 [ 725.428227] ? lock_acquire+0x1dc/0x520 [ 725.432195] ? aio_write+0x4ed/0x5e0 [ 725.435909] ? __lock_is_held+0xb5/0x140 [ 725.439974] ? __ceph_remove_cap+0x258/0xd70 [ 725.444386] ? rcu_read_lock_sched_held+0x108/0x120 [ 725.449409] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 725.454941] ? __sb_start_write+0x17f/0x300 [ 725.460132] aio_write+0x37e/0x5e0 [ 725.463695] ? aio_complete+0xff0/0xff0 [ 725.467676] ? lock_release+0xa10/0xa10 [ 725.471643] ? check_same_owner+0x320/0x320 [ 725.475963] ? kasan_check_read+0x11/0x20 [ 725.480116] ? __might_sleep+0x95/0x190 [ 725.484088] ? __sanitizer_cov_trace_switch+0x53/0x90 [ 725.489270] do_io_submit+0x14cc/0x1980 [ 725.493255] ? free_ioctx_users+0x6b0/0x6b0 [ 725.497586] ? __sb_end_write+0xac/0xe0 [ 725.501557] ? ksys_write+0x1a6/0x250 [ 725.505360] ? syscall_slow_exit_work+0x4f0/0x4f0 [ 725.510211] __x64_sys_io_submit+0x75/0xb0 [ 725.514449] ? __x64_sys_io_submit+0x75/0xb0 [ 725.519037] do_syscall_64+0x1b1/0x800 [ 725.522921] ? finish_task_switch+0x1ca/0x810 [ 725.527512] ? syscall_return_slowpath+0x5c0/0x5c0 [ 725.532453] ? syscall_return_slowpath+0x30f/0x5c0 [ 725.537402] ? entry_SYSCALL_64_after_hwframe+0x59/0xbe [ 725.542774] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 725.547620] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 725.552817] RIP: 0033:0x455979 [ 725.555996] RSP: 002b:00007f262d5fbc68 EFLAGS: 00000246 ORIG_RAX: 00000000000000d1 [ 725.563707] RAX: ffffffffffffffda RBX: 00007f262d5fc6d4 RCX: 0000000000455979 [ 725.570968] RDX: 0000000020000080 RSI: 0000000000000001 RDI: 00007f262d5ab000 [ 725.578230] RBP: 000000000072bea0 R08: 0000000000000000 R09: 0000000000000000 2018/05/12 22:57:26 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0x1, 0xf0ffffff0f0000, r0, &(0x7f0000000000), 0xfe00}]) [ 725.585744] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000014 [ 725.593527] R13: 000000000000018e R14: 00000000006f65f0 R15: 0000000000000005 2018/05/12 22:57:26 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140), 0xa}, 0x0) 2018/05/12 22:57:26 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf0ffff], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) 2018/05/12 22:57:26 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='dctcp\x00', 0x6) sendto$inet6(r0, &(0x7f00004e8000), 0xf401, 0x20000001, &(0x7f000007f000)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x900]}}, 0x1c) 2018/05/12 22:57:26 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0x6, 0x0, 0x252]}) 2018/05/12 22:57:26 executing program 5: r0 = dup3(0xffffffffffffff9c, 0xffffffffffffffff, 0x80000) getsockopt$IPT_SO_GET_REVISION_TARGET(r0, 0x0, 0x43, &(0x7f0000000fc0)={'IDLETIMER\x00'}, &(0x7f0000001000)=0x1e) r1 = socket(0x40000000015, 0x5, 0x0) bind$inet(r1, &(0x7f0000fc4000)={0x2, 0x0, @loopback=0x7f000001}, 0x10) sendmmsg(r1, &(0x7f0000573000)=[{{&(0x7f0000001040)=@in={0x2, 0x0, @local={0xac, 0x14, 0xffffffffffffffff, 0xaa}}, 0x80, &(0x7f0000001180), 0x0, &(0x7f00000010c0)=[{0x27f, 0x10a, 0xffffffff00000002}], 0x10}}], 0x4000000000002a2, 0x0) [ 725.738506] binder: 19380:19383 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 725.745763] binder: 19380:19383 BC_DEAD_BINDER_DONE 0000000000000000 not found 2018/05/12 22:57:26 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0x1, 0x3700000000000000, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:57:26 executing program 3: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x12, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:57:26 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0x1c, 0x0, 0x252]}) 2018/05/12 22:57:26 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140), 0xfffffffe}, 0x0) 2018/05/12 22:57:26 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='dctcp\x00', 0x6) sendto$inet6(r0, &(0x7f00004e8000), 0xf401, 0x20000001, &(0x7f000007f000)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfec0]}}, 0x1c) 2018/05/12 22:57:26 executing program 5: r0 = socket(0x28bf92830df4575c, 0x1, 0xffffffffffff8005) ioctl(r0, 0x8912, &(0x7f0000000280)="c6295e4eca6c09b612ec6f") getsockopt$bt_l2cap_L2CAP_LM(r0, 0x6, 0x3, &(0x7f0000000040), &(0x7f0000000080)=0x4) 2018/05/12 22:57:26 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x1c, 0x0, &(0x7f0000000040)=[@request_death={0x400c630e}, @free_buffer={0x630b}], 0x0, 0x0, &(0x7f0000000080)}) 2018/05/12 22:57:26 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) [ 725.846232] binder: 19380:19411 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 725.854164] binder: 19380:19411 BC_DEAD_BINDER_DONE 0000000000000000 not found 2018/05/12 22:57:26 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140), 0xfd}, 0x0) 2018/05/12 22:57:26 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0x2f000000, 0x0, 0x252]}) [ 725.935167] binder: 19416:19417 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 725.942435] binder: 19416:19417 ERROR: BC_REGISTER_LOOPER called without request [ 725.950065] binder: 19416:19417 unknown command 0 2018/05/12 22:57:26 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf000], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) 2018/05/12 22:57:26 executing program 3: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0xf, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x12, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:57:26 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0x1, 0x1000000000000, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:57:26 executing program 5: perf_event_open(&(0x7f0000220000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6_sctp(0xa, 0x5, 0x84) openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000600)='/selinux/avc/hash_stats\x00', 0x0, 0x0) setsockopt$EBT_SO_SET_ENTRIES(0xffffffffffffffff, 0x0, 0x80, &(0x7f0000000440)=@filter={'filter\x00', 0xe, 0x2, 0x130, [0x0, 0x20000080, 0x200000b0, 0x200002a0], 0x0, &(0x7f0000000040), &(0x7f0000000080)=[{}, {0x0, '\x00', 0x0, 0x0, 0x1, [{{{0x0, 0x0, 0x0, 'bcsf0\x00', 'eql\x00', 'gretap0\x00', 'ip6_vti0\x00', @empty, [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x70, 0x70, 0xa0}}, @common=@NFQUEUE0={'NFQUEUE\x00', 0x8}}]}, {0x0, '\x00', 0x2}]}, 0x1a8) ioctl$sock_ifreq(r0, 0x89f2, &(0x7f0000000000)={'ip6tnl0\x00@\x00', @ifru_data=&(0x7f0000000180)="d61a072afa6a2e6e9105a65cf0b08be4d57565e1a85eff283ee23d954743a2e3"}) [ 725.998831] binder: 19416:19417 ioctl c0306201 20000140 returned -22 [ 726.048797] binder: 19416:19444 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 726.056082] binder: 19416:19444 ERROR: BC_REGISTER_LOOPER called without request [ 726.063721] binder: 19416:19444 unknown command 0 2018/05/12 22:57:26 executing program 5: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$midi(&(0x7f0000000140)='/dev/midi#\x00', 0x1, 0x600002) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000180)={0xaa, 0x42}) add_key(&(0x7f0000000040)='ceph\x00', &(0x7f0000000080)={0x73, 0x79, 0x7a}, &(0x7f00000000c0)='"', 0x1, 0xfffffffffffffffe) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000100)='/dev/snapshot\x00', 0x2, 0x0) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000300)={r1, 0x50, &(0x7f0000000280)}, 0x10) 2018/05/12 22:57:26 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140), 0xffffffff00000000}, 0x0) 2018/05/12 22:57:26 executing program 3: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x9, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x12, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) [ 726.136890] binder: 19416:19444 ioctl c0306201 20000140 returned -22 2018/05/12 22:57:27 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='dctcp\x00', 0x6) sendto$inet6(r0, &(0x7f00004e8000), 0xf401, 0x20000001, &(0x7f000007f000)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4]}}, 0x1c) 2018/05/12 22:57:27 executing program 5: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c6295e46ca6c09b612ec6f") mkdir(&(0x7f0000cb3ff8)='./file0\x00', 0x0) getsockopt$inet_sctp6_SCTP_ASSOCINFO(r0, 0x84, 0x1, &(0x7f0000000040)={0x0, 0x401, 0x5, 0x400, 0x6, 0x9}, &(0x7f0000000080)=0x14) getsockopt$bt_BT_CHANNEL_POLICY(r0, 0x112, 0xa, &(0x7f0000000100), &(0x7f0000000180)=0x4) setsockopt$inet_sctp_SCTP_RTOINFO(r0, 0x84, 0x0, &(0x7f00000000c0)={r1, 0xfffffffeffffffff, 0x4, 0xff}, 0x10) mount(&(0x7f0000000140)='./file0\x00', &(0x7f0000000280)='./file0\x00', &(0x7f0000000340)='pipefs\x00', 0x0, 0x0) 2018/05/12 22:57:27 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140), 0x400000000000000}, 0x0) 2018/05/12 22:57:27 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) 2018/05/12 22:57:27 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x1c, 0x0, &(0x7f0000000040)=[@request_death={0x400c630e}, @free_buffer={0x40086302}], 0x0, 0x0, &(0x7f0000000080)}) 2018/05/12 22:57:27 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0x1, 0xa80300, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:57:27 executing program 3: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x7, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x12, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:57:27 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0x8000000, 0x0, 0x252]}) 2018/05/12 22:57:27 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0x2b000000, 0x0, 0x252]}) [ 726.906800] binder: 19489:19492 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 726.914338] binder: 19489:19492 unknown command 1074291458 2018/05/12 22:57:27 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140), 0xe00}, 0x0) 2018/05/12 22:57:27 executing program 3: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0xc6d, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x12, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:57:27 executing program 5: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x9, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x12, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:57:27 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0x1, 0xd00, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:57:27 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa00000000000000], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) [ 726.955610] binder: 19489:19492 ioctl c0306201 20000140 returned -22 [ 727.022584] binder: 19489:19510 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 727.029885] binder: 19489:19510 unknown command 1074291458 2018/05/12 22:57:27 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0x2c00, 0x0, 0x252]}) 2018/05/12 22:57:27 executing program 3: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0xd, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x12, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) [ 727.122184] binder: 19489:19510 ioctl c0306201 20000140 returned -22 2018/05/12 22:57:28 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='dctcp\x00', 0x6) sendto$inet6(r0, &(0x7f00004e8000), 0xf401, 0x20000001, &(0x7f000007f000)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x300000000000000]}}, 0x1c) 2018/05/12 22:57:28 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140), 0xffffff97}, 0x0) 2018/05/12 22:57:28 executing program 5: r0 = syz_open_dev$dspn(&(0x7f0000000100)='/dev/dsp#\x00', 0x1, 0x0) ppoll(&(0x7f0000013000)=[{r0}], 0x1, &(0x7f0000001000)={0x77359400}, &(0x7f000000d000), 0x8) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000300)={0x0, r0, 0x0, 0x3}, 0x14) ioctl$KIOCSOUND(r0, 0x4b2f, 0x401) ioctl$GIO_FONT(r0, 0x4b60, &(0x7f0000000000)=""/242) 2018/05/12 22:57:28 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x1c, 0x0, &(0x7f0000000040)=[@request_death={0x400c630e}, @free_buffer={0x40406301}], 0x0, 0x0, &(0x7f0000000080)}) 2018/05/12 22:57:28 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa000000], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) 2018/05/12 22:57:28 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0x1, 0xfe, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:57:28 executing program 3: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0xa71, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x12, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:57:28 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0x33, 0x0, 0x252]}) 2018/05/12 22:57:28 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0x1100000000000000, 0x0, 0x252]}) 2018/05/12 22:57:28 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000000], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) [ 727.891333] binder: 19542:19552 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 727.898869] binder: 19542:19552 got reply transaction with no transaction stack [ 727.906458] binder: 19542:19552 transaction failed 29201/-71, size 0-0 line 2763 2018/05/12 22:57:28 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140), 0xffffff7f00000000}, 0x0) 2018/05/12 22:57:28 executing program 3: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x5, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x12, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:57:28 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0x1, 0xfefe00, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:57:28 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='dctcp\x00', 0x6) sendto$inet6(r0, &(0x7f00004e8000), 0xf401, 0x20000001, &(0x7f000007f000)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1802000000000000]}}, 0x1c) [ 728.015234] binder: 19542:19574 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 728.022549] binder: 19542:19574 got reply transaction with no transaction stack [ 728.030090] binder: 19542:19574 transaction failed 29201/-71, size 0-0 line 2763 2018/05/12 22:57:28 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0x2f00000000000000, 0x0, 0x252]}) 2018/05/12 22:57:28 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140), 0x200000000000000}, 0x0) [ 728.198173] binder: undelivered TRANSACTION_ERROR: 29201 [ 728.203872] binder: undelivered TRANSACTION_ERROR: 29201 2018/05/12 22:57:29 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa908], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) 2018/05/12 22:57:29 executing program 3: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x3, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x12, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:57:29 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0xffffff84, 0x0, 0x252]}) 2018/05/12 22:57:29 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0x1, 0xf, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:57:29 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140), 0xfd000000}, 0x0) 2018/05/12 22:57:29 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x1c, 0x0, &(0x7f0000000040)=[@request_death={0x400c630e}, @free_buffer={0x40106308}], 0x0, 0x0, &(0x7f0000000080)}) 2018/05/12 22:57:29 executing program 5: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x5, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x12, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:57:29 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='dctcp\x00', 0x6) sendto$inet6(r0, &(0x7f00004e8000), 0xf401, 0x20000001, &(0x7f000007f000)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe803]}}, 0x1c) 2018/05/12 22:57:29 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0xfffffffd, 0x0, 0x252]}) [ 728.930016] binder: 19603:19610 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 728.937539] binder: 19603:19610 BC_INCREFS_DONE u0000000000000000 no match 2018/05/12 22:57:29 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffff9e], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) 2018/05/12 22:57:29 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0x1, 0xfe00, r0, &(0x7f0000000000), 0xfe00}]) [ 728.970951] binder: 19603:19624 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 728.978320] binder: 19603:19624 BC_INCREFS_DONE u0000000000000000 no match 2018/05/12 22:57:29 executing program 3: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x23, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x12, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:57:29 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140), 0xfd00}, 0x0) 2018/05/12 22:57:29 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000590fa8)={0x26, 'hash\x00', 0x0, 0x0, 'michael_mic-generic\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00001ec000), 0x0) syncfs(r0) 2018/05/12 22:57:29 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0x2f, 0x0, 0x252]}) 2018/05/12 22:57:29 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x1c, 0x0, &(0x7f0000000040)=[@request_death={0x400c630e}, @free_buffer={0x40046307}], 0x0, 0x0, &(0x7f0000000080)}) 2018/05/12 22:57:29 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0x1, 0x4000000, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:57:29 executing program 3: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x6800, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x12, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) [ 729.171354] binder: 19645:19649 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 729.178722] binder: 19645:19649 DecRefs 0 refcount change on invalid ref 0 ret -22 [ 729.186619] binder: 19645:19649 unknown command 0 [ 729.264567] binder: 19645:19649 ioctl c0306201 20000140 returned -22 [ 729.290458] binder: 19645:19666 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 729.297805] binder: 19645:19666 DecRefs 0 refcount change on invalid ref 0 ret -22 [ 729.305613] binder: 19645:19666 unknown command 0 [ 729.313954] binder: 19645:19666 ioctl c0306201 20000140 returned -22 2018/05/12 22:57:30 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xaa593a576e000000], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) 2018/05/12 22:57:30 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140), 0x4}, 0x0) 2018/05/12 22:57:30 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0x3c000000, 0x0, 0x252]}) 2018/05/12 22:57:30 executing program 5: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x1c, 0x0, &(0x7f0000000040)=[@request_death={0x400c630e}, @free_buffer={0x40106308}], 0x0, 0x0, &(0x7f0000000080)}) 2018/05/12 22:57:30 executing program 3: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x187f, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x12, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:57:30 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0x1, 0x8000000000000000, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:57:30 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='dctcp\x00', 0x6) sendto$inet6(r0, &(0x7f00004e8000), 0xf401, 0x20000001, &(0x7f000007f000)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000]}}, 0x1c) 2018/05/12 22:57:30 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x1c, 0x0, &(0x7f0000000040)=[@request_death={0x400c630e}, @free_buffer={0x40406300}], 0x0, 0x0, &(0x7f0000000080)}) 2018/05/12 22:57:30 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140), 0xc0ffffff00000000}, 0x0) 2018/05/12 22:57:30 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0x88ffffff, 0x0, 0x252]}) 2018/05/12 22:57:30 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffff7f00000000], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) 2018/05/12 22:57:30 executing program 3: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x6, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x12, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) [ 729.884658] binder: 19679:19683 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 729.904160] binder: 19682:19688 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 729.911753] binder: 19682:19688 BC_INCREFS_DONE u0000000000000000 no match [ 729.927287] binder: 19679:19683 transaction failed 29189/-22, size 0-0 line 2856 2018/05/12 22:57:30 executing program 5: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x1c, 0x0, &(0x7f0000000040)=[@request_death={0x400c630e}, @free_buffer={0x40106308}], 0x0, 0x0, &(0x7f0000000080)}) 2018/05/12 22:57:30 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0x1, 0xe4ffffff, r0, &(0x7f0000000000), 0xfe00}]) [ 729.977408] binder: 19679:19694 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 2018/05/12 22:57:30 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='dctcp\x00', 0x6) sendto$inet6(r0, &(0x7f00004e8000), 0xf401, 0x20000001, &(0x7f000007f000)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa00]}}, 0x1c) 2018/05/12 22:57:30 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140), 0x1f000000}, 0x0) 2018/05/12 22:57:30 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) 2018/05/12 22:57:30 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0x32000000, 0x0, 0x252]}) [ 730.080206] binder: 19679:19694 transaction failed 29189/-22, size 0-0 line 2856 [ 730.108925] binder: 19713:19714 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 730.116214] binder: 19713:19714 BC_INCREFS_DONE u0000000000000000 no match 2018/05/12 22:57:30 executing program 3: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x4, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x12, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:57:30 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='dctcp\x00', 0x6) sendto$inet6(r0, &(0x7f00004e8000), 0xf401, 0x20000001, &(0x7f000007f000)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfc00]}}, 0x1c) 2018/05/12 22:57:30 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0x1, 0xfdef, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:57:30 executing program 5: r0 = socket(0x11, 0x100000802, 0x0) r1 = syz_open_dev$tun(&(0x7f0000000140)='/dev/net/tun\x00', 0x0, 0x2) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={"6966623000faffffffffffffff00", 0x4001}) ioctl$TUNSETVNETBE(r1, 0x400454de, &(0x7f0000000080)=0x1) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000000)={"69666230000006dc01583370b31700", 0xa201}) accept4$alg(r0, 0x0, 0x0, 0x80000) write$tun(r1, &(0x7f0000000280)={@pi, @hdr={0x0, 0x84, 0x0, 0xfffffffffffffff7}, @ipv4={{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast=0xffffffff}, @udp={0x0, 0x0, 0x8}}}, 0x2a) 2018/05/12 22:57:30 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140), 0x700}, 0x0) [ 730.280764] binder: undelivered TRANSACTION_ERROR: 29189 [ 730.286395] binder: undelivered TRANSACTION_ERROR: 29189 2018/05/12 22:57:31 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x1c, 0x0, &(0x7f0000000040)=[@request_death={0x400c630e}, @free_buffer={0x4008634b}], 0x0, 0x0, &(0x7f0000000080)}) 2018/05/12 22:57:31 executing program 3: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x5b00, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x12, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:57:31 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140), 0xa00}, 0x0) 2018/05/12 22:57:31 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0x2100, 0x0, 0x252]}) 2018/05/12 22:57:31 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='dctcp\x00', 0x6) sendto$inet6(r0, &(0x7f00004e8000), 0xf401, 0x20000001, &(0x7f000007f000)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x500]}}, 0x1c) 2018/05/12 22:57:31 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0x1, 0xffffffe4, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:57:31 executing program 5: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0xd0) r1 = socket(0x11, 0x4000000000080002, 0x0) setsockopt(r1, 0x107, 0xd, &(0x7f0000001000), 0x717) poll(&(0x7f0000000040)=[{r1}], 0x1, 0x7) r2 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000080)='/proc/self/net/pfkey\x00', 0x4000, 0x0) ioctl$DRM_IOCTL_WAIT_VBLANK(r2, 0xc018643a, &(0x7f00000000c0)={0x24000000, 0x3, 0x2c}) 2018/05/12 22:57:31 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9effffff], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) 2018/05/12 22:57:31 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6e573a59aa], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) 2018/05/12 22:57:31 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0x3, 0x0, 0x252]}) 2018/05/12 22:57:31 executing program 3: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x11, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x12, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) [ 730.474918] binder: 19767:19769 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 730.482395] binder: 19767:19769 unknown command 1074291531 [ 730.495314] binder: 19767:19769 ioctl c0306201 20000140 returned -22 2018/05/12 22:57:31 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140), 0x18}, 0x0) 2018/05/12 22:57:31 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0x1, 0x300000000000000, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:57:31 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='dctcp\x00', 0x6) sendto$inet6(r0, &(0x7f00004e8000), 0xf401, 0x20000001, &(0x7f000007f000)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffff5]}}, 0x1c) 2018/05/12 22:57:31 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffff0], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) 2018/05/12 22:57:31 executing program 5: r0 = socket(0x11, 0x800, 0x8) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/vcs\x00', 0x4000, 0x0) write$sndseq(r1, &(0x7f00000002c0)=[{0x2, 0xdd3b, 0x4, 0x5, @tick=0xffffffff, {0x92, 0x8}, {0x5, 0x3}, @raw32={[0x20, 0x3f11, 0xffffffff]}}, {0xfff, 0x200, 0x1, 0x8, @tick=0x6, {0x3, 0x6}, {0x3, 0x6}, @time=@time}, {0x4, 0x1, 0xfffffffffffffffe, 0x1, @tick=0x9, {0x7fff}, {0xf519, 0xfffffffffffffffa}, @connect={{0xa9c, 0x4a9b}, {0x7, 0x8}}}, {0x8, 0x8, 0x9, 0x1, @tick=0x84, {0x5, 0x7fff}, {0x1, 0x40}, @raw8={"d821ab9ea9c480d111f57bfb"}}, {0xba, 0x0, 0x4, 0x641, @time={0x0, 0x989680}, {0x3, 0x5}, {0x8b, 0x81}, @addr={0x100000001, 0x5}}, {0xffffffff, 0x8, 0x80, 0x0, @tick=0x7, {0xffff, 0x8}, {0x5, 0x2}, @note={0x6b, 0xed8, 0x71, 0x3, 0x3}}, {0x8, 0x9, 0x7, 0x4, @time, {0x40, 0x3}, {0x4080000000, 0x9}, @time=@tick=0x9}, {0x80000001, 0x3, 0x9, 0x9, @tick, {0x8, 0x1}, {0x7}, @quote={{0x5, 0x6}, 0x2, &(0x7f0000000140)={0x5, 0x40, 0x7fff, 0xffffffffffffffc1, @time, {0x357, 0xfff}, {0x100000001, 0x80}, @quote={{0x0, 0x2bcb}, 0x591a, &(0x7f0000000100)={0x9cb4, 0x1, 0x5, 0x4, @time, {0x0, 0x8}, {0x8, 0x7ac}, @time=@tick=0x5}}}}}], 0x180) ioctl(r0, 0x8912, &(0x7f0000000280)="c6295e4eca6c09b612ec6f") getsockopt$inet_tcp_buf(r0, 0x6, 0x7, &(0x7f0000000000)=""/102, &(0x7f0000000080)=0x66) socket$bt_bnep(0x1f, 0x3, 0x4) [ 730.559231] binder: 19767:19783 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 730.566564] binder: 19767:19783 unknown command 1074291531 [ 730.582647] binder: 19767:19783 ioctl c0306201 20000140 returned -22 2018/05/12 22:57:32 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x1c, 0x0, &(0x7f0000000040)=[@request_death={0x400c630e}, @free_buffer={0x40086312}], 0x0, 0x0, &(0x7f0000000080)}) 2018/05/12 22:57:32 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='dctcp\x00', 0x6) sendto$inet6(r0, &(0x7f00004e8000), 0xf401, 0x20000001, &(0x7f000007f000)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe8030000]}}, 0x1c) 2018/05/12 22:57:32 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0x1, 0x3f00000000000000, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:57:32 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140), 0x97ffffff00000000}, 0x0) 2018/05/12 22:57:32 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0x3300000000000000, 0x0, 0x252]}) 2018/05/12 22:57:32 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) 2018/05/12 22:57:32 executing program 3: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0xffffffe0, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x12, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:57:32 executing program 5: r0 = socket$inet6(0xa, 0x800000806, 0x0) setsockopt$inet6_buf(r0, 0x29, 0xf3, &(0x7f0000000000)="0022040000ffffebfffffffeffffffff144eea57ff000207835ec62d16b208feefaf234b0002b4cc4c39bdc8451792b903f4b7d8c8c4070000008735e9ab2f77c62e0a5cdd2cf9984c070400000000000003ff23353d8b2fc6a3ae1ebfcb49004a3ccd3560ae01010000079c60ed7449b842f37d7049621eedc4e10fe75a9ea937ea4e2540019ccbd9f6672837496d00ec0f91c88a1ea1ff6ee708c72febedcf20798d41991ac25bb6fce2220c25ea380c7e112ab358c3a6bd8a59c100000001b4e82cb03419544a39bace00000000000060cd7cf8d103d38c31c7c86d16c4d86cbe4ab390c092d077ce70590fbbd4f8bf4d6ab1cea6dbe9d4a54c17aac0db6e384515f20000000000000000000000000000", 0x42) getsockopt$inet6_IPV6_IPSEC_POLICY(r0, 0x29, 0x22, &(0x7f0000000140)={{{@in6=@remote, @in6=@loopback}}, {{@in=@rand_addr}, 0x0, @in=@broadcast}}, &(0x7f0000000240)=0xe8) 2018/05/12 22:57:32 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140), 0xfd00000000000000}, 0x0) 2018/05/12 22:57:32 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0x3200000000000000, 0x0, 0x252]}) [ 731.584845] binder: 19822:19836 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 731.592315] binder: 19822:19836 unknown command 1074291474 2018/05/12 22:57:32 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0x1, 0xfefe0000000000, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:57:32 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf0ffffffffffff], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) 2018/05/12 22:57:32 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) mkdirat(r1, &(0x7f000025b000)='./file0\x00', 0x0) mount(&(0x7f00001a4ff2)='./file0/file0\x00', &(0x7f0000f89ff8)='./file0\x00', &(0x7f000067b000)='\x00v\t', 0x1004, &(0x7f000073afff)) unlinkat(r1, &(0x7f0000783ff8)='./file0\x00', 0x200) chdir(&(0x7f0000000040)='./file0\x00') getcwd(&(0x7f0000fde000), 0xfffffffffffffc22) sendmsg$nl_route(r0, &(0x7f0000001a40)={&(0x7f0000000000)={0x10}, 0xc, &(0x7f0000000100)={&(0x7f0000001a80)=ANY=[@ANYBLOB="1c0000001a0011050000000000000000800000c7f98ce60000000000"], 0x1c}, 0x1}, 0x0) r2 = dup2(r0, r0) ioctl$KVM_PPC_GET_SMMU_INFO(r2, 0x8250aea6, &(0x7f0000000040)=""/118) 2018/05/12 22:57:32 executing program 3: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x5c00, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x12, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) [ 731.662188] binder: 19822:19836 ioctl c0306201 20000140 returned -22 [ 731.708890] binder: 19822:19858 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 731.716223] binder: 19822:19858 unknown command 1074291474 2018/05/12 22:57:32 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='dctcp\x00', 0x6) sendto$inet6(r0, &(0x7f00004e8000), 0xf401, 0x20000001, &(0x7f000007f000)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40000000]}}, 0x1c) 2018/05/12 22:57:32 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0x800000000000000, 0x0, 0x252]}) [ 731.802715] binder: 19822:19858 ioctl c0306201 20000140 returned -22 2018/05/12 22:57:32 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x1c, 0x0, &(0x7f0000000040)=[@request_death={0x400c630e}, @free_buffer={0x630d}], 0x0, 0x0, &(0x7f0000000080)}) 2018/05/12 22:57:32 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140), 0x1000000}, 0x0) 2018/05/12 22:57:32 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf00000000000000], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) 2018/05/12 22:57:32 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) mkdirat(r1, &(0x7f000025b000)='./file0\x00', 0x0) mount(&(0x7f00001a4ff2)='./file0/file0\x00', &(0x7f0000f89ff8)='./file0\x00', &(0x7f000067b000)='\x00v\t', 0x1004, &(0x7f000073afff)) unlinkat(r1, &(0x7f0000783ff8)='./file0\x00', 0x200) chdir(&(0x7f0000000040)='./file0\x00') getcwd(&(0x7f0000fde000), 0xfffffffffffffc22) sendmsg$nl_route(r0, &(0x7f0000001a40)={&(0x7f0000000000)={0x10}, 0xc, &(0x7f0000000100)={&(0x7f0000001a80)=ANY=[@ANYBLOB="1c0000001a0011050000000000000000800000c7f98ce60000000000"], 0x1c}, 0x1}, 0x0) r2 = dup2(r0, r0) ioctl$KVM_PPC_GET_SMMU_INFO(r2, 0x8250aea6, &(0x7f0000000040)=""/118) 2018/05/12 22:57:32 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0x1, 0xe0000, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:57:32 executing program 3: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x8, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x12, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:57:32 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0x33000000, 0x0, 0x252]}) 2018/05/12 22:57:32 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='dctcp\x00', 0x6) sendto$inet6(r0, &(0x7f00004e8000), 0xf401, 0x20000001, &(0x7f000007f000)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe000000]}}, 0x1c) 2018/05/12 22:57:32 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140), 0x97ffffff}, 0x0) 2018/05/12 22:57:32 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf00], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) 2018/05/12 22:57:32 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0x1, 0xd, r0, &(0x7f0000000000), 0xfe00}]) [ 732.006334] binder: 19903:19904 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 732.013647] binder: 19903:19904 unknown command 0 2018/05/12 22:57:32 executing program 3: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0xd100, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x12, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:57:32 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0x84ffffff, 0x0, 0x252]}) 2018/05/12 22:57:32 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='dctcp\x00', 0x6) sendto$inet6(r0, &(0x7f00004e8000), 0xf401, 0x20000001, &(0x7f000007f000)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfe80]}}, 0x1c) 2018/05/12 22:57:32 executing program 5: perf_event_open(&(0x7f0000b5a000)={0x4000000002, 0x70, 0x1e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = semget$private(0x0, 0x20000000102, 0x830) getresgid(&(0x7f0000000000), &(0x7f0000000080), &(0x7f00000000c0)) semtimedop(r0, &(0x7f0000033816)=[{0x1, 0x2}, {0x0, 0x800}], 0x2, &(0x7f0000000040)) gettid() [ 732.053227] binder: 19903:19904 ioctl c0306201 20000140 returned -22 2018/05/12 22:57:32 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140), 0x7}, 0x0) [ 732.115605] binder: 19903:19917 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 732.122975] binder: 19903:19917 unknown command 0 [ 732.205195] binder: 19903:19917 ioctl c0306201 20000140 returned -22 2018/05/12 22:57:33 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x1c, 0x0, &(0x7f0000000040)=[@request_death={0x400c630e}, @free_buffer={0x400c630f}], 0x0, 0x0, &(0x7f0000000080)}) 2018/05/12 22:57:33 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140), 0x1f00000000000000}, 0x0) 2018/05/12 22:57:33 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='dctcp\x00', 0x6) sendto$inet6(r0, &(0x7f00004e8000), 0xf401, 0x20000001, &(0x7f000007f000)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc2219574]}}, 0x1c) 2018/05/12 22:57:33 executing program 5: mmap(&(0x7f0000000000/0xff7000)=nil, 0xff7000, 0x1, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000004000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) capset(&(0x7f0000004ffa)={0x20080522}, &(0x7f0000001000)) r0 = syz_open_dev$vcsa(&(0x7f0000000040)='/dev/vcsa#\x00', 0x7fff, 0x101000) setsockopt$inet_msfilter(r0, 0x0, 0x29, &(0x7f0000000080)={@remote={0xac, 0x14, 0x14, 0xbb}, @multicast1=0xe0000001, 0x0, 0x3, [@loopback=0x7f000001, @dev={0xac, 0x14, 0x14, 0xe}, @rand_addr=0x3b]}, 0x1c) syz_genetlink_get_family_id$ipvs(&(0x7f0000000000)='IPVS\x00') 2018/05/12 22:57:33 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100007f], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) 2018/05/12 22:57:33 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0x1, 0x9, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:57:33 executing program 3: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0xde00, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x12, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:57:33 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0x2b00, 0x0, 0x252]}) 2018/05/12 22:57:33 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0x4, 0x0, 0x252]}) [ 733.154410] binder: 19947:19949 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 733.161831] binder: 19947:19949 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 2018/05/12 22:57:33 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140), 0x4000000}, 0x0) 2018/05/12 22:57:33 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf0ffff], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) 2018/05/12 22:57:33 executing program 3: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x2, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x12, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:57:33 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) perf_event_open(&(0x7f000025c000)={0x0, 0x78}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(0xffffffffffffffff) ioctl(0xffffffffffffffff, 0x0, &(0x7f0000002000)) mmap$binder(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0, 0x10, 0xffffffffffffffff, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) utime(&(0x7f0000c4c000)='./file0\x00', &(0x7f0000a98000)={0x3}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000080)={0x0, 0x3, 0x0, 0x2000, &(0x7f0000a98000/0x2000)=nil}) ioctl$KVM_SET_SREGS(r2, 0x4138ae84, &(0x7f0000c9bec8)={{}, {}, {}, {}, {}, {}, {}, {}, {}, {}, 0xfffffffffffffffc}) ioctl$KVM_TRANSLATE(r2, 0xc018ae85, &(0x7f0000000000)) r3 = syz_open_dev$admmidi(&(0x7f0000000040)='/dev/admmidi#\x00', 0x40, 0x321000) ioctl$KVM_GET_PIT2(r3, 0x8070ae9f, &(0x7f00000000c0)) 2018/05/12 22:57:33 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0x1, 0x37000000, r0, &(0x7f0000000000), 0xfe00}]) [ 733.287846] binder: 19947:19981 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 733.295261] binder: 19947:19981 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 2018/05/12 22:57:33 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0xffffff88, 0x0, 0x252]}) 2018/05/12 22:57:33 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140), 0x2000000}, 0x0) 2018/05/12 22:57:34 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x1c, 0x0, &(0x7f0000000040)=[@request_death={0x400c630e}, @free_buffer={0x40046304}], 0x0, 0x0, &(0x7f0000000080)}) 2018/05/12 22:57:34 executing program 3: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x10, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x12, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:57:34 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140), 0xa000000}, 0x0) 2018/05/12 22:57:34 executing program 5: r0 = socket(0x11, 0x100000802, 0x0) ioctl$sock_proto_private(r0, 0x89ea, &(0x7f00000001c0)="9a7bb62269a12760c4707848516e164b1b25a86e235cd41b671fd64bfe1a59972acb4d25626173f9f7ecdd8dc1c0113bd803c2a7239957ff6804f481344d38b3a37073386bdae2d07837a2c9685496c120d9af2e49a8a82b570ef5aed68e0971f23b1dd77066180c0c5d270eb318c3ea5f50be64f918b0b7064b84188b0cd67e067c1200f602807eb2254d06fa8bec13f415e7b1353c931f8c5b0d4ef4ba9980dd9f975bccce2ead2d65972a46aee5be7291719c9fb95729fe036f121a2ff02d0d") r1 = syz_open_dev$tun(&(0x7f0000000140)='/dev/net/tun\x00', 0x0, 0x2) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={"6966623000faffffffffffffff00", 0x1411}) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000000)={'ifb0\x00', 0xa201}) io_setup(0x469, &(0x7f0000000180)=0x0) setsockopt$inet_MCAST_MSFILTER(r0, 0x0, 0x30, &(0x7f00000002c0)={0x100, {{0x2, 0x4e24, @multicast1=0xe0000001}}, 0x0, 0x7, [{{0x2, 0x4e22, @dev={0xac, 0x14, 0x14, 0xd}}}, {{0x2, 0x4e20, @loopback=0x7f000001}}, {{0x2, 0x4e21, @local={0xac, 0x14, 0x14, 0xaa}}}, {{0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x16}}}, {{0x2, 0x4e23, @local={0xac, 0x14, 0x14, 0xaa}}}, {{0x2, 0x4e23, @broadcast=0xffffffff}}, {{0x2, 0x25a, @dev={0xac, 0x14, 0x14, 0x19}}}]}, 0x410) ioctl$TUNSETVNETLE(r1, 0x400454dc, &(0x7f00000000c0)=0x1) r3 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000080)='/dev/autofs\x00', 0x2, 0x0) ioctl$TIOCSETD(r3, 0x5423, &(0x7f0000000100)=0x10000) io_submit(r2, 0x1, &(0x7f00000016c0)=[&(0x7f0000001380)={0x0, 0x0, 0x0, 0x1, 0x0, r1, &(0x7f0000000080)}]) 2018/05/12 22:57:34 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='dctcp\x00', 0x6) sendto$inet6(r0, &(0x7f00004e8000), 0xf401, 0x20000001, &(0x7f000007f000)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5400]}}, 0x1c) 2018/05/12 22:57:34 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0x21, 0x0, 0x252]}) 2018/05/12 22:57:34 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0x1, 0x2000000, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:57:34 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffff7f], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) 2018/05/12 22:57:34 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0x84ffffff00000000, 0x0, 0x252]}) 2018/05/12 22:57:34 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfcffffff], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) [ 734.171320] binder: 20015:20022 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 734.200408] binder: 20015:20022 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 734.208357] binder: 20015:20022 unknown command 0 2018/05/12 22:57:34 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0x1, 0x400000000000000, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:57:34 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140), 0xfeffffff00000000}, 0x0) 2018/05/12 22:57:34 executing program 3: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0xffffffffffffffe0, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x12, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) [ 734.265198] binder: 20015:20022 ioctl c0306201 20000140 returned -22 2018/05/12 22:57:34 executing program 5: r0 = socket(0x20000000000000a, 0x5, 0x0) r1 = syz_open_dev$sndpcmc(&(0x7f00000000c0)='/dev/snd/pcmC#D#c\x00', 0x7ff, 0x101000) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000180)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) getsockopt$SO_COOKIE(r1, 0x1, 0x39, &(0x7f0000000100), &(0x7f0000000140)=0x8) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r2 = socket(0x7, 0x80a, 0x0) connect$inet6(r2, &(0x7f0000000040)={0xa, 0x0, 0x0, @mcast1={0xff, 0x1, [], 0x1}, 0x100000002}, 0x1c) setsockopt$sock_int(r2, 0x1, 0xb, &(0x7f0000000080), 0x4) 2018/05/12 22:57:34 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='dctcp\x00', 0x6) sendto$inet6(r0, &(0x7f00004e8000), 0xf401, 0x20000001, &(0x7f000007f000)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfc00000000000000]}}, 0x1c) 2018/05/12 22:57:34 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0x2c000000, 0x0, 0x252]}) [ 734.318859] binder: 20015:20037 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 734.457204] binder: 20015:20037 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 734.465097] binder: 20015:20037 unknown command 0 2018/05/12 22:57:35 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x1c, 0x0, &(0x7f0000000040)=[@request_death={0x400c630e}, @free_buffer={0x4008630a}], 0x0, 0x0, &(0x7f0000000080)}) 2018/05/12 22:57:35 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140), 0x700000000000000}, 0x0) 2018/05/12 22:57:35 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0ffffff], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) 2018/05/12 22:57:35 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0x1, 0x20000000, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:57:35 executing program 3: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x104, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x12, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:57:35 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0x29000000, 0x0, 0x252]}) 2018/05/12 22:57:35 executing program 5: r0 = add_key$keyring(&(0x7f0000000040)='keyring\x00', &(0x7f0000000080)={0x73, 0x79, 0x7a}, 0x0, 0x0, 0xffffffffffffffff) r1 = add_key$keyring(&(0x7f00000000c0)='keyring\x00', &(0x7f0000335ffb)={0x73, 0x79, 0x7a}, 0x0, 0x0, r0) r2 = add_key$user(&(0x7f00003bd000)='user\x00', &(0x7f0000a00000)={0x73, 0x79, 0x7a}, &(0x7f0000facfff)="01", 0x1, r1) r3 = add_key$user(&(0x7f0000fc0ffb)='user\x00', &(0x7f0000752ffb)={0x73, 0x79, 0x7a, 0x3}, &(0x7f00003eb000)="b3", 0x1, r1) r4 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000300)='/proc/self/net/pfkey\x00', 0x40000, 0x0) write$vnet(r4, &(0x7f0000000480)={0x1, {&(0x7f0000000340)=""/8, 0x8, &(0x7f0000000380)=""/251, 0x3, 0x2}}, 0x68) keyctl$update(0x2, r3, &(0x7f000060df0f)="df02754677212dfc3e2acc26fdc3ffa64813da494137e175e9f2780ac5e2a09f43a1fcebf272a5a135de92bf4a9033933824f6e6aa023895113293535d1c0066d20e0f275188b4b4c187e18774fc2227cbb60fc6697f5337726164c8fbe11875deb27eafcf7d06438f252510d87bd91d03e7dc2faed85adcd88ca30e75b1e143a72d94defa187e48b89efbbbcc9b9a9a307353df7a21affce4e9149eb122cbc356cb681365afd979e97b57b596e901864a68679f0512cca7341063127aa29672", 0xc0) keyctl$dh_compute(0x17, &(0x7f0000000100)={r2, r3, r2}, &(0x7f0000a53ffb)=""/5, 0x34, &(0x7f0000c61fc8)={&(0x7f0000a3dffa)={'sha3-512-generic\x00'}, 0x0, 0x23}) r5 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x80080, 0x0) ioctl$BLKZEROOUT(r5, 0x127f, &(0x7f00000002c0)={0x2, 0x4}) getrusage(0xffffffffffffffff, &(0x7f00000001c0)) openat$pfkey(0xffffffffffffff9c, &(0x7f0000000180)='/proc/self/net/pfkey\x00', 0x0, 0x0) r6 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0xffffffff00000001, 0x4200) ioctl$ASHMEM_GET_PROT_MASK(r6, 0x7706, &(0x7f0000000140)) 2018/05/12 22:57:35 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='dctcp\x00', 0x6) sendto$inet6(r0, &(0x7f00004e8000), 0xf401, 0x20000001, &(0x7f000007f000)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200000000000000]}}, 0x1c) [ 734.501180] binder: 20015:20037 ioctl c0306201 20000140 returned -22 2018/05/12 22:57:35 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140), 0x7000000}, 0x0) 2018/05/12 22:57:35 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='dctcp\x00', 0x6) sendto$inet6(r0, &(0x7f00004e8000), 0xf401, 0x20000001, &(0x7f000007f000)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff00000000000000]}}, 0x1c) 2018/05/12 22:57:35 executing program 3: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0xe0, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x12, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) [ 734.611341] binder: 20086:20087 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 734.618798] binder: BC_ATTEMPT_ACQUIRE not supported 2018/05/12 22:57:35 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0x1, 0xfbffffff, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:57:35 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffc0], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) 2018/05/12 22:57:35 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0x1c000000, 0x0, 0x252]}) [ 734.709205] binder: 20086:20087 ioctl c0306201 20000140 returned -22 [ 734.747261] binder: 20086:20110 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 734.754563] binder: BC_ATTEMPT_ACQUIRE not supported 2018/05/12 22:57:35 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000068f50)={{0x80}, "706f72ff070000000000000000000000000b000000000000000000001f0000ffffff03000000ef000003ff02000000000012000000000000000000000600", 0xd3, 0x80003}) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x0, 0x0) close(r0) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$TIOCGPGRP(r1, 0x540f, &(0x7f0000000000)=0x0) ptrace$setregset(0x4205, r2, 0x205, &(0x7f0000000100)={&(0x7f0000000040)="6676b494bb20296fa5040ab8cab80d0a7186d02c64c17712d9960c381dc2de6fea46dd3e709eca0b544380af9693554ccce1b277d2952323cc498e61a5ce0df9ea73dbbd31f45fa98056517f6f83692d175f2457ecb146459c76086684ff5f28c242f6236b437e8a2e7c68483a5bf4d05e69329c60bebdc55f6b2790c9a3658cc669ea2ad50bb945", 0x88}) close(r1) 2018/05/12 22:57:35 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0x2f00, 0x0, 0x252]}) 2018/05/12 22:57:35 executing program 3: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1300, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x12, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:57:35 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x1c, 0x0, &(0x7f0000000040)=[@request_death={0x400c630e}, @free_buffer={0x40086304}], 0x0, 0x0, &(0x7f0000000080)}) 2018/05/12 22:57:35 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140), 0xe000000}, 0x0) 2018/05/12 22:57:35 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='dctcp\x00', 0x6) sendto$inet6(r0, &(0x7f00004e8000), 0xf401, 0x20000001, &(0x7f000007f000)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x54000000]}}, 0x1c) 2018/05/12 22:57:35 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) 2018/05/12 22:57:35 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0x3300, 0x0, 0x252]}) 2018/05/12 22:57:35 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0x1, 0x40000, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:57:35 executing program 5: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") ioctl$PPPIOCSFLAGS(r0, 0x40047459, &(0x7f00000000c0)=0x20) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = dup3(r1, r0, 0x80000) ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(r2, 0xc0505350, &(0x7f0000000040)={{0x200, 0x10001}, {0x2, 0xffffffff80000001}, 0x7c7, 0x6, 0x9}) setsockopt$inet_tcp_int(r1, 0x6, 0xa, &(0x7f0000000140)=0x1, 0x4) write$binfmt_script(r1, &(0x7f00000013c0)=ANY=[@ANYBLOB="2321202e2f66696c65302020200020202f6465762f7667615f61726269746572000a6e6711139f90bb2b034f8335f0b529fb9df90b4c39b62efdf63cd2d4e277316ca5496274b3a059b56a91b5ae5778e2b9df7f35a36fad45d8294e2e61ebaee8d3eb0250a5dbf49320e252949cce44d006fc6ac433cc2d43df01081e15acf1b75e92faf798336180487688c6b3f53920ea3502f8d9ab2879a162cd8158fb8a5fd824e745b9455ad235226678a4142297381074c47b225db691e4194d982145eba56bf496c82cd46c143dd92c194a91faefb6dc14e3348369b2fbdd12867b749308bc2b5a7cd15cca07facc438fe2b173f5ad33ea53affcc2b7c114684241125d2cc7b382e71bf3dda96e86118f8ad85e0323419d52f1090349b3cb19d41c85b4a0a57ec234ce11acf85274353e0cf117671cbeeb37f546b2eb0261f64f244e918d88431357e25ce67b857da25253326266b9208e817d529c8280fa2d7e34a00803652c2cecfe6f3ecc25b59408111b1ff8333eaf51217834a2cd6bb80a5063fff12f6b10c83d85f8fcec0b79a5e5d95579d5a5d38da56c7f4326e572f09133a9beb441563b5a5abe0df7ae9a630b735df4fb48b48f48a7ffa0421b51ec7fd2538c98baf51acda1cc3afb1230adbc78329debb1900cd093586b73659b6f106dfd3e6d400b914b7dbec4a7cb3c7cb918d551c6818ac5a462266e6d8793ac7a0c877eaff3fb80f5fb0f99c09cfe97c79e530fe3b2441f7a3269688e889915d3bdc31dd77631a708d3cedaf170ae222b9bc9ba439d2fc892dc5995a26f64b46fb0ad1a7cf0fb8352edd486511553bea96fbabde4cf83ae8119177395dc32b700361b77e3b68091121761334b05e3f346be59ab3f406a08b042a64202e44216245ff08d6044514ee1dca338f250a0a9c07a5e9dea3bb7497e6c82ee38bfe05c1c1745fbc23819872efe21e9d4dc94c96873ed893ee9e4c6e99f33e75b25108511f44649f74bee8f83dcc7e2f3d6b720304fd850f75dedc1481081cd421927dc9e74d7c497e24ac36e51dbcef31d1991a830573341651ab6bac51e20922924380618f1fa390c3bd01f779748d5e62ba7cf114598f3746f1ddeab8df4b20d3420dcb344bf037a7a71f3e646a741baa1e3a6ceac79faec59662b7186c9b704f72a97bea485e59d1a01245de45462e6fe4765e2a65b4e6644ab7f15a4969bb95794d0069b817067b79ea25ec385f9a76bbd8f5e3a3eb88008729a156015fe65daff79fb5ffe2a017439195d3af8b737234f083cc70d4c4c7c479594c7a59ae8a0c5f85207e6e1fd929aa665e8086bdb12338e7e7dff1b51b997d9ca80a2e4015bc96a717653b66bd5e335286c589cf02e22a131ed7987a69d0f07b87e954eace10883304008bc07252b47400d6dd9bcbe0db6f4eead696b6fef30ee9402b4650daac552ef0c7498a0741178d216cf2d8c30ab640dec42ed9b84771e18da6427d2ab79239dde52e88f3cbfaae58907e2bbf1990e512f7094864b044c52b90ddd2ab251a40c19ba057da5e3e9362e95f480b0436c0f6b077062be644acc51dbf5937954ed61564e4ae739a78faf643299511f3324157f34b48731d00cc6510d93bc3e7b527c11b4ea28114668ef5286ad87069a42b5a29c5aca071572f2dd671cec9200b65644fd48cfcf34691a19bbeda74934b20fecb664ac13b4bdd87ee49e921369aaf661b59be2ccae3bfecba8c7f5a287c31db59420738626dc6b6f3ddf06538291bf4dbed9f57febabf070e6ee55a183e2ce2b437351a498c92e452db918db24fbefb1e583f39eed51d868de492f751db2dc2df5595e8a1444602e3cdfb39e24f2ad0438307c1f603f010bb01c4703fa5173943b40aad74d407827a22fbf596570d3e812ba58f59ce01a45d7266ed2e3a9d74e7fd4bc386a0209c958ba2c87c83467497743418135fc92a137079c628a9a8554cabd68c5e43484617266b92ed277e419f9af257a1817b3070caf76630c27cc76fd0e505383cc32a7577dd81fc43fc89b3fb65bee65f9c655c366635175a711a5ab42f34fe4d900b5d313817750d0347f536d034f727743d225505c2171a4e8aee2bd0e7de20e50fc3183c66e9de7c147b709598ce360d422a6602f0f8f499e0b993b218a13b3508a5986b34df38ac9af28d60ef70980d1992140eca75aa2fa0a029e1acd686ef4bc6a39129ae794069298cb3c94b2819dfd1e6a0254d0126b35aad64083d7dfd44fb79224cb343b5a2f9c606bf1175aae51e3613c754d531d3d5482aa88e331e3cfabe4d13325d2b54be62049cdb03d18d8f6e5ead8ecd621a93613c7b8a04dd6f7c90ab216852878d73d59f92870cabe8b442d58523c23a654ad7ffa2ac76ad1c0e53662c7081941877c7bb3333cb9fbc89cd72e1b8cd4aacf0ca175c039314ba24a57dfb83fd6fd5fef927b9ade943d324f2432b49c654f6834db9fd45b38c95165e28fd774eeb59d990ace54e6d261d7aab88961b153895da181116fffd63e3c3e92f32fc5e68e9c53690a55f42ecc0b7800d0e8ff02768014d5eac2b5e2feb638b35356515003afa6e46bc908663a9c845fdb9a5d054a9ab30c5162701df0dbdd25be84e58f5f2a0f9f552b2fc850ba3e0d33a8ae03669da3ed0504ba469fdc0afc3d61713d0402c0482097dabb9ac118db5aefe60100aba545aa5d12116b54b8a9840fca99da5adab23228f7a1598713100ead68f9bdb317e7304668e8f160bb0487bdc3100cb90f0574970be1b0a8e753094571e068c05c39b31e3546835482c95ff74ff31e22134d23abbcccd383a9e7b96a52c42bc71d575860cf63f6b0990852042b807f48175a56b7eb0e40d601dc459cfe4064b3ace95e51211879b85482d84ea179eec914fd707669c62b02a3a2e468d6d68b39de46b8ef2ef4e39f1efa7821b83482caed17245c3af8b5240794d4c4fa3affe66db5624dd759636b1f4bce79811f4c01a30d9835c3453f973c0c344dce839bf965302968df7f53aa41f25a273277b28f73b1e40e858ce0c01cf7a398046b4707a1db158805ce7704fb2b754183ec949977e1da5cdeaf0e89bfbafd542136cf85301a360907ccf1111938dc43e9c228591483d948a1173ad5c2f87ad411e04d613bb98d58c9eeb15b8cb8862f18272c4ee1a506645b4e1f7a396da14bcd719d5435da05c3f992c39d8d5cfe3f93cb9c6920167fc92a8dee3addf15b8f28d2d52cc812841d22bccf250c63a44db640c7e12e601d9b0b1de01690839e64234c49fa6b89bdaaa8b5687559835a233fd4367bcc59e197836c2632c451ae1586089cb6a68deb809404491b06966b48b2b0d798f03c09481f39300d24a9ac7fcc0b7cee83b47c980b01827d292f3cfa335c1fee6270851e96ab8bcbab11da5a2aa9f7c7655d7499f1844218746f4ef4e8081beeeb0ca41eef406bfc64d6c5d246ce8647a6c9444b79ce8aebae7d3fe3e48160de24854666d257862f1e4de08a46505fcc461988948e41f345d10059eb1116e30ea95c51671363afc937e6a86c3118d3d1938b031975c6a2d724be7d6be5a8cb78076803fd655219d6ae9c0a6638507fb450515de8b11ceea93f64af1e9f358ce5313da990ffd264b67816a8152d1e01231ae27e53e18f7163dff07aee57416e5c488e3479767c38125d13edade86b9b53d225bab0fa791dc03b1756da960551b410fc45d78ed5da4af74c336a89176383814f8e2a6199f18590fcf74ef8bad590ebf42ae65e3604251f0e9812d1bf96fe351b5fb4127a4baac52432938eac74e5df8abaaf92a7a84aac4934492fe7ee88a34d597c7852ab8b47335047f193cf29543efe0890b965c7f8e2ca0d677f7bc50e4eed25e52501c82179741202f9e0d37e2a280d206f020f3d75985d56591d84e9bfe557368b68abf5ac272c58c5b24ab26ee7e2c88450619222129fa2b42dfb923e720ac95663320f8adff32861a993382a9afe00ebf1b1a2b939c1ffed96c79ebe95727eb02ef06fff45c03c596de2c92146daa10009abd0813c485ff595a4374d522d0c3a19c66f5b52817884d4bc6a52eee43ee9b4fab197a67ead6c3219c6951967935efbe7ad9c9ae9aa51f892e49fea9a4741af82092e611b9a41b5401aa99ed39bc7ac5da87a32d8e7073a635717b2e32139ad10fb7439b99b2b631a73ca0a4fb3dbc3afe01892e7f90680dfc5ac9678b5a960d034f4b21c526e8152ddd1d70a0a12378ff634ddfe6a876ede36946c84d171f1acd9fbd49ebcfac04531f2c41a916387767f8b698166724809918eddd497a187cc81ba7f6efadf0d5814f7b961b15370feded105f62002935280d9a444625085827fef152644882defadc0be2940f330c3b1fba44bd8e2fb4024f026a9d62e7a65d6186c77d90f2a016dcc3abca144d82d694ded21f02b6d9d0c3a4bb7802511c76279c28ad1f738250ec73ba0002c93f35f61b546b43951635770261939f71573fe56b1c708ac74127562f2cb29b9a58e72831cb85c099efdcf4f231550d3da0a7096271a43825b0d8811c8ac5c3ef9e927514fd0bfecdf7417b8a199248e26bafb14821bfe5d8a022e53d7f712a72ef0cc2c42abd728ff6d4708b836400e38579e8f47aebd0085a4f995487ffe1d1cb6d10c8e634b31e09fcfeba256c23aad34bfb3d5986954fbeb57ea0a5626432cceffd1017101ca08629712ff491b171a68e1a9de6c769cc8a1a06efe8a696418a6fbf402171f245bab1ad6cddf9842036d384a59fba5f667e4ff09475c343ed96f12fe44c53d8b5add6f55af0340f1a56a4f7cec8fd61d26ffdb7e44150de4582052426deaec7a8b714fa8c63b8cf2de35ac9922b5334a01f022ede3a4c967e885734416ee21758f3e33bc3d94cc33647610aecb7cadf1add54b217d2f5069994965c2179f9f183fc55f77f606951139ab80ced0fc3cf106a50a301f35f71f75d45695fd2d6cf7f06ea118ee1f39c129381e2d47dded8c681a17e5dc53fded6be0d1d1672eb6f864ddbbab786ab8ac2d172b0ac62a8eae4b536ad93a553285e98e4c529acf9fe933c098ee63c0ff861361c2b2ee54e0831ce6336e1d095c52a7119dbea749f3e47afe350df3d0fb5b11f2a2cf92be12e0698d9edff15f421fb883f9a2cbbf6dedfff873dddddffdbc0a5b2a916c3fa44ae46ed428b76057b1f0843b55720d916a6fa7d97fc3a6659366d80f6769b1731a6a38310dd1062fbcb58f3050e4fa972e8b25e14896b9d344cdbe9ddfbbeffe4c76fd0b6e78dfd8a461cdc3fdcfbca71a8fba0f96d9fd556131fcc2284de896d83d4d8d9b17f7332804990c361584368e555d16304a592c0c93732a085d06dae10a65d194e317d8de509bbb3be6a3e68b8a38693afb2c27d7f7db76f9ecabb11105ecee8358d5a9b19555697adb86176e23630b0c725ee35940e5a2cf6d992c2aeb611470e576682e77df8d055ec57cdff164efeba45d1794aa45a0e46d654a788874947e8cf2ed1711e2ff3132deeff28039784036b399f0547836ce3b341468d857e37e3304222a8a0a2d2c036e09acac7b81d472d3777219d22e1ac1e9aa5a0b1016d80a2d0b7e3961cc117f88d5cfc6850fffec6948332aeeda8a4b8af0ff138a2e28a5cbf7acb4dfbde1a4f87b5929e652ba71b9d17e0eb049b08ca6d9cd1a6a3853abe6e1ad82833e30133a6322498df654d6a3e9115db0322eeb49cf387f774bf9d414c1159107b841f77f7b69203e210f29af4b3d54604a87b794959460d659e66a4b96c1215d9e8e988bc3f0d76563e58aeee6e25d15233a7618781d142d942a416a7e592d00000000da901c998d4905bcbe1e104975f4eafbfa1179478691eba7e18654ce5a7b9ac75a06609fa18e01172983775b5e60c0e2b2a8588e"], 0x1022) r3 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000100)='/dev/vga_arbiter\x00', 0x10000, 0x0) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000001200)='IPVS\x00') sendmsg$IPVS_CMD_GET_DEST(r3, &(0x7f0000001300)={&(0x7f00000011c0)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f00000012c0)={&(0x7f0000001240)={0x54, r4, 0x200, 0x70bd2b, 0x25dfdbfc, {0x8}, [@IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x5}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x40}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x5}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x871}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x2}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0xb7}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x4}]}, 0x54}, 0x1, 0x0, 0x0, 0x8841}, 0x800) getegid() setsockopt$inet_tcp_int(r1, 0x6, 0x22, &(0x7f0000cb9ffc)=0x1, 0x4) bind$inet(r1, &(0x7f0000c16ff0)={0x2, 0x1, @multicast1=0xe0000001}, 0x10) sendto$inet(r1, &(0x7f0000fa0fff), 0xfffffffffffffeb0, 0x20020007, &(0x7f0000e97fcf)={0x2, 0x1, @loopback=0x7f000001}, 0x10) syncfs(r0) accept4$llc(r1, &(0x7f0000001340)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @random}, &(0x7f0000001380)=0x10, 0x800) [ 734.958624] binder: 20086:20110 ioctl c0306201 20000140 returned -22 2018/05/12 22:57:35 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='dctcp\x00', 0x6) sendto$inet6(r0, &(0x7f00004e8000), 0xf401, 0x20000001, &(0x7f000007f000)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff0f0000]}}, 0x1c) 2018/05/12 22:57:35 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140), 0x1f00}, 0x0) 2018/05/12 22:57:35 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0x1, 0x8800000, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:57:35 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0x2900, 0x0, 0x252]}) 2018/05/12 22:57:35 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x34000], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) [ 735.058549] binder: 20152:20154 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 735.065841] binder: 20152:20154 unknown command 1074291460 [ 735.129243] binder: 20152:20154 ioctl c0306201 20000140 returned -22 [ 735.194559] binder: 20152:20177 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 735.202108] binder: 20152:20177 unknown command 1074291460 2018/05/12 22:57:35 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='dctcp\x00', 0x6) sendto$inet6(r0, &(0x7f00004e8000), 0xf401, 0x20000001, &(0x7f000007f000)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50000]}}, 0x1c) 2018/05/12 22:57:35 executing program 5: r0 = socket(0x20000000000000a, 0x5, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x4, 0x32, 0xffffffffffffffff, 0x0) r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000003fe8)={0xaa}) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000001fe2)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_DISABLE_FRAGMENTS(r2, 0x84, 0x1e, &(0x7f0000013e95)=0xfffffffffffffffb, 0x0) setsockopt$inet_sctp6_SCTP_AUTH_DELETE_KEY(r2, 0x84, 0x16, &(0x7f00000001c0), 0x8) ioctl$sock_SIOCETHTOOL(r2, 0x8943, &(0x7f0000000040)={'bridge0\x00', &(0x7f0000000080)=ANY=[]}) close(r1) ioctl$VT_GETSTATE(r1, 0x5603, &(0x7f0000000080)={0x400, 0x2, 0x7f}) accept$packet(r0, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, &(0x7f0000000100)=0x14) 2018/05/12 22:57:35 executing program 3: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x710b, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x12, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:57:35 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140), 0xe}, 0x0) 2018/05/12 22:57:35 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100000000000000], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) 2018/05/12 22:57:35 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x1c, 0x0, &(0x7f0000000040)=[@request_death={0x400c630e}, @free_buffer={0x40046302}], 0x0, 0x0, &(0x7f0000000080)}) 2018/05/12 22:57:35 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0x1, 0x2000, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:57:35 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0x2c, 0x0, 0x252]}) [ 735.273756] binder: 20152:20177 ioctl c0306201 20000140 returned -22 2018/05/12 22:57:36 executing program 5: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$urandom(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/urandom\x00', 0x1, 0x0) bind$bt_l2cap(r0, &(0x7f0000000200)={0x1f, 0x63b, {0x9, 0xfffffffffffffff9, 0x3, 0xd8bf, 0xfffffffffffffe01, 0x5}, 0x1d, 0x1}, 0xe) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r1, &(0x7f0000000140)={&(0x7f0000000180)={0x10}, 0xc, &(0x7f0000f93000)={&(0x7f000024e000)=ANY=[@ANYBLOB="140000000001090f010400000000000000000000"], 0x14}, 0x1}, 0x0) r2 = syz_open_dev$dmmidi(&(0x7f0000000040)='/dev/dmmidi#\x00', 0x401, 0x503180) ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO(r2, 0x40a85323, &(0x7f0000000080)={{0x2d1f973f, 0x100}, 'port1\x00', 0x26, 0x8, 0x6, 0x86, 0x6, 0xe99, 0xd53a, 0x0, 0x1, 0x1}) 2018/05/12 22:57:36 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0x600000000000000, 0x0, 0x252]}) [ 735.383209] binder: 20203:20204 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 735.390765] binder: BC_ACQUIRE_RESULT not supported [ 735.420384] binder: 20203:20204 ioctl c0306201 20000140 returned -22 [ 735.455741] binder: 20203:20211 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 735.463327] binder: BC_ACQUIRE_RESULT not supported [ 735.488857] binder: 20203:20211 ioctl c0306201 20000140 returned -22 2018/05/12 22:57:36 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffff000], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) 2018/05/12 22:57:36 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140), 0xffffffc0}, 0x0) 2018/05/12 22:57:36 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='dctcp\x00', 0x6) sendto$inet6(r0, &(0x7f00004e8000), 0xf401, 0x20000001, &(0x7f000007f000)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa000000]}}, 0x1c) 2018/05/12 22:57:36 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0x1, 0x7f00000000000000, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:57:36 executing program 3: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x31, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x12, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:57:36 executing program 5: recvmsg(0xffffffffffffffff, &(0x7f000000e5b4)={&(0x7f000000b000)=@can, 0x10, &(0x7f0000002000)=[{&(0x7f0000000000)=""/237, 0x3c7}, {&(0x7f0000000fdb)=""/37, 0x9c}], 0x96b0cf4a6d2225a0, 0x0, 0xb5}, 0x0) memfd_create(&(0x7f0000000100)='vmnet1vmnet1user\x00', 0x3) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x1, 0x5, &(0x7f0000002000)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x31a}, [@jmp={0xc, 0x0, 0x42}], {0x95}}, &(0x7f000000a000)='syzkaller\x00', 0x1, 0x31b, &(0x7f0000011000)=""/195}, 0x48) 2018/05/12 22:57:36 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x1c, 0x0, &(0x7f0000000040)=[@request_death={0x400c630e}, @free_buffer={0x40106309}], 0x0, 0x0, &(0x7f0000000080)}) 2018/05/12 22:57:36 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0x300000000000000, 0x0, 0x252]}) 2018/05/12 22:57:36 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='dctcp\x00', 0x6) sendto$inet6(r0, &(0x7f00004e8000), 0xf401, 0x20000001, &(0x7f000007f000)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x600]}}, 0x1c) [ 735.637529] binder: 20232:20233 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 735.644927] binder: 20232:20233 BC_ACQUIRE_DONE u0000000000000000 no match 2018/05/12 22:57:36 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140), 0x2}, 0x0) 2018/05/12 22:57:36 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0x1, 0xffffffff00000000, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:57:36 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0x2900000000000000, 0x0, 0x252]}) 2018/05/12 22:57:36 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa9080000], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) 2018/05/12 22:57:36 executing program 3: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x121, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x12, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) [ 735.770268] binder: 20232:20253 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 735.777684] binder: 20232:20253 BC_ACQUIRE_DONE u0000000000000000 no match 2018/05/12 22:57:36 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='dctcp\x00', 0x6) sendto$inet6(r0, &(0x7f00004e8000), 0xf401, 0x20000001, &(0x7f000007f000)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa00000000000000]}}, 0x1c) 2018/05/12 22:57:36 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140), 0xe00000000000000}, 0x0) 2018/05/12 22:57:36 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x1c, 0x0, &(0x7f0000000040)=[@request_death={0x400c630e}, @free_buffer={0x400c630e}], 0x0, 0x0, &(0x7f0000000080)}) 2018/05/12 22:57:36 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f000001], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) 2018/05/12 22:57:36 executing program 5: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$inet(0x10, 0x3, 0x0) r2 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000040)='/dev/dsp\x00', 0x2080, 0x0) ioctl$DRM_IOCTL_RES_CTX(r2, 0xc0106426, &(0x7f00000000c0)={0x6, &(0x7f0000000080)=[{}, {}, {}, {}, {}, {}]}) sendmsg(r1, &(0x7f0000011fc8)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000002000)="24000000240007031dfffd946fa2830020200a0009000000461d85680c1ba3a20400ff7e280000001100ffffba16a0aa1c0009b356da5a80d18bec4c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x0) 2018/05/12 22:57:36 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0x1, 0xe, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:57:36 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0x1100, 0x0, 0x252]}) 2018/05/12 22:57:36 executing program 3: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x12, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x12, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:57:36 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='dctcp\x00', 0x6) sendto$inet6(r0, &(0x7f00004e8000), 0xf401, 0x20000001, &(0x7f000007f000)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f4]}}, 0x1c) [ 736.027638] binder: 20287:20293 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 736.033484] netlink: 8 bytes leftover after parsing attributes in process `syz-executor5'. 2018/05/12 22:57:36 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0x600, 0x0, 0x252]}) 2018/05/12 22:57:36 executing program 3: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0xffe0, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x12, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:57:36 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0x1, 0x31000000, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:57:36 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140), 0xc0ffffff}, 0x0) 2018/05/12 22:57:36 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfcffffff00000000], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) [ 736.068447] binder: 20287:20293 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 736.107626] binder: 20287:20301 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 2018/05/12 22:57:36 executing program 5: r0 = syz_open_dev$usbmon(&(0x7f0000000000)='/dev/usbmon#\x00', 0x8, 0x20000) getsockname$netrom(r0, &(0x7f0000000040), &(0x7f0000000080)=0x10) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_TIMER(r0, 0xc0605345, &(0x7f00000000c0)={0x7f, 0x0, {0xffffffffffffffff, 0x0, 0x4, 0x3, 0x2}}) r1 = getpid() r2 = syz_open_procfs(r1, &(0x7f0000d0a000)='comm\x00') ftruncate(r2, 0x3) ftruncate(r0, 0x740) [ 736.165889] binder: 20287:20301 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 2018/05/12 22:57:36 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0x11, 0x0, 0x252]}) 2018/05/12 22:57:36 executing program 3: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x3f00000000000000, 0x0, 0x12, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:57:37 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='dctcp\x00', 0x6) sendto$inet6(r0, &(0x7f00004e8000), 0xf401, 0x20000001, &(0x7f000007f000)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfe80000000000000]}}, 0x1c) 2018/05/12 22:57:37 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x1c, 0x0, &(0x7f0000000040)=[@request_death={0x400c630e}, @free_buffer={0x40486311}], 0x0, 0x0, &(0x7f0000000080)}) 2018/05/12 22:57:37 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0x2c00000000000000, 0x0, 0x252]}) 2018/05/12 22:57:37 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000f56000)={0x0, 0x0, &(0x7f0000f85ff0)={&(0x7f0000000000)={0x2, 0x1, 0x0, 0x0, 0x2}, 0x10}, 0x1}, 0x0) remap_file_pages(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x1000008, 0x7fff, 0x1002) setsockopt$inet_MCAST_JOIN_GROUP(r0, 0x0, 0x2a, &(0x7f0000000040)={0x0, {{0x2, 0x4e21, @multicast2=0xe0000002}}}, 0x88) 2018/05/12 22:57:37 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0x1, 0x7f000000, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:57:37 executing program 3: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x2000000000000, 0x0, 0x12, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:57:37 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140), 0x1800000000000000}, 0x0) 2018/05/12 22:57:37 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f00000100000000], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) [ 737.035819] binder: 20351:20352 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 2018/05/12 22:57:37 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0x1, 0x10000000, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:57:37 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0xfdffffff00000000, 0x0, 0x252]}) 2018/05/12 22:57:37 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) 2018/05/12 22:57:37 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140), 0xa00000000000000}, 0x0) 2018/05/12 22:57:37 executing program 3: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x1200000000000000, 0x0, 0x12, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) [ 737.090507] binder: 20351:20352 transaction failed 29189/-22, size 0-0 line 2856 2018/05/12 22:57:37 executing program 5: r0 = syz_open_procfs(0x0, &(0x7f0000000040)="2f65786500000000000035abe1e80d903e0d717ac1889a45e581c9e14a5c8f95f5d2968ae8c767e9d18fd69a") flistxattr(r0, &(0x7f0000000100)=""/71, 0x47) [ 737.131621] binder: 20351:20367 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 2018/05/12 22:57:37 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='dctcp\x00', 0x6) sendto$inet6(r0, &(0x7f00004e8000), 0xf401, 0x20000001, &(0x7f000007f000)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb6c78c0600000000]}}, 0x1c) [ 737.201834] binder: 20351:20367 transaction failed 29189/-22, size 0-0 line 2856 2018/05/12 22:57:37 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0x3c00000000000000, 0x0, 0x252]}) 2018/05/12 22:57:37 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0x1, 0xfffffdef, r0, &(0x7f0000000000), 0xfe00}]) [ 737.338513] binder: undelivered TRANSACTION_ERROR: 29189 [ 737.344193] binder: undelivered TRANSACTION_ERROR: 29189 2018/05/12 22:57:38 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0x1, 0x100000, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:57:38 executing program 3: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x20000000000000, 0x0, 0x12, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:57:38 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x1c, 0x0, &(0x7f0000000040)=[@request_death={0x400c630e}, @free_buffer={0x40486312}], 0x0, 0x0, &(0x7f0000000080)}) 2018/05/12 22:57:38 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='dctcp\x00', 0x6) sendto$inet6(r0, &(0x7f00004e8000), 0xf401, 0x20000001, &(0x7f000007f000)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100000000000000]}}, 0x1c) 2018/05/12 22:57:38 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9effffff00000000], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) 2018/05/12 22:57:38 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0x29, 0x0, 0x252]}) 2018/05/12 22:57:38 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140), 0x100000000000000}, 0x0) 2018/05/12 22:57:38 executing program 5: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000fcbff7)='/dev/kvm\x00', 0x0, 0x0) syz_open_dev$mice(&(0x7f0000000100)='/dev/input/mice\x00', 0x0, 0x80) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000140)=[@textreal={0x8, &(0x7f0000000040)="b8ff0f8ed066b94508000066b82462000066ba000000000f300f58717f66b9c80900000f320f20c06635000000400f22c00fc76800b839088ed80f080f01d1640fc75c00", 0x44}], 0x1, 0x0, &(0x7f0000000180), 0x0) ioctl$KVM_SET_XCRS(r3, 0x4188aea7, &(0x7f00000000c0)=ANY=[@ANYBLOB="0200000000000000ffffff7f0000000000000000000000000000000000000000"]) [ 737.445746] binder: 20408:20415 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 737.453190] binder: 20408:20415 got reply transaction with no transaction stack [ 737.461112] binder: 20408:20415 transaction failed 29201/-71, size 0-0 line 2763 2018/05/12 22:57:38 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140), 0xffffff7f}, 0x0) 2018/05/12 22:57:38 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='dctcp\x00', 0x6) sendto$inet6(r0, &(0x7f00004e8000), 0xf401, 0x20000001, &(0x7f000007f000)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x91ffffff]}}, 0x1c) 2018/05/12 22:57:38 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf0ffffff00000000], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) 2018/05/12 22:57:38 executing program 3: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x400000000000000, 0x0, 0x12, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:57:38 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0x1, 0x1000000, r0, &(0x7f0000000000), 0xfe00}]) [ 737.557455] binder: 20408:20429 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 737.564749] binder: 20408:20429 got reply transaction with no transaction stack [ 737.572365] binder: 20408:20429 transaction failed 29201/-71, size 0-0 line 2763 2018/05/12 22:57:38 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0x32, 0x0, 0x252]}) 2018/05/12 22:57:38 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffff000], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) 2018/05/12 22:57:38 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140), 0x1800}, 0x0) 2018/05/12 22:57:38 executing program 3: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x5000000, 0x0, 0x12, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:57:38 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0x4000000, 0x0, 0x252]}) 2018/05/12 22:57:38 executing program 5: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c6262c2c8523bf012cf66f") r1 = openat$cuse(0xffffffffffffff9c, &(0x7f00001a3000)='/dev/cuse\x00', 0x0, 0x0) r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ion\x00', 0x0, 0x0) close(r1) ioctl$sock_SIOCGPGRP(r1, 0x8904, &(0x7f0000000040)=0x0) get_robust_list(r3, &(0x7f0000000200)=&(0x7f00000001c0)={&(0x7f00000000c0)={&(0x7f0000000080)}, 0x0, &(0x7f0000000180)={&(0x7f0000000140)}}, &(0x7f0000000240)=0x18) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000001fc8)={0x0, 0x0, &(0x7f0000003000), 0x0, &(0x7f0000002000)=ANY=[@ANYBLOB="cbff7f00000000000e"], 0x9}, 0x0) ioctl(r2, 0xc0184900, &(0x7f0000002000)) mmap$binder(&(0x7f0000e00000/0x200000)=nil, 0x200000, 0x4, 0x13, r1, 0x0) 2018/05/12 22:57:38 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x1c, 0x0, &(0x7f0000000040)=[@request_death={0x400c630e}, @free_buffer={0x4008634d}], 0x0, 0x0, &(0x7f0000000080)}) 2018/05/12 22:57:38 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0x1, 0x12000000, r0, &(0x7f0000000000), 0xfe00}]) [ 737.766790] binder: undelivered TRANSACTION_ERROR: 29201 [ 737.772533] binder: undelivered TRANSACTION_ERROR: 29201 2018/05/12 22:57:38 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200000000000000], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) 2018/05/12 22:57:38 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140), 0x0, 0xa00}, 0x0) [ 737.878818] binder: 20466:20468 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 737.886871] binder: 20466:20468 unknown command 1074291533 2018/05/12 22:57:38 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0x300, 0x0, 0x252]}) 2018/05/12 22:57:38 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0x1, 0x3, r0, &(0x7f0000000000), 0xfe00}]) [ 738.018512] binder: 20466:20468 ioctl c0306201 20000140 returned -22 [ 738.056425] binder: 20466:20496 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 738.063760] binder: 20466:20496 unknown command 1074291533 [ 738.081010] binder: 20466:20496 ioctl c0306201 20000140 returned -22 2018/05/12 22:57:39 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='dctcp\x00', 0x6) sendto$inet6(r0, &(0x7f00004e8000), 0xf401, 0x20000001, &(0x7f000007f000)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000]}}, 0x1c) 2018/05/12 22:57:39 executing program 5: r0 = syz_open_dev$midi(&(0x7f0000000000)='/dev/midi#\x00', 0x5, 0xc2) ioctl$sock_inet_SIOCSARP(r0, 0x8955, &(0x7f00000000c0)={{0x2, 0x1, @rand_addr=0x3ff}, {0x6}, 0xa, {0x2, 0x4e20, @rand_addr=0x75}, 'ip6tnl0\x00'}) r1 = socket(0x10, 0x3, 0x0) write(r1, &(0x7f0000000080)="2400000032001f1546b472da91173e3ab70007010c00020050ff010000003768a0f5fb00", 0x24) signalfd4(r0, &(0x7f0000000040)={0x531}, 0x8, 0x80800) 2018/05/12 22:57:39 executing program 3: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x3f00, 0x0, 0x12, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:57:39 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa00000000000000], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) 2018/05/12 22:57:39 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140), 0x0, 0x7}, 0x0) 2018/05/12 22:57:39 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0x3200, 0x0, 0x252]}) 2018/05/12 22:57:39 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0x1, 0xfeffffff00000000, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:57:39 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x1c, 0x0, &(0x7f0000000040)=[@request_death={0x400c630e}, @free_buffer={0x40086303}], 0x4, 0x0, &(0x7f0000000080)}) [ 738.590886] binder: 20512:20515 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 738.613821] binder: 20512:20515 BC_FREE_BUFFER u0000000000000000 no match 2018/05/12 22:57:39 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140), 0x0, 0xa00000000000000}, 0x0) 2018/05/12 22:57:39 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0xffffff89, 0x0, 0x252]}) 2018/05/12 22:57:39 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0x1, 0x1200000000000000, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:57:39 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40030000000000], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) 2018/05/12 22:57:39 executing program 5: r0 = socket$inet6_sctp(0xa, 0x5, 0x84) mmap(&(0x7f0000000000/0xeef000)=nil, 0xeef000, 0x4, 0x32, 0xffffffffffffffff, 0x0) getsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r0, 0x84, 0x1f, &(0x7f0000000100)={0x0, @in={{0x2, 0x0, @multicast2=0xe0000002}}}, &(0x7f0000000000)=0x90) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='net/unix\x00') mkdirat(r1, &(0x7f0000000080)='./file0\x00', 0x53) 2018/05/12 22:57:39 executing program 3: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0xf, 0x0, 0x12, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) [ 738.644465] binder: 20512:20525 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 738.679244] binder: 20512:20525 BC_FREE_BUFFER u0000000000000000 no match 2018/05/12 22:57:39 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='dctcp\x00', 0x6) sendto$inet6(r0, &(0x7f00004e8000), 0xf401, 0x20000001, &(0x7f000007f000)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9000000]}}, 0x1c) 2018/05/12 22:57:39 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0xffffffff00000000, 0x0, 0x252]}) 2018/05/12 22:57:39 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0x1, 0xfe000000000000, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:57:39 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140), 0x0, 0x700000000000000}, 0x0) 2018/05/12 22:57:39 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xaa593a576e000000], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) 2018/05/12 22:57:39 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xef) read(r0, &(0x7f00000003c0)=""/187, 0xbb) mlock2(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x1) recvmsg(r0, &(0x7f00000002c0)={&(0x7f0000000040)=@pppol2tp={0x0, 0x0, {0x0, 0xffffffffffffffff}}, 0x80, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/40, 0x28}, {&(0x7f0000000100)=""/173, 0xad}], 0x2, &(0x7f0000000200)=""/136, 0x88, 0x400}, 0x60) getsockname$unix(r1, &(0x7f0000000300)=@abs, &(0x7f0000000380)=0x6e) setsockopt$inet6_int(r0, 0x29, 0x5, &(0x7f0000000000)=0x2, 0x4) ioctl$TIOCGPGRP(0xffffffffffffff9c, 0x540f, &(0x7f0000000480)=0x0) ioprio_get$pid(0x1, r2) setsockopt$inet6_int(r0, 0x29, 0x4, &(0x7f0000013ffc)=0x2, 0x4) sendto$inet6(r0, &(0x7f0000001ffe), 0x0, 0x0, &(0x7f0000003000)={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [], 0x1}}, 0x1c) r3 = syz_open_dev$vcsn(&(0x7f00000004c0)='/dev/vcs#\x00', 0x400, 0x0) ioctl$SG_GET_NUM_WAITING(r3, 0x227d, &(0x7f0000000500)) 2018/05/12 22:57:39 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x1c, 0x0, &(0x7f0000000040)=[@request_death={0x400c630e}, @free_buffer={0x40086303}], 0x3000000, 0x0, &(0x7f0000000080)}) 2018/05/12 22:57:39 executing program 3: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0xf5ffffff00000000, 0x0, 0x12, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:57:39 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0x1c00, 0x0, 0x252]}) 2018/05/12 22:57:39 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffff9e], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) 2018/05/12 22:57:39 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140), 0x0, 0x2000000}, 0x0) 2018/05/12 22:57:39 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='dctcp\x00', 0x6) sendto$inet6(r0, &(0x7f00004e8000), 0xf401, 0x20000001, &(0x7f000007f000)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, 0x1c) [ 738.992498] binder: 20574:20577 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 739.065900] binder: 20574:20577 BC_FREE_BUFFER u0000000000000000 no match [ 739.107397] binder: 20574:20594 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 739.128504] binder: 20574:20594 BC_FREE_BUFFER u0000000000000000 no match 2018/05/12 22:57:40 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0x1, 0xf00, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:57:40 executing program 3: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x2000000000000000, 0x0, 0x12, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:57:40 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0x1c00000000000000, 0x0, 0x252]}) 2018/05/12 22:57:40 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140), 0x0, 0x1f000000}, 0x0) 2018/05/12 22:57:40 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) 2018/05/12 22:57:40 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x1c, 0x0, &(0x7f0000000040)=[@request_death={0x400c630e}, @free_buffer={0x40086303}], 0x7000000, 0x0, &(0x7f0000000080)}) 2018/05/12 22:57:40 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='dctcp\x00', 0x6) sendto$inet6(r0, &(0x7f00004e8000), 0xf401, 0x20000001, &(0x7f000007f000)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x700]}}, 0x1c) 2018/05/12 22:57:40 executing program 5: prctl$intptr(0x26, 0x1) r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000080)='cgroup.controllers\x00', 0x0, 0x0) getsockopt$SO_COOKIE(r0, 0x1, 0x39, &(0x7f00000000c0), &(0x7f0000000100)=0x8) seccomp(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000040)=[{0x6, 0x0, 0x3f}]}) exit_group(0x2) [ 740.066637] binder: 20613:20615 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 2018/05/12 22:57:40 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0x400000000000000, 0x0, 0x252]}) 2018/05/12 22:57:40 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0x1, 0xeffd, r0, &(0x7f0000000000), 0xfe00}]) [ 740.109795] audit: type=1326 audit(1526165860.729:210): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=20611 comm="syz-executor5" exe="/root/syz-executor5" sig=31 arch=c000003e syscall=202 compat=0 ip=0x455979 code=0x0 2018/05/12 22:57:40 executing program 3: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x40000, 0x0, 0x12, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:57:40 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) 2018/05/12 22:57:40 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140), 0x0, 0xc0ffffff}, 0x0) [ 740.154392] binder: 20613:20615 BC_FREE_BUFFER u0000000000000000 no match [ 740.196911] binder: 20613:20632 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 740.245147] binder: 20613:20632 BC_FREE_BUFFER u0000000000000000 no match 2018/05/12 22:57:41 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='dctcp\x00', 0x6) sendto$inet6(r0, &(0x7f00004e8000), 0xf401, 0x20000001, &(0x7f000007f000)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4002]}}, 0x1c) 2018/05/12 22:57:41 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0x89ffffff, 0x0, 0x252]}) 2018/05/12 22:57:41 executing program 5: r0 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000e15000)={0x26, 'rng\x00', 0x0, 0x0, 'jitterentropy_rng\x00'}, 0x58) r2 = accept4$alg(r1, 0x0, 0x0, 0x0) r3 = syz_open_dev$dmmidi(&(0x7f0000001040)='/dev/dmmidi#\x00', 0x80, 0x0) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x2, 0x10, r0, 0x0) ioctl$sock_bt_cmtp_CMTPCONNADD(r3, 0x400443c8, &(0x7f0000001080)={r2, 0x8fcb}) readv(r2, &(0x7f0000000000)=[{&(0x7f0000000040)=""/4096, 0xfea7}], 0x1) 2018/05/12 22:57:41 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0x1, 0x3a800, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:57:41 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0ffffff00000000], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) 2018/05/12 22:57:41 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x1c, 0x0, &(0x7f0000000040)=[@request_death={0x400c630e}, @free_buffer={0x40086303}], 0xffffff7f, 0x0, &(0x7f0000000080)}) 2018/05/12 22:57:41 executing program 3: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x82000000, 0x0, 0x12, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:57:41 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140), 0x0, 0x1800}, 0x0) 2018/05/12 22:57:41 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0x0, 0x2f, 0x252]}) [ 740.915342] binder: 20656:20658 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 2018/05/12 22:57:41 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0x1, 0xfbffffff00000000, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:57:41 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140), 0x0, 0x700}, 0x0) 2018/05/12 22:57:41 executing program 3: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x502d, 0x0, 0x12, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:57:41 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf0], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) [ 740.959308] binder: 20656:20658 BC_FREE_BUFFER u0000000000000000 no match [ 740.994913] binder: 20656:20680 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 2018/05/12 22:57:41 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140), 0x0, 0xfffffffe}, 0x0) [ 741.067528] binder: 20656:20680 BC_FREE_BUFFER u0000000000000000 no match 2018/05/12 22:57:41 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0x0, 0x3300000000000000, 0x252]}) 2018/05/12 22:57:41 executing program 3: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0xffffffe4, 0x0, 0x12, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:57:42 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0x1, 0xf00000000000000, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:57:42 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140), 0x0, 0x1800000000000000}, 0x0) 2018/05/12 22:57:42 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0x0, 0xffffff88, 0x252]}) 2018/05/12 22:57:42 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf0ffffff], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) 2018/05/12 22:57:42 executing program 3: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x781, 0x0, 0x12, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:57:42 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='dctcp\x00', 0x6) sendto$inet6(r0, &(0x7f00004e8000), 0xf401, 0x20000001, &(0x7f000007f000)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x500000000000000]}}, 0x1c) 2018/05/12 22:57:42 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x1c, 0x0, &(0x7f0000000040)=[@request_death={0x400c630e}, @free_buffer={0x40086303}], 0xfffffdfd, 0x0, &(0x7f0000000080)}) 2018/05/12 22:57:42 executing program 5: r0 = syz_open_dev$mice(&(0x7f0000000540)='/dev/input/mice\x00', 0x0, 0x3ffb) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000ab9ff0)={0x2, &(0x7f000039a000)=[{0x20, 0x0, 0x0, 0xffffffffffffbe9e}, {0x6}]}, 0x10) write(r1, &(0x7f0000000100), 0x10174) pipe(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) unshare(0x8000400) mq_open(&(0x7f000004b000)='/$cgrouplo\x00', 0xfffffffffffffffe, 0x0, &(0x7f000004b000)={0x3, 0x7, 0x3}) unshare(0xc000000) mincore(&(0x7f0000fed000/0x11000)=nil, 0x11000, &(0x7f0000000040)=""/94) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x2400, 0x2) add_key$keyring(&(0x7f00000000c0)='keyring\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x2}, 0x0, 0x0, 0x0) add_key$keyring(&(0x7f0000000140)='keyring\x00', &(0x7f0000000180)={0x73, 0x79, 0x7a}, 0x0, 0x0, 0xfffffffffffffff8) pipe2(&(0x7f0000f61000)={0xffffffffffffffff}, 0x0) write$sndseq(0xffffffffffffffff, &(0x7f0000000080), 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r6 = userfaultfd(0x0) ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f0000bc8000)={0xaa, 0x2}) getpeername(r5, &(0x7f0000000200)=@rc, &(0x7f0000000280)=0x80) write$sndseq(0xffffffffffffffff, &(0x7f0000000000)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @time=@time={0x77359400}}], 0x30) tee(r5, r4, 0x1, 0x0) r7 = dup2(r5, r6) syz_genetlink_get_family_id$ipvs(&(0x7f0000000ac0)='IPVS\x00') dup2(r0, 0xffffffffffffffff) ioctl$TCXONC(0xffffffffffffffff, 0x540a, 0x0) setsockopt$inet_sctp6_SCTP_FRAGMENT_INTERLEAVE(r3, 0x84, 0x12, &(0x7f0000000180)=0x200, 0x4) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(0xffffffffffffffff, 0x84, 0x1d, &(0x7f00000001c0)=ANY=[@ANYBLOB="3f00000000000000000000f7b679273718026fe72101462a"], &(0x7f0000000440)=0x1) getsockopt$inet_sctp_SCTP_PR_ASSOC_STATUS(r7, 0x84, 0x73, &(0x7f0000000300)={0x0, 0x1, 0x4000000, 0xffffffffffffffff, 0x2}, &(0x7f0000000100)=0x18) ioctl$VT_GETMODE(r7, 0x5601, &(0x7f00000002c0)) setsockopt$inet_sctp6_SCTP_RESET_STREAMS(r5, 0x84, 0x77, &(0x7f0000000140)=ANY=[@ANYRES32=r8, @ANYBLOB="0400feff0408"], 0x2) [ 741.864623] binder: 20716:20718 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 741.882817] binder: 20716:20718 BC_FREE_BUFFER u0000000000000000 no match 2018/05/12 22:57:42 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0x0, 0x1c, 0x252]}) 2018/05/12 22:57:42 executing program 3: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x3, 0x0, 0x12, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:57:42 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0x1, 0xeffdffff, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:57:42 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8a9], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) 2018/05/12 22:57:42 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140), 0x0, 0xfd00000000000000}, 0x0) [ 741.910260] binder: 20716:20737 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 741.944298] binder: 20716:20737 BC_FREE_BUFFER u0000000000000000 no match 2018/05/12 22:57:42 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='dctcp\x00', 0x6) sendto$inet6(r0, &(0x7f00004e8000), 0xf401, 0x20000001, &(0x7f000007f000)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7000000]}}, 0x1c) 2018/05/12 22:57:42 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0x0, 0x2b00000000000000, 0x252]}) 2018/05/12 22:57:42 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140), 0x0, 0x200000000000000}, 0x0) 2018/05/12 22:57:42 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x1c, 0x0, &(0x7f0000000040)=[@request_death={0x400c630e}, @free_buffer={0x40086303}], 0xe4ed030000000000, 0x0, &(0x7f0000000080)}) 2018/05/12 22:57:42 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000000000], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) [ 742.149618] binder: 20767:20770 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 742.191179] binder: 20767:20770 BC_FREE_BUFFER u0000000000000000 no match [ 742.217145] binder: 20767:20780 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 742.232429] binder: 20767:20780 BC_FREE_BUFFER u0000000000000000 no match 2018/05/12 22:57:43 executing program 3: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0xe00, 0x0, 0x12, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:57:43 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x1c, 0x0, &(0x7f0000000040)=[@request_death={0x400c630e}, @free_buffer={0x40086303}], 0x1000000, 0x0, &(0x7f0000000080)}) 2018/05/12 22:57:43 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0x1, 0xfeffffff, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:57:43 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='dctcp\x00', 0x6) sendto$inet6(r0, &(0x7f00004e8000), 0xf401, 0x20000001, &(0x7f000007f000)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7]}}, 0x1c) 2018/05/12 22:57:43 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0x0, 0x11000000, 0x252]}) 2018/05/12 22:57:43 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140), 0x0, 0xfd}, 0x0) 2018/05/12 22:57:43 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400300], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) 2018/05/12 22:57:43 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = syz_open_dev$audion(&(0x7f0000000040)='/dev/audio#\x00', 0x3, 0x8c00) ioctl$BLKROSET(r1, 0x125d, &(0x7f0000000080)=0x401) sendmsg$nl_route(r0, &(0x7f0000000100)={&(0x7f0000000000)={0x10}, 0xc, &(0x7f0000000140)={&(0x7f00000002c0)=ANY=[@ANYBLOB="2400000018009515b6da14000000080002000000ff0000050000000008000500ac1414bbb675c5835e9024434d9972c91203d625f836995fe84d666ed85aaf59a8862b1c8c2092108546dccf2c62debbc41129bc66210ba70863b8314a58fa0d6158094a7719649b3392f368dbd57229e1795bba451c2ca983e483abe0ad536fac4876b6a543e17e3cbbd6a6297d544b37c2ff6a5ce5bbd791f7d99f6fa12714b5817c68e95d07b9120f80f07ee7b8981f6aa1738c2b8d4420a57a601483f50cd324ec8c51ac516ed216bc3a2472b6bf3eb428635700d12fda8688dd8b743ccb30233d7c173152f6ee6318874a0e0533dd7b66484e1883a6ba20add6379f2cb4f74cf053eed42f"], 0x3c}, 0x1}, 0x0) ioctl$BLKSECTGET(r1, 0x1267, &(0x7f00000000c0)) setsockopt$inet_sctp6_SCTP_FRAGMENT_INTERLEAVE(r1, 0x84, 0x12, &(0x7f0000000180)=0x2, 0x4) 2018/05/12 22:57:43 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0x0, 0x88ffffff00000000, 0x252]}) 2018/05/12 22:57:43 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140), 0x0, 0x18000000}, 0x0) 2018/05/12 22:57:43 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0x1, 0xd000000, r0, &(0x7f0000000000), 0xfe00}]) [ 742.981398] binder: 20788:20798 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 2018/05/12 22:57:43 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) 2018/05/12 22:57:43 executing program 3: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0xffffffff00000000, 0x0, 0x12, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) [ 743.038774] binder: 20788:20798 BC_FREE_BUFFER u0000000000000000 no match [ 743.138466] binder: 20788:20826 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 743.170239] binder: 20788:20826 BC_FREE_BUFFER u0000000000000000 no match 2018/05/12 22:57:44 executing program 5: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mkdir(&(0x7f000000dff6)='./control\x00', 0x0) r0 = open(&(0x7f0000000080)='./control\x00', 0x0, 0x0) mkdirat(r0, &(0x7f000002cff6)='./file0\x00', 0x0) mkdirat(r0, &(0x7f0000016ff8)='./file0\x00', 0x0) r1 = openat(r0, &(0x7f0000025000)='./file0\x00', 0x0, 0x0) open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="080080000000000040e0b7facb9a5a47ebe3929e5c69"], 0x0) symlinkat(&(0x7f0000000040)='./file0\x00', r1, &(0x7f00000000c0)='./control\x00') renameat2(r0, &(0x7f0000000200)='./control\x00', r1, &(0x7f00000002c0)='./control\x00', 0x2) clock_gettime(0x0, &(0x7f0000000180)={0x0, 0x0}) utimensat(r0, &(0x7f0000000140)='./control\x00', &(0x7f00000001c0)={{0x77359400}, {r2, r3/1000+30000}}, 0x100) 2018/05/12 22:57:44 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0x0, 0x3c00000000000000, 0x252]}) 2018/05/12 22:57:44 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140), 0x0, 0xffffffc0}, 0x0) 2018/05/12 22:57:44 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0x1, 0x3f000000, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:57:44 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf000000], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) 2018/05/12 22:57:44 executing program 3: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x4f2d040000000000, 0x0, 0x12, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:57:44 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='dctcp\x00', 0x6) sendto$inet6(r0, &(0x7f00004e8000), 0xf401, 0x20000001, &(0x7f000007f000)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffff91]}}, 0x1c) 2018/05/12 22:57:44 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x1c, 0x0, &(0x7f0000000040)=[@request_death={0x400c630e}, @free_buffer={0x40086303}], 0x20000000, 0x0, &(0x7f0000000080)}) [ 743.925396] binder: 20838:20841 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 743.961587] binder: 20838:20841 BC_FREE_BUFFER u0000000000000000 no match 2018/05/12 22:57:44 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0x0, 0xffffff84, 0x252]}) 2018/05/12 22:57:44 executing program 3: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x8200000000000000, 0x0, 0x12, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:57:44 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140), 0x0, 0xe}, 0x0) 2018/05/12 22:57:44 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf000], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) 2018/05/12 22:57:44 executing program 5: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000346fd4)={0x0, 0x0, 0x0, 0x105f}, 0x2c) ioctl$TIOCGSOFTCAR(r0, 0x5419, &(0x7f0000000080)) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x20000229, &(0x7f00000000c0)=@raw=[@alu={0x7, 0xff, 0x0, 0x0, 0x4, 0xfffffff4, 0x11}, @generic={0x0, 0x9, 0x4, 0xcb}], &(0x7f000031cff6)='syzkaller\x00', 0x5c6e, 0x6f8, &(0x7f00001a7f05)=""/251, 0x40f00, 0x1000000000}, 0x29f) 2018/05/12 22:57:44 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0x1, 0x4, r0, &(0x7f0000000000), 0xfe00}]) [ 743.982207] binder: 20838:20860 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 744.022338] binder: 20838:20860 BC_FREE_BUFFER u0000000000000000 no match 2018/05/12 22:57:44 executing program 3: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0xe0000, 0x0, 0x12, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:57:44 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0x0, 0x800000000000000, 0x252]}) 2018/05/12 22:57:45 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='dctcp\x00', 0x6) sendto$inet6(r0, &(0x7f00004e8000), 0xf401, 0x20000001, &(0x7f000007f000)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfe800000]}}, 0x1c) 2018/05/12 22:57:45 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa908], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) 2018/05/12 22:57:45 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140), 0x0, 0xc0ffffff00000000}, 0x0) 2018/05/12 22:57:45 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0x1, 0x37, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:57:45 executing program 5: r0 = socket(0xa, 0x1, 0x0) chdir(&(0x7f0000000000)='./file0\x00') ioctl(r0, 0x8912, &(0x7f0000000100)="c626262c8523bf012cf66f") mkdir(&(0x7f0000000040)='./file0\x00', 0x0) r1 = open(&(0x7f0000aa0000)='./file0\x00', 0x0, 0x0) r2 = fcntl$dupfd(r1, 0x800000000402, 0xffffffffffffffff) r3 = openat(0xffffffffffffff9c, &(0x7f00004e2ff8)='./file0\x00', 0x0, 0x0) fcntl$dupfd(r3, 0x402, 0xffffffffffffffff) dup3(r2, r1, 0x0) 2018/05/12 22:57:45 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0x0, 0x8000000, 0x252]}) 2018/05/12 22:57:45 executing program 3: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x1200, 0x0, 0x12, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:57:45 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x1c, 0x0, &(0x7f0000000040)=[@request_death={0x400c630e}, @free_buffer={0x40086303}], 0x4c00000000000000, 0x0, &(0x7f0000000080)}) 2018/05/12 22:57:45 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0x0, 0x2900, 0x252]}) [ 744.919885] binder: 20900:20904 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 744.951810] binder: 20900:20904 BC_FREE_BUFFER u0000000000000000 no match 2018/05/12 22:57:45 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa00], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) 2018/05/12 22:57:45 executing program 3: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x8107, 0x0, 0x12, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:57:45 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140), 0x0, 0xffffff7f}, 0x0) 2018/05/12 22:57:45 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0x1, 0xe000000000000, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:57:45 executing program 5: r0 = syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x0) io_setup(0x6fdfcab7, &(0x7f0000000040)=0x0) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000100)='net/sockstat\x00') io_cancel(r1, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x6, r0, &(0x7f0000000080)="b67d7c9ea937b8b3875837f599ecd6dba7db1b7c5482cf2c6b7bc7e9c811d47e339e3f6b4c0abb9a63a896b69ce2809090fdaa8a111c880cc5597a757f6705bf1eda847e22", 0x45, 0x0, 0x0, 0x0, r2}, &(0x7f0000000180)) ioctl(r0, 0x800000040004500, &(0x7f0000000080)) [ 744.995435] binder: 20900:20922 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 2018/05/12 22:57:45 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='dctcp\x00', 0x6) sendto$inet6(r0, &(0x7f00004e8000), 0xf401, 0x20000001, &(0x7f000007f000)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1802]}}, 0x1c) [ 745.050737] binder: 20900:20922 BC_FREE_BUFFER u0000000000000000 no match 2018/05/12 22:57:45 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140), 0x0, 0xfeffffff}, 0x0) 2018/05/12 22:57:45 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0x0, 0x2100, 0x252]}) 2018/05/12 22:57:46 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='dctcp\x00', 0x6) sendto$inet6(r0, &(0x7f00004e8000), 0xf401, 0x20000001, &(0x7f000007f000)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf401]}}, 0x1c) 2018/05/12 22:57:46 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) 2018/05/12 22:57:46 executing program 5: mount(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='./file0\x00', &(0x7f0000000080)='bpf\x00', 0x5, &(0x7f00000000c0)="539adc384f93c948dc7e69fe42e4bd5f1105eb7a1169a69aa8a95d5fb08d2831c67320164bf518e8fea795aeebae7f3e8afc88a9e9e1eb5b72da6f09") mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x10, 0xffffffffffffffff, 0x0) socketpair(0x2, 0x4, 0x80, &(0x7f0000000180)) r0 = syz_open_dev$sndmidi(&(0x7f0000000740)='/dev/snd/midiC#D#\x00', 0xaa70, 0x111000) r1 = openat(r0, &(0x7f000060cff8)='/', 0x4, 0x40) getdents(r1, &(0x7f000056a000)=""/210, 0xd2) setsockopt$ARPT_SO_SET_REPLACE(r1, 0x0, 0x60, &(0x7f0000000240)=ANY=[@ANYBLOB="66696c74657200000000000000000000000000000000000000000000000000000700000004000000a0040000580200000000000058020000b8030000b8030000b803000004000000", @ANYPTR=&(0x7f00000007c0)=ANY=[@ANYBLOB="00000000000000000000000099c3232d042954180bd4714465aa00fdff0000ddffffffffffffff0000000000000000000000000000000800000000000000009eea402f321e81c630caf84720c9355500001a0000000000000000000000000b02cb34f585d71e5385a540b13b435861782494fbf6c9c4c9d9d729965ea1b24341161b195c89800790086853ba320edd411984772ab1353536fee613035194d5c5e9c88e361b0745ecaf5a31c598f907f3194b519ddf54e15d1d93e5c1bba4b8d8cd3866c7797a0644bd1633922f037745e8964ae1f11eebf87a80edc98f912d48b4f20fd1"], @ANYBLOB="ffffffff00000002000000ff00000000aaaaaaaaaabb00000000000000000000000000000000000000ffffffffff00000000000000000000aaaaaaaaaaaa000000000000000000000000000000000000ffffff00ffff0000000000000000000001ff0000010000400002000069705f76746930000000000000000000626f6e6430000000000000000000000000000000000000000000ff0000000000000000000000000000000000000000000000000000000000ff0000000000000000000000000000000000000100000000000000000000f0004001000000000000000000000000000000000000000000000000000050006d616e676c65000000000000000000000000000000000000000000000000aaaaaaaaaa1200000000000000000000ffffffffffff0000000000000000000000000040ac1414aa0400000001000000e00000017f000001ffffffffffffff00aaaaaaaaaa140000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000ff000000000000000000000000df0005000407f60000000776657468315f746f5f62726964676500697036746e6c3000000000000000000000000000000000000000a30000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000f0001801000000000000000000000000000000000000000000000000000028004e46515545554500000000000000000000000000000000000000000000010900030000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0006001000000000000000000000000000000000000000000000000000070004e464c4f4700000000000000000000000000000000000000000000000000060000000600000000000000422ed5f99d76cd8532eff2da2c1e12f547549c548f39a9d79a7e3b41e4236db63d5ea8cb9a232e5458fbb5ab0e372ff25d828c49bc5513c09556391121869a4a000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000c000e8000000000000000000000000000000000000000000000000002800000000000000000000000000000000000000000000000000000000000000feffffff00000000"], 0x4f0) getsockname$unix(r1, &(0x7f0000000100)=@abs, &(0x7f0000000780)=0xffffffffffffff4c) fcntl$dupfd(r1, 0x402, r1) ioctl$KVM_UNREGISTER_COALESCED_MMIO(r1, 0x4010ae68, &(0x7f00000001c0)={0x2, 0x119000}) 2018/05/12 22:57:46 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140), 0x0, 0xfd000000}, 0x0) 2018/05/12 22:57:46 executing program 3: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x6400000000000000, 0x0, 0x12, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:57:46 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0x0, 0x3200, 0x252]}) 2018/05/12 22:57:46 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x1c, 0x0, &(0x7f0000000040)=[@request_death={0x400c630e}, @free_buffer={0x40086303}], 0x9410, 0x0, &(0x7f0000000080)}) 2018/05/12 22:57:46 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0x1, 0xeffdffffffffffff, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:57:46 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0x0, 0x3c00, 0x252]}) [ 746.099188] binder: 20965:20969 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 746.118467] binder: 20965:20969 BC_FREE_BUFFER u0000000000000000 no match 2018/05/12 22:57:46 executing program 3: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0xeffdffff, 0x0, 0x12, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:57:46 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140), 0x0, 0xfd00}, 0x0) 2018/05/12 22:57:46 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0x1, 0x200000000000000, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:57:46 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa908000000000000], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) [ 746.164452] binder: 20965:20988 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 746.191114] binder: 20965:20988 BC_FREE_BUFFER u0000000000000000 no match 2018/05/12 22:57:46 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0x0, 0x1c000000, 0x252]}) 2018/05/12 22:57:46 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x1c, 0x0, &(0x7f0000000040)=[@request_death={0x400c630e}, @free_buffer={0x40086303}], 0xa00, 0x0, &(0x7f0000000080)}) 2018/05/12 22:57:46 executing program 5: r0 = socket$inet6(0xa, 0x1, 0x0) capset(&(0x7f0000000500)={0x19980330}, &(0x7f0000032fe8)) ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f0000000540)={@dev={0xfe, 0x80}, @local={0xfe, 0x80, [], 0xaa}}) [ 746.389171] binder: 21019:21020 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 746.439188] binder: 21019:21020 BC_FREE_BUFFER u0000000000000000 no match [ 746.454518] binder: 21019:21027 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 746.464489] binder: 21019:21027 BC_FREE_BUFFER u0000000000000000 no match 2018/05/12 22:57:47 executing program 3: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0xe4ffffff, 0x0, 0x12, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:57:47 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140), 0x0, 0x400000000000000}, 0x0) 2018/05/12 22:57:47 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0x0, 0x2b00, 0x252]}) 2018/05/12 22:57:47 executing program 5: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="c6295e4eca6c09b612ec6f") r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000505000)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) pipe2(&(0x7f0000cdc000)={0x0, 0x0}, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) dup3(r5, r4, 0x0) r6 = accept(r3, &(0x7f0000000000)=@nfc, &(0x7f0000000080)=0x80) fallocate(r6, 0x2, 0x25, 0x1) ioctl$KVM_SET_VCPU_EVENTS(r4, 0x5000aea5, &(0x7f0000460fe4)) 2018/05/12 22:57:47 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='dctcp\x00', 0x6) sendto$inet6(r0, &(0x7f00004e8000), 0xf401, 0x20000001, &(0x7f000007f000)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3]}}, 0x1c) 2018/05/12 22:57:47 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x1c, 0x0, &(0x7f0000000040)=[@request_death={0x400c630e}, @free_buffer={0x40086303}], 0x48, 0x0, &(0x7f0000000080)}) 2018/05/12 22:57:47 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x300000000000000], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) 2018/05/12 22:57:47 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0x1, 0x4000000000000, r0, &(0x7f0000000000), 0xfe00}]) [ 747.093306] binder: 21032:21035 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 747.121213] binder: 21032:21035 BC_FREE_BUFFER u0000000000000000 no match 2018/05/12 22:57:47 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0x0, 0xffffffffffffffff, 0x252]}) 2018/05/12 22:57:47 executing program 3: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x11000000, 0x0, 0x12, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:57:47 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000000], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) 2018/05/12 22:57:47 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140), 0x0, 0x100000000000000}, 0x0) 2018/05/12 22:57:47 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0x1, 0xa8030000000000, r0, &(0x7f0000000000), 0xfe00}]) [ 747.153379] binder: 21032:21054 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 2018/05/12 22:57:47 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0x0, 0xfdffffff00000000, 0x252]}) [ 747.304527] binder: 21032:21054 BC_FREE_BUFFER u0000000000000000 no match 2018/05/12 22:57:48 executing program 3: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0xf00, 0x0, 0x12, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:57:48 executing program 5: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000200)="c626262c8523bf012cf66f") mkdir(&(0x7f000000dff8)='./file0\x00', 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) symlinkat(&(0x7f0000008ff8)='./file1\x00', r1, &(0x7f0000012ff8)='./file0\x00') creat(&(0x7f0000020ff2)='./file0/file0\x00', 0x0) renameat(r1, &(0x7f0000020ff2)='./file1\x00', r1, &(0x7f0000002000)='./file0\x00') 2018/05/12 22:57:48 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa000000], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) 2018/05/12 22:57:48 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140), 0x0, 0xe000000}, 0x0) 2018/05/12 22:57:48 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0x1, 0x9000000, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:57:48 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0x0, 0x100000000000000, 0x252]}) 2018/05/12 22:57:48 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='dctcp\x00', 0x6) sendto$inet6(r0, &(0x7f00004e8000), 0xf401, 0x20000001, &(0x7f000007f000)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80fe]}}, 0x1c) 2018/05/12 22:57:48 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x1c, 0x0, &(0x7f0000000040)=[@request_death={0x400c630e}, @free_buffer={0x40086303}], 0x4c, 0x0, &(0x7f0000000080)}) 2018/05/12 22:57:48 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140), 0x0, 0x4000000}, 0x0) 2018/05/12 22:57:48 executing program 5: r0 = socket$pptp(0x18, 0x1, 0x2) r1 = fcntl$dupfd(r0, 0x406, r0) setsockopt$inet_int(r1, 0x0, 0x13, &(0x7f0000000280)=0x1, 0x4) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000000)={r1, &(0x7f00000000c0)="0bd85f8e47f2fbb5f3745d7ed2316bafd23cd792fdb1f7db6b03b42b83ba2d8ba2dee7e3b21c494b2f0487d476348fdd57055ecf61460624b1f4dbf8cfa9be93a64863436b45c9ae9d84a283ca1fe8db45e57b34754ceba5ad0ba24802be0dd51d945d3fddb90bbd0b14a4bcba348c20b8732625060e92a53934e41b06f42d63fcfd89dc468476c56f45152a72116f2f48da11ae74daf4cc6e3ada400c3a154302a0b2b4e3fe76e315c180e18d7738", &(0x7f0000000180)=""/245}, 0x18) connect(r0, &(0x7f0000000040)=@pppoe={0x18, 0x0, {0x0, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], 'vlan0\x00'}}, 0xfffffe2a) 2018/05/12 22:57:48 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x300], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) 2018/05/12 22:57:48 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0x1, 0xfffffffffffffdef, r0, &(0x7f0000000000), 0xfe00}]) [ 748.075788] binder: 21100:21101 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 748.114275] binder: 21100:21101 BC_FREE_BUFFER u0000000000000000 no match 2018/05/12 22:57:48 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0x0, 0x1c00000000000000, 0x252]}) 2018/05/12 22:57:48 executing program 3: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x89000000, 0x0, 0x12, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) [ 748.165556] binder: 21100:21110 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 2018/05/12 22:57:48 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140), 0x0, 0x2}, 0x0) 2018/05/12 22:57:48 executing program 5: unshare(0x50002) r0 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000000c0)={'lo\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000140)={&(0x7f0000000000)={0x10}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)=@ipv4_newaddr={0x20, 0x14, 0x1, 0x0, 0x0, {0x2, 0x0, 0x0, 0x0, r1}, [@IFA_LOCAL={0x8, 0x2, @local={0xac, 0x14, 0x14, 0xaa}}]}, 0x20}, 0x1}, 0x0) r2 = socket(0x10, 0x802, 0x0) write(r2, &(0x7f00000c7fdc)="24000000210025f0071c0165ff0ffc0e020000000010000002e1000c08000b0000000000", 0x24) [ 748.231695] binder: 21100:21110 BC_FREE_BUFFER u0000000000000000 no match 2018/05/12 22:57:48 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0x0, 0x1000000, 0x252]}) 2018/05/12 22:57:48 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9effffff00000000], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) 2018/05/12 22:57:49 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0x1, 0xe00, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:57:49 executing program 3: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0xf000000, 0x0, 0x12, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:57:49 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x1c, 0x0, &(0x7f0000000040)=[@request_death={0x400c630e}, @free_buffer={0x40086303}], 0x3ede4, 0x0, &(0x7f0000000080)}) 2018/05/12 22:57:49 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140), 0x0, 0x18}, 0x0) 2018/05/12 22:57:49 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_SREGS(r2, 0x4138ae84, &(0x7f0000c9bec8)={{}, {}, {}, {}, {}, {}, {}, {}, {}, {}, 0xfffffffffffffffc}) syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000a92000/0x18000)=nil, &(0x7f0000000000)=[@text32={0x20, &(0x7f00000000c0)="b9800000c00f3235002000000f302e36f6d6c4c3b9495d03000f22846466f20f7024e700b805000000b90d0000000f01d966baf80cb8f4236682ef66bafc0cb00deeb9800000c00f3235008000000f30c744240088000000c744240230160000c7442406000000000f01142426f3e000", 0x70}], 0x1, 0x41, &(0x7f0000000140), 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000a94000/0x18000)=nil, &(0x7f0000000040)=[@textreal={0x8, &(0x7f0000000280)="0f20010f01cbf30f2d700066b8090000000f23d00f21f86635200000080f23f866b91300000066b80000000066ba000000000f308092d67f0db800008ed8f466b9800000c00f326635008000000f300f2297", 0x52}], 0x1, 0x0, &(0x7f0000000340)=[@cr4={0x1, 0x220000}], 0x1) ioctl$KVM_TRANSLATE(r2, 0xc018ae85, &(0x7f0000000240)) r3 = syz_open_dev$dmmidi(&(0x7f0000000080)='/dev/dmmidi#\x00', 0x7fff, 0x1) setsockopt$ALG_SET_KEY(r3, 0x117, 0x1, &(0x7f0000000140)="03917d9f40823554176b99f17ac8fa2f78ab1401285b5373ddfef39c4435fe6ea1bef7436c3323da54985741078511d1f6dc7d8981967b3d239708df49637f847ccb31914fbe02fd34807211152b2ab630dd2d350dadd58d9af0a38d558e90c7795fc51a8ecd6b6b09ec07f89328f1fc40311110653540b1260064ae134d15f6985199726efb080b4493a286c435349d34712f2ab9484c3831196c627ea4f36f541878ff7c713591eb5bae303cbe3dd13f", 0xb1) 2018/05/12 22:57:49 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0x0, 0x32000000, 0x252]}) 2018/05/12 22:57:49 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='dctcp\x00', 0x6) sendto$inet6(r0, &(0x7f00004e8000), 0xf401, 0x20000001, &(0x7f000007f000)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe803000000000000]}}, 0x1c) 2018/05/12 22:57:49 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40030000000000], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) [ 749.070289] binder: 21166:21167 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 749.097192] binder: 21166:21167 BC_FREE_BUFFER u0000000000000000 no match 2018/05/12 22:57:49 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0x1, 0x900000000000000, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:57:49 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140), 0x0, 0x4}, 0x0) 2018/05/12 22:57:49 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf0], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) 2018/05/12 22:57:49 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0x0, 0x32, 0x252]}) 2018/05/12 22:57:49 executing program 3: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x4000, 0x0, 0x12, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) [ 749.143112] binder: 21166:21180 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 749.160436] binder: 21166:21180 BC_FREE_BUFFER u0000000000000000 no match 2018/05/12 22:57:49 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='dctcp\x00', 0x6) sendto$inet6(r0, &(0x7f00004e8000), 0xf401, 0x20000001, &(0x7f000007f000)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6000000]}}, 0x1c) 2018/05/12 22:57:49 executing program 5: mmap(&(0x7f0000000000/0xfd0000)=nil, 0xfd0000, 0xfffffefffffffffd, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) r1 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rfkill\x00', 0x400000, 0x0) setsockopt$netlink_NETLINK_PKTINFO(r1, 0x10e, 0x3, &(0x7f0000000040)=0x6, 0x4) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000a54ff8), &(0x7f000022affc)=0x8) 2018/05/12 22:57:49 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='dctcp\x00', 0x6) sendto$inet6(r0, &(0x7f00004e8000), 0xf401, 0x20000001, &(0x7f000007f000)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe]}}, 0x1c) 2018/05/12 22:57:49 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0x1, 0xd00000000000000, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:57:49 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0x0, 0x1100000000000000, 0x252]}) 2018/05/12 22:57:49 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x1c, 0x0, &(0x7f0000000040)=[@request_death={0x400c630e}, @free_buffer={0x40086303}], 0x60, 0x0, &(0x7f0000000080)}) 2018/05/12 22:57:49 executing program 3: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x2, 0x0, 0x12, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:57:49 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf0ffff], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) [ 749.460621] binder: 21219:21220 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 749.509846] binder: 21219:21220 BC_FREE_BUFFER u0000000000000000 no match [ 749.562708] binder: 21219:21236 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 749.572339] binder: 21219:21236 BC_FREE_BUFFER u0000000000000000 no match 2018/05/12 22:57:50 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140), 0x0, 0x97ffffff00000000}, 0x0) 2018/05/12 22:57:50 executing program 5: r0 = socket(0xa, 0x1, 0x1) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") mkdir(&(0x7f0000000040)='./file0\x00', 0x0) mount(&(0x7f00003dd000)='./file0\x00', &(0x7f00004f5ff8)='./file0\x00', &(0x7f00000e1000)='ramfs\x00', 0x8, &(0x7f0000000100)) statfs(&(0x7f00000008c0)='./file0\x00', &(0x7f0000ac6781)=""/50) 2018/05/12 22:57:50 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0x1, 0x300, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:57:50 executing program 3: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x12, 0x0, 0x12, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:57:50 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0x0, 0x84ffffff00000000, 0x252]}) 2018/05/12 22:57:50 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa000000], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) 2018/05/12 22:57:50 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='dctcp\x00', 0x6) sendto$inet6(r0, &(0x7f00004e8000), 0xf401, 0x20000001, &(0x7f000007f000)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x600000000000000]}}, 0x1c) 2018/05/12 22:57:50 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x1c, 0x0, &(0x7f0000000040)=[@request_death={0x400c630e}, @free_buffer={0x40086303}], 0x7a, 0x0, &(0x7f0000000080)}) [ 750.360607] binder: 21244:21245 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 2018/05/12 22:57:51 executing program 3: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x4, 0x0, 0x12, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:57:51 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000000], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) 2018/05/12 22:57:51 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140), 0x0, 0x1f00}, 0x0) 2018/05/12 22:57:51 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='dctcp\x00', 0x6) sendto$inet6(r0, &(0x7f00004e8000), 0xf401, 0x20000001, &(0x7f000007f000)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfec0000000000000]}}, 0x1c) [ 750.407833] binder: 21244:21245 BC_FREE_BUFFER u0000000000000000 no match [ 750.451114] binder: 21244:21269 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 750.532107] binder: 21244:21269 BC_FREE_BUFFER u0000000000000000 no match 2018/05/12 22:57:51 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0x0, 0x4000000, 0x252]}) 2018/05/12 22:57:51 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0x1, 0x7f00, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:57:51 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6e573a59aa], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) 2018/05/12 22:57:51 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x1c, 0x0, &(0x7f0000000040)=[@request_death={0x400c630e}, @free_buffer={0x40086303}], 0x7400, 0x0, &(0x7f0000000080)}) 2018/05/12 22:57:51 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140), 0x0, 0xe00}, 0x0) 2018/05/12 22:57:51 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000832ff3)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r0, 0xc08c5332, &(0x7f0000b0bf74)={0x0, 0x0, 0x0, 'queue1\x00', 0x3}) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x402c5342, &(0x7f00000002c0)={0x0, 0xc14e}) 2018/05/12 22:57:51 executing program 3: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0xe4ffffff00000000, 0x0, 0x12, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:57:51 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='dctcp\x00', 0x6) sendto$inet6(r0, &(0x7f00004e8000), 0xf401, 0x20000001, &(0x7f000007f000)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfc000000]}}, 0x1c) [ 750.670621] binder: 21311:21312 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 2018/05/12 22:57:51 executing program 5: r0 = socket$inet6_dccp(0xa, 0x6, 0x0) r1 = dup(r0) setsockopt$inet6_group_source_req(r0, 0x29, 0x97029ec21cf9f7e7, &(0x7f0000000080)={0x3, {{0xa, 0x4e24, 0x7, @mcast2={0xff, 0x2, [], 0x1}, 0x401}}, {{0xa, 0x4e22, 0x0, @dev={0xfe, 0x80, [], 0x1b}, 0xf06}}}, 0x108) bind$alg(0xffffffffffffffff, &(0x7f0000000200)={0x26, 'hash\x00', 0x5, 0x0, 'crct10dif-pclmul\x00'}, 0x58) r2 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000440)='/dev/dsp\x00', 0x40, 0x0) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f00000002c0)='IPVS\x00') sendmsg$IPVS_CMD_GET_INFO(r1, &(0x7f0000000380)={&(0x7f0000000280)={0x10}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)={0x14, r3, 0x202, 0x70bd2b, 0x25dfdbff, {0xf}}, 0x14}, 0x1, 0x0, 0x0, 0x48000}, 0x4040010) ioctl$SNDRV_SEQ_IOCTL_RUNNING_MODE(r2, 0xc0105303, &(0x7f0000000040)={0x1ff, 0x7, 0x512}) openat$uinput(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/uinput\x00', 0x8000, 0x0) 2018/05/12 22:57:51 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0x1, 0x3f00, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:57:51 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0x0, 0x300, 0x252]}) 2018/05/12 22:57:51 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f00000100000000], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) 2018/05/12 22:57:51 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140), 0x0, 0x1f00000000000000}, 0x0) 2018/05/12 22:57:51 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='dctcp\x00', 0x6) sendto$inet6(r0, &(0x7f00004e8000), 0xf401, 0x20000001, &(0x7f000007f000)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000000]}}, 0x1c) 2018/05/12 22:57:51 executing program 3: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x31000000, 0x0, 0x12, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) [ 750.724787] binder: 21311:21312 BC_FREE_BUFFER u0000000000000000 no match [ 750.777308] binder: 21311:21319 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 750.829177] binder: 21311:21319 BC_FREE_BUFFER u0000000000000000 no match 2018/05/12 22:57:51 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf0ffffff00000000], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) 2018/05/12 22:57:51 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180)='/dev/kvm\x00', 0x0, 0x0) socketpair$inet_tcp(0x2, 0x1, 0x0, &(0x7f0000000040)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000000)=0x0) ioprio_set$pid(0x1, r1, 0x5) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) close(0xffffffffffffffff) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) openat$mixer(0xffffffffffffff9c, &(0x7f0000000080)='/dev/mixer\x00', 0x800, 0x0) ioctl$sock_ipx_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f00000000c0)={'nr0\x00', {0x4, 0x0, 0x0, "c3ef4f5be3de"}}) ioctl$KVM_SET_DEBUGREGS(r3, 0x4080aea2, &(0x7f0000000100)={[0x0, 0x3000], 0x0, 0x82, 0x3}) 2018/05/12 22:57:51 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x1c, 0x0, &(0x7f0000000040)=[@request_death={0x400c630e}, @free_buffer={0x40086303}], 0xfdfdffff, 0x0, &(0x7f0000000080)}) 2018/05/12 22:57:51 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140), 0x0, 0xa000000}, 0x0) 2018/05/12 22:57:51 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0x1, 0x200000, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:57:51 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='dctcp\x00', 0x6) sendto$inet6(r0, &(0x7f00004e8000), 0xf401, 0x20000001, &(0x7f000007f000)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff0f]}}, 0x1c) 2018/05/12 22:57:51 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0x0, 0x2f00, 0x252]}) 2018/05/12 22:57:51 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfcffffff00000000], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) 2018/05/12 22:57:51 executing program 3: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x8401, 0x0, 0x12, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:57:51 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0x0, 0x11, 0x252]}) 2018/05/12 22:57:51 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140), 0x0, 0x97ffffff}, 0x0) 2018/05/12 22:57:51 executing program 3: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x3100000000000000, 0x0, 0x12, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) [ 751.055610] binder: 21354:21364 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 751.094184] binder: 21354:21364 BC_FREE_BUFFER u0000000000000000 no match 2018/05/12 22:57:51 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0x1, 0xfe0000, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:57:51 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f000001], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) 2018/05/12 22:57:51 executing program 5: mmap(&(0x7f0000000000/0xd25000)=nil, 0xd25000, 0x0, 0x32, 0xffffffffffffffff, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r0 = syz_open_dev$vcsa(&(0x7f0000000180)='/dev/vcsa#\x00', 0x9, 0x0) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffff9c, 0x89e2, &(0x7f0000000000)={r0}) getsockopt$inet_tcp_int(r1, 0x6, 0x14, &(0x7f0000000040), &(0x7f0000000080)=0x4) getcwd(&(0x7f0000001000)=""/4096, 0x1000) r2 = syz_open_dev$vcsn(&(0x7f00000000c0)='/dev/vcs#\x00', 0x2, 0x0) setsockopt$bt_BT_RCVMTU(r2, 0x112, 0xd, &(0x7f0000000100)=0x74cf, 0x2) ioctl$TUNGETVNETHDRSZ(r2, 0x800454d7, &(0x7f0000000140)) [ 751.173466] binder: 21354:21383 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 751.207320] binder: 21354:21383 BC_FREE_BUFFER u0000000000000000 no match 2018/05/12 22:57:52 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0x0, 0x8, 0x252]}) 2018/05/12 22:57:52 executing program 3: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0xfeffffff, 0x0, 0x12, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:57:52 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0x1, 0x100000000000000, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:57:52 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa908], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) 2018/05/12 22:57:52 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140), 0x0, 0x7000000}, 0x0) 2018/05/12 22:57:52 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x1c, 0x0, &(0x7f0000000040)=[@request_death={0x400c630e}, @free_buffer={0x40086303}], 0x68, 0x0, &(0x7f0000000080)}) 2018/05/12 22:57:52 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='dctcp\x00', 0x6) sendto$inet6(r0, &(0x7f00004e8000), 0xf401, 0x20000001, &(0x7f000007f000)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x218]}}, 0x1c) 2018/05/12 22:57:52 executing program 5: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="0400024eca0200b612ec6f") r1 = socket(0x11, 0x100000803, 0x0) r2 = syz_open_dev$tun(&(0x7f0000000380)='/dev/net/tun\x00', 0x0, 0x400000) setsockopt$IP_VS_SO_SET_STOPDAEMON(r1, 0x0, 0x48c, &(0x7f0000000200)={0x0, 'veth1_to_team\x00', 0x4}, 0x18) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={"6966623000faffffffffffffff00", 0x5001}) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000000)={'ifb0\x00', 0xa201}) io_setup(0x115, &(0x7f00000003c0)=0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000100)={0x1f, 0x0, 0x7fffffff}, 0x2c) io_submit(r3, 0x1, &(0x7f00000001c0)=[&(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x0, r2, &(0x7f0000000140)="2aca1a398e161cda7b99fab9a08b610b83790d3daf53a7060999853a78663f84ec605c45f0bcf19da4b0aa59b16d33c7d2c8043df4fc257f298209d2aa7d89aee24297d7575d87708de5c4ba36de2702f82b97d0634258afe5b352", 0x5b}]) 2018/05/12 22:57:52 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140), 0x0, 0xe00000000000000}, 0x0) 2018/05/12 22:57:52 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0x0, 0x4, 0x252]}) 2018/05/12 22:57:52 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x34000], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) [ 752.020981] binder: 21409:21424 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 752.057302] binder: 21409:21424 BC_FREE_BUFFER u0000000000000000 no match 2018/05/12 22:57:52 executing program 3: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x200000, 0x0, 0x12, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:57:52 executing program 5: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$inet6_sctp(0xa, 0x1, 0x84) bind$inet6(r1, &(0x7f0000fa8fe4)={0xa, 0x4e23, 0x0, @loopback={0x0, 0x1}}, 0x1c) r2 = socket$vsock_stream(0x28, 0x1, 0x0) connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x4e23, 0x6, @loopback={0x0, 0x1}, 0x32}, 0xfffffffffffffffb) r3 = dup(r1) setsockopt$inet_sctp6_SCTP_MAXSEG(r3, 0x84, 0xd, &(0x7f0000000080)=@assoc_value={0x0, 0x3ff}, 0x8) ioctl$sock_bt_bnep_BNEPCONNADD(r0, 0x400442c8, &(0x7f0000000040)={r2, 0x80, 0x6694, "02c9edaed5c695fa3bd5d0dcc8191a372003"}) write$eventfd(r3, &(0x7f0000fc7ff8), 0xffc7) write$eventfd(r3, &(0x7f0000604000), 0xfdef) 2018/05/12 22:57:52 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0x1, 0x800800000000, r0, &(0x7f0000000000), 0xfe00}]) [ 752.094085] binder: 21409:21432 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 2018/05/12 22:57:52 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x10) bind$netlink(r0, &(0x7f0000010ff4)={0x10, 0x0, 0x0, 0x120202}, 0xc) bind$netlink(r0, &(0x7f0000000000)={0x10}, 0xc) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000100)=0x0) r2 = fcntl$getown(r0, 0x9) ioctl$sock_FIOGETOWN(r0, 0x8903, &(0x7f00000014c0)=0x0) getresuid(&(0x7f0000001500), &(0x7f0000001540), &(0x7f0000001580)=0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f00000015c0)={0x0, 0x0, 0x0}, &(0x7f0000001600)=0xc) sendmsg$netlink(r0, &(0x7f00000016c0)={&(0x7f0000000040)=@kern={0x10, 0x0, 0x0, 0x42000}, 0xc, &(0x7f0000001480)=[{&(0x7f0000000080)={0x60, 0x1c, 0x800, 0x70bd2a, 0x25dfdbfe, "", [@generic="18a08f0ffb277f0d6be0d9412533ca891c32b9b2fd89bffc021fab61b439e1e9113039b0a86f26483bac72cc554bc8d9ccb8db8cc4d8060da83819e3f954b44102bd3dc063c9ef2db4cd96a0c7bf28c8"]}, 0x60}, {&(0x7f0000000140)={0x38, 0x23, 0x800, 0x70bd26, 0x25dfdbff, "", [@generic, @nested={0x28, 0x26, [@typed={0x8, 0x58, @pid=r1}, @typed={0x14, 0x6d, @ipv6=@remote={0xfe, 0x80, [], 0xbb}}, @typed={0x8, 0x43, @pid=r2}]}]}, 0x38}, {&(0x7f0000000180)={0x11dc, 0x18, 0x0, 0x70bd2c, 0x25dfdbfe, "", [@generic="f37df6ce0117bcfc9c203158762d4ce1d765c6cd13f99ff3da07576d9b31bef1a1e0d5c26893d5dd6d686ec07e33c48e012babc5cc572eb2b6be2db57a923d4c0ab864dc863a30cb5e03b26335178ba26cc08bddb883add25b895c41ee480c30c28df832b48a163baec27e8eb47be4cad1c511b4f3a056795cc5745c55615e063142cc49c56669ee29d5d596f864eb5b6fabf42a9cb831f2c293c546e9aad29f9eef6bd098645f4922ee7af30a20b0a69efbd23d02ce9065ca030326bf792e12c1d2153db57b964f11fdc20f8245380821202714c1e1e16287f6d1b3", @typed={0x8, 0x31, @str='\x00'}, @generic="7bfdfbe29fc0c8def9c04b268cef456558ef40e5c3cf46acf77db323b245fd88de064c5e416aad9c9d9dde74fc0d7115d2cbd97b459ff984ca384003690ba2bcc7b62d34312cfac771bd9ddc82caf6e0dc13d2f23f5b925f88fa7536447f3dfabf30972628c7f70a62fb44203adfa33135e356f36f83e74b319df6d331a8eb857ab7aa4dae6cdc4355c31a4eb99d53e445650a60f237b48a37d3aebf03c418a12649ab8f5b08b036c92413be0ee937ef695eb8e711057b6b6bd2733807980a33e8c790d005dc8b519c782bcc9b840aabd6275bdc1c51e956466af8853e7a0231204ecb008b32", @generic="ab1b4b5eb4af330a517650840276c984e9174176af78024fb6f97cdd4914a4366a222ded7d1b8368f839e6ce07dd7319026344baf3b0f0dc32b61bac511871024b424bc26f4f4ecd956561416f52a702d6d32f7fbfe31b726e97634dde9fcf572af11b5c0c05f9d176267bf765032f86a98fdef1f3f8c6ea71ee4608d9d2abec2d7b2bf38c573c88f3cb491b05bb740131fd5bdc367cc4628d5a843f515a4c11ffb0ef732483f2dde853dc0ba00dbd19182bad24960bbb5306e33d248138e035fd9f05edb57bd6cfdcc43dcda712689ba6aa4deed9483ba1cc94cf73b3713cf6498bf6e5daf3949029b5d9dc369e1949ce2cb5e3d732cc2964dcd7c1e722ae68fa5e99dcb7d6c8a67da42d5f92644c6bcf7082b54ddd8508a149da3ce07221bdaf86cf7268710bc8959fa34e7de7030f0703878c379f09fe5b035a9774a5d946560531d41fbeb3f403f2304abf12ea863f00bee212814c10dc17aa9a4a9072cf1698b511e146daec257fec050ff352cebda5a3a6ecf281f6cc59c63bc044fcefd2cf1bce365950b62b57b1164e85c929a0502d70f1153642d4510cb4c9a15811dfa5f9684d4b4f8f3b099f2338d6248551021afa15e14aa90b1c840806677f7ab7f4ad781b76e8cf25f82299b7e1c1daab33e4842baf3a066703ec05c4b17563dfc6e42d910a7e1ef7c003525afea3d9ed1cbc9fd05f6e4b3a766445b979f4dc641de65236bb783134c5ce0e75715a8216ba615ef459fc12510cff350fc92e707e8e7e6cec3c46e4c1895be0b84cddf331e88d687c9c5ad25865a580d9cf837c3bd49f0b97e375305a381fab80cbec443edc43acd751de01c0037e62545e9895a28b5e7292458c9d872d9cad1013155ce6580e6489e49690e6a15d351ab429bdf1eb9320c1705b792fb327ce19335dff52168a0e7e2735836c4703022ebf87156beb129dbf3fe3cba736937b0771a42fe50f24b84c68bdbd279f567dc2072d4f766d5f27000eb2c1cf8614ea0b35ee280996e5a170e1615abd6b01fb6c63cdee55d62770dc67372dd2b01ef2c139b3a6603aa21aa9556d0c797bff55ada710a289dc8fe122c33d569e1782045377930c0812417c5ef10e7f1572e94f4656a757221ca816d9cb28d8d68fdaa7487764d41bcc7c58b528dd137891fc0e51f442267e28cd675b112c83883142db1ff21952a9f0b7763e630dda0d31f906ce2f33e7a2d8b8fb83a0f75ca6ed6211c7a1ca68062440ac50184e2de7626a7d1f31d1c5e2b5ca76d695ac2b308af0da1d1dc431c17878cbc0cb6fb67d8a4a9b74f279b40484ebaacd311b39759d91c2151846c7152acd241e0b50bfe352d1dd0c7a40bbc79b2006ff2655e33c13a4667115d6eaf51a134b1a81057f1a96c2d42e0824c0f824641cfac0988cb16f824f80368c6d3e8247188512aa0c7fde65e894194b924b5aa3f065f9e5a915189f372bd22c62a5a3d6a5c26d6d4872231f886cd2f14a00b58a5df346c03378370ca1300830538b06a0d4c613d28fdcc3949f59bedb439afff90e623347d5d37ce4570df5cd2f433bc79ec7c95c67faec77fc5513cf7d708f43ee32b794419fdb406f7829b149a10336ad547fb24969a52372daf51249f684902de897fc0fb6424222c9fd2502ad701d471330670591d50acaaaa19aff0560840faf36fccaee9c35ca666037b8914830c3fcac33db3cf300e621adaee852749c606aaaa8d7ed80ffe1f021d62613d5ffa9ea95b73b859a48bf1a9ad3c7d6893bd5bc75fb35324264db078b0777d68233e3432f4304d3b471b00f084bf8585120075868de524312596c59384931a27012f05923b60c486c96623f5821a3cf04cad7b4752e3cce860d2bbd5afbfbe0e656fb3e54a07e9f79337804fdf6862ab2777d3cfe41a440fbb555d80c643c7e3d1aa364d03fc050d3d191fe1e97570cd21cea620420fb7e7cf1cb73e820d790b20ca1df4136a9b4892b86c62081d4664a1a0f787d5889d8434d6ce93ec92d1672dd4555c6ab74a1b35193160c24a32a7bd8795840b3ef37d4b02abdc3f443efbcd7c272bc1009fce8a304fa9a47d9904943b363f408d9c99f04c787eb15b40d9220ed78b9d8903957fd1f13c1e7b9dbdd4cd53e97c1e7c6757566dddecc94404e54fba12c2b79bf7cded8ce81400cfbc22d01155f68b9a1657686c956cf612226763e12a928c1a414ef66e69af310ccc3761117af06f31fedd20778154317bde34fe459b9f449d3905b3b33e21af320440250bbd6e152ed22c9b4ae906b350971cbfd90e60bc082a5e3496f249fb096222d7f9c497a54d9f00bfd632b803cfae278df57cf4c931f9e055d9d6532208d1b0fffe8a075aee1c02a5c8ef6730cdb061ee1234a0c354d6ce2a62ac482642d108040789c9b7ff1850a5e89e33c67def21a9f43b5a7addcafd1063d8c4164d333ab097a07feb0e53c581c2eace4e9ddc6f69833153d717fec11debc99350b399dc0098474c98fd27b7ac61c38c49429f9245f05a69d52bcd03f1f0777ded1f4c45d04319df61a16f5474539063ad1542c8529ad493ba5aca14b9834783e22d5bf87e1e9bb801641a4f6e088bdc006e5cc6c61a7ceea8b8d68aceda24bdd1aa0f8b90c5a54ee268b376c62c73b5af17554284680ffdbb5065fd2d9bcfa89c386297823666e384ed2dc123d82b8554120a81287a25355c2c070524a5685ce5041c5ba2c55860c1a192cc9c2b798601307e4164e54891f152815392e5a857d9dbe52845adf64ee4c3003c2bbb28e0100a147b3e510b85dec52c316097d213a483afbdc7da363b0262acd7a44ee5d64d117dfd58a4ab0b1b33a10c21e3caf804a33f7d66f158c9f16b4cc58fb1d86c74c7e17e315d02fe96a43230f90d240dcee1002727d9fb996d4276dfafce3fbbbcd8ecb87d0c142a7f203b9fa41df80dfca1a97e0e81db5220445b169d2834a2d4bb5f6acff9ac24bba6e3fc409a26f769ce432a2abf968b5b00003ce89cc6ee01e68f5f45a3885cdada269103be4074755b3a2553da6e9b97d1a7de69b2f8c5babeafc678bcc8f2fdd63c242f8d776c8220497ba2936a94675b09378cb609a9c8c3491aa13e549cfe0ab7468fda5d28b80570a35d22535db0d37f1cae7bfc5ba860f8a4f1440ea2570f2134d31e0523f9722cfc74f2e8a0c36dc5dc07a35fe5e352bb2db334cf0f6cfc52f2a17a9217ef1ed26debd2bc05f9373646d5115afbc5b5151d9f9b921c1ec83977283c09feaf45cff575cb26baedaef4e8298740fa8bbe02aa1b63247677284f873388924608f0139d501d7c0f38d2f5bd528edc36abc91112f13fe5b26a2f15690256cb95667e97500307363511e35e805e0426604a0950992a85296bb72814023d501aa40d4e2c6f925f82ea0e3a2eaae49411ed89b8238cc0286e18f651f66151b146eae316b72dd51474da5718259a2cbb6977caeef71f961f72134d4dd5d811a163eb43d85ed9d0468d4705b1817d73038ffc301d48050b6d201ebe16c09ca86e2498940b087aeb6827939f84c0451cfea3593604035566aa3844dcda72fa816ff044e9ffbe5de30ba590b10fc8ef2e2b00a3485d6037533464bd588a8ac93c7d6924d7aaed5abb95ea76ef1ef45532512c1a08c3b0fe467140f58019d0657ffb9af57e2b7bca7451ae26e9140fe3d6296edf6776ed6c420b289732d9ef27911d86e0e9db4688044a09d71db6f4a52aeac3305d47ecc8ad0605dcd95414578d8211f5414a208863261e96be3df7c3c06d1bc78cea06a96ba68a021a39d9c2b8dca21e9f3326220eab8a9e6d4178838996541ba632717717713920713b04663443a2c3361e0911df3caadd134d7ace64e89f65c1c327948d68a358113c42853bc387f5576a429bdf69f8b7e065f53a5fa133df4743d18137b45b2579cba8ffd2845b25898f7fa5e8c13e9f9fe611ffa08b09c908330a5f8c47a8939b685658c97b43c8a8c8f0bd69a6822580c7a7294538c91195c05feeaeca3841861053c7733775158c35c035f13f22046345e5e808dfd18e5829493f0f43510b233c16a16e78414dfe39d4d93f0e0121ce6920b438fc194ca5fee8e613966628af573e2cd124d972861d4d5283c3c0e37bde3c3deede8cada353f44beb879c95bf0db53b4c62a314c7907766c6e7a5b2d50ff73c5195134dd7b0562761f45de4bd72ba7aea553bba8a3d82848e5db65b03dfcb627a5aa3fcdc96a7339708a851f5374fb81e8f8c9cb3ee32c9e41052b1924fd727294da111bd7ae712c43d82ff19d6c746eb968c16e60e61b695ac8ea24d9f55d5ab4c0c261470af15c56ad47bed75be33a114664d91571ceaa6098ebe451ce5d95c497773e5f0ce0c1a89b5404c41545f9769c15d2c9e4b3b46c65dd7c6565570c61690bb198f8b36d029740eeed64077480914cb7e06773c3aa4e4121afc2b34dc6f1b89ab5e71380da3bb59bc49325d21a210e0e78359a47c0e1d4547a3ac707dfd3ee246371b83d3c4c940fd5c33bc3989d3fac92f2e689d89be85a9bee19b64ab321a8ba4fcc961ff7ed88cb4279859d875fd292e386a617bcb7babb217d555ad8598f267063f8a842a8faf283758f49c5ff5370d1f0a59b59f668ffcfb10153a571986ca979e606e226ceb7c129003cb6c4044d3acf5be4edbe040825a50ed3fb2325967757937dedd0fed41f58a195e1f42342d928e426037f7b96834231c408a2810b8eb9a4359619fea97a2219cd44ecede389cad761341a5a6318bb3f0cb491890fe1f72ef91fbc7937f463805114c1a4a993563f80ec913e4f0d5f0f251c22cfe78660373e3488f8a6144e4a01037b452ac0bdade9fd93c2153728795fab3b6a14761f86ea44f9355ab6b2fa7f302cb18067d1cb2f5d93c86e3344c8c1b082c14125e3dbbfe94d1c1b0604003a5f93044608e3bc773213d41ad78608463152bfc12045bf0d7947ac2e9dee90a3f100bb63fb99a034b77a65deb6616277139f3592b490a81f65b5e6445384772c84f1eaa0e215e861610f77ce2a86425271943f0ab0b1eea0c338952fb0d34a618ea3c7fdbec03c6ee39e0efa8b46fe4cd4aebe8eb513986eac23d3f091052a2a8dd3e164372dfba960b03efc1cecb7f4de5fc49c54b50daf9025b7c6d88675a8cd22f16f2a4b51f6e443966f944f1741147509ae9aefadedc7aa6899334770568af53740b531c1cf2918dac604a913e27941db510b8266493e0158d85a309e16757d054ec72a8becc7c05e9bb1c313648be2c4aa33d4d3626f4c812d75a8c4590d676229b4e98d29000afcdecf53cbf1f3f948ec5989bef72dcdd86840a9a12a5540caf45b6705a1e1cec1e7f5a5ce639215642c1c38d6edc8c65029197afaffb7bf3227793d694407bf51d45d09cf2b4d2dac3a6c7935df4feadbba47b023cab24326239056c8ab587df4b7ad062e22ba1ec93761b7687f17de9091701b8fc44c281e907e5aaef1641423a3a29258cf9b26408bde1e34ddd02f68ff251c296db8e3adfe6baf99fa6e942ddd6be65970cbf2b869c7bdc83fc7e218b6c836e4f93537b7e2d67f16b16d4341ecdb640b78f90b01c6fa5a6657e928c254e91d7758ce6724641be2e39a6398647093993c52a7ff8de646f523aba941f853ff311528252f8b58017354c0f4ae9c8e8c85cde07cdd4fe989ec27c2b1f9b1112d1a55ce6c382409a90772bb8aefe20f90b9094d66bf544113e252499a1728789aef24ff904496cbfde76834809135846de13baa817800570a54fd539123db57d95d442ebe5273b4"]}, 0x11dc}, {&(0x7f0000001380)={0xfc, 0x35, 0x224, 0x70bd2b, 0x25dfdbfb, "", [@generic="1ff97dbc47f3d293a26381bad321277913a64a5976271abfddc086c622a0c67f95ed48fd9386686f9a01f8ee5db05a505c3303c4deb1b648e81392f07729042cabddd5dda4fcc683b9a7f4c66cf56fedc3d44134d2f2068e994cdb7039f3f603c6082824de41a01156b893037919299274bf1b5f3df609420a75996fb83297ec08ee3fb08ca21772299d2fde2648ae611b6a5d48cfd6fcdc58d6b31e051a4abc51db8cc0b5bb41fcce10478a2f8c0f51b0bce2c83d3f2fcf7ecb6b0e1b6c9fce1a0af9b3da3bae54afe155eecaa0d14ad88001beaa2c313b4912e4a2b540987efe5e8e02ababa44e3728073e"]}, 0xfc}], 0x4, &(0x7f0000001640)=[@rights={0x30, 0x1, 0x1, [r0, r0, r0, r0, r0, r0, r0, r0]}, @cred={0x20, 0x1, 0x2, r3, r4, r5}], 0x50, 0x14}, 0x24048004) [ 752.207634] binder: 21409:21432 BC_FREE_BUFFER u0000000000000000 no match 2018/05/12 22:57:53 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='dctcp\x00', 0x6) sendto$inet6(r0, &(0x7f00004e8000), 0xf401, 0x20000001, &(0x7f000007f000)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfc000000]}}, 0x1c) 2018/05/12 22:57:53 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0x1, 0x2000000000000000, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:57:53 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) 2018/05/12 22:57:53 executing program 3: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x100000, 0x0, 0x12, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:57:53 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0x0, 0x2f00000000000000, 0x252]}) 2018/05/12 22:57:53 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x1c, 0x0, &(0x7f0000000040)=[@request_death={0x400c630e}, @free_buffer={0x40086303}], 0x4800000000000000, 0x0, &(0x7f0000000080)}) 2018/05/12 22:57:53 executing program 5: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x200000, 0x0, 0x12, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:57:53 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140), 0x0, 0xfeffffff00000000}, 0x0) 2018/05/12 22:57:53 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0x0, 0x3c000000, 0x252]}) 2018/05/12 22:57:53 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0ffffff00000000], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) [ 753.010368] binder: 21475:21480 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 753.030553] binder: 21475:21480 BC_FREE_BUFFER u0000000000000000 no match 2018/05/12 22:57:53 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0x1, 0x10000000000000, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:57:53 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140), 0x0, 0x1000000}, 0x0) 2018/05/12 22:57:53 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='dctcp\x00', 0x6) sendto$inet6(r0, &(0x7f00004e8000), 0xf401, 0x20000001, &(0x7f000007f000)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2]}}, 0x1c) [ 753.078464] binder: 21475:21489 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 2018/05/12 22:57:53 executing program 3: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x6400, 0x0, 0x12, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:57:53 executing program 5: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x200000, 0x0, 0x12, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:57:53 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0x0, 0x2c00, 0x252]}) 2018/05/12 22:57:53 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000000000], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) [ 753.226406] binder: 21475:21489 BC_FREE_BUFFER u0000000000000000 no match 2018/05/12 22:57:54 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140), 0x0, 0xa}, 0x0) 2018/05/12 22:57:54 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0x1, 0x12, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:57:54 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0x0, 0x3300, 0x252]}) 2018/05/12 22:57:54 executing program 5: modify_ldt$write2(0x11, &(0x7f0000000100), 0x10) r0 = syz_open_dev$sndpcmc(&(0x7f0000001fee)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) ioctl(r0, 0x81204101, &(0x7f0000000000)="ba72e4dfd90306ddca512f9283438a6e674dbf8c8bd0e1c68444c7a46051d7f7e4d7654bd62abf8d664e5827d3d3f5702749fb6a0dca3a66916f") sendto$inet(r0, &(0x7f0000000200), 0x0, 0xfffffffffffffffe, &(0x7f0000000080)={0x2, 0x0, @dev={0xac, 0x14, 0x14}}, 0x10) 2018/05/12 22:57:54 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf0ffffff], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) 2018/05/12 22:57:54 executing program 3: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x4000000, 0x0, 0x12, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:57:54 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='dctcp\x00', 0x6) sendto$inet6(r0, &(0x7f00004e8000), 0xf401, 0x20000001, &(0x7f000007f000)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfc]}}, 0x1c) 2018/05/12 22:57:54 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x1c, 0x0, &(0x7f0000000040)=[@request_death={0x400c630e}, @free_buffer={0x40086303}], 0x2000000000000000, 0x0, &(0x7f0000000080)}) 2018/05/12 22:57:54 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf0ffffffffffff], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) 2018/05/12 22:57:54 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0x0, 0x3200000000000000, 0x252]}) [ 754.181271] binder: 21532:21534 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 2018/05/12 22:57:54 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140), 0x0, 0xffffff97}, 0x0) 2018/05/12 22:57:54 executing program 5: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x6400, 0x0, 0x12, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:57:54 executing program 3: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0xfffffffffffffff2, 0x0, 0x12, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:57:54 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0x1, 0x3100000000000000, r0, &(0x7f0000000000), 0xfe00}]) [ 754.230842] binder: 21532:21534 BC_FREE_BUFFER u0000000000000000 no match [ 754.266937] binder: 21532:21555 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 754.316611] binder: 21532:21555 BC_FREE_BUFFER u0000000000000000 no match 2018/05/12 22:57:55 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0x0, 0x29000000, 0x252]}) 2018/05/12 22:57:55 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffff000], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) 2018/05/12 22:57:55 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140), 0x0, 0xffffffff00000000}, 0x0) 2018/05/12 22:57:55 executing program 5: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="c6295e4eca6c09b612ec6f") r1 = socket(0x11, 0x803, 0x300) r2 = socket$inet(0x2, 0x1, 0x0) write$binfmt_elf32(r2, &(0x7f0000000500)={{0x7f, 0x45, 0x4c, 0x46, 0xe26, 0x7, 0x6, 0xfffffffffffffffa, 0x80, 0x0, 0x3e, 0x9, 0x254, 0x38, 0x1e5, 0x8, 0x8, 0x20, 0x1, 0x9, 0x7, 0x80}, [{0x6, 0x800, 0x7, 0x10000, 0x2, 0x800, 0x0, 0xd99}, {0x0, 0x1, 0x8, 0x10000, 0x0, 0x1, 0x8, 0xffffffff}], "c263edb3880eddfda4af4ff814c425045f7e21df5a8c3d9af2847b44943aff4f92e26f83cf18bbf7ad86b960b08efffc7889a39c531bb17cc046b55a20522fee519c99a56c40b8079c316e0cf1242897b086af07", [[], [], [], [], []]}, 0x5cc) connect$inet(r2, &(0x7f0000cd0ff0)={0x2}, 0x10) recvmmsg(r1, &(0x7f000094f000), 0x269, 0x0, 0x0) ioctl$sock_netrom_SIOCGSTAMPNS(r0, 0x8907, &(0x7f0000000080)) 2018/05/12 22:57:55 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x1c, 0x0, &(0x7f0000000040)=[@request_death={0x400c630e}, @free_buffer={0x40086303}], 0x9510000000000000, 0x0, &(0x7f0000000080)}) 2018/05/12 22:57:55 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0x1, 0x900, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:57:55 executing program 3: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0xfffffffffffffdef, 0x0, 0x12, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:57:55 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0ffffff], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) 2018/05/12 22:57:55 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='dctcp\x00', 0x6) sendto$inet6(r0, &(0x7f00004e8000), 0xf401, 0x20000001, &(0x7f000007f000)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3e8]}}, 0x1c) 2018/05/12 22:57:55 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0x0, 0x600, 0x252]}) 2018/05/12 22:57:55 executing program 3: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x100000000000000, 0x0, 0x12, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) [ 755.172812] binder: 21599:21606 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 755.195487] binder: 21599:21606 BC_FREE_BUFFER u0000000000000000 no match [ 755.214128] binder: 21599:21613 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 2018/05/12 22:57:55 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0x1, 0x3700, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:57:55 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffff9e], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) 2018/05/12 22:57:55 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140), 0x0, 0xffffff7f00000000}, 0x0) 2018/05/12 22:57:55 executing program 5: mkdir(&(0x7f0000014000)='./file0\x00', 0x0) mount(&(0x7f000000a000)='./file0\x00', &(0x7f0000c40000)='./file0\x00', &(0x7f0000014000)='ramfs\x00', 0x0, &(0x7f000000a000)) chroot(&(0x7f0000000040)='./file0\x00') umount2(&(0x7f0000000100)='/', 0x2) r0 = socket(0xa, 0x1, 0x0) connect$vsock_dgram(r0, &(0x7f0000000200)={0x28, 0x0, 0xd934a29ddd33bae5, @hyper}, 0x10) ioctl(r0, 0x8912, &(0x7f0000000140)="c626262c8523bf012cf66f7b2249e589515d39adc5cfa4e469d0a85f49651987f711ec1183ecfc9839b70c8fefca7e7974a9bd93f59d9f10fc9cceec66470c52e96b4567e8765d") chroot(&(0x7f00000002c0)='./file0\x00') r1 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x1, 0x80000) ioctl$LOOP_SET_BLOCK_SIZE(r1, 0x4c09, 0x6f5) fcntl$notify(r1, 0x402, 0x8) ioctl$BLKIOMIN(r1, 0x1278, &(0x7f00000000c0)) open$dir(&(0x7f00000001c0)='./file0\x00', 0x82, 0x2) ioctl$BLKIOOPT(r1, 0x1279, &(0x7f0000000080)) 2018/05/12 22:57:55 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0x0, 0x2c00000000000000, 0x252]}) [ 755.239435] binder: 21599:21613 BC_FREE_BUFFER u0000000000000000 no match 2018/05/12 22:57:55 executing program 3: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x1000000000000000, 0x0, 0x12, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:57:56 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x1c, 0x0, &(0x7f0000000040)=[@request_death={0x400c630e}, @free_buffer={0x40086303}], 0x4000000, 0x0, &(0x7f0000000080)}) 2018/05/12 22:57:56 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0x1, 0xfffffffb, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:57:56 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140)}, 0x0) 2018/05/12 22:57:56 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0x0, 0xfdffffff, 0x252]}) [ 755.423737] binder: 21642:21643 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 755.473005] binder: 21642:21643 BC_FREE_BUFFER u0000000000000000 no match [ 755.526825] binder: 21642:21658 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 755.563548] binder: 21642:21658 BC_FREE_BUFFER u0000000000000000 no match 2018/05/12 22:57:56 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='dctcp\x00', 0x6) sendto$inet6(r0, &(0x7f00004e8000), 0xf401, 0x20000001, &(0x7f000007f000)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x700000000000000]}}, 0x1c) 2018/05/12 22:57:56 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140)}, 0x0) 2018/05/12 22:57:56 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0x0, 0x88ffffff, 0x252]}) 2018/05/12 22:57:56 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffff0], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) 2018/05/12 22:57:56 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0x1, 0xe4ffffff00000000, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:57:56 executing program 5: r0 = syz_open_dev$loop(&(0x7f0000ca9ff5)='/dev/loop#\x00', 0x0, 0x105082) r1 = memfd_create(&(0x7f0000000140)="000000008c00000000000000000000", 0x0) sendfile(r0, r1, &(0x7f0000000040)=0x80000000000000, 0x7) ioctl$KVM_SET_CPUID(r1, 0x4008ae8a, &(0x7f0000000600)=ANY=[]) ioctl$KVM_GET_MP_STATE(r1, 0x8004ae98, &(0x7f0000000000)) setsockopt$kcm_KCM_RECV_DISABLE(r1, 0x119, 0x1, &(0x7f0000000100)=0x1, 0x7f) ioctl$KVM_ASSIGN_SET_INTX_MASK(r1, 0x4040aea4, &(0x7f0000000080)={0x2f, 0x7fff, 0x4, 0x4, 0x6}) 2018/05/12 22:57:56 executing program 3: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x80000000000000, 0x0, 0x12, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:57:56 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x1c, 0x0, &(0x7f0000000040)=[@request_death={0x400c630e}, @free_buffer={0x40086303}], 0x3ed94, 0x0, &(0x7f0000000080)}) 2018/05/12 22:57:56 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0x0, 0x2b000000, 0x252]}) [ 756.155695] binder: 21669:21677 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 2018/05/12 22:57:56 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100007f], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) 2018/05/12 22:57:56 executing program 5: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000240)='/selinux/enforce\x00', 0x8c002, 0x0) io_setup(0x6, &(0x7f0000000000)=0x0) prctl$setfpexc(0xc, 0x3ffff) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x4, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00, 0xe00}]) io_submit(r1, 0xa, &(0x7f00000008c0)=[&(0x7f0000000100)={0x0, 0x0, 0x0, 0xf, 0x7fff, r0, &(0x7f00000000c0)="1b2193c00bf4b7da82a7d81d9a1aeb20b52fa59039f460fe415e41166cb52e910cf6", 0x22, 0x40, 0x0, 0x8be46f55335b5ccf, r0}, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x14, r0, &(0x7f0000000140)="1ae0ca9a6cca878ee5fa85ab47488a53753cc952c1b5be9fb76b84d9bd958966c17471b936b012e77d0587f22ddaf00f3b2dd1ca96c1618d241747845334d331e855b08b3944b0098561093fe30887ed118b", 0x52, 0x7, 0x0, 0x1, r0}, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x7, 0xffffffffffffff7f, r0, &(0x7f0000000280)="1b006c52a5dd689fc78f0b5d8b75b07f9a86ecbc4b94e03419b9acce16c597fb8cc98dcc3ff0fd880dd487b05bf52b5f6bccb5a46875d57a88d650806509e6ee55fc4ec7282dac5814b04673d7b82cce6ef8bc5650147d30d00cf979add887613983671ed724df06e9b46b11dfae2c3ea05c890675cc5987d90e785de0857d8786a6172a9915f29f7e29203268050c66caf7589de73b330548f0bf1025226458786085e0f1ccd9d60b5a82ea1ffee8a5f637", 0xb2, 0x1, 0x0, 0x1, r0}, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x6, 0xff, r0, &(0x7f0000000340)="a7a5039dde125c0cf0431ba14209034175a37aa97d327b311a4b834d", 0x1c, 0x0, 0x0, 0x0, r0}, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x2, 0xffff, r0, &(0x7f00000003c0)="5e4b3e517d3c1ac7d46ace252281676ad0115106ee5a84f89ffbe77ee6975aec0caba6b768cd5baee9271b3124ee21ab5aefcb0f6d7beaf6cb0d658ad1d9d65ec23776a42633143ad1c5f6c7b60fc09ac95609c032feec33d7ae97904535537fccbcb96b9b41f999986f18644f422a9f889c2f28cb0343", 0x77, 0x6, 0x0, 0x1, r0}, &(0x7f0000000540)={0x0, 0x0, 0x0, 0xf, 0xffffffffffffff81, r0, &(0x7f0000000480)="dade658bdafb46d793fd09997941ef0d371721c63819b00adfc664a8a9629ea09a79d30c85afdb0ee479e37c6ca0eb03b680adb7dad1d0e3beff52302c3cd68bafe529d0effdc621eac333d0a7b8fb6d0d380b694bf1a02c3aec4fc7817b342a43358e0f6ca7805ff20b5ebdbea43015d512deca3edf1cee215af5b34fbf819c8b4a9f640959a83bcb876d846c78b4f57f9ba315ed213fdee8a398873778a106643b19c2c9ca713f018344a3e8b877a53872f1169577c87712c722616578", 0xbe, 0x10001, 0x0, 0x0, r0}, &(0x7f00000005c0)={0x0, 0x0, 0x0, 0x1, 0xfffffffffffffff7, r0, &(0x7f0000000580)="698f85243cfc52b49fdf352083a0", 0xe, 0x8, 0x0, 0x1, r0}, &(0x7f00000006c0)={0x0, 0x0, 0x0, 0x0, 0x5d0f, r0, &(0x7f0000000600)="26b6e15261d2f18ee6d8de38b283a811176527709e21f6f6ec8233a6e746efab3b4f6b1d76bb267aa9f130ed0a2d63958b910e1681938a82e0a0df20dfde37aeb558f017686fdcd3a0a539f611621f9a4a4814c27391d17867bbf68949da4523711199f4fc7c26a887859c55b0f66a5fb7309f2ba8484a0d6b584de6e5841f8b006c52bf3f039c3ecd54a3a67ffd", 0x8e, 0x96, 0x0, 0x1, r0}, &(0x7f00000007c0)={0x0, 0x0, 0x0, 0x8, 0xb4, r0, &(0x7f0000000700)="b006bc0233f7c822758cb8ebff46ee9a942f8c3277ca38e42bd436fc72900713c9711eff4aba6459a07ff6fa377a6090934f8768585a9492b7e7487fad45c0f25c76e58e8226d5fd87470f3d75d22ca16de90133cf64e893fdd9ebcd5336109fc47a35ad0f1b3e8dd0e07177a7cae8f7534104af0ccd49c1fa306d3e67fe19c0d21d8ac7794118aa65f3c3aeea135a7a39dcbe891f6bd0fb04ae8733abff0c3139b8a645d8264aba392b7f353ce9", 0xae, 0x6, 0x0, 0x1, r0}, &(0x7f0000000880)={0x0, 0x0, 0x0, 0x6, 0x2, r0, &(0x7f0000000800)="940a4c30bedbe442349c3f16acffcbba22321fb6c9421fde30998f95cbb382679d43a06da1e7e7181961a1b2f4d16f4eb37b1bd26dd883f411e41b7fd2ca5c109b97633b9582ae0d6ec4603249ccdb013fca9707ed684890477e4cb3145583848fde90a5ae5b8e814ede96b33f3a00fdb66c1839166203291b87000a", 0x7c, 0x2, 0x0, 0x1, r0}]) 2018/05/12 22:57:56 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140)}, 0x0) 2018/05/12 22:57:56 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0x1, 0xf000000, r0, &(0x7f0000000000), 0xfe00}]) [ 756.211017] binder: 21669:21677 BC_FREE_BUFFER u0000000000000000 no match [ 756.272080] binder: 21669:21697 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 756.326199] binder: 21669:21697 BC_FREE_BUFFER u0000000000000000 no match 2018/05/12 22:57:57 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0x1, 0x8008, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:57:57 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0x0, 0x1100, 0x252]}) 2018/05/12 22:57:57 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100000000000000], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) 2018/05/12 22:57:57 executing program 5: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000040), 0x8, 0x80800) ioctl$sock_SIOCGPGRP(0xffffffffffffff9c, 0x8904, &(0x7f0000000100)=0x0) sched_setaffinity(r1, 0xc28bec74, &(0x7f00000000c0)=0x6) readv(r0, &(0x7f0000b28000)=[{&(0x7f000004f000)=""/128, 0x80}], 0x1) signalfd4(r0, &(0x7f0000000000), 0x8, 0x0) 2018/05/12 22:57:57 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='dctcp\x00', 0x6) sendto$inet6(r0, &(0x7f00004e8000), 0xf401, 0x20000001, &(0x7f000007f000)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000000000000]}}, 0x1c) 2018/05/12 22:57:57 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140)}, 0x0) 2018/05/12 22:57:57 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x1c, 0x0, &(0x7f0000000040)=[@request_death={0x400c630e}, @free_buffer={0x40086303}], 0x6800000000000000, 0x0, &(0x7f0000000080)}) 2018/05/12 22:57:57 executing program 3: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x7900, 0x0, 0x12, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:57:57 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140)}, 0x0) [ 756.480349] binder: 21724:21731 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 2018/05/12 22:57:57 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0x0, 0xfffffffd, 0x252]}) 2018/05/12 22:57:57 executing program 5: r0 = socket(0x20000000000000a, 0x5, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket(0x40000000015, 0x5, 0x0) bind$inet(r1, &(0x7f00008a5ff0)={0x2, 0x0, @loopback=0x7f000001}, 0x10) uselib(&(0x7f0000000040)='./file0\x00') recvfrom$ipx(r1, &(0x7f0000000140)=""/190, 0xbe, 0x2, &(0x7f0000000200)={0x4, 0x0, 0x0, "18dd1df250d3"}, 0x707000) sendto$inet(r1, &(0x7f0000f7db7f), 0x0, 0x0, &(0x7f000069affb)={0x2, 0x0, @loopback=0x7f000001}, 0x10) 2018/05/12 22:57:57 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf00000000000000], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) 2018/05/12 22:57:57 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='dctcp\x00', 0x6) sendto$inet6(r0, &(0x7f00004e8000), 0xf401, 0x20000001, &(0x7f000007f000)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff0f0000]}}, 0x1c) 2018/05/12 22:57:57 executing program 3: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x2000, 0x0, 0x12, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:57:57 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0x1, 0xffffffff000, r0, &(0x7f0000000000), 0xfe00}]) [ 756.559933] binder: 21724:21731 BC_FREE_BUFFER u0000000000000000 no match [ 756.621616] binder: 21724:21754 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 2018/05/12 22:57:57 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0x0, 0x21, 0x252]}) 2018/05/12 22:57:57 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140)}, 0x0) 2018/05/12 22:57:57 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa9080000], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) 2018/05/12 22:57:57 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='dctcp\x00', 0x6) sendto$inet6(r0, &(0x7f00004e8000), 0xf401, 0x20000001, &(0x7f000007f000)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfe800000]}}, 0x1c) [ 756.681674] binder: 21724:21754 BC_FREE_BUFFER u0000000000000000 no match 2018/05/12 22:57:57 executing program 3: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x79, 0x0, 0x12, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:57:57 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0x1, 0x1200, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:57:57 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140)}, 0x0) 2018/05/12 22:57:57 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x1c, 0x0, &(0x7f0000000040)=[@request_death={0x400c630e}, @free_buffer={0x40086303}], 0x300000000000000, 0x0, &(0x7f0000000080)}) 2018/05/12 22:57:57 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='dctcp\x00', 0x6) sendto$inet6(r0, &(0x7f00004e8000), 0xf401, 0x20000001, &(0x7f000007f000)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x900]}}, 0x1c) 2018/05/12 22:57:57 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0x0, 0xffffff89, 0x252]}) 2018/05/12 22:57:57 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa00], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) [ 756.948757] binder: 21800:21802 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 756.976275] binder: 21800:21802 BC_FREE_BUFFER u0000000000000000 no match [ 757.007335] binder: 21800:21811 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 757.051987] binder: 21800:21811 BC_FREE_BUFFER u0000000000000000 no match 2018/05/12 22:57:58 executing program 5: r0 = inotify_init() fcntl$notify(r0, 0x0, 0x20) ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, &(0x7f00000002c0)=0x0) r2 = syz_open_procfs(r1, &(0x7f0000000040)='net/ip6_mr_cache\x00') getsockopt$netlink(r2, 0x10e, 0x9, &(0x7f0000000300)=""/229, &(0x7f0000000000)=0xe5) clone(0x0, &(0x7f0000000000), &(0x7f0000000240), &(0x7f0000000100), &(0x7f0000000140)) getsockopt$inet_sctp_SCTP_PR_SUPPORTED(r2, 0x84, 0x71, &(0x7f00000000c0)={0x0, 0x2}, &(0x7f0000000140)=0x8) setsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r2, 0x84, 0x6, &(0x7f0000000180)={r3, @in6={{0xa, 0x4e22, 0x7fff, @ipv4={[], [0xff, 0xff], @multicast2=0xe0000002}, 0x2}}}, 0x84) accept4$packet(r2, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @link_local}, &(0x7f0000000280)=0x14, 0x80800) 2018/05/12 22:57:58 executing program 3: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x4000000000000000, 0x0, 0x12, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:57:58 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0x0, 0x2100000000000000, 0x252]}) 2018/05/12 22:57:58 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140)}, 0x0) 2018/05/12 22:57:58 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0x1, 0x2, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:57:58 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='dctcp\x00', 0x6) sendto$inet6(r0, &(0x7f00004e8000), 0xf401, 0x20000001, &(0x7f000007f000)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x54]}}, 0x1c) 2018/05/12 22:57:58 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x300], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) 2018/05/12 22:57:58 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x1c, 0x0, &(0x7f0000000040)=[@request_death={0x400c630e}, @free_buffer={0x40086303}], 0xffffff7f00000000, 0x0, &(0x7f0000000080)}) [ 757.445707] binder: 21825:21827 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 757.462515] binder: 21825:21827 BC_FREE_BUFFER u0000000000000000 no match 2018/05/12 22:57:58 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0x1, 0x10, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:57:58 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140)}, 0x0) 2018/05/12 22:57:58 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400300], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) 2018/05/12 22:57:58 executing program 3: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x8900000000000000, 0x0, 0x12, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) [ 757.493321] binder: 21825:21827 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 2018/05/12 22:57:58 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0x0, 0x400000000000000, 0x252]}) [ 757.542183] binder: 21825:21827 BC_FREE_BUFFER u0000000000000000 no match 2018/05/12 22:57:58 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffc0], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) 2018/05/12 22:57:58 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140)}, 0x0) 2018/05/12 22:57:58 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0x0, 0x6, 0x252]}) 2018/05/12 22:57:58 executing program 5: r0 = socket(0xa, 0x1, 0x0) r1 = userfaultfd(0x0) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000911000)={{&(0x7f0000004000/0x1000)=nil, 0x1000}, 0x1}) clone(0x0, &(0x7f0000001f37), &(0x7f0000001ffc), &(0x7f0000001000), &(0x7f0000001000)) mbind(&(0x7f0000004000/0x1000)=nil, 0x1000, 0x0, &(0x7f0000000240), 0x9, 0x3) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r2 = syz_open_procfs(0x0, &(0x7f00000000c0)='smaps\x00') sendfile(r2, r2, &(0x7f0000c7a000)=0x100004, 0x10001) 2018/05/12 22:57:58 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x1c, 0x0, &(0x7f0000000040)=[@request_death={0x400c630e}, @free_buffer={0x40086303}], 0x4800, 0x0, &(0x7f0000000080)}) 2018/05/12 22:57:58 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140)}, 0x0) 2018/05/12 22:57:58 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffff7f00000000], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) 2018/05/12 22:57:58 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='dctcp\x00', 0x6) sendto$inet6(r0, &(0x7f00004e8000), 0xf401, 0x20000001, &(0x7f000007f000)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000]}}, 0x1c) 2018/05/12 22:57:58 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0x0, 0x2c, 0x252]}) 2018/05/12 22:57:58 executing program 3: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x184000000000000, 0x0, 0x12, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:57:58 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0x1, 0x3000000, r0, &(0x7f0000000000), 0xfe00}]) [ 758.404985] binder: 21882:21886 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 2018/05/12 22:57:59 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0x1, 0x3100, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:57:59 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0x0, 0x2b, 0x252]}) 2018/05/12 22:57:59 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140)}, 0x0) 2018/05/12 22:57:59 executing program 3: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x5, 0x0, 0x12, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) [ 758.447449] binder: 21882:21886 BC_FREE_BUFFER u0000000000000000 no match 2018/05/12 22:57:59 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200000000000000], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) 2018/05/12 22:57:59 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='dctcp\x00', 0x6) sendto$inet6(r0, &(0x7f00004e8000), 0xf401, 0x20000001, &(0x7f000007f000)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf401]}}, 0x1c) [ 758.517079] binder: 21882:21907 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 2018/05/12 22:57:59 executing program 3: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0xf00000000000000, 0x0, 0x12, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:57:59 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0x0, 0x2900000000000000, 0x252]}) [ 758.583864] binder: 21882:21907 BC_FREE_BUFFER u0000000000000000 no match 2018/05/12 22:58:00 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='dctcp\x00', 0x6) sendto$inet6(r0, &(0x7f00004e8000), 0xf401, 0x20000001, &(0x7f000007f000)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff00]}}, 0x1c) 2018/05/12 22:58:00 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0x0, 0x33000000, 0x252]}) 2018/05/12 22:58:00 executing program 3: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x79000000, 0x0, 0x12, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:58:00 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140)}, 0x0) 2018/05/12 22:58:00 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x1c, 0x0, &(0x7f0000000040)=[@request_death={0x400c630e}, @free_buffer={0x40086303}], 0x68000000, 0x0, &(0x7f0000000080)}) 2018/05/12 22:58:00 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0x1, 0xfffffffe, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:58:00 executing program 5: r0 = socket(0x1e, 0x1, 0x0) setsockopt$packet_tx_ring(r0, 0x10f, 0x87, &(0x7f0000540ff0)=@req={0x3fc, 0x0, 0x1}, 0x10) r1 = socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(r1, 0x10f, 0x87, &(0x7f0000265000)=@req={0x3fc, 0x6, 0x1}, 0x10) r2 = socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(r2, 0x10f, 0x87, &(0x7f0000265000)=@req={0x3fc, 0x0, 0x1}, 0x10) fcntl$setpipe(r1, 0x407, 0xffffffff) ioctl$sock_kcm_SIOCKCMCLONE(r2, 0x89e2, &(0x7f0000000000)={r0}) 2018/05/12 22:58:00 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffff7f], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) [ 759.593136] binder: 21953:21955 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 2018/05/12 22:58:00 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140)}, 0x0) 2018/05/12 22:58:00 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9effffff], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) 2018/05/12 22:58:00 executing program 3: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x502d0400, 0x0, 0x12, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:58:00 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0x0, 0x84ffffff, 0x252]}) [ 759.646480] binder: 21953:21955 BC_FREE_BUFFER u0000000000000000 no match 2018/05/12 22:58:00 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_open_dev$mice(&(0x7f00000000c0)='/dev/input/mice\x00', 0x0, 0x2) ioctl$KVM_SET_MSRS(r2, 0xc008ae88, &(0x7f0000000000)=ANY=[@ANYBLOB="0100000000000000044d564b0000000000000000000000006675514b1ed3a12edf6c9a4212fdee78f878cf4801ff719e5327a09355038c3c32302cdbd432836c382a453dc5f618904a958e06e098a67b52e1adf0475aa6f439deac996da97d5637334f26b01c277968b5e206be4f505222d727365e8dc993a4476b046559ea82843026e7adb6d0bbac66c9652f8630e14bfb6735e7a2939bf749f3039295ce4ad4d4a7"]) [ 759.698304] binder: 21953:21969 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 759.798163] binder: 21953:21969 BC_FREE_BUFFER u0000000000000000 no match 2018/05/12 22:58:00 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='dctcp\x00', 0x6) sendto$inet6(r0, &(0x7f00004e8000), 0xf401, 0x20000001, &(0x7f000007f000)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x600]}}, 0x1c) 2018/05/12 22:58:00 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0x1, 0x20000000000000, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:58:00 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140)}, 0x0) 2018/05/12 22:58:00 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf00], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) 2018/05/12 22:58:00 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0x0, 0x3, 0x252]}) 2018/05/12 22:58:00 executing program 3: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0xfdef, 0x0, 0x12, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:58:00 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x1c, 0x0, &(0x7f0000000040)=[@request_death={0x400c630e}, @free_buffer={0x40086303}], 0x500000000000000, 0x0, &(0x7f0000000080)}) 2018/05/12 22:58:00 executing program 5: r0 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r0, &(0x7f0000000000)={0x18, 0x0, {0x1, @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, 'erspan0\x00'}}, 0x1e) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000640)='/dev/ptmx\x00', 0x80, 0x0) r2 = dup(r1) ioctl$SNDRV_SEQ_IOCTL_DELETE_QUEUE(r2, 0x408c5333, &(0x7f0000000500)={0x7, 0x9, 0xaf7f, 'queue1\x00', 0x800}) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000040)=0x3) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f00003dd000)='/dev/ppp\x00', 0x3fffd, 0x0) ioctl$EVIOCGPROP(r3, 0x40047438, &(0x7f0000000300)=""/246) eventfd2(0x3c, 0x7fe) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_TEMPO(r3, 0xc02c5341, &(0x7f00000000c0)) ioctl$VT_OPENQRY(r3, 0x5600, &(0x7f0000000140)) lstat(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x0}) getsockopt$inet6_IPV6_XFRM_POLICY(r3, 0x29, 0x23, &(0x7f0000000680)={{{@in=@local, @in=@broadcast, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@dev}, 0x0, @in=@rand_addr}}, &(0x7f0000000280)=0xe8) r6 = geteuid() r7 = accept4(r0, 0x0, &(0x7f00000002c0), 0x800) setresuid(r4, r5, r6) bind$ax25(r7, &(0x7f00000005c0)={0x3, {"b0bc5c3cebb4d3"}, 0x7}, 0x10) memfd_create(&(0x7f0000000080)='/dev/ppp\x00', 0x2) 2018/05/12 22:58:00 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0x0, 0x33, 0x252]}) 2018/05/12 22:58:00 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0x1, 0x0, r0, &(0x7f0000000000), 0x7ffff000}]) [ 759.956682] binder: 22009:22011 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 760.025476] binder: 22009:22011 BC_FREE_BUFFER u0000000000000000 no match [ 760.081207] binder: 22009:22027 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 760.119485] binder: 22009:22027 BC_FREE_BUFFER u0000000000000000 no match 2018/05/12 22:58:00 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) 2018/05/12 22:58:00 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140)}, 0x0) 2018/05/12 22:58:00 executing program 3: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0xd00, 0x0, 0x12, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:58:00 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='dctcp\x00', 0x6) sendto$inet6(r0, &(0x7f00004e8000), 0xf401, 0x20000001, &(0x7f000007f000)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffff91]}}, 0x1c) 2018/05/12 22:58:00 executing program 5: r0 = dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) setsockopt$inet_sctp6_SCTP_RECVRCVINFO(r0, 0x84, 0x20, &(0x7f0000000180)=0x9, 0x4) sendmmsg$alg(r0, &(0x7f0000000540)=[{0x0, 0x0, &(0x7f0000000480)=[{&(0x7f00000001c0)="a119a5800c9d8341539470d9a4680173b45a9b0088b999c0524988b5ac9d786ccbf257c027e14f710e2856fa5b5470cb2f3ca7e0d8997d3f3ac6648516757139d1abd8e83ec52c7d8c7da26e9fd7d92517715e2055ff7bfdb33299dd9a3a505bb8449ef2fbc761ed052ebcf855264a28c40425328184dddf5526c2ef7e2cfd9ae4f95a7196841ce20545f995d572c512b405d1c1a6e32161015b94eae4424de3078fce578cb2839fda9415", 0xab}, {&(0x7f0000000280)="16ac587abef68565c12a6be3759f9bfa40291f3cc36f1d0b7afd097957fb34db5132b9b33e3b595f9e6482825026ad715a7166afb77cc4d208bece26fe59faf0f78a77459af3eb2496d5498343618bc27eefd430918755b226cd82b9a14196b1e077d31b8becb867c84ff710b711242f00d32b47c3e7de3563232364ef7d17a97a8b8976eaa408de3c0277ba3a00d6a03125afc4d81cbdd35a27d33aa7cdcba46bed8be9f6c43d39c95faa2dd375895a98f8df5aa2a8cc9c41b096a6fc44f3430917cabbff9c37416d63ebf0d8e97c131dc94a9d75b0e4db8e3b360ab0f6fb9bc1e6182938a919bd7b6a1e339238e027", 0xf0}, {&(0x7f0000000380)="4236f6ae37cffa19fcc3aba6a88a23d2181944a88ffa2a675f39fbc205cd8a111ed966d476fcea2bcdaaa2cde4ebde5467cc47908e0a674f61b813c638134b719c932bf01be82bd17642988de01e876e78bbe4f22c802e45a983fae519e32315b33c3010fdb28bbaf0593d71c78d97b30f40e741364fcdd660bbc020634bd7603b2f45bd5d33887c52012b9a5d7d246f15c79fb3187684ef0e15c640acf9c3fc802ab4f172c3056aee5334f9efba79c1dae8cb04c72827545ea1eb7fa2069d168ea48e76d1dabc0ab23f9dac19f15c0cad39f6a33085350102df2fb2f190bb76e2bd12", 0xe3}], 0x3, &(0x7f00000004c0)=[@op={0x18, 0x117, 0x3}, @assoc={0x18, 0x117, 0x4, 0x1}, @op={0x18, 0x117, 0x3, 0x1}], 0x48, 0x40800}], 0x1, 0x20000041) r1 = syz_open_dev$sndseq(&(0x7f0000000000)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r1, 0xc08c5332, &(0x7f0000000040)={0x0, 0x0, 0x0, 'queue1\x00'}) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_CLIENT(r1, 0x404c534a, &(0x7f0000030fb4)={0xbe, 0x0, 0xfffffffffffffffb}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$SO_TIMESTAMPING(r2, 0x1, 0x25, &(0x7f0000000100), &(0x7f0000000140)=0x4) 2018/05/12 22:58:00 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0x0, 0x300000000000000, 0x252]}) 2018/05/12 22:58:00 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x1c, 0x0, &(0x7f0000000040)=[@request_death={0x400c630e}, @free_buffer={0x40086303}], 0x600000000000000, 0x0, &(0x7f0000000080)}) 2018/05/12 22:58:00 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0x1, 0x0, r0, &(0x7f0000000000), 0xfefe00}]) 2018/05/12 22:58:00 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) 2018/05/12 22:58:00 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0x0, 0x6000000, 0x252]}) 2018/05/12 22:58:00 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140)}, 0x0) 2018/05/12 22:58:00 executing program 5: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0x1, 0x0, r0, &(0x7f0000000000), 0x7ffff000}]) [ 760.218163] binder: 22052:22053 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 760.236751] binder: 22052:22053 BC_FREE_BUFFER u0000000000000000 no match [ 760.255216] binder: 22052:22056 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 2018/05/12 22:58:00 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) [ 760.301713] binder: 22052:22056 BC_FREE_BUFFER u0000000000000000 no match 2018/05/12 22:58:00 executing program 5: r0 = socket$inet6(0xa, 0x3, 0x200000000001) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @local={0xfe, 0x80, [], 0xaa}, 0x6}, 0x1c) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000040)='/dev/snapshot\x00', 0x40000, 0x0) ioctl$BLKSECDISCARD(r1, 0x127d, &(0x7f0000000080)) r2 = msgget(0x2, 0x0) msgctl$IPC_INFO(r2, 0x3, &(0x7f00000000c0)=""/86) getrandom(&(0x7f0000000540)=""/4096, 0x1000, 0x1) sendmmsg(r0, &(0x7f0000007e00)=[{{0x0, 0x0, &(0x7f0000000040), 0x0, &(0x7f00000003c0)}}, {{&(0x7f00000004c0)=@in6={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [], 0x1}}, 0x4, &(0x7f0000000680), 0x0, &(0x7f0000002000)=[{0x10}], 0x10}}], 0x2, 0x0) 2018/05/12 22:58:01 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x1c, 0x0, &(0x7f0000000040)=[@request_death={0x400c630e}, @free_buffer={0x40086303}], 0x7400000000000000, 0x0, &(0x7f0000000080)}) [ 760.459985] binder: 22076:22080 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 760.470767] binder: 22076:22080 BC_FREE_BUFFER u0000000000000000 no match [ 760.493749] binder: 22076:22084 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 760.501820] binder: 22076:22084 BC_FREE_BUFFER u0000000000000000 no match 2018/05/12 22:58:01 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0x0, 0x21000000, 0x252]}) 2018/05/12 22:58:01 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140)}, 0x0) 2018/05/12 22:58:01 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe37}]) 2018/05/12 22:58:01 executing program 3: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x300000000000000, 0x0, 0x12, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:58:01 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa908000000000000], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) 2018/05/12 22:58:01 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket(0x10, 0x2, 0x0) ioctl(r0, 0x3, &(0x7f0000000480)="c626262c8523bf012cf66f") r2 = socket$key(0xf, 0x3, 0x2) lstat(&(0x7f0000000000)='./file0\x00', &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$sock_SIOCGPGRP(r1, 0x8904, &(0x7f0000000100)=0x0) r5 = getpid() lstat(&(0x7f0000000200)='.\x00', &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x0}) getsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f00000002c0)={{{@in, @in6=@dev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast2}, 0x0, @in=@broadcast}}, &(0x7f00000003c0)=0xe8) sendmsg$netlink(r1, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000400)=[{&(0x7f0000001040)={0x14e0, 0x1b, 0x1, 0x70bd2c, 0x25dfdbfc, "", [@generic="8371226b6b75088a3b7fde04ce203e98dbd62f8f7c907132b576bfdcf79d66f9d86c08b6b6efd2b0044db14cd64fb8b6f5fcb57e9014796b9e1dfb980affa327d90cb8ee8a1fcc436385213553150d6ec131a3843a411b1d9f1508994eee32b5c0bc6da94df16c6f20b6edf6aa0dffe28230837d7132199047de9a2ab41a6a50c2dc1ac587547021d4d993a95866f25c465b6c1c45edcc621b9e011c0899ac131d7276f732add2a30129e4a52c081dcb39da785d98e3ae883f59b13e9427c9125f5b70b0e0209c5b60b345e7e19dca7350cc4bf9a53a", @generic="7811b946084577720635f5614f4bd3e374e43610d331ea672e0cf600a2710a4076a37c457de7df92cf3c8d1b941c509bbc911806517f787e0d95f58384bab01936a94664071b009da96041ad56f646a8b260ebaaa14033ddc34a5c1e8337633e0eb500ae8f627eef0947271a233f6a868749cd0e4c983007f79326674603bf6fe4b466dfd610f388a454b93876722b1b52a1c38aa82ba47d4d5321b88ed8aea66f83c35765ce2046cd08e4b8a177d7ee7a66177db64604ae3f0089da4ef323394b5d83b76e2d3308401f689d6fa1bed4dfa36b0a5ccea603d7ec37d21a79d66a2a503803cef49d6e40788fec3d7124", @nested={0x1188, 0x1f, [@typed={0x4, 0x25}, @generic="64e188c2db634d4abe0809f02b5a5017bc43891eefe893a05c61cdb2ac0e4267f7d83c06aec4a491f31e609d72e253e8b749d00287cf283453d20788e635ae08ba61e81480e03cf2546f91c1b4f2fc0e18c9c01317d0558f9da38d2a6c9e0ed37feeacc4967eaaf08b5135005556400b1a99e2a54dbd882c018591d7a0df231ba22a62ff9c70d13f3f4ee983861d6fecc9b733d14aa9a928a2da2e9961f0a20310850409118b3fddfc57bc5a130f1cc41cfc4b99f8320c16f5e912711620dd1f10662e8ba9a79157a95b81b199c5ddee64acc45aaab88d41d3dd78f2593d118f6271813a283e8a9a8d5820fa4603b176cef1bee9c106ceb903f445cbd75b24875245163fd1cd3beb19208f41addd1d13d8d0fdcdafa8c568e9bf241289d86e6e8a323bbcccc18b95ca4007f9bacad97b417036d4ea5c4de3eba55df4c43cf4b34427fab023242b89e799bae926b1a9ffd4065a8d4e0bd92b6a6529d8caf96a6e144dbf226362a3390381d99dfd9d8976028be5ac660789ea662ecd7b7d3d35d2db5726fe396a0d24e8929e97291f58a2293720e6835720eb75e8954d8ba21e0c9529f9e02741f051db02c5d93aa2237fc75be2228d48ef7decb1586be9768d0bcd632366bd379d939d3fb720beae51e516a48c96d2ac67013b5ec26088a9b86592b965fcd11ce4a99375a0029a84e28eddb5923ac801ec300a101c77601523f844d6d5778a38debc33690bc2811d60d2c753cff18dc4f1753777a447b0da102553f7399b3d51669a478d2b2f6e587e7146766a0dd74597f6bf1a790ac7ae6747bcb9ff22125c81a7fe02614ec889b22004fca457ca3a64b870d0e0a4aaf32d0ee05cc836f09b559834745655321a1126b29e6cae0af703009ad13486ac3f05814e3e9293710b997d09c6cc405ed126ed1cab5aaece629e61f7f01b84cdd7281303114ba1c6bf49755a07aa493f88b036d6553d10b07cd08df5682c32774975a26e731f78a137387acf22b1aec12a81a8a4b008712346649e182e165700e1caf41079a32807a3eba65025e1497ef795811dc68bb0a67a458683c20e02f23c88f213e1bfa4c608dfe887c66b2f877dd940f48f70cea9974fd3a646db22e35f3c7138f6df78981f1c9ad0b8283d0c8dc875d11752e353cb923a78c07f856d80e7e0e2c7b0924b61e0254ee015bf0e792536397aa2c028e015849c43ce39a9ec1105661a3b762406257ed9ff128d81c70606dfde2a78deb6033e585886e02da0899b58ed5b3870968ccd41a1caee5185bb46f185137cf0beef852266bb907d52856a15165c7dd2f9ec85fab1d9413577d6fc195e9f99aca0eab4db84e07442aaf7c5849678a07354b6d40fce062acf01bf782e532086802b219fa99c9d2febf7fd5dffcbaf42db316a4c31b6c63f775983f32b305f277f288e618ee5726deb9c042bab17a7b2f196cc2088499b49a416bc504ef5044cecb586cb9ae03254a61488a7a418f62d06462aec125d6799d034455316c48db125002158f99218b0e6c5f35b2f37142300377426af19c31a0a4f0ec496750279943891ea356b5876d43271690d0ff12df9069d48eea7064f5609bed959360bc93a157b5cf57d47c36892ec59fe187968c945514bcb8388f538ac12cf12c2fa327e088c4ce8baac929db9cd77fff1a725d97266ed8884b4831a2f738966ba6e27b737b25c56da5683346385b759e194903502381f2831d9138f54d0aa63f1458297775550a54355b26ad4830db6c1e7929119a82b6575ddfc0112e51a095a797da47a92623c4c3b94179f6c870577d126e6c99de969392eb2f59bd3da80e827572fc123c189b57b13921ab92bc36e6ea583252f55ed4c8ef47f27bd2d58ad8a1a736ae5431b28b5687a9b2955ccb9ed945411a6727ddadb97a87c471122bae7ba9e46bdf7e9be1bb657924122a65519c881732119b0a19bdff3ae7265f97ddd9bc548da448ec9c9e9ae937af7d039aea4e957b04b151dba54503108be7050fccd335c7fc90b4b09f5751f8cf497c35546945e2ddb2dfe79bb0bc2ef06f2a2b2d006eef6023156bd5e702c35d9a4a230922edcb58b5c6968d84b3a696495845a734638409078af1107b419ef2997be29b519244596f27032a638261b7492ca3ed850809fca9121065a4f867cfa3066d74c7790008c14168e700bed9c85e5a4117ec6d17d786d49ae715ced605871f9899bace59632908fe04b155192e77ee4f4eed0a5c4d9f18b7b7aeb7c85bdf907ef654bdeb716f9e2682dc1fe8e54862ce16dbce3733557ef48c633aca7f228c96dd8506a6646418507c0cc14e39018aaa2057d073fbbf9e3f641f47c55177eefabe4e1f035eca1f6629a1ef3e691bc5dead4a40bafa9de2ecea119448d37f58473fc04a8832fe3cf65134484e4226a993cea7e2548634785754eed7d2cfc16e3d0acd7a437e5a937a513682f058f0fb06c6ba8a939ab08a32cd06a3793687c0fed23b898840c1400a449b3c6e802ec92f1a8bda6712e509f02cf5f059e1b663aef174ab76e274f46a5218ac210e3b49e8d8e8429ec56676a9ac2d491a4f66779344680fff0a6a9465d3ec52c97c449b67b211201363b75e5424a20985f49a86676860879d0294fcf877d8cd1968e17728493e0de40f36335767fcd2d8693cc5852c83659ccdc6e86a23d62068728db4f219c9a742cf0fcbc989ada853fa7fe8750262bad5c2c0787d77569b1a9adc4080a1f4ec7335015575edd354749b24aa9f23fe54b7d2c84b9c5771e6055aff1dd3f1142c2a06ceefe85bda686a78a788362be5d9f3ff904e26468fc60e22579f37e96f4b1e8c5ae732054a6e326d6c8be5455c259f54fc8c3f77d0272f604b879dc207f386290581df61a693fbb80c542d98507ea819e2cca5a0e924f0c90be180af60541b99f7e0ca5154dc09cb486e431bc6b3ab448c0d042e5fd3ef53a7bc1ec7b7fc1906856bb4e1157b5562f82736b9545579828aba78b7a713b0df213e63ec707a743624b5529d60308cbc7f4eebffb24e06b540af1a6826d69b36b38ded61999b3d239261cf8fe2bc35ff82265ebcd8230a6bc80dc08aeeb6c6dbe8bf37521cbef874eb88301c3f1ee6fa2b5b36e56fd05de2d337e841fdcc49ccfde2c16af225880d51ccc80f823c5537d785eb58f7ca909e1f1f6bf51d18916c0351a89e0c69c5b38dcfa2358e45277601525d860862a9d89bb110e3f488c74e333b293f9617103d37d976411c18faaeb892c75e0c80268455fbd313a9e4d62251a022c58ab4f4dc823a119478bbe4b22738fc4e19a3c2663d724200d45534fac64f24fda65a5e5bdececa1ad1d91a6724968e5a51303cda469fb0401d83fb842c2741b283bb785e8c8ae77eb800f57732c03fd897e76cf92a9f077b49913ec7f66827d44251137d2bfa4b47a1312601be56c2456188a597b80835abe2bc287a8ae9e86fdcfb96b1ca2c22728464bb6162402797e9a9c19d61e40008d94887c861539474e343ef94262aafd514d6258682730f44d08ee35ef5cbe0ae3ffaaee2ecd99fb4f03a999059e8a9099d7113015478540b48e23c963c0b46f8c0a8e003b691f442628ba7ab3e11aef4386913fbf8d26f27844de9e878d420e8272163e9bc8c93eb8a3696f5644e47bd7c145d8daa97cc18af8ea4952ab880a16a86ee4c516f125b9928202d5d7f878c7f16c2a176bb94811345af4ae80e369a32013965feb268965dd769326c25f156e4193bf7e849bf92313bd55b2b322bd093b8d9f158c37fa03ca38164e9f4e05c47435c87264983ee97ed959f7a2028ab1b8094cdbddd2e7a417a9f3af36ce95b27381f10a1b1933cc5567e217c32d3d9964543dc9fd63c98126defe642c471704965f507075d5356c2e9f930433082c6abb01ce9047fd4a8e00db285b0c54bc35a65ea31093b8667e7faa6519e2a6387c0645cfbc08bda70ca4157182e7c177617a7931b5efd775422c06e7ae316539cb0822611deba4d514d1c5b4ba540d3b3248c594b6fa7e58bb61ac4a604d03364c61d8050df5335d87275322264ccee0ee681fcff9ebee52ace3300cbee6e537c154664f5dcafeb3a983372e7145e4f52b32cafe1f8b6106526845bbf3e4f49ab3bca3b9da81b0f3a47261867953cc6a49c886af12a45119943ff09bed72bf5c4b18c3e12c65b372a38e649646e343afa7425f7c9643c277fba7e54e5caa3bd06df12cc3b37e37426e83da50aac63b19bea8bbc76acdfbec48f7f571a754a3fcb01882dfb6f2f3195a7d657152a9e782407c1b1db3fd6b5462185a57a9df6712e7f82d0751ae1ab63637ebc607dc0acf7fc7bc5cf4be823b41a8bdeb90c2e84f0ceaf70047ef3625a980264849582fb7872d618b894ee0f1de0306b410785ff03bdd37f46250f6ce5c64fbb1e8ebdd9d0e5e91ed4d9335e7ebaaf0b6e2dabc5bea7d685b38182f157a665ee4edd8d528bd539325dc84bc77f78821bebbb4546767417066c7e8c919a9bbd79c00d75fcc5bf9947e6356423aeb8ebcb331015ee212b7ac4cc604ca0aac1741c573e5eb874db742db4ce6adc5a7fe821217294de6d0bad8be67bccc2855713b0b10bcc0aa1101b1aa474e785a552cd98c03cc8345544b47d054a1c7feb7800d4410f65a6870e5e1f5434e30dc9734d75d145433983b49c9f6fa86e4106c0b0c0a8e7875198669e937236be2e60b9d19038a351aa333d30586595887046120a72117d8d9ece66b3a67761c24a35449132a7c5284997288fbf2d286986ef1b92c62c065359597998048881bb7744e07c915948f235aa3532d4df60a3a418b001c739da4521dd664ae1e4a0f8e7141814d0c165311a031dfb4b1118059d148bd3ddb13c9ef87af2cd627604641857b560537e9040eac2d34ffa17496b3ca623fb1e3ff00e24d4b3286a537b45776eddc23ffac581dacdbb307a0a64a995749de2df358fb1f78199ab9f84ac9c31e909a2c2ef005567466b5bb8c2bf8421ccdb7b252e0d036cc0ddbfa5a75a5ba5b3da71cfbb6d052a58034c60e5af7c1d46afccb1d405804dbdb9bc65f3abdfddfb7525969b5c948e30bb32c9db65aad516ae5edc3c9c54fd84bee9b6f545445d0fb57914f76bad48905694bf05a69357f20babb66d363d5c5168ea5afef3edbfb874c10d64227771d8dc4a1d2f7a2d1edab39cdd1f29e5ea32260af220b79457cea49ecad3585f45e07cd64f50d813538f267c99764450b99ce926a3dfff17238d54f714d5472ba2a64e621387756149ee97708ee22c7a11c0abe224d34a97e9f7553f693bdbb5bcccab48ebfbe67c9d1dc4cc111d78181daff6fd9e32563c191e06a9de8a8ad6286ba8a0081e114e26dd967372d064fd1b26efb331ee26e332eab8a6ae4533eb34983ba28c15e3faf66737f6d8fe1a157a05dc30f13f408bd68d3ed0ee2478e3fd495b45a2d1b06e55250f35e6a2575745ae4bc5d74ec2eb5037d4372f18f4c0aa42393bfef111b52fc50099ba245d123446ee65e8e3f8a45cdb3f717d0bb07fc110edf85a035d34e470793569e4fb741fe8676fcc43dd989dd8ac53d57070c42927628e7097a937da79c916a03850e72daca4234da1231248981069245e9e9de7d22ca843dc4986064f202b132b2890851c4e52ea9532ecb62a5b38d9c7e46214570380c19576feb099f92c6943810d9323179d2d9ce4dd80b522a58d765e922b2bab420ea647e340a4e1d46b0b2973412b390b161c723995ec3df9f203114fbfee76d9da7b59639956d5c6d69e4358bfe7b0a606075", @typed={0x8, 0x42, @fd=r0}, @typed={0x8, 0x52, @u32=0x8}, @generic="07596f4faca4f7df2575ed7d214e707ce9da0fa048896d2e4b83ba2f9553c1c619187f1eed3594cc7790a46d0551729777a47835f4b986015fb0c97f145828c0e2d8acd43ebf5d33b3069a60fd0b68989a4cb1b313b21feb2af3c37788061d56e48e8012983b", @typed={0x8, 0x15, @ipv4}, @generic="47b145433c6c65a9beaef40cc77a747ba093e7b002d8f45a2aa7951665b7254b251b779c73857f3bddea44a5205a18929debd5528b3ffb1a2c6ee1ff956edf5b0485cb73", @generic="1c7082f14525f11fdcd7b70a59c06a9b236dc298f9d4c929b8dcc282d6cbcec1e7d33006bd09bbd1513335aee863f02b25400256b30ac91fc73f8793e905a8569b69d94da22d4889191f1f3f71e4e9891341edc1e370d18eb8da4cffdd25ab289d412f58d542bf2bf8a15cf60d2414e992750f9cd3a8df4c744433ea0f12fde6f3ca37d4678849e9c1436a329dd8615ce66895788c06025ac6438604f9f8cb2381dcf27f090f28ffe0d4efa7363568185328fb08214001a956b0bbb482"]}, @typed={0xa8, 0xe, @binary="72198915653c5a0c286ca5cfbdd49168af47c9e89a7b07a128ab9b282d0c122af5ffd502a63cd9cb8c8c7d6f616c8d29d4ac0f448767bd8fc4098c063823347081117f8d07d10562aba7fbeea4bbca62b6b83c3ba90c0bf31d252bbf877d287d1c57833e683663674c080918a13ec92212413d3dd540aff7283bfe7234cf85e3986ca04adabd42dc0d40be1b9402c217ad084e296e5db8959b214753a05294d198b15238"}, @nested={0xd8, 0x0, [@generic="3136ca537a8ef81f1d748ba7330855022be177818e2ce5e541fd8b38cc3ea777204ab1327e3e3fc2edc104c739aafa39ecb974821b463c9f6bb701205198952e2c57a9d7cc882ade6c407b260e759676ce40602287eb43bd2986173c545b2a73793adfe451b335e84e7e7c921250c5e3fbcf82fb78130ac046e7dae01fc549e029c8c51ec5e0e9e3700cef7304c88793108843b6479f4e1ea1054a4e56c3b4c9c2c5d1433d6a0b6a56effa6c353ede564b23ebace5ff4e47ccc1d5ed354ec94273fb", @typed={0x8, 0x91, @u32=0x1}, @typed={0x8, 0x44, @u32=0x7}]}]}, 0x14e0}, {&(0x7f0000002540)={0x1444, 0x41, 0x106, 0x70bd28, 0x25dfdbff, "", [@generic="0edbad3d2db06d9ffd2081443ca8f8df1f2e43a5b438227327957152d09489becb7c2ae4c74ebf8f9fb9815557c69760bc951b085281afafa47499c763d486eb96992d43e47dcfc38d44df7d91368b2265ceebb61a9fee091323065aeadaa9b94f721f6edf0ef5feed9f853d1c6edeabd8b745ad999e7dc70a82956d170969ffc87ac79b94e7b2c6f0ea091fa61dcfd1fffa87dd3311de792d3075ae1f374fc40add876d5230bca864ecf2c8dd3ede27022c5066d7b13a13c38bd4e586a73ee59ff34d0dabe970f9cde8172a4d9f441937b5a747", @generic="53ba4beb6c8ec4f5b47a4df145b49e5be203a63abf76be2af83cc2582aa7f36c686b2b1daa9a30bf69658e22e578e4c76b5e74f338150db3dc0a7243fa4637c80fddc743938679e5ce20ce266ce1b2ab5643ad790abe70df647c0d593825866a539262d02e5ea5f005bd742ab7299ad4500139463279b50d96cb12df0a807dbde689002f5440c26d5575df5de4d6381379b0462b5b5c15bc", @generic="9e0453210b8137bade2cb53db98fde56f68570875f828f442d8fa703c2dd81e4c1033b009eb3e742839e4ed27579a9cc83b1bc9f5159a03ba50c24ed78b0e792c9ca2b7bb6d3e5b9481d3c5679bd0c53df864e262fb6a5d6dc9ac88177c1e1180658cdf2d14bdaedad600b77670937fc95902adf2d88c6be1473009e4c386ac2ec406356a4a6305969ef883983fb3c7a2d6495fee366d4a16afb01e554ab154b8d712d45a69d5894c2bc7a88088fb8c555e623388587d176a9f844b28c7530a07938c18b921d208112b7a6b0dc9c5afb0e51b6e835cb0d8644c4b21efe73", @typed={0xc, 0x3b, @u64=0x401}, @nested={0x11b8, 0x6d, [@generic="fc38a18d84b985111df8ac3b0f2299fbf0e6d4879d65c2665212b1ab3ab80f35f34c9d7524fa5f48061f3603f7280c91632def5877ae27a5800bc32cf8c7c014d5d9f5da4795829e51aaa9657ca69690e6cea6c8220600a9d8217aa4736bf6658c1a01517551017924cced", @generic="44f3a33281403ba8b39b3f80b9c235e30d547eda486704bedac8a109595ab93c6c33ab50635716f1303e701ffe09932321462e676185288de00415", @typed={0x14, 0x10, @ipv6}, @typed={0xc4, 0x4, @binary="105bbfa140445f0dc407bc8c3fd2bde338bd396707c221e62dd71d6e96c35b408975d1a9195fb326b6452350a1f72a31dff572876301576a40c88878d996b8550bde5bca958eb472964483fcfb834b9ecbe4e207c25baa2667c4c84fefe8882c586ccf4a5095f69de7ecbc66430e0be66edbe3525be94fb188e3db6f383d3e5a854770c3ba6a56b9a8233ef24d2c271b00d6422f6bbaa57958d7642459aca802f3a6a3efe1a6c10b53cae4a2b15e5197aca245a9e0a86bd77100834e7c7e"}, @typed={0x8, 0x37, @uid=r3}, @typed={0x8, 0x25, @pid=r4}, @generic="004ae9e0bc5bba27f3e3c2db405e9da7256dd907142f2a4486b77ecf444f711901ac0b", @generic="2b2ce9196133d0c987c3c8d93dd9f038a3354553fee630e3d60a72d1c9af6149837bc39fef2d4bc9c3f9cde6938c17bbb429892542612532c5491d9caf8ec998866f25d06d5975d094e7ea825be39b96cfca0acd712d44e27d71573763d5e2e7f256e56f71fa40d309486ba54ca44854d0228874c953d0998cd95687e0b13371955efd3555330e0173d18c3532ba63739540fafa577192183977d0b32440b6965183a0337c45a4f2da7a2b8d4669275e667b90dd696e868bf940baceda07b4dd91378746a48af82e1ae6be86b14ca22cfb5f0a2c67c5cc57351bce9b87b627c1401158df9f2def2f5fc8ec2351e989957c35cb664fb941cc789ef89abfda8038fb187fbff2c3c3e881f35a3d55bf40faa7e4ee1ffd6e874fa4d02acd9817a29241fc8ffe8f6a1adc34396189c3faeed269828456c211747930257ef57474912c8ac6d17ccfca51c873913dbcff08c82336c5e3aa402c69d18f36272ee268a7a2535b09dd8b5465021ce47819594902b90460eca9cbb184b5a4b261cb58725a8e7720c37f9efa32c50b133d58df4bf2fcf90d3893edaa3fec5c3d671be9a550a8f6923c7d45f63c77fa403a2c5d4ba77a5ea07388bca89e11c125cbc184e451141accbe9fe850dc626e4b9ba41e8b8f97b9016fc584ff10409edea028dd6af4c56bedac365383c6a29a64868841000efe26646b0488a22095d24faa92e55c3d537a1fe62ab7e765e312227ea105964b81bc4a94fd27bdafba4e91f57e3a00afdbd8db84f4d87fcaad43f8c25e5608ad0a85a4f6265dd7fb3cff35844b698055a9f95c664732036f1121559257fd88a3bb71117d4f4c1319c3e2753d4861bb2ff35020de44de11f6f194580f6508d2a04bd898ae07c4bb383c0c8fb642c9ba928535c8ffdcd6177b48ae7199f557702d0fb8014606e0c42df80f29afede7a8e3786b1fdea5ed637ad3d347c0c2fe843c20720160adab8ad8bae852779d01403299d14410e483fc7ba7592dca1765cd382136a34088f2b9e9683cc5d37b5651fd24f5b636c4f8920084112b13d3e341de8a0665e804a8e69c001a6a18abc8f7966082c698e74a2d94fb0ffedcf0fb0dbaa3cf0bfc50983e725e24cdf058a8ba74ddb84490398820ebc9a10c18a7cbdd2daa3be308ecb9a4d7ffc9119449147dcaee1cde8495534c075a04ec59d535f216d2dec5c2b50074d0e8b01aef52327dc19fd3f1d1701310fc9bb63cb29308a1b6d6d73f40dcb365619ac1bf25a77daa64e24867963e72de986c756d187a3cb78dfb08ba1fc2ed4a91ab6d2d660d6ae89cb8d5897e15d0328da1894ce5aff5afcc1a3d4eca1fd257340a09fb76a22aa5278f7b7cdeeb02108cf59e616bd1e603fa37fabeeddb9607b21f59bbf82389c05caf42fa22df83257ff57b7a1eb3c7484ef7312d4a246f387f5dc27846fd7834e9d51d42e32dfae45d9740559676f76f72f500f64e558fe83e5520dabf60d54d21d5708eaae5a074a0e1aabf710fe437512ede2709143899608aa74134f512bfa29898e7195b6f804772645099d54a237bf05388e20d3874e1daa9ae7e3e31724690f2c4ef799c6558e20a2fbbf5e97dff7ee968eef82ec2ca4a2dacbbed93b77d8fb25c33185c7d13a492831e7bb02bb5ea873e8ef3166d1b97a2f9b981fb926087586e0152c55c5bb200008464960ea40eca53d9ca29eaf57016c795466b25a21d3a1c93a830c848c96219617e75cbf1ff272a84a2a73b4c988455a3348c79892f00fa9ac3f3124f6191f3b14f93b7cf14b1880103a4b11d8e1e2b67055baac1b91610d33787ea0c53a5823b4581b5545cd67df08eb8d39e46e9b8f298b62909433910dbd2510b8f9882eaf1252e0e6e5878b1169d9e8adddda77d3bc760e15c47e414ec02a7391d72b5bb151836f04aa9fd80ecc1420b8062dd7dfc62cce183feb7eb6f2c3acc6ff0d8869f7a4beb16159cee1587b70ec47caffa8764af5d5bb7c379a17718198c6c56465386cac162b872ba48edbd337ddcb526cd33f97a19d2c80bd4e13f1dc81f84fbcfee7411653e4c1a2301c696440ccdf052b6e158ad78ff9bc4edda2586acadc95a9de721fb7a5c7af8460d9262098988c1de29daae3967bd68f6813fa7c2069cd0e0ec197591e91fbc880e84bdbc8ef8011b383070a59e2f9ed2353252a7da03db5db428c4ff08e02fa68ebcf4164f1b2566eba944cfd8b569f29f44c93da85489d99bb161040226ec72d9042ae9537a0e7be58abdb0539b909ac21d805857c5300210afd88e752f395b3b2696e0ebfcb88e4c20c567ebe1aee6a6a0a2c1b773f3f3d23ed684f40641ff1578228fcb97e774c86dc186a347d3b6fc58ef6e3c210a6c9c018b39dfcd8ed91178a334ae8b3b66466d59fba08c16b86d04a6e22d4ffb1857756b6c5aab180c5521f772ce02390060baa157033b93bf671e784f3b89e63b34e1d696e0ee93f2afa56fb45969b7ee5565b0aed6909355c42136f58da8047209dfc53578f5b17e649cd749bcbf1ecb724ca0cdffeb7282e56a36bebc135c9829dd3f3af878f9c8bd2ba2696e704a46825745ff1b9b885f6ed785572fb0999b31dca96bfa5c58102decdd4d934b89155325e062fe9ceadf842965bbdc04caa133b59f6f39559e354be0ab9e84bfca8cadd168ee9e4967c145477a3c6326423a43a07c9ce4db6f66ba45e68b7aaa0baa1ddc821095d0d8930aa410a57abdbd158336c53938bae47240d93597ec77e96a4ef849704ecbcf35132fea59efc3a372569116577c8c4d59c3ee67835f29b2c8f9db732258cad752d9c512cff96d7d85ec77d03e4518c24bce2c9a284ac3ed969990989a108266ac0b3c11c6faadef81afb71d22691f7e508942fdec1b5bdbfded23b18d404cd7f19c2cbc5b458bae92dcd78bece722ed38182a7604af0fca3ef0d7553ed5bd65d3ed44d85033c80d32677ed1a27a14e196f2d1e00fdff18fc375e01610296253da50d5afe3ea632c762fc9b6ca82bb24f86441e6f3b3de2003d2a35a3d9ed728d3679e8786a25f1d7eb572d070cfcdeff67d395dc957898c2de3877055514ece0eab83828ee00483a75b7fe084378142b197358d641f8839a2a040e719d4c955a78fc1318d5c1c7af9192786bea087260b5caa0fd656a751ef931bf802382a73f4f966af1ef6531c8407d05f682999caeccbfb54dd67e0e245f2adfd748519cfbfa3be9ad64a542f899724c977679e5c7725af70c051361336ef08b2bdae7fd7ec552f242b3c17733272588f0b3859592c12939f8a5e7e8c0e4c7e2f8f287be254569179b18d954aff1fc76e362d69af15795df831b9eab76297172da8330d69a6b728c66eb7e46398a23b158e06dae1b776271f6ba3082e9ec3cf96b6b5f43e09639b00a30610764ae011de53b6979fe5ff0a07f6f6eda59fd5fb71ec0c572d5dcd03908d7af124be0a8cf36ab2a95efcfb88d115da6a19d7cc3be1df212261c6dbfcf16a69ea296c583faf216e73fea0883b5fb64d26a927cb8216250707496b52d6e672fc98e1958f10b7dddda7912d39e0f229c902fd3a6189e0f438012cd591dca0cf9b25f6657cb8e6352e6a8c1098d955864e33bf7d81e095174337d46fa610096083f4a869c8055f2f4afcd99bdabcb28454eedf6c0de67be8d610ac32f2246398f7dc0378861cbc74a8eac6b081f1bac3747a2be38fb7617eb89415bb518b23f2dea96c661ab53a96c8b15df2e8b515e1c992e250bb53c855dbddcc7ee4338364f7519a0a764fbc7ed9a22c5633d99fafb2d14e66213650b3101c6b8d2ad75a3bbf041f0d1ea79eeb00eded1f2eae12707e09b49a9e219d1ccd0583afd2aa6bbb7906e149a08306639a461ac508c2f0a54889eefc10b27d4ef99746663f10c202156aa55f999bf3e5f2f6fec6a4b0a03dfb88c6c51d0065092bacb63db1bc6fd32e4caa58b9410e18767bb3c40a1f41c057d4c796a664d1bbfe84111bd1ca66b1a3c92cd9a4089f359f69423019b6e65f07d5e43c85c0079859bdf0d2028adba9d77173e63d6d4fa482a0fd772d4702cb78da21f5258390418e77a96a6e1bc80417a304c308582fc81d150b3a6bc24b7528f1df5b6fcd73e8169f9db2210ce051f93dc555a94b5f01ae340ade1184bde1e38360e789a5dee4fabbf783e8ad8a2c44fdd06d2d8f6c7e1dc032e4eb220913257667b7244b4fd1f96a93a548f51cca54e2a256d5b3afa3f7afbdfad6f2160fc3a7a5a4193739bb57d8507d600865f7b5bed4ce0dee0634e5997c46714706b9efbb097b5a0b87ff3c2054cbca353d1a2e2047d151106a18b28aa9b2c582d1493d472377949a212f3ad8418ec1fc89aaaa81401fd55685402efd2499573180b3d74df0f75bba2ea63de8d49407ff29e2f8e96b744c3d9ee540ebeb2ab2f4b4a4acd5abd4701d6188a6af758f54cd169df06e3f9eae0cb9bfac1a874243c4a21738d62186a49e7072fff284b24a7422ce6ad15ba861cefcbde5ef3b786fd491343fd8aad23b253436125b66fc03751cb5bee6fce604451a87cfc06c7874a370fea76fe15f258f0e2512327c846f0e14e7bd92dc816c5fe11783575d7c5a5dd6e65d36335daa9e098a80c32da12e5a560d605eb21cf3d5b5135e842f845700b718c80325f5055ea217505126a61ecb82c5be0fc82822f8f788ed2a3f837adda5bc23e3bae5f2ee2c381d36397b5c313d4b501e91c4fa9bfebc75549d4951b1a1d234997d50d252a47ed7756464aa1a33951e7dac8a934fa0209d3baf7945a73d256bbfaf8874b146ca92f6289de621c8e2f1562e64167e35d803597380ae958d6d71b805e6027fc8b843bd36590ca97546e065afc68f43d310dc41239e6930d32aa44e0de0686866567bd6c13e024a7d68a6b2bfe73f8bcab6d60fd2944305419590e0dc216a9587a9fe792adb943ca887a2ac33eab855572c3b1d6de746ba833dd99dee4b4fdf47f8b720097e883aaed023228bdca90a9fb8bf8aa23f26eb3c3a91c1463bc2d2bab0cf56071831e12dfb169870538572dcbfd7823511c927dfa83b25c6ed7372caf0f281cf887896a7fa9fc53a9098a29224e7db31106e724001f2f6c3aafb34575594c5d2fe51b6a8569008678a3ed8868a1754bbd5abb0d3235027f807951b4edd41f20779af83c26c45b2900198dfc9f9543ba9ed1fb86b062a15cdc2ff37ae6fb045e8347c374038eeb2d8da3c87c0f6b668578e8a8c5d4d94d05c0b81bdea11f8b0d62a9e9212cc140fc2591d074ea64266007433b7ef293d51863004a11370654c9e276159a33204cf7e8a2e245533c386bb6e9f3753e05ec432d78828c7571ebfd0b75b6989ed0e34454f1a4b9d2de7f3997952196eeda9cdf5c702dd40b1132686a5b442a1fa208da84a81dd5989703cce7bbca1e0d46bf7f896e29498eef25407a520de0e9c3a18a7334c55894d474ffd2ae54f7c0431d223e52ea22d12e7157d5f6ac580a160a513b67fb047b5d9c44929fe09cf715ab6fe6de8e1efd7db3efbd9a02d76913219501bff8ca33c0881758156553fe54f009783f0c517e7308eb7051f5d03bc25bbd9c85efdf324c44e8e39e61e0974d16c03ab2de106986c1acc01a8be217bca415bf05a21de884ca82a1cd2dbb77e8bc397370b64d1e09d6a03e695fb99e0806bb69daf3a7917c9d8cc4cbcefc715eb09b6810af6dc99f1fadfc717147e33450e8bc11a5c38a499415e39e82f932e3c1c14adb881a21803a9319bc3d08215a069b43553cc9416c1e6bacaaaf6d831dafdaf12e0098658"]}, @generic="63b8642983809fe2b0eb39c0d30c5f3b4d60a41be73928", @typed={0xc, 0x20, @u64=0x8}]}, 0x1444}, {&(0x7f0000000140)={0xac, 0x19, 0x300, 0x70bd2a, 0x25dfdbfd, "", [@typed={0x8, 0x12, @pid=r5}, @typed={0x8, 0x64, @ipv4}, @generic="ee17fd4fdeab8a9030", @typed={0x8, 0x5d, @str='\x00'}, @typed={0x4, 0x71}, @generic="9a7d39f64284b46b1eed28ef78b27be172a3c348f00ba9ff1f7a5321d99f9448fd301cc52f16d55d261c4758239e0101c3f54d2eb6d45eaa2a5cb20d4884fc28b6c7c3e4f208cbed93014988695375621304a2190c7e056d3155706cfcccfafba73dff7632b50628e47f031d6553b3f9bf662799b9"]}, 0xac}, {&(0x7f0000004000)={0x2240, 0x22, 0x400, 0x70bd28, 0x25dfdbfb, "", [@generic="d9b391df93dc1697b6ea922a1b7e787f42b0c1343507ca219fd381c86d1d85b1ab2f806d13232f09e6eda120a00bf162b3e2c3d153da5c991cec0071dd0261ec1977b3921b61b771a30f1d10ca5e2c52181716c4e6ba02ee3e940281b1cf6fbfd25394d1153fc109eaf901be9bc69fe585446a2d4d33c14be9bf00cf517ca6df23748b465ce80290a5280d148bf3de477dafe507a0f0d4772ede7a98fdc79fb5f42ebc8eb4d44c7780a1bd267fcf168cb4c7826f78eaebf3678e71fa22cb6f11d40f6359adce4a302775f12c546092732e5c8db9d97f8c3ed88378876bd436819686e7c64e83eab360ec93792b1dc449f4517d06d32fadca0ceb6313e6b7d993d413ce2e45be8521cb1a3f8b95d37491c612572a21f116fec74a18ce47302c3000e4c9c5dd66a38ef222e821312252d87e3f464153cdedd9ffbe1e7b1d4f1dd16b393ac66d6a3e14fe466f8110bfb34d26d94abff157af1715bff757392e553fe665598516b54066825d342a3e619c5f8d2c40315b69e20cb0ea0b64657c9c271fe65c760e2aafcd77efa50a9a5b0086a5c43be657adad03107bdac40e91b76b11fb45a2dfa9deec757ebd26228ef8c537de2e7ff053f9c5d7df97700ee5a4124107506c07c5cbdb82dc29ee34190df3c53f2d50819c47fcac09e894f09c519e1c2d7c070dfb592bd32080a9a330044d56f4ad040da7a688b461b089c75ad398a79f7bd9b9e07832c735a12bd7cbaae25ec2a6d077cd28d9972e2d442dafdff3963444ac9a8deee2f9c2f255cebd62e23729c948c8fbcbf641ece24f49cbdb2a3fbb3aa9a261ea1128279b20d3a62e5407a98419847722da2043ceb734862a8c00b7b9de9c08ee6502a8ea12d6b1ad98f0a89a8e8ce0d6e0390326a247c412488e0d9a53548a72c9f9510aab6f56de4f0ae3b8af516bc4cbb97760820dfc4719fe585657470e1e51122e8ca4233ae4cf8228bf2c5de1981c8078ff6ff5924dca19ccb043bfb15de4bed99d3336adca2957ac359da0c910b59b83ab7a6bdbf8306751868a39832ced24b91e7388cee4ce4d02351cf7e173870a4db87e7042e6f97c138262d85a1f262a72882f59dde68760290ef3c4a4d4dfc0382fc3f646dc7ff2c11b549fc2fe4f4f885b82a4c0220e5023ee1d2c26ccc76672495d2a043ef8691fef18cbb3af2ce2d5650d6c0d14cf7bbcc20dd94f2bf6fc8b3b82d8ad390268d5d7c9d70a99edf460ce648aa917f09e57e1dacfb207b5af1a77314303e2ae7db96d78f52f6fc902222558c49a9c9188d54fed204164718718cc28fb8d274a8944a9261a8f7fc21129f97041c1496df3491848aef62634100985c5d3787acb35dbadd6e19e481a7ab5a23ed092f1dbf759fd0bada2be0ecfca3d02afd2d5ea10b42244c84f9687a4408e46d56b619df4a337de38e6863d68fe7e2c053f3af5c993a514c6d6cde806c873db0d69081dd8aa9272b6d21ff706c2e29714fdf0288fb19516b88f8056bbe92764dc033aa2be1f129df0e6bfab59371c4b1ef65f3f3ccd2afb198551a0e7e71bed8e2f5295ec1623fdbf723b648e925f2d6740a6bc6ef6967bed5181f22b9db6124e839097c40ea64f97ffe4301c22a5fc136a9dad25e3047b68be950078a17045eea5e519d746023674c125b1b5e5716e24a0c4db4cc27ff14f0a528c992338a0cf29e22ef30d5d2e9d3c69a006e0e12ef66c4d4924ad27b4519d5c29ddfa1c5b7681116a73d06a39b7b87e821ea158ea02e3db80e892ac51961f6bb760d976ad598d22dfcdc86374af8c1b50ff04c29b421c855ff64bfa7fec5738996bf4a3a166e90fbd1e89bf02f65ff24e600637696d5a3421e988ee512413b7ded0a4f51845df2648d5c44e36dfc9441bda6763923fd534a1f444aa4b211dd3e46577aba51903c5ac4271ea22dd8c0d5ceda0658c307428cea86f78fb57df9966d616c2b80b4ec707e57dea5b20c131422b5b61ad582b028259e0624512954f34b877a44abd3679eed1130030a13585fb73c2ff9b4a2d9d4e38c65ecde923ed08861bf2dd7c397040980ecf58417a014f18d4a6114e082c4a04cbd73439362a5e01d5446bd70e5deca10588f66758520c44542c5f5e592f8e24e1485f69268181a444f91d849f7463553780cd93fa91f2d02d02713b80d8ab2476ee7e032f4f2d79f874045c8b8979a80e94a876138c48a3f1ba761ae1b44499cb60a0a03e796c04034408fb5e352c7ae7939bf3e22286a80ea6a4eb1ac937fcf80816857650e95b68ad39fea07328452c22e232a85a3ce2e3a3b0e453f98f40e786b0f8aa741324617c72f6389201793be22ecd77d69f29b8add7b5fc7757b87b94a2eba018ec2b53bf3db092cec1a16b7e532cd141a86bd5c2c2401c76b5bbfb0e1ab6f3d56de28eaf8dcb9cc28a645cc31e3f25877b9be5485a1d22f5df372f89bda9c36d2cedcfe6f594dea0f159aa1b6e341d664680a6d257d675bc82cfa680f0b5fc58cbaeb59a1b05447207d52618bd208ed7366615b31dbd497ac126d429cfd7e6872b1609ced19b1dafccb981a58cbb6dd0550d5a276b70aad5ae27cfc3e546d23d6943c04c31f82c4c2815030517581fc0980d5ded47ebd6de1ebe27382abb5f9a82601ebcff320dfa96ff606cb8a2a0c750ed1e04ef55840069743fac0f3a6a42c63186850a99f3101718ffe97c0feaf9d5195ccbe9cd2a5a7b89678d06428455a6431ed1f2b6dc444c1c06b2736b30bcf2538fe6fe13e434c2054cb69f70ffb5a620167adcc605c9b827a51deba6c34fc30d481be002f46a6bfadd571bfdd98c5e925d9d54a8e529db5c218aaa7fdb0599874e7c3f209660f9d2bcf02d0483511fbe24f18f8d4f638d95d0d622263af8cc8ead50e448a292abce34f401e00d965e5159f32f572d8912cff52d6a49d9359fffbd1a1cd9c867b39790b6dec3e5cbd12a51c6ff79cd9777b3afc62a3e98de81be6f20ab8a28ba700a5e626e3ddaa165dd077a71e6603a34553ef4cc244d516ab06290f7800bb91e0deede6fe7f1cd40496123607bdffea97808e82223c6b3e5b7ebfd9feb4e38a9e378a08abb8957fed85e64c7480356d5631d0381e9640bfdb5eac3bc0d7f134144251d37eabc19185a01c8e49f860d79ef282fe848cb3c988ac4c75e2fbf940a9fad5616961bd774258aba111894f5e4a6dc0b2592d378b517403453501f3ce157f1c4754a98c730ec478c2dd2ee570265500f1cfe452cbdf480e731ac03051f88a4ea8d15fba7da5b3e3b1b800b2df708925234276889314399b310524c0dc04159b3d72db705226fe6b2affa7ab9c05eb2feeafb292c4b78fca89d743550671d34a07b2797648c36588b25f0fd2f9097221b82fd1510077a902538bb602160097f0dccb2ac7868747e332c1530d772a0b27b99dcb747da9b70cc940b508d25793bee2ef4602ff6a6041df5cb38774dace890f9a97c22655bc6a54f9e272114fc9b47bfe083e76b1c71eaf6ca081613a1b0ddbfd8b10d06365ef01e69a0f082b99b3869528a926d1e0fce615240d6ad09882a660190f0f1d0f074883b73107e4b34e34ea9e77abbd4e833eb2f946c58e809642fa5068b1bc0d3459f1207b15d4e1bf0801cb4eb4cd36e5cad3776bc2dc4a690915065bfb522761e3d0feb7627d45fad4f0db3c71c8fe1ee5cf67b276ae2cc0333b232518d71eb26d2465b748c7d4ee0026e4d49ea6f698c36edd8c2e537f456c6b62063f23a873cd3c882a9fdc48b24fc90937361616ec07c664573f05636e957a5e74c78268f9a0df47de36f0257903e7fa888722c626f4661a3c841d440662cc7d3e1ed66c6b0a71d86a981ab0f57cdd34ae1ff6dd5388bb0d85b7753f0686c0c32ee97cdac696a01832724028020c4b1a5f257685abf6cfe6749688ba1bd5c2f05704a591cafbaaf8aeaba26aa13e5f0598fc94f34b7bc8b9248739b4fb5ccb3b4e530a697a5406b42d5b07d05404fecbf1ee61c89b8e5261f80a0867d04384c594c76109bcd8c6ccb805bda1abc27ac27d9e43fdd8836d105cf1d04e0853f238569de5cc4343e7c325d7e5ba6414ecb7a633ed4fd19f9c19d5dd9dc8c6bde489a0a3d6b569a393af2f74b8a22816cc15dfabe3075a3bddef67ab18f16bf4b641ac5b7fb157e12c97306b54a090e160fab0abb5fd83e9588ae3e422201428c68abf3016fd4ffe47cb10ae57575bb8ec42c5f1846f1eca0a54c1740a4c79254e3e3525c90930ef3ebd13865f661bd1a19849b631601d87f9bd8f5c8d67d19fd7cf9808ec834eecbbd8c8dc2a479d0b2bd5ffc164f76117bf227d897a3b6a3bc6112beea8ff48455e4ada7440fe30e96509a2002a2908d7049815677615ac51900fac555450da7218516a2393cbfe757c2dec66b85dffc1fcd43798ae40580beb89c18a9d4b366c4aae1831b52e82e2e279e413dc78faf63d2e88b4587c0d6e754569623111a9d2b0072fbacf5cd0d889334e7deabc803d1aff61fbbf21bb3d1d180121d344eb3b3a8551d4e113d66ccff2b365498e971758df0dde8814e3cc04960387ca786ab84f0fc3abb900204b0d9b196626afb0becbc3e9742d9cc3b71ae271e9a9f83c5b5234e4adbccc8c323e85645b3ca500f74385fc18f9bdfb8620265fdc1f2b00fcdfc7e47f81f67bc99a5046bacf0377b4f6e85cd62020aa698859f4c63dd001e2e029ba984a6fa84770743122cc0c780342e3f24fa3577501bc83f32edaf0bfb8ff370a658f7821f77bff3512daf057aa689cf7e2ddbfa1c165d322920873599acaab7fd9f34f7eb7017476668de8c70f256f2551f6b07b4e2e30dcee7d56dd01aa6a899094ac80fc2a7733cb2acc900c34b8113822af90559e1dfaaf87979546f9d3051fad6af425ff9aa6551fbbd8585b87872222f967d8a52680a9318cc27eea7ea6f388ec39c083aac9e0d7ac17f6c224ed61647fce14c4be3ef01b9053545dfb38a22655a38fccfa9e54f104240a3ab9d00d9f28b13283dad0d40c94962d8e73f140c99a9f6c70d0d215c9a3046977b3ac069f961f325459806da81f01cf701796a43d7be986ac4e5b79355c9a1c37b19dc4d4b394f675a599fa2bfceba6b0567a51b5bf291699f63a248ef878a9667e9387cd611809b703f8119629dd03732169222a6acacd9755949789699b08cd3834fa056d8b44c83d631f55d63e2549ffe376403799d057d030f707863dd199cfd20fb6410e110bd6cc981c054ea85daedbb50421151c838a74b2fd7759822b216bb3600576dfafc1254390562812f673b93c50a5ec5a42894a5d122c730fad63330f6f864abf15ed0d0af2817ed7fdf1efacbe45484748033c29ac9bcd6e53bff6f7c3d182c097de1c71a9ec3f5e9f9c9ec1217585812537401a62a3abef0c9c427955ad56a40284689c9e245b43694b5f5516bfe12ccd7dbfb70d68cddd83699bb440f12304691e27f57161a7fc412c5f4a8150f5c37bea00d69f3cf43f3cbc7f640fb145593ce9d2494f9fe558715afe157e393aa25a0dbec7251dded3fbc0079952d4d443278c2bd2678b4c8b2287c07f69ada4fbb8f9502f2bcdd981094c4f86ddb53946644aff1be7c73f2d1894255177d8387a0030e9a78863bfb7454591a964a5e28aefa61c7d264712143dab0b6ef2eebc88441627a33c67554d822bc5bfeccbf40a9b2f67b7b3ef3e2d7a3703c7bbf082752659b837d7828db3800f3a025c5e9ae65542b2b3b141e2c74158dfa452b7f7826b4e233c2d72349ad616ceb1ca894e2ab7b5e071a72522966db38fdb6", @generic="a5ecc653038a62b2d7856acc3d4e4d4a5db0c6dcb4750bd2bd8cc0bb219f470f00f077328f9956be2a62139fe63428379ae4cce1d6b256a82a33dfd48feaf2dc62a0f0fabfc43f96d0c1d619dbb9d7b8f0bea6b66e626dd5efb927435153c6b80817305612f0197843cb05c9532fea42aa142f38c2c177489e7739e054606cbc34c9e6f8e046070a5abac2bf2c29fd1ff7e08428fc1657722d8be77cc143f7389d0843da5e6c15fef5c629500cc8e2384b5a7358d897a8caf4d659205f786ac4bdacc167f3de1c0c7fd4c36ba08ba018e4be2e1c44d263aeb626bb43e236", @typed={0x1004, 0x69, @binary="c4fa9c997a7539091c39255853b0e9f431f67a6e380b3f202f2ae2a24c00990b2ff51a04e93c75bd757c1b77e292f57f36b092d2c1cb907361a6714cf00ebdfb3df83acc518de2b792d0538f3fb7f34f25b63f8d3b8a0fe5720b11704671ef5a752f65543204a82ab9dc0479762a85b72785dacba48fcbba178cfa40460b88746b5363840c4aeb97876c2c6fde8b09c0addf628c21014a21982c91046b14666d7adb69b5008bd2ee7af2df9b8e1f099c1aa3bfd423c0d3cdf779da04962f2e047ca90f8729b160c56a531334c72671ce1febe7189dc7e15d6614b52fb85eb9cec6fbb20dd0086d9e7fe367d0ed96c229dbe92413411bf359a7a37fcdd7030f41528d415fc5ac49d572c075d3f01a8f40c0f2e6641dbcd8b43de2af7a30756d45f3fdb6ba17ea02bb9b6e1dc479f070d687eefd42564ed7f93beea5f7b0e38595a5fb9a403815f7bcae75c49dc0069cb7406978b2f20670157a69f39d3da123df6bce4b2238b6e91600e55d3ad622aaec10ce2643f91fcbfc2d433fb750fb9551f476d224295455a86e8c98cdfdd2cb44950b9b7385fcc11e2721c3ea99419ea9a7e208992705ce2cf84b823a2e9ef33afd65ce4517a17bccad3f31756b50f52278d37a78c4e267893b5ae7aff34f577155d06fc79041e1b6d75a6d8c78932b3b224fd529c2b1f61a1f278cfece2f989a2326686f4299ef657fc6eb712aa858825604e7430b21a01b55bdfaf2fb62ea8b02968579fdcdf02333ded573c8b744df4d89d41eb07830308cd48b796e07ce8da46b687a77c4ac69af7a8a2a444eb4dc76128f1626147cf43e0d5253add69fc878db124b2745b552bf6022057c4ad760b2dd02f2282c108c4f9fc2474d279654d6e63c842d78d71841e288aa3a702ed9e22bd20f806fdc417849bb2149457bcb02864893f0bac8b64ee0d888dbbacd093cd0d7ec0167b453ee7ab103a18d90c460e66f432436eb413709bbc9ab1ef9686a62ba004ac0cb35a9b2b8a8a0f0071da7529f1e078f9d7e16359a2dbb7cc4c2c4b9547c127cd8692304ca4b178154d91a84dcf62b0dd38f46b12bf812349d12758cdc68fa148869575e6179913444732515d80b04deef989430c1912129676634121eae2b5d935a7747129d9a398564ca34a171e691d59645410343d828d5958957783883e4622c4d164a78c007778fc59b26d032196d2397bddb2957bc17f256ba3ad7f8701a27123533131f0b8b9853984120ae00e04d6ffe19f3bcba6d89528ca0546f2f3373865ea7029bab46b5c7e06e285e5869172f1d406b04cfdb20c69cc680a9e776772c137d988f77720e72b482caf3717d2ebde217eea4c56dfc92ab09a8fa0d4deb27954492ec550b0a3691a5b41f15bcf979e86909a33542fb937a77c9735d380c0aae0398ff87c05acd5f2dda79d39aff8be6ee638db62bfbbc231e03fbfa39ccdac9eb5a97056f9a7844d2f30a75e035a889d4cdc98756bd46a08d9ced6b682af27be0b5e1789bbc36a4daafef0d146bb5e4d38a31c675a7b3a05e6423ddacf4bdd23fd17371c2f9bcf1c6bbd2724ae1f2388875201989ce94acdf31f2d335c3e192b0d68c41471a88db3437a5e8944e05e7a9fbca64ebd82127b7f298df306c21fa7888fa8b4811f5bb0618181b99e2ed1188eb504f87bdc857f7943dda4ca7258171ed42a49753fcd9e8eec65e3936d74e18fae366d825ec74a7abf603fecccd802965163a1a43e2cf2f3620d1268ecdaf407e031a2eee3608a12523fc563542340ab34e1e014481dc0e68833b1487ece337de53cd90fd2aa54c2e412d27897a3ce990f11e7a8ce12b664339e73b71d696939779906ed9fc32441cb3d5aa89e7613175bed1a4fe0fe6be952c8be97f608da99b31a53b60768b20ec2bc876376f7f30eb0c85a0902c8f968972f76cf3a6e9ca510610843886985ac0cf5adba24054b219a9648caee46db8e310e16bc9f4a223d200f3a87c2da68a5f9538430b961885433550c8b60dc3999d836d7576ae253e51b1d021d1696ef38afd7a48e6f9388949f2c8df4c59ee2829aeabfee46500abc8aa5a96ee0e37b0e05fe1864c6b0a6138066ffe2bbe2d9456abd6506ecbe673e52083c36dcf83239e665444aded74b2db2a4ad0f6cfa430ff7d8d14865383a00f82293fc8e0485db74ffab2409a697bc755c6dc02b2ad6f3f9fbe5be56b912b8d565e1a0c37ead4605187d362071a2980ec849aa46aa2e6643270ce2471516ad4ab01cc387886af32f26497f32e6326a923f20009c0a3659abfc6c7021d5ee3bda137805cb34b939284acc446bc9144615675abfc7c588c6436af90842b14227ca00022d34f7209a64e790c5d45d558044b9bb0df2107557a6caaa3f8f06aa3b60aabf87b566b27bd7a2f623348edf7b1c273caddc32f29c6fc475c3a1f81ada9627c9673f938201afce46edf7715d7370af2751eca426f56c9f3308c3315062b9cf1482052751f2d35dc437269436f6e706995b828d69b3bbaff3632be7560022bb107994dc6396dd9ca343a07c470e2b31a7d3ba1c83623168930898eb3645f2d2eebc877595965439e8a286595f741c770a1fddc6721f5327715a01247992c9b1b72d0ad0bc8096188a511587b04b8f3ac454e1486ef336e06eb83d665417976b3ef2bae0cd2a6c7e750413f07efd4db1bc462881a8fcd7ac01d9add5028bdf1c54ea82ec175403ae13877e55d89e04d45fe31ba0e07363138f86cebee718aaa86fb266b41f38142e3e112772155af3baa3b240bedf599b5e622081c123ffdc246ac50761eeff821d8e99c8fd29b570eef2b7ae0b21c30fc67ad63829ae7d72ab26ea2c454a1048e0cffc6a5b8583b7c64a855e3ec12a39aaa52f197a795203f913afe261c6098b602e62f6a48be53ca0afe618876efe818d8af9a3bb28d1b3c49088c7252a996049dd59c94f0eb6ace2c59a9f60caf043c930c560fd97b18c58bdd7180ff06884977250215c422c3766b124274dd0a4697750ef994f88a87e232742696713e3e2d204786ed522d974053b6a1d91e4c716523cdbcd36a944533f628fc4d5c7be0544d2224b406d115418c69b84a1425a8b10905aac94f3234e11a7e77b86940fa9bc82b26cf1197947cab90bbcad0dcb3470ae5ff715adef6e7bb07ef709e7f7945792ddf9a607396726e4328a9038326a8b15d15b0b14e3c5730c27aecea586aa908c5f338da9f3373db9190a919cf0daf3205ef30486f63e774e0fec00aaa8dd3fddd9adf8e595794096ffe2d4fe25de0123d06b118f221cf617ef799a890ebcc87b726b012ea970db167d2cee1a8728a342909b19b1c885c174cac1e1639e5e17f0675997f48ec815a4405471c3ac18880a9e37876c64e747e056008ad4be411ccb016bd05db3ea1606d16efcd9555c85daad53951b25ac52b1b2efb32839010ef4b3351caac5cb6d4f304636f52ad5869ee356c4d326c31b45d16c3121e8630561a5e26cd0825e1276893fda79cae01874b028c108a0e476cd73fc89c77a39b974b2406602eba12ab1e8f0aff6cf93963130a30c31d655bc11671e91f43bd08e02942723a929c8155627d88f42189a3a175b0e2a9644aba6f02fcd19d9b12f090457c1086f7aa0e2399ececb5a45f74f505faad1e8c1c9e4059e61d1d480436caafcdd84c6f0010fadb5ea9b5d88d5379eb39c198ea154a7c542c276fe6377f89fbcec20ad798ed046c309831b9d48f34719d1d2f9f877ebc586a21a8b5f1c46faf142c36c9915872df8dd6f79564bcc066ebc94a201787aaece06998639af29efa3fc625bb81871ed5113aab37bf231d455b0ccce271e7944674046af79b257d6c03f98f11a9d843f6d1f4ce59b5fc3f50ae56b155ea58564efe053be6cacf480d3855b9a8cb61fe0db05d150edcc668541f8f9ba662b13ba76cec85e0c0475c88c81101d95ff2c47960860fc7f4c60d8bf291a56f74b600cd1ae7c8eebc52cec844c27a3ee0f64a2acccdae50e21dd690b6d7ef7cdf661612098b6b2fead9a1d5a05b21b4fe8ae26803e9a044f0b593df607f2789c631d374c84902208196196d241360cb5df0db0cfe46f77d956984792c17316ebe0ccd022c3b42be8dd16dce502c77873391edba86ba040595040175612c1e5899f3d66a793567e361ec73e616fdb3e22dc9ef7cbac2110bedcf1ca8acdae2ae1798d4caf4277490183f2993dfda55b863cc2c998d903f2c7f1bcf61e47ac0dd8528dda3ff7f40b26a81ac550db331eff64bc66c3dcc9a90ae27791e478908146ef67d2c09e2e1a51ecc129ba5ea3cf75c36a5400bdb3e33382a3591f416446e0a144fdb3d73a496f84be06bb2c099cb509b1e93cac28377f0439dd155554d88854ccd8af3684551eb7a69fa961705aa8f8b85a51d09f765684eedac066478870fbfa05352222d5d4cd1dfd5529a11c30a1c9450fdbd6a8bc3230bca4fcd78ab85ccf2d8de9be10a6d26ae018ab20fdc7ce1a6b9eee2dfa23283d7687c6fb8932674ebd4d7a403083b5fb3ce4eae9b1f6893cf35142e0df437dbd7ada7aee7c82caa1e1ba42aa9498b77caeb6ab6b17a9b1b04046325e149204db1c7b00f7add371f2597bb354530f0eecbe38d1b445235f8086a79f615a56e2ae8971e58d34977a037a6d5d63034834d22b8e46d45899b8ccb8e66b41aa0c93b126ea872ccaedff07d194476d2da58b597398b8327ee464d0b21d00bcc5a93379b8fc263158423a6e91c9806a84d463951d6270efd18ea835a7ee70877221854ce888a31bd685ccb32f192a2e9b7adc5d6b5be073dd879d43901da62e92124595cd267f70a85790ae9af37c6ac26dd92eb508cca0c58a1cff7bfa68cebc42743b665d87a2fee4392f4b0455a11ca7bd45878c39d23b71e08dceebd78e8f3bece3f134d753761513c08977e164f8f8b5149fcc0087a44b908b61c619ba73fb310f0f7029c257087691e313fa6e46e1a8e1c01f32796ae6e24daab51c03adb34f1642c0fac74dd450c6281a0e1da7791e211ff95d23a0113661df269e7e21d039ff5ce93c61b5d217057bfb6db4433e0f3cff249fe2b307a0b8a0aaa83a252f628167cb34c61ad1623f10aa110bd37dc3f8da942f4530ccfe91327e932975775c05798602f236b0e67af6360c8ae96ef2bef7472c629199f010b3eccd1d621e1e256cbcb027547edc8af77747ff8e16d05c50e9201c25a20979eb471bb3d9c6a7b6441a5d95291a56f59ea27ecded63f903e4d7cde24bf7ac83811b93cc07a1868815edc3c243376be5c2f11ead634c59da391ae5f38417ee58d0654e9a212b3971b99ca38b4ff11abe095b743a5156562117ba91179a1512e230d131e4817f2f2f69871abbbbc2259f9b25055c8763be8c0b2daabcbdd71144177b0aed61153698fb9ae7d9a66ab3181c11d12316d95ce8a60844541b7782674bbe59824658091ba7f01c3db62509fa24640f0b49240c10ba497f79f96a51e8e6b01b6b62c62c5d7ab01163dcaad0790e8fd19671aa597793b06a6b9bff8daf616187b6977d2019998e73f7408091c1a4fb59fac2fd7781be24ff2f0bc95f8ea7f8241d98b1909948772a885e6010ab436ba1a0983d5bb528c50a3f13d1500ed41f39f0ef62a0e18c97f3946808aadb9cbb4a3f36d3fef1e406619149d07b0bf3692fb0cfa8e226f0b89b8e4b24c6794c4cc001080a59fe7a863d69156cf086a8721a207cd591cc7e9f5d800bc3446de686825e9c4ec4a6ab9359562dac4ff48b62a384987447afc0e27110c1d197aacc08d"}, @nested={0x18, 0x80, [@typed={0x8, 0x5c, @fd=r2}, @typed={0x8, 0x44, @ipv4=@multicast2=0xe0000002}, @typed={0x4, 0x12}]}, @typed={0x8, 0x83, @uid=r6}, @typed={0x8, 0x33, @uid=r7}, @typed={0x14, 0x8d, @ipv6=@mcast1={0xff, 0x1, [], 0x1}}, @nested={0x110, 0x45, [@generic="57f1a257eef4cf2fb0a007e086038b904078b6cba6b2d77bc5b555d014319e6852727f442c54b3bb730e00a5c5634e0aa135fd211a828b8fa853e58295eb859d8ac4d55096baea42dc610266b72734b58bdd79005331020c4c13054aea1b0680099d7afb0ae08c82b66737c529f39273ff79465d986a43c71a977a846d5797a4299f012d6ea947f65ac8d998202f59a1006d0e24e80caa6e60538a02a68001aa2f12f0f97e3530897628d3ff4ff7052703dbb7468e016f9e764b07f744a56bd2a9e1f931e9350459635494a380dd9c49cff107", @typed={0x14, 0x20, @ipv6=@remote={0xfe, 0x80, [], 0xbb}}, @typed={0xc, 0xd, @str='selinux\x00'}, @generic="0d014dcc3944faea5244d97b01a40b7f4516c12fdb2520f6"]}]}, 0x2240}], 0x4, 0x0, 0x0, 0x8000}, 0x1) sendmsg$key(r2, &(0x7f0000001000)={0x0, 0x0, &(0x7f0000003ff0)={&(0x7f0000012f80)=ANY=[@ANYBLOB="020d0000100000000000000000040000080012000000030800000000000000001c000000000000000000000011000000e000000100000000000000000000000008000000000000000000000000000000030006000000000002000000ac14ffbb00001a5d000000000300050000000000020000008f14ffbb0000000000000000"], 0x80}, 0x1}, 0x0) 2018/05/12 22:58:01 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='dctcp\x00', 0x6) sendto$inet6(r0, &(0x7f00004e8000), 0xf401, 0x20000001, &(0x7f000007f000)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf5ffffff00000000]}}, 0x1c) 2018/05/12 22:58:01 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x1c, 0x0, &(0x7f0000000040)=[@request_death={0x400c630e}, @free_buffer={0x40086303}], 0x7a00000000000000, 0x0, &(0x7f0000000080)}) 2018/05/12 22:58:01 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0x0, 0x2f000000, 0x252]}) 2018/05/12 22:58:01 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x300000000000000], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) [ 761.149492] binder: 22092:22094 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 761.184016] binder: 22092:22094 BC_FREE_BUFFER u0000000000000000 no match 2018/05/12 22:58:01 executing program 5: mkdir(&(0x7f0000000040)='./control/file0\x00', 0x0) mmap(&(0x7f0000010000/0x3000)=nil, 0x3000, 0x4, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000480)={0xaa}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000200)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r1 = creat(&(0x7f0000000000)='./control/file0\x00', 0x0) write$sndseq(r1, &(0x7f0000011fd2)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @time=@time={0x77359400}}], 0x4) unlink(&(0x7f00000000c0)='./control/file0\x00') ioctl$KVM_S390_UCAS_MAP(r1, 0x4018ae50, &(0x7f0000000080)={0x5, 0x5, 0x8a15}) getuid() rmdir(&(0x7f000015dff6)='./control\x00') mount(&(0x7f00000003c0)='./control\x00', &(0x7f0000000400)='./control\x00', &(0x7f0000000440)='tmpfs\x00', 0x0, 0x0) creat(&(0x7f0000000180)='./control/file0\x00', 0x0) close(r0) 2018/05/12 22:58:01 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140)}, 0x0) 2018/05/12 22:58:01 executing program 3: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x200000000000000, 0x0, 0x12, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:58:01 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe03}]) [ 761.229132] binder: 22092:22113 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 2018/05/12 22:58:01 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='dctcp\x00', 0x6) sendto$inet6(r0, &(0x7f00004e8000), 0xf401, 0x20000001, &(0x7f000007f000)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfe80]}}, 0x1c) 2018/05/12 22:58:01 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0x0, 0x1c00, 0x252]}) [ 761.301201] binder: 22092:22113 BC_FREE_BUFFER u0000000000000000 no match 2018/05/12 22:58:02 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140)}, 0x0) 2018/05/12 22:58:02 executing program 3: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x1000000, 0x0, 0x12, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:58:02 executing program 5: sigaltstack(&(0x7f0000013000/0x3000)=nil, &(0x7f0000000000)) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000002fe8)={0xaa}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f00000001c0)={{&(0x7f0000013000/0x4000)=nil, 0x4000}, 0x1}) fcntl$getownex(r0, 0x10, &(0x7f0000000080)={0x0, 0x0}) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f00000000c0)=0x0) splice(r0, &(0x7f0000000100), r0, &(0x7f0000000140), 0xe2e6, 0x1) kcmp(r1, r2, 0x2, r0, r0) pselect6(0x40, &(0x7f0000011fc0), &(0x7f0000011000), &(0x7f0000003000), &(0x7f0000013000), &(0x7f0000001ff8)={&(0x7f0000012000), 0x8}) ioctl$UFFDIO_ZEROPAGE(r0, 0x8010aa02, &(0x7f0000004ff0)={&(0x7f0000011000/0x3000)=nil, 0x3000}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000400)={{&(0x7f0000012000/0x4000)=nil, 0x4000}, 0x1}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000040)={{&(0x7f0000012000/0x3000)=nil, 0x3000}}) 2018/05/12 22:58:02 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8a9], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) 2018/05/12 22:58:02 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0x1, 0x0, r0, &(0x7f0000000000), 0xffffffff000}]) 2018/05/12 22:58:02 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x1c, 0x0, &(0x7f0000000040)=[@request_death={0x400c630e}, @free_buffer={0x40086303}], 0x93100000, 0x0, &(0x7f0000000080)}) 2018/05/12 22:58:02 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0x0, 0x3000000, 0x252]}) 2018/05/12 22:58:02 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='dctcp\x00', 0x6) sendto$inet6(r0, &(0x7f00004e8000), 0xf401, 0x20000001, &(0x7f000007f000)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb6c78c0600000000]}}, 0x1c) 2018/05/12 22:58:02 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140)}, 0x0) 2018/05/12 22:58:02 executing program 3: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x20000, 0x0, 0x12, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:58:03 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0x0, 0x89ffffff, 0x252]}) 2018/05/12 22:58:03 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140)}, 0x0) 2018/05/12 22:58:03 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) 2018/05/12 22:58:03 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0x1, 0x0, r0, &(0x7f0000000000), 0x8800000}]) [ 762.346345] binder: 22168:22172 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 762.369124] binder: 22168:22172 BC_FREE_BUFFER u0000000000000000 no match 2018/05/12 22:58:03 executing program 3: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x40000000, 0x0, 0x12, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:58:03 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='dctcp\x00', 0x6) sendto$inet6(r0, &(0x7f00004e8000), 0xf401, 0x20000001, &(0x7f000007f000)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff00000000000000]}}, 0x1c) [ 762.431329] binder: 22168:22185 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 2018/05/12 22:58:03 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='dctcp\x00', 0x6) sendto$inet6(r0, &(0x7f00004e8000), 0xf401, 0x20000001, &(0x7f000007f000)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x500000000000000]}}, 0x1c) [ 762.498417] binder: 22168:22185 BC_FREE_BUFFER u0000000000000000 no match 2018/05/12 22:58:03 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf000000], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) [ 763.133177] FAULT_FLAG_ALLOW_RETRY missing 30 [ 763.137814] CPU: 0 PID: 22171 Comm: syz-executor5 Not tainted 4.17.0-rc4+ #44 [ 763.145096] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 763.154452] Call Trace: [ 763.157051] dump_stack+0x1b9/0x294 [ 763.160677] ? dump_stack_print_info.cold.2+0x52/0x52 [ 763.165867] ? kasan_check_write+0x14/0x20 [ 763.170107] ? do_raw_spin_lock+0xc1/0x200 [ 763.174354] handle_userfault.cold.32+0x44/0x5a [ 763.179019] ? finish_task_switch+0x1ca/0x810 [ 763.183510] ? handle_userfault+0x16c6/0x2760 [ 763.188007] ? userfaultfd_ioctl+0x4d10/0x4d10 [ 763.192584] ? debug_check_no_locks_freed+0x310/0x310 [ 763.197771] ? __schedule+0x809/0x1e30 [ 763.201655] ? print_usage_bug+0xc0/0xc0 [ 763.205713] ? print_usage_bug+0xc0/0xc0 [ 763.209783] ? __sched_text_start+0x8/0x8 [ 763.213920] ? plist_check_list+0x7e/0xa0 [ 763.218056] ? perf_trace_lock+0xd6/0x900 [ 763.222196] ? graph_lock+0x170/0x170 [ 763.225990] ? plist_check_list+0xa0/0xa0 [ 763.230148] ? __lock_acquire+0x7f5/0x5140 [ 763.234366] ? graph_lock+0x170/0x170 [ 763.238175] ? find_held_lock+0x36/0x1c0 [ 763.242240] ? lock_downgrade+0x8e0/0x8e0 [ 763.246385] ? kasan_check_read+0x11/0x20 [ 763.250522] ? do_raw_spin_unlock+0x9e/0x2e0 [ 763.254925] ? do_raw_spin_trylock+0x1b0/0x1b0 [ 763.259506] ? kasan_check_write+0x14/0x20 [ 763.263749] ? do_raw_spin_lock+0xc1/0x200 [ 763.268002] __handle_mm_fault+0x38d8/0x4310 [ 763.272419] ? vm_insert_mixed_mkwrite+0x40/0x40 [ 763.277186] ? graph_lock+0x170/0x170 [ 763.280978] ? futex_wake+0x750/0x750 [ 763.284772] ? find_held_lock+0x36/0x1c0 [ 763.288826] ? lock_downgrade+0x8e0/0x8e0 [ 763.292980] ? handle_mm_fault+0x8c0/0xc70 [ 763.297206] handle_mm_fault+0x53a/0xc70 [ 763.301274] ? __handle_mm_fault+0x4310/0x4310 [ 763.305854] ? find_vma+0x34/0x190 [ 763.309395] __do_page_fault+0x60b/0xe40 [ 763.313448] ? mm_fault_error+0x380/0x380 [ 763.317585] ? graph_lock+0x170/0x170 [ 763.321391] ? debug_mutex_init+0x1c/0x60 [ 763.325542] do_page_fault+0xee/0x8a7 [ 763.329345] ? exit_robust_list+0x290/0x290 [ 763.333667] ? vmalloc_sync_all+0x30/0x30 [ 763.337816] ? find_held_lock+0x36/0x1c0 [ 763.341884] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 763.346717] page_fault+0x1e/0x30 [ 763.350168] RIP: 0010:copy_user_generic_unrolled+0x86/0xc0 [ 763.355781] RSP: 0018:ffff8801af7a7b68 EFLAGS: 00010202 [ 763.361141] RAX: ffffed0035ef4f7d RBX: 0000000000000010 RCX: 0000000000000002 [ 763.368400] RDX: 0000000000000000 RSI: 0000000020013000 RDI: ffff8801af7a7bd8 [ 763.375748] RBP: ffff8801af7a7ba0 R08: ffffed0035ef4f7d R09: ffffed0035ef4f7b [ 763.383009] R10: ffffed0035ef4f7c R11: ffff8801af7a7be7 R12: 0000000020013010 [ 763.390358] R13: 0000000020013000 R14: ffff8801af7a7bd8 R15: 00007ffffffff000 [ 763.397652] ? _copy_from_user+0x10d/0x150 [ 763.401883] get_timespec64+0x75/0x180 [ 763.405757] ? timespec_trunc+0x170/0x170 [ 763.409894] do_pselect+0xd3/0x4d0 [ 763.413423] ? kern_select+0x250/0x250 [ 763.417301] ? lock_downgrade+0x8e0/0x8e0 [ 763.421436] ? pid_task+0x10e/0x1e0 [ 763.425056] ? __x64_sys_futex+0x477/0x680 [ 763.429374] ? do_futex+0x27d0/0x27d0 [ 763.433166] __x64_sys_pselect6+0x1f7/0x280 [ 763.437492] do_syscall_64+0x1b1/0x800 [ 763.441384] ? finish_task_switch+0x1ca/0x810 [ 763.445956] ? syscall_return_slowpath+0x5c0/0x5c0 [ 763.450877] ? syscall_return_slowpath+0x30f/0x5c0 [ 763.455810] ? entry_SYSCALL_64_after_hwframe+0x59/0xbe [ 763.461168] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 763.466004] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 763.471194] RIP: 0033:0x455979 [ 763.474372] RSP: 002b:00007f9c76028c68 EFLAGS: 00000246 ORIG_RAX: 000000000000010e [ 763.482155] RAX: ffffffffffffffda RBX: 00007f9c760296d4 RCX: 0000000000455979 [ 763.489525] RDX: 0000000020011000 RSI: 0000000020011fc0 RDI: 0000000000000040 [ 763.497999] RBP: 000000000072bea0 R08: 0000000020013000 R09: 0000000020001ff8 [ 763.505275] R10: 0000000020003000 R11: 0000000000000246 R12: 00000000ffffffff [ 763.512540] R13: 0000000000000526 R14: 00000000006fbc30 R15: 0000000000000000 2018/05/12 22:58:04 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0x0, 0x29, 0x252]}) 2018/05/12 22:58:04 executing program 5: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000080)="c6295e4eca6c09b612ec6f") r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer2\x00', 0x1, 0x0) fcntl$addseals(r1, 0x409, 0x4) pwrite64(r1, &(0x7f00000001c0)="c064c372b43c7e7294000bfff3d40060", 0x10, 0x0) socket$kcm(0x29, 0x7, 0x0) setsockopt$inet_sctp6_SCTP_PARTIAL_DELIVERY_POINT(r0, 0x84, 0x13, &(0x7f0000000040)=0x6, 0x4) close(r1) 2018/05/12 22:58:04 executing program 3: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0xd, 0x0, 0x12, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:58:04 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe12}]) 2018/05/12 22:58:04 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x1c, 0x0, &(0x7f0000000040)=[@request_death={0x400c630e}, @free_buffer={0x40086303}], 0x74000000, 0x0, &(0x7f0000000080)}) 2018/05/12 22:58:04 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140)}, 0x0) 2018/05/12 22:58:04 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) 2018/05/12 22:58:04 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='dctcp\x00', 0x6) sendto$inet6(r0, &(0x7f00004e8000), 0xf401, 0x20000001, &(0x7f000007f000)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfec00000]}}, 0x1c) [ 763.805575] binder: 22226:22228 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 763.814691] binder: 22226:22228 BC_FREE_BUFFER u0000000000000000 no match 2018/05/12 22:58:04 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140)}, 0x0) 2018/05/12 22:58:04 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe04}]) 2018/05/12 22:58:04 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='dctcp\x00', 0x6) sendto$inet6(r0, &(0x7f00004e8000), 0xf401, 0x20000001, &(0x7f000007f000)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4002]}}, 0x1c) 2018/05/12 22:58:04 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf000], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) [ 763.857174] binder: 22226:22246 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 2018/05/12 22:58:04 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0x0, 0x3c, 0x252]}) 2018/05/12 22:58:04 executing program 3: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0xfffffff4, 0x0, 0x12, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:58:04 executing program 5: r0 = perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe}, 0x0, 0x4, 0xffffffffffffffff, 0x0) r1 = signalfd4(0xffffffffffffffff, &(0x7f0000fe9000), 0x8, 0x0) r2 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/net/ipv4/vs/sync_version\x00', 0x2, 0x0) ioctl$KVM_GET_PIT2(r2, 0x8070ae9f, &(0x7f0000000080)) unshare(0x400) signalfd4(r1, &(0x7f0000a9bff8), 0x8, 0x0) setsockopt$llc_int(r0, 0x10c, 0x0, &(0x7f0000000100)=0x3, 0x4) 2018/05/12 22:58:04 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe02}]) [ 763.989152] binder: 22226:22246 BC_FREE_BUFFER u0000000000000000 no match 2018/05/12 22:58:05 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140)}, 0x0) 2018/05/12 22:58:05 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0x0, 0x600000000000000, 0x252]}) 2018/05/12 22:58:05 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfcffffff], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) 2018/05/12 22:58:05 executing program 3: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x8107000000000000, 0x0, 0x12, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:58:05 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x1c, 0x0, &(0x7f0000000040)=[@request_death={0x400c630e}, @free_buffer={0x40086303}], 0x500, 0x0, &(0x7f0000000080)}) 2018/05/12 22:58:05 executing program 5: r0 = socket(0x15, 0x80005, 0x0) r1 = socket(0xa, 0x1, 0x0) ioctl(r1, 0x110000008910, &(0x7f0000000040)) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000040)='/dev/snapshot\x00', 0x80000, 0x0) fcntl$dupfd(r1, 0x406, r0) getsockopt(r0, 0x200000000114, 0x5, &(0x7f0000001040)=""/4096, &(0x7f0000000000)=0x1d4) 2018/05/12 22:58:05 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='dctcp\x00', 0x6) sendto$inet6(r0, &(0x7f00004e8000), 0xf401, 0x20000001, &(0x7f000007f000)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffff5]}}, 0x1c) 2018/05/12 22:58:05 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe0d}]) [ 764.890825] binder: 22287:22289 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 2018/05/12 22:58:05 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140)}, 0x0) 2018/05/12 22:58:05 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0x0, 0xffffffff00000000, 0x252]}) [ 764.952630] binder: 22287:22289 BC_FREE_BUFFER u0000000000000000 no match [ 764.980389] binder: 22287:22309 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 2018/05/12 22:58:05 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0x1, 0x0, r0, &(0x7f0000000000), 0x2000fe00}]) 2018/05/12 22:58:05 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) 2018/05/12 22:58:05 executing program 3: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x7900000000000000, 0x0, 0x12, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) [ 765.005551] binder: 22287:22309 BC_FREE_BUFFER u0000000000000000 no match 2018/05/12 22:58:05 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00006a4ff7)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) rename(&(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='./file0\x00') r2 = openat$full(0xffffffffffffff9c, &(0x7f0000000100)='/dev/full\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_NEXT_CLIENT(r2, 0xc0bc5351, &(0x7f0000000140)={0x0, 0x1, 'client0\x00', 0x2, "8e78c2df2e5d3ca9", "3c620b7dcd54477966c37f6b621cd5bdedb9162c5a536e6f6ee00f053fb8c42a", 0x4e19, 0x400}) pipe2(&(0x7f0000e3eff8)={0x0, 0x0}, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) dup3(r4, r3, 0x0) ioctl$KVM_SET_MSRS(r3, 0xc008ae88, &(0x7f0000000040)={0x1, 0x0, [{0x200c0000084}]}) socketpair$inet_udp(0x2, 0x2, 0x0, &(0x7f0000000000)) 2018/05/12 22:58:06 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140)}, 0x0) 2018/05/12 22:58:06 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe0f}]) 2018/05/12 22:58:06 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0x0, 0x89ffffff00000000, 0x252]}) 2018/05/12 22:58:06 executing program 3: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x4f2d0400, 0x0, 0x12, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:58:06 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) 2018/05/12 22:58:06 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x1c, 0x0, &(0x7f0000000040)=[@request_death={0x400c630e}, @free_buffer={0x40086303}], 0x6000, 0x0, &(0x7f0000000080)}) 2018/05/12 22:58:06 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='dctcp\x00', 0x6) sendto$inet6(r0, &(0x7f00004e8000), 0xf401, 0x20000001, &(0x7f000007f000)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5]}}, 0x1c) 2018/05/12 22:58:06 executing program 5: fcntl$lock(0xffffffffffffffff, 0x0, &(0x7f00000001c0)={0x0, 0x0, 0x5}) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000)='/dev/hwrng\x00', 0x202000, 0x0) r0 = syz_open_dev$vcsa(&(0x7f0000002ff5)='/dev/vcsa#\x00', 0x2, 0x1) pwritev(0xffffffffffffffff, &(0x7f0000000180)=[{&(0x7f0000000080)="f7", 0x1}], 0x1, 0x0) writev(r0, &(0x7f0000000180), 0x100000000000026a) 2018/05/12 22:58:06 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe10}]) 2018/05/12 22:58:06 executing program 3: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x82, 0x0, 0x12, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:58:06 executing program 5: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") socketpair$unix(0x1, 0x1, 0x0, &(0x7f000064e000)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup3(r0, r0, 0x80001) ioctl$KDDELIO(r3, 0x4b35, 0x0) ioctl$int_in(r1, 0x5452, &(0x7f0000000140)=0x3f) lseek(r0, 0x0, 0x1) write$binfmt_script(r1, &(0x7f0000000180)={'#! ', './file0', [], 0xa}, 0xb) dup2(r1, r2) [ 765.912652] binder: 22344:22347 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 765.949707] binder: 22344:22347 BC_FREE_BUFFER u0000000000000000 no match 2018/05/12 22:58:06 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffff000], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) 2018/05/12 22:58:06 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0x0, 0x2c000000, 0x252]}) 2018/05/12 22:58:06 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140)}, 0x0) [ 765.989512] binder: 22344:22366 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 766.015099] binder: 22344:22366 BC_FREE_BUFFER u0000000000000000 no match 2018/05/12 22:58:06 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140)}, 0x0) 2018/05/12 22:58:06 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe31}]) 2018/05/12 22:58:06 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0x0, 0x0, 0x252, 0x1c]}) 2018/05/12 22:58:06 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xaa593a576e000000], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) 2018/05/12 22:58:06 executing program 3: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x2d50, 0x0, 0x12, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:58:07 executing program 5: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x2d50, 0x0, 0x12, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:58:07 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x1c, 0x0, &(0x7f0000000040)=[@request_death={0x400c630e}, @free_buffer={0x40086303}], 0x6, 0x0, &(0x7f0000000080)}) 2018/05/12 22:58:07 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140)}, 0x0) 2018/05/12 22:58:07 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0x0, 0x0, 0x252, 0x6]}) 2018/05/12 22:58:07 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe09}]) 2018/05/12 22:58:07 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa00000000000000], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) 2018/05/12 22:58:07 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='dctcp\x00', 0x6) sendto$inet6(r0, &(0x7f00004e8000), 0xf401, 0x20000001, &(0x7f000007f000)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400000000000000]}}, 0x1c) 2018/05/12 22:58:07 executing program 3: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x20000000, 0x0, 0x12, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:58:07 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}, 0xfffffff0}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) [ 766.919015] binder: 22424:22427 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 766.949604] binder: 22424:22427 BC_FREE_BUFFER u0000000000000000 no match 2018/05/12 22:58:07 executing program 5: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$inet6(0xa, 0x803, 0x8000000001) connect$inet6(r1, &(0x7f0000000100)={0xa, 0x0, 0x0, @ipv4={[], [0xff, 0xff], @dev={0xac, 0x14, 0x14, 0x12}}}, 0x1c) sendmsg(r1, &(0x7f00000024c0)={0x0, 0x0, &(0x7f0000002400)}, 0x0) write$binfmt_elf32(r0, &(0x7f0000000140)={{0x7f, 0x45, 0x4c, 0x46, 0x1, 0x2, 0x2, 0x8, 0x3, 0x2, 0x3e, 0x8001, 0x60, 0x38, 0x1d, 0x3, 0x800, 0x20, 0x2, 0xffe0000000000000, 0x41bc}, [{0x60000007, 0x7f, 0x3, 0x8, 0x4, 0x5, 0x7, 0x4}], "158caa09ec1a9b5ef4ed4e9433bb5bd539357decbdedea39d249b60ea1605ddbedc655e684f88a22416c0cea69fc4249b4d24c8607090b1008adf6163a85a25575da6794e61d10580b6b4ea855a6ee5d08a34ec7b4280c743da5fc23bd50ebab5ed03eda3a4f72077c91795d76ede85f25ad719ab15220a2f101699e2cea102784afe48d9dd5180097bfda5f1bb8f19ec0f27f4395bd5c9d587360b617399ec47ceef043a525167371bbbd08ea071f1c1c55acfe0c6027ff8e966e905ffd36078a8747f2e146c4defd826ea47a19b4aafa360e", [[], [], [], []]}, 0x52b) 2018/05/12 22:58:07 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='dctcp\x00', 0x6) sendto$inet6(r0, &(0x7f00004e8000), 0xf401, 0x20000001, &(0x7f000007f000)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18020000]}}, 0x1c) 2018/05/12 22:58:07 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140)}, 0x0) 2018/05/12 22:58:07 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0x0, 0x0, 0x252, 0x2900]}) [ 766.993156] binder: 22424:22442 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 767.057474] binder: 22424:22442 BC_FREE_BUFFER u0000000000000000 no match 2018/05/12 22:58:07 executing program 3: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0xfff2, 0x0, 0x12, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:58:07 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00, 0xe4ffffff00000000}]) 2018/05/12 22:58:07 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}, 0x2}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) 2018/05/12 22:58:07 executing program 5: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f00000000c0)="c626262c8523bf012cf66f") r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/cuse\x00', 0x1, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000140)={'tunl0\x00', 0x1000}) r2 = memfd_create(&(0x7f00000005c0)="6465762046a80d01bed3c1e1c85fe2dbef94a677a99248217280a42d688043cc913ddb112187ee23355083fc8a1eed8f3d1a468b405da49550403420a5685e12afb758b1bfcf91d09bfe61b023e1b04f2f8e23a38e1ef575997d875079d8275500cf932de25ff116808e0097e9a30f89ffec73d758337ba4ecfe26e0709dceb3bc100af911f29826293f7e6d4cbbb7fa03189e2fd5b9461150c1f6c46be2eddd2f84ce8136164ee052fdf7c5919654885d693f6c70f42b0eef3f33160056b93855cb84bf62730fd9afe77c1b8d7b0b9dcc2a7566f6067be13c15bbbc440e796acc56b204c7f48fcdfa2e84e52a95", 0x3) setsockopt$inet_mreq(r2, 0x0, 0x23, &(0x7f0000000300)={@local={0xac, 0x14, 0x14, 0xaa}, @dev={0xac, 0x14, 0x14, 0x17}}, 0x8) write(r2, &(0x7f0000000240)='v', 0x1) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f00000001c0)={0x0}, &(0x7f0000000200)=0xc) fcntl$lock(r1, 0x0, &(0x7f00000002c0)={0x2, 0x0, 0x126dab8d, 0x0, r3}) sendfile(r2, r2, &(0x7f0000001000), 0xffff) ioctl$KVM_GET_REG_LIST(r1, 0xc008aeb0, &(0x7f0000000180)={0x6, [0x6, 0x10000, 0x7ff, 0x8c1b, 0x3, 0x80000000]}) fcntl$addseals(r2, 0x409, 0xa) fsetxattr(r2, &(0x7f0000000000)=ANY=[@ANYBLOB="73480004000000792e6367726f757029657468162e2863707573657400"], &(0x7f0000000080)='system.sockprotoname\x00', 0x15, 0x0) clone(0x0, &(0x7f0000000140), &(0x7f0000000280), &(0x7f0000000100), &(0x7f00000000c0)) 2018/05/12 22:58:07 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x1c, 0x0, &(0x7f0000000040)=[@request_death={0x400c630e}, @free_buffer={0x40086303}], 0xfdfdffff00000000, 0x0, &(0x7f0000000080)}) 2018/05/12 22:58:07 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='dctcp\x00', 0x6) sendto$inet6(r0, &(0x7f00004e8000), 0xf401, 0x20000001, &(0x7f000007f000)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf5ffffff]}}, 0x1c) 2018/05/12 22:58:07 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0x0, 0x0, 0x252, 0x2b]}) 2018/05/12 22:58:07 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140)}, 0x0) 2018/05/12 22:58:07 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0x0, 0x0, 0x252, 0x3200000000000000]}) 2018/05/12 22:58:07 executing program 3: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x300, 0x0, 0x12, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) [ 767.220447] binder: 22468:22470 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 767.258698] binder: 22468:22470 BC_FREE_BUFFER u0000000000000000 no match 2018/05/12 22:58:07 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00, 0x31000000}]) 2018/05/12 22:58:07 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140)}, 0x0) 2018/05/12 22:58:07 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}, 0x8000000000}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) [ 767.298765] binder: 22468:22487 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 2018/05/12 22:58:08 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0x0, 0x0, 0x252, 0xfdffffff]}) [ 767.382286] binder: 22468:22487 BC_FREE_BUFFER u0000000000000000 no match 2018/05/12 22:58:08 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00, 0x9000000}]) 2018/05/12 22:58:08 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140)}, 0x0) 2018/05/12 22:58:08 executing program 3: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x2000000, 0x0, 0x12, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:58:08 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}, 0xf00000000000000}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) 2018/05/12 22:58:08 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x1c, 0x0, &(0x7f0000000040)=[@request_death={0x400c630e}, @free_buffer={0x40086303}], 0x9410000000000000, 0x0, &(0x7f0000000080)}) 2018/05/12 22:58:08 executing program 5: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) r2 = epoll_create1(0x0) dup3(r1, r2, 0x0) epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r1, &(0x7f0000d40ff4)) r3 = request_key(&(0x7f0000000080)='pkcs7_test\x00', &(0x7f00000000c0)={0x73, 0x79, 0x7a, 0x2}, &(0x7f0000000100)='!\x00', 0xfffffffffffffffc) add_key$keyring(&(0x7f0000000000)='keyring\x00', &(0x7f0000000040)={0x73, 0x79, 0x7a, 0x0}, 0x0, 0x0, r3) socketpair$inet6_icmp(0xa, 0x2, 0x3a, &(0x7f0000000140)) epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r2, &(0x7f0000b1eff4)) 2018/05/12 22:58:08 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0x0, 0x0, 0x252, 0x2f000000]}) 2018/05/12 22:58:08 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='dctcp\x00', 0x6) sendto$inet6(r0, &(0x7f00004e8000), 0xf401, 0x20000001, &(0x7f000007f000)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfec0]}}, 0x1c) 2018/05/12 22:58:08 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140)}, 0x0) 2018/05/12 22:58:08 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0x0, 0x0, 0x252, 0x2c]}) [ 768.267166] binder: 22527:22533 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 768.304701] binder: 22527:22533 BC_FREE_BUFFER u0000000000000000 no match 2018/05/12 22:58:08 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00, 0x7f00}]) 2018/05/12 22:58:08 executing program 3: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0xfffffffe, 0x0, 0x12, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:58:09 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}, 0x1000000}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) [ 768.333442] binder: 22527:22546 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 768.359809] binder: 22527:22546 BC_FREE_BUFFER u0000000000000000 no match 2018/05/12 22:58:09 executing program 5: r0 = accept$inet(0xffffffffffffff9c, &(0x7f0000000780)={0x0, 0x0, @rand_addr}, &(0x7f00000007c0)=0x10) pwritev(r0, &(0x7f0000000a00)=[{&(0x7f0000000800)="33d47f7fb7d541b5d74ae453c4667256afbf01475085fdbbb2def8606f55b0c04d55b7d2bdce63f4018d99ca455a0b2e6bfa9809d8238d30e49e5ad0f11b8fc9b6e959fbd76feda7601a70a756514333b114370f11ef8f096b98f26037331615e47cdb8288dabb77fa0fb785b73589daee9469f2eb09c6deccdb252d594efb03d88e3bb65012bb5140a5d8869a1cbf340016ac3aea1fded6467c621c589741ed3bc15955b40595bba5e2425f3d4557305d26dfffb6b85809d51e669f077a9d231deb34fc861e73a6adf73a9bd4ca45010862a1db83ae8024ba8ec537a40b04ad7f2ee427b9143bf328edd39ccf2cc0", 0xef}, {&(0x7f0000000900)="d1cddbde6d2e9a92275a23da9c4a1a52dbdfd4bb7e8e1e2e198ef68d14e2dac2697a9c76cc6ea2ab5f14e3c149ec9f40927dbf35a42ffc06ba726462b29ba0ca9a5a78654cdbc183206cb3876fd6deccd330b01f2b4d6a15fd2cef2611ad825d80871bc63006f80f56e3a00a984a02dd3b1752a405b73169ea3e07ab986824e250dac50b2f041e1e7d650a2eb0fe9542", 0x90}, {&(0x7f00000009c0)="f9329d95fabe404ecbb1e36e399a4538f7a12be4c3c84cb98211f0838ff1be709e0bb04beec09d76cf3362d4", 0x2c}], 0x3, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r4 = dup3(r3, r1, 0x0) syz_kvm_setup_cpu$x86(r2, r4, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000180)=[@text64={0x40, &(0x7f0000000040)="440f20c0350e000000440f22c0260f013ab805000000b9078000000f01d9b9321001c0b802000000ba000000000f30c744240000f0d9e8c744240204000000c7442406000000000f011424c4227d0ff70f353e660f38814d0ac4e27d8c07668ec5", 0x61}], 0x1, 0x4d, &(0x7f0000000000), 0x0) ioctl$KVM_SET_DEBUGREGS(0xffffffffffffffff, 0x4080aea2, &(0x7f00000001c0)={[0x0, 0x0, 0x0, 0x6000], 0xfffffffffffffffc}) ioctl$KVM_RUN(r3, 0xae80, 0x0) r5 = accept$inet6(0xffffffffffffff9c, &(0x7f0000000a40)={0x0, 0x0, 0x0, @loopback}, &(0x7f0000000a80)=0x1c) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffff9c, 0x84, 0x6f, &(0x7f0000000b80)={0x0, 0xa4, &(0x7f0000000ac0)=[@in={0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x16}}, @in6={0xa, 0x4e20, 0x1, @empty, 0x100000000}, @in6={0xa, 0x4e21, 0x3, @mcast1={0xff, 0x1, [], 0x1}, 0xc653}, @in={0x2, 0x4e24, @remote={0xac, 0x14, 0x14, 0xbb}}, @in={0x2, 0x4e21, @rand_addr=0x6}, @in6={0xa, 0x4e21, 0x1, @dev={0xfe, 0x80, [], 0x1f}, 0x8}, @in={0x2, 0x4e21, @local={0xac, 0x14, 0x14, 0xaa}}, @in={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x16}}]}, &(0x7f0000000bc0)=0x10) setsockopt$inet_sctp6_SCTP_AUTH_DELETE_KEY(r5, 0x84, 0x19, &(0x7f0000000c00)={r6, 0x9}, 0x8) r7 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0x0, 0x3) perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r7, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000002000)}) r8 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer\x00', 0x1, 0x0) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(0xffffffffffffffff, 0x84, 0x1a, &(0x7f00000005c0)={0x0, 0xa9, "8a5567d0bdbd59f1d1c52b0fe956f96c17093c62fad9b3ff542911821032f10b7f959b6dfb942504ad22913ff1b4f85c9dc460e30b9600f4127ac04446249917e9455343c16f81a76961261cb8951cc7a0c50aa42b15015082a84c5ef4d497e11ec75719a64ef74fc774f8cb8ebbdb6771200cddd7bccb7f38e5bb1e919b8efc5dfb462efbf5ad15a25025b5c26129ea7c7c6a0504c1daf8632712c449b8efd39791aa6fe4e4d18cf5"}, &(0x7f0000000680)=0xb1) sendmsg$inet_sctp(r8, &(0x7f0000000740)={&(0x7f0000000080)=@in6={0xa, 0x4e24, 0x8, @loopback={0x0, 0x1}, 0xfffffffffffffbff}, 0x1c, &(0x7f0000000540)=[{&(0x7f0000000f80)="0ba7959fbca1cdb3c857936668c07fd91b4f90a5faa043bbd956711b21df0f4e3d13e8df02cbfbf6e37416fbcd35835608a01d98441408720f30006ebfbaca792fc03936f15692b938eaa41eded7ac07442e77c55ca99235ab68ba7fa8720d67dfff515d642d91ea4f5a600697694c74b5f02acc9452071e75497feea1a16fc78b2612e1ccf9913abe65e07ef3c44a436fa7ce03e43bc3df52ee1a06cd83974240b0b34ef5c81a55a999bbb43c909d7d6bc56f6b61a9e42fe0879427584d1e1f8523a0654e2e040ffcb44b3c7023302fb7a593f8cf8f35fc00023cfe151606344f5df176040a7f66ae0198e0067a149fd1f7e30dd95d464b71d713ee9ceccea8981dcf48e167ffc547382e3a5a62e86856f0353274d4a26573a2b6af1f5a5f40cc9a922563573e9c2f390c8854bfa48b3d2d568e05183e6db2a07c0102ec52a0abb49e29f96b1396097ec0606bf6c1540076b31a7db6358f3ca68e1f389381a63d527ef77a0e9e8edfef444b5bd79855681d949d85e8cf380a08faa1cf50bd0471fd99838218ac24fa5e5031095b742c645df0bfe25a2c394dc6b84ece4e23ba4552f10d9cc1468f7d8eaa01cca9ad69c78e4f163bb0f0a567042fe30d8a93e6bd694a128b9621ea0b11f615668f53acac61b2c8e776c88dda88d9bfb39f062ef3ce6f335dbaf3d582d21464bf1e2039fae065cf57866a6213c2ddcba3961e8328b86003cfc7d1c1f62e341ec3079fa5c2f662f33ce8b6befa4923ae151440266768a2b410656956f91c11de574a066e698e7690308c60431152ef9bf195c15d9510b841ccd4f89c23294f817085d8fed54244e686cdb0e22717ed1221509dcdfc96156fbc4a6afde7cf0df7e0b76c9cf5cef77998beca77e4500a652b6a25d56850fd966881dfb3ad2104c7d653a7c5a48f95dd978a8bbb54fbcd0febd3d4a3ec9e93e21674146423f2e497257a5567e8bd184eb72ef7f1f7370e5273d9108d6818ebb343cc9b4000c80ac64c59ff48d6e736de6592b596348bff98b6d656ded2bf427fc279b186f3ba07cd84fee376d6c2d2546e219a45c39cd8e1e7576161e9ae2f5b9772db14fbce771a5c40148a489723c2adb4f7b1488a558c6be22724c8635bb02141f8b272468694d14543f8ccfa61714345626958351a27f45d7e56cc5b057a9baff30f44a933f51505349354781e929f122069743618eb6e3e2d711ba58a254d8693f71a5551477509b9f4bd31c88a445fb0dda09d7e2c523ff7393788f45ad0d65af9b1f0d95f25cff56303bfdf03afa7ee9153292307b428f4527a43b88e48ab21943a155b3905ad28d51aa0b911984b04500bb2111c2aa72092ba67b5925d55bcd7e03b8269290c2f79abfdb5719b1304a548fa69da17095e71456f6bb8f712b7aff584bc09f32b02bb3cc37f24daeeb2fe4cab09d51ba8b828c8c7d06e16b4b017d46e9ea58a95c029ef39c46a0c871743182ab184a5ef26d1f493a9ae59cf9e02c33fa0bc1bbe8fd3857b2c4327e9cfd33b4c063a33d87337c73b2ebf2b361be43b6c99da4615977937312b5c00051107d22175d68c34895c4bb57cee5a70d31697a855dcf30de4ef677e98c70e04448e413e04665cb630205c5fe5d9f0adb5a9fab17cd67758ae61c7ad1924e731196b4ca08ccbf4e72c8b73bb01acd8a84312bba3ab938c8d27ca95be293f5bf98d48ab27287d89a37b256b300f755b0348eb1f18aaf2d497441660b2e04d5027cda028eaa1add34fe197c9a9941ef27bc6b1c74dc23f2ebecf0300db4d024382cd0cabc294a8ddc8cfef59d0a59599ee53d6f031432e4f7010a1e6e016879d0da6a84fe2c0127f9b232841dbec0837a7c7180b23f1fddea438fdb92a720f410e65d38dc2d75792729d6293c7faeebcd870c28d43198b38174e49f999909ce0c57cdf81144e8131a7778128678dc2cedc1a0dd6493cd116a0bed2f36e7829a251221ca1ed35c0be1a32ac52c32eba0906b7b7d4c8d2d5ac9faffd1bbed0291e52170edf15d97134f6af7abccc28b4d4db415d157f96a1d1297a8103924ea0bef811b849d48e19d2b9fe426f20e477c6eff1a89efd6f9e874297385634ba54d50ce1e9899e45fc32cbd07b9e550cb124ab207e91014ac77dc9b2e557a9ac43c5e10d1adbea54776822114a46b96996ae6516072107fb9956059de98f12e13ee09d3e5e88024d6dd57003ca099b7373dc5ae487e4d24cea1eae14ce26f74c881b3b4d101274fe08073d157e6d24e36a21f8be5b584acccb82942dda2512ecd4dc6fd7bc6e96193433f13f1611ca08a65190dd504d1fb9d817f2d066baecd1994ae620333788cee1c03d72b2669d1dd1f84054e55c41aa517f4dedb7287e0756a4d9daf303db0205ad20d77638497efc5f3937527b79f01f87cb70e6ace72928bae6e3137f8a5522d65a86c5367f80a811920fa9609eb08127b6a966c008e7f37b0b7d32e6a264cc54b762f4983c0daa028ab6db9b0575bd55e02c9829b779f4e23d176c1f1dcc3eafa95426a0585585eb09f3c8bd877de0048feca60870f8c58f3baec22f4984843cd12a09199e883d4129885e7732f421051a86647ce9e9c49aaafa0c72867f20390045de78ba163f03e2ed145dd5b42dc7d6401659ba2727ecef05691eecf3a993518387abcba785c22f45c7edb2c568a5439226f72751a5b3f8392c330e3238743a1b1242a6f5084012fe2b562985ac85f93a2bddd8ad5edf5e14e2a834983cc31db0807f226cc32f149b67361c663a1cfc6ad110c8e65ec2dc19b866c9fa21c7fe4c984d39aaf705d4f3b95dbb5b6cc3952d7a34aea922fa34afb197955f6e9b5963fc29efc2f1fa33c252fab878106b03b47eb269652cfd199995f07477a9b4045be964516c4ed0249b2cecb5bf9e68292a58b8eff8147dfdc13d9c4ca1509a02d15cc7ede7beb480e44cbf9fe70bc7d40a813dd4f35d4a221211fdbd2f27edd59525b9899a0d6fbb288c0ebc4dfdeaece59c8724fedc2010fcc9feb24c1c4fd82087cfc250d58c03f72770198649ae313a139a8d098722008dcdca3b209bd9a80d9cc16b9b2eff987f1dfe7ff850e68809410a8f2e11448d2311a055318de99b77a850c042ce579db96c2c74ff1bd1f0f8d5936cf6493206d10afe4f51992c5c127c9b186f38ef9f2c66d820a21114986507851fd2f5de25072b412b9c1caa35479318527fa2634e1a0cf341e6dfbc89118b7a304667cad426c62dfdbe2631437aedc73065c566346c140ee093ff7524eb08d18e7a2634b3371bb642d896f9eeef60d8389709a78da622dc4dcec80643689264afe163ca31b3caee236b3cc329c8a2be4b7ff5e800fead17727a8508196dbedd337d7d4a862747aadbfafda63e1286f5dcaae9e514d9ba517c9351ab3c7f29f7c888e0113bc52670f59ec31bd93a54b122ca4bb0aa5f0500bf5d25b5600d8a85aa2f35d8faa5f1a37e9f32502c6781fb20ce31f332a181e75482f96329b2d06378e82fbe5d07d7581f1e936c5578a3a03af1b97878cebebcc4b8f6ddbf830aa4ecbe233028cc60740a58164c2faaa8ad7b281307dd515e54c7d82215e561256cc5b05f007730c2418c7da9fc6d0a91ade7f4757b663c5ce39337db229b148ab6ae8f27a17fedd3de09025bfec2bd38427b867ffb286c95d712ae9c2b2668240f825a913d563f3db73bbb69226a40928227a0db968c84ad836634d74078a87b0b23777c0e8196ef218f1b2e8a6303d21049814da1e6b314fc6a796227d197ca75edf028e7a7517506f2cc2d547d994717df863c61f58785c658016697255b7829a480146ec2bc5cc230e64afa4b85c71320b79ff00087b3adf17b8a1e35c9eea6f9fcef42f0fca0333470d2d184b18193b44d7533b58478f1df69cdc4a7681230aac113ba064698fadc5f919feb5b44753f1abebbaf45cbe06d5b3e9f5570b437dc8c6ca02aeff2b38654c1be8c8db1e6af9408fdbae35d3741a74f9af4429dfda430277b4c703bac342d64383517afa325e67fc7cee5c5f3801b16f364c94358157164a50254adc1742e59d173ba81768f24bde05763327e9e1a78f334f5bac3c88f6aafbc53b1aa428d651aba666fac71e9ddb17a96a4d0b58e9153756cd4608a70b600d9016956d500725116326f020cf797b58dc92ec3d4bad371bd10fef6f842506e14c076a83195c48f5fc719c3a89969156c6fd3ce3cb6ee63680963fa919e02261847328ea7ee22c831bbbecb50e3e2031bab4d1cc7851c0f51ada8491b945fb0f9dcf46d90a284a6fefc1a35fbf572be190b4757570215f2ac75e0efa574f2b861a0e94a7f9fab6b06d66bd5060e7f9f42acd646367fb8eb705cf029cedf526504923c7d56d414a51398e3d8ee5ea99f4a0b2dff652a0a23bb3fbb9b614816a8942e5ad04b9767459e0c77be80287842f661a8749996433e3398274627ee2535111aa4befc4817e5fdc5a3a2b73e0ad1ec193644e21daf002e441c1e3b988a5d9e4e74aed2108c5311aeae50e60a6bde6d6fd87b05712c99ba3b41f25d9e35eef4cb816a7e3edd3db14f922596d3d9ddf2c244dddc08d53d37dad33c3b25a8ebab5b9162ea6b4052673a1aac7cdf40e8d92c449c080a15f360fc30abbb78ca895591b23fe9f5d999a898c587d057f555387ea24d6ff639aa027725bfb61063357b76ce773da1fc6077738901a64465f340144ddac50abee134f57c65d1f550709be2df0ab709513c9cf2efa477441207e97d841be72399bc0e25c88e9a0218b0e5e2050a5ef7c9f57effb4fbb62004c6ed5f0ec72b8a36bdb65344534aedc8a331e8152fc95a55d0cbe57fd7da30ebe0196f52e5664ce30c289bc347d3dfba574227c66b724655e418dde84205ba6059436441f4c9e903f01c5406c3c14aaf6d321a304caa5e439f543bb2d0161b7f8c52274a1f85f73211326c135bb501839631a46d866a42228fa3a786442619d623814f2c46f17bbeb6be3c9aa41c32e01aea43831a9d7a5c2c25d0ff3da3532d5853835487fabd6796a9a68fbdca21c60a15ae27d3e2348699711b3ace591f25d0a44f440a2d2c056569da6e1a9fa96b7d3b72a3f5c8e8d2ef9df2c0cc48b4f86b1be8ffa68fd318a3ea453b0a39d7f40ce3deeb14be6bca98b8285ac4830cc132bc2d3a5c0c73e9766b5fef596fa9d96566d7a98e67d7f53d9321284a61ca8c0b4f072f4bae8146c62dbc0f4eb62d96f07256eca8ba7bf1f6a40c73b2a67c7e04636f262b967c6a1123d4794a8b1c62f4879d348d8b312fa1fd941387eb3a8ca6cedb8fc9e3ee9c76387b82dabe3c5090a7f7e647679cdd30d6d60fcb99c0d26fb068e94fa3194351d4c0c6c2ddb1767571f6fefe567dcfd0646d8c81ae87114d89c3bf888bc913166767c25cdcd8422224d4edd3c5d7fa19e63ccc2691a4ffb9cc598b03dcb871be74455875f3010ad02c35b22f766e7e6c9f8487eafadf9244aa800fab00dddb33ecce9e7c44123e4efccd28e99c696dc13cafcd0b622f2c2c8a862c5a0bf715cc0fdee710d4e7413da88aa478fd09d460eaf460959ed49c197ab4b16f9826b829331086fa3fb23b28ee2f11e75400bde3b81c618692c934806df672d3cb5337ff1b6d9a0eb4bf2d64e7687a85226072e811d8cf306a8fe2505496656017c2eee5f441e75e74b4ddbe8fe30a592439be685cb7525c0aaa1c69fff9dc4d934aa906cb9a1ee2aa5317159676d35b96f9fe5b2fbc02cb7d3d0ab9dab2eac7e85a6eeb246b304ecc5df54368b91069e6cf6868521a37", 0x1000}, {&(0x7f00000000c0)="5c64944a6ef473caf7e82d85f9978128153a305d39dff646ff471466fb897e8eca258c20587ca3ab35243ca83a28a41ddaf97c882d9aac265d090103eb0b41d0726b91d1505522a603001767cb6c982d293942dbb15a0f8e919187e749ac4130f9b7e68ced95d2a4026e3d3b580f003f0952d88b1daa79", 0x77}, {&(0x7f0000000140)="16551cf3dccfae381d5711edd6a1bb6da3a728f3279a5d86d5185f580b303f96ebef2876311e1a76f1e99121c587f90bd6dd4700323fd943f54927fd25cd370c0081071d8c492801c02dc5be2fb9da6affeb246b05098aa09a8fc0eca296c885404d123f4cc45e29587b85", 0x6b}, {&(0x7f0000000200)="69d8000b2230a8068de7e03292570e4076f918fb6b7f37f21c895904c41ff883f3588346a0e3d4f4f615c8ec0c8b30b55c0fa827bf0394c43141fa85ea984689831089501cd52cbd672f054096821e57d2207a0589aa35bbd62b2e28834047b526753a737168c548e81912958f66bf231af9a11ce75334f1fe3c2ce2069b67b536c7ff5005cd3fbfa0433bc9e41c3e1d0b41226f0ec1c34309e0d14efc589ac9aa", 0xa1}, {&(0x7f00000002c0)="9e0223ba7021e2ec861a2539d7720b282ee056f6ff8ac98ab3609f8bb317285562facd108705055cb39a733699c390cd6cc1d1", 0x33}, {&(0x7f0000000300)="d114765c6ffdd96dbdf3ef3633918e17cbfb6429ae5dd7a684b9984eb70885f297d2be20088632c06eeaff855cbaad4d01838b8e3fe4ff42c4ca4ae91cfa00d9711dc9318628bd6e5739e7fef0ac679567d0671793a82a51a72c16eba2583631fea13132ec06687d49a6b8aff35921766f8559101c616ca2207d0ee47fd8d7f73aa539bf1a496de6402c8f6629f5da8488342172913c", 0x96}, {&(0x7f00000003c0)="9cf5dea2c58ca09ec0447ea7dffd5a32ee12e2cfa1e1ebb51a13765c40407b5dfc360f14b60057be4d6a68c8e93c98e1c840655f1748ea6760e4da4ed729f247ef076135a2ed2ffc40934d7e586a7a5c7e750b3f96abc38e2cb403cc8e12f99b41a8b9dd4a437a51b7febd43408809093dc6ff0ba81ae0a9d5db664ee88da752c529094553276e5dc50419bb3a9c337861f15d3f77aa3020501ea8d77f6191620004d5efadd2ebcb687775752060a9873c", 0xb1}, {&(0x7f0000000480)="28301c2d3fb2b4121259844e8ba5643969060d38b1be689194dc52d8e32c122c02100d5d40bb9f3bc0f2d9a9ff45cee706c133a6e6d598ddd495d903d67a2188301528df65df1bd7cc162889e4df5828fae661e8f60de138e59189c04409203b7f869a8096b388318a3310b3b642973aa1d336a61df6159861f587caff6e85862ce9e2bdbeed53aaff4a08936b024345ef094d04c1938e0c5d8e1fdf19bc297bd2", 0xa1}], 0x8, &(0x7f00000006c0)=[@prinfo={0x18, 0x84, 0x5, {0x10, 0x7fffffff}}, @prinfo={0x18, 0x84, 0x5, {0x30, 0x45}}, @authinfo={0x18, 0x84, 0x6, {0x100000000}}, @sndrcv={0x30, 0x84, 0x1, {0x9, 0x1, 0x206, 0x6, 0x8, 0x8001, 0x4, 0x4, r9}}], 0x78, 0x40000}, 0x4000000) getsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r8, 0x84, 0x7b, &(0x7f0000000c40)={r6, 0x2}, &(0x7f0000000c80)=0x8) ioctl$BINDER_WRITE_READ(r7, 0xc0306201, &(0x7f0000008fd0)={0x4, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0e630c40"], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r7, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f000000cf68)=[@enter_looper={0x630c}], 0x1, 0x0, &(0x7f0000008f37)="c2"}) 2018/05/12 22:58:09 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140)}, 0x0) 2018/05/12 22:58:09 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0x0, 0x0, 0x252, 0x2900000000000000]}) 2018/05/12 22:58:09 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x1c, 0x0, &(0x7f0000000040)=[@request_death={0x400c630e}, @free_buffer={0x40086303}], 0xa00000000000000, 0x0, &(0x7f0000000080)}) 2018/05/12 22:58:09 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00, 0xffffffe4}]) [ 768.525519] binder: 22570:22572 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 768.573833] binder: 22570:22572 BC_FREE_BUFFER u0000000000000000 no match [ 768.603721] binder: 22570:22584 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 768.618916] binder: 22570:22584 BC_FREE_BUFFER u0000000000000000 no match [ 768.671895] binder: 22567:22568 Acquire 1 refcount change on invalid ref 0 ret -22 [ 768.681494] binder: 22567:22568 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 768.689147] binder: 22568 RLIMIT_NICE not set [ 769.293059] binder: 22567:22593 Acquire 1 refcount change on invalid ref 0 ret -22 [ 769.310058] binder: 22593 RLIMIT_NICE not set [ 769.310107] binder: 22567:22592 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 2018/05/12 22:58:10 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}, 0xf0ffffff}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) 2018/05/12 22:58:10 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00, 0x9}]) 2018/05/12 22:58:10 executing program 3: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0xeffdffffffffffff, 0x0, 0x12, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:58:10 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0x0, 0x0, 0x252, 0x4000000]}) 2018/05/12 22:58:10 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x1c, 0x0, &(0x7f0000000040)=[@request_death={0x400c630e}, @free_buffer={0x40086303}], 0x6000000000000000, 0x0, &(0x7f0000000080)}) 2018/05/12 22:58:10 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140)}, 0x0) 2018/05/12 22:58:10 executing program 5: r0 = accept$inet(0xffffffffffffff9c, &(0x7f0000000780)={0x0, 0x0, @rand_addr}, &(0x7f00000007c0)=0x10) pwritev(r0, &(0x7f0000000a00)=[{&(0x7f0000000800)="33d47f7fb7d541b5d74ae453c4667256afbf01475085fdbbb2def8606f55b0c04d55b7d2bdce63f4018d99ca455a0b2e6bfa9809d8238d30e49e5ad0f11b8fc9b6e959fbd76feda7601a70a756514333b114370f11ef8f096b98f26037331615e47cdb8288dabb77fa0fb785b73589daee9469f2eb09c6deccdb252d594efb03d88e3bb65012bb5140a5d8869a1cbf340016ac3aea1fded6467c621c589741ed3bc15955b40595bba5e2425f3d4557305d26dfffb6b85809d51e669f077a9d231deb34fc861e73a6adf73a9bd4ca45010862a1db83ae8024ba8ec537a40b04ad7f2ee427b9143bf328edd39ccf2cc0", 0xef}, {&(0x7f0000000900)="d1cddbde6d2e9a92275a23da9c4a1a52dbdfd4bb7e8e1e2e198ef68d14e2dac2697a9c76cc6ea2ab5f14e3c149ec9f40927dbf35a42ffc06ba726462b29ba0ca9a5a78654cdbc183206cb3876fd6deccd330b01f2b4d6a15fd2cef2611ad825d80871bc63006f80f56e3a00a984a02dd3b1752a405b73169ea3e07ab986824e250dac50b2f041e1e7d650a2eb0fe9542", 0x90}, {&(0x7f00000009c0)="f9329d95fabe404ecbb1e36e399a4538f7a12be4c3c84cb98211f0838ff1be709e0bb04beec09d76cf3362d4", 0x2c}], 0x3, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r4 = dup3(r3, r1, 0x0) syz_kvm_setup_cpu$x86(r2, r4, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000180)=[@text64={0x40, &(0x7f0000000040)="440f20c0350e000000440f22c0260f013ab805000000b9078000000f01d9b9321001c0b802000000ba000000000f30c744240000f0d9e8c744240204000000c7442406000000000f011424c4227d0ff70f353e660f38814d0ac4e27d8c07668ec5", 0x61}], 0x1, 0x4d, &(0x7f0000000000), 0x0) ioctl$KVM_SET_DEBUGREGS(0xffffffffffffffff, 0x4080aea2, &(0x7f00000001c0)={[0x0, 0x0, 0x0, 0x6000], 0xfffffffffffffffc}) ioctl$KVM_RUN(r3, 0xae80, 0x0) r5 = accept$inet6(0xffffffffffffff9c, &(0x7f0000000a40)={0x0, 0x0, 0x0, @loopback}, &(0x7f0000000a80)=0x1c) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffff9c, 0x84, 0x6f, &(0x7f0000000b80)={0x0, 0xa4, &(0x7f0000000ac0)=[@in={0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x16}}, @in6={0xa, 0x4e20, 0x1, @empty, 0x100000000}, @in6={0xa, 0x4e21, 0x3, @mcast1={0xff, 0x1, [], 0x1}, 0xc653}, @in={0x2, 0x4e24, @remote={0xac, 0x14, 0x14, 0xbb}}, @in={0x2, 0x4e21, @rand_addr=0x6}, @in6={0xa, 0x4e21, 0x1, @dev={0xfe, 0x80, [], 0x1f}, 0x8}, @in={0x2, 0x4e21, @local={0xac, 0x14, 0x14, 0xaa}}, @in={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x16}}]}, &(0x7f0000000bc0)=0x10) setsockopt$inet_sctp6_SCTP_AUTH_DELETE_KEY(r5, 0x84, 0x19, &(0x7f0000000c00)={r6, 0x9}, 0x8) r7 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0x0, 0x3) perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r7, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire={0x40046305}], 0x0, 0x0, &(0x7f0000002000)}) r8 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer\x00', 0x1, 0x0) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(0xffffffffffffffff, 0x84, 0x1a, &(0x7f00000005c0)={0x0, 0xa9, "8a5567d0bdbd59f1d1c52b0fe956f96c17093c62fad9b3ff542911821032f10b7f959b6dfb942504ad22913ff1b4f85c9dc460e30b9600f4127ac04446249917e9455343c16f81a76961261cb8951cc7a0c50aa42b15015082a84c5ef4d497e11ec75719a64ef74fc774f8cb8ebbdb6771200cddd7bccb7f38e5bb1e919b8efc5dfb462efbf5ad15a25025b5c26129ea7c7c6a0504c1daf8632712c449b8efd39791aa6fe4e4d18cf5"}, &(0x7f0000000680)=0xb1) sendmsg$inet_sctp(r8, &(0x7f0000000740)={&(0x7f0000000080)=@in6={0xa, 0x4e24, 0x8, @loopback={0x0, 0x1}, 0xfffffffffffffbff}, 0x1c, &(0x7f0000000540)=[{&(0x7f0000000f80)="0ba7959fbca1cdb3c857936668c07fd91b4f90a5faa043bbd956711b21df0f4e3d13e8df02cbfbf6e37416fbcd35835608a01d98441408720f30006ebfbaca792fc03936f15692b938eaa41eded7ac07442e77c55ca99235ab68ba7fa8720d67dfff515d642d91ea4f5a600697694c74b5f02acc9452071e75497feea1a16fc78b2612e1ccf9913abe65e07ef3c44a436fa7ce03e43bc3df52ee1a06cd83974240b0b34ef5c81a55a999bbb43c909d7d6bc56f6b61a9e42fe0879427584d1e1f8523a0654e2e040ffcb44b3c7023302fb7a593f8cf8f35fc00023cfe151606344f5df176040a7f66ae0198e0067a149fd1f7e30dd95d464b71d713ee9ceccea8981dcf48e167ffc547382e3a5a62e86856f0353274d4a26573a2b6af1f5a5f40cc9a922563573e9c2f390c8854bfa48b3d2d568e05183e6db2a07c0102ec52a0abb49e29f96b1396097ec0606bf6c1540076b31a7db6358f3ca68e1f389381a63d527ef77a0e9e8edfef444b5bd79855681d949d85e8cf380a08faa1cf50bd0471fd99838218ac24fa5e5031095b742c645df0bfe25a2c394dc6b84ece4e23ba4552f10d9cc1468f7d8eaa01cca9ad69c78e4f163bb0f0a567042fe30d8a93e6bd694a128b9621ea0b11f615668f53acac61b2c8e776c88dda88d9bfb39f062ef3ce6f335dbaf3d582d21464bf1e2039fae065cf57866a6213c2ddcba3961e8328b86003cfc7d1c1f62e341ec3079fa5c2f662f33ce8b6befa4923ae151440266768a2b410656956f91c11de574a066e698e7690308c60431152ef9bf195c15d9510b841ccd4f89c23294f817085d8fed54244e686cdb0e22717ed1221509dcdfc96156fbc4a6afde7cf0df7e0b76c9cf5cef77998beca77e4500a652b6a25d56850fd966881dfb3ad2104c7d653a7c5a48f95dd978a8bbb54fbcd0febd3d4a3ec9e93e21674146423f2e497257a5567e8bd184eb72ef7f1f7370e5273d9108d6818ebb343cc9b4000c80ac64c59ff48d6e736de6592b596348bff98b6d656ded2bf427fc279b186f3ba07cd84fee376d6c2d2546e219a45c39cd8e1e7576161e9ae2f5b9772db14fbce771a5c40148a489723c2adb4f7b1488a558c6be22724c8635bb02141f8b272468694d14543f8ccfa61714345626958351a27f45d7e56cc5b057a9baff30f44a933f51505349354781e929f122069743618eb6e3e2d711ba58a254d8693f71a5551477509b9f4bd31c88a445fb0dda09d7e2c523ff7393788f45ad0d65af9b1f0d95f25cff56303bfdf03afa7ee9153292307b428f4527a43b88e48ab21943a155b3905ad28d51aa0b911984b04500bb2111c2aa72092ba67b5925d55bcd7e03b8269290c2f79abfdb5719b1304a548fa69da17095e71456f6bb8f712b7aff584bc09f32b02bb3cc37f24daeeb2fe4cab09d51ba8b828c8c7d06e16b4b017d46e9ea58a95c029ef39c46a0c871743182ab184a5ef26d1f493a9ae59cf9e02c33fa0bc1bbe8fd3857b2c4327e9cfd33b4c063a33d87337c73b2ebf2b361be43b6c99da4615977937312b5c00051107d22175d68c34895c4bb57cee5a70d31697a855dcf30de4ef677e98c70e04448e413e04665cb630205c5fe5d9f0adb5a9fab17cd67758ae61c7ad1924e731196b4ca08ccbf4e72c8b73bb01acd8a84312bba3ab938c8d27ca95be293f5bf98d48ab27287d89a37b256b300f755b0348eb1f18aaf2d497441660b2e04d5027cda028eaa1add34fe197c9a9941ef27bc6b1c74dc23f2ebecf0300db4d024382cd0cabc294a8ddc8cfef59d0a59599ee53d6f031432e4f7010a1e6e016879d0da6a84fe2c0127f9b232841dbec0837a7c7180b23f1fddea438fdb92a720f410e65d38dc2d75792729d6293c7faeebcd870c28d43198b38174e49f999909ce0c57cdf81144e8131a7778128678dc2cedc1a0dd6493cd116a0bed2f36e7829a251221ca1ed35c0be1a32ac52c32eba0906b7b7d4c8d2d5ac9faffd1bbed0291e52170edf15d97134f6af7abccc28b4d4db415d157f96a1d1297a8103924ea0bef811b849d48e19d2b9fe426f20e477c6eff1a89efd6f9e874297385634ba54d50ce1e9899e45fc32cbd07b9e550cb124ab207e91014ac77dc9b2e557a9ac43c5e10d1adbea54776822114a46b96996ae6516072107fb9956059de98f12e13ee09d3e5e88024d6dd57003ca099b7373dc5ae487e4d24cea1eae14ce26f74c881b3b4d101274fe08073d157e6d24e36a21f8be5b584acccb82942dda2512ecd4dc6fd7bc6e96193433f13f1611ca08a65190dd504d1fb9d817f2d066baecd1994ae620333788cee1c03d72b2669d1dd1f84054e55c41aa517f4dedb7287e0756a4d9daf303db0205ad20d77638497efc5f3937527b79f01f87cb70e6ace72928bae6e3137f8a5522d65a86c5367f80a811920fa9609eb08127b6a966c008e7f37b0b7d32e6a264cc54b762f4983c0daa028ab6db9b0575bd55e02c9829b779f4e23d176c1f1dcc3eafa95426a0585585eb09f3c8bd877de0048feca60870f8c58f3baec22f4984843cd12a09199e883d4129885e7732f421051a86647ce9e9c49aaafa0c72867f20390045de78ba163f03e2ed145dd5b42dc7d6401659ba2727ecef05691eecf3a993518387abcba785c22f45c7edb2c568a5439226f72751a5b3f8392c330e3238743a1b1242a6f5084012fe2b562985ac85f93a2bddd8ad5edf5e14e2a834983cc31db0807f226cc32f149b67361c663a1cfc6ad110c8e65ec2dc19b866c9fa21c7fe4c984d39aaf705d4f3b95dbb5b6cc3952d7a34aea922fa34afb197955f6e9b5963fc29efc2f1fa33c252fab878106b03b47eb269652cfd199995f07477a9b4045be964516c4ed0249b2cecb5bf9e68292a58b8eff8147dfdc13d9c4ca1509a02d15cc7ede7beb480e44cbf9fe70bc7d40a813dd4f35d4a221211fdbd2f27edd59525b9899a0d6fbb288c0ebc4dfdeaece59c8724fedc2010fcc9feb24c1c4fd82087cfc250d58c03f72770198649ae313a139a8d098722008dcdca3b209bd9a80d9cc16b9b2eff987f1dfe7ff850e68809410a8f2e11448d2311a055318de99b77a850c042ce579db96c2c74ff1bd1f0f8d5936cf6493206d10afe4f51992c5c127c9b186f38ef9f2c66d820a21114986507851fd2f5de25072b412b9c1caa35479318527fa2634e1a0cf341e6dfbc89118b7a304667cad426c62dfdbe2631437aedc73065c566346c140ee093ff7524eb08d18e7a2634b3371bb642d896f9eeef60d8389709a78da622dc4dcec80643689264afe163ca31b3caee236b3cc329c8a2be4b7ff5e800fead17727a8508196dbedd337d7d4a862747aadbfafda63e1286f5dcaae9e514d9ba517c9351ab3c7f29f7c888e0113bc52670f59ec31bd93a54b122ca4bb0aa5f0500bf5d25b5600d8a85aa2f35d8faa5f1a37e9f32502c6781fb20ce31f332a181e75482f96329b2d06378e82fbe5d07d7581f1e936c5578a3a03af1b97878cebebcc4b8f6ddbf830aa4ecbe233028cc60740a58164c2faaa8ad7b281307dd515e54c7d82215e561256cc5b05f007730c2418c7da9fc6d0a91ade7f4757b663c5ce39337db229b148ab6ae8f27a17fedd3de09025bfec2bd38427b867ffb286c95d712ae9c2b2668240f825a913d563f3db73bbb69226a40928227a0db968c84ad836634d74078a87b0b23777c0e8196ef218f1b2e8a6303d21049814da1e6b314fc6a796227d197ca75edf028e7a7517506f2cc2d547d994717df863c61f58785c658016697255b7829a480146ec2bc5cc230e64afa4b85c71320b79ff00087b3adf17b8a1e35c9eea6f9fcef42f0fca0333470d2d184b18193b44d7533b58478f1df69cdc4a7681230aac113ba064698fadc5f919feb5b44753f1abebbaf45cbe06d5b3e9f5570b437dc8c6ca02aeff2b38654c1be8c8db1e6af9408fdbae35d3741a74f9af4429dfda430277b4c703bac342d64383517afa325e67fc7cee5c5f3801b16f364c94358157164a50254adc1742e59d173ba81768f24bde05763327e9e1a78f334f5bac3c88f6aafbc53b1aa428d651aba666fac71e9ddb17a96a4d0b58e9153756cd4608a70b600d9016956d500725116326f020cf797b58dc92ec3d4bad371bd10fef6f842506e14c076a83195c48f5fc719c3a89969156c6fd3ce3cb6ee63680963fa919e02261847328ea7ee22c831bbbecb50e3e2031bab4d1cc7851c0f51ada8491b945fb0f9dcf46d90a284a6fefc1a35fbf572be190b4757570215f2ac75e0efa574f2b861a0e94a7f9fab6b06d66bd5060e7f9f42acd646367fb8eb705cf029cedf526504923c7d56d414a51398e3d8ee5ea99f4a0b2dff652a0a23bb3fbb9b614816a8942e5ad04b9767459e0c77be80287842f661a8749996433e3398274627ee2535111aa4befc4817e5fdc5a3a2b73e0ad1ec193644e21daf002e441c1e3b988a5d9e4e74aed2108c5311aeae50e60a6bde6d6fd87b05712c99ba3b41f25d9e35eef4cb816a7e3edd3db14f922596d3d9ddf2c244dddc08d53d37dad33c3b25a8ebab5b9162ea6b4052673a1aac7cdf40e8d92c449c080a15f360fc30abbb78ca895591b23fe9f5d999a898c587d057f555387ea24d6ff639aa027725bfb61063357b76ce773da1fc6077738901a64465f340144ddac50abee134f57c65d1f550709be2df0ab709513c9cf2efa477441207e97d841be72399bc0e25c88e9a0218b0e5e2050a5ef7c9f57effb4fbb62004c6ed5f0ec72b8a36bdb65344534aedc8a331e8152fc95a55d0cbe57fd7da30ebe0196f52e5664ce30c289bc347d3dfba574227c66b724655e418dde84205ba6059436441f4c9e903f01c5406c3c14aaf6d321a304caa5e439f543bb2d0161b7f8c52274a1f85f73211326c135bb501839631a46d866a42228fa3a786442619d623814f2c46f17bbeb6be3c9aa41c32e01aea43831a9d7a5c2c25d0ff3da3532d5853835487fabd6796a9a68fbdca21c60a15ae27d3e2348699711b3ace591f25d0a44f440a2d2c056569da6e1a9fa96b7d3b72a3f5c8e8d2ef9df2c0cc48b4f86b1be8ffa68fd318a3ea453b0a39d7f40ce3deeb14be6bca98b8285ac4830cc132bc2d3a5c0c73e9766b5fef596fa9d96566d7a98e67d7f53d9321284a61ca8c0b4f072f4bae8146c62dbc0f4eb62d96f07256eca8ba7bf1f6a40c73b2a67c7e04636f262b967c6a1123d4794a8b1c62f4879d348d8b312fa1fd941387eb3a8ca6cedb8fc9e3ee9c76387b82dabe3c5090a7f7e647679cdd30d6d60fcb99c0d26fb068e94fa3194351d4c0c6c2ddb1767571f6fefe567dcfd0646d8c81ae87114d89c3bf888bc913166767c25cdcd8422224d4edd3c5d7fa19e63ccc2691a4ffb9cc598b03dcb871be74455875f3010ad02c35b22f766e7e6c9f8487eafadf9244aa800fab00dddb33ecce9e7c44123e4efccd28e99c696dc13cafcd0b622f2c2c8a862c5a0bf715cc0fdee710d4e7413da88aa478fd09d460eaf460959ed49c197ab4b16f9826b829331086fa3fb23b28ee2f11e75400bde3b81c618692c934806df672d3cb5337ff1b6d9a0eb4bf2d64e7687a85226072e811d8cf306a8fe2505496656017c2eee5f441e75e74b4ddbe8fe30a592439be685cb7525c0aaa1c69fff9dc4d934aa906cb9a1ee2aa5317159676d35b96f9fe5b2fbc02cb7d3d0ab9dab2eac7e85a6eeb246b304ecc5df54368b91069e6cf6868521a37", 0x1000}, {&(0x7f00000000c0)="5c64944a6ef473caf7e82d85f9978128153a305d39dff646ff471466fb897e8eca258c20587ca3ab35243ca83a28a41ddaf97c882d9aac265d090103eb0b41d0726b91d1505522a603001767cb6c982d293942dbb15a0f8e919187e749ac4130f9b7e68ced95d2a4026e3d3b580f003f0952d88b1daa79", 0x77}, {&(0x7f0000000140)="16551cf3dccfae381d5711edd6a1bb6da3a728f3279a5d86d5185f580b303f96ebef2876311e1a76f1e99121c587f90bd6dd4700323fd943f54927fd25cd370c0081071d8c492801c02dc5be2fb9da6affeb246b05098aa09a8fc0eca296c885404d123f4cc45e29587b85", 0x6b}, {&(0x7f0000000200)="69d8000b2230a8068de7e03292570e4076f918fb6b7f37f21c895904c41ff883f3588346a0e3d4f4f615c8ec0c8b30b55c0fa827bf0394c43141fa85ea984689831089501cd52cbd672f054096821e57d2207a0589aa35bbd62b2e28834047b526753a737168c548e81912958f66bf231af9a11ce75334f1fe3c2ce2069b67b536c7ff5005cd3fbfa0433bc9e41c3e1d0b41226f0ec1c34309e0d14efc589ac9aa", 0xa1}, {&(0x7f00000002c0)="9e0223ba7021e2ec861a2539d7720b282ee056f6ff8ac98ab3609f8bb317285562facd108705055cb39a733699c390cd6cc1d1", 0x33}, {&(0x7f0000000300)="d114765c6ffdd96dbdf3ef3633918e17cbfb6429ae5dd7a684b9984eb70885f297d2be20088632c06eeaff855cbaad4d01838b8e3fe4ff42c4ca4ae91cfa00d9711dc9318628bd6e5739e7fef0ac679567d0671793a82a51a72c16eba2583631fea13132ec06687d49a6b8aff35921766f8559101c616ca2207d0ee47fd8d7f73aa539bf1a496de6402c8f6629f5da8488342172913c", 0x96}, {&(0x7f00000003c0)="9cf5dea2c58ca09ec0447ea7dffd5a32ee12e2cfa1e1ebb51a13765c40407b5dfc360f14b60057be4d6a68c8e93c98e1c840655f1748ea6760e4da4ed729f247ef076135a2ed2ffc40934d7e586a7a5c7e750b3f96abc38e2cb403cc8e12f99b41a8b9dd4a437a51b7febd43408809093dc6ff0ba81ae0a9d5db664ee88da752c529094553276e5dc50419bb3a9c337861f15d3f77aa3020501ea8d77f6191620004d5efadd2ebcb687775752060a9873c", 0xb1}, {&(0x7f0000000480)="28301c2d3fb2b4121259844e8ba5643969060d38b1be689194dc52d8e32c122c02100d5d40bb9f3bc0f2d9a9ff45cee706c133a6e6d598ddd495d903d67a2188301528df65df1bd7cc162889e4df5828fae661e8f60de138e59189c04409203b7f869a8096b388318a3310b3b642973aa1d336a61df6159861f587caff6e85862ce9e2bdbeed53aaff4a08936b024345ef094d04c1938e0c5d8e1fdf19bc297bd2", 0xa1}], 0x8, &(0x7f00000006c0)=[@prinfo={0x18, 0x84, 0x5, {0x10, 0x7fffffff}}, @prinfo={0x18, 0x84, 0x5, {0x30, 0x45}}, @authinfo={0x18, 0x84, 0x6, {0x100000000}}, @sndrcv={0x30, 0x84, 0x1, {0x9, 0x1, 0x206, 0x6, 0x8, 0x8001, 0x4, 0x4, r9}}], 0x78, 0x40000}, 0x4000000) getsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r8, 0x84, 0x7b, &(0x7f0000000c40)={r6, 0x2}, &(0x7f0000000c80)=0x8) ioctl$BINDER_WRITE_READ(r7, 0xc0306201, &(0x7f0000008fd0)={0x4, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0e630c40"], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r7, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f000000cf68)=[@enter_looper={0x630c}], 0x1, 0x0, &(0x7f0000008f37)="c2"}) 2018/05/12 22:58:10 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='dctcp\x00', 0x6) sendto$inet6(r0, &(0x7f00004e8000), 0xf401, 0x20000001, &(0x7f000007f000)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe00]}}, 0x1c) 2018/05/12 22:58:10 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140)}, 0x0) 2018/05/12 22:58:10 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}, 0xffffff7f}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) 2018/05/12 22:58:10 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0x0, 0x0, 0x252, 0x8000000]}) [ 769.499736] binder: 22598:22599 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 769.534459] binder: 22598:22599 BC_FREE_BUFFER u0000000000000000 no match 2018/05/12 22:58:10 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='dctcp\x00', 0x6) sendto$inet6(r0, &(0x7f00004e8000), 0xf401, 0x20000001, &(0x7f000007f000)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x240]}}, 0x1c) 2018/05/12 22:58:10 executing program 3: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x10000000000000, 0x0, 0x12, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:58:10 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00, 0x3100000000000000}]) [ 769.576666] binder: 22598:22616 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 769.590194] binder: 22598:22616 BC_FREE_BUFFER u0000000000000000 no match [ 769.716807] binder: 22610:22612 Acquire 1 refcount change on invalid ref 0 ret -22 [ 769.780857] binder: 22610:22612 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 769.795205] binder: 22612 RLIMIT_NICE not set 2018/05/12 22:58:11 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0x0, 0x0, 0x252, 0x2c00]}) 2018/05/12 22:58:11 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00, 0x7f00000000000000}]) 2018/05/12 22:58:11 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}, 0xffffff9e}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) 2018/05/12 22:58:11 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140)}, 0x0) 2018/05/12 22:58:11 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x1c, 0x0, &(0x7f0000000040)=[@request_death={0x400c630e}, @free_buffer={0x40086303}], 0x6800, 0x0, &(0x7f0000000080)}) 2018/05/12 22:58:11 executing program 3: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x502d040000000000, 0x0, 0x12, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:58:11 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='dctcp\x00', 0x6) sendto$inet6(r0, &(0x7f00004e8000), 0xf401, 0x20000001, &(0x7f000007f000)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc2219574]}}, 0x1c) 2018/05/12 22:58:11 executing program 5: r0 = socket(0x2, 0xa, 0x4000) r1 = socket(0x8, 0x1, 0x0) ioctl(r1, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") fcntl$getown(r1, 0x9) close(r0) 2018/05/12 22:58:11 executing program 5: r0 = socket(0x2, 0x803, 0x1) connect$inet(r0, &(0x7f0000000080)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) write$binfmt_aout(r0, &(0x7f0000000540)={{0x10b}}, 0x20) 2018/05/12 22:58:11 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0x0, 0x0, 0x252, 0x4]}) 2018/05/12 22:58:11 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00, 0xfdef}]) 2018/05/12 22:58:11 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140)}, 0x0) [ 770.632116] binder: 22659:22660 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 770.656685] binder: 22659:22660 BC_FREE_BUFFER u0000000000000000 no match 2018/05/12 22:58:11 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}, 0xfcffffff}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) 2018/05/12 22:58:11 executing program 3: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x60000, 0x0, 0x12, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) [ 770.713808] binder: 22659:22671 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 2018/05/12 22:58:11 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00, 0x2000000000000000}]) 2018/05/12 22:58:11 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0x0, 0x0, 0x252, 0x2b00]}) [ 770.784149] binder: 22659:22671 BC_FREE_BUFFER u0000000000000000 no match 2018/05/12 22:58:11 executing program 5: 2018/05/12 22:58:12 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='dctcp\x00', 0x6) sendto$inet6(r0, &(0x7f00004e8000), 0xf401, 0x20000001, &(0x7f000007f000)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800000000000000]}}, 0x1c) 2018/05/12 22:58:12 executing program 5: 2018/05/12 22:58:12 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x1c, 0x0, &(0x7f0000000040)=[@request_death={0x400c630e}, @free_buffer={0x40086303}], 0x5, 0x0, &(0x7f0000000080)}) 2018/05/12 22:58:12 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}, 0x3}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) 2018/05/12 22:58:12 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00, 0xf000000}]) 2018/05/12 22:58:12 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0x0, 0x0, 0x252, 0x84ffffff00000000]}) 2018/05/12 22:58:12 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140)}, 0x0) 2018/05/12 22:58:12 executing program 3: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0xf2ffffff, 0x0, 0x12, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:58:12 executing program 5: [ 771.626869] binder: 22710:22711 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 2018/05/12 22:58:12 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0x0, 0x0, 0x252, 0x2c000000]}) 2018/05/12 22:58:12 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00, 0xfe0000}]) [ 771.676148] binder: 22710:22711 BC_FREE_BUFFER u0000000000000000 no match 2018/05/12 22:58:12 executing program 3: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x42d50, 0x0, 0x12, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:58:12 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}, 0xffffffc0}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) 2018/05/12 22:58:12 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140)}, 0x0) 2018/05/12 22:58:12 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='dctcp\x00', 0x6) sendto$inet6(r0, &(0x7f00004e8000), 0xf401, 0x20000001, &(0x7f000007f000)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100000000000000]}}, 0x1c) [ 771.719918] binder: 22710:22730 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 2018/05/12 22:58:12 executing program 5: [ 771.783886] binder: 22710:22730 BC_FREE_BUFFER u0000000000000000 no match 2018/05/12 22:58:12 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140)}, 0x0) 2018/05/12 22:58:12 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0x0, 0x0, 0x252, 0x21]}) 2018/05/12 22:58:12 executing program 3: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x89, 0x0, 0x12, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:58:12 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x1c, 0x0, &(0x7f0000000040)=[@request_death={0x400c630e}, @free_buffer={0x40086303}], 0x74, 0x0, &(0x7f0000000080)}) 2018/05/12 22:58:12 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}, 0x40030000000000}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) 2018/05/12 22:58:12 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140)}, 0x700000000000000) 2018/05/12 22:58:12 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='dctcp\x00', 0x6) sendto$inet6(r0, &(0x7f00004e8000), 0xf401, 0x20000001, &(0x7f000007f000)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x749521c200000000]}}, 0x1c) 2018/05/12 22:58:12 executing program 5: 2018/05/12 22:58:12 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0x0, 0x0, 0x252, 0xffffffff00000000]}) 2018/05/12 22:58:12 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00, 0xd000000}]) 2018/05/12 22:58:12 executing program 5: [ 772.051975] binder: 22775:22777 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 2018/05/12 22:58:12 executing program 3: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0xff01000000000000, 0x0, 0x12, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:58:12 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00, 0x300000000000000}]) 2018/05/12 22:58:12 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}, 0xf0ffff}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) 2018/05/12 22:58:12 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='dctcp\x00', 0x6) sendto$inet6(r0, &(0x7f00004e8000), 0xf401, 0x20000001, &(0x7f000007f000)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6000000]}}, 0x1c) [ 772.108293] binder: 22775:22777 BC_FREE_BUFFER u0000000000000000 no match 2018/05/12 22:58:12 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0x0, 0x0, 0x252, 0x6000000]}) 2018/05/12 22:58:12 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140)}, 0x97ffffff) 2018/05/12 22:58:12 executing program 5: [ 772.157072] binder: 22775:22793 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 772.230157] binder: 22775:22793 BC_FREE_BUFFER u0000000000000000 no match 2018/05/12 22:58:12 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='dctcp\x00', 0x6) sendto$inet6(r0, &(0x7f00004e8000), 0xf401, 0x20000001, &(0x7f000007f000)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfc00]}}, 0x1c) 2018/05/12 22:58:13 executing program 3: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0xf2ffffffffffffff, 0x0, 0x12, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:58:13 executing program 5: 2018/05/12 22:58:13 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x1c, 0x0, &(0x7f0000000040)=[@request_death={0x400c630e}, @free_buffer={0x40086303}], 0x100000000000000, 0x0, &(0x7f0000000080)}) 2018/05/12 22:58:13 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0x0, 0x0, 0x252, 0x29000000]}) 2018/05/12 22:58:13 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140)}, 0xffffffc0) 2018/05/12 22:58:13 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='dctcp\x00', 0x6) sendto$inet6(r0, &(0x7f00004e8000), 0xf401, 0x20000001, &(0x7f000007f000)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8]}}, 0x1c) 2018/05/12 22:58:13 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}, 0xa000000}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) 2018/05/12 22:58:13 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00, 0x1000000000000000}]) 2018/05/12 22:58:13 executing program 5: r0 = syz_open_dev$loop(&(0x7f0000ca9ff5)='/dev/loop#\x00', 0x0, 0x105082) r1 = memfd_create(&(0x7f0000000140)="000000008c00000000000000000000", 0x0) pwritev(0xffffffffffffffff, &(0x7f0000f50f90)=[{&(0x7f0000000100)="a8", 0x1}], 0x1, 0x81003) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) ftruncate(r1, 0x10001) sendfile(r0, r1, &(0x7f00000ddff8), 0x102000001) 2018/05/12 22:58:13 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0x0, 0x0, 0x252, 0x300]}) 2018/05/12 22:58:13 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}, 0x300}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) 2018/05/12 22:58:13 executing program 3: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x64000000, 0x0, 0x12, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) [ 772.460249] binder: 22842:22843 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 772.495371] binder: 22842:22843 BC_FREE_BUFFER u0000000000000000 no match 2018/05/12 22:58:13 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00, 0xfffffdef}]) 2018/05/12 22:58:13 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140)}, 0x7) [ 772.533403] binder: 22842:22850 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 2018/05/12 22:58:13 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}, 0xa}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) [ 772.619724] binder: 22842:22850 BC_FREE_BUFFER u0000000000000000 no match 2018/05/12 22:58:14 executing program 5: pause() sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000380)=[{&(0x7f0000000440)=@abs, 0x6e, &(0x7f00000016c0)=[{&(0x7f00000004c0)="47e37ad0cf344394bf43f96b36e7c2b8a31c89bfa71e3d04181fbd79e32e78c206f46261c8694cbca0f0c3a36b654599d7402360f4de392c4d02352e2bfa9eac5ad6bf23f887cd99d932ebe452444a3d7e36e2789fddffb6f82484d301ae89b9237fe4181bd8d85949071b698eb3e98f36c95a1f0b2a767074f945868c3f4f7d7723e3fa2ac02d1d26bf26861ddf2f3e9331c56070ecfa5d792ad1a543158eef363b2489e916ff914ad84192d2e2a7d3dede0bb181962a5f973819872a6c9bf7b9d4d91155601eb49166ca396b51a891913de774362ae9402a2360e2b2d9cf5613a541ce7e6f69ace6429a0767f61133579d7a3a326e9396220a416e7e81bd0816d7430f3838ea11c18671b6de108bde0465cacb01359219ae58cc09240a4df5478b5159f198aa30cc2cd899104608dcfc958b9f8b10ee48f5bfe134c7b5ac6dd5e71b4b26b910593cf8d2e0687ba041bb5bbd1f2621a7bb54181e4bfb1280f89923032885df0646c79b0334414f2d9529b69b9055cddfceaecb4f8a2b5204ab9ae167f6a328cdc912649a15be11fc9e79f482709d9e814995e32fda5c858a9ccbc5314a031500fc42905d81420431cf476dea1ec09b364020ada89761c2ecc01f5dd5abafe8458908c8f729ac6e31e3853773a1ecad7bdc4391d0dec1dafa5aa1beadadde5a751cff06ab26909b30cfae7d2bd8e8f0f5f7b135d2b58069b64ec2758e74324339254ac0af67620c1f0f5b9f48014dca2453be3a9868c6e4c6c8f3d69c0cc8ef7accf3545e945ab32c7e0bd6a1083763dc42a8d60b1148a227bf410f74a9a569037752542151cb6c6d4ad8d67f1cd0ab2e08333f8ab37564f9e825352c8c536ab567ff4e835433bdcb231423e2ab47c2e41e658415e762b912338a8b1863f9a18980be726fbaf070ebdcebbd425cd5dd541acb4793c5105dbe577538187bf86b385b7c81c8811fa6c208d2ae3ed12803ccf921c7635e30cbbe554f2c8505f698f47f473b16364a4a5223897a7de1d52658ba824d4e8368fceba90669319e6119cba19b6917eebdf0188d8b671e1e99d9b7ef46d0abef3b1e8a660bd30714efe8823fcff2c7a498273d952dce260f0b5ca3d05e6348dad4fd04d8e334b09d626c7eb6ba897404b96e765805db4ad236b22fa5f05336116d2a0a40234ca52077a10fc28442dd72075ad57e5dbc4aa71839ff258194c2a0d2897484211ce6b855babdef8fa4f569c30142fe4def002dc2e68364bfcb58a85f81b313ae657cd344f1f3b04b3e1e252e6b960ec8152ba374e7ea7f3fa0a637709cddc1c406096816e53690139e28fb41b09e79b232573e9ca0268c739acdc3939f9e5c2cd5d6c4b02e4a939425fba5ae5d61e70ceabcdad3d666a34b97c641894ff6ec04f1712109a2ef6a1e1d620d94659b659d89d9cf3de3636085cb447473488de453bdb221339ad5fa7fa352eef36deed2d3f6f1c7b02528a2ec788a286784e85cf30379d6f750e5ab99558df54905e0890f57d69c4bdd49c1478a6735deb4c91816b388282daccf2fab9b7ac7ac9dfab9be4e258e106c99c1f756f85edcbea898f3ec307cea515f49e631fc24adf198d0246a1d3482790e7b2a280dbc4e8ac936d4e9fcc91c3cb376b91e60b25c8cffbee9506db33720339c87565066c8552bd71e3cbfd10d785f3dd361f172a4dde6b6984323d91444ee6ad09e519d5f3b99c3afdebfaba9520726dbf7ef00815ec2b37f0e811e86954daf18a90c5e5ec191eb73244eb57c5c562515bb51b6b2742be1a9464e46fe5dbdbab1b1e3726b53bc109db605d23a753edfe24d4c631b35515f92928edb250093f6c1e30283b9b1c23dfe58fce85fa5a46fde02afd473b9a771d671e44ffc500a68f9e8d8f6f235aee7f341f538b6177fe52a5f782526f741558034d12201e49b15ff578ab5e53703058cc563147693ac68b3bffa90861954d5671afc3bd98e22bdad2f0bd021b1ca7b04d40880a0002fc8059e2cc62ac5e2cf121fbc337c4ce2a3caf02fcddd66cc230b8f70e45547e3b7df65c958c09ed3899368e3d70a0d9ee0d19501c3fc186208d27efc7894d1347e0fc507159fa23ae6b3b00c81912cb7c7f2339f4e8134727018fbe2c50f7a4599ee37cf3bc9f4cf59019fc8c39d66db96c5bcf2c1538f36efe8b3af642c35eed158d9ad25230acc6f42f4f5a1726102b27aaf11e003ba927d3569563f0a6f93281bbd88b1e01a99ce28bb32cfbec649ef06a444382469a6ac634892edf2ebba29865cf66d5b8d9a4c70cc10331b197704b06ed3ec6db3db9512325604bdd7de1bb952457e23d309d6fc7e8d143a9e3698e13ee862156e7647d8e1f0f38cbf39bc123b2454d5023bdad3da71535de9c177536dd30a7bf4ddf8829b48e9df4b7b8d3f44b7dc6bd71f8b72301d8151ee08da0ed7c3a5176937c775c4e5ce286a578411cdb9afb494e88672f0b27ef1a24c5ea61c82569f69d80fd0b07a29be44a371e552e6fbdb81f35bc086af19e64316cdf03e9e9890f5cced96c070d53bfca3aff8b72f969f3a46ce330b8cc3a91b9fbe70aa770c61bdcd7c4d019f9ef47987dda969af933fc66d118cb687ddd4571eacd2281be77271060df37771af2b15eb5faa585bf6ad4f4a50f2b18e914bb0a66cdb69ce61c0189d3702759e4ba859f95a52fcd2ef21be126d27a00d7b0550cea0ffbcd5ff30e511082ff866edbadf0d149b90125b1cbddf4db9bc30ed44972733a5eb31178a84e92e1bc813286bddceecd6cc92f902bc495d2d53bd4ace7b617be4cafa9c146eddac51d6459314fd57bc9a086849bf6b3e9ee17100be5c4b2704b41d9ddb607e10ed5b7a70537f216b52fdd3e3ac1b8138ea2e8ce3f675a0e86e611520c362a7a4feea316b0461c9fbf532b9965f37637e605679987ae2dadd7545fa7a2baf0242184d2f842094dd99af8478bf16ae9ba3812d5a8331caac41791148b831c8b137860c6e7c96571af00ce3a264e5dc42cb07acbb3b0f1507acb11c9d1aae86e33f3303a115bbc63a82ff45888ef26c8d87df2cf81711acaa0c730963dcd5a9b33b47d67ddf17ea9979ea5d876db519c9b43ac461c725b303ce14b9dfc936c4c26942954baa22d8fec0ad8f9b598ca424d05afb2cfb2e42e2e17e5babb8ffaddd515b9083587b21ad961acd2a481e701d45d92adeea80314a9638fa826b7eb735b3177fd2658c7d96073a40d87173de9c58e4c8cdcece3d4198bebfd0de5ea0f97abb857676c341f12d27b319f18b9a8233162f07b2bcf369a409cdf55fadc86e2bf4243b48c0e4395eef43fea92fc09889b50900ae76c3e13c40cb06ce5e7f87aa7432a78341766e1d26ccf74493b2bb0df70cbc8863d96ee7e14b823af4daa92f61c81c90770bb9b7a4684b34bae8ccb2733e8f64bfd666f9f2a9bc94efaf3a0ad4e1cc960c8b3488b5ddb9f71c9c16c5c8fe5d5ab46f09454b13796fe02720d6a7b23511f33b9f62796c15d676860f135cf424ddf6d37f6a9b175efd1aa4415cd3d09a77a4883b3d347b2d99dabebf4a79fc9dfe5dcbf04d96d7a2297803812674d191cba45f3e5f32c90ddd873b97826cd4b0bfa924a5c9ac2671effbf7c7ca74acdbf539ac0c2d6f8b51cae01aea56a70f43c0443ea36c12f1adb605fa772e84ec759bc7ba4a263e12363e1e19070d0c6525faa40c0c3e130ce1da0aaed185e52f7a532e972e333913aeb3eae0b771d901159ef8e15edc7f3becbaa73b57baf72977c1e92cd463199be1e17158590986db60977351e92efc9fe377e3bd2be5ffa3c2b0f99d70157e6a69d3438b53bb372f64fe61b9ccae9afe96eabfcdd39cd2367bf3b2ce601629ed775f4c22f2288263ed4427fae7517f1787c35c5ac54216fd0adfa331557eb024a65069a82c2189cce7ab244f94af46985803438efa0720f6dcb5e9f745daab1d44584342b8bcebd698b67fa82e5219119244a249a5d917b87fd398a8e45258487ffe9420c821c6a0a809381c8e8b881a435177bd6c46e72a68bee2f2d5bd393c3acb262340505962d7f5cc12508321c17db4f654cc1e8cdecbb2773b13467eeb7e54b8a607b54db2fe49916f30edf20af10c54e35a73f74f77d8e0ea0f868f982d7755296e6ee9ffdb34b453d1dd310ffb8fa9e0834d2ec123217badb0d872fa4813377c46e0ee00513973dad9b0e08539c852ca36c8eddeb2a574cfd6f27a91422a9d7adacaa98ebfdecd20b64162ab286b3af55254f09ef46450e0b18cb9ca4b41ac280c3981a662c9b60a2a47286db99600a4b201025562f43659d8498dff8f749f5a53c2067e519024f33c91ee248d247f6318606e20e88cf11f0ba8bf2ee809cab25c01cd3b9576a617128069b64699a3d57c9cf160174d927359c206b6b41e0f3707e5428529c68ad23f6b95db66b2cfa84ab522ea2e7c540b71824c2e9f04f08dd639f33d9e75d61c04c06cf0db7a4c80717c6228a838f59d9ca07844d5d1273f3a01823b10bc17835622783d4e3372cc58f35b5e9ba3eeff7a10ef674e19a8b1ed90b353bcc82d88ecc3e453d552c109012c1069547fd1a10d13c38f3823a80a3c0fc9037cab87d2ac562e674cea66f434d2f4214fa90ba284cfdc193f87d58455230c513667b5390fad2b9d412ffed80d0cdc44565b662620a8b29140fc21545fe9306754c4ad0307724823ea4e4272f725f88172045e8509667e6583d947728b9bc35b650f86d9708abf46f2446390f473ffd71a39a7fb95c3a41007b042cff70568d90c3c9c2623a05a5eb9f7ac093f28dc1e3a12bdcfadeb89d933a9f58864358cbba0ae25825e8a94df72414e9667edf17210361dba6f5d09ecee709a15a2371c0b32e054832924babc954d8f9485212ceaf9f3aeec418f5eb2097457b21db156325367b53f829bd16d1b446e75d0796f7f05330341ce6baf62a78ef9c9be4fde0fb2e5ee018e001eb59b8d06037d335f41db5d9597583cee5cdea113d5621ed2d05504fddc80b5dfd7d3367a48e12c9a5372b115651281a874b079ab45b9fc0c2e7dca3640d6012deb5a93c6571c4dc8e20cc89484f682038a4e87c91c3da0b4b8603f2414c66b12a7d1bdcf99c77c3ab7bfb6ef38652a550b889f6c70c9761962a1d143d143bd305da60854f4d0fa5bcbce42957470b09fe9d35851ffcc45a72dae5f06fa609c1017feb30d0de9d356744792ce302b1db97ce83df3aa97352886e8b64e303bd9144f86914617b294983458c454ae452fda6edaa5849779c7a655b084c6ee58d66bc565d91da167409b84afa87227c1ceca70710cd144aec3b70df4db5008023b5b8addf40e6a4520778747a8838ba20744f387c3cc4005006e70fdf3e0ebb9d07a3c8f516d6bc8be7c6d73430377ec701c2df17ce767d89580561ba03a0128f7d47ec77282ad71ca6561ae4e6b43539a90660f039d0267e651458d949b40da25e94f75b47cfeef31c103616be2a9e4a3af9f419651ce71f6cd701f75f0ffe691c8973b87777a7da5ba70be07f7647af5", 0xf47}], 0x1, &(0x7f0000001700)}], 0x1, 0x0) pipe2(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[@ANYBLOB="71795af67eda4e345aea37c95ff14d47a48b83d3209986116af369eeb8c5abe2891dea01000000d0f642"], 0x2a) readv(r0, &(0x7f0000c9e000)=[{&(0x7f0000c25f19)=""/231, 0xe7}], 0x1) r2 = getpid() process_vm_readv(r2, &(0x7f0000001400), 0x1, &(0x7f0000000000)=[{&(0x7f0000000040)=""/204, 0xd7e1e1d24b36aac5}, {&(0x7f0000002880)=""/183, 0x3d1}], 0x2, 0x0) 2018/05/12 22:58:14 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140)}, 0x18) 2018/05/12 22:58:14 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0x0, 0x0, 0x252, 0xfffffffd]}) 2018/05/12 22:58:14 executing program 3: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0xc00, 0x0, 0x12, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:58:14 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00, 0x200000}]) 2018/05/12 22:58:14 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x1c, 0x0, &(0x7f0000000040)=[@request_death={0x400c630e}, @free_buffer={0x40086303}], 0x48000000, 0x0, &(0x7f0000000080)}) 2018/05/12 22:58:14 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='dctcp\x00', 0x6) sendto$inet6(r0, &(0x7f00004e8000), 0xf401, 0x20000001, &(0x7f000007f000)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0fe]}}, 0x1c) 2018/05/12 22:58:14 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}, 0xa00000000000000}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) 2018/05/12 22:58:14 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140)}, 0xfeffffff00000000) [ 773.455610] binder: 22895:22898 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 773.477771] binder: 22895:22898 BC_FREE_BUFFER u0000000000000000 no match 2018/05/12 22:58:14 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0x0, 0x0, 0x252, 0x89ffffff00000000]}) 2018/05/12 22:58:14 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00, 0x8800000}]) 2018/05/12 22:58:14 executing program 3: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0xfffffff5, 0x0, 0x12, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:58:14 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}, 0xffffff7f00000000}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) [ 773.516202] binder: 22895:22909 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 2018/05/12 22:58:14 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140)}, 0xfd00000000000000) [ 773.576124] binder: 22895:22909 BC_FREE_BUFFER u0000000000000000 no match 2018/05/12 22:58:15 executing program 5: perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) fchdir(r0) creat(&(0x7f0000000080)='./file0\x00', 0x0) open$dir(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) r1 = open(&(0x7f0000000140)='./file0\x00', 0x4001, 0x0) fallocate(r1, 0x0, 0xfffe, 0x2) 2018/05/12 22:58:15 executing program 3: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x4000000000000, 0x0, 0x12, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:58:15 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00, 0xfe000000000000}]) 2018/05/12 22:58:15 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}, 0x7f000001}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) 2018/05/12 22:58:15 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='dctcp\x00', 0x6) sendto$inet6(r0, &(0x7f00004e8000), 0xf401, 0x20000001, &(0x7f000007f000)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7]}}, 0x1c) 2018/05/12 22:58:15 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x1c, 0x0, &(0x7f0000000040)=[@request_death={0x400c630e}, @free_buffer={0x40086303}], 0x9310000000000000, 0x0, &(0x7f0000000080)}) 2018/05/12 22:58:15 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140)}, 0x200000000000000) 2018/05/12 22:58:15 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0x0, 0x0, 0x252, 0x88ffffff00000000]}) 2018/05/12 22:58:15 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0x0, 0x0, 0x252, 0x800000000000000]}) [ 774.547288] binder: 22950:22952 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 2018/05/12 22:58:15 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140)}, 0x7000000) 2018/05/12 22:58:15 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}, 0xc0ffffff}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) 2018/05/12 22:58:15 executing program 3: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x500000000000000, 0x0, 0x12, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:58:15 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00, 0xffffffff00000000}]) [ 774.591004] binder: 22950:22952 BC_FREE_BUFFER u0000000000000000 no match 2018/05/12 22:58:15 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0x0, 0x0, 0x252, 0x84ffffff]}) 2018/05/12 22:58:15 executing program 5: pause() sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000380)=[{&(0x7f0000000440)=@abs, 0x6e, &(0x7f00000016c0)=[{&(0x7f00000004c0)="47e37ad0cf344394bf43f96b36e7c2b8a31c89bfa71e3d04181fbd79e32e78c206f46261c8694cbca0f0c3a36b654599d7402360f4de392c4d02352e2bfa9eac5ad6bf23f887cd99d932ebe452444a3d7e36e2789fddffb6f82484d301ae89b9237fe4181bd8d85949071b698eb3e98f36c95a1f0b2a767074f945868c3f4f7d7723e3fa2ac02d1d26bf26861ddf2f3e9331c56070ecfa5d792ad1a543158eef363b2489e916ff914ad84192d2e2a7d3dede0bb181962a5f973819872a6c9bf7b9d4d91155601eb49166ca396b51a891913de774362ae9402a2360e2b2d9cf5613a541ce7e6f69ace6429a0767f61133579d7a3a326e9396220a416e7e81bd0816d7430f3838ea11c18671b6de108bde0465cacb01359219ae58cc09240a4df5478b5159f198aa30cc2cd899104608dcfc958b9f8b10ee48f5bfe134c7b5ac6dd5e71b4b26b910593cf8d2e0687ba041bb5bbd1f2621a7bb54181e4bfb1280f89923032885df0646c79b0334414f2d9529b69b9055cddfceaecb4f8a2b5204ab9ae167f6a328cdc912649a15be11fc9e79f482709d9e814995e32fda5c858a9ccbc5314a031500fc42905d81420431cf476dea1ec09b364020ada89761c2ecc01f5dd5abafe8458908c8f729ac6e31e3853773a1ecad7bdc4391d0dec1dafa5aa1beadadde5a751cff06ab26909b30cfae7d2bd8e8f0f5f7b135d2b58069b64ec2758e74324339254ac0af67620c1f0f5b9f48014dca2453be3a9868c6e4c6c8f3d69c0cc8ef7accf3545e945ab32c7e0bd6a1083763dc42a8d60b1148a227bf410f74a9a569037752542151cb6c6d4ad8d67f1cd0ab2e08333f8ab37564f9e825352c8c536ab567ff4e835433bdcb231423e2ab47c2e41e658415e762b912338a8b1863f9a18980be726fbaf070ebdcebbd425cd5dd541acb4793c5105dbe577538187bf86b385b7c81c8811fa6c208d2ae3ed12803ccf921c7635e30cbbe554f2c8505f698f47f473b16364a4a5223897a7de1d52658ba824d4e8368fceba90669319e6119cba19b6917eebdf0188d8b671e1e99d9b7ef46d0abef3b1e8a660bd30714efe8823fcff2c7a498273d952dce260f0b5ca3d05e6348dad4fd04d8e334b09d626c7eb6ba897404b96e765805db4ad236b22fa5f05336116d2a0a40234ca52077a10fc28442dd72075ad57e5dbc4aa71839ff258194c2a0d2897484211ce6b855babdef8fa4f569c30142fe4def002dc2e68364bfcb58a85f81b313ae657cd344f1f3b04b3e1e252e6b960ec8152ba374e7ea7f3fa0a637709cddc1c406096816e53690139e28fb41b09e79b232573e9ca0268c739acdc3939f9e5c2cd5d6c4b02e4a939425fba5ae5d61e70ceabcdad3d666a34b97c641894ff6ec04f1712109a2ef6a1e1d620d94659b659d89d9cf3de3636085cb447473488de453bdb221339ad5fa7fa352eef36deed2d3f6f1c7b02528a2ec788a286784e85cf30379d6f750e5ab99558df54905e0890f57d69c4bdd49c1478a6735deb4c91816b388282daccf2fab9b7ac7ac9dfab9be4e258e106c99c1f756f85edcbea898f3ec307cea515f49e631fc24adf198d0246a1d3482790e7b2a280dbc4e8ac936d4e9fcc91c3cb376b91e60b25c8cffbee9506db33720339c87565066c8552bd71e3cbfd10d785f3dd361f172a4dde6b6984323d91444ee6ad09e519d5f3b99c3afdebfaba9520726dbf7ef00815ec2b37f0e811e86954daf18a90c5e5ec191eb73244eb57c5c562515bb51b6b2742be1a9464e46fe5dbdbab1b1e3726b53bc109db605d23a753edfe24d4c631b35515f92928edb250093f6c1e30283b9b1c23dfe58fce85fa5a46fde02afd473b9a771d671e44ffc500a68f9e8d8f6f235aee7f341f538b6177fe52a5f782526f741558034d12201e49b15ff578ab5e53703058cc563147693ac68b3bffa90861954d5671afc3bd98e22bdad2f0bd021b1ca7b04d40880a0002fc8059e2cc62ac5e2cf121fbc337c4ce2a3caf02fcddd66cc230b8f70e45547e3b7df65c958c09ed3899368e3d70a0d9ee0d19501c3fc186208d27efc7894d1347e0fc507159fa23ae6b3b00c81912cb7c7f2339f4e8134727018fbe2c50f7a4599ee37cf3bc9f4cf59019fc8c39d66db96c5bcf2c1538f36efe8b3af642c35eed158d9ad25230acc6f42f4f5a1726102b27aaf11e003ba927d3569563f0a6f93281bbd88b1e01a99ce28bb32cfbec649ef06a444382469a6ac634892edf2ebba29865cf66d5b8d9a4c70cc10331b197704b06ed3ec6db3db9512325604bdd7de1bb952457e23d309d6fc7e8d143a9e3698e13ee862156e7647d8e1f0f38cbf39bc123b2454d5023bdad3da71535de9c177536dd30a7bf4ddf8829b48e9df4b7b8d3f44b7dc6bd71f8b72301d8151ee08da0ed7c3a5176937c775c4e5ce286a578411cdb9afb494e88672f0b27ef1a24c5ea61c82569f69d80fd0b07a29be44a371e552e6fbdb81f35bc086af19e64316cdf03e9e9890f5cced96c070d53bfca3aff8b72f969f3a46ce330b8cc3a91b9fbe70aa770c61bdcd7c4d019f9ef47987dda969af933fc66d118cb687ddd4571eacd2281be77271060df37771af2b15eb5faa585bf6ad4f4a50f2b18e914bb0a66cdb69ce61c0189d3702759e4ba859f95a52fcd2ef21be126d27a00d7b0550cea0ffbcd5ff30e511082ff866edbadf0d149b90125b1cbddf4db9bc30ed44972733a5eb31178a84e92e1bc813286bddceecd6cc92f902bc495d2d53bd4ace7b617be4cafa9c146eddac51d6459314fd57bc9a086849bf6b3e9ee17100be5c4b2704b41d9ddb607e10ed5b7a70537f216b52fdd3e3ac1b8138ea2e8ce3f675a0e86e611520c362a7a4feea316b0461c9fbf532b9965f37637e605679987ae2dadd7545fa7a2baf0242184d2f842094dd99af8478bf16ae9ba3812d5a8331caac41791148b831c8b137860c6e7c96571af00ce3a264e5dc42cb07acbb3b0f1507acb11c9d1aae86e33f3303a115bbc63a82ff45888ef26c8d87df2cf81711acaa0c730963dcd5a9b33b47d67ddf17ea9979ea5d876db519c9b43ac461c725b303ce14b9dfc936c4c26942954baa22d8fec0ad8f9b598ca424d05afb2cfb2e42e2e17e5babb8ffaddd515b9083587b21ad961acd2a481e701d45d92adeea80314a9638fa826b7eb735b3177fd2658c7d96073a40d87173de9c58e4c8cdcece3d4198bebfd0de5ea0f97abb857676c341f12d27b319f18b9a8233162f07b2bcf369a409cdf55fadc86e2bf4243b48c0e4395eef43fea92fc09889b50900ae76c3e13c40cb06ce5e7f87aa7432a78341766e1d26ccf74493b2bb0df70cbc8863d96ee7e14b823af4daa92f61c81c90770bb9b7a4684b34bae8ccb2733e8f64bfd666f9f2a9bc94efaf3a0ad4e1cc960c8b3488b5ddb9f71c9c16c5c8fe5d5ab46f09454b13796fe02720d6a7b23511f33b9f62796c15d676860f135cf424ddf6d37f6a9b175efd1aa4415cd3d09a77a4883b3d347b2d99dabebf4a79fc9dfe5dcbf04d96d7a2297803812674d191cba45f3e5f32c90ddd873b97826cd4b0bfa924a5c9ac2671effbf7c7ca74acdbf539ac0c2d6f8b51cae01aea56a70f43c0443ea36c12f1adb605fa772e84ec759bc7ba4a263e12363e1e19070d0c6525faa40c0c3e130ce1da0aaed185e52f7a532e972e333913aeb3eae0b771d901159ef8e15edc7f3becbaa73b57baf72977c1e92cd463199be1e17158590986db60977351e92efc9fe377e3bd2be5ffa3c2b0f99d70157e6a69d3438b53bb372f64fe61b9ccae9afe96eabfcdd39cd2367bf3b2ce601629ed775f4c22f2288263ed4427fae7517f1787c35c5ac54216fd0adfa331557eb024a65069a82c2189cce7ab244f94af46985803438efa0720f6dcb5e9f745daab1d44584342b8bcebd698b67fa82e5219119244a249a5d917b87fd398a8e45258487ffe9420c821c6a0a809381c8e8b881a435177bd6c46e72a68bee2f2d5bd393c3acb262340505962d7f5cc12508321c17db4f654cc1e8cdecbb2773b13467eeb7e54b8a607b54db2fe49916f30edf20af10c54e35a73f74f77d8e0ea0f868f982d7755296e6ee9ffdb34b453d1dd310ffb8fa9e0834d2ec123217badb0d872fa4813377c46e0ee00513973dad9b0e08539c852ca36c8eddeb2a574cfd6f27a91422a9d7adacaa98ebfdecd20b64162ab286b3af55254f09ef46450e0b18cb9ca4b41ac280c3981a662c9b60a2a47286db99600a4b201025562f43659d8498dff8f749f5a53c2067e519024f33c91ee248d247f6318606e20e88cf11f0ba8bf2ee809cab25c01cd3b9576a617128069b64699a3d57c9cf160174d927359c206b6b41e0f3707e5428529c68ad23f6b95db66b2cfa84ab522ea2e7c540b71824c2e9f04f08dd639f33d9e75d61c04c06cf0db7a4c80717c6228a838f59d9ca07844d5d1273f3a01823b10bc17835622783d4e3372cc58f35b5e9ba3eeff7a10ef674e19a8b1ed90b353bcc82d88ecc3e453d552c109012c1069547fd1a10d13c38f3823a80a3c0fc9037cab87d2ac562e674cea66f434d2f4214fa90ba284cfdc193f87d58455230c513667b5390fad2b9d412ffed80d0cdc44565b662620a8b29140fc21545fe9306754c4ad0307724823ea4e4272f725f88172045e8509667e6583d947728b9bc35b650f86d9708abf46f2446390f473ffd71a39a7fb95c3a41007b042cff70568d90c3c9c2623a05a5eb9f7ac093f28dc1e3a12bdcfadeb89d933a9f58864358cbba0ae25825e8a94df72414e9667edf17210361dba6f5d09ecee709a15a2371c0b32e054832924babc954d8f9485212ceaf9f3aeec418f5eb2097457b21db156325367b53f829bd16d1b446e75d0796f7f05330341ce6baf62a78ef9c9be4fde0fb2e5ee018e001eb59b8d06037d335f41db5d9597583cee5cdea113d5621ed2d05504fddc80b5dfd7d3367a48e12c9a5372b115651281a874b079ab45b9fc0c2e7dca3640d6012deb5a93c6571c4dc8e20cc89484f682038a4e87c91c3da0b4b8603f2414c66b12a7d1bdcf99c77c3ab7bfb6ef38652a550b889f6c70c9761962a1d143d143bd305da60854f4d0fa5bcbce42957470b09fe9d35851ffcc45a72dae5f06fa609c1017feb30d0de9d356744792ce302b1db97ce83df3aa97352886e8b64e303bd9144f86914617b294983458c454ae452fda6edaa5849779c7a655b084c6ee58d66bc565d91da167409b84afa87227c1ceca70710cd144aec3b70df4db5008023b5b8addf40e6a4520778747a8838ba20744f387c3cc4005006e70fdf3e0ebb9d07a3c8f516d6bc8be7c6d73430377ec701c2df17ce767d89580561ba03a0128f7d47ec77282ad71ca6561ae4e6b43539a90660f039d0267e651458d949b40da25e94f75b47cfeef31c103616be2a9e4a3af9f419651ce71f6cd701f75f0ffe691c8973b87777a7da5ba70be07f7647af5", 0xf47}], 0x1, &(0x7f0000001700)}], 0x1, 0x0) pipe2(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$binfmt_misc(r1, &(0x7f0000001440)=ANY=[@ANYBLOB="00a8201d07ab78f78625c926d7f2ca7d5400000000b2070800c3db4fe5c043eea9e24f479281059336246d046639073dba95b8b546bd99db85e0131eaf4ad044b52bf62b234ab4e0957d82e3ce54454f7c6b9b164212850000000000000000000000000000000000000008c4c8f5d8021339d8f58cfaa9170cbb0d5bbd13c9cfb1440a24736f48ec2bb970b2d56961d0dc1bb68c5e7178b5045096aa16f2209849208abe1d8553174085c40455291fc55bcd908c7dcfa41b2aec02ee90113bfc667c3843c737afc8d15114e8bb84279be1"], 0xd1) readv(r0, &(0x7f0000c9e000)=[{&(0x7f0000c25f19)=""/231, 0xe7}], 0x1) r2 = getpid() process_vm_readv(r2, &(0x7f0000001400), 0x1, &(0x7f0000000000)=[{&(0x7f0000000040)=""/204, 0xd7e1e1d24b36aac5}, {&(0x7f0000002880)=""/183, 0x3d1}], 0x2, 0x0) [ 774.663712] binder: 22950:22973 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 774.703350] binder: 22950:22973 BC_FREE_BUFFER u0000000000000000 no match 2018/05/12 22:58:15 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}, 0xf000000}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) 2018/05/12 22:58:15 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140)}, 0xffffff97) 2018/05/12 22:58:16 executing program 3: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0xfeffffff00000000, 0x0, 0x12, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:58:16 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x1c, 0x0, &(0x7f0000000040)=[@request_death={0x400c630e}, @free_buffer={0x40086303}], 0x10000000, 0x0, &(0x7f0000000080)}) 2018/05/12 22:58:16 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00, 0xf0ffffff0f0000}]) 2018/05/12 22:58:16 executing program 5: pause() sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000380)=[{&(0x7f0000000440)=@abs, 0x6e, &(0x7f00000016c0)=[{&(0x7f00000004c0)="47e37ad0cf344394bf43f96b36e7c2b8a31c89bfa71e3d04181fbd79e32e78c206f46261c8694cbca0f0c3a36b654599d7402360f4de392c4d02352e2bfa9eac5ad6bf23f887cd99d932ebe452444a3d7e36e2789fddffb6f82484d301ae89b9237fe4181bd8d85949071b698eb3e98f36c95a1f0b2a767074f945868c3f4f7d7723e3fa2ac02d1d26bf26861ddf2f3e9331c56070ecfa5d792ad1a543158eef363b2489e916ff914ad84192d2e2a7d3dede0bb181962a5f973819872a6c9bf7b9d4d91155601eb49166ca396b51a891913de774362ae9402a2360e2b2d9cf5613a541ce7e6f69ace6429a0767f61133579d7a3a326e9396220a416e7e81bd0816d7430f3838ea11c18671b6de108bde0465cacb01359219ae58cc09240a4df5478b5159f198aa30cc2cd899104608dcfc958b9f8b10ee48f5bfe134c7b5ac6dd5e71b4b26b910593cf8d2e0687ba041bb5bbd1f2621a7bb54181e4bfb1280f89923032885df0646c79b0334414f2d9529b69b9055cddfceaecb4f8a2b5204ab9ae167f6a328cdc912649a15be11fc9e79f482709d9e814995e32fda5c858a9ccbc5314a031500fc42905d81420431cf476dea1ec09b364020ada89761c2ecc01f5dd5abafe8458908c8f729ac6e31e3853773a1ecad7bdc4391d0dec1dafa5aa1beadadde5a751cff06ab26909b30cfae7d2bd8e8f0f5f7b135d2b58069b64ec2758e74324339254ac0af67620c1f0f5b9f48014dca2453be3a9868c6e4c6c8f3d69c0cc8ef7accf3545e945ab32c7e0bd6a1083763dc42a8d60b1148a227bf410f74a9a569037752542151cb6c6d4ad8d67f1cd0ab2e08333f8ab37564f9e825352c8c536ab567ff4e835433bdcb231423e2ab47c2e41e658415e762b912338a8b1863f9a18980be726fbaf070ebdcebbd425cd5dd541acb4793c5105dbe577538187bf86b385b7c81c8811fa6c208d2ae3ed12803ccf921c7635e30cbbe554f2c8505f698f47f473b16364a4a5223897a7de1d52658ba824d4e8368fceba90669319e6119cba19b6917eebdf0188d8b671e1e99d9b7ef46d0abef3b1e8a660bd30714efe8823fcff2c7a498273d952dce260f0b5ca3d05e6348dad4fd04d8e334b09d626c7eb6ba897404b96e765805db4ad236b22fa5f05336116d2a0a40234ca52077a10fc28442dd72075ad57e5dbc4aa71839ff258194c2a0d2897484211ce6b855babdef8fa4f569c30142fe4def002dc2e68364bfcb58a85f81b313ae657cd344f1f3b04b3e1e252e6b960ec8152ba374e7ea7f3fa0a637709cddc1c406096816e53690139e28fb41b09e79b232573e9ca0268c739acdc3939f9e5c2cd5d6c4b02e4a939425fba5ae5d61e70ceabcdad3d666a34b97c641894ff6ec04f1712109a2ef6a1e1d620d94659b659d89d9cf3de3636085cb447473488de453bdb221339ad5fa7fa352eef36deed2d3f6f1c7b02528a2ec788a286784e85cf30379d6f750e5ab99558df54905e0890f57d69c4bdd49c1478a6735deb4c91816b388282daccf2fab9b7ac7ac9dfab9be4e258e106c99c1f756f85edcbea898f3ec307cea515f49e631fc24adf198d0246a1d3482790e7b2a280dbc4e8ac936d4e9fcc91c3cb376b91e60b25c8cffbee9506db33720339c87565066c8552bd71e3cbfd10d785f3dd361f172a4dde6b6984323d91444ee6ad09e519d5f3b99c3afdebfaba9520726dbf7ef00815ec2b37f0e811e86954daf18a90c5e5ec191eb73244eb57c5c562515bb51b6b2742be1a9464e46fe5dbdbab1b1e3726b53bc109db605d23a753edfe24d4c631b35515f92928edb250093f6c1e30283b9b1c23dfe58fce85fa5a46fde02afd473b9a771d671e44ffc500a68f9e8d8f6f235aee7f341f538b6177fe52a5f782526f741558034d12201e49b15ff578ab5e53703058cc563147693ac68b3bffa90861954d5671afc3bd98e22bdad2f0bd021b1ca7b04d40880a0002fc8059e2cc62ac5e2cf121fbc337c4ce2a3caf02fcddd66cc230b8f70e45547e3b7df65c958c09ed3899368e3d70a0d9ee0d19501c3fc186208d27efc7894d1347e0fc507159fa23ae6b3b00c81912cb7c7f2339f4e8134727018fbe2c50f7a4599ee37cf3bc9f4cf59019fc8c39d66db96c5bcf2c1538f36efe8b3af642c35eed158d9ad25230acc6f42f4f5a1726102b27aaf11e003ba927d3569563f0a6f93281bbd88b1e01a99ce28bb32cfbec649ef06a444382469a6ac634892edf2ebba29865cf66d5b8d9a4c70cc10331b197704b06ed3ec6db3db9512325604bdd7de1bb952457e23d309d6fc7e8d143a9e3698e13ee862156e7647d8e1f0f38cbf39bc123b2454d5023bdad3da71535de9c177536dd30a7bf4ddf8829b48e9df4b7b8d3f44b7dc6bd71f8b72301d8151ee08da0ed7c3a5176937c775c4e5ce286a578411cdb9afb494e88672f0b27ef1a24c5ea61c82569f69d80fd0b07a29be44a371e552e6fbdb81f35bc086af19e64316cdf03e9e9890f5cced96c070d53bfca3aff8b72f969f3a46ce330b8cc3a91b9fbe70aa770c61bdcd7c4d019f9ef47987dda969af933fc66d118cb687ddd4571eacd2281be77271060df37771af2b15eb5faa585bf6ad4f4a50f2b18e914bb0a66cdb69ce61c0189d3702759e4ba859f95a52fcd2ef21be126d27a00d7b0550cea0ffbcd5ff30e511082ff866edbadf0d149b90125b1cbddf4db9bc30ed44972733a5eb31178a84e92e1bc813286bddceecd6cc92f902bc495d2d53bd4ace7b617be4cafa9c146eddac51d6459314fd57bc9a086849bf6b3e9ee17100be5c4b2704b41d9ddb607e10ed5b7a70537f216b52fdd3e3ac1b8138ea2e8ce3f675a0e86e611520c362a7a4feea316b0461c9fbf532b9965f37637e605679987ae2dadd7545fa7a2baf0242184d2f842094dd99af8478bf16ae9ba3812d5a8331caac41791148b831c8b137860c6e7c96571af00ce3a264e5dc42cb07acbb3b0f1507acb11c9d1aae86e33f3303a115bbc63a82ff45888ef26c8d87df2cf81711acaa0c730963dcd5a9b33b47d67ddf17ea9979ea5d876db519c9b43ac461c725b303ce14b9dfc936c4c26942954baa22d8fec0ad8f9b598ca424d05afb2cfb2e42e2e17e5babb8ffaddd515b9083587b21ad961acd2a481e701d45d92adeea80314a9638fa826b7eb735b3177fd2658c7d96073a40d87173de9c58e4c8cdcece3d4198bebfd0de5ea0f97abb857676c341f12d27b319f18b9a8233162f07b2bcf369a409cdf55fadc86e2bf4243b48c0e4395eef43fea92fc09889b50900ae76c3e13c40cb06ce5e7f87aa7432a78341766e1d26ccf74493b2bb0df70cbc8863d96ee7e14b823af4daa92f61c81c90770bb9b7a4684b34bae8ccb2733e8f64bfd666f9f2a9bc94efaf3a0ad4e1cc960c8b3488b5ddb9f71c9c16c5c8fe5d5ab46f09454b13796fe02720d6a7b23511f33b9f62796c15d676860f135cf424ddf6d37f6a9b175efd1aa4415cd3d09a77a4883b3d347b2d99dabebf4a79fc9dfe5dcbf04d96d7a2297803812674d191cba45f3e5f32c90ddd873b97826cd4b0bfa924a5c9ac2671effbf7c7ca74acdbf539ac0c2d6f8b51cae01aea56a70f43c0443ea36c12f1adb605fa772e84ec759bc7ba4a263e12363e1e19070d0c6525faa40c0c3e130ce1da0aaed185e52f7a532e972e333913aeb3eae0b771d901159ef8e15edc7f3becbaa73b57baf72977c1e92cd463199be1e17158590986db60977351e92efc9fe377e3bd2be5ffa3c2b0f99d70157e6a69d3438b53bb372f64fe61b9ccae9afe96eabfcdd39cd2367bf3b2ce601629ed775f4c22f2288263ed4427fae7517f1787c35c5ac54216fd0adfa331557eb024a65069a82c2189cce7ab244f94af46985803438efa0720f6dcb5e9f745daab1d44584342b8bcebd698b67fa82e5219119244a249a5d917b87fd398a8e45258487ffe9420c821c6a0a809381c8e8b881a435177bd6c46e72a68bee2f2d5bd393c3acb262340505962d7f5cc12508321c17db4f654cc1e8cdecbb2773b13467eeb7e54b8a607b54db2fe49916f30edf20af10c54e35a73f74f77d8e0ea0f868f982d7755296e6ee9ffdb34b453d1dd310ffb8fa9e0834d2ec123217badb0d872fa4813377c46e0ee00513973dad9b0e08539c852ca36c8eddeb2a574cfd6f27a91422a9d7adacaa98ebfdecd20b64162ab286b3af55254f09ef46450e0b18cb9ca4b41ac280c3981a662c9b60a2a47286db99600a4b201025562f43659d8498dff8f749f5a53c2067e519024f33c91ee248d247f6318606e20e88cf11f0ba8bf2ee809cab25c01cd3b9576a617128069b64699a3d57c9cf160174d927359c206b6b41e0f3707e5428529c68ad23f6b95db66b2cfa84ab522ea2e7c540b71824c2e9f04f08dd639f33d9e75d61c04c06cf0db7a4c80717c6228a838f59d9ca07844d5d1273f3a01823b10bc17835622783d4e3372cc58f35b5e9ba3eeff7a10ef674e19a8b1ed90b353bcc82d88ecc3e453d552c109012c1069547fd1a10d13c38f3823a80a3c0fc9037cab87d2ac562e674cea66f434d2f4214fa90ba284cfdc193f87d58455230c513667b5390fad2b9d412ffed80d0cdc44565b662620a8b29140fc21545fe9306754c4ad0307724823ea4e4272f725f88172045e8509667e6583d947728b9bc35b650f86d9708abf46f2446390f473ffd71a39a7fb95c3a41007b042cff70568d90c3c9c2623a05a5eb9f7ac093f28dc1e3a12bdcfadeb89d933a9f58864358cbba0ae25825e8a94df72414e9667edf17210361dba6f5d09ecee709a15a2371c0b32e054832924babc954d8f9485212ceaf9f3aeec418f5eb2097457b21db156325367b53f829bd16d1b446e75d0796f7f05330341ce6baf62a78ef9c9be4fde0fb2e5ee018e001eb59b8d06037d335f41db5d9597583cee5cdea113d5621ed2d05504fddc80b5dfd7d3367a48e12c9a5372b115651281a874b079ab45b9fc0c2e7dca3640d6012deb5a93c6571c4dc8e20cc89484f682038a4e87c91c3da0b4b8603f2414c66b12a7d1bdcf99c77c3ab7bfb6ef38652a550b889f6c70c9761962a1d143d143bd305da60854f4d0fa5bcbce42957470b09fe9d35851ffcc45a72dae5f06fa609c1017feb30d0de9d356744792ce302b1db97ce83df3aa97352886e8b64e303bd9144f86914617b294983458c454ae452fda6edaa5849779c7a655b084c6ee58d66bc565d91da167409b84afa87227c1ceca70710cd144aec3b70df4db5008023b5b8addf40e6a4520778747a8838ba20744f387c3cc4005006e70fdf3e0ebb9d07a3c8f516d6bc8be7c6d73430377ec701c2df17ce767d89580561ba03a0128f7d47ec77282ad71ca6561ae4e6b43539a90660f039d0267e651458d949b40da25e94f75b47cfeef31c103616be2a9e4a3af9f419651ce71f6cd701f75f0ffe691c8973b87777a7da5ba70be07f7647af5", 0xf47}], 0x1, &(0x7f0000001700)}], 0x1, 0x0) pipe2(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$binfmt_misc(r1, &(0x7f0000001440)=ANY=[@ANYBLOB="00a8201d07ab78f78625c926d7f2ca7d5400000000b2070800c3db4fe5c043eea9e24f479281059336246d046639073dba95b8b546bd99db85e0131eaf4ad044b52bf62b234ab4e0957d82e3ce54454f7c6b9b164212850000000000000000000000000000000000000008c4c8f5d8021339d8f58cfaa9170cbb0d5bbd13c9cfb1440a24736f48ec2bb9"], 0x8a) readv(r0, &(0x7f0000c9e000)=[{&(0x7f0000c25f19)=""/231, 0xe7}], 0x1) r2 = getpid() process_vm_readv(r2, &(0x7f0000001400), 0x1, &(0x7f0000000000)=[{&(0x7f0000000040)=""/204, 0xd7e1e1d24b36aac5}, {&(0x7f0000002880)=""/183, 0x3d1}], 0x2, 0x0) 2018/05/12 22:58:16 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0x0, 0x0, 0x252, 0x33000000]}) 2018/05/12 22:58:16 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}, 0x2000000}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) 2018/05/12 22:58:16 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140)}, 0xffffffff00000000) 2018/05/12 22:58:16 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='dctcp\x00', 0x6) sendto$inet6(r0, &(0x7f00004e8000), 0xf401, 0x20000001, &(0x7f000007f000)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x600000000000000]}}, 0x1c) [ 775.901072] binder: 23013:23016 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 775.928417] binder: 23013:23016 BC_FREE_BUFFER u0000000000000000 no match 2018/05/12 22:58:16 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140)}, 0xffffff7f00000000) 2018/05/12 22:58:16 executing program 3: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x502d000000000000, 0x0, 0x12, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:58:16 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='dctcp\x00', 0x6) sendto$inet6(r0, &(0x7f00004e8000), 0xf401, 0x20000001, &(0x7f000007f000)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf401000000000000]}}, 0x1c) 2018/05/12 22:58:16 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00, 0xfeffffff}]) 2018/05/12 22:58:16 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}, 0xa9080000}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) 2018/05/12 22:58:16 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0x0, 0x0, 0x252, 0x600]}) [ 775.958946] binder: 23013:23031 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 775.992308] binder: 23013:23031 BC_FREE_BUFFER u0000000000000000 no match 2018/05/12 22:58:16 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00, 0xe0000}]) 2018/05/12 22:58:16 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0x0, 0x0, 0x252, 0x29]}) 2018/05/12 22:58:17 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='dctcp\x00', 0x6) sendto$inet6(r0, &(0x7f00004e8000), 0xf401, 0x20000001, &(0x7f000007f000)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x54000000]}}, 0x1c) 2018/05/12 22:58:17 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}, 0xfffffffffffff000}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) 2018/05/12 22:58:17 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140)}, 0xffffff7f) 2018/05/12 22:58:17 executing program 3: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0xf4ffffff, 0x0, 0x12, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:58:17 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0x0, 0x0, 0x252, 0x2b00000000000000]}) 2018/05/12 22:58:17 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x1c, 0x0, &(0x7f0000000040)=[@request_death={0x400c630e}, @free_buffer={0x40086303}], 0x94100000, 0x0, &(0x7f0000000080)}) 2018/05/12 22:58:17 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00, 0x2000}]) 2018/05/12 22:58:17 executing program 5: r0 = syz_open_dev$loop(&(0x7f0000ca9ff5)='/dev/loop#\x00', 0x0, 0x0) r1 = memfd_create(&(0x7f0000000300)="2f6465762f6c6f6f7023009da58e238fce4c397a08c7c7ccf52afb23d73290", 0x0) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) write$fuse(0xffffffffffffffff, &(0x7f0000000180)={0x20, 0x0, 0x0, @fuse_ioctl_out={0x0, 0x1}}, 0x20) ioctl$LOOP_SET_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) 2018/05/12 22:58:17 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='dctcp\x00', 0x6) sendto$inet6(r0, &(0x7f00004e8000), 0xf401, 0x20000001, &(0x7f000007f000)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9]}}, 0x1c) [ 776.973761] binder: 23071:23080 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 777.001800] binder: 23071:23080 BC_FREE_BUFFER u0000000000000000 no match 2018/05/12 22:58:17 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}, 0xf000}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) 2018/05/12 22:58:17 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0x0, 0x0, 0x252, 0x11]}) 2018/05/12 22:58:17 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140)}, 0xfeffffff) 2018/05/12 22:58:17 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00, 0x1000000}]) 2018/05/12 22:58:17 executing program 3: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x500, 0x0, 0x12, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) [ 777.046086] binder: 23071:23096 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 777.064596] binder: 23071:23096 BC_FREE_BUFFER u0000000000000000 no match 2018/05/12 22:58:17 executing program 5: perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$IP_VS_SO_SET_ADD(r0, 0x0, 0x482, &(0x7f0000000000)={0x11, @remote={0xac, 0x14, 0x14, 0xbb}, 0x0, 0x0, 'none\x00'}, 0x2c) setsockopt$IP_VS_SO_SET_FLUSH(r0, 0x0, 0x485, 0x0, 0x0) 2018/05/12 22:58:17 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140)}, 0x700) 2018/05/12 22:58:17 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x1c, 0x0, &(0x7f0000000040)=[@request_death={0x400c630e}, @free_buffer={0x40086303}], 0x6c000000, 0x0, &(0x7f0000000080)}) 2018/05/12 22:58:17 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00, 0x3f000000}]) [ 777.254460] binder: 23123:23126 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 777.299223] binder: 23123:23126 BC_FREE_BUFFER u0000000000000000 no match [ 777.330526] binder: 23123:23134 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 777.354493] binder: 23123:23134 BC_FREE_BUFFER u0000000000000000 no match 2018/05/12 22:58:18 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0x0, 0x0, 0x252, 0x33]}) 2018/05/12 22:58:18 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}, 0x100000000000000}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) 2018/05/12 22:58:18 executing program 3: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0xf2ff, 0x0, 0x12, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:58:18 executing program 5: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$sock_int(r1, 0x1, 0x22, &(0x7f0000000000)=0x2000000000007, 0x4) write(r2, &(0x7f0000000080), 0x0) recvmsg(r1, &(0x7f0000019fc8)={0x0, 0x0, &(0x7f0000984000), 0x0, &(0x7f00000001c0), 0x1be}, 0x0) r3 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000080)='/dev/vcs\x00', 0x6000, 0x0) ioctl$KVM_SET_IDENTITY_MAP_ADDR(r3, 0x4008ae48, &(0x7f00000000c0)=0x2000) 2018/05/12 22:58:18 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00, 0xf00}]) 2018/05/12 22:58:18 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140)}, 0xfd00) 2018/05/12 22:58:18 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='dctcp\x00', 0x6) sendto$inet6(r0, &(0x7f00004e8000), 0xf401, 0x20000001, &(0x7f000007f000)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80fe]}}, 0x1c) 2018/05/12 22:58:18 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x1c, 0x0, &(0x7f0000000040)=[@request_death={0x400c630e}, @free_buffer={0x40086303}], 0x95100000, 0x0, &(0x7f0000000080)}) [ 778.032334] binder: 23142:23146 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 2018/05/12 22:58:18 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0x0, 0x0, 0x252, 0x2100000000000000]}) 2018/05/12 22:58:18 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140)}, 0x4) 2018/05/12 22:58:18 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00, 0xa80300}]) 2018/05/12 22:58:18 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}, 0xa908}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) [ 778.074790] binder: 23142:23146 BC_FREE_BUFFER u0000000000000000 no match 2018/05/12 22:58:18 executing program 3: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x1100000000000000, 0x0, 0x12, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:58:18 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000340)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP(r1, 0x4068aea3, &(0x7f0000000100)={0x79}) r2 = syz_open_dev$amidi(&(0x7f0000000000)='/dev/amidi#\x00', 0x2, 0x22801) r3 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$inet_tcp_int(r3, 0x6, 0x14, &(0x7f0000d16ffc), &(0x7f0000000100)=0x4) ioctl$TUNGETFEATURES(r2, 0x800454cf, &(0x7f0000000040)) socket$nl_netfilter(0x10, 0x3, 0xc) [ 778.115777] binder: 23142:23166 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 778.161519] binder: 23142:23166 BC_FREE_BUFFER u0000000000000000 no match 2018/05/12 22:58:19 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0x0, 0x0, 0x252, 0x3000000]}) 2018/05/12 22:58:19 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x1c, 0x0, &(0x7f0000000040)=[@request_death={0x400c630e}, @free_buffer={0x40086303}], 0x3, 0x0, &(0x7f0000000080)}) 2018/05/12 22:58:19 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}, 0xf0ffffffffffff}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) 2018/05/12 22:58:19 executing program 3: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0xc000000000000, 0x0, 0x12, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:58:19 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140)}, 0x1f000000) 2018/05/12 22:58:19 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00, 0x10000000000000}]) 2018/05/12 22:58:19 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='dctcp\x00', 0x6) sendto$inet6(r0, &(0x7f00004e8000), 0xf401, 0x20000001, &(0x7f000007f000)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x900000000000000]}}, 0x1c) 2018/05/12 22:58:19 executing program 5: mknod(&(0x7f0000000ffa)='./bus\x00', 0x1000, 0x0) r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/net/ipv4/vs/nat_icmp_send\x00', 0x2, 0x0) recvmsg$kcm(r0, &(0x7f0000000380)={&(0x7f0000000080)=@sco, 0x80, &(0x7f00000002c0)=[{&(0x7f0000000100)=""/50, 0x32}, {&(0x7f0000000140)=""/227, 0xe3}, {&(0x7f0000000240)=""/63, 0x3f}, {&(0x7f0000000280)=""/6, 0x6}], 0x4, &(0x7f0000000300)=""/93, 0x5d, 0x2}, 0x40000000) r1 = creat(&(0x7f0000ccb000)='./bus\x00', 0x0) ioctl$SG_GET_VERSION_NUM(r1, 0x2282, &(0x7f0000000000)) 2018/05/12 22:58:19 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}, 0x300000000000000}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) 2018/05/12 22:58:19 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='dctcp\x00', 0x6) sendto$inet6(r0, &(0x7f00004e8000), 0xf401, 0x20000001, &(0x7f000007f000)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa00000000000000]}}, 0x1c) [ 779.034192] binder: 23200:23202 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 779.063337] binder: 23200:23202 BC_FREE_BUFFER u0000000000000000 no match 2018/05/12 22:58:19 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00, 0xd00000000000000}]) 2018/05/12 22:58:19 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140)}, 0xa000000) 2018/05/12 22:58:19 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0x0, 0x0, 0x252, 0x1100]}) 2018/05/12 22:58:19 executing program 3: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0xfffffff2, 0x0, 0x12, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) [ 779.107915] binder: 23200:23220 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 779.129513] binder: 23200:23220 BC_FREE_BUFFER u0000000000000000 no match 2018/05/12 22:58:20 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00, 0x3f00000000000000}]) 2018/05/12 22:58:20 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}, 0xfcffffff00000000}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) 2018/05/12 22:58:20 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='dctcp\x00', 0x6) sendto$inet6(r0, &(0x7f00004e8000), 0xf401, 0x20000001, &(0x7f000007f000)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe00000000000000]}}, 0x1c) 2018/05/12 22:58:20 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x1c, 0x0, &(0x7f0000000040)=[@request_death={0x400c630e}, @free_buffer={0x40086303}], 0x1000000000000000, 0x0, &(0x7f0000000080)}) 2018/05/12 22:58:20 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140)}, 0x1800) 2018/05/12 22:58:20 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0x0, 0x0, 0x252, 0xffffff88]}) 2018/05/12 22:58:20 executing program 5: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0xc000000000000, 0x0, 0x12, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:58:20 executing program 3: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x3f000000, 0x0, 0x12, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) [ 780.089286] binder: 23261:23263 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 2018/05/12 22:58:20 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}, 0xf0ffffff00000000}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) 2018/05/12 22:58:20 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140)}, 0xe) 2018/05/12 22:58:20 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='dctcp\x00', 0x6) sendto$inet6(r0, &(0x7f00004e8000), 0xf401, 0x20000001, &(0x7f000007f000)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5000000]}}, 0x1c) 2018/05/12 22:58:20 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0x0, 0x0, 0x252, 0x1c00000000000000]}) [ 780.136288] binder: 23261:23263 BC_FREE_BUFFER u0000000000000000 no match 2018/05/12 22:58:20 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00, 0x100000000000000}]) 2018/05/12 22:58:20 executing program 5: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x22002, 0x0) perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, r0, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_MCAST_JOIN_GROUP(0xffffffffffffffff, 0x0, 0x2a, &(0x7f0000008000)={0x1, {{0x2, 0x0, @multicast2=0xe0000002}}}, 0x90) mprotect(&(0x7f0000008000/0x2000)=nil, 0x2000, 0x6) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000001000)={0x0, @broadcast, @broadcast}, &(0x7f0000008000)=0xc) 2018/05/12 22:58:20 executing program 3: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x8200, 0x0, 0x12, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:58:20 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='dctcp\x00', 0x6) sendto$inet6(r0, &(0x7f00004e8000), 0xf401, 0x20000001, &(0x7f000007f000)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5400]}}, 0x1c) 2018/05/12 22:58:20 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140)}, 0x97ffffff00000000) 2018/05/12 22:58:20 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}, 0x3000000}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) [ 780.270584] binder: 23261:23290 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 2018/05/12 22:58:20 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0x0, 0x0, 0x252, 0x3200]}) [ 780.354176] binder: 23261:23290 BC_FREE_BUFFER u0000000000000000 no match 2018/05/12 22:58:21 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00, 0xd00}]) 2018/05/12 22:58:21 executing program 3: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x64, 0x0, 0x12, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:58:21 executing program 5: r0 = socket(0xa, 0x1, 0x0) r1 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vsock\x00', 0x200000, 0x0) ioctl$EVIOCGBITKEY(r1, 0x80404521, &(0x7f0000000100)=""/4096) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") syz_emit_ethernet(0x7e, &(0x7f0000000080)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaabb0800450000700000000000019078ac1414bbac1414110300907800000000450000000000000000040000ac14ed0256e61400444000000000000000000000e000000200000000e000000100000000000000007f00000100000000ffffffff00000000e000000100000000ac14140000000000"], &(0x7f0000000000)) 2018/05/12 22:58:21 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x1c, 0x0, &(0x7f0000000040)=[@request_death={0x400c630e}, @free_buffer={0x40086303}], 0x60000000, 0x0, &(0x7f0000000080)}) 2018/05/12 22:58:21 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}, 0xfffffffc}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) 2018/05/12 22:58:21 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140)}, 0x18000000) 2018/05/12 22:58:21 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='dctcp\x00', 0x6) sendto$inet6(r0, &(0x7f00004e8000), 0xf401, 0x20000001, &(0x7f000007f000)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb6c78c06]}}, 0x1c) 2018/05/12 22:58:21 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0x0, 0x0, 0x252, 0x3300000000000000]}) [ 780.530997] binder: 23325:23333 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 780.550268] binder: 23325:23333 BC_FREE_BUFFER u0000000000000000 no match [ 780.573230] binder: 23325:23343 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 2018/05/12 22:58:21 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00, 0x400000000000000}]) 2018/05/12 22:58:21 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0x0, 0x0, 0x252, 0x3c]}) 2018/05/12 22:58:21 executing program 5: r0 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) r1 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20010000003}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = gettid() vmsplice(r1, &(0x7f00000012c0)=[{&(0x7f0000000080)="31a726196bd01a3b17ab3cbf8b24306a2be376c508385194c30aa6ab1008406e87e19ac1d9fda81e580170ba7b718745cc23a1c5baa9476b6f5a08fb88a32c3784738e8c8e8b3c82fdefcb868f16d4826d7657c1eb675280736af947610b67208e1a6b17486a1bf2d43fdd100dbe7e", 0x6f}, {&(0x7f0000000100)="7bb9900e9f66f9be4065df8a93c15057e9de", 0x12}, {&(0x7f0000000140)="3b95dad8f3d24cf68a581f9357c52e532bd718b34c79ff501b2d5c3934b9343dea9573224dda56c0d87e135bc9fb5db81c97200ec4c750bdd389eaf739dc67cc150ff695b3cca56f2d9eba97dd2da4791bc82f352e9c997beb37df47821f175e9f5f188b0f7a6261b83efe830f9ec75637aaa4e6c031f9b4c215", 0x7a}, {&(0x7f00000001c0)="e384cec8c2a2bc0381d2bdbb82a232e98d0918022df3565255b518e698d856c17138bf6fa09751751ae6a6ea010f274cc9d54469df7a971919e0f322521347afdc86eb731605a021e9f42b931c12503d302bd737f3c51beb8ccad08aacd7a2fc068f6901d3a9ffa6965e3a57c89a39656c535e271cc03f277768aa929b59386a9a2eb73e11eaddb1df03fcddbdf916617d6d3bdafea342aa3189b683e4fe0f3607777b9e6465a7cbc2b7e33c8ce67f7c96fa1260ab2fe391c1bd8d2429fc3a2e74086761dd36ef7279f6b134f712a7f173643929c728d6d696c6aa244529faf6af6d1bafb64de6f54955a8c6f96c7fc6eb6d8593b439ea7bfe870dfc9f7729ab363ae2f4619c95d707485a203e2166a1defbdf473b7f23aae0d35c070f1f56118a4490e5883a30e3457194af8b34aaab304584952c1ad113c0ec5f1ef761bab88b20acaf5ad397c6a6587fac2f5ab00ed45e4d99d30e01c472bd07b3788c44f7634997a7512eddc7284c56f5ba17028673cb98a152686c094c416f439836211bff2e2c5ccf3b18409832e41c1ae1255b0b5fe860867c5938badb8c9f09f47d89ef09fbc61680a03175b818cd57676b858dc963e3f0e5d811c50a18efa3ad749ae7ad427d7b9e03226ed2cb4ba3dc0fb6e8051706c7d6f42fd8598045f5476991cfc2de75bfa100c9a9e2bd357d64bd51bbdec04786ce01336f49a5c4f456a5b38020aa6f28275b37565548e67bb2d3f2a793f2fe8c82aa5a9f57052eaa29189f7e46c8f5563115d776854389a6cab6343f2fbdabadb8705f80dfed80e76b7c2ccb48a424f445a5e18e224d185cf6e5c9575276e35affb957f8a00c41c1f1569393a2260f3b901283962f788955aa76d1017c4cc59ba880327c4033eecd11d874be323a3839a4dd87f0f32c7053bf83eaf043970cd7675431208c55362f629001e1f7d2ff65269d422ce66fa9b25a31aeb5c741ee8c326c2dfc4642c5a5fa637115f6ca368cf08b6f700062e189dd12e1ed46d45e3dbbc67b8b196466a5db46a9e59f4328f1a588d432d4363d3e0ba8e7ff0a9ddd19014c32535f65a2338c9ac4c9377c25ad2d9ac3ea538531aa73d23cad9380559f0cb91df4e37a71e2b6e148fb0ef5cf357bf42450508cfd41521a8b03b8708f1e2c08ab9d20aa88b2a0c066a15bdf74f994adbab429a5e7ed6631679950db585ddec1a4699b1fed8f86a11b043947d780efd6c0a053c14b622793348f73e9618f5e3af257f33787a9acbc01169161d500cb8bc6a411f0bf2377bd09b943c767520bb79e73501124d20d780e0b9cf3f1df6e2dfa8aa0388491e070645f2e90a60e67eb0fff3499e835f65295f74d6f931c6af9947a523bfddda780d73dad981d9ef9f9d7b1df43fa18abf8120f19a2a49955fb5ead6f367e47ca375209cdffcaa44add42b0be743f32bc9598f1fad1b35dba32c1ea6c2dbd099e12288d2c1b6d0a863f5fce034229df1f0db9e9f010fcf4a22f28efbf2f1d4ef26cc94d1315bda52aaacc7dd1968144aae4e94ee22d2f311ff6b18d5b5527ed6ff27c4461a26643fac71d0359ed9a3d9319b28843c0047fb81617f9b1819b9f627849aff738d35a2b4a7518a6816b757bc7117b58683f93a435b0789a7cdd525fe0fb30d43d0f8d702b0ca59292d72a9fa488515e67bcacf8ec45c1c1686d1bb7d7cf6182804df099c6269a97e1fa76e7740307863ecc3620ea813e78beef93abc8531144120a3b9d9d75d5ae41090fb61c3f0977e6d2c17c81e9cbde5096ba9b95e956a725790cee871cea02a666e0d8cc1949dccd65f0428d0a291f672799636a4b5f32e95ee6cae82f072d31d2b76d10271e5862a85d96f5af5f30e4cc06f200fa00be4f4db7ba1eba425426d4f9949b5168913b06632dfedda1b30fd58ded92e3f4ebbf47307d514a11f3fd89b48733bbb3c1865093ddbeb270898b980e0fcfc74508995f1038d50bfb7423645180ab7457a4c66e4e4e4f9ac6a4a3c2be8f07cac9ebe8876c9b4fd3d122232f7d13c58156104836a33b2adf354b797f3d5b073dd92db6c49b6d9c56e1e0aef7f3bcd2db09a85a013dc75a66795ce24422091c0477f0e8cd2a701241757600679b4faddee5731912d6c6634287c56d6481ccbfd582d1de39dd791af539dc0322a433aaa186499805e839e911bc23873747513d2c48d982dbcddb518d3fc2079d1eebf86298cec506c8df5f6382432a0f7a37444dd5b77501a2576ea68ea32bfc77ff041014a263e9a3b318cb2978d36e9f30e6a51f685be0514070ae9c16f34191228583dec59f1d01633f3cb63eb00727c6afc1e7cf2e91d6d33d8cb5b3b26ab71bc9b9b855058e023f61c5cb2a927156bd4af8876d616c98f91acd6c5d26e86da27955acf71a19a6634cdd2f274a109f708f0ae3f9768b306b582e3923e5b612560e8f819932367db1859607637b4e5a6c0582d3427bb42c873d720cfac758c0e91b975ce0307b7260218adcf15352c77b4bddb22283a68301d308d4199c970425551133e98e8b31cabfdbb6a2491ed97b020b230797899eae6084a89e1dfd1ebc5544b286a5b8fbb75d9005fdb29a49e63f0aa6aad800a466553411c44c39c596764ec5bb89377d23413985df39e5980de85ab7391c6fd72acf03ced0dfb4466b493081edce4c22df4b99ce033d8da4fb6ee5b6c82385e7e9924669e711677538eece194a778b27cb829dbd9a7fb95cb816c97707a3bc4820faa319f1fe8b06f20fb389c374c49a97d7bc807b32b4d5ff866d416c3e4a97f7ad5dd02db0ff97d32b43cb6a490a69ef1dc9b8c4bcf3c6e21e53971bf8436f53bd800a2bc7cdce06e15d2699b0ca027c220417b0bc86e8c7b4e58244679d16c134f2adff21d1658dfda2eefb5926e1aee109544e98daf30b632e3feaae29f9cd20a0bc659a3ddaac570cb47d08d551f814d9e08be240073bc0cc359b54d0280ef9d20706654deaf6c5257ebfbdafc707a8dcfa7e28cd06856cf91fa3f467b098197b158801dd1843ae6ea44f3f04a9c13b8b27550727058398910903c99b28746c8a5cd6a15c799d5e06b37cceec65464c158993f78b9eba85c3868e4b19e296721140e897f7b861c82b6bdaf0466f61ec241bec5f9ebced972f1be5a4c6050b4673d274bcc3d65b836433e1893faed634649c8035d8c647941212fafb20dda67cd27c6b2f740f8f9bd6a99ca9fb83d01888ab9c9d1e8b19fe68cb870648c41d498e613e982928611d60dd9d5e0d01639f6419f80fc041f597e09b64878a923adc1a2c3905ab31019ae5c772202bdb7f64280438b3f4a9e02e2a4e2f32355c8e6b21d3a8e3a22923d21cac6616c7314999d5c45a582cc935d47848016540b09a107df697152cf35b97a0e3ad2f26316f74d01d5fa6db591b4ed2753bd9ddb30945e429455326e35ac84b18afbbc453850572880e70eb43b8a804b18c7c7252ba7b5dd9d6cdbc2215084a7f10c6c83d23cff7f07ace2f04a1bb7f65884ac8713e65baf4fba0a609051d181cea31c7a550a414770f0161bf4540392c56667129401d9d4caee7aa10b416ad5d8a8523eb6044396dfc248b2c265813de4c59f21b7d733279aa28a4119bcc882c3f4ca0df9bd9ca0993f26e29aecf5ecd1be7f505afc06f91c9f7a7946c38634ae56ef079af0395dee92dcb8e4f543201c0b5907e98ff6e53cb0582fb8a3e55c4fefa34b17f9283d1902ecb6add08556113032d89653c46d5e62bbeb9c6d7c273a12847ee92a465cb8f710838568ad68a91d729f452103035b79c8187b02703507e102ad6c7e2256f0c855a61a327fee66d80e4d34d580c78ed5c5be108de27c36f3b447afa9775dc02a4d4418e0e28ee74777661569ee480f258e672b30f5fcfa48cf38aacca8c0ffb22a62aa197271ce586593c11db01ea186b7aff1d4bf4b5fb43ccb77656a731433a866496789c3ca8a468b95e72842104f3ddecf451c4eecf93c95307a18f1fd948e492a8cae86dd10551ab260fab3ec657c9c9ac13033f565b95cc39135defc6a1bdef287f4a5d46054c97f58280000d5d3c5a2926fdcfaabb38609720aa0bf1ea919bf9f309ddca47bf52fb0df3c269ba572d873ee5f2bf21059028c9553ee4a76db351a77327fa2bbb81cbacd19ed03aa309d23b5248abbdb2a8587a1469e9ac4562b6db763382b36db942e9b6ce52aeaf7d34c0d364fc34b12e6c231d67d0192590b681262929afecdf8b788d0df12f972fd92ff1d51e9aa9e6d526bc4326cdb102c185859ba8813ffccf91f4d263220601f2ecb0d7d8aadadf428363105b04af33a822fd81326d958633d42f7efeff5c9b6de1f7ac0371e18c885663fff033f87ea874b64c38980408b8c1968ac07f51eab0c1e7d39f98aba2503a86bb3f28160e0ae6405aa6c785d6ead75f0bd671b27205d6dcd5e369f1acdb2fef7c25998962b23d044a289dd7b6d4c99a553395fb2c68822049296b275b2bc61787b4d7e306fde60b01dab527b451975b1f368c3bdaecb5f15895eba56a84608bbacb9bc8f25e043c12fe3c3b4aa7c7cee06f6ba7d0a00b9f742db765ec4cc5bb46fc1e198c868921e76829be176bb3f803938fd3ec6778f5c852719e7e83f0431c7ff967eebaafba83ad478ffbf7065c73e0a855612ac4d603acd35807dff5000057bd83a928f0d31e57bd7e27374ffc506cb6e5b711cfe56cbc76e8901da8b03122d241ebaa95d06c2479d2382b6dd65557d6a6ab8e08435ad92b22b1d245d192ad66a9f382d7decd59f8d5bc7e52259f27b928345aff9c3b9d727ffb2d9108a2455cd648eaa21385794c224f1e6050f37002867eb3772bd3ddf1f0de5863e9739d1727a4f650eff14f7b174d6ad704dede7ea190190026625c708161c8ae8622c1f47b63593613375ee1829bed0561991708f6f2195bd4e7ce379dd36b52d2bfcb0007a0c3aae86abced0961fa40882400534ba0cb6c7ce0096dbae6e1c0f1dcaa00432493db9feff40df26a2a548e14572203392a0cf865405ff0e7750c6f451f260a0b3da0f759b71a8d9af195c353af063bb769fc55d05308ecea4a54b6cd6a92479c3838f80f1ca9567308abb6a160ba021a1a9b6bee07cd60a75fe7b1fd2208d9683114a4ecdc1927f242c61734b4b3679ce032afb67834d71740e16281a3d6edd0565880cfa933f9b2cf5c0f07a2a2f8432ae24e16f65ad8aba58160402768812ff269c3636be2faa9a0efeea9f2ef02d865de238f8afa1e6888f1934406f58cac76595acc2ae2476c3827ba5d937366813a360cf6a14f8e5ecadd828632a16aa82f1da6fc84a5ee719d05a70555c62c6f23e4f312d5e348352712c73cfce4594887d76d569530220b7d3ce02869e5da2fda853335db997877cbb60e5aaf2015613e671ff7a27baa98af43eddfb0c6f6aa17dc1525101c07d960acdbc071c893c2418ae3bdfa111f579d4257495c3d7eaf142d004a80bb27d9634cc7359bc7a8bdcad41e183696c858adbb5a91a5776a032d081850c0342106e842c76ff2375d908db3510673f65b0f663c32ce38898efe9f3cc43d4691c3175b7f8e32dae48da2d9fa4f7290c89304197bd7b717ce140f3735c49c8e8d93ccef72819c109ce284b044ab7d8760b79cbaae91bafe2e29e7ab1395f73fa9dd74fd40ca00ba69bc51234dbc8543c39fadbf1bd1f289b9201e205af184ee758446d48678451d7d6a23c013d6438eec31b30c2cf0a6bb9e747348ad39cac61791ebb9045ea11ce5493466edbc92175d34667c2c4f2663a5122ebd124f", 0x1000}, {&(0x7f00000011c0)="3f4f16eb8103b8dfb867ba550046d1131a7d0119e8d1dc13bc695f2ebd6bec2bb4f701178f1f02499f62128ab41d", 0x2e}, {&(0x7f0000001200)="7325522df2601f579e01d3c9c33a5f78267e3d651d007ab7af83a7a32561cf6a4dcf129cac9676762eefc68ce284a40f5fe1a6631c099c618025c736984ce1e69c04ccc21120eeecddffa83d44e95640f170f2ebca78f9c0", 0x58}, {&(0x7f0000001280)="4623db22a0b6b680d59307a735507838c3b75ffa24b15f77f87e1c303591ebff803f2be23e2a395cacd00d486da2b2ade7347263b2e01c", 0x37}], 0x7, 0xd) ioctl$TIOCGSID(r0, 0x5429, &(0x7f0000000040)=0x0) kcmp(r2, r3, 0x1, r1, r1) ioctl$KVM_SET_NR_MMU_PAGES(r0, 0x9204, 0xf0b1) 2018/05/12 22:58:21 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}, 0xf}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) 2018/05/12 22:58:21 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140)}, 0x2) [ 780.605305] binder: 23325:23343 BC_FREE_BUFFER u0000000000000000 no match 2018/05/12 22:58:21 executing program 3: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x6000000000000, 0x0, 0x12, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:58:21 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x1c, 0x0, &(0x7f0000000040)=[@request_death={0x400c630e}, @free_buffer={0x40086303}], 0x9510, 0x0, &(0x7f0000000080)}) 2018/05/12 22:58:21 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00, 0xeffdffff}]) [ 780.781614] binder: 23368:23370 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 780.822593] binder: 23368:23370 BC_FREE_BUFFER u0000000000000000 no match [ 780.875503] binder: 23368:23377 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 780.884093] binder: 23368:23377 BC_FREE_BUFFER u0000000000000000 no match 2018/05/12 22:58:22 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0x0, 0x0, 0x252, 0x300000000000000]}) 2018/05/12 22:58:22 executing program 5: r0 = socket(0xa, 0x1, 0x0) getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f0000000240)={{{@in=@broadcast, @in6=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@dev}, 0x0, @in6=@dev}}, &(0x7f0000000340)=0xe8) getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000380)={{{@in=@multicast1, @in6=@ipv4={[], [], @local}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6}, 0x0, @in6=@mcast2}}, &(0x7f0000000480)=0xe8) setsockopt$inet6_IPV6_IPSEC_POLICY(r0, 0x29, 0x22, &(0x7f00000004c0)={{{@in6=@mcast2={0xff, 0x2, [], 0x1}, @in, 0x4e20, 0x3, 0x4e23, 0x0, 0xa, 0x20, 0xa0, 0x67, r1, r2}, {0x801, 0x100000001, 0x1, 0x32194955, 0x8, 0x7, 0x1f, 0x8}, {0x7fe000000000000, 0x9, 0x6f, 0x56bd4577}, 0x401, 0x6e6bb2, 0x2, 0x0, 0x2}, {{@in6=@loopback={0x0, 0x1}, 0x4d3}, 0xa, @in6=@mcast2={0xff, 0x2, [], 0x1}, 0x3503, 0x1, 0x2, 0x5, 0x1ff, 0x2, 0x1000}}, 0xe8) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f00000000c0)={0x0, 0x3, 0x0, 0x20001000}) 2018/05/12 22:58:22 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140)}, 0xfffffffe) 2018/05/12 22:58:22 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}, 0x8a9}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) 2018/05/12 22:58:22 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00, 0x3000000}]) 2018/05/12 22:58:22 executing program 3: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0xff01, 0x0, 0x12, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:58:22 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='dctcp\x00', 0x6) sendto$inet6(r0, &(0x7f00004e8000), 0xf401, 0x20000001, &(0x7f000007f000)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3]}}, 0x1c) 2018/05/12 22:58:22 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x1c, 0x0, &(0x7f0000000040)=[@request_death={0x400c630e}, @free_buffer={0x40086303}], 0x6c, 0x0, &(0x7f0000000080)}) 2018/05/12 22:58:22 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0x0, 0x0, 0x252, 0x1100000000000000]}) 2018/05/12 22:58:22 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}, 0x9effffff00000000}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) [ 781.573584] binder: 23390:23397 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 781.609518] binder: 23390:23397 BC_FREE_BUFFER u0000000000000000 no match 2018/05/12 22:58:22 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00, 0x7f000000}]) 2018/05/12 22:58:22 executing program 3: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x600, 0x0, 0x12, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:58:22 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140)}, 0x1800000000000000) [ 781.632425] binder: 23390:23406 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 2018/05/12 22:58:22 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0x0, 0x0, 0x252, 0x1c000000]}) [ 781.688878] binder: 23390:23406 BC_FREE_BUFFER u0000000000000000 no match 2018/05/12 22:58:22 executing program 5: r0 = socket$kcm(0x29, 0x6, 0x0) ioctl$sock_kcm_SIOCKCMATTACH(r0, 0x89e0, &(0x7f0000000000)={0xffffffffffffffff, r0}) 2018/05/12 22:58:23 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}, 0x200000000000000}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) 2018/05/12 22:58:23 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00, 0x4000000}]) 2018/05/12 22:58:23 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140)}, 0x100000000000000) 2018/05/12 22:58:23 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0x0, 0x0, 0x252, 0x32]}) 2018/05/12 22:58:23 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x1c, 0x0, &(0x7f0000000040)=[@request_death={0x400c630e}, @free_buffer={0x40086303}], 0x1093, 0x0, &(0x7f0000000080)}) 2018/05/12 22:58:23 executing program 3: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x10000000, 0x0, 0x12, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:58:23 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='dctcp\x00', 0x6) sendto$inet6(r0, &(0x7f00004e8000), 0xf401, 0x20000001, &(0x7f000007f000)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4]}}, 0x1c) 2018/05/12 22:58:23 executing program 5: r0 = socket(0x10, 0x802, 0x0) ioctl(r0, 0x3, &(0x7f0000000080)="c626262c8523bf012cf66f") r1 = socket$inet(0x2, 0x2, 0x0) bind$inet(r1, &(0x7f0000eed000)={0x2, 0x104e21}, 0x10) syz_emit_ethernet(0x423, &(0x7f000018f000)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @empty=[0x0, 0x0, 0x14], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x415, 0x0, 0x0, 0x0, 0x11, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}, @dccp={{0x0, 0x4e21, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, "d73cde", 0x0, "f53475"}, "b441d632cdbbcb211363807aec73d3883762a61dc02d349bfa3ac974b987aa7fb97eb324d594fbbb77bab759418aa8d451d921e8f5d2cf2b08292111701192e97cac366dd3eb2e0fb039e58314ef4709c5f3556db6a1ab6b4fb2bdd83cdc26e8395ec4984ec3faf71a611d1569545d654cded93be827a85188b803c19c1b56aab522862a718b81e512b49690994d3425e33bd93f0e744c66a083c1f9f1bd7bb8f9e123c08f3f041ed3fdc058136cf0071a47cc0e38720a12e11e842a7b5b26dff07f578fdb9a7b14662a625c1ee76c41ccb2b1fc6376aa718e1067b9e4af511ef5b360dbfad326108bb033db193dab27974eb8c462739eaee51d87f31c516e7e391073770da3202e02c41a7277c847df24bd5b0a7ab6e252f3c8ebf00688cc55311d887e8bfd95a7f4c6a126af3fe26714ddb869c66d18f870631bbd497e8a06881b754ecdcdd0dcffc51cd52a6b560f8d64b63a1674745edc5f53b18a8ffcc5c2fbc4d2bbcc2faf3c189d9b36c0655d1394f5c127ec86b8a764a87b546c2b6ac37d0a8ec3edd7cda6f930570763dbdc0640d219749bd57c7c89eaadfdae41d654a46b17be069a32a7d94d29b612fbe61b8bd11a2d10ba5d4ac7014fc0465c3f144598bd1f913343e7293711040eee0ae8df1e49f04ed1037d4b742aed0e932116060aaf6b985238d2e10fb5b11d19d7801befed4833287d96a85a7cdd9e211a672760335655576fc0fa0336621c2b2b1018ef71bb5077c67ee5fa8d479d6776013363e98b1f1213712be7e47549b6035459008c509f0f983130a451531381ee3c1ab9e1cbb8e558b56ca1a70939389addc5f9632b37ff3f634abb504bb0be0a51649683f6e29588c15cda40255e173328681884ffef6729e9058c5623e1401fdcc7b8cb5623a8fd725fbeea05fc417c44e46500619218dff7c70aa068994c58883cada505a2aa85b6620dfe9c45b707c9aa1222b86972eae564b28a05ddfa3545df231fde2707d4bf67dc6ba41daba91dee8081e5c7e2bcfbebebd42d5ab8a32d6e098fd57233e3b813dc0d772134775def451823b7fef2bc93da01722cd613b9a3db7e2d4c51fb7b56006ee9cea53b62343599a56167388d45247f9289fb1cab67a7cb0c3665ddf1e1411875b4de3428b32fc6603691a023d8e4cb93c667acb7b535fb5f77af9a49640cbe8ffe3a193cf4df1b556a67cb753c60bdf978b871aa513c07074c6602037ebc32199290e3c7ac6f103ad9358951ad4de0c8f1b34951b0e6a48295975cf08b2c3c95064855fc95317e386f1c18608d1d08699003c998b93332cd316f17a5139d350cbfa9dabc3f77c4197a0186e50913978e980a7a028e7ccdeee718af028200e94a6b3a0ec93ba14b0c64dfaf3967e230d8cf876f26287d436ebc9588b52b43f2380836bfe3"}}}}}, 0x0) syz_emit_ethernet(0x2a, &(0x7f000000a000)={@broadcast=[0xff, 0xe0, 0xff, 0xff, 0xff, 0xff], @empty=[0x0, 0x0, 0x14], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x11, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}, @udp={0x0, 0x4e21, 0x8}}}}}, 0x0) r2 = semget$private(0x0, 0x0, 0x60a) semctl$GETVAL(r2, 0x7, 0xc, &(0x7f00000000c0)=""/216) recvfrom$inet(r1, &(0x7f0000000200)=""/4096, 0x3f9, 0x0, 0x0, 0x0) socketpair$inet_dccp(0x2, 0x6, 0x0, &(0x7f0000000040)) [ 782.567272] binder: 23446:23448 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 782.589356] binder: 23446:23448 BC_FREE_BUFFER u0000000000000000 no match 2018/05/12 22:58:23 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}, 0xa908000000000000}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) 2018/05/12 22:58:23 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140)}, 0x1f00000000000000) 2018/05/12 22:58:23 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0x0, 0x0, 0x252, 0x2c00000000000000]}) 2018/05/12 22:58:23 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00, 0xe4ffffff}]) 2018/05/12 22:58:23 executing program 3: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x81070000, 0x0, 0x12, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) [ 782.612382] binder: 23446:23462 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 2018/05/12 22:58:23 executing program 5: mkdir(&(0x7f00000013c0)='./file0/\x00', 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x0, 0x0, 0x31}, 0x2c) r0 = syz_open_dev$sndpcmc(&(0x7f00000000c0)='/dev/snd/pcmC#D#c\x00', 0x7, 0x1) ioctl$KVM_GET_TSC_KHZ(r0, 0xaea3) mount(&(0x7f0000000180)='./file0/', &(0x7f00000001c0)='./file0/', &(0x7f0000000240)="70726f63009b6a2c823f92ab1d5b2f50155c21b4ddadd93db479216becc16f47afb3aec6b4d757eac0a6344afd1c23c0a8de0802dd112a9abf61c3ae458640c0ec61baa4c00d684cd95e0be68153c4adca5e45190c3aa5f8ae16d793a4a983e9", 0x0, 0x0) mkdir(&(0x7f0000000000)='./file0/', 0x0) mount(&(0x7f0000000000)='.', &(0x7f0000000040)='.', &(0x7f0000000080)='cgroup\x00', 0x5010, &(0x7f00000000c0)) mount(&(0x7f0000000300)='./file0/\x00', &(0x7f0000000340)='./file0/\x00', &(0x7f0000000380)='proc\x00', 0x1000000, &(0x7f00000003c0)) [ 782.642099] binder: 23446:23462 BC_FREE_BUFFER u0000000000000000 no match 2018/05/12 22:58:23 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x1c, 0x0, &(0x7f0000000040)=[@request_death={0x400c630e}, @free_buffer={0x40086303}], 0x400000000000000, 0x0, &(0x7f0000000080)}) 2018/05/12 22:58:23 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}, 0xfffff000}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) [ 782.815456] binder: 23486:23487 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 782.883518] binder: 23486:23487 BC_FREE_BUFFER u0000000000000000 no match [ 782.894804] binder: 23486:23497 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 782.902297] binder: 23486:23497 BC_FREE_BUFFER u0000000000000000 no match 2018/05/12 22:58:24 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0x0, 0x0, 0x252, 0x2f00000000000000]}) 2018/05/12 22:58:24 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00, 0xe}]) 2018/05/12 22:58:24 executing program 5: syz_open_dev$vcsa(&(0x7f0000616000)='/dev/vcsa#\x00', 0x5, 0x0) setsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000000)={{{@in6=@loopback={0x0, 0x1}, @in6=@local={0xfe, 0x80, [], 0xffffffffffffffff}}, {0x0, 0x0, 0x0, 0x0, 0x5}}, {{@in6=@mcast1={0xff, 0x1, [], 0x1}}, 0x0, @in=@dev={0xac, 0x14}}}, 0xe8) socketpair$ax25(0x3, 0x5, 0xf0, &(0x7f0000000100)) 2018/05/12 22:58:24 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140)}, 0xc0ffffff00000000) 2018/05/12 22:58:24 executing program 3: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x3000000, 0x0, 0x12, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:58:24 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}, 0xf0}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) 2018/05/12 22:58:24 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='dctcp\x00', 0x6) sendto$inet6(r0, &(0x7f00004e8000), 0xf401, 0x20000001, &(0x7f000007f000)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68cc7b6]}}, 0x1c) 2018/05/12 22:58:24 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x1c, 0x0, &(0x7f0000000040)=[@request_death={0x400c630e}, @free_buffer={0x40086303}], 0xa000000, 0x0, &(0x7f0000000080)}) [ 783.521732] binder: 23515:23516 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 2018/05/12 22:58:24 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0x0, 0x0, 0x252, 0x88ffffff]}) 2018/05/12 22:58:24 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00, 0x10}]) 2018/05/12 22:58:24 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140)}, 0x1000000) 2018/05/12 22:58:24 executing program 3: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0xfffffffb, 0x0, 0x12, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:58:24 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}, 0x100007f}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) [ 783.562317] binder: 23515:23516 BC_FREE_BUFFER u0000000000000000 no match 2018/05/12 22:58:24 executing program 5: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX_OLD(r0, 0x84, 0x6b, &(0x7f00000000c0)=[@in6={0xa, 0x4e20, 0x8, @dev={0xfe, 0x80, [], 0x13}, 0x4}, @in={0x2, 0x4e21, @multicast1=0xe0000001}, @in6={0xa, 0x4e23, 0x7f, @remote={0xfe, 0x80, [], 0xbb}, 0x7}, @in6={0xa, 0x4e21, 0x400, @mcast1={0xff, 0x1, [], 0x1}}], 0x64) setsockopt$inet6_mreq(r1, 0x29, 0x1b, &(0x7f0000000080)={@remote={0xfe, 0x80, [], 0xbb}}, 0x14) r2 = socket(0x10, 0x3, 0x0) write(r2, &(0x7f00000000c0), 0x0) write(r2, &(0x7f0000000240)="130000003e001fffffe3ffbd000026180a3f02", 0x13) [ 783.622295] binder: 23515:23530 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 783.687304] binder: 23515:23530 BC_FREE_BUFFER u0000000000000000 no match 2018/05/12 22:58:25 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140)}, 0xa00) 2018/05/12 22:58:25 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0x0, 0x0, 0x252, 0x1000000]}) 2018/05/12 22:58:25 executing program 3: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0xf4ffffff00000000, 0x0, 0x12, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:58:25 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00, 0x4}]) 2018/05/12 22:58:25 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x1c, 0x0, &(0x7f0000000040)=[@request_death={0x400c630e}, @free_buffer={0x40086303}], 0x4c00, 0x0, &(0x7f0000000080)}) 2018/05/12 22:58:25 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}, 0x9effffff}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) 2018/05/12 22:58:25 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='dctcp\x00', 0x6) sendto$inet6(r0, &(0x7f00004e8000), 0xf401, 0x20000001, &(0x7f000007f000)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x300000000000000]}}, 0x1c) 2018/05/12 22:58:25 executing program 5: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x31, 0xffffffffffffffff, 0x0) r0 = mq_open(&(0x7f0000000000)="7d6d643573756d626465765bd200", 0x0, 0xc2, &(0x7f0000000040)={0x5, 0x2, 0x7fffffff, 0x8, 0xac5, 0x8, 0x0, 0x5}) write$binfmt_elf32(r0, &(0x7f0000000080)={{0x7f, 0x45, 0x4c, 0x46, 0xffffffff, 0xffff, 0x80000001, 0xdc, 0x7419, 0x3, 0x3f, 0xfffffffffffffffe, 0x27f, 0x38, 0x2d5, 0xfb2, 0x3, 0x20, 0x2, 0x8001, 0x9, 0x5}, [{0x7, 0x2, 0x1, 0x0, 0x8, 0x3ff, 0x8}, {0x60000007, 0x0, 0x0, 0x5, 0x9, 0x0, 0x101, 0x2}], "96f90699c700376001c127905651d521f70856d6a8d181b611f6b88cc505497963a3857c9d8d61a5262b181fdc591bd5815c3a3cd49d100904c19b1b56ef29ebc62d2e0a1352af5771c15a620579274cc30dc0d2e8a58cd9595dc1065265ca7ded20f716227816012b0c45c402738a0a6fb3432163b1cf769c4824909b8ce229564a631a868871e9d4bd5f4343c2d2a884479d77", [[], []]}, 0x30c) prctl$setname(0xf, &(0x7f0000a9aff2)="6c6f2c70726f635c4750572af493") [ 784.480364] binder: 23564:23574 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 2018/05/12 22:58:25 executing program 3: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0xf2, 0x0, 0x12, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:58:25 executing program 5: r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040)='/dev/hwrng\x00', 0x200000, 0x0) socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000080)="c68100000023bf012cf66f") move_pages(0x0, 0x87, &(0x7f0000000040), &(0x7f0000000040), &(0x7f0000000080), 0xfffffffffffffffe) 2018/05/12 22:58:25 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140)}, 0xa) 2018/05/12 22:58:25 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00, 0xa8030000000000}]) 2018/05/12 22:58:25 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='dctcp\x00', 0x6) sendto$inet6(r0, &(0x7f00004e8000), 0xf401, 0x20000001, &(0x7f000007f000)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200000000000000]}}, 0x1c) 2018/05/12 22:58:25 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}, 0x400300}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) 2018/05/12 22:58:25 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0x0, 0x0, 0x252, 0x2b000000]}) [ 784.521379] binder: 23564:23574 BC_FREE_BUFFER u0000000000000000 no match [ 784.586277] binder: 23564:23591 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 2018/05/12 22:58:25 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00, 0xfbffffff}]) [ 784.642665] binder: 23564:23591 BC_FREE_BUFFER u0000000000000000 no match 2018/05/12 22:58:25 executing program 5: move_pages(0x0, 0x200001e1, &(0x7f0000000080), 0x0, &(0x7f00000000c0)=[0x0, 0x0], 0x0) arch_prctl(0x2002, &(0x7f0000000180)) r0 = dup3(0xffffffffffffff9c, 0xffffffffffffff9c, 0x80000) ioctl$KVM_UNREGISTER_COALESCED_MMIO(r0, 0x4010ae68, &(0x7f0000000080)={0x6, 0x4000}) r1 = fcntl$dupfd(0xffffffffffffff9c, 0x0, 0xffffffffffffff9c) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r1, 0xc01064b5, &(0x7f0000000040)={&(0x7f0000000000)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x8}) 2018/05/12 22:58:25 executing program 3: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x1840000, 0x0, 0x12, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:58:25 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}, 0x34000}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) 2018/05/12 22:58:25 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x1c, 0x0, &(0x7f0000000040)=[@request_death={0x400c630e}, @free_buffer={0x40086303}], 0x94ed0300, 0x0, &(0x7f0000000080)}) 2018/05/12 22:58:25 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140)}, 0xe00000000000000) [ 784.806128] binder: 23619:23622 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 784.865261] binder: 23619:23622 BC_FREE_BUFFER u0000000000000000 no match [ 784.899081] binder: 23619:23634 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 784.910137] binder: 23619:23634 BC_FREE_BUFFER u0000000000000000 no match 2018/05/12 22:58:26 executing program 5: move_pages(0x0, 0x200001e1, &(0x7f0000000080), 0x0, &(0x7f00000000c0)=[0x0, 0x0], 0x0) arch_prctl(0x2002, &(0x7f0000000180)) r0 = dup3(0xffffffffffffff9c, 0xffffffffffffff9c, 0x80000) ioctl$KVM_UNREGISTER_COALESCED_MMIO(r0, 0x4010ae68, &(0x7f0000000080)={0x6, 0x4000}) r1 = fcntl$dupfd(0xffffffffffffff9c, 0x0, 0xffffffffffffff9c) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r1, 0xc01064b5, &(0x7f0000000040)={&(0x7f0000000000)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x8}) 2018/05/12 22:58:26 executing program 3: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x3100, 0x0, 0x12, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:58:26 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}, 0x7f00000100000000}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) 2018/05/12 22:58:26 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='dctcp\x00', 0x6) sendto$inet6(r0, &(0x7f00004e8000), 0xf401, 0x20000001, &(0x7f000007f000)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfc00000000000000]}}, 0x1c) 2018/05/12 22:58:26 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140)}, 0x400000000000000) 2018/05/12 22:58:26 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0x0, 0x0, 0x252, 0x2100]}) 2018/05/12 22:58:26 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x1c, 0x0, &(0x7f0000000040)=[@request_death={0x400c630e}, @free_buffer={0x40086303}], 0x700, 0x0, &(0x7f0000000080)}) 2018/05/12 22:58:26 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00, 0xfffffffb}]) 2018/05/12 22:58:27 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140)}, 0x2000000) 2018/05/12 22:58:27 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}, 0xaa593a576e000000}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) 2018/05/12 22:58:27 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='dctcp\x00', 0x6) sendto$inet6(r0, &(0x7f00004e8000), 0xf401, 0x20000001, &(0x7f000007f000)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40000000]}}, 0x1c) 2018/05/12 22:58:27 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0x0, 0x0, 0x252, 0x2f00]}) [ 786.411597] binder: 23650:23652 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 786.446914] binder: 23650:23652 BC_FREE_BUFFER u0000000000000000 no match [ 786.496320] binder: 23650:23664 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 786.551320] binder: 23650:23664 BC_FREE_BUFFER u0000000000000000 no match 2018/05/12 22:58:28 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}, 0xc0ffffff00000000}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) 2018/05/12 22:58:28 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00, 0xfeffffff00000000}]) 2018/05/12 22:58:28 executing program 3: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x8900, 0x0, 0x12, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:58:28 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='dctcp\x00', 0x6) sendto$inet6(r0, &(0x7f00004e8000), 0xf401, 0x20000001, &(0x7f000007f000)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000000]}}, 0x1c) 2018/05/12 22:58:28 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140)}, 0xfd000000) 2018/05/12 22:58:28 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0x0, 0x0, 0x252, 0x3]}) 2018/05/12 22:58:28 executing program 5: move_pages(0x0, 0x200001e1, &(0x7f0000000080), 0x0, &(0x7f00000000c0)=[0x0, 0x0], 0x0) arch_prctl(0x2002, &(0x7f0000000180)) r0 = dup3(0xffffffffffffff9c, 0xffffffffffffff9c, 0x80000) ioctl$KVM_UNREGISTER_COALESCED_MMIO(r0, 0x4010ae68, &(0x7f0000000080)={0x6, 0x4000}) r1 = fcntl$dupfd(0xffffffffffffff9c, 0x0, 0xffffffffffffff9c) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r1, 0xc01064b5, &(0x7f0000000040)={&(0x7f0000000000)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x8}) 2018/05/12 22:58:28 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x1c, 0x0, &(0x7f0000000040)=[@request_death={0x400c630e}, @free_buffer={0x40086303}], 0x2, 0x0, &(0x7f0000000080)}) [ 787.439397] binder: 23693:23694 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 2018/05/12 22:58:28 executing program 3: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0xd00000000000000, 0x0, 0x12, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:58:28 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140)}, 0xe000000) 2018/05/12 22:58:28 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='dctcp\x00', 0x6) sendto$inet6(r0, &(0x7f00004e8000), 0xf401, 0x20000001, &(0x7f000007f000)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff0f]}}, 0x1c) 2018/05/12 22:58:28 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0x0, 0x0, 0x252, 0x400000000000000]}) 2018/05/12 22:58:28 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00, 0xe000000000000}]) 2018/05/12 22:58:28 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}, 0x8000000000000000}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) [ 787.491664] binder: 23693:23694 BC_FREE_BUFFER u0000000000000000 no match [ 787.535507] binder: 23693:23709 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 787.610388] binder: 23693:23709 BC_FREE_BUFFER u0000000000000000 no match 2018/05/12 22:58:29 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0x0, 0x0, 0x252, 0x100000000000000]}) 2018/05/12 22:58:29 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00, 0x1000000000000}]) 2018/05/12 22:58:29 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}, 0xf00}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) 2018/05/12 22:58:29 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140)}, 0x4000000) 2018/05/12 22:58:29 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x1c, 0x0, &(0x7f0000000040)=[@request_death={0x400c630e}, @free_buffer={0x40086303}], 0x10, 0x0, &(0x7f0000000080)}) 2018/05/12 22:58:29 executing program 3: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x8000000000000000, 0x0, 0x12, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:58:29 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='dctcp\x00', 0x6) sendto$inet6(r0, &(0x7f00004e8000), 0xf401, 0x20000001, &(0x7f000007f000)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa00]}}, 0x1c) 2018/05/12 22:58:29 executing program 5: ioctl(0xffffffffffffffff, 0x8912, &(0x7f0000000280)="c6295e4eca6c09b612ec6f") getpriority(0x3, 0x0) 2018/05/12 22:58:29 executing program 5: unshare(0x60000003) r0 = socket$inet(0x2, 0x806, 0xffffffff00000001) setsockopt$IP_VS_SO_SET_STARTDAEMON(r0, 0x0, 0x48b, &(0x7f0000000000)={0x1, 'syzkaller1\x00', 0x3}, 0x18) r1 = socket$netlink(0x10, 0x3, 0x1f) r2 = openat$audio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/audio\x00', 0x8000, 0x0) accept4$packet(r2, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, &(0x7f00000000c0)=0x14, 0x0) writev(r1, &(0x7f0000000100)=[{&(0x7f0000000140)="2900000018001980013d75241a0407210206e30067ffbd010a0000000800050000000200080000bf00", 0x29}], 0x1) [ 788.553610] binder: 23741:23750 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 788.576582] binder: 23741:23750 BC_FREE_BUFFER u0000000000000000 no match 2018/05/12 22:58:29 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140)}, 0x1f00) 2018/05/12 22:58:29 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}, 0xa00}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) 2018/05/12 22:58:29 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00, 0xfbffffff00000000}]) 2018/05/12 22:58:29 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0x0, 0x0, 0x252, 0x89ffffff]}) 2018/05/12 22:58:29 executing program 3: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0xe000000000000, 0x0, 0x12, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) [ 788.630134] binder: 23741:23762 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 2018/05/12 22:58:29 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='dctcp\x00', 0x6) sendto$inet6(r0, &(0x7f00004e8000), 0xf401, 0x20000001, &(0x7f000007f000)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfec0000000000000]}}, 0x1c) [ 788.711140] binder: 23741:23762 BC_FREE_BUFFER u0000000000000000 no match 2018/05/12 22:58:29 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140)}, 0xfd) 2018/05/12 22:58:29 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}, 0x6e573a59aa}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) 2018/05/12 22:58:29 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x1c, 0x0, &(0x7f0000000040)=[@request_death={0x400c630e}, @free_buffer={0x40086303}], 0x6000000, 0x0, &(0x7f0000000080)}) 2018/05/12 22:58:29 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00, 0x8000000000000000}]) [ 788.897774] binder: 23804:23810 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 788.948396] binder: 23804:23810 BC_FREE_BUFFER u0000000000000000 no match [ 788.978403] binder: 23804:23816 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 2018/05/12 22:58:29 executing program 3: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x1000000000000, 0x0, 0x12, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:58:29 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0x0, 0x0, 0x252, 0x32000000]}) 2018/05/12 22:58:29 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}, 0x0, 0xf000000}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) 2018/05/12 22:58:29 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140)}, 0xa00000000000000) 2018/05/12 22:58:29 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00, 0x20000000000000}]) 2018/05/12 22:58:29 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='dctcp\x00', 0x6) sendto$inet6(r0, &(0x7f00004e8000), 0xf401, 0x20000001, &(0x7f000007f000)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5000000000000]}}, 0x1c) 2018/05/12 22:58:29 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x1c, 0x0, &(0x7f0000000040)=[@request_death={0x400c630e}, @free_buffer={0x40086303}], 0x7a000000, 0x0, &(0x7f0000000080)}) 2018/05/12 22:58:29 executing program 5: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x8000000000000000, 0x0, 0x12, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) [ 789.008802] binder: 23804:23816 BC_FREE_BUFFER u0000000000000000 no match 2018/05/12 22:58:29 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0x0, 0x0, 0x252, 0x3300]}) 2018/05/12 22:58:29 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}, 0x0, 0xfcffffff}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) 2018/05/12 22:58:29 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140)}, 0xc0ffffff) 2018/05/12 22:58:29 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00, 0x40000}]) 2018/05/12 22:58:29 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$evdev(&(0x7f0000072fee)='/dev/input/event#\x00', 0x0, 0x0) ioctl$EVIOCSCLOCKID(r0, 0x400445a0, &(0x7f0000000100)=0x7) r1 = openat$null(0xffffffffffffff9c, &(0x7f0000000040)='/dev/null\x00', 0x0, 0x0) ioctl$EVIOCGABS3F(r0, 0x8018457f, &(0x7f00000002c0)=""/161) ioctl$SNDRV_SEQ_IOCTL_SET_CLIENT_INFO(r1, 0x40bc5311, &(0x7f0000000200)={0x3, 0x1, 'client0\x00', 0xffffffff80000000, "123d599b48fec795", "f3ceac5e97a258440d472ec8d001ae51c44ad6beaed77479c6f63a375cbcc676", 0x7fffffff, 0x5}) setsockopt$l2tp_PPPOL2TP_SO_LNSMODE(r1, 0x111, 0x4, 0x1, 0x4) [ 789.098577] binder: 23839:23841 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 789.147576] binder: 23839:23841 BC_FREE_BUFFER u0000000000000000 no match 2018/05/12 22:58:29 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='dctcp\x00', 0x6) sendto$inet6(r0, &(0x7f00004e8000), 0xf401, 0x20000001, &(0x7f000007f000)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe8030000]}}, 0x1c) 2018/05/12 22:58:29 executing program 3: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x800000, 0x0, 0x12, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) [ 789.228778] binder: 23839:23862 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 789.304728] binder: 23839:23862 BC_FREE_BUFFER u0000000000000000 no match 2018/05/12 22:58:30 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140)}, 0xe00) 2018/05/12 22:58:30 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='dctcp\x00', 0x6) sendto$inet6(r0, &(0x7f00004e8000), 0xf401, 0x20000001, &(0x7f000007f000)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x749521c2]}}, 0x1c) 2018/05/12 22:58:30 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0x0, 0x0, 0x252, 0x2f]}) 2018/05/12 22:58:30 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$evdev(&(0x7f0000072fee)='/dev/input/event#\x00', 0x0, 0x0) ioctl$EVIOCSCLOCKID(r0, 0x400445a0, &(0x7f0000000100)=0x7) r1 = openat$null(0xffffffffffffff9c, &(0x7f0000000040)='/dev/null\x00', 0x0, 0x0) ioctl$EVIOCGABS3F(r0, 0x8018457f, &(0x7f00000002c0)=""/161) ioctl$SNDRV_SEQ_IOCTL_SET_CLIENT_INFO(r1, 0x40bc5311, &(0x7f0000000200)={0x3, 0x1, 'client0\x00', 0xffffffff80000000, "123d599b48fec795", "f3ceac5e97a258440d472ec8d001ae51c44ad6beaed77479c6f63a375cbcc676", 0x7fffffff, 0x5}) setsockopt$l2tp_PPPOL2TP_SO_LNSMODE(r1, 0x111, 0x4, 0x1, 0x4) 2018/05/12 22:58:30 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}, 0x0, 0x300}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) 2018/05/12 22:58:30 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x1c, 0x0, &(0x7f0000000040)=[@request_death={0x400c630e}, @free_buffer={0x40086303}], 0x2000000, 0x0, &(0x7f0000000080)}) 2018/05/12 22:58:30 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00, 0x12}]) 2018/05/12 22:58:30 executing program 3: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x42d4f, 0x0, 0x12, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:58:30 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0x0, 0x0, 0x252, 0xffffff89]}) 2018/05/12 22:58:30 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x8000000000, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f0000000000)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0xfffffffffffffd1f}], 0x209, &(0x7f0000000140)}, 0x0) r1 = syz_open_dev$mice(&(0x7f0000000040)='/dev/input/mice\x00', 0x0, 0x2000) ioctl$ASHMEM_SET_SIZE(r1, 0x40087703, 0x100) 2018/05/12 22:58:30 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}, 0x0, 0xf00}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) [ 789.451981] binder: 23893:23894 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 2018/05/12 22:58:30 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00, 0xfffffffffffffdef}]) 2018/05/12 22:58:30 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) pipe2(&(0x7f0000000700)={0x0, 0x0}, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe5000/0x18000)=nil, &(0x7f0000000100)=[@text64={0x40, &(0x7f0000000000)="0f20e035000002000f22e066ba4000b009ee48b80b000000000000000f23c00f21f83503000a000f23f80f2025b805000000b95cfb2d030f01c166b81a010f00d06526deefc4c2f921d826650f3066ba6100ed", 0x53}], 0xcec, 0x0, &(0x7f0000000540), 0x0) r4 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x1) dup3(r4, r3, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000decfe0)={0x10005, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_VCPU_EVENTS(r3, 0x4040aea0, &(0x7f0000460fe4)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x805}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r4, &(0x7f0000fe8000/0x18000)=nil, &(0x7f00000000c0)=[@text32={0x20, &(0x7f0000000140)="3e9066b894000f00d86566673636df571c660f3840c6ea210000006e000f6fe0c7442400bde4bd82c74424023bfb58adc7442406000000000f011c24b9640800000f32190e66baf80cb8245e848fef66bafc0ced", 0x54}], 0x1, 0x0, &(0x7f00000001c0)=[@cr4={0x1, 0x10020}], 0x1) ioctl$KVM_SET_CPUID(r4, 0x4008ae8a, &(0x7f0000000200)=ANY=[]) ioctl$KVM_RUN(r4, 0xae80, 0x0) 2018/05/12 22:58:30 executing program 3: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0xf5ffffff, 0x0, 0x12, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) [ 789.513195] binder: 23893:23894 BC_FREE_BUFFER u0000000000000000 no match [ 789.552823] binder: 23893:23908 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 2018/05/12 22:58:30 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0x0, 0x0, 0x252, 0xffffffffffffffff]}) 2018/05/12 22:58:30 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}, 0x0, 0xa}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) [ 789.611913] binder: 23893:23908 BC_FREE_BUFFER u0000000000000000 no match 2018/05/12 22:58:30 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) openat$vsock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vsock\x00', 0x800, 0x0) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640), 0x0, &(0x7f0000000140)}, 0x0) 2018/05/12 22:58:30 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00, 0xeffdffffffffffff}]) 2018/05/12 22:58:30 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x1c, 0x0, &(0x7f0000000040)=[@request_death={0x400c630e}, @free_buffer={0x40086303}], 0x300, 0x0, &(0x7f0000000080)}) 2018/05/12 22:58:30 executing program 3: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x6, 0x0, 0x12, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:58:30 executing program 5: prctl$intptr(0x2000000000029, 0x3) mmap(&(0x7f0000cbf000/0x2000)=nil, 0x2000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x25, 0x4000) setsockopt$inet_MCAST_MSFILTER(r0, 0x0, 0x30, &(0x7f0000000040)={0x81, {{0x2, 0x4e23, @multicast1=0xe0000001}}, 0x1, 0x5, [{{0x2, 0x4e21, @local={0xac, 0x14, 0x14, 0xaa}}}, {{0x2, 0x4e24, @local={0xac, 0x14, 0x14, 0xaa}}}, {{0x2, 0x4e23, @loopback=0x7f000001}}, {{0x2, 0x4e21, @multicast1=0xe0000001}}, {{0x2, 0x4e20, @rand_addr}}]}, 0x310) 2018/05/12 22:58:30 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0x0, 0x0, 0x252, 0xfdffffff00000000]}) 2018/05/12 22:58:30 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}, 0x0, 0x100000000000000}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) 2018/05/12 22:58:30 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='dctcp\x00', 0x6) sendto$inet6(r0, &(0x7f00004e8000), 0xf401, 0x20000001, &(0x7f000007f000)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000]}}, 0x1c) 2018/05/12 22:58:30 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140)}, 0x0) r1 = syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x3f, 0x80) ioctl$PPPIOCGCHAN(r1, 0x80047437, &(0x7f0000000040)) 2018/05/12 22:58:31 executing program 5: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu\x00', 0x200002, 0x0) dup(r0) openat$cgroup_int(r0, &(0x7f0000000140)='cpuset.cpu_exclusive\x00', 0x2, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) pselect6(0x40, &(0x7f0000000040)={0x3ffffd}, &(0x7f0000768000)={0x0, 0x0, 0x0, 0xb43}, &(0x7f00007fbfc0)={0x0, 0x2}, &(0x7f0000f22000)={r1, r2+30000000}, &(0x7f0000f14000)={&(0x7f00000000c0), 0x8}) 2018/05/12 22:58:31 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0x0, 0x0, 0x252, 0x600000000000000]}) [ 790.395093] binder: 23953:23956 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 790.424483] binder: 23953:23956 BC_FREE_BUFFER u0000000000000000 no match 2018/05/12 22:58:31 executing program 3: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0xfbffffff00000000, 0x0, 0x12, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:58:31 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@pptp={0x18, 0x2}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140)}, 0xc004) 2018/05/12 22:58:31 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00, 0x3700000000000000}]) 2018/05/12 22:58:31 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}, 0x0, 0xffffff7f00000000}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) 2018/05/12 22:58:31 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='dctcp\x00', 0x6) sendto$inet6(r0, &(0x7f00004e8000), 0xf401, 0x20000001, &(0x7f000007f000)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf4010000]}}, 0x1c) [ 790.453860] binder: 23953:23967 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 790.484738] binder: 23953:23967 BC_FREE_BUFFER u0000000000000000 no match 2018/05/12 22:58:31 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0x0, 0x0, 0x252, 0x3c000000]}) 2018/05/12 22:58:31 executing program 3: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x12000000, 0x0, 0x12, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:58:31 executing program 5: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = syz_open_dev$adsp(&(0x7f0000000040)='/dev/adsp#\x00', 0x1, 0xb9d1e321e09e6044) utimensat(r1, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)={{0x0, 0x2710}, {0x77359400}}, 0x100) 2018/05/12 22:58:31 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00, 0x2000000}]) 2018/05/12 22:58:31 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x1c, 0x0, &(0x7f0000000040)=[@request_death={0x400c630e}, @free_buffer={0x40086303}], 0x7a00, 0x0, &(0x7f0000000080)}) 2018/05/12 22:58:31 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}, 0x0, 0xc0ffffff}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) 2018/05/12 22:58:31 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000140)='ip_vti0\x00', 0x10) fsetxattr(r0, &(0x7f0000000000)=@random={'system.', 'ip_vti0\x00'}, &(0x7f0000000040)='GPL{\x00', 0x5, 0x1) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140)}, 0x0) 2018/05/12 22:58:31 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='dctcp\x00', 0x6) sendto$inet6(r0, &(0x7f00004e8000), 0xf401, 0x20000001, &(0x7f000007f000)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40020000]}}, 0x1c) 2018/05/12 22:58:31 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0x0, 0x0, 0x252, 0x21000000]}) [ 790.791466] binder: 24015:24021 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 790.811191] binder: 24015:24021 BC_FREE_BUFFER u0000000000000000 no match 2018/05/12 22:58:31 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0x0, 0x0, 0x252, 0x1c00]}) 2018/05/12 22:58:31 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00, 0x10000000}]) 2018/05/12 22:58:31 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) getsockopt$inet_sctp_SCTP_STATUS(r0, 0x84, 0xe, &(0x7f00000001c0)={0x0, 0x9e17, 0x101, 0x7, 0x6, 0x9, 0x2, 0x100000, {0x0, @in6={{0xa, 0x4e21, 0x100000001, @remote={0xfe, 0x80, [], 0xbb}, 0xd08}}, 0x2, 0x7, 0x1f, 0x52, 0x8000000000}}, &(0x7f0000000000)=0xb0) setsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r0, 0x84, 0x75, &(0x7f0000000040)={r1, 0x7ff}, 0x8) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140)}, 0x0) [ 790.836154] binder: 24015:24026 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 2018/05/12 22:58:31 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='dctcp\x00', 0x6) sendto$inet6(r0, &(0x7f00004e8000), 0xf401, 0x20000001, &(0x7f000007f000)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa]}}, 0x1c) 2018/05/12 22:58:31 executing program 3: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0xd000000, 0x0, 0x12, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:58:31 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}, 0x0, 0xfffffffc}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) 2018/05/12 22:58:31 executing program 5: r0 = socket(0x10, 0x3, 0x0) r1 = socket(0xa, 0x1, 0x0) ioctl$sock_ifreq(r1, 0x8929, &(0x7f00000000c0)={'ip6gre0\x00', @ifru_settings={0x6, 0x30f, @te1=&(0x7f0000000040)={0x8, 0x7, 0x3f, 0x7}}}) ioctl(r1, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") ioctl$sock_ifreq(r0, 0x89f0, &(0x7f0000000080)={'sit0\x00', @ifru_addrs=@in={0x2, 0x4e20, @rand_addr}}) [ 790.876259] binder: 24015:24026 BC_FREE_BUFFER u0000000000000000 no match 2018/05/12 22:58:31 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0x0, 0x0, 0x252, 0xffffff84]}) 2018/05/12 22:58:32 executing program 7: r0 = socket$inet(0x2, 0x801, 0xfffffffffffffffe) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140)}, 0x0) 2018/05/12 22:58:32 executing program 3: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x1100, 0x0, 0x12, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:58:32 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00, 0x3100}]) 2018/05/12 22:58:32 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}, 0x0, 0x6e573a59aa}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) 2018/05/12 22:58:32 executing program 5: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu\x00', 0x200002, 0x0) r1 = openat$cgroup_int(r0, &(0x7f0000000100)='cpuset.cpus\x00', 0x2, 0x0) socketpair$inet_udp(0x2, 0x2, 0x0, &(0x7f0000000080)) write$cgroup_int(r1, &(0x7f0000000040)={[0x38, 0x3a]}, 0x2) 2018/05/12 22:58:32 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x1c, 0x0, &(0x7f0000000040)=[@request_death={0x400c630e}, @free_buffer={0x40086303}], 0x2000, 0x0, &(0x7f0000000080)}) 2018/05/12 22:58:32 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='dctcp\x00', 0x6) sendto$inet6(r0, &(0x7f00004e8000), 0xf401, 0x20000001, &(0x7f000007f000)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe]}}, 0x1c) 2018/05/12 22:58:32 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0x0, 0x0, 0x252, 0x3c00000000000000]}) 2018/05/12 22:58:32 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/autofs\x00', 0x80, 0x0) futimesat(r1, &(0x7f0000000140)='./file0\x00', &(0x7f00000001c0)) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) futimesat(r1, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)) pselect6(0x40, &(0x7f00000002c0)={0x9, 0x80000000, 0x9, 0x27bf05c3, 0x8, 0x100, 0x3ff, 0xffff}, &(0x7f0000000300)={0x5, 0x3, 0x1, 0x3, 0x9, 0xfffffffffffffffa, 0x4}, &(0x7f0000000340)={0xb97f, 0x9, 0x9f26, 0x1, 0x6, 0xc8, 0x7fff, 0x7c8f}, &(0x7f0000000380)={0x0, 0x1c9c380}, &(0x7f0000000400)={&(0x7f00000003c0)={0x7fff}, 0x8}) sendto$inet(r0, &(0x7f0000000000)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140)}, 0x0) 2018/05/12 22:58:32 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0x0, 0x0, 0x252, 0x11000000]}) 2018/05/12 22:58:32 executing program 5: r0 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$ARPT_SO_SET_ADD_COUNTERS(r0, 0x0, 0x61, &(0x7f0000000000)={'filter\x00', 0x4}, 0x68) sendto$inet(r0, &(0x7f0000a34fff)='H', 0x1, 0x0, &(0x7f0000030ff0)={0x2, 0x0, @local={0xac, 0x14, 0xffffffffffffffff, 0xaa}}, 0x10) r1 = memfd_create(&(0x7f00000005c0)="707070318b295c747275737465642c216367726f7570656d3100835ea91a918dd6e03be05d9c222d9a2576dc0e84289704918d4d88b2fd9f3ea0a78763b5f6319b0f8e9345ba083c9434db61748a445ac627ffd44fbbff54a2e131b7cd13a2919da83a44d3a48482da6ce9f8c99d74c3d1e1018c388f729d5a42c9a76b8b5d24fbb9335b17befea2cb460937f573172e98e6f23768d7f1eb1a8ca8245f43e68ce51254033c2c140e49d30165cb65806f725f3af114b286fe5fd2dbb3d591b07e8d469de0f200153be40c4e48215d714c590e96cfc3385aec65865747e0e50317ed491cae6f11e48d01e690200ef466b48478eda70d6a38879d91c2167a1f1d6f6be5e1b75352a67435d7085b48698d567c31aa360c09d48a6a337a4d6522fac8b94cf2b75a2c8e2854048895ff05347411599b886aff18472234fd14a55c9856eeeb78e45dbe4d50f51e03a21fd2b4bf8934442506c7a95a54b066e2cb1ac5b43d41ca58fcaf994f6a07c82e818939e6af0100daa28248c1e33a187ec1fef6b4", 0x1) getsockopt$inet_sctp6_SCTP_LOCAL_AUTH_CHUNKS(0xffffffffffffffff, 0x84, 0x1b, &(0x7f0000000100)={0x0, 0x5a, "db0712d3adad542df841b8c1518f614f6386bd5d890fb45617068307cd4c7cef3bc7128a7d8513c55dc0a7d3c5e50199196a62d902fb712554032be81387e991ebc0ae22230c20f683de44682ed9116ac843d031bd19be0d7385"}, &(0x7f0000000180)=0x62) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(r1, 0x84, 0x73, &(0x7f00000001c0)={r2, 0xfff, 0x30, 0x0, 0x100000000}, &(0x7f0000000200)=0x18) sendto$inet(r0, &(0x7f000026cfff)="c6", 0x1, 0x0, &(0x7f000052a000)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}}, 0x10) shutdown(r0, 0x1) setsockopt$inet_sctp6_SCTP_ASSOCINFO(r0, 0x84, 0x1, &(0x7f0000000080)={0x0, 0x3}, 0x14) [ 791.878496] binder: 24069:24070 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 791.910408] binder: 24069:24070 BC_FREE_BUFFER u0000000000000000 no match 2018/05/12 22:58:32 executing program 3: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x184, 0x0, 0x12, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:58:32 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}, 0x0, 0xfcffffff00000000}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) 2018/05/12 22:58:32 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00, 0x900}]) [ 791.957894] binder: 24069:24089 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 2018/05/12 22:58:32 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0x0, 0x0, 0x252, 0x3c00]}) 2018/05/12 22:58:32 executing program 7: r0 = socket$inet(0x2, 0x80e, 0x14668) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_inet_SIOCGIFPFLAGS(r0, 0x8935, &(0x7f0000000000)={'irlan0\x00', 0x7}) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f00000001c0)=0x400, 0x4) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f00000001c0), 0x3c9}, 0x0) getsockopt$IP_VS_SO_GET_VERSION(r0, 0x0, 0x480, &(0x7f0000000040), &(0x7f0000000140)=0x40) r1 = memfd_create(&(0x7f0000000200)='ip_vti0\x00', 0x3) getsockopt$inet_sctp_SCTP_GET_ASSOC_STATS(r0, 0x84, 0x70, &(0x7f0000000300)={0x0, @in={{0x2, 0x4e24, @rand_addr=0x3}}, [0x2, 0x9, 0x0, 0x4, 0x3f, 0x1, 0x2, 0x5, 0x81, 0x6, 0x10000, 0x393e, 0x0, 0x6, 0x7e00000000000]}, &(0x7f0000000240)=0x100) setsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r1, 0x84, 0x72, &(0x7f0000000400)={r2, 0x1417}, 0xc) [ 792.026415] binder: 24069:24089 BC_FREE_BUFFER u0000000000000000 no match 2018/05/12 22:58:32 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}, 0x0, 0xf000}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) 2018/05/12 22:58:32 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00, 0xfffffffe}]) 2018/05/12 22:58:32 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x1c, 0x0, &(0x7f0000000040)=[@request_death={0x400c630e}, @free_buffer={0x40086303}], 0x1094, 0x0, &(0x7f0000000080)}) 2018/05/12 22:58:32 executing program 3: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x31, 0x0, 0x12, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:58:32 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0x0, 0x0, 0x252, 0x8]}) 2018/05/12 22:58:32 executing program 7: r0 = socket$inet(0x2, 0x3, 0x800080000000) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer2\x00', 0x10300, 0x0) ioctl$EVIOCSMASK(r1, 0x40104593, &(0x7f0000000140)={0x0, 0x28, &(0x7f0000000040)="1fd4cd86660eee3f1b2cb8078a39a27cc7f96e69b11e7f3c44e3e8f602edc27007d8f5ed7200863f"}) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140)}, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8924, &(0x7f00000001c0)={'veth1_to_bridge\x00', @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff]}) [ 792.193667] binder: 24123:24126 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 792.231718] binder: 24123:24126 BC_FREE_BUFFER u0000000000000000 no match [ 792.279656] binder: 24123:24134 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 792.303200] binder: 24123:24134 BC_FREE_BUFFER u0000000000000000 no match 2018/05/12 22:58:33 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='dctcp\x00', 0x6) sendto$inet6(r0, &(0x7f00004e8000), 0xf401, 0x20000001, &(0x7f000007f000)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5400000000000000]}}, 0x1c) 2018/05/12 22:58:33 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00, 0x37}]) 2018/05/12 22:58:33 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}, 0x0, 0xa908}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) 2018/05/12 22:58:33 executing program 3: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0xfffffdef, 0x0, 0x12, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:58:33 executing program 5: perf_event_open(&(0x7f000001d000)={0x2, 0x78, 0xe0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x25, 0x0, 0x0, 0x5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket(0xa, 0x4, 0x4) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'ip6gretap0\x00', 0x0}) sendto$packet(r0, &(0x7f0000000140)="cad71db21a1130f1b7193ba55ac4b90b03a23b26d8ec8c859f194b8d462d0e7d9dcea0d783add4d3166b1fdf788e71a1c0188546bd338f5c7cbea7d832eb1848790cd9fda7f082d7cab97ab2cfca7f98a9a33d6ce2a093ac14a97a5400db87f532b24a87807badd0d1174d39cc01da3a3c9edec0b1eeebd6496600d6c18d158e5ecdf8488ffec6351ee8bae29aee11b4264b3cbbe3e90feac7cf9c7b004871a5c8d19b4e5ebe1b75ddb785343ea6dbfc460e91b9060fa7da68ef0550", 0xbc, 0x4000000, &(0x7f0000000080)={0x11, 0xfe, r1, 0x1, 0x2d7, 0x6, @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}}, 0x14) clone(0x0, &(0x7f0000000140), &(0x7f00000000c0), &(0x7f0000000100), &(0x7f0000000500)) 2018/05/12 22:58:33 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x1c, 0x0, &(0x7f0000000040)=[@request_death={0x400c630e}, @free_buffer={0x40086303}], 0x1095, 0x0, &(0x7f0000000080)}) 2018/05/12 22:58:33 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0x0, 0x0, 0x252]}) r0 = syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x8, 0x10000) ioctl$KVM_GET_IRQCHIP(r0, 0xc208ae62, &(0x7f00000000c0)=@ioapic) 2018/05/12 22:58:33 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140)}, 0x0) r1 = accept4$unix(0xffffffffffffff9c, &(0x7f0000000000), &(0x7f0000000140)=0x6e, 0x80800) sendto$unix(r1, &(0x7f00000001c0)="aadc72334b86a9b362d29cc3325ff382724eaac16c051ca210830168041320492ce16cbf24a5834c08183202ca09d9d97ca54158754d69", 0x37, 0x40000, 0x0, 0x0) 2018/05/12 22:58:33 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}, 0x0, 0x100007f}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) 2018/05/12 22:58:33 executing program 3: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0xfbffffff, 0x0, 0x12, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:58:33 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00, 0x100000}]) 2018/05/12 22:58:33 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='dctcp\x00', 0x6) sendto$inet6(r0, &(0x7f00004e8000), 0xf401, 0x20000001, &(0x7f000007f000)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50000]}}, 0x1c) 2018/05/12 22:58:33 executing program 6: syz_emit_ethernet(0x3, &(0x7f00000003c0)=ANY=[@ANYPTR=&(0x7f0000000240)=ANY=[@ANYRES64, @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYRES32, @ANYBLOB="3f323c728ec39b4edbe553be5f4c9b5ba47836c73645a3d6856fef4da74311c97500dc59ee840c0052ec80c3af7fbd45b21a16f09be2c38e81fcadb8531cd6ce299921afee819a8f94e5768cb5b29975f6ba5f81073bf6b59aebc1365356ff92efd41c2e00e2c14fc69a5e6170adec9917863aac729e0157e2ed6d2b2e330d57ce5e4e9d8122e684610f09bb816c854064e687d589dbda5c5f485f2c0c7537f98020da791f82e5f45db6354918b9959f289ad82cfdc87d845d0c9e53f699bfff1a594837aec957b7cbd047adb4d8f8e73ada4ca19398108b7be08ef2c7f365aae2"], @ANYPTR64=&(0x7f00000001c0)=ANY=[@ANYRES32, @ANYRES32, @ANYRES32, @ANYPTR, @ANYBLOB="890a6b8968b34172cd8c6b364960151473488c3bf0ebcc9b8e4c33fb7d57", @ANYPTR, @ANYPTR, @ANYRES16, @ANYPTR], @ANYPTR=&(0x7f0000000040)=ANY=[@ANYRES32, @ANYPTR64, @ANYRES32], @ANYRES64], @ANYPTR64=&(0x7f0000000380)=ANY=[@ANYRES32, @ANYRES16, @ANYRES32, @ANYRES16, @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="186e8cf762f20fc7ffcfd2fcd204a389556db110367f4f79fa6cbd740a63f8f04e2f2badf52988b947e53b50d285e0fdafc03661327cb35bc9515ce5927df7ee61695c434f8af997afb5603aa0a958c45d8d78ddba3cfb3b4b34f72826e1958d856c5ab7181bede71502061e5e0ebd23c637713d10531d3dda5902aa1c04cdbc2152ac0710c87eb48efeca34ad8335f1c6c4547a09bfd5d1a33d", @ANYPTR, @ANYPTR64, @ANYPTR, @ANYRES32, @ANYRES64, @ANYRES16, @ANYBLOB="f7db3cdb5e29af55ff"]], @ANYBLOB="8f8ab5553eeedc6dd67587339d6c4bfd72ecfdfd8f0c21d306bde925ad954f056ee5a662c14f73ff09227fc10071be257284535cebbf92109315c61a162ed3fe6e2223e3cc391d78c35d610fcebe4aa34739ad18b3f24b6bc1866a554bb7b1122e0f76314cf1bc8cf68a3daec596c861ec412b2f35f105b01ce5762ffd58afb051afdece81bcc0894db34063da86970effa96d93d024f8de3ffd434db4858489d3c1594645f81d0cc331c9b0ede5a9eee286629cc87c21f5a2d9"], &(0x7f00000004c0)={0x0, 0x0, [0xfffffffffffffffd, 0x0, 0x252]}) [ 793.171381] binder: 24174:24176 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 793.201486] binder: 24174:24176 BC_FREE_BUFFER u0000000000000000 no match 2018/05/12 22:58:33 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}, 0x0, 0x8000000000}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) 2018/05/12 22:58:33 executing program 7: socketpair$inet_tcp(0x2, 0x1, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$inet_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000500)='tls\x00', 0x4) setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(0xffffffffffffffff, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) accept4$packet(0xffffffffffffff9c, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @dev}, &(0x7f0000000040)=0x14, 0x0) r2 = syz_open_dev$audion(&(0x7f00000001c0)='/dev/audio#\x00', 0x7fff, 0x400000) ioctl$KVM_INTERRUPT(r2, 0x4004ae86, &(0x7f0000000200)=0x1000) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000300)={{{@in6=@ipv4={[], [], @loopback}, @in=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast1}, 0x0, @in=@multicast2}}, &(0x7f0000000140)=0xe8) setsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000400)={{{@in=@rand_addr=0x1000, @in=@dev={0xac, 0x14, 0x14, 0x14}, 0x4e22, 0x6, 0x4e22, 0x7f, 0xa, 0xa0, 0x80, 0x2e, r1, r3}, {0x6, 0xfff, 0xffffffff, 0x8, 0x9, 0x3, 0xb7, 0x6}, {0x3, 0x5, 0x7, 0x1}, 0x9, 0x6e6bb0, 0x1, 0x1, 0x2}, {{@in6=@remote={0xfe, 0x80, [], 0xbb}, 0x4d5, 0x6c}, 0x2, @in=@loopback=0x7f000001, 0x3502, 0x4, 0x2, 0x1, 0x9, 0x1623, 0x400}}, 0xe8) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140)}, 0x0) 2018/05/12 22:58:33 executing program 3: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x502d0000, 0x0, 0x12, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:58:33 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='dctcp\x00', 0x6) sendto$inet6(r0, &(0x7f00004e8000), 0xf401, 0x20000001, &(0x7f000007f000)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa000000]}}, 0x1c) [ 793.233375] binder: 24174:24193 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 2018/05/12 22:58:33 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00, 0xfe}]) 2018/05/12 22:58:33 executing program 6: r0 = syz_open_dev$midi(&(0x7f0000000040)='/dev/midi#\x00', 0xfbee, 0x800) getsockopt$inet_sctp_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f00000000c0)={0x0, 0x5, 0xffffffffffff0001}, &(0x7f0000000100)=0x8) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r0, 0x84, 0x18, &(0x7f0000000140)={r1, 0x100000000}, &(0x7f0000000180)=0x8) syz_emit_ethernet(0x2a, &(0x7f00000001c0)=ANY=[@ANYBLOB="aaaaaaaa001c0000000000009078ac141400ac1414fa70d3990b0b0e78f31b738bdccf9abb1200907800000000"], &(0x7f0000000080)={0x0, 0x0, [0x0, 0x0, 0x252]}) [ 793.305730] binder: 24174:24193 BC_FREE_BUFFER u0000000000000000 no match 2018/05/12 22:58:34 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}, 0x0, 0xf0ffffff00000000}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) 2018/05/12 22:58:34 executing program 5: r0 = syz_open_procfs(0x0, &(0x7f0000004000)='\x00\x00\x00\afles\x00') getdents(r0, &(0x7f0000000000)=""/43, 0x2b) getdents(r0, &(0x7f0000000300)=""/183, 0x28) getsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f00000001c0)={0x0, 0xa0, &(0x7f0000000040)=[@in6={0xa, 0x4e23, 0xfffffffffffffbf2, @dev={0xfe, 0x80, [], 0x1f}, 0x1}, @in6={0xa, 0x4e21, 0x5, @mcast1={0xff, 0x1, [], 0x1}, 0xfffffffeffffffff}, @in={0x2, 0x4e21}, @in={0x2, 0x4e22, @multicast1=0xe0000001}, @in6={0xa, 0x4e21, 0x8, @ipv4={[], [0xff, 0xff], @multicast2=0xe0000002}, 0x3}, @in6={0xa, 0x4e23, 0xa2, @mcast2={0xff, 0x2, [], 0x1}, 0x58}, @in={0x2, 0x4e24, @loopback=0x7f000001}]}, &(0x7f0000000200)=0x10) ioctl$BLKTRACETEARDOWN(r0, 0x1276, 0x0) setsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r0, 0x84, 0x76, &(0x7f0000000240)={r1, 0x9}, 0x8) setsockopt$inet6_tcp_buf(r0, 0x6, 0xb, &(0x7f0000000280)="444b63cf4e96410fb0817f", 0xb) setsockopt$inet_sctp_SCTP_RECVNXTINFO(r0, 0x84, 0x21, &(0x7f00000002c0), 0x4) 2018/05/12 22:58:34 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x1c, 0x0, &(0x7f0000000040)=[@request_death={0x400c630e}, @free_buffer={0x40086303}], 0x200000000000000, 0x0, &(0x7f0000000080)}) 2018/05/12 22:58:34 executing program 7: r0 = syz_open_dev$audion(&(0x7f0000000140)='/dev/audio#\x00', 0x3b1, 0x200) setsockopt$inet_int(r0, 0x0, 0x22, &(0x7f00000001c0)=0x7fff, 0x4) r1 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r1, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r1, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140)}, 0x0) r2 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x80, 0x0) ioctl$KDGETMODE(r2, 0x4b3b, &(0x7f0000000040)) 2018/05/12 22:58:34 executing program 3: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0xeffd, 0x0, 0x12, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:58:34 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00, 0xfefe0000000000}]) 2018/05/12 22:58:34 executing program 6: r0 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/mixer\x00', 0x14200, 0x0) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(0xffffffffffffff9c, 0x84, 0xf, &(0x7f0000000040)={0x0, @in={{0x2, 0x4e24}}, 0x9, 0x3, 0x5, 0x7, 0xec}, &(0x7f0000000100)=0x98) getsockopt$inet_sctp_SCTP_LOCAL_AUTH_CHUNKS(r0, 0x84, 0x1b, &(0x7f0000000140)={r1, 0xa8, "8fbb27d15e416dd6a4a6e0779ed4dc5b2981eda84ec28cfc7f865bac5306e498eaad9085629cfa1bdc7c83b55c4b92b139fe889354b4fb5d8b2ace284b598267f50337e302214f440c7cfdba299e41dacaab430a4386015c1b5ad14ec4421c8682568d774aaeb4f609538c12aac41dab59b352db77b1ccf42a171e2a9399267865677ad377ed7d3ce8b9b48bca7ddf47ac8497284512a9b766f919ee14a36248d6f642ebc07f438c"}, &(0x7f0000000200)=0xb0) 2018/05/12 22:58:34 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='dctcp\x00', 0x6) sendto$inet6(r0, &(0x7f00004e8000), 0xf401, 0x20000001, &(0x7f000007f000)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe000000]}}, 0x1c) 2018/05/12 22:58:34 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}, 0x0, 0xa908000000000000}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) 2018/05/12 22:58:34 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00, 0xf00000000000000}]) [ 793.587844] binder: 24240:24242 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 793.621698] binder: 24240:24242 BC_FREE_BUFFER u0000000000000000 no match 2018/05/12 22:58:34 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) io_setup(0x7, &(0x7f0000000000)=0x0) r2 = openat$audio(0xffffffffffffff9c, &(0x7f0000000140)='/dev/audio\x00', 0x400000, 0x0) io_cancel(r1, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0xe, 0x0, r0, &(0x7f0000000040)="2d4da721ed09d86b2520a3a2b302e4d4e73aeba01d8e", 0x16, 0x4, 0x0, 0x1, r2}, &(0x7f0000000200)) setsockopt$inet_sctp_SCTP_FRAGMENT_INTERLEAVE(r0, 0x84, 0x12, &(0x7f0000000240)=0x2, 0x4) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140)}, 0x0) 2018/05/12 22:58:34 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='dctcp\x00', 0x6) sendto$inet6(r0, &(0x7f00004e8000), 0xf401, 0x20000001, &(0x7f000007f000)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9000000]}}, 0x1c) 2018/05/12 22:58:34 executing program 3: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0xc, 0x0, 0x12, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:58:34 executing program 6: r0 = syz_open_dev$dspn(&(0x7f0000000040)='/dev/dsp#\x00', 0x7, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)={0x1, 0x40, 0x401, 0x8000, 0x1a, r0, 0x3f}, 0x2c) syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0x0, 0x0, 0x252]}) getsockopt$sock_cred(0xffffffffffffff9c, 0x1, 0x11, &(0x7f0000000100)={0x0}, &(0x7f0000000140)=0xc) ioctl$sock_FIOGETOWN(r0, 0x8903, &(0x7f0000000180)=0x0) rt_tgsigqueueinfo(r1, r2, 0x34, &(0x7f00000001c0)={0x37, 0x5, 0x8, 0x2d}) 2018/05/12 22:58:34 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}, 0x0, 0x400300}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) [ 793.662626] binder: 24240:24261 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 793.696201] binder: 24240:24261 BC_FREE_BUFFER u0000000000000000 no match 2018/05/12 22:58:34 executing program 5: r0 = open(&(0x7f0000000000)='./file0\x00', 0x8000, 0x10) getsockopt$inet_sctp_SCTP_SOCKOPT_PEELOFF(0xffffffffffffffff, 0x84, 0x66, &(0x7f0000000080)={0x0, 0x63}, &(0x7f0000000180)=0x8) setsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r0, 0x84, 0x75, &(0x7f00000001c0)={r1, 0x707}, 0x8) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r2, 0x84, 0x1f, &(0x7f00000000c0)={0x0, @in6={{0xa}}}, &(0x7f0000000040)=0x90) 2018/05/12 22:58:34 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) getsockopt$inet_sctp_SCTP_ADAPTATION_LAYER(r0, 0x84, 0x7, &(0x7f0000000340), &(0x7f0000000380)=0x4) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) r1 = openat$urandom(0xffffffffffffff9c, &(0x7f0000000000)='/dev/urandom\x00', 0xc040, 0x0) recvfrom$inet6(r1, &(0x7f0000000040)=""/49, 0x31, 0x101, &(0x7f0000000140)={0xa, 0x4e24, 0x2, @loopback={0x0, 0x1}, 0x7fff}, 0x1c) setsockopt$bt_l2cap_L2CAP_LM(r1, 0x6, 0x3, &(0x7f0000000440)=0x71, 0xffffffffffffff45) getsockopt$inet_sctp_SCTP_RESET_STREAMS(r1, 0x84, 0x77, &(0x7f00000003c0)=ANY=[@ANYRES32=0x0, @ANYBLOB="0517aef7e300"], &(0x7f0000000400)=0xa) getsockopt$inet_sctp_SCTP_DEFAULT_PRINFO(r0, 0x84, 0x72, &(0x7f00000001c0)={r2, 0x80000001, 0x30}, &(0x7f0000000200)=0xc) setsockopt$inet_sctp_SCTP_DEFAULT_SNDINFO(r0, 0x84, 0x22, &(0x7f0000000240)={0xff, 0x8, 0x97b, 0x4, r3}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x2e0, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140)}, 0x0) 2018/05/12 22:58:34 executing program 3: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x10, 0x0, 0x12, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:58:34 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}, 0x0, 0xffffff9e}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) 2018/05/12 22:58:34 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00, 0x300}]) 2018/05/12 22:58:34 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x1c, 0x0, &(0x7f0000000040)=[@request_death={0x400c630e}, @free_buffer={0x40086303}], 0x5000000, 0x0, &(0x7f0000000080)}) 2018/05/12 22:58:34 executing program 6: syz_emit_ethernet(0x62, &(0x7f0000001440)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@generic={0x6b17, "7c39bf5dda7889e928b0f45a791a1a08383c8299dd2982d8ed95bf624c8ce860e4284ad16fe1eb564d6fa244791a6d310207e1ca4709e8badaf66688676d880e5401134ee84d4c16a3dcedb60b37d3c9cac581da"}}}, &(0x7f0000000080)={0x0, 0x0, [0x0, 0xb78, 0x4000252, 0xffffffffffffffff]}) r0 = dup(0xffffffffffffffff) ioctl$SNDRV_SEQ_IOCTL_UNSUBSCRIBE_PORT(r0, 0x40505331, &(0x7f0000000000)={{0x5, 0x3}, {0x6, 0x9}, 0x50, 0x2, 0x2}) 2018/05/12 22:58:34 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='dctcp\x00', 0x6) sendto$inet6(r0, &(0x7f00004e8000), 0xf401, 0x20000001, &(0x7f000007f000)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x218]}}, 0x1c) 2018/05/12 22:58:34 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='veth1_to_bridge\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140)}, 0x0) ioctl$sock_inet_SIOCGIFPFLAGS(r0, 0x8935, &(0x7f0000000000)={'syzkaller0\x00', 0x4}) 2018/05/12 22:58:34 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}, 0x0, 0xc0ffffff00000000}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) 2018/05/12 22:58:34 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000100)=ANY=[@ANYBLOB="aaaaaaaaaaaa8d9d494c17ee08004500001c0000000000009078ac141400ac1414bb1200907800000000a3cb9e3c871d8c61"], &(0x7f0000000080)={0x0, 0x0, [0x0, 0x0, 0x252]}) openat$mixer(0xffffffffffffff9c, &(0x7f0000000040)='/dev/mixer\x00', 0x2, 0x0) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x20000, 0x0) socket$nl_route(0x10, 0x3, 0x0) 2018/05/12 22:58:34 executing program 5: unshare(0x8000400) r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) r2 = openat$urandom(0xffffffffffffff9c, &(0x7f0000000080)='/dev/urandom\x00', 0x404100, 0x0) ioctl$SNDRV_TIMER_IOCTL_PAUSE(r2, 0x54a3) setsockopt$inet_int(r1, 0x0, 0x3, &(0x7f0000000040)=0x9, 0x4) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @broadcast=0xffffffff}, 0x10) [ 793.980244] binder: 24312:24314 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 2018/05/12 22:58:34 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00, 0x1200}]) [ 794.065826] binder: 24312:24314 BC_FREE_BUFFER u0000000000000000 no match [ 794.118718] binder: 24312:24333 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 794.150944] binder: 24312:24333 BC_FREE_BUFFER u0000000000000000 no match 2018/05/12 22:58:35 executing program 3: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x11, 0x0, 0x12, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:58:35 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) openat$vcs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vcs\x00', 0x40402, 0x0) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140)}, 0x0) 2018/05/12 22:58:35 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0x0, 0x0, 0x252]}) r0 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/autofs\x00', 0x1, 0x0) write$eventfd(r0, &(0x7f00000000c0)=0xfffffffffffff670, 0x8) 2018/05/12 22:58:35 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}, 0x0, 0xf00000000000000}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) 2018/05/12 22:58:35 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00, 0xe00}]) 2018/05/12 22:58:35 executing program 5: r0 = socket(0xa, 0x1, 0x0) setsockopt$IP_VS_SO_SET_DEL(r0, 0x0, 0x484, &(0x7f0000000040)={0x37, @multicast2=0xe0000002, 0x4e22, 0x4, 'sh\x00', 0x0, 0x9, 0x19}, 0x2c) ioctl$sock_inet_SIOCGIFNETMASK(r0, 0x891b, &(0x7f00000037c0)={'vlan0\x00', {0x2, 0x4e22, @local={0xac, 0x14, 0x14, 0xaa}}}) ioctl(r0, 0x8912, &(0x7f0000003800)="c6dbea4ce2b0bfc90d7a64a64d26262c8523ca712cf66f") fcntl$addseals(r0, 0x409, 0x1) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/audio\x00', 0x0, 0x0) getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f0000003600)={{{@in=@remote, @in=@local}}, {{@in6=@dev}, 0x0, @in=@multicast2}}, &(0x7f0000003700)=0xe8) pwritev(r0, &(0x7f0000003500)=[{&(0x7f0000000080)="c36790f24faf0919fc4d6128f1f2d92cf4af8351bba9e5cdf29582e2a879b95d62e4515656cda1eb27858054140508ff03777c9d56a4a2d5dea875b712aa91d7597c741b3f34d22f5f288617298bc715701b7826ecf67c6240bc64b15d060c686d0cfec128e0bb91195237917c762d66f1c7aecdeadd64f69e9e552bb182385b2691622c203d778bd21216a23f7e54bc2505ed6d23c80b9b36b5f2648d4e8d3ec473fbc8c8a42a7efe9879191817c9930ec9ac06610f88df4db62b85081608380f092062572dcf1ac3d26acdc89363d91bb2ed663368948bbea246c97137b22b6ea4283409a25c17ca79f0d5f5ea0f028fa7b0dd9a85635d25ec4f0abac747", 0xff}, {&(0x7f0000000440)="7ee801dd60825187c84de6dd4b9fdfc8c7f32bff5fc98bf79618782010eeaed70177074fa3ee9fc8249f0ecca2ce3f3126f840089c886839fb7c51b8bd0352e37b41a9e66f475356d97b61f74796dbb631bbf233a216e4eb2e55bfe552dd3c73e9eb968619cfc657dc37cfed1d9b51e240b5f78efd9c2133f5d8caf9ba611f9dd1eac31343fd659323c5e77410d0dbd199e1132786e32460197123d1ab4b32c86a50513d725f4cabe737717cc4094fb504202fb388a52f7bc312150c426bb3812bc59f940e48265eb7db992f056fa252ad2b97a4c517274ecb23d76c5e6d2c0ba6eca68707cead0223e723b1e72b8bd8d8aeb1e9abe96f5ca5eb2ca342ea47f58ff9188b10e414387063f25b8f8d82e0c09e03801e646edc0c77382bbbe920e898922721611e49f0a04ba9455670b5dc7ebfd7dab793fc8745dfe281659c23a1a96d53f19d1d5bad49ce69d7dcb1206cb60bbc434e91336bb8625ec4f346594246230ba23cbc12314c5647b2bf7fd1ebf63ba63f6ce7c25bd9bfe048a67afe3534960bc430e9c3a7b349ecd001b96596196e4068b619db0d08dbd79205e82a5746b52147fab6434ce6309bae99c1bb4e40903c47b9d49f090f989578892d765bb3c548106f1abf82b2558f8c39a95d7a2ff8b07cf905e6c4b3e28d1b68609534b4d94cd41b50e939656d6256c01b9331f8140f6e92a20563f48775723f26effed4a077551429e707d6be04436cd6f911a2965a2813ef31ca64f56b0964c79d8c0122f5304f39284147d940cb8e9405d3d6ffc68fb6edddec3769bde1f881de5904b3c97936ce5e76781bd5cc91672cca528707d954fb4248fc5488311f6cdc9e54b7e91dc69f19fcb89e3fa963d30f203572236a6bc8b3a94ac57757a16e57d362fe8b4a2e0bafe7fae88b8216e6ac252d759fa74d9822bf240501a9d3549de0d8c355afaf096fb48869d21f28e19e5b1339e9c35edea171a2a616ee8cd534a53ad6165617802c7c41df85b214da10b611ab5446ac914db45a7d4e4aed58462e65f20cf47a5e980a899b569eec43322f15c801d2b840b002ab883f0da1f3e3fd81495281cddf4dec9b6604397b8edbf41f035300fb44a5aa1aebca46ae1f5724d7412a68703a4ee9a6fd25707806194ab898c7bb487688f4641f469f39ba9facbf7c86cd5e64ef00d35b1ba40c8359b608b69d7462a52b0362a4be18b7d95dbcc36b1318bd6833b3abefaf18bfa14c9c3c57380881357c2573f1c9fb9384bca8b35d948488b5b954f4f40bcdc7564ad6923ad842dd2a93f5c6dd6af01f3a87559281673dc4a8456c8d8ddcdd5af3c154ec9406a341e3752716e72ec5668224e57e1edb267f7010eec7e958d66d5dc12be1e016833ddadb053c21272c2c1210454d1c6f842f703901fd464e500453ef609ca65bc20d556ca0e5602d5c86169b78e4360ffc88fb8c97334637d8cf5c42248dbe910c566de95d8430de8d66f1ea8fba6813c31bbbc658ffa97803f00c9a861d87be246d57fe02cc33198dd00d3ace24046de20c31b0ed62c77507bacceb98c0ceea197064c8e48848cd5acbfc822e56800bb19e49ad01c166e82beeb1eaff531d932708ef3397a816f913df5d2e4dbf32888841aa76c4ffb4bc588f985792a779ed4b7266a1f1bdb1d5034ea6af4f895bb40f113ba00b119ba9fc584c04dadd9a5abb3807f042c116bffb493791150cd5b1cd435bdf2dc65690919975a35a57a18946ef33195ab43f41f944c53024296c2b448fedc1d6eec8a43e12d8373ebaecc3bc1d522f5d06fef021a5a133c723f2560acc7d0af40ab880563e2571afb1cdfa6dda2a6c2f3d4a35c3ad03017cfaa415a98c82ea2a3c0ae3f36876a8fb3a0eaec054686f21d64ef3655c373a00792a7c38820661879d23d205d1023c4f9626d62523bc335c76a1d416fb9dc96de21350b8f9be50644b8c8248e9a7f0a131aa8107f543f4c7ed8cad974b45d6c1407d86036156d8d995ce867219f9a8e6e686edd0fec99fdbe44653f5122f44160e2e474caf6266754cd956e287a85db80526cf16b53c3f02b0cfb361d5b608c845f0b218246bba9b32702e7f9d96d3ce6d44dd3302bf81531f8f512416551e56b8ec2612fca8870e4fc00c084f8f9bc35e01ae086f22e388b358b9c3789a2ec9bf2229886562bfbdebe3dc4b1466f51f5c2a9597ee42a421dc387ee6d8620af0cd8cf47adeeb1834189620a3206f2ee25d112853846788264b64360f0578bcf618aa93dd308e696d67249ef7b84b97d7a6d4ed898deea747e8cb80581b6c7b2186a6225e20af5467a3ad7aa3733dc1572c741fa626e21cd595291ae93ad436aa09456e9cc2bc9cf47065909da3e6cbf349fea2f45a5f58a40dae5b577f54c8ccea5469f902afb701a2594d0dc2fec805e5f948b8b07846eebe193321de09d6b33811d76e60623d016998fba212c0b55be6d917bb07570363b22b840edccbe49300f6cc1fde79838107dbe8e1bd6de8c5d0a53798789d9945bf25c45aafffde241e1210c0440f2ef4245d55110f7d740b641ade619055a580d3aadf2682a67b02f50ef8d9f3cd706a776cca175b7bbd629157d3e3adf746cd73598f65685193574f8855b740463e77eef0a348e83cb677e2dc67b13060eb706c58464398ec12bbc9fcdfba0698e3b1ff6921be7e8d1c2cef8014fd888dde92b1d87028a775babcfc411dab29100c58df781c8260e2cf70b9b705c30432dd734263caecd5dde7451ec53625fbbce7f6c8dfb32c59bca35ef2c07a8cb6360c2da2777049ab8c6baa1935b2417600dc917b40621dc8ceab075eb919cdb255292a8d162f47e7e981f6d96ddc7812df319831389d9d0784b1cb1aeec7cbe87d5567c75ad1fa110284f6f418f1e7fade13e51e16074b020cb8e34bee29c5fc8312dec4d8bf2ac81846bafb173202cd4bf1d7f101297cbc5674e946d341fa9874208ffac991e06c7ad2754fb869cf8b3505958d7f62dff40315f159fd91c4da24cef1d0a7b31ce3160676990c64cc14ef1ed65348a35baa8e0c6fe65f94cdfcabb9bfea7e4ffa21897de9b8e3fbf2e8a1c1f728d27b9197d55817cd2494a113b13658bd158722fa1cd9e81a4d9536516ea04598e15b83376cb58e1a0b4fc413a204d0c14838cf99d4de2a05151f9a3c0b9dafda1c1be4876ce3981e38dbd82492d671bb952a9cf1ff79b44dcc55db8a4e499a8f1db3d22eb3ddcaf47c6237d86a843e478d8f1df1d0519c1f83e8c97ba07ef8c1156893f9d90769f03cd0a15f41cdd1ff5238e655d8c0f0f5235c8a273a857b76bf7ad2ea7d742c9313d2395ad0afa30275100648a1e975df13f220741cf5276ae3aa4e4e553fa21a8651e16c257ac5ba51da11dfd328330469bed6d40818f34f25b9c39958216a90776ef422b970f181326e26012690017dde38889a6c16302cb595ab75deeb0e418bc6a8ea2e6e3451b737e3e32a2da7a023dbd5e752292548605e6f5eb193bbc481fec5973cde0c9ede25f4704a287f8bf9c5555cf7540439e306b65cb501cdaa1912a7281b9d4f884b44c3594129e0d93ce405e830ebb5e9d8178a7fc16f326c538f5a0e68c18cfe5a0a88b015f8fb902ba15df4c0614c1dfabae9d9952f445c99109fff87cd2170325e13206583219ea27d47a23cd34912616f01b500e01eaa0ef00edf51651291a50762bb6c734e99708be4198b69e0dba012188af96d0364a7dedb9dc984bd823cdebb50d24b34ba0c6e4cc07f0b99dbc29cdc1e97b773222e2fba5ae6e7dccb0e4f81dce0121d82c3793b40139061f3aaae2b7c760fd7d5bfd9d1fcbbfb11fabe96022548533ac7aa5a52def0c3fbb4b3972ce7f81c86a532e8b5f9b643f9ccfc7d418565272cc8294e12b5b51231544239cf827cba0ede20c7c10115b73e8288dd273fd99fb9b1a50cfb48e912c52103dcdc99b259f7046eddf8b71e89a9cb71fa12a758a98a7f0189e0c8afae5a6e59de42f565a31206dfefb5fff990229455ca53beb8bf34597b344caa9d37a83e8c17e58004fda25a7a7aa2d978ad8fde3cfd60002eb42deb00ea7a5d29ebf43045783515983768cafba7644f9dc9b06e6bbd04e8dc968d874c705a7b1cc245d2ead0d794583c3c708baece8d8e510aeb14a8f1b5de88ac967fb857f5df625d9c46e03aff500ca63054fcd40cefb693d603b1f7cc66ecefeac7df4dedf2e265f4a40ce45765ea6ec1188bc77858b67e4d8ec576ff0f2c20f06308bcbe12aa921e86c0169aa7d0b8a4361e70cc25a79364c3683bf5137e37ed17a8612d1746e4f3183352062be8e045784ef729b71e637c59e7bf06c659f91ae044c54ae043d20a2ae159c43a146d0c7ec7211da7bb4c38934d4e8d1ee42e0ccb354cac53fdca059b0b2609bf866a4e6c235c6847ecbff3834f7127aae4d7de3e8063d2c52e9767f6c77d22706120807a5bf9e31fb5ea4f3bce284b0e93c7936b589c24b1eae7ab2854979a1720f22697eb70e2493d327831fef03c1879dbdeeed2500a61d7636c5a155df295fd32ba878e98a85af2f303a4a89ba6739fa616bc39165f76d09234e91b3cf13a6a5096c9a27c1771af65a2d2605db7a399a57b2f644b4783f19240ea6be40db6824e4e1f1e62a3a5ef76a16e089cf6acc4527c1d725e835d869b3e13eee5b105eb53f6c6e8a51d282841a28a1a599b5a65af8aa0cb2ce7edb3d3171485cfb7224dff2c03963e7c8ed910ce876c67bfeb67dc965a917dd62fd9108e7163d0cb472dc34fd38c366264928053e2c34b00a97937105a676c467a0d0ec3d05fe82381a1e945bc3737815c6ffa0962096ed5cbfbe1220a5b23a8917924432e7dc48def219aa683205895b5d37f3d757c13505a4b796e5be4960d19f17cbe8f167ef439bad3565990acc9b8f0b69f69bb158ca6c3e833a501ecc2944f22397bd9be33dddb69a1be2089b429273efef2ee041887c7f19d07241e99d9b7825072a9f5b5f4df0a3029fdf1d9988edda6e9dc21c2966319ce0777134206038cbc81a808ed0352f5a778f27e4d3af15d9fef0abb4c9ef5d61ad514d597008e1ce5af6e72be86c927c7166743859e6c0061dd8a85dee3433e6234c054502621f7978e9e060e8fa40b13b4cb5da27ec33dd3f7ad59e44a7e1adaf735ba4ea94986988735c976e88abeb05e51912464de8a67ab9066af7d7bbcca8a818218c52e7924eabccda8ea39075fea2b79cb63ddb2b7917d0ae2721e2e65dbcfcdac937fd91a489c86d2d6c49ae691b84cddf9d9e5ff0e003e29d9119912d6bc6371f85057ad66e7dd86eec743638e9ee50b787f9e5d07a325cdc7a56fd5fa5a453a9e11d2675389881b3879ee8988770667d60c30b34e63e50d2ecfbef8037a0852b1fbfa37bb47ceb6bfc81ea05ca01f6d34f90630651c4f7b8ca969b1e18f52f51dcd2546ba2cfbf5b6ee8ca0bd522b47476530ee460c2615572b44562c62afc67730acebcdc1983c6132925e809763fa3f9cc2659f2b95b2d3e2202985134eba29190150c2dc5f5fcf9d75e1c39c52e277eaeb10b3e0d024db98155f7b8b397fd737f69eed7a4788fd7ca7bf60c8fd11f1d6fd0090517cb90fc6d062f16702a8a4746c231b61485210356d01f21232323e13d3bcdd949c2f4b0ed4f44efefec7ea079db55ff724bfcac256554a0e3ebfe0f359bab6d4bda981cfe94ebfb24676859cc2cddbcc3114ee614bf2f653f0fa0e1d4e48e366d9e267b2e8496d1e84205952cabfcacd571fc802251889af44c043679b64f3d1d37479a8fc", 0x1000}, {&(0x7f0000001440)="4962b4bd5733820a24502d57f64b27d26b437b1c5bcb1734bf4482bca88b93c4dbeb05fec9b5a3983bc11af5615c6d541d3c475554d695c7ee842e9f7a0199d594d969fdcb59440ea7189805c88a991b046089ab86b8f15a7e28fd54a5b84bf69934527193d09b7f259e56ed03602cc7be11d7ebd899d42872592bcb3bdedb7fb5182433e96d8b9e965f0c5e1ada852e4e0a816ce14763d1744692d02b106436ad60db7bc5ac5af2a70a85ba0abe3346df2263a6746f4945c5a6a13a878ce1d7cc2604ee5a174377847da7e2892fd47a387da9533753544ae6aea4321cc727c2c3ff837ae83897e46939b0a701987a02bafc7efa3e52d9c008f630306114fcd5ec213d119b14024bd057c13cbd0b8a618754da335bb53b262ff118d2c6cc468217a6e28ceec31fa1bcda7dfbab31140acb43c2112e7d03067e49f0eab45a5fe85d70ed434f8c91dc95a543f7bd1a5d39f5010d6304fbbe605d23a4426f7a6b286df97e56d1cc731e5574deece046769e22e07cb8a28216a7a53bf68231598c8e7685880798c36796c1aeba5e5d995f72e3af58c0f54f0db6334933ee7f445f987c09339a6e310a3f30d31630460cd301898fd7c667d55f3ac3cbe61dcf6a39bf805ff99b9d125cc48d4da41de146eda9d5de17daeb5aa894f33e8c6eb3ec203b7ce1211dc05b6fb59238bfd99f1eba3af4f63e974da5162b809985be7bf6e6780181e78598f4b1d0e4c8c1f387b75f0a13ac02306a55cbd7087ad891250cca3da7fdda76f62990075743e07a1eb9c29a7211b500db37a6857b9f412fe4f49f338feb9c15dcee47d15e9d11f310cce30f2c1db455dfb37f62b00a1fecf380bca79ba9be64978606e2b18a7b9b8d964dd66ce915da22e8013262d7318778730a528a27df466d451b5269c03058df9faeaacbbedadcde2e8a551aef4e355ff76ff34b4dad24193a5db5cfcc4ffc78185f63f906b5ba53608b88682d28bce991026c35dc016b96025484d91ab9e97efb31f8d0584bd235713bcf1eb919dffcbdc6a2c1f911014877f93ff4ff9da748381a6f45fe4d0365232ce4fc2508eaea0455679bd0710343a897bd350554907caf3cc69a64285bf5e13a767786024880688e2c31189b5c48adcd5054b05c61c0f98603ba515112ca4a7376b6fb76fd41457c8699f68c9d38721b10bf2b4643c85ef7592f0de6db67b5af50c78fce73070ca2d030692e4f69e1ff50ba7246dcf77de243fc75dd1a19d2ad35d4c95d4267d419647c4e76049d418abd0ddfd3dcb88c7ed5954c390ec3714c999b59aae5b23f870b1bb8022969700a20fa5ee60c50bd3064f559b1b120d89bbbd8740ebf76e441cd5d775d8687c77ee1fd471908025f30244db194a3eeada9fac0d09cea430a8aa87d585fe3959c07fc7dd91777795b2faa521aba0750562e2c8927ed1ceba7d097797999bb3470635db712564ff6be05dff77396d8d8a2e35a891b2324fab66fbd269400c56e51a6c8c41ba3e48f6d12630a49f286b6f042c08ee11e0f4ee13503e4dc6f116d390006ae75d5151bfc7f707cd88dd9424e9d9caa44e9c239afd6f8db16937ed0198694188883552a6717b67d329999a435b908ca92036ce8c2ba8941d6ebd443aad90478b4437bfb296e8c76314e513b43c7055d4f0fb7d158bf0dc1326215fc0b42aa36ad4cbab1964eb329cf0ee1dde9d2bb2a194ad98d0c64cc0eb4bd493826bb4c46540f9c56c4baadb673517f6f88fae0b82ece917c0cb2ba4c2cf802e8090013baf0287c8af1b4556657353e111ff121ebcc0e766fe94e7bf8ff3ed341ae0bfdf9d92366344b0bca9d2e33ec1bc0f9cb8adfce3fe1f92b3abbf8de2dda2d27bc754204a1202cae3f1571663537aa20c481defb9fa1560fd45c1b4a3bfdaf3036bf2b89664868507b0131e0d4359a1dfc2bb75fc01971641a40eddbd081da0bd2a2fed466727676715d047288600a90fd1a1ad103beb89348ce188ee14672850db827f4c3666fc675db92e8b51eb7208f00eeb185c077b0088202cf86c357548731a392d715c8b2ef1ba70ec9cbac5b0a3a042054c754677e1d581e78c3dd398d2d70f642576f506042ecced71be55b8f16a39677716f2837fc2c77eec1f94607c08b0b871efae24706853abb7335a39b6c65d5dabb11fdd00e69819fae1c3fec80d2d85e34a04d44d4aab15eacdc69e47107989a4a76186841fab5bbb499a1f612a4e8d09f111e78ec509ccdda8428e78c112d47acaad42b987554fcd13fa69e9d985675fbd00161ee16239a912cdcba5ead47740d19ffc9f49aed144598f7d50f8206567e1e505b8dd7c6b473643595eec523cf1ce1339c055dcae1d907d25418beff6070d01b9d91c19f45d2893214eed63742a59b72aa524aa456ef1fbdce05d604cd8240e82ce00fdc12d561f3ffcb1b66cc87ecc08e05ae26dee351407392bd5a4bbbdf0ae4b0b7f1c3ad7ce5041f31dddf0512f991372dc01281f5ead4445a1e92a1dffb9f694a7eb33289ffa356cf43dcdfde08a47a689b37c6b6e0d949b92087710ac5279f1c4a5f8881d86a05caac656b986c5cf892f3e9846729af3881a4ef5f0524cedb927a2543ae7a5a25e03664dd52cb6aa4e45285d7da98e3d8b48eb73961003b83cdb3661bc261926aac0fc55e494cf9612cea65489c29d69382147cbf19e39df8288709d53e6382b5ddc2e750a9590b546c04a1e19b21aad7f26743fbca20490d6c92018bfacb5333135ea0b680a478b9dcfc9df503c0f240773c7fabf51773dc321fd9f00c1be98664961e3ee65b291abbe05dece13396fea081d842fd5d1d92783687e9734f5b8e64c019034f28d8fd3f993835328a9e2c14f5444ecb88d4241fe3dfcaa285ebc3f6e0df0951e77ea239d1420b87113047e9a658a492cd234c883267e322c01ade6a0ee7dcd888e280bd940e3cc20e06dbfc0c03d4bbf8ae48c6690fcfe0f73f53cef8155e883d20fb53813c1e89b63ae63068555ebf99d1f0dfa0c5ba7a760448ae8f49c937310ea4046d61835baee165420a4365ac8d20a4128b9641b2819ade2c1d5ef3d8812497aee33ca2773476269dae61f86e21465bf13ade260a83adbc043a14edcff6b8be62686341329869ec89895971b7e1938edd768ec9d2bd1fa088ec4a98aabf0b0ec9476471e7e12b6b8cbb143d8f42e900e07053c22276215c21709eb97699637a5d59108ebbc867198dc431e91fedba9a9c846bc26747787463579ae0c175da1fc975d3fe87718ac1c7c3621ff27dc88d7e4ba7a3fe86dd4badb52d456520d2d1726616b9249553d839b5cac7e6bd39997281428b22c72d37b8dc1116cd4d2fdc09d9eb04bab43b9a716099f45a27a76b7907b3c61d2c0d09290c47336764143a8c16677c9a54c0be693601548e5ed12bef63f5e25bc5b4ac11a775dbd10885b297fc10fe6b62b91b821b7c6417a65db712d327ea1cd159575d018bb4c3d9c62bae7611b9beed5b624abb7475ed0a798672c98425a2c40315fc4ee7a2bdb143c07942bf2af2a851a1b404ac637b47b83495d21ca2d56a96082d740bbe969b9756048151efe3cc4d14c3646b68dabfa7d00d5fe40b590ffb7b782e7bb18e97a69696397a6f825a87f0b1e20290f734510d3ea266df1a70f7ef57e502487b1b98836edc3888d694847ecc85f82ba283b34a08fa4f89088024b79952b919efbfba7932abb67515c0f3422cfc2bdc9ea2724fc0e8a38d89a577317a506aeadcd8c9e03cbb123ad74e73f6b082b1da008ab09c6df4f9893cb4332acc5012dadc71df8fc0fda0b8f061a0b1b8157c31d480514c1ca6ccf0f5aab58814987a04a237a1b0384ff2b0a157b78abfb2604b4d95caa5cb74308c30c3350af29485aba7fcaf7df3d34ce0d48329461f3fb39330de55564b0f8372ac8d867ebf13f784e5a0df6618d17593d74b9134b68f6d7adfddf68891e3a85b729188514fd8523b5e927e093870a016a4c2fc8404d19f32932126830d24024c2ca1fa0fddfc7aad4f03421b54a3144ec145dc84aa6c22918b651b78f3c29e5afef8f1a5ee6a3f6ec405fe10a418880b51709ab17bca3cd806a95956fe9e6d1ebc8e355699c7dcec5279c13bc593e62bfe13663ef5dd705c68a466482ce45e11c1b59921acddc716fad35b230383ad1e1f8f8d6cdf9717f997160b51100288c27f1e98598dca2b4a7f045d5a2607ab86a4314526e8ad8cd42c49a21bb8ec160fddae60e09607e6c7af62d056bb33f0cae0f0819e40f4e8130a78279ee1e8b6a7a5892f3bee951b859cb691ed525b0eeed465a909993c780f2b4257f23a3fbc926531a2ee3642433054a608a4fea39d6649cef4d30dc34e4046d719f0d3bd9642dba7d8f8d2ec745de4d6e19fc5cc4ff5f57e43ae148a5ff6f50837d8ee7145e9b8584d09f8b62ab92c22bb1ffa45b182274c0db40a5ad3192e6cd50b6f8823e21b4deb12dff67ccb70ad3fef90780ef078437ee7399c57d320a48600de2b73009cf502be24f825ec770028d424656c35a6453366a6a408699aad1d631d530db59e434726bf98b006b8528f3efcc6779d837261c556b8a7caedf1531e43ca95342b1b62bf77539869adf62adfd7ca27ee5d51a5106348e1e65160fe3d4ab5bc2c7f131a4eef53cec585e907e89b81a0a709463ae8506ac7f006ed03ad941f4b039989edbda114401a46cdf390422cef5de91cbb61a1968e91c61e4bd4192e2fcd297fd8e768926ff53cf5550cc41f9d6ac605edf738867fa43b3a2c2dae493efb837bfc02c20c0e4496d56f50a964051d34498c049965310a9623aa4c02a2a12313b09e5c8d5c9632acac760e7b0f9fc7a518d1f0e37f290fed96314c1493c43b9173535ce3b449a7d763c0dba3f27a3545787aad2b478ab15193791c96c3bf6b2e97eb21d1e612cd6f98bec27ca55f5e2538f4c3f1fc71b7b011a98ddd69e5332cb8c9fa8c32a4fa44ae2d19b229f69347925a589ce8b0000e133e56c335dbe8a3f77251ee2a5edbb9ad8301c1f8d4dcbc0c80fae5074c66db913b18ea244320c5a1a0c7b37cb547f463482ab53fa5f035deb0d66b2ee96d63e9e8ab7d583ccd0c49fd5269875e3df39775070709f910beaa1d19db51a67a6e649436f57ac643f4f640dc8d530c1c5bcd287f89bd3813612d84963f3a1b3a87eec7a98f66f66a4ed738c247dc9685b09ec8a8ef9f09eaf20883ac20db9cdc0ac59d49cc11527b6f7d11a4dc57dd0de5cf35f7196489b9b9d52167e642aa3eaf0e3bae4ce9dc338d938272645500b7d30db274624745e7b73c4cf57ba4ff413a45a32d4ba0887bac114ad4ba6dc7e264ef013905eb5a5e77aa9f0296e306c59ecaaf0b45252a92894a517f50c2d4280137e862bb306b812ed65d18f5f794f889d711a055ceae721f04324093950e04b86bd037df61c2c6922667f6805b46a23948828bf54b74d10c979e272a039796638dc9c076a5469a1eb159609a4a6eb09df1d5c0bdc4367824d8f90d6da9162c64764c30b89621cf8a2edf91465544120a5f7bbd9ed5c1d29c4feb25aa7f5461077a7f0ad57fc3df860a39da59d56e5da4fc72e1d71f6d3269cbefec3e8fd0d9d25fd26168697c19805d75492b5cfc184812fce44058600c35b6d8e473f58741131e5fe5125106117c19981bd8955f97da7d5ab517046b59975698d95211d6abeeb0541f3deb682d937d022d54e37cb578953b16cdca26ebd1ca0782b6e08add285fa552febf5a700b04f87cc6da7325bb7b547e257b9b9a181af72efe08c504914799", 0x1000}, {&(0x7f0000002440)="b42dd4ab13c7233c044cbe1661f8ada1c495ee7f5b21f42924558b50666134b5ebdfbc6466ef3b10da04a6aaa1e48cf6518de9919002488bf926275e21f396b891a0f284a4d3de15b910f2bd9f8e3754fcb6e7712af6920dfb9c3876538a31fd43c5f6b14d25565394edb74bf026fc62124ccf29845da262b71361f419037aebd02f2bdd87e4ca3de50a3e3d6696c7db2fad710fc139039d377857e6709185a1796bc139ba4c171e8e2f0e30dbc7ee4b09bc55e8b5dce0f86f1b1036a3264a5520ef5e611b02b9b4eeeee1718bf920319066d7aba422de8531f16284ae8c557a5684e0c1f331edc5611e3aec640df23bdaf2e8048e775cd2c79147336df0b6c66a6253d6640f73d3fe49ff493475e52ece2fd9e5f6e8819104e7b1ad179bfe99fb220c991f5eb8d730eaf455ff72a75ae07e6907b5e63ffee40206dd9204a0bd61d2bcc0eea9f73f20f2b0ff6fc149656603bff7b7e4667423bec85d8dd66d9817c2490ed92176ee549dd581f8de7f7c7115d18d5074505aeb2b504514b09ca1a9ac6b8083e4f7ecd068b153c9dac03e21485304d695517453116eb48a964e5efdff379fef528058e14983b7612d305a624c081024dff79773f03789afe59d6e0fe84360218f36b566ccbf0ca985fe69c35359295007414985c7c04043ed6289ada9e73520ee4d3b814a39748192cdadda63ba9699d7a5e34da231584c4a204442eb6f029da94ff2325f6cc58d2307bb32c4faa96f3d6285aaaa37af9e53b3d096fcc357e8243c650db95f46e92d68c9c0e7f4d7a0a21498620e1353fb527066b4508a6dff32ac19720abd813111291c59fcebd6b81da8ff042483f898fd08fd923bafd3bedb216bc1e2d42a563b78312e0542a52fcd4b9b44dfee3be32c946b5b2d79387d8c842a5e92d5f229a1a6ee2f933dfb83cb70f013f8c6d2475f9352de14cdf8d8b5aa0b8446cf0d43c1eb4a14e471629682607bf51abfd641922a742059fd55367b338c842a3b27b0ac47b0bbdf12c7bdc3f1eec9c8c1d9102370cf98ee30e00e1b442653c40527d60bc992371fb9a86e248c85b4d830aa06063446189c9c74e3b0f633125cd30d203a96290097d424de7da2bf0d42950fecd77928aa902515ac28f251748b1bc3a9be8444366ea7677ac7a96e566f3d0dd33ea8bf4ea0a8e7098e6875b79dfb7761ee8d4a599c5418e45c0474abba3d2b72e8d7947fadd24fe62bf0a649036eb76d7d2cd62d6c20a5bb406c25527290ecc554d473543a9f6103e8a57c863835eeae8a8674e9c5342f1ebd8a692d646f68f6ca5e08c0ec532ca47a0a90e2c3f7369390c5fa569e0b85dc3e29cec94ca35ce3b059020d5ef24a840d70b419ca9cb8b5c00e9c89f1e74dc986d51fb7d47050d84d4ef15c266095abb4b0c1567a1c8ab3d1629218ecf30776608f9837c1798fbd2569c6916ebea9fbee7c6ece378f91d83661979320acc154db47692449e683f2bea9a51243f7f5b41433098ccd4f3e95ea403c7c03ba751ced72771934cb5fb00c4832ed1da3c856c8022ab890e4bfa0a0ec8322083742bfae71b518e9f547c28232d036c89ff1c1344f36d3177fca4f7aa30a587956428d48b19a5180b30c0b214ec2d3f0c309c9f8a579deb2b97a1a2e1e955b481240031881078a998c31411ef13bc573323461cbd7fd73eae6a17a1fe6b804acc20b494d7a0fb566bb90349c8e57350571ca60fea9eab19d77f9985ce288084f032217cfa8b49408067fe4492b6ac9032964d94eb034b18dc79af17f3b7e849922e3611ca5c3ba1d4c63ea472340a6e5e4cbbc216b14de07cebc51a86f7eab03d0552b5b6a72888e0ed12302aa82f09075e23c8867cc945f71972f3a6e6585250ab4b9a602fcd24da65f6206b9d92aade4c8916113c53b1e5ca26a799e7f51a7c612ece24db703e83bebc6d4e7041fbf7c1bf2b5e28412ecf6168258ab33670aed7d6f64f45c7869276ba1c8a34d9b7e8e036a809a25256d445dcb8f6584307b583ed07266fce91cbf8cb9c2ee6c3603301bcf6b8d38a58511ed1fce694ad81a8b1790663f82b7b016598a52b46565d7fca93739f3c312231e290e6073bbc456aa2d0acd23fc5d428a3d4e6dcf37c2a7b1070bbc4b2eedc9f7b40a6bbe1530fe33482264b8de9921f5bd645087fc6ad8c6c75e6cac8886b153e0f4af4179dfb16ac10ae5f035618264b26caaab7ddd9d4e55629c0f843c2546c391329e3473d7de3f6912a71ea104b049e47e2bca8ce5bab6696a675976eed75a30c498d2c61eb45a2820f94b86b4ae19c7d44030ee1051c20069501cef93791321276b7a25cc80d0f63a1e06cef86fe8d42bfdbe765f00a192a26e802ac7a8bd56e2041f5155f4abf0dcf7b35af1ccf46913c253a2d443ae06d29c1e8dcedb5f2ca54610746d46efca4121a6219acdd370529f9f13770b4d4cdf9c139a367b65d32d5c0ddfbb1989f2e8d44544c530294a5c2246ab885f7326af4602ae16bca46b6c022b80d4e8b51f8cc4d6c87afa38d3fca6838963329513f9622bc880c26fdd4b088ca82de40f14d87b61ee4141877c8207777e507ccbbfb4d0a1d2d87bfc0e4f32b3cde0c065240a51a48d43a52b0dbd9d68379d3cb88e1a4659ab689ea1c920fcb064aec81cd20e2d2276c351c1a253053fb7abea717b9435d8525471ffc23753eb34bf657c1d6bdbd9abfd649d16cca95c0b9bafbd595d07b3663f8f9f22439182e38114ba47959e40cdd1270ac310bc2fcc351d850d03a233d1b693376e089314fb69e63091538aa007c8b9a13414aa66cff08838a4acc5339218b04f2b1c8506aa00f57ab2403c157cc1a21d2e767bf78b6ebf84098c0efab28822fbb9b0e053c103c62fe68dab301e6ea3756659d8382fb0f0b721adc5695cd9671a073c477f9d157ac3fb527c19dcdfd94dc191b16d63a4d71b49089b8d850c6b4fe8f03dcbcd297e8698e3b02ee35d15ca69de86f55b7ee8cb2270393e6d84f8af96cbd2ce676ae55e1c46f8df7aa12503f1501c66882a7527887f97b4d3caa44671e3cde4f1226df4576bc9965ab607ddaa6db430888214c7182def18fff1c0f5d0b5001d33e9da18cf017ca8b71689741d4e0d1d689e377e24afee152ea52c57cf5ce2824d818f46a6074f28e87fd05b0cae3881244c2be79ae26f793380dcdac9a08ecf3250c17f73c3b3932b0200857b29dafb66aaa2881d20c066dd247ef9003296cc4d7f1aaf61013f68eb7e7c8c0f7b03832805b2cc0282ac38fefaced01bad6a4da675a0baf84253e70429add86ca6dc5af6a963c6a2986616505745ac7a1e9f90297d2ec9041d4ddf53b536b5ab0b36e9532c9ca435dfe55f44a00181366c0906ca43330757e74602b868bdcbac3d4f5c3199fff8587f72c15f3d11024ef9ddc5946c3a8aff03e186f6145221c8785b4c356dee2da8270d9c6ed6b3152cdd21811048e838d269d17d5ba41dceb36e1e38bb70a16933165a271056b852941afe72cb31bb0a8d51d165d98067ceabd49c9a2d37f30bdadbdfa27d597f92935f996d408ac9485275bc1a76971ef2a773fc9a6ae20d1bdc7a761ad3bba223c80cacbe7c7b64ea1dbb608d38042f4209bc6163016a0527b30334111f7fb6ea94a38ffeec0e36441f8c22b301b79c02e4c513393d2fae4567be75e6ffb579d9f4f1ad865bec241506dfade2d7f3757323f6162affe80138561317ff6876b1ef658c5ef8ed1a5c8231e11004cde81568db0fa538b6bbfa55b41c51a3dc2083c407f3bced71ab5cfb4bd4984ea0388ad394ff67416a6b8883929b91669261643a1105442875b3f386105856f1f984a01df4b2d37c00f8130ba90ca83f025354b499853c85a3a1cebeb02bf5d5c9365aaaa3b081879d4158438a2405a42f7dc6d8b279b98dbd9b2b4a77a3723a5984372900488f22ef5451e276428ebb0c378defa7a891308345fbdd1c58232e315c2fbf71d62a155db4f9889a0cd18f32645cfe9eec3eafe491b0ab2e022b1d91efdbc299cd24b44b17f5d0268f055634dd9266a373944689ffae22081a52a1e9ff3af502cfed1331fe744136c7458b0756ec75a5b9c263aa19976239957c037ee403c16a690f86fe9fe65e05dd1a0efe9bb83015455c4cae5775f397080356cc89f8f06be44db396d572ff93b1eae9a6e6e505f1339090be98348da1e07ae51cc8160f4548ee985412582966f5b89a91fa05d78afeb99dc034006bf2f00e61a8bf1f00f2e9e26d1ea39a263d22ed5512da39a8a4807615f4d7cc57476caafbb9819e8e510dc5eefbabc8d372853fe0100c9a630622caa06ad78d244c47bfe95f2a05405dc5e04ca025af2ef376803385e9afc3da7048f54618bf86da6c71aa10993208d33b866ce6d79c8a860ea4a97610826e21323a653e14604746e2aa7bed52cf3ad99f0dff29971b8b9c7f34255d8b230201af8d6a8e95e891fd97547e903698f631071cc4cdaf404a666ea79b8234cf9764fa67fc9534e406ea28911bc69b9e9cf6297f9a7b5c9cdcb10dee030b4662ece2186aa99fbbeb78de4194c2dc1b5908fb075e8f78bfd18ba0b9dfe35cceb87c9ca440dcb2b1948a0b76f98582a762e1e72f377059ba89b4884493ea812b8427f3aed654187b9ee5fbd6708e8e9dadcda80bc1e0817c5b5ef2d9d23d5c1dbcb09495353aa2ee32d92cc8763865b12a8f16d99fca997ee23630f487c23db3de9ec6994a83ed6fe45f5ae94b496adf9352745bf7e6379e5c4aaae011a127d672e4818cc843081222132ef848fe2ead3983b6b1542aba8ff6d68ad49db7b27a4277e26bd09145247437e4bfae65828c4b94d92bc4eb1f881e839dce2787e2ec3537e270b601557e5b6f4d918b388b5df7686589aeb3148a050a95f07ec5f9590141108a70099a2a7ea5f703afd803463b65bbcf2c9ba713fd213f24cd9c19c991ffc2be6b09a810220b211cbc5dc75f8f23e5ac2b3e7c980f9a672585f8213bd87826447ce5c7ceae21bd8c9b5f747a1bef0b41626d298a7b3297e6bf177473a39f01399b7f79b60afc3e6dbeef06732d01f8832e8a4cfa1898cee46308326b89b48dd0775fff99ead5263f552f815cb4d088a807692687962281473e5e24a38837d2ea71ebbe03f6a3b655dcca22c665c3f2467bc3efd0e694996dd9590ac91140a58151bf0248b4431e49befde1b8ba9f3dc2b871b7f45368ad64f3334f3150250522210b03df0ef9ef0f78372114f5087269dd9dd9f209e27df23b02490dcc199ba0efedc874d24bed406c6c18c993dbe11e8a99a0b5b61b242c280c6326493d15493abb3190a4fab994a25dd2b1bfc206df8238b9e95b8879c8b83e9297f7f41d4da8c073609ffac3f8414b93bfd8cea1a6def84263ab5f2fac8fa6a5d667fd0875eb0129140359742ca99c33ce7c9fa760c8143f4a41aab51e501abdbeefc9a5395fe03be184230ec86ae6af954c71e4c440d01a894e721aba2ad75a0683a87f5ffc1fe5c56d92f8f2d6cdfcd270304294cbf2681962e97c899239e8de76fa5928801db221a9135d0fa63f0b3458281a444cea3ee57fe537a50cfbb0c05780398846a6e19b53ae51f9ae5e12e283c580fc0859aa5f2ab9d900b0a00d94f976953bade5affb0637dac5f069af829083caefcaa97dbe4b5c1f8af71fe65a407546b1afcfbe15ec9adbd391ab99aebb2269da345943501442c8e01c844a08e9a233bce0d8b71458a91a0501439c8a005c7dcc00bc4a786a35ea42be3ba59501e85911af7922c008a262de8492ece13c23cd351193", 0x1000}, {&(0x7f0000000180)="36437e41c8c265c4cd3f5d12697124625562c7727c187a4de1d575d077db794b7cec4993c18b", 0x26}, {&(0x7f0000000240)="0d73b560aa079fc8aa0bfeb5199e5176f68fe9e2cd26aa60f80578b80a4a419f71726ade1445a87316a1573b7999ad15e06f7d88b2cc18cbb978f7c017d8aa94e9e5f891a34b8428bba5258dd48d586591df2940f16d2e77bdd5f69057d2019a1a56b0f2e8c65ca003e00eb6cad3667358ecbc10ff9cb695909fa5b41efb32c1c336041baecdf231", 0x88}, {&(0x7f0000000300)="a6de87d9d7a1f97d38ff2366c4117e9affcf06e0dcead3c0448ae538395149035241173e993f115c0b115ab9cac1f6d59b55074a5168a39bfd6db9c8311dc4577556aed6043870e206e4aa502ed9dc2dce8bebe7b8361e526c07f04324ba21efd7219f9b742487d41e", 0x69}, {&(0x7f0000000380)="235b80eacf2b7fb00fb07141ff221e90eb3b18453fe58bdf554bf956ae199358ec6b4b27dab78d5cbf75b974fe05d5e3f63baeba6c3221543d18bd3e19d233f3538fe91dccbfa85637579c", 0x4b}, {&(0x7f0000003440)="a8dd68eeae9defc84162a7c66ef705cdaa3962bed5d29bd55f4f642f94dc0d113e2560d7339c09b6c8cc5d53a471cb5dea7be451e0bf8a806aa1efb3b2dd6db1143d2eb2be60a8eeae4bf42a308be9dd7a5006ecb27116390fb2d938992e2132057fa5040218c0d093ad2d18c360af54bd4ce48f98630a220302e125d293b5a697b9f609b5", 0x85}], 0x9, 0x2) getsockopt$IP_VS_SO_GET_DAEMON(r1, 0x0, 0x487, &(0x7f00000001c0), &(0x7f00000035c0)=0x30) getsockname$netlink(r0, &(0x7f0000003740), &(0x7f0000003780)=0xc) ioctl$int_in(r1, 0x800000c0045003, &(0x7f0000000200)=0xf000000) setsockopt$IP_VS_SO_SET_EDIT(r0, 0x0, 0x483, &(0x7f0000000000)={0x2f, @loopback=0x7f000001, 0x4e24, 0x0, 'none\x00', 0x24, 0x4, 0x56}, 0x2c) 2018/05/12 22:58:35 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='dctcp\x00', 0x6) sendto$inet6(r0, &(0x7f00004e8000), 0xf401, 0x20000001, &(0x7f000007f000)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe803000000000000]}}, 0x1c) 2018/05/12 22:58:35 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x1c, 0x0, &(0x7f0000000040)=[@request_death={0x400c630e}, @free_buffer={0x40086303}], 0x4c000000, 0x0, &(0x7f0000000080)}) 2018/05/12 22:58:35 executing program 7: r0 = accept$packet(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, &(0x7f0000000040)=0x14) ioctl$sock_SIOCGIFINDEX(0xffffffffffffff9c, 0x8933, &(0x7f0000000140)={'veth1_to_team\x00', 0x0}) bind$packet(r0, &(0x7f00000001c0)={0x11, 0x5, r1, 0x1, 0x0, 0x6, @random="780d41a4875e"}, 0x14) r2 = syz_open_dev$vcsn(&(0x7f0000000200)='/dev/vcs#\x00', 0x10001, 0x88040) ioctl$SG_SET_FORCE_PACK_ID(r2, 0x227b, &(0x7f0000000240)=0x1) r3 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r3, &(0x7f00000002c0)="993d", 0x2, 0x1, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r3, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0xffffffffffffffa9}], 0x1, &(0x7f0000000140)}, 0x0) [ 794.888169] binder: 24352:24354 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 794.895114] IPVS: set_ctl: invalid protocol: 55 224.0.0.2:20002 sh [ 794.922170] binder: 24352:24354 BC_FREE_BUFFER u0000000000000000 no match 2018/05/12 22:58:35 executing program 6: syz_emit_ethernet(0x2a, &(0x7f00000000c0)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000040)={0xffffffffffffffff, 0x80000, [0x0, 0x23, 0xa90]}) 2018/05/12 22:58:35 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}, 0x0, 0x9effffff00000000}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) [ 794.946411] IPVS: set_ctl: invalid protocol: 47 127.0.0.1:20004 none [ 794.953953] binder: 24352:24370 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 2018/05/12 22:58:35 executing program 3: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0xff010000, 0x0, 0x12, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:58:35 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00, 0x3a800}]) 2018/05/12 22:58:35 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='dctcp\x00', 0x6) sendto$inet6(r0, &(0x7f00004e8000), 0xf401, 0x20000001, &(0x7f000007f000)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1802000000000000]}}, 0x1c) 2018/05/12 22:58:35 executing program 7: r0 = socket$inet(0x2, 0x80002, 0x400000005) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) getsockopt$inet_mreqsrc(r0, 0x0, 0x27, &(0x7f0000000040)={@multicast1, @loopback, @loopback}, &(0x7f0000000100)=0xc) openat$ipvs(0xffffffffffffff9c, &(0x7f0000000240)='/proc/sys/net/ipv4/vs/sloppy_sctp\x00', 0x2, 0x0) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000140)='loginuid\x00') getsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r1, 0x6, 0x1d, &(0x7f00000001c0), &(0x7f0000000200)=0x14) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000000)="00c3"}], 0x1, &(0x7f0000000140)}, 0x0) [ 794.999144] binder: 24352:24370 BC_FREE_BUFFER u0000000000000000 no match [ 795.004394] IPVS: set_ctl: invalid protocol: 55 224.0.0.2:20002 sh 2018/05/12 22:58:35 executing program 6: r0 = semget$private(0x0, 0x3, 0x40) semctl$GETVAL(r0, 0x3, 0xc, &(0x7f00000000c0)=""/196) syz_emit_ethernet(0x2a, &(0x7f0000000000)=ANY=[@ANYBLOB="aac8aaaa899d494cef551137a617ec08004500001c0000020000008b78ac141000ac141418120090"], &(0x7f0000000080)={0x0, 0x0, [0x0, 0x0, 0x252]}) semctl$IPC_RMID(r0, 0x0, 0x0) 2018/05/12 22:58:35 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x1c, 0x0, &(0x7f0000000040)=[@request_death={0x400c630e}, @free_buffer={0x40086303}], 0x94ed030000000000, 0x0, &(0x7f0000000080)}) 2018/05/12 22:58:35 executing program 3: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0xc0000, 0x0, 0x12, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:58:35 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}, 0x0, 0x2000000}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) [ 795.160948] binder: 24400:24402 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 795.173141] binder: 24400:24402 BC_FREE_BUFFER u0000000000000000 no match [ 795.263471] binder: 24400:24418 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 795.301668] binder: 24400:24418 BC_FREE_BUFFER u0000000000000000 no match 2018/05/12 22:58:35 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='dctcp\x00', 0x6) sendto$inet6(r0, &(0x7f00004e8000), 0xf401, 0x20000001, &(0x7f000007f000)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1802000000000000]}}, 0x1c) 2018/05/12 22:58:35 executing program 3: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0xe, 0x0, 0x12, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:58:35 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00, 0x31}]) 2018/05/12 22:58:35 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='dctcp\x00', 0x6) sendto$inet6(r0, &(0x7f00004e8000), 0xf401, 0x20000001, &(0x7f000007f000)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff00000000]}}, 0x1c) 2018/05/12 22:58:35 executing program 6: socketpair$inet6(0xa, 0x80003, 0x80000000, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r0, 0x84, 0x6e, &(0x7f00000000c0)=[@in6={0xa, 0x4e21, 0xfff, @loopback={0x0, 0x1}, 0x40}, @in={0x2, 0x4e21, @loopback=0x7f000001}, @in={0x2, 0x5, @broadcast=0xffffffff}, @in6={0xa, 0x4e21, 0x40, @remote={0xfe, 0x80, [], 0xbb}, 0xfffffffffffffffb}], 0x58) syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0x0, 0x0, 0x252]}) 2018/05/12 22:58:35 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140)}, 0x0) ioctl$sock_inet_SIOCGARP(r0, 0x8954, &(0x7f0000000000)={{0x2, 0x4e21, @rand_addr=0x1f}, {0x306, @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}}, 0x4, {0x2, 0x4e20, @broadcast=0xffffffff}, 'team_slave_1\x00'}) 2018/05/12 22:58:35 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}, 0x0, 0x3000000}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) 2018/05/12 22:58:35 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x1c, 0x0, &(0x7f0000000040)=[@request_death={0x400c630e}, @free_buffer={0x40086303}], 0x700000000000000, 0x0, &(0x7f0000000080)}) 2018/05/12 22:58:36 executing program 5: prctl$seccomp(0x26, 0x1, &(0x7f0000000040)) 2018/05/12 22:58:36 executing program 6: syz_emit_ethernet(0x2e, &(0x7f0000000040)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [{[], {0x8100, 0x2, 0x101}}], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0x0, 0x0, 0x252]}) r0 = syz_open_dev$sndmidi(&(0x7f0000000000)='/dev/snd/midiC#D#\x00', 0x5, 0x0) ioctl$sock_inet6_tcp_SIOCINQ(r0, 0x541b, &(0x7f00000000c0)) [ 795.408805] binder: 24425:24441 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 2018/05/12 22:58:36 executing program 7: r0 = socket$inet(0x2, 0x4, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2ed}], 0x1, &(0x7f0000000140)}, 0x0) [ 795.469118] binder: 24425:24441 BC_FREE_BUFFER u0000000000000000 no match [ 795.522010] binder: 24425:24458 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 795.577500] binder: 24425:24458 BC_FREE_BUFFER u0000000000000000 no match 2018/05/12 22:58:36 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00, 0xd}]) 2018/05/12 22:58:36 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='dctcp\x00', 0x6) sendto$inet6(r0, &(0x7f00004e8000), 0xf401, 0x20000001, &(0x7f000007f000)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f4]}}, 0x1c) 2018/05/12 22:58:36 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}, 0x0, 0x7f000001}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) 2018/05/12 22:58:36 executing program 3: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x3, 0x12, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:58:36 executing program 5: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={0xffffffffffffff9c, 0x2, 0x1, 0x9, &(0x7f0000000080)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0xa}, 0x20) ioctl$SNDRV_SEQ_IOCTL_GET_CLIENT_POOL(r0, 0xc058534b, &(0x7f0000004a80)={0xa2, 0x0, 0x2, 0x8, 0x0, 0x80000001}) ioctl$SG_GET_RESERVED_SIZE(r0, 0x2272, &(0x7f0000000100)) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000140)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$rdma_cm(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="4419d8ced548992a7f72b79755ad9f466f9e86ba87f2789018ef893995096889e720c269454d362ac2e7b6b71d787ae4b572870741136f6a349c1211d99b85dc3b4e2be7324028b4b9d2cbebb882c42e89c55adc7615b53c4ccb2d85ec0cf928fec3863079cbbd5a2ee9946a193b5489a1bc15a423d87fbf044949245a8cb33e61c9594c9658df88ba1b7c775f0098a0b57764ef4b7141c6389473"], 0xfffffffffffffece) write$rdma_cm(r1, &(0x7f0000000380)=ANY=[@ANYBLOB="0f000000084000fa", @ANYRES32=0xffffffff, @ANYBLOB='\x00\x00\x00\x00'], 0x10) recvmmsg(r0, &(0x7f0000004840)=[{{0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000000140)}, {&(0x7f00000003c0)=""/226, 0xe2}, {&(0x7f0000000180)=""/32, 0x20}, {&(0x7f00000001c0)=""/18, 0x12}, {&(0x7f00000004c0)=""/145, 0x91}], 0x5, &(0x7f0000000200)=""/24, 0x18, 0xb114}, 0x4}, {{&(0x7f0000000580)=@ax25, 0x80, &(0x7f00000008c0)=[{&(0x7f0000000600)=""/221, 0xdd}, {&(0x7f0000000700)=""/92, 0x5c}, {&(0x7f0000000780)=""/66, 0x42}, {&(0x7f0000000800)=""/139, 0x8b}], 0x4, &(0x7f0000000900)=""/212, 0xd4, 0xe66}, 0x8}, {{&(0x7f0000000a00)=@llc={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, 0x80, &(0x7f0000001f80)=[{&(0x7f0000000a80)=""/126, 0x7e}, {&(0x7f0000000b00)=""/161, 0xa1}, {&(0x7f0000000bc0)=""/43, 0x2b}, {&(0x7f0000000c00)=""/243, 0xf3}, {&(0x7f0000000d00)=""/186, 0xba}, {&(0x7f0000000dc0)=""/4096, 0x1000}, {&(0x7f0000001dc0)=""/200, 0xc8}, {&(0x7f0000001ec0)=""/136, 0x88}], 0x8, &(0x7f0000002000)=""/220, 0xdc, 0x6}, 0x9833}, {{&(0x7f0000002100)=@in={0x0, 0x0, @dev}, 0x80, &(0x7f0000002400)=[{&(0x7f0000002180)=""/143, 0x8f}, {&(0x7f0000002240)}, {&(0x7f0000002280)=""/127, 0x7f}, {&(0x7f0000002300)=""/246, 0xf6}], 0x4, 0x0, 0x0, 0x7}, 0xf30}, {{&(0x7f0000002440)=@sco, 0x80, &(0x7f0000002780)=[{&(0x7f00000024c0)=""/31, 0x1f}, {&(0x7f0000002500)=""/31, 0x1f}, {&(0x7f0000002540)=""/116, 0x74}, {&(0x7f00000025c0)=""/191, 0xbf}, {&(0x7f0000002680)=""/233, 0xe9}], 0x5, &(0x7f0000002800)=""/113, 0x71, 0x4}, 0x2}, {{&(0x7f0000002880)=@pppol2tp={0x0, 0x0, {0x0, 0xffffffffffffffff, {0x0, 0x0, @remote}}}, 0x80, &(0x7f0000003e80)=[{&(0x7f0000002900)=""/244, 0xf4}, {&(0x7f0000002a00)=""/83, 0x53}, {&(0x7f0000002a80)=""/255, 0xff}, {&(0x7f0000002b80)=""/81, 0x51}, {&(0x7f0000002c00)=""/146, 0x92}, {&(0x7f0000002cc0)=""/247, 0xf7}, {&(0x7f0000002dc0)=""/170, 0xaa}, {&(0x7f0000002e80)=""/4096, 0x1000}], 0x8, &(0x7f0000003f00)=""/115, 0x73, 0xa7d6}, 0x4}, {{0x0, 0x0, &(0x7f0000004500)=[{&(0x7f0000003f80)=""/127, 0x7f}, {&(0x7f0000004000)=""/200, 0xc8}, {&(0x7f0000004100)=""/162, 0xa2}, {&(0x7f00000041c0)=""/76, 0x4c}, {&(0x7f0000004240)=""/185, 0xb9}, {&(0x7f0000004300)=""/215, 0xd7}, {&(0x7f0000004400)=""/48, 0x30}, {&(0x7f0000004440)=""/171, 0xab}], 0x8, &(0x7f0000004580)=""/196, 0xc4, 0xff}, 0xa00000000}, {{&(0x7f0000004680)=@pppol2tp={0x0, 0x0, {0x0, 0xffffffffffffffff, {0x0, 0x0, @multicast2}}}, 0x80, &(0x7f00000047c0)=[{&(0x7f0000004700)=""/138, 0x8a}], 0x1, &(0x7f0000004800)=""/60, 0x3c, 0x200}, 0x1}], 0x8, 0x100, &(0x7f0000004a40)) 2018/05/12 22:58:36 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) sendto$inet(r0, &(0x7f00000002c0)="997d", 0x2, 0x4004, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140)}, 0x0) openat$uinput(0xffffffffffffff9c, &(0x7f0000000140)='/dev/uinput\x00', 0x101400, 0x0) recvfrom$inet(r0, &(0x7f0000000900)=""/4096, 0x1000, 0x10042, &(0x7f0000000000)={0x2, 0x4e21, @loopback=0x7f000001}, 0x10) 2018/05/12 22:58:36 executing program 6: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") unshare(0x20020000) mknod$loop(&(0x7f0000000340)='./file0\x00', 0x0, 0xffffffffffffffff) poll(&(0x7f00000000c0)=[{r0, 0x1000}], 0x1, 0x0) mount(&(0x7f0000018000)='./file0\x00', &(0x7f0000027000)='./file0\x00', &(0x7f0000018ffa)='Qamfs\x00', 0x105403, &(0x7f000000a000)) clock_gettime(0x0, &(0x7f0000000040)={0x0}) nanosleep(&(0x7f0000000100)={r1}, &(0x7f0000000140)) unlink(&(0x7f0000933ff8)='./file0\x00') syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0x0, 0x0, 0x252]}) 2018/05/12 22:58:36 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x1c, 0x0, &(0x7f0000000040)=[@request_death={0x400c630e}, @free_buffer={0x40086303}], 0xe4ed0300, 0x0, &(0x7f0000000080)}) [ 795.674513] binder: 24475:24477 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 795.685152] binder: 24475:24477 BC_FREE_BUFFER u0000000000000000 no match 2018/05/12 22:58:36 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}, 0x0, 0xf}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) 2018/05/12 22:58:36 executing program 7: r0 = socket$inet(0x2, 0xfffffffffffffffe, 0xfffffffffffffffe) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x40000, 0x0) mq_getsetattr(r1, &(0x7f0000000040)={0x8, 0x101, 0x800, 0xdad, 0x0, 0x101, 0x7, 0xc4}, &(0x7f0000000140)) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140)}, 0x0) 2018/05/12 22:58:36 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00, 0x20000000}]) 2018/05/12 22:58:36 executing program 3: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0xf00000000000000, 0x12, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:58:36 executing program 5: r0 = open(&(0x7f0000ae8ff8)='./file0\x00', 0x14104a, 0x0) write$evdev(r0, &(0x7f0000037fe8)=[{}], 0x18) sendfile(r0, r0, &(0x7f00009bcffe), 0x2000000000004c35) sendfile(r0, r0, &(0x7f0000000200), 0x80003ffd) r1 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(r0, 0x84, 0x1d, &(0x7f0000000340)={0x8, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, &(0x7f0000000140)=0xfffffffffffffd37) getsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f0000000240)={r2, @in6={{0xa, 0x4e20, 0x5, @local={0xfe, 0x80, [], 0xaa}, 0x100000000}}, 0x6, 0xffff, 0xff, 0x101, 0x2}, &(0x7f00000001c0)=0x98) creat(&(0x7f0000000000)='./file0\x00', 0x0) r3 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000100)={0xffffffffffffffff, 0x0, 0x1, 0x0, &(0x7f00000000c0)=[0x0], 0x1}, 0x20) sendmsg$key(0xffffffffffffffff, &(0x7f0000000000)={0x2000000, 0x0, &(0x7f0000000080)={&(0x7f0000333f88)=ANY=[]}, 0x1}, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000180)='/dev/sequencer2\x00', 0x400001, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000040)={0x0, @multicast1, @loopback}, &(0x7f0000000300)=0xc) ioctl$sock_inet6_SIOCDIFADDR(r1, 0x8936, &(0x7f0000000380)={@local={0xfe, 0x80, [], 0xaa}, 0x10, r4}) [ 795.730360] binder: 24475:24494 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 795.756871] binder: 24475:24494 BC_FREE_BUFFER u0000000000000000 no match 2018/05/12 22:58:37 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x1c, 0x0, &(0x7f0000000040)=[@request_death={0x400c630e}, @free_buffer={0x40086303}], 0x6c00, 0x0, &(0x7f0000000080)}) 2018/05/12 22:58:37 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00, 0x12000000}]) 2018/05/12 22:58:37 executing program 7: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/vs/snat_reroute\x00', 0x2, 0x0) setsockopt$sock_void(r0, 0x1, 0x1b, 0x0, 0x0) r1 = socket$inet(0x2, 0x3, 0x1) openat$autofs(0xffffffffffffff9c, &(0x7f0000000140)='/dev/autofs\x00', 0x105002, 0x0) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000040)='syzkaller1\x00', 0x10) sendto$inet(r1, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r1, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140)}, 0x0) 2018/05/12 22:58:37 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}, 0x0, 0xaa593a576e000000}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) 2018/05/12 22:58:37 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='dctcp\x00', 0x6) sendto$inet6(r0, &(0x7f00004e8000), 0xf401, 0x20000001, &(0x7f000007f000)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7000000]}}, 0x1c) 2018/05/12 22:58:37 executing program 3: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0xd00000000000000, 0x12, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:58:37 executing program 5: r0 = open(&(0x7f0000ae8ff8)='./file0\x00', 0x14104a, 0x0) write$evdev(r0, &(0x7f0000037fe8)=[{}], 0x18) sendfile(r0, r0, &(0x7f00009bcffe), 0x2000000000004c35) sendfile(r0, r0, &(0x7f0000000200), 0x80003ffd) r1 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(r0, 0x84, 0x1d, &(0x7f0000000340)={0x8, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, &(0x7f0000000140)=0xfffffffffffffd37) getsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f0000000240)={r2, @in6={{0xa, 0x4e20, 0x5, @local={0xfe, 0x80, [], 0xaa}, 0x100000000}}, 0x6, 0xffff, 0xff, 0x101, 0x2}, &(0x7f00000001c0)=0x98) creat(&(0x7f0000000000)='./file0\x00', 0x0) r3 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000100)={0xffffffffffffffff, 0x0, 0x1, 0x0, &(0x7f00000000c0)=[0x0], 0x1}, 0x20) sendmsg$key(0xffffffffffffffff, &(0x7f0000000000)={0x2000000, 0x0, &(0x7f0000000080)={&(0x7f0000333f88)=ANY=[]}, 0x1}, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000180)='/dev/sequencer2\x00', 0x400001, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000040)={0x0, @multicast1, @loopback}, &(0x7f0000000300)=0xc) ioctl$sock_inet6_SIOCDIFADDR(r1, 0x8936, &(0x7f0000000380)={@local={0xfe, 0x80, [], 0xaa}, 0x10, r4}) 2018/05/12 22:58:37 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)=ANY=[@ANYBLOB="aaaaaaaaaaaa8d9d494c17ee08004500001c0000009078ac141400ac1414bb1200907800000000000000"], &(0x7f0000000080)={0x0, 0x0, [0x0, 0x0, 0x252]}) semget$private(0x0, 0x3, 0x210) r0 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={0xffffffffffffff9c, 0x2, 0x1, 0x0, &(0x7f0000000040)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0xa}, 0x20) bind$ipx(r0, &(0x7f0000000100)={0x4, 0xffffffffffffffe0, 0x5, "80596c6757fd", 0x3}, 0x10) 2018/05/12 22:58:37 executing program 6: syz_emit_ethernet(0x2a, &(0x7f00000001c0)=ANY=[@ANYBLOB="aaaaaaaaaaaa8d9d494c17ee08004500001c0000000000009078ac141400ac1414bb12009078000000005a68800347e951edcb9b7169a7c0bb4171971e6f85d062bb983ba81b78dcb6dc533bdba1cd06e8bcf3bebe8da571f50b8225e00c0456fb0d6ff1a675cd0ed33f0f92e26c5f7ed875c3516af134584701eb0e3fdd8b96eb3ec1d9c226c2d17a09ce68192eb01f01c16c5a75f4d8a718c75089fdd130bc468a057531b1ae189653226f40de4b3e9e4603691820d89b81fe6f68c2bb681412be09abe3a8100bc82ccdad133d25bf6f69389f050824f6562a1bfd3aa156169c40b232fc661f83cd28e00fdc588c7562dd4379b5c62ddaba11e65d427fdce8e6b486a4c80572c7f16e6ee32bfee1c0da80ebecc5a14497385422dd2871243cbb90481868c9d1566084f94f734898ad4e9ef918ba8b8bce972c6e6f3a9780ebe7c090b84ef030e67aa8269df6e506d346b82ce9d33ac6f0707dd53dd0a9585d4c758013d17e6223ae5938832669f94c934fd0a14a73fb380c88908b2fc49fdd9cb691e5bb9e2b45da29bf1318b629661d265cbef9f3c24f054cadd4aeb777c040e72fd2a1e556d15b26d27713c14fae0116c3a51fde130e"], &(0x7f0000000080)={0x0, 0x0, [0x0, 0x0, 0x252]}) r0 = dup2(0xffffffffffffff9c, 0xffffffffffffffff) r1 = openat(r0, &(0x7f0000000000)='./file0\x00', 0x400000040000, 0x8) setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0x7, &(0x7f0000000040)={0x7f, 0x2, 0x100, 0x400}, 0x10) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(r1, 0x84, 0x13, &(0x7f0000000100)={0x0, 0x80}, &(0x7f0000000140)=0x8) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000380)={0x0, @in6={{0xa, 0x4e21, 0x8001, @dev={0xfe, 0x80, [], 0x1a}, 0x9}}, 0x7, 0xffffffffffffff1e, 0x5, 0x0, 0x80}, &(0x7f0000000180)=0x98) ioctl$int_out(r1, 0x5462, &(0x7f0000000540)) getsockopt$inet_sctp_SCTP_STATUS(r1, 0x84, 0xe, &(0x7f0000000440)={r2, 0xfffffffffffffffc, 0x2f7, 0x84f, 0x3ff, 0x7fffffff, 0x0, 0x6, {r3, @in={{0x2, 0x4e20, @multicast1=0xe0000001}}, 0x1000, 0x65e6, 0xd74d, 0x2, 0x8001}}, &(0x7f0000000500)=0xb0) ioctl$BLKRAGET(r1, 0x1263, &(0x7f00000000c0)) 2018/05/12 22:58:37 executing program 3: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x6000000000000, 0x12, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) [ 796.916395] binder: 24530:24532 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 796.944619] binder: 24530:24532 BC_FREE_BUFFER u0000000000000000 no match 2018/05/12 22:58:37 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) restart_syscall() setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140)}, 0x0) 2018/05/12 22:58:37 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00, 0x3700}]) 2018/05/12 22:58:37 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='dctcp\x00', 0x6) sendto$inet6(r0, &(0x7f00004e8000), 0xf401, 0x20000001, &(0x7f000007f000)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff000000]}}, 0x1c) 2018/05/12 22:58:37 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}, 0x0, 0x8000000000000000}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) [ 796.976165] binder: 24530:24549 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 796.998178] binder: 24530:24549 BC_FREE_BUFFER u0000000000000000 no match 2018/05/12 22:58:37 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0x0, 0x0, 0x252]}) pkey_alloc(0x0, 0x3) 2018/05/12 22:58:37 executing program 3: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x82000000, 0x12, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:58:37 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x1c, 0x0, &(0x7f0000000040)=[@request_death={0x400c630e}, @free_buffer={0x40086303}], 0xa, 0x0, &(0x7f0000000080)}) [ 797.214908] binder: 24580:24581 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 797.268162] binder: 24580:24581 BC_FREE_BUFFER u0000000000000000 no match [ 797.294162] binder: 24580:24589 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 797.314890] binder: 24580:24589 BC_FREE_BUFFER u0000000000000000 no match 2018/05/12 22:58:38 executing program 7: r0 = socket$inet(0x2, 0x3, 0x2002) setsockopt$inet_mreq(r0, 0x0, 0x27, &(0x7f0000000000)={@local={0xac, 0x14, 0x14, 0xaa}, @local={0xac, 0x14, 0x14, 0xaa}}, 0x8) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='veth0_to_team\x00', 0xffffffffffffff1b) r1 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000140)={r0, 0x3, 0x0, 0x7, &(0x7f0000000040)=[0x0, 0x0], 0x2}, 0x20) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x2400, 0x0) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140)}, 0x0) 2018/05/12 22:58:38 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00, 0x3f00}]) 2018/05/12 22:58:38 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='dctcp\x00', 0x6) sendto$inet6(r0, &(0x7f00004e8000), 0xf401, 0x20000001, &(0x7f000007f000)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1802]}}, 0x1c) 2018/05/12 22:58:38 executing program 3: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x20000000, 0x12, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:58:38 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}, 0x0, 0x9effffff}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) 2018/05/12 22:58:38 executing program 6: syz_emit_ethernet(0xf9, &(0x7f00000000c0)=ANY=[@ANYBLOB="aaaaaaaaaaaa8d9d494c17ee0004ab01bf36219a00fdb7ae6676897d7faacca6db9db02c81d3a466b5c09f5c79bb5b757d2c46d0fc2651fd008dca92694415a183f9206750634e7653171c020b39cb404ffbfba3e1178df1298525c39f7bff69e34e118b592bf33c312c864036c080b73e51f4ba7f00000000000000b68247662045b6d3099f5209af52ca176d8ba34616019489c6b3e70889cde138a3488ac978fa448526f052dd9f77eb3dfab772136552b03a996c82c5b6170a1826f9ecf80bc95b7b4eebeb8abe643afac81bbb16a7fd920ba3471523de02d985fb91fd2dead9d87f2165d0c279fc887dd5941fc2b3f2444681d992e853"], &(0x7f0000000080)={0x0, 0x0, [0x2, 0x0, 0x252]}) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) setsockopt$netlink_NETLINK_NO_ENOBUFS(r0, 0x10e, 0x5, &(0x7f0000000000)=0xb725, 0x4) 2018/05/12 22:58:38 executing program 5: r0 = syz_open_dev$dspn(&(0x7f0000000040)='/dev/dsp#\x00', 0x1, 0x24002) setsockopt$inet_sctp6_SCTP_AUTO_ASCONF(r0, 0x84, 0x1e, &(0x7f0000001140)=0x7ff, 0x4) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000001100)={0x2, 0x0, &(0x7f0000000080)=""/77, &(0x7f0000000000)=""/13, &(0x7f0000000100)=""/4096, 0x1}) 2018/05/12 22:58:38 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x1c, 0x0, &(0x7f0000000040)=[@request_death={0x400c630e}, @free_buffer={0x40086303}], 0x7, 0x0, &(0x7f0000000080)}) [ 797.817679] binder: 24594:24597 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 797.841187] binder: 24594:24597 BC_FREE_BUFFER u0000000000000000 no match 2018/05/12 22:58:38 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @empty, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000040)={0x0, 0x0, [0x0, 0x0, 0x252]}) r0 = syz_open_dev$admmidi(&(0x7f0000000080)='/dev/admmidi#\x00', 0x5, 0x0) write$tun(r0, &(0x7f00000000c0)={@pi={0x0, 0x6007}, @void, @eth={@link_local={0x1, 0x80, 0xc2}, @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, [{[], {0x8100, 0x1, 0x6, 0x3}}], {@ipv4={0x800, {{0x11, 0x4, 0x5, 0x3, 0x58, 0x64, 0xfffffffffffffff7, 0x1000, 0x2f, 0x0, @empty, @multicast1=0xe0000001, {[@timestamp={0x44, 0x18, 0x85fd, 0x1, 0x5, [{[@local={0xac, 0x14, 0x14, 0xaa}], 0xfffffffffffffffc}, {[@multicast1=0xe0000001], 0x800}, {}]}, @ssrr={0x89, 0x7, 0x81, [@remote={0xac, 0x14, 0x14, 0xbb}]}, @generic={0xcc, 0xe, "259b4a47f705e2c34d6f9a44"}]}}, @icmp=@timestamp_reply={0xe, 0x0, 0x0, 0x5, 0x8, 0x15d, 0x6, 0x9}}}}}}, 0x6e) ioctl$KDGKBMODE(r0, 0x4b44, &(0x7f0000000140)) socketpair$inet6_dccp(0xa, 0x6, 0x0, &(0x7f0000000180)) 2018/05/12 22:58:38 executing program 7: r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c) ioctl$DRM_IOCTL_AGP_ENABLE(r0, 0x40086432, &(0x7f0000000140)=0x2f00) r1 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) r2 = syz_open_dev$vcsn(&(0x7f0000000000)='/dev/vcs#\x00', 0xff, 0x300) recvmsg$kcm(r2, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000400)=[{&(0x7f0000000300)=""/83, 0x53}, {&(0x7f0000000380)=""/86, 0x56}, {&(0x7f00000001c0)=""/20, 0x14}, {&(0x7f0000000240)=""/43, 0x2b}], 0x4, &(0x7f0000000440)=""/225, 0xe1, 0xe6e6}, 0x20) socketpair$unix(0x1, 0x1000000000005, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r3, 0x1, 0x1a, &(0x7f0000021ff0)={0x2, &(0x7f0000000000)=[{0x28, 0x0, 0x0, 0xfffffffffffff004}, {0x6}]}, 0x10) writev(r4, &(0x7f00000012c0)=[{&(0x7f0000001240)="11", 0x1}], 0x1) ioctl$KDGKBLED(r2, 0x4b64, &(0x7f0000000040)) sendto$inet(r1, &(0x7f00000002c0)="993d", 0x2aa, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r1, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140)}, 0x0) sendto$inet(r1, &(0x7f0000000580)="3dbf5c5ffe8679e8388f8c3ec1d77254fb57ec2ea269fdbd0e5c7d657842a789f9bc689a76bc9eb23f9dc037dc50973440ea0aeacbe799933d767e774edacc7a726ba9c7572cd1bb45792485702305cb1bd29fcf9c403d94c681499cae72fa8e08233277e33c6b266af471a4301f58680fb2892bb337429cd391b6a6a184b2a89dd3db9b3e3c2ef86bfb94d3a168d9eff4262b925c86776f1fd40f56f3", 0x9d, 0x80, &(0x7f0000000680)={0x2, 0x4e22, @broadcast=0xffffffff}, 0x10) 2018/05/12 22:58:38 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}, 0x0, 0xa9080000}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) 2018/05/12 22:58:38 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00, 0xfefe00}]) 2018/05/12 22:58:38 executing program 3: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x781, 0x12, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) [ 797.879857] binder: 24594:24616 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 797.904333] binder: 24594:24616 BC_FREE_BUFFER u0000000000000000 no match 2018/05/12 22:58:38 executing program 5: r0 = socket(0x2, 0x8000000000000003, 0x7) ioctl(r0, 0x8912, &(0x7f0000000280)="c6295e4eca6c09b612ec6f") r1 = syz_open_dev$vcsa(&(0x7f0000000080)='/dev/vcsa#\x00', 0xffffffff, 0x400) ioctl$BLKFRASET(r1, 0x1264, &(0x7f0000000100)) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmmsg(r2, &(0x7f0000003d00)=[{{&(0x7f0000000000)=@nl=@kern={0x10}, 0x80, &(0x7f0000000900), 0x0, &(0x7f00000009c0)=[{0x10}], 0x10}}], 0x1, 0x0) syz_open_dev$sndpcmc(&(0x7f00000000c0)='/dev/snd/pcmC#D#c\x00', 0xc9, 0x400) ioctl$VHOST_GET_VRING_ENDIAN(r1, 0x4008af14, &(0x7f0000000140)={0x3, 0xfffffffffffff65f}) 2018/05/12 22:58:38 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0x0, 0x0, 0x252]}) r0 = socket(0x10, 0x803, 0x6) connect$pppoe(r0, &(0x7f0000000040)={0x18, 0x0, {0x3, @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, 'veth1_to_bond\x00'}}, 0x1e) 2018/05/12 22:58:38 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}, 0x0, 0xa00}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) 2018/05/12 22:58:38 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00, 0x200000000000000}]) 2018/05/12 22:58:38 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x1c, 0x0, &(0x7f0000000040)=[@request_death={0x400c630e}, @free_buffer={0x40086303}], 0x6c00000000000000, 0x0, &(0x7f0000000080)}) [ 798.123484] binder: 24643:24645 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 798.167599] binder: 24643:24645 BC_FREE_BUFFER u0000000000000000 no match [ 798.186091] binder: 24643:24656 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 798.193870] binder: 24643:24656 BC_FREE_BUFFER u0000000000000000 no match 2018/05/12 22:58:39 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='dctcp\x00', 0x6) sendto$inet6(r0, &(0x7f00004e8000), 0xf401, 0x20000001, &(0x7f000007f000)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6]}}, 0x1c) 2018/05/12 22:58:39 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00, 0x1200000000000000}]) 2018/05/12 22:58:39 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}, 0x0, 0x34000}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) 2018/05/12 22:58:39 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x1c, 0x0, &(0x7f0000000040)=[@request_death={0x400c630e}, @free_buffer={0x40086303}], 0x9310, 0x0, &(0x7f0000000080)}) 2018/05/12 22:58:39 executing program 7: setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(0xffffffffffffffff, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140)}, 0x0) 2018/05/12 22:58:39 executing program 5: openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu\x00', 0x200002, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000040), 0x10000) 2018/05/12 22:58:39 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000040)=ANY=[@ANYBLOB="aaaaaaaaaaaa8d9d494c17ee08004500001c0000000000009078ac141400ac1414bb1200907800006896ead733fc672092c9bb2f940000"], &(0x7f0000000080)={0x0, 0x0, [0x0, 0x0, 0x252]}) r0 = shmget(0x1, 0x1000, 0x4, &(0x7f0000fff000/0x1000)=nil) shmctl$SHM_INFO(r0, 0xe, &(0x7f0000000000)=""/28) 2018/05/12 22:58:39 executing program 3: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x2, 0x12, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) [ 798.809507] binder: 24674:24677 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 2018/05/12 22:58:39 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) r1 = socket(0x11, 0xe, 0xfe4) setsockopt$bt_BT_DEFER_SETUP(r1, 0x112, 0x7, &(0x7f0000000000)=0x80000000, 0x4) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140)}, 0x0) 2018/05/12 22:58:39 executing program 5: r0 = socket(0xa, 0x1, 0x0) accept(r0, &(0x7f0000000000)=@ipx, &(0x7f0000000080)=0x80) ioctl(r0, 0x8008913, &(0x7f00000012c0)="c65e4eca6cffb612ec6fa0af67b7095fad8f4e76ecf70846b7ede7dcea45d613a38e729dbe553374d372c283511fcb5c3190ef378c29a28faf7bad0ce700f831f57ddbe9e045000000518818565a7dc964d4b9e3745d4fe336446dc93f506027f4133d4ac104d12a400afcc462d81af95e3592cc456df74518e52fa47a3b31e33667eaaf752e3327e7ee1db965159be1ad6e87e04b805038cf8634858c3084c89e9702dd1a8f7e4ee8c1a14d77de542c13c71d39eff799b8ae86d722d3299b9f2a594a5f9fbae604f49f2fa371a3d67a3c412227b23424a8dd142fc42d2aeef925f366acdd73cc4c5049f0a17e3e3d00547ed9691edc584cafb0e6cb79bb7ff340b037c6f8c09aa646568c742ed07c18bdaec63abb0d31a4fc0706") r1 = syz_open_dev$mice(&(0x7f00000000c0)='/dev/input/mice\x00', 0x0, 0x4100) ioctl$TUNSETOFFLOAD(r1, 0x400454d0, 0x0) ioctl$KVM_UNREGISTER_COALESCED_MMIO(r1, 0x4010ae68, &(0x7f0000001400)={0x8, 0x100000}) setsockopt$inet_msfilter(r1, 0x0, 0x29, &(0x7f0000001440)={@multicast2=0xe0000002, @dev={0xac, 0x14, 0x14, 0xd}, 0x0, 0x4, [@loopback=0x7f000001, @rand_addr=0x3, @empty, @local={0xac, 0x14, 0x14, 0xaa}]}, 0xbe) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x2, 0x32, 0xffffffffffffffff, 0x0) r2 = socket$inet(0x2, 0x3, 0x20000000082) delete_module(&(0x7f0000000140)='wlan1vmnet0.@\x00', 0x800) getsockopt$EBT_SO_GET_ENTRIES(r2, 0x0, 0x83, &(0x7f0000001200)={'nat\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00@\x00\x00\b\x00', 0x0, 0x1, 0x1000, [], 0x0, &(0x7f00000001c0), &(0x7f0000000200)=""/4096}, &(0x7f0000001280)=0x78) connect(r1, &(0x7f0000000180)=@pppol2tpv3in6={0x18, 0x1, {0x0, r0, 0x0, 0x4, 0x4, 0x0, {0xa, 0x4e24, 0xfffffffffffff000, @ipv4={[], [0xff, 0xff], @broadcast=0xffffffff}, 0x1}}}, 0x80) 2018/05/12 22:58:39 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)=ANY=[@ANYBLOB="aaaaaaaaaaaa8d9d494c17ee08004500001c0000000000009078ac141400ac1414bb1200907800000000"], &(0x7f0000000080)={0x0, 0x0, [0x0, 0x0, 0x252]}) r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000140)='/dev/sequencer\x00', 0x0, 0x0) getsockopt$inet_sctp6_SCTP_MAX_BURST(r0, 0x84, 0x14, &(0x7f00000000c0)=@assoc_value={0x0}, &(0x7f0000000100)=0x8) sendmsg$unix(r0, &(0x7f0000000440)={&(0x7f0000000180)=@abs={0x1, 0x0, 0x4e21}, 0x6e, &(0x7f0000000400)=[{&(0x7f0000000200)="31dc5c0e0aa9797307e36ad4bf2b916f20d3c8103b71bfcad14cc32d2c24af741556acd3682778ec221466e821b2b9466f4027f26844eed2c350786662b483a829d94e04240a0ef4f3caf8985f19831fe59b55c0101fe5de2378d5c6b92b07f1648988517ec5321f7dc6ae2c059d6f0cd829dd3c4c926fef2a602543527819c23cc2c9dc4717a4316ac8ce4cef355f89dc27ac904b61cd66ac513084e4da27e87de37fd705128d9d26f21e6444c6087aec560c783b8eb555865c9e3763202eb3f5e3a14a8cb9ab8a8f386e668c8594b8775e8ba390d97e968b55372df131b5fe6f4a54e7", 0xe4}, {&(0x7f0000000300)="288945e529088e902e9101ba66d2bb264b149652cb6a", 0x16}, {&(0x7f0000000340)="cfa96cbb108d5ecef8aede6095db4772639084ef6ef9f3d69ba59b9a687fcb9a0880ef89d1d95c916e79e9bd6c82780dc345f2ff934e250cec1acf64878030dd6411be4de58409c91c06887eb29eb644da253af7cd4a82f3306da0d7609f030a99dbe8e44b6d54e7b40175cb65c4b5ae891f4c433733c734dbcd8820cdaa6204a68fee13be188bcb4c1115c5ab6c3b585bdc0fac5c0d37", 0x97}], 0x3, 0x0, 0x0, 0x20000000}, 0x1) setsockopt$inet_sctp_SCTP_AUTH_DEACTIVATE_KEY(r0, 0x84, 0x23, &(0x7f0000000040)={r1, 0xffff}, 0x8) 2018/05/12 22:58:39 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00, 0x800800000000}]) 2018/05/12 22:58:39 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}, 0x0, 0xffffffc0}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) [ 798.852366] binder: 24674:24677 BC_FREE_BUFFER u0000000000000000 no match [ 798.888574] binder: 24674:24689 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 798.943573] binder: 24674:24689 BC_FREE_BUFFER u0000000000000000 no match 2018/05/12 22:58:40 executing program 3: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x64000000, 0x12, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:58:40 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) recvmsg(r0, &(0x7f0000000580)={&(0x7f00000001c0)=@hci, 0x80, &(0x7f00000004c0)=[{&(0x7f0000000300)=""/156, 0x9c}, {&(0x7f00000003c0)=""/99, 0x63}, {&(0x7f0000000040)}, {&(0x7f0000000440)=""/113, 0x71}, {&(0x7f0000000140)=""/37, 0x25}, {&(0x7f0000000240)=""/53, 0x35}], 0x6, &(0x7f0000000540)=""/63, 0x3f, 0x1}, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cpuacct.usage_user\x00', 0x0, 0x0) ioctl$KVM_SET_SIGNAL_MASK(r1, 0x4004ae8b, &(0x7f00000005c0)={0xc, "fadf7b9a0ae56d0d29d8988d"}) fcntl$dupfd(r0, 0x0, r0) connect$ipx(r1, &(0x7f0000000600)={0x4, 0xfffffffffffff508, 0x2, "bf2b422c019f", 0x2}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140)}, 0x0) 2018/05/12 22:58:40 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)=ANY=[@ANYBLOB="aaaaaaaaaaaa8d9d494c17ee08004500001c000000000000907804141400ac1414bb1200907800d4632a"], &(0x7f0000000080)={0x0, 0x0, [0x0, 0x0, 0x252]}) r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040)='/dev/uinput\x00', 0x0, 0x0) getsockopt$inet_sctp6_SCTP_NODELAY(r0, 0x84, 0x3, &(0x7f00000000c0), &(0x7f0000000100)=0x4) 2018/05/12 22:58:40 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}, 0x0, 0xfffff000}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) 2018/05/12 22:58:40 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00, 0x8008}]) 2018/05/12 22:58:40 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x1c, 0x0, &(0x7f0000000040)=[@request_death={0x400c630e}, @free_buffer={0x40086303}], 0x600, 0x0, &(0x7f0000000080)}) 2018/05/12 22:58:40 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='dctcp\x00', 0x6) sendto$inet6(r0, &(0x7f00004e8000), 0xf401, 0x20000001, &(0x7f000007f000)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000]}}, 0x1c) 2018/05/12 22:58:40 executing program 5: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='cpuset.effective_mems\x00', 0x0, 0x0) ioctl$SG_GET_VERSION_NUM(r0, 0x2282, &(0x7f0000000180)) perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r1, 0x29, 0x20, &(0x7f0000000000)={@remote={0xfe, 0x80, [], 0xbb}, 0x0, 0x0, 0x3, 0x1}, 0x20) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$IP_VS_SO_GET_DESTS(r2, 0x0, 0x484, &(0x7f00000000c0)=""/91, &(0x7f0000000040)=0x5b) bind$inet6(r2, &(0x7f00001fefe4)={0xa, 0x4e22}, 0x1c) listen(r2, 0x0) connect$inet6(r1, &(0x7f00001cd000)={0xa, 0x4e22, 0x0, @ipv4={[], [0xff, 0xff]}}, 0x1c) setsockopt$inet6_IPV6_ADDRFORM(r1, 0x29, 0x1, &(0x7f0000000080)=0x2, 0x4) [ 799.816863] IPVS: length: 91 != 24 [ 799.822649] binder: 24722:24732 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 799.840218] IPVS: length: 91 != 24 2018/05/12 22:58:40 executing program 7: r0 = socket$inet(0x2, 0x80005, 0x10004) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140)}, 0x0) 2018/05/12 22:58:40 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00, 0xeffd}]) 2018/05/12 22:58:40 executing program 3: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x10, 0x12, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:58:40 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000100)=ANY=[@ANYBLOB="aaaaaaaaaaaa8d9d494c17ee08004500001c0000000000009078ac141400ac1414bb12009078000000003f1f15a6a800955502a2a8f41833d18b2f2acc0b26c355ca87bc58c0baede4928fe8ff9ad455c7f50848aec73cd0c6af964890d21494d5ceb35e539541a6bedbc3a4f19d3b08adb243846e5ef3f101d4bf9cf8bd94f513b47bdc540a4cf2631a3c98aa875812ee06ad104203624bda97cc5e4c1cbe82ace303a3fb28432c7fae4ccc0dda429145808caf66dd24280b029705d7f4fb6637510aab20ca957ab9aeb1f487df14b2854d38f892e964239f76f8169f5b3f20fee1ee08ef5d1b4a16d01506275c799e10628d2c0d21be0185b65db0801846"], &(0x7f0000000080)={0x0, 0x0, [0x0, 0x0, 0x252]}) 2018/05/12 22:58:40 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}, 0x0, 0xf0ffffff}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) [ 799.868660] binder: 24722:24732 BC_FREE_BUFFER u0000000000000000 no match [ 799.906622] binder: 24722:24742 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 2018/05/12 22:58:40 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='dctcp\x00', 0x6) sendto$inet6(r0, &(0x7f00004e8000), 0xf401, 0x20000001, &(0x7f000007f000)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x91ffffff]}}, 0x1c) [ 799.934384] binder: 24722:24742 BC_FREE_BUFFER u0000000000000000 no match 2018/05/12 22:58:40 executing program 5: r0 = socket(0xa, 0x1, 0x8) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f0000000240)=0x0) sched_getattr(r1, &(0x7f0000000280), 0x21, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c6295e46ca6c09b612ec6f") mmap(&(0x7f0000000000/0x95c000)=nil, 0x95c000, 0x0, 0x44031, 0xffffffffffffffff, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000140)={{{@in6=@loopback, @in6=@mcast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@ipv4={[], [], @rand_addr}}, 0x0, @in6=@remote}}, &(0x7f0000000040)=0xe8) setsockopt$inet_mreqn(r0, 0x0, 0x23, &(0x7f0000000080)={@empty, @rand_addr=0x8001, r2}, 0xc) socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$EBT_SO_SET_COUNTERS(r0, 0x0, 0x81, &(0x7f00000000c0)={'filter\x00', 0x2, [{}, {}]}, 0x48) 2018/05/12 22:58:40 executing program 7: r0 = getpgrp(0xffffffffffffffff) getpriority(0x0, r0) r1 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r1, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r1, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140)}, 0x0) 2018/05/12 22:58:40 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00, 0xf}]) 2018/05/12 22:58:40 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)=ANY=[@ANYBLOB="aaaaaaaaaaaa8c9d494c17ee08004500001c0000000000009078ac141400ac1414bb1200907800000000"], &(0x7f0000000080)={0x0, 0x0, [0x0, 0x0, 0x252]}) r0 = syz_open_dev$admmidi(&(0x7f0000000040)='/dev/admmidi#\x00', 0x35, 0x42000) sync_file_range(r0, 0xfffffffffffff15f, 0x3, 0x0) 2018/05/12 22:58:40 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}, 0x0, 0x40030000000000}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) 2018/05/12 22:58:40 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x1c, 0x0, &(0x7f0000000040)=[@request_death={0x400c630e}, @free_buffer={0x40086303}], 0x0, 0x48, &(0x7f0000000080)}) [ 800.168783] binder: 24780:24785 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 800.201846] binder: 24780:24785 BC_FREE_BUFFER u0000000000000000 no match [ 800.254969] binder: 24780:24795 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 800.284391] binder: 24780:24795 BC_FREE_BUFFER u0000000000000000 no match 2018/05/12 22:58:41 executing program 3: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0xfffffff4, 0x12, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:58:41 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) r1 = dup3(r0, r0, 0x0) ioctl$TIOCMBIC(r1, 0x5417, &(0x7f0000000000)=0xfffffffffffffff8) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140)}, 0x0) 2018/05/12 22:58:41 executing program 6: syz_emit_ethernet(0xffffffffffffffaf, &(0x7f00000001c0)={@random="681c60622cd2", @random="8d9d494c17ee", [], {@arp={0x806, @ether_ipv6={0x1, 0x86dd, 0x6, 0x10, 0xb, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0x10}, @ipv4={[], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}, @empty, @mcast1={0xff, 0x1, [], 0x1}}}}}, &(0x7f0000000240)={0x801, 0x0, [0x0, 0x0, 0x250]}) 2018/05/12 22:58:41 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}, 0x0, 0x300000000000000}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) 2018/05/12 22:58:41 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00, 0xffffffff000}]) 2018/05/12 22:58:41 executing program 5: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f000039c000)=0x400000000000001, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x0, 0x7ef0028e, 0x0, 0xa}, 0x14) r1 = syz_open_dev$mice(&(0x7f0000000080)='/dev/input/mice\x00', 0x0, 0x20002) ioctl$sock_inet_SIOCGIFDSTADDR(r0, 0x8917, &(0x7f0000000000)={'ipddp0\x00', {0x2, 0x4e20}}) socket$inet6_icmp(0xa, 0x2, 0x3a) setsockopt$inet_tcp_int(r0, 0x6, 0x19, &(0x7f0000000140)=0x975, 0x4) ioctl$IOC_PR_RESERVE(r1, 0x401070c9, &(0x7f0000000100)={0x1ff, 0x400}) ioctl$sock_SIOCGPGRP(r1, 0x8904, &(0x7f0000000180)=0x0) syz_open_procfs$namespace(r2, &(0x7f00000001c0)='ns/cgroup\x00') ioctl$EVIOCSABS20(r1, 0x401845e0, &(0x7f00000000c0)={0x8001, 0x100000000, 0xff, 0x80000000, 0xe3}) mmap(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x2000000, 0x10, r1, 0x0) 2018/05/12 22:58:41 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='dctcp\x00', 0x6) sendto$inet6(r0, &(0x7f00004e8000), 0xf401, 0x20000001, &(0x7f000007f000)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000]}}, 0x1c) 2018/05/12 22:58:41 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x1c, 0x0, &(0x7f0000000040)=[@request_death={0x400c630e}, @free_buffer={0x40086303}], 0x0, 0x6, &(0x7f0000000080)}) 2018/05/12 22:58:41 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) getsockopt$inet_opts(r0, 0x0, 0x9, &(0x7f0000000000)=""/119, &(0x7f0000000140)=0x77) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000300)=@vsock={0x28, 0x0, 0x2710, @hyper}, 0x80, &(0x7f0000000640), 0x0, &(0x7f0000000900)=[{0x1010, 0x10d, 0x7, "75e7f5bfdd9a48240001100068d69b035e731dd61f9541efe1e46a600f5b76b97f851e3030dd57e75444841cc64e79daa98cc820900a88e9ebf4667d38c5db3bb8525660890437fc478810b05de0d1bf9b0e198c6622fcb1951226a4ba52c6e444def92ba8bd44da9ac13f81bf3dcdd04302043f35589d894b681cfd1e7299f83a595a9ce5ea156e486b9f7486114ada5d2efd274a5f8c583fb8ceda0401f1e0b53d7b388270bfb3b3142d17dfb59b27a7b23b35119e1b2825cd14c323c23106c775acf3a30e39277f9ecaecf6da978c9ccdb164e770fc0ac7c39941ae7b89e70016a2f069545d69b9a9ac200d8fcf3fd282706b8243f21bede36ecf1a863978d91731c9749819bc8efd92cc673937371dc75992fbc42ec48a85bebaa3ef448a9d7c476e8f783da7341aaebbb1c4bc6c699e8997c6510bf1f9d40dd5f2fb2251fff44b6a71bd0c28b51c125a6e65f5045dda77417483e18ac5e43a74f7ab1e424bc0224ee9f361e11514927fe8cfb22758f205a7f475150f0a66377a2c479903914ffce3bacf6283f75891f495ab2d71d0188b4604d0a20d7c0c6af31ba96e99978a9699ab12bc0ff2a5b1492f944a78edb342cf7f9ffc2475ce5c283d26ffe0c34b71d734e8aae683eb0f36c5e7bca056798fb06f7e192f477cd6006a56c55be1fcc0e41f836a3bb41c57772cc415f4c369fbd3728841f04d34daeec1a62e5e4890b0d21b84fecbbe0cd611a8b83ffc9ca10709c1fe4426d0d552e9b24c39310de6708e5f0d20f5c8f792d16a9cfb3401fb89165489121344fd3453ccf81344c54020f09beb67673b0fbae5e754da161d782b4c6f10e03feca415cfd5eb476aec539a54dbbca8e28cd6e4a24a92ae7cb5699642e32ae342c67f74a1db5f8831ad762335854c5c69538f83fec9a522439059708dee43b84e775dd6c9ba71e6e5c42678154a3cccea968cbcc8d3ec6909a8b116fcbba8c45222194a6b9bf6788e56e7dfea8dc47a97e5b54f1b650bf743e2c78aa62fd172f54ea0e92da85ee0f7fab116749a84ec619be7f05d11b5302289de230a44abdba9f383f75c781da5ca313ea27d44323bf4057a4cb9a45ccdd51183c5c27037ac2498d3d0fad3d9bf07724995aa18fb25c3c59ac149c34ad8d5ffbf4b57fe5b18e7b86238404df484fc4aa4ebf26ab1f3ccbcf01d41e39c37e6c635aba2338e07544aaadfd56c21cdb42d4f419fe488cc6e3c7f717d090c23653146e59519098032674b9188928e1c4bf9fdd726ba21d1175d743b256597cbf1cf360ee987903d563e616575f9ebf62138dcc3e14afa6b6e6b89b7442fb07544c03b68ec982bc692ced000b473f22eb5c9caff00f01c89d966b598333a4e1dd1815c8ed35fa2d384fd1c307c63ff0f8892dfab45769155694ddf957fd8d6d0b10f85f71a443c92696d05da0c07804fc8ac2078ce1d01bbcd4fa5cd27f0c296927d740d221d4156b1c361a389dfa33d9121825afaab1b1d300fa80995e29079158001f90429312a6d409b9b2c9f89a5b9d2c0a46bdb6896cc0410d9650562e9476546775d7aaca1400197dfdfe812fb7f777708c727315ac56021bc878dab1d69563558029e29af9c438f6824c9423e314ca2d444a33aff492af91dfc258ec21d4782142bb0cd34151491c8081d79dc9032f027aad5eef87965f8464ccad402149a632832f12a3a581381598d30771a61975a9043a9410d5369b3734b46226ee41e600de32ad35f5059da567392c380ca47a4911320bc0c2714811af92286429fe1026d99882ee0ccc723a94ff0bfbc94d8889b4156112628f52acdaef87089f779c31c3376e253dee79910681d6951ed795c5e9be697d83c66137d0995d6e62059ac298acb1e106cd0f9d5b2f4c28773c6967593891692c65431f9ade2d0ab2e98f6cbe816b6128a50fb6c5283aa2c1b8608c3bb8fb6a1a6bb4d50833bb5e80c033d3a79ffd355f399311b8f604cb390b2ebe070fec3ed743705d82c6ea2183ef097fad29fbc21b8ab633a6af0a98a0dc232747edca399f10632d3aba45460a2c6de925a38dc43422445cdb36d97882f64db030dbbbe9977d785fe629953dc4ca77cf0aa4d2973759efa3b05d9636e67e1f587c705fceabdc494ffbc0b5db45001558d19a45e124a8879f714e419a87a7ba4e4b794f49c4b567f68d9ff66047cd04074336c1da4f5f8f6df41a0272553c279c40d5000bcb9937fcc4ab73b3ad2490830bd3dba1cd6589790e008a45e79ff04f19f1b21875e4b6579ae89c57397f9beb1bad01b7f00cb2f3d002d3198584f11c4e9e9d284612f1d235d15193da98f942ae1fde66764085ed730277847098f5e37e6941d04659ba3c7fd20da623391abf009a228312d10d23277b5135ceaff9402d53b368825c985c83fccdaf1f053398fef2b7ee39a88e511bbbd9fd4d71acea5b98c93a1a363e0cc5b5f8b00de65bcdea1366a5add063fa9c8a5d88428ee7bc194e44d739e6ebbf661949c81b5eaf52137943a12fe4f8d9c1d36e7eee64029ff62079cd87842cfc5c1e8e62e42dea4d7d5e2ce4cb0ccaf0c98501ac89bd761841e747a700da86c4126630f0b43b4cf5deee0b0501593eaf35e0e37058276db1c507a4ae230577390b2674a43407c6d9d7acefcee4f81f5b56a6d465a4b1f94ff08ccf743752b99dd3670b728111c6b443bcb3db06bfa3f8640c76606b706ed2f1178d522ce7885676c060e99a0b5b9e80304a489d55f7055bbc0a74e29ca063e7a2035ef865e097f14486142f5e0ca7d198c4dc1d92136d74ceaf9f577f817f51fa5cd249ee8d9684d71a5acd8155547a58de2873bd57f702da8121bb3ca452ddc6524df91e2df6b186abd1775c0e84e615005051f01a926e70b1faa43e75e74feda2e2c183122384172968ab5c4d283383f4bdffcbd108233587016921ee1b192937c452435cb12a6eb2c667018c70bd147e8f00f07e4721b89d277ed393b9762ebca6d15a993a6febcc28707d804f4c1af8c946aaa4e8775cc0fc5bfe56025316e6a4744cee9ceb5d072c32a8c94c86c2570ec3c6c0adb7e5d960aeb8ae079953c87f643ebc78a3d7b01384fbf36ab6dcc95ab7b6508666f10658798a4a75804248c02d53bd81fdf81333e47e77cc10f959f35bbb69c0aac45e0b99106a5b466eb10aef0f64493ed6528a2840c22f8f2060c312dfdbf0990c6b8af3b364c3bdbc2924823de9c7c90080b46ac5ebb4ed0059651ef631457212bc7a81609c2be8997d92bcfa5cae9f2c1fd0ffd7d774ea07cbec9b5fd43def6e1466ea4846a8c0fcce1ef43dd8a6be1be594f7b4ffd82e8fdee594c63de93b77f705555ecda5bef1fbb875fcbfd4506b80b8761e35b732c9dfdc9bca246b1dce6aba9c730d767fc5d8704d63970106f5cfb52a363bd360700bb1b14f4da821ecf990d9a8b10b23de7967d94a8ad303f8d68d9bebbe7cf59468d9c8a2edf2698758183af2adc8725b7aec603eef5bbcdba54a604054121270013db84caf1428c25db7f5edce7848d06d915615493d27b636ef2d6fd4be17fa39c7ca9307d845b536bdfa9723b3371c828daaab2642b109e5f5965f41f503f804c67a79334583d38563411b39d356e05f41db0f9e2299f826ebc89e187dc4ad659b24c057c16d3ebb67408157297f36da15db28e66904f9c8d1e83facc0f1af2531cc4c24db814f3da0c1ac07ddae70ddd803b2bcff7fe7596e5153e3a3babf524da8808f1e55025624e6fc058594d5bc916fadfdb88237370616d9ab410a6473d84c2e7bba368e0738d70841550ca8445df50df07806e4b3609266197e2fa26d7a684781ac9ba11055613fa524aba24b4a3461ed4dde35bfc895cb31f9d37b24b187052766a88dd7f138b652a7390924857a96e99a613fee8060cf2a553aafdf216816b30122f116e5a7cb776e11e079ae06871bbbb005c8cbb9fdf1da9000674a43fb218d43c7526f8fd0c4d2375cb8221a380b213d971779e1c8d75accb0e3bafd34d038f6e7f3cffc22e95edc85b8549a990996a7cfb8e3b802a0d659d009fce5a7197f656084cc955d035a8d2ac3a76fa603fddc01f39876bd50f4ddf7e5fcce45082f022c51dacefd8fcc4d38420f47f53f1e4a64d3460cce60ef9d50c247e133ebdd16a6ae115e5d827c4dd873681614c529c62c22feedd6d07fe4db8dd91432f72bfffdea08bf501bc8701b5ad367282be2082c598663a6e6d7fe7b8ed71468dcfb1c48e04c4ba341b1bfbbeb72251e162e5c6832f2377489b32734bad5c4c84f0b775ac0c82921ca4e23a417b87be2f9c6f9f98eb2d156486cf27aba4240e4797543081e03ce67b674360aecd7792356de68f911c2afe3f2e742388a607ec94c23f39b4f0d57b031202b2a5239c04671f7ef3dd7112fd0e10149164d82f7a2615f4bee8db38adbc5e7e2ec6db4980be9da794b661b1be742174281e14e20a2eb87c1617544a3a080b7e52d49c10c5c77921729081a68e76b4469a2c376cf9fc6ac5d05dc23d753f7e02667669d60c79ce0d6ef788650fb1e841b630a3fb43ae0467903ccf49af5a47ee0b2a3919bc1226713496c4b5c92f3c677c2690363f63680f46e414072792c8bbdab1cee8502115f22434ef725e6e44c163394279090d84cbc63910a0a78c9865b6b92afd3b54055e02abb533e429ff9e0812e80000d9f95680a4effe2768af41f4db4fea43e2257ab02d0b3cf005199ef5acc63ec909a0f5c40fa4a79029b3be066ce05075853ad63e22bbfdc72056bd00a5bba50735794f906137eec973ef2e1c2c4440a035e215504aa37b18ca655e85a26a1bfb9993d91dbbae5fbd0c979640ab40b862bd4291ed8db570d8b0b5d68c8d846f5dc956e8a0ae9044d523647ca22076e0fd9267e7c15f98436883a41b020544c348a4702516bac1de354459baeef0a79d5b838cc487cac33a1fbfa7276d6af71d6a3f0348365243b48dc6f310ec9c1a108931480e5d7b45e0ee358b9dc7ff2fe2260ef37f5c054ad54a853221489abaa3c55caae78df528ed0dae8ae61e944b6d2cae13053da337aa34a0b00054b6495a82befa7b1c190b296d94e797fae14c95781294e909b4f1c5700b21145daccf181f2bef6779f3321cf02b5b260ab3c82cd4653db0824ba44d196c0291fe7b2d79d4a4a419e87b8e4d53504316dac0515388388a129731878af77f0ec60d5219fd506980236a39e6ac9eec80bb1ee7b22c4c25fd7b46de633074eab2687bb02a89d77d4849c512c18d52e538f6e17a50f007128625cf9d974500c602d2e2dd4fc582e54b05db786b805256b982d903d2b2cc1400a2dcdb14fe432a3dfafc097abde5e36076d9b8f8d12b420d8e3d2309130df4f6196c1fb8bb1f6c38f21430d63c5cf41c6177e56a598633c7e952ec95fe52cac43b245c3fd848559d951158ad0780531f479b025801da71082d27e4ec88beeacd4060302132bb3550c248c9c99db78e04b81ef8275034b5cd854d9f26d926a4f7b5a18994daa8899112df34b10380d9c4405c377f8877190b0ba4e67b2d53cefa25bed77ab6b6029237f129ab9436aeb23a3fa36e7790101e0372d390e206f05f44320fe176d551aa8727fe3727b287fb3c9d01db2b50cba7b30d365531be50ccd8abfd018b014114542325bbf026e928d7707318b010652587744df84b5f16bf69c089d7298ceaedfa2d1abb356f0ea6ee30914becaef801ca888079d7863bcc01256afccdf490beafafb30407a674dbb8790463203ec4883af859f41ee0cc1a321b39c3a09e"}], 0x1010, 0x40000000000000}, 0x0) 2018/05/12 22:58:41 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00, 0x900000000000000}]) 2018/05/12 22:58:41 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}, 0x0, 0xf0ffffffffffff}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) 2018/05/12 22:58:41 executing program 6: socketpair$ipx(0x4, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) syz_emit_ethernet(0x2a, &(0x7f0000000180)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaaaa08004500001c000000000012009078000000005d0303cb3ab6c85cdfaf7766e481a3b32a84c6eacafe896c97694e8ea3a2557dae0f94c3fcbed3eb8642e2fd5663fa2ef43df406656858b57199e8ab977cf941db562fc3745281be00b33e7a09077a06e6d3825c9c2fda8005f37932bf52d3b0943d10f287825b00ba"], &(0x7f0000000080)={0x0, 0x0, [0x0, 0xcbe, 0x252]}) syz_open_dev$sndmidi(&(0x7f0000002ac0)='/dev/snd/midiC#D#\x00', 0x8, 0x101000) pread64(r1, &(0x7f0000000040)=""/28, 0x1c, 0x0) write$binfmt_elf32(r0, &(0x7f0000000240)={{0x7f, 0x45, 0x4c, 0x46, 0x6, 0xa3, 0x4, 0x1, 0x0, 0x0, 0x3, 0x9, 0x4b, 0x38, 0x3d, 0xffffffff, 0x5, 0x20, 0x2, 0x7, 0x200, 0x81}, [{0x0, 0x400, 0x5e4, 0x9, 0x9, 0x3ff, 0x5, 0x9}, {0x70000005, 0x5, 0x7f, 0x7, 0x100000001, 0x0, 0x100000000, 0x5}], "95540e0fe59fcb3cecc28b8310c4fff4cff0c8381c418117c8cbcd47f3ed6290f88f69927c9a305b9f4843f164161a365349bb270257637c0a2cd0dc53c07df0ed92683ef313c7600ad50ff844741f00b6f3136e547ae024587cd1ecade8a8aaecad203d52610ea726588e05cef4ff2cc2c5b29e266643135db94dea", [[], []]}, 0x2f4) [ 801.010722] binder: 24803:24804 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 801.043633] binder: 24803:24804 BC_FREE_BUFFER u0000000000000000 no match [ 801.087612] binder: 24803:24827 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 801.124113] binder: 24803:24827 BC_FREE_BUFFER u0000000000000000 no match 2018/05/12 22:58:41 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='dctcp\x00', 0x6) sendto$inet6(r0, &(0x7f00004e8000), 0xf401, 0x20000001, &(0x7f000007f000)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x300]}}, 0x1c) 2018/05/12 22:58:41 executing program 3: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x3f00, 0x12, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:58:41 executing program 5: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8911, &(0x7f0000000200)="0000000000000010000000c742ecc0fe19bcf141ea136eac675362da3173133a19b7e7fbbcd3bb71c236c905f1aa42b4fe0b197b2c7516fa973c66067ae9c05c313fea213ae55b7658dd30c58af4a315d7687f449ff1e1dd48e902b340f9c6a1c27f560402acdbe90e57805dbb873d6189afc3f086f9f81f3be5cf7bf4a830837820967650d6c222104bf818939a508bb069472590e8dfc984415e7d048a4fd6ac9f94ddf2400bdc32653012d11ea81f2e173c93771fd7a66ebc5b2cb3ec85ef79772ee674b101a98910b2a7e62f38b9a8305c279df65f47c712262e062df50bb33ae31a86dcc29c196693da6a43") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'hmac(sha224-avx)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000080)="e0e3f35180304c74e4ad5ca328b710b9b854fcbd0b8e46495c3c05cd828857f3acfdf35e9c3fcdf453868b14ad56aa452e25b60b696458bdc4fe2683ff883ea364", 0x41) 2018/05/12 22:58:41 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}, 0x0, 0xa000000}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) 2018/05/12 22:58:41 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00, 0x4000000000000}]) 2018/05/12 22:58:41 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)=ANY=[@ANYBLOB="aaaaaaaaaaaa8d9d494c17ee08004500005c000000000000900000000000000005bb1200907800000000"], &(0x7f0000000080)={0x0, 0x0, [0x0, 0x0, 0x252]}) r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ppp\x00', 0x400241, 0x0) getsockopt$inet_sctp_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f00000000c0)={0x1ff, 0x10001, 0x1, 0xb2, 0x1, 0x9, 0x0, 0x6, 0x0}, &(0x7f0000000100)=0x20) setsockopt$inet_sctp_SCTP_AUTH_ACTIVE_KEY(r0, 0x84, 0x18, &(0x7f0000000140)={r1, 0xfffffffffffffff8}, 0x8) 2018/05/12 22:58:41 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) r1 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rfkill\x00', 0x400000, 0x0) getsockopt$inet_sctp6_SCTP_PR_SUPPORTED(0xffffffffffffff9c, 0x84, 0x71, &(0x7f0000000040)={0x0}, &(0x7f0000000140)=0x8) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f0000000300)={r2, 0xa4, &(0x7f0000000380)=[@in={0x2, 0x4e21, @local={0xac, 0x14, 0x14, 0xaa}}, @in={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x15}}, @in={0x2, 0x4e21}, @in6={0xa, 0x4e24, 0x2, @remote={0xfe, 0x80, [], 0xbb}, 0xffffffff}, @in={0x2, 0x4e23, @multicast2=0xe0000002}, @in6={0xa, 0x4e24, 0x679, @loopback={0x0, 0x1}, 0x7fffffff}, @in={0x2, 0x4e20, @rand_addr=0x3ff}, @in6={0xa, 0x4e21, 0xfffffffffffffb86, @mcast1={0xff, 0x1, [], 0x1}, 0x4}]}, &(0x7f0000000340)=0x10) r3 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r3, &(0x7f0000002000)=@ethernet, 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r3, &(0x7f0000000000)={&(0x7f0000004000)={0x1d, r4}, 0x10, &(0x7f0000002ff0)={&(0x7f0000004fb8)={0x5, 0x0, 0x0, {}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "b100"}}, 0x48}, 0x1}, 0x0) perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$can_bcm(r3, &(0x7f0000000180)={&(0x7f0000000080)={0x1d, r4}, 0x10, &(0x7f0000000140)={&(0x7f00000000c0)={0x6, 0x0, 0x0, {0x0, 0x7530}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "d300692ddfae1e24"}}, 0x48}, 0x1}, 0x0) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140)}, 0x0) 2018/05/12 22:58:41 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x1c, 0x0, &(0x7f0000000040)=[@request_death={0x400c630e}, @free_buffer={0x40086303}], 0x0, 0x1094, &(0x7f0000000080)}) [ 801.307469] binder: 24863:24866 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 801.328767] binder: 24863:24866 BC_FREE_BUFFER u0000000000000000 no match [ 801.348992] binder: 24863:24876 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 2018/05/12 22:58:41 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00, 0x2}]) 2018/05/12 22:58:41 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='dctcp\x00', 0x6) sendto$inet6(r0, &(0x7f00004e8000), 0xf401, 0x20000001, &(0x7f000007f000)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4002000000000000]}}, 0x1c) 2018/05/12 22:58:42 executing program 3: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x1100, 0x12, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:58:42 executing program 6: r0 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snapshot\x00', 0xfffe, 0x0) getsockopt$inet_sctp6_SCTP_ADAPTATION_LAYER(r0, 0x84, 0x7, &(0x7f00000000c0), &(0x7f0000000100)=0x4) syz_emit_ethernet(0x2a, &(0x7f0000000140)=ANY=[@ANYBLOB="aaaaaaaaaaaa8d9d494c17ac141400ac1414bb12009078000000008dfe66a09f250e8a72033a62e42ba37dd072e86c1bf9d1f346d0096f1450f0655c334632ee5b49a7c284c9e6a58e9ae0201d48449499c0b20badce255a01cf11b49bc999e5ce3ed90a3612a4419871dd060000005151d0431e87700fe1b44d4027e6effc93822483faa8168eb80d6f08333ccc9971a9c2e042383a52de6d244054c8b60f000052ee71721cd894c83992b388b42993a7c178aa6ec6efd7fc7a030498a41a36c18a1437d55dd60b0a4e2e5bb1517c304d6b85e3e4171278e6eb40c11021d4e84d11d1651e46a635b325bf8e5664f5da"], &(0x7f0000000080)={0x0, 0x0, [0x0, 0x0, 0x252]}) 2018/05/12 22:58:42 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}, 0x0, 0x3}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) [ 801.356968] binder: 24863:24876 BC_FREE_BUFFER u0000000000000000 no match 2018/05/12 22:58:42 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x1c, 0x0, &(0x7f0000000040)=[@request_death={0x400c630e}, @free_buffer={0x40086303}], 0x0, 0x1095, &(0x7f0000000080)}) 2018/05/12 22:58:42 executing program 5: r0 = socket$packet(0x11, 0x7, 0x300) socketpair$inet6(0xa, 0x0, 0x200000000000000, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$inet6_dccp_buf(r1, 0x21, 0x2, &(0x7f0000000080)=""/247, &(0x7f0000000180)=0xf7) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000001c0)='net/snmp\x00') ioctl$KDGETKEYCODE(r3, 0x4b4c, &(0x7f00000002c0)={0x7, 0x5}) r4 = fcntl$getown(r2, 0x9) ptrace$pokeuser(0x6, r4, 0xd, 0x2) ioctl$IOC_PR_RELEASE(r3, 0x401070ca, &(0x7f0000000200)={0x4, 0x44a, 0x1}) ioctl$sock_ifreq(r0, 0x8b0f, &(0x7f0000000000)={'veth0\x00', @ifru_mtu}) getsockopt$IP6T_SO_GET_REVISION_MATCH(r1, 0x29, 0x44, &(0x7f0000000240)={'NETMAP\x00'}, &(0x7f0000000280)=0x1e) socket$key(0xf, 0x3, 0x2) 2018/05/12 22:58:42 executing program 7: r0 = inotify_init1(0x80000) r1 = inotify_add_watch(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x4) inotify_rm_watch(r0, r1) r2 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000140)='/dev/uinput\x00', 0x400000, 0x0) ioctl$BLKIOMIN(r2, 0x1278, &(0x7f0000000040)) r3 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r3, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r3, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140)}, 0x0) 2018/05/12 22:58:42 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00, 0xfe00}]) 2018/05/12 22:58:42 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}, 0x0, 0xfffffff0}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) [ 801.518105] binder: 24897:24899 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 801.556552] binder: 24897:24899 BC_FREE_BUFFER u0000000000000000 no match [ 801.599365] binder: 24897:24912 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 801.660394] binder: 24897:24912 BC_FREE_BUFFER u0000000000000000 no match 2018/05/12 22:58:42 executing program 3: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0xfffffff5, 0x12, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:58:42 executing program 6: syz_emit_ethernet(0x2a, &(0x7f00000000c0)=ANY=[@ANYBLOB="aaaaaa304596e910038c711a966c4eb239aaaaaa8d9d494c17ee08004500001c000000000000907808000000ac1414bb12009078000000007dcb6f67281e099e77596ca368efff31aa046466c2aaaf38b00b2a9c95ba2269418d41cd9cda9798d269990fecce64fd434446d090786b"], &(0x7f0000000080)={0x0, 0x0, [0x0, 0x0, 0x252]}) r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x20000, 0x0) getsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffff9c, 0x84, 0x9, &(0x7f0000000140)={0x0, @in6={{0xa, 0x4e24, 0x1, @mcast2={0xff, 0x2, [], 0x1}, 0x281}}, 0xca, 0x5, 0x4, 0xffffffff, 0xa0}, &(0x7f0000000040)=0x98) setsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r0, 0x84, 0xa, &(0x7f0000000200)={0x3f, 0x6, 0xc, 0x20, 0x0, 0x0, 0x100, 0x400, r1}, 0x20) 2018/05/12 22:58:42 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='dctcp\x00', 0x6) sendto$inet6(r0, &(0x7f00004e8000), 0xf401, 0x20000001, &(0x7f000007f000)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x91ffffff00000000]}}, 0x1c) 2018/05/12 22:58:42 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x1c, 0x0, &(0x7f0000000040)=[@request_death={0x400c630e}, @free_buffer={0x40086303}], 0x0, 0x9410000000000000, &(0x7f0000000080)}) 2018/05/12 22:58:42 executing program 7: r0 = socket$inet(0x2, 0xffffffffffffffff, 0x10000) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000000)={0x4d0000000, 0x2, 0x5c3, 0x8, 0x80000000400}, 0x14) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140)}, 0x0) 2018/05/12 22:58:42 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00, 0x3}]) 2018/05/12 22:58:42 executing program 5: r0 = socket$inet6(0xa, 0x804, 0x0) bind$inet6(r0, &(0x7f000047b000)={0xa, 0x4e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) listen(r0, 0x80000003) connect$inet6(0xffffffffffffffff, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) sendmmsg(0xffffffffffffffff, &(0x7f0000005e00)=[{{&(0x7f00000021c0)=@in6={0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [], 0x1}}, 0x80, &(0x7f0000005c80), 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="10000000000000000d0100000ef54bfbdefb40d90b72603dcb93ffd465465cf62eb94748ef80df2fb5a3a6c1a597"], 0x10}}], 0x1, 0x0) socketpair(0x3, 0x3, 0x10001, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$inet_sctp_SCTP_EVENTS(r2, 0x84, 0xb, &(0x7f0000000080), &(0x7f00000000c0)=0xb) ioctl$TIOCMBIC(r1, 0x5417, &(0x7f0000000100)=0x8) 2018/05/12 22:58:42 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}, 0x0, 0x2}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) [ 801.775930] binder: 24932:24934 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 2018/05/12 22:58:42 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='dctcp\x00', 0x6) sendto$inet6(r0, &(0x7f00004e8000), 0xf401, 0x20000001, &(0x7f000007f000)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfe80000000000000]}}, 0x1c) 2018/05/12 22:58:42 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}, 0x0, 0x7f00000100000000}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) [ 801.816753] binder: 24932:24934 BC_FREE_BUFFER u0000000000000000 no match [ 801.847846] binder: 24932:24956 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 2018/05/12 22:58:42 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00, 0x37000000}]) 2018/05/12 22:58:42 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)=ANY=[@ANYBLOB="aaaaaaaaaaaa8d9d494c0000009078ac141400ac1414bb12009078000000000000000000000000000000"], &(0x7f0000000080)={0x0, 0x0, [0x0, 0x0, 0x252]}) 2018/05/12 22:58:42 executing program 3: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x10000000, 0x12, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:58:42 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x880, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140)}, 0x0) [ 801.884154] binder: 24932:24956 BC_FREE_BUFFER u0000000000000000 no match 2018/05/12 22:58:42 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)=ANY=[@ANYBLOB="aaaaaaaaaaaa8d84494c17ee08004500001c0000020000009078ac141400ac1414bb1200907800000000"], &(0x7f0000000080)={0x0, 0x0, [0x0, 0x0, 0x252]}) 2018/05/12 22:58:42 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}, 0x0, 0xf0ffff}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) 2018/05/12 22:58:42 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='dctcp\x00', 0x6) sendto$inet6(r0, &(0x7f00004e8000), 0xf401, 0x20000001, &(0x7f000007f000)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000]}}, 0x1c) 2018/05/12 22:58:42 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x1c, 0x0, &(0x7f0000000040)=[@request_death={0x400c630e}, @free_buffer={0x40086303}], 0x0, 0xe4ed0300, &(0x7f0000000080)}) 2018/05/12 22:58:42 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x9, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00, 0x0, 0xfdef}]) 2018/05/12 22:58:42 executing program 5: r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000040)='/dev/loop-control\x00', 0x1, 0x0) r1 = openat$urandom(0xffffffffffffff9c, &(0x7f0000001200)='/dev/urandom\x00', 0x400, 0x0) ioctl$sock_proto_private(r1, 0x89e1, &(0x7f0000001240)="6031540a044ef2e4cacfb77ae54600483119e84f6fb6d7bfb301a38eb16b8a27608333323827b34c4831d4fc670693884f6e08c432fce37561e6e15ffd6ed5f875ae55") r2 = ioctl$LOOP_CTL_GET_FREE(0xffffffffffffff9c, 0x4c82) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, r2) r3 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x40042, 0x0) write$vnet(r3, &(0x7f0000001180)={0x1, {&(0x7f0000000080)=""/4096, 0x1000, &(0x7f0000001080)=""/240, 0x1, 0x4}}, 0x68) getsockopt$netrom_NETROM_N2(r3, 0x103, 0x3, &(0x7f00000012c0)=0x80000003, &(0x7f0000001300)=0x4) ioctl$LOOP_CTL_ADD(r0, 0x4c80, r2) getsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r1, 0x84, 0x22, &(0x7f0000001340)={0x128, 0x4, 0x4e0, 0x0, 0x0}, &(0x7f0000001380)=0x10) getsockopt$inet_sctp_SCTP_PEER_ADDR_THLDS(r1, 0x84, 0x1f, &(0x7f00000013c0)={r4, @in={{0x2, 0x4e22, @local={0xac, 0x14, 0x14, 0xaa}}}, 0xfff, 0x73e5}, &(0x7f0000001480)=0x90) fcntl$getflags(r3, 0xb) 2018/05/12 22:58:42 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) socketpair$inet6_tcp(0xa, 0x1, 0x0, &(0x7f0000000080)) ioctl$sock_FIOSETOWN(r0, 0x8901, &(0x7f0000000000)) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_REM(r0, 0x84, 0x65, &(0x7f00000000c0)=[@in6={0xa, 0x4e23, 0x10000, @local={0xfe, 0x80, [], 0xaa}, 0x4bf}], 0x1c) r1 = shmget(0x0, 0x4000, 0x1020, &(0x7f0000ffa000/0x4000)=nil) shmctl$IPC_RMID(r1, 0x0) sendto$inet(r0, &(0x7f00000002c0)="993d", 0x2, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f00000001c0)=@ethernet={0x307, @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}}, 0x80, &(0x7f0000000040)=[{&(0x7f0000000100)="00c3", 0x2}], 0xae, &(0x7f0000000140)}, 0x8004) getrusage(0xffffffffffffffff, &(0x7f0000000300)) 2018/05/12 22:58:42 executing program 3: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x8c005, 0x0) io_setup(0xc12, &(0x7f0000000100)=0x0) io_submit(r1, 0x1, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x8000000000000000, 0x12, 0x1, 0x0, r0, &(0x7f0000000000), 0xfe00}]) 2018/05/12 22:58:42 executing program 2: r0 = socket(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="c626262c8523bf012cf66f") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x225, 0x0, 0x0, {{{@in=@rand_addr, @in6=@ipv4={[], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}, 0x0, 0xffffff7f}, {@in=@rand_addr, 0x0, 0x33}, @in=@loopback=0x7f000001}, 0x0, 0x80000000}}, 0xf8}, 0x1}, 0x0) 2018/05/12 22:58:42 executing program 6: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="8d9d494c17ee", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14}, @remote={0xac, 0x14, 0x14, 0xbb}}, @icmp=@address_reply={0x12}}}}}, &(0x7f0000000080)={0x0, 0x0, [0x0, 0x0, 0x252]}) r0 = syz_open_dev$mice(&(0x7f0000000040)='/dev/input/mice\x00', 0x0, 0x0) setsockopt$inet_sctp6_SCTP_RECVRCVINFO(r0, 0x84, 0x20, &(0x7f00000000c0)=0xbf, 0x4) 2018/05/12 22:58:42 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='dctcp\x00', 0x6) sendto$inet6(r0, &(0x7f00004e8000), 0xf401, 0x20000001, &(0x7f000007f000)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x500]}}, 0x1c) [ 802.194189] binder: 25002:25003 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 802.205393] binder: 25002:25003 BC_FREE_BUFFER u0000000000000000 no match [ 802.215432] binder: 25002:25017 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 802.222888] kasan: CONFIG_KASAN_INLINE enabled [ 802.228124] kasan: GPF could be caused by NULL-ptr deref or user memory access [ 802.235665] general protection fault: 0000 [#1] SMP KASAN 2018/05/12 22:58:42 executing program 7: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f00000002c0)="993d", 0xfffffffffffffe2a, 0x8000, &(0x7f0000000280)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000080)=@in={0x2, 0x0, @loopback=0x7f000001}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000100)="00c3", 0x2}], 0x1, &(0x7f0000000140)}, 0x0) [ 802.241216] Dumping ftrace buffer: [ 802.244763] (ftrace buffer empty) [ 802.248478] Modules linked in: [ 802.251686] CPU: 0 PID: 8760 Comm: kworker/u4:6 Not tainted 4.17.0-rc4+ #44 [ 802.258790] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 802.263404] binder: 25002:25017 BC_FREE_BUFFER u0000000000000000 no match [ 802.268163] Workqueue: writeback wb_workfn [ 802.268183] RIP: 0010:wb_workfn+0x195/0x1740 [ 802.268190] RSP: 0018:ffff8801aa327270 EFLAGS: 00010206 [ 802.268202] RAX: dffffc0000000000 RBX: 0000000000000000 RCX: ffffffff814e1f65 [ 802.268209] RDX: 000000000000000a RSI: ffffffff81cd306d RDI: 0000000000000050 [ 802.268216] RBP: ffff8801aa327750 R08: ffff880188b380c0 R09: ffffed003b5c46c2 [ 802.268223] R10: ffffed003b5c46c2 R11: ffff8801dae23613 R12: 0000000000000001 [ 802.268229] R13: 1ffff10035464f37 R14: ffff8801aa327728 R15: ffff8801abdaa758 [ 802.268244] FS: 0000000000000000(0000) GS:ffff8801dae00000(0000) knlGS:0000000000000000 [ 802.334172] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 802.340047] CR2: 00007f40fc2bbdb8 CR3: 00000001afc0d000 CR4: 00000000001406f0 [ 802.347304] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 802.354560] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 802.361823] Call Trace: [ 802.364407] ? __lock_acquire+0x7f5/0x5140 [ 802.368641] ? inode_wait_for_writeback+0x40/0x40 [ 802.373567] ? debug_check_no_locks_freed+0x310/0x310 [ 802.378749] ? lock_downgrade+0x8e0/0x8e0 [ 802.382918] ? lock_downgrade+0x8e0/0x8e0 [ 802.387061] ? kasan_check_read+0x11/0x20 [ 802.391201] ? do_raw_spin_unlock+0x9e/0x2e0 [ 802.395598] ? perf_trace_lock+0xd6/0x900 [ 802.399739] ? rcu_read_lock+0x70/0x70 [ 802.403883] ? kthread_data+0x58/0xc0 [ 802.407697] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 802.413223] ? zap_class+0x720/0x720 [ 802.416922] ? trace_hardirqs_off+0xd/0x10 [ 802.421144] ? _raw_spin_unlock_irqrestore+0x63/0xc0 [ 802.426234] ? try_to_wake_up+0x102/0x1190 [ 802.430460] ? find_held_lock+0x36/0x1c0 [ 802.435115] ? graph_lock+0x170/0x170 [ 802.438915] ? migrate_swap_stop+0x850/0x850 [ 802.443319] ? lock_downgrade+0x8e0/0x8e0 [ 802.447455] ? find_held_lock+0x36/0x1c0 [ 802.451502] ? graph_lock+0x170/0x170 [ 802.456684] ? lock_acquire+0x1dc/0x520 [ 802.460643] ? process_one_work+0xb46/0x1b50 [ 802.465037] ? _raw_spin_unlock_irqrestore+0x63/0xc0 [ 802.470136] ? __lock_is_held+0xb5/0x140 [ 802.474187] process_one_work+0xc1e/0x1b50 [ 802.478411] ? finish_task_switch+0x182/0x810 [ 802.482899] ? pwq_dec_nr_in_flight+0x490/0x490 [ 802.487565] ? __schedule+0x809/0x1e30 [ 802.491443] ? retint_kernel+0x10/0x10 [ 802.495326] ? trace_hardirqs_on_caller+0x421/0x5c0 [ 802.500351] ? graph_lock+0x170/0x170 [ 802.504151] ? find_held_lock+0x36/0x1c0 [ 802.508204] ? lock_acquire+0x1dc/0x520 [ 802.512280] ? worker_thread+0x41f/0x1440 [ 802.516423] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 802.521953] ? move_linked_works+0x2f6/0x470 [ 802.526367] ? trace_event_raw_event_workqueue_execute_start+0x290/0x290 [ 802.533294] ? do_raw_spin_trylock+0x1b0/0x1b0 [ 802.537874] worker_thread+0xa30/0x1440 [ 802.541842] ? process_one_work+0x1b50/0x1b50 [ 802.546938] ? graph_lock+0x170/0x170 [ 802.550739] ? find_held_lock+0x36/0x1c0 [ 802.554788] ? find_held_lock+0x36/0x1c0 [ 802.558856] ? __schedule+0x1e30/0x1e30 [ 802.562825] ? do_raw_spin_unlock+0x9e/0x2e0 [ 802.567221] ? do_raw_spin_trylock+0x1b0/0x1b0 [ 802.571795] ? _raw_spin_unlock_irqrestore+0x74/0xc0 [ 802.576885] ? trace_hardirqs_on_caller+0x421/0x5c0 [ 802.581889] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 802.587426] ? __kthread_parkme+0x1b7/0x280 [ 802.591737] kthread+0x345/0x410 [ 802.595101] ? process_one_work+0x1b50/0x1b50 [ 802.599584] ? kthread_bind+0x40/0x40 [ 802.603374] ret_from_fork+0x3a/0x50 [ 802.607081] Code: fa 48 c1 ea 03 80 3c 02 00 0f 85 ee 13 00 00 48 8b 9b 08 06 00 00 48 b8 00 00 00 00 00 fc ff df 48 8d 7b 50 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 3f 14 00 00 4c 8b 63 50 4d 85 e4 0f 84 a9 0e [ 802.626308] RIP: wb_workfn+0x195/0x1740 RSP: ffff8801aa327270 [ 802.632260] ---[ end trace b08811e7b42d07e1 ]--- [ 802.637046] Kernel panic - not syncing: Fatal exception [ 802.643021] Dumping ftrace buffer: [ 802.646553] (ftrace buffer empty) [ 802.650246] Kernel Offset: disabled [ 802.653880] Rebooting in 86400 seconds..